AF447 and the loss of control epidemic

Including Air France flight 447, there have been twelve fatal loss-of-control airline accidents since the year 2000.


Altogether, they have killed 1,394 people.


The common factor in all of them was pilot inability to recognise what was happening and to do something effective about it in time to save the aircraft.


So what we’re looking at here is an issue of human cognition.


Since the release of the cockpit voice transcript by the investigators of Air France 447,  the fact that the pilots were totally at a loss to understand what was happening to their aircraft has become distressingly clear.


Before I start digging down into the immensely complex human aspects of this accident, I must make clear that, even when the BEA’s final report comes out, we’ll still be guessing at what was going on in the heads of the three pilots in charge of Air France 447.


But even if, after the final report, we are left guessing about what was actually going on in the pilots’ heads, that does not absolve us from the responsibility of attempting to understand it.


Because unless we do understand, we can’t work out intelligent ways to deal with these problems of pilot cognition and lack of situational awareness.


In Air France 447 the pilots were confronted with a situation they clearly didn’t recognise,


or didn’t believe,


or didn’t understand.


They never appeared to come close to appreciating what they could do to save the aircraft, because they didn’t understand what they were seeing.


The essential question is: how can that be? These pilots were fully qualified to operate this aircraft, and the same was true of the pilots in charge of the 11 other cases of loss of control since the year 2000.


I said before, understanding these events necessitates an understanding of human cognitive processes, and of how they are sustained.


Cognition has many components. Let’s go back to those three words I mentioned, which describe what pilots have to be able to do when they look at an aircraft’s instrument panel: recognise, believe, understand.


If the Air France 447 crew had recognised what the flight and engine instruments were telling them, had believed the information the displays were supplying,  and had understood the whole picture conveyed by the numerous sources of data, they could have recovered that aircraft to safe flight at any point in the trajectory, except the final minute or so of flight.


What is in danger of happening following AF447, is that the industry reacts to this accident by trying to design the pilots totally out of the loop and to replace them with automation.


But the irony of that course of action would be that, in the case of Air France 447,  the fatal sequence of events started with the automation disconnecting because it could not cope, leaving the pilots to fly the aircraft without it.



The problems for this crew started when the autopilot and autothrottle tripped out,  and the aircraft’s control system shifted out of normal law into alternate law.


In normal law, the crew have full, automatic flight-envelope protection.

In alternate law, the pilots themselves are entirely responsible for keeping the aircraft’s flight within its safe performance envelope. Just like the old days.


Just, in fact, like most airliners still flying today.


The reason the automation tripped out is the GIGO principle that applies to all computing: Garbage In, Garbage Out.


An aircraft’s automatics are designed to trip out when they recognise they’re being fed unreliable data. Because if computers are fed incorrect data, their output will be incorrect, and this could lead to disaster.


So they hand over control to the pilots.


In Air France 447 this is where a minor technical problem became a major one, because of the pilots’ misapprehension of what was going on and why.


That misapprehension was certainly not inevitable, but it was – and remains – a likely product of the way aeroplanes have changed, while airline pilot recurrent training has not evolved to take account of the differences in the modern flying task.


I maintain that what happened here is a symptom of the fact that the aviation system itself has already taken airline pilots out of the loop.


It didn’t intend to, but that has been the effect.


When aeroplanes didn’t have flight management systems, pilots had to work out their navigation and aircraft performance on paper. Planning a complex descent in difficult terrain while flying on instruments  would require a combination of mental arithmetic and the use of pages of tables in the flight manual, or the use of a circular slide rule, or both.


The effect of doing these things with raw data meant that the pilots were more mentally engaged in the aircraft’s trajectory planning than they are now.


With the old system, they could still make mistakes, and many lost their lives through their mistakes, but they didn’t come to grief by losing control of their aeroplanes.


Air France 447 was a loss of control, or lack of control accident. The acronym LOC covers them both, and the result is the same.


LOC is becoming a modern phenomenon. Before Air France 447, it had already become the biggest killer accident category.




Pilots have no need to do their detailed calculations and trajectory planning any more because the FMS computers are more accurate than anything they could do.


One effect of this is that pilots become passive recipients of  pre-packaged information, which is both accurate and intuitively presented, and thus seductively credible.


If it were ever to lie to you, it would lie so beautifully you would believe it.


The trouble is that, although pilots are given initial training in the mental skills needed to fly without automation,  modern flying on the line does not give them any practice at using these skills.


And because recurrent training doesn’t provide the practice either, the mental skills atrophy, and so does the knowledge and awareness that practice confers.


It wouldn’t matter that such skills should atrophy if an aircraft’s automatics could be guaranteed never to fail or, as in the case of Air France 447, never to withdraw their services for good reason.


Unfortunately, computers will occasionally fail.


The task the airline industry faces is rebuilding the pilot skills that automation takes away from them.


Contrary to a lot of comment you will hear, this is not a function of the atrophying of manual motor skills, it is brain skills and awareness that is being lost.


I would qualify that statement about loss of manual skills by saying that flying on instruments is a skill that needs frequent practice, because it requires sophisticated cognitive skills.


But even in instrument flying, it is not the loss of motor skills that’s the killer, it’s the loss of that ability to recognise, believe, and understand what the instruments are telling you.


But the loss of these skills is being covered up by the cleverness and reliability of flight management systems and the autopilot/autothrottle systems that they direct.


Even the pilots don’t know whether they’ve lost these skills or not.


They don’t find out unless the automatics fail. And with the stress of a systems failure reducing your brain’s capacity to take good decisions, that’s a bad time to find out you no longer have the skills to cope.


Just a simple analogy for you about the loss of skills: I recently discovered I had forgotten how to do long division. I don’t need that skill any more because my calculator has rendered it redundant.


But my life and the lives of those around me do not depend on these atrophied skills of mine.


Whereas a pilot’s cognition of what’s going on, gleaned from raw data sources when that’s all there is left, is essential for survival.


The training regime pilots are required to undergo is the underlying cause of Air France 447.


The training regime is not set by the airlines, it is set by the world’s civil aviation authorities. They have failed to update pilot training requirements to take account of the massive changes in the nature of an airline pilot’s job with the arrival of modern, highly automated aircraft.


So it’s the world’s civil aviation authorities who, above all others, shoulder the responsibility for Air France 447, and for the eleven other loss-of-control flights since 2000.


Let me list them. And remember these have been the cause of 1,384 unnecessary deaths:


2010 Afriqiyah Airways A330-200, Tripoli airport approach, Libya

2010 Ethiopian Airlines Boeing 737-800, in the Mediterranean Sea near Beirut

2009 Yemenia Airbus A310-200, in the Indian Ocean near the Comoros Islands

2009 Air France A330-300, South Atlantic

2009 Caspian Airlines Tu-154M, Iran

2009 Colgan Air Dash 8 Q400, Buffalo, NY, USA

2008 Aeroflot Nord 737-500, Perm, Russia

2007 Adam Air Boeing 737-400, Java Sea near Sulawesi

2006 Armavia Airbus A320-200, Black Sea near Sochi 

2004 Flash Airlines 737-300, Red Sea near Sharm el-Sheikh

2000 Gulf Air A320-200, Arabian Gulf near Bahrain 

2000 Crossair Saab 340B, Nr Zurich, Switzerland

This has to stop, and a modernised system of training for pilots that recognises how automation is causing essential skills to atrophy, is the only way of doing it.





, ,

15 Responses to AF447 and the loss of control epidemic

  1. Tim Rees 4 August, 2011 at 4:38 pm #

    Hi David, I really appreciate your article and insight – there is a raging debate over “experience” vs “competency-based” training of new pilots and I think this will continue.

    I do see a very clear link between pilots and ATC with the changes in automation. ATC skills are also being slowly deteriorated by automation and we do not understand what this means if automation fails (or lies) – I think we should broaden your discussion to beyond just pilots.

    I heard a very interesting presentation by Capt Richard De Crespigny on QF32 emergency and he stated that with the many checklists that they faced, they had to use human rationale to clearly understand what the computer was suggesting they do – the stand out was to transfer fuel from one wing tank to another to stabilize the aircraft – even though the tank had holes in it and was leaking fuel – again the human element was so important when facing abnormal situations.


  2. Colin Guilliatt 4 August, 2011 at 4:51 pm #

    Years ago, not long after the Wright Brothers, when I wanted a professional licence one had to have accumulated 700 hours atleast before one could attempt the flight tests for a professional licence! I for one instructed,did parachute dropping and built up lots of experience. Now a professional licence is obtained in little more than 250 hours obtained in simulators and classrooms. Try air taxi for a few more years no wonder with modern cigar tubes junior F/O’s are unsure whats going on! May I also suggest all new aircrew have a good 10 hours in a taildragger and some basic handling skills might return.I have been an instructor at commercial level and now an examiner at PPL level and believe that standards are falling despite what the regulators believe and have us believe.

  3. David Learmount 4 August, 2011 at 4:55 pm #

    Colin, I hear what you say, but you can have all the experiences you talk about, and then if you don’t use them for years afterwards in a highly automated flight deck, you will lose the cognitive skills from lack of practice.

  4. John Strickland 4 August, 2011 at 7:23 pm #

    David, An excellent and insightful piece into this tragic loss of life. For someone with an industry commercial background such as myself, with a technical awareness but limited detailled understanding, it only serves to underline the critical importance of human beings in stressful operational situations regardless of automated or sophisticated decision support systems. I hope that those with the responsibilities which you describe take heed of your advice

  5. Oluf Husted 4 August, 2011 at 11:55 pm #

    Dear David,

    Thanks for your call for better pilot training in icing/LOC situations. I would add:

    The 2002 Taiwanese Transavia ATR 72, GE 791 (cargo flight) and Colgan Airs 2009 crashes to your list of: Loss-of control flights since 2000.

    The taiwanese government and the french BEA send out a world wide warming,
    in 2003, calling for better pilot training, so did everybody after the Colgan crash.

    In september 1995, Javid Karin wrote his thesis, at Cranfield University, about:

    “An Investigation Of Aircrafts Accidents And Incidents Attributed To Icing And Cold Weather Operations”

    Mr. Karims results indicated:

    “A general lack of crew awereness and training concerning winter operation”
    (out of more than 50 airlines interviewed only Finnair stod out as a usefull model)

    On my webpage: from 2005, I wrote four articles called:
    “The Pilot in Commands Catch 22″ nummer four was about: “High altitude airframe icing”

    In the 31 Juli – 6 august 2007 Flight International, I had a LETTER:

    “Captains: exert your authority”

    Ending with a call for: Better pilot training or flying without pilots at all, selling the cockpit seats to passengers pretending to be in control.

    David, what good is warnings, when nobody seems to listen?

    Oluf Husted
    Slagelse, Denmark.

  6. Ian - New Zealand 5 August, 2011 at 12:36 am #

    Hello David

    I’m not a pilot, just an aviation enthusiast so please forgive me if you think this question is a silly one. Regarding AF447, it seems to me that the biggest single factor in the loss of the aircraft was the failure of the aircrew to recognise the high angle of attack that was maintained over the last few minutes of the flight. Do modern flight decks not include an artificial horizon instrument any more?

  7. Former Captain 5 August, 2011 at 12:41 am #

    Hi David

    Thanks to your work and that of the Wood’s Hole Oceanographic Institution and the Bureau d’Enquêtes et d’Analyses, enough is now known about this accident to start looking for useful lessons, to analyze the data along with the BEA. Flight safety and the future of the piloting profession depend on this becoming a wide and serious conversation.

    To slow things down, let’s start with one minute of the flight.

    2:10:51 Pilot Flying (right seat) maintains back pressure on the sidestick, causing the Trimmable Horizontal Stabilizer (horizontal tail) to move from 3° nose-up to 13° (more or less full) nose-up in one minute. This is because autotrim is still active in Alternate Law.

    This movement goes unnoticed. The only notice of THS movement is the rotation of the trim wheels.

    Is the aircraft recoverable from deep stall by elevator alone with the THS at 13° nose-up?



  8. David Learmount 5 August, 2011 at 9:30 am #

    Modern aircraft still have an artificial horizon. You will notice that the aircraft attitude was not mentioned in the dialogue between the pilots. The speed was, the height was, but not the attitude.

  9. John 5 August, 2011 at 9:40 am #

    Yes, and when a certain Captain who was acting as a Co-pilot wanted to fly the aircraft manually for a sector or two because he had a base check coming up and needed the practice, he was not allowed to do so.

    He flew the aircraft anyway and got the sack for it. What a waste of good quality experience because somebody has gets a monk on (was it PMT?) and difficulty with the Co-pilot being more senior than the Captain for the day? Talk about cutting nose off to spite face!

    They say that the crew of the future will be Pilot and Dog. The Pilot is there to feed the Dog and the Dog is to bite the Pilot if they touch anything. It looks like is about to happen. I am pleased I am not part of it and do not travel in automated cigar tubes any more.

    At a certain flying school in the north there is an instructor who does not teach stalling. i recently had one of his students for a Night Rating. The PPL could not land the aircraft in the day time, let alone at night so I enquired about his training for the PPL training. It transpired that he only did ONE flight as exercise 10 (no specifics) and bent the noseleg on his first solo flight.

    My comment? If there are pilots out there with this kind of inferior training, what chance do they stand later? Snowball and Hell come to mind. The passengers in the back are entitled to be able to trust the flight crew when the chips are down.

  10. Andreas 5 August, 2011 at 11:33 am #

    You can probably add the Afriqyah 771 crash with 103 killed to the list.

    While this is a terrible list, the counter-question would be how many lives have not been lost due to automation?

    How do you propose that pilots keep up with these skills? Make them take mandatory flights in non-automated planes?

    Thank you for a thought-provoking piece.

    All the best


  11. David Connolly 5 August, 2011 at 12:42 pm #

    LOC epidemic eh ?, I like your way of thinking David. BTW, excuse my tiresome pedantry, but AF447 was an A332, not an A-333. I think this confirms that your “Long Division Skills” are current, contrary to your promulgated loss, reports of which seem much exaggerated. Further, we will always be left guessing what transited the minds of the 3 AF447 musketeers, all for one, done for all. A CVR is not contextual, nor clairvoyant.
    I have sympathy and empathy with the clueless Clouseau crew of AF447 though in and of their collective failure to “recognize, believe or understand” their terminal predicament. While beyond fiction, It was fully salvageable from FL355, when the PIC reentered the chaotic flightdeck. From which, had PIC Marc Dubois, chronologically aged 58, exercised non-CRM executive command from “sleeping command delegated culpability” of a waking nightmare of panicked disbelief, salvation was possible, as you say.
    Command is delegated, responsibility as CRM is shared among many in strategy but one tactically, namely the PIC. How should Marc have executed non-CRM tactical command after office reentry @ FL355-stalled ?
    My CRM-non MCC view(a crew is multi-plural by definition, it does not need an EASA oxymoronic multiplier, that’s Euro-fudge regulators for you) would be a less than one minute conversational observational analysis and collar grabbing extraction of the PF-PNF-PF from his seat and executing a “push-power-rudder-roll” muscle memory, then with some cognitive margin restored, calmly take stock, ignoring the screaming slipstream, with a 2.5 minute max recovery window, excluding the last minute of which the recovery window was closed. Excluding temporal distortion, that is really a literal lifetime. The CRM-breakdown would then be best discussed at a long desk at destination without an adrenal fueled pulse rate on the flightdeck.
    At the end of the terminal day, professionalism is bringing more to the occupation than required by regulation, indeed it is beyond regulation. And bearing in mind, that in all hues, regulation is political vindication and public comfort-always, it is best to be hyper-skeptical of regulatory solutions.
    Your last comment of -“So it’s the world’s aviation authorities who, above all others, shoulder the responsibility for Air France 447, and for the six other loss-of-control flights since 2000”, is one with which I strongly disagree. This is a bit like prayer being the last refuge of the scoundrel atheist in which a single penitent implores a deity for the suspension of the laws of the universe for that penitent, confessedly unworthy. Regulation should only be a broad principle not rule based, as rules will be broken, bent or circumvented or all three.
    No-this is primarily the responsibility of the operating airlines in general and Air France in particular. Their statement of July 29 in response to the BEA is evidence enough of their culpability in training deficit in general and their company culture in particular. Air France’s hull loss rate of the past 50 years bears mute testament to this cavalier culture too. And needless to say, they always look for an external scapegoat. Their howling wheeze of frivolity of suing Continental for the loss of their Concorde speaks volumes. In this case, they will pursue Airbus/Thales with the peripheral issues of the stall warning and pitot heat. All valid concerns, pardon the pun, per se, but more peripheral canard than central in causation in AF447’s case.
    On most Boeings, the AP/AT will remain engaged with unreliable data, but it is strongly recommended to disconnect and hand fly, they don’t do too much abdication.
    But as AF447 demonstrated, Alpha floor expectation bias can lead to an oceanic floor via a lack of control leading to a loss of control. Training hard to fight and flight easy is to be recommended in recurrent sim details, with the instructor pulling a non-scripted surprise or the sim PF simulating a sudden seizure and hauling the plane into a stall and get the PNF/PM to execute a recovery. We all fail in every day and in every way, we can only train and hope to fail better in future. Opportunity comes to pass and not to pause.

  12. peter bore 6 August, 2011 at 11:32 pm #

    Question 1.
    How much did Air France save in the past ten years by not training pilots to cope with high altitude stalls and by not having two captains on long-haul flights?

    Question 2.
    What will be the total financial cost to Air France of AF447.

    The cost to the crew and passengers is of course incalculable.

  13. Treadworm 7 August, 2011 at 9:48 pm #

    Dear David, we would not be discussing AF447 if the equipment which we have been using for the measurement of Indicated Airspeed for about the last 100 years had kept pace with the rest of the Aircraft equipment. I wont mention manufacturers but in 2007 there were multiple reports of Icing up of Pitots on Airbus Aircraft. A recomendation was made to change them. I had encountered erratic Airspeed in cloud and changed them all on my Airbus to a different manufacturer from the installed Pitots. These two Kids were sold down the river by the Training System and Equipment failure. This is incredible and unforgivable in 2011.
    In our flying careers most of us will have experienced Airspeed failures several times. Fly Attitude and carry on. The first rule I remember in the RAF…… Power Attitude Trim. Its one we never forgot and it worked every time. Simple.



  14. chris shrimpton 17 August, 2011 at 5:51 pm #

    I learnt to fly when jet upsets were fresh in the industry memory. Those aircraft that had survived the “death plunge” were usually severely stressed or badly damaged (Air China 747 – >30,000ft to recover!). Thus we were taught not to stall the aircraft at high altitude.
    If we put aside the initial airspeed indication issue, AF447 was lost because the PF appears to have applied a sustained full nose up command which resulted in a 3000ft increase in altitude @6000ft per minute. This would be an excessive command at any altitude, let alone at the edge of the cruising flight envelope, and the result was a dynamic stall. What is amazing is that the aircraft didn’t drop a wing and roll on it’s back.
    Having taken the aircraft out of the flight envelope, the only hope of saving the aircraft would have been an immediate “classic” nose down stall recovery but this opportunity was lost by ignoring the valid stall warning. The continued application of this nose-up command ensured the aircraft was held deep into the stall and the speed got so low that the slow speed de-activation of the stall warning occurred. The aircraft behaved exactly as designed.
    Amongst the questions this poses are:-
    Is the aircraft so difficult to fly in the configuration it was in that the PF was not skilled enough to control the aircraft?
    Did the PF have a proper understanding of the flying characteristics of of the aircraft when in “alternate law”?
    Was the PNF too distracted by the multitude of abnormal warnings to be able to monitor the PF?
    Did these two pilots have an adequate understanding of the performance implications of operating this type of aircraft close to the edge of the flight envelope?
    If the answers are NO, YES, NO, YES, then we might assume that there is something missing from the information we have so far. How much of the data recorded by the FDR was displayed to the pilots? We know the speed indications were erratic but what about VS, Attitude, Altitude, Stab trim position and AOA?
    If YES, NO, YES, NO, then we must sadly conclude that these pilots had not been adequately trained to operate this aircraft.

  15. alex 14 September, 2011 at 6:46 pm #

    Certainly, as with most accidents, there were more than just one contibuting factors.

    You identify the lack of authority guidance with respect to training as major factor. I do not dispute this point.

    In my opinion however, your conclusion approaches on politics.
    Pilots should never engage in politics, I think.

    Having read the preliminary accident report, I cannot share your finding.

    I am missing the following (human) factors in your train of thought:
    - complacency, leading to failure
    to adhere to trained and established procedure
    to follow ECAM
    consult QRH for pitch and power values

    - lack of airmanship by
    probably neglecting EADI as primary instrument and applying full control deflection at high speed and altitude, despite the fact that the EADI would probably have given correct information

    I do not belief more SEP time will cure this problem – let alone taildragger time. I don’t see how this aids in understanding jet-mechanics. By the by, this problem is not in the hands. It’s is in the head. Complacency manifests itself in slackness. It starts with a sloppy, ineffective briefing.

    The call “pilot error” is easily made and often a welcome excuse when in need for a scapgoat. However, I think it is as hypocritical to divert attention from pilot error, when they did screw up royally.

    It can happy to any of us if and as soon as we decide to switch-off our heads and go cowboy.

    It is my belief, that this particular accident could have been prevented even without additional authority /regulatory intervetion.

    I am not suggesting that I would have done a better job. Hindsight is a b*#ch, after all.