Tuesday, July 10, 2012

Pilot Error? Let's Talk Airplane Error in Flight 447 Crash

One heartbreaking takeaway in the 224 page final report into the crash of Air France Flight 447 is that in the year prior to the plane's plunge into the Atlantic on June 1, 2009, there was plenty of warning that something like this could happen.

I'm not talking pilot error. Far too much attention has already been paid to how the pilots handled the problems arising on the flight. It is frustrating to see the seriousness of the situation in which these men found themselves dismissed by armchair aviators.




The BEA report tells story of missed opportunities to fix a repeated problem of inaccurate indicated airspeed on the A330. These incidents - 13 are counted in the report - provide another reminder of how incidents languish until they become accidents. The A330 that crashed en route from Rio de Janerio to Paris, killing all 228 aboard, was on course to have its airspeed problem fixed, but time ran out.

Could the pilots have saved the flight had they reacted differently? Probably, but let's move on, because as the head of the
Bureau d'EnquĂȘtes et d'Analyses said last week, "this crew and most crews were not prepared to face such an event." The final report makes it clear both Air France and Airbus made their own grave mistakes in the way they handled safety shortcomings in the Air France A330 fleet.


In the 13 months leading up to Flight 447's plunge into the Atlantic, pilots flying for Air France reported nine episodes in which they received erroneous speed information. In seven of these cases, the report included the fact that the stall warning triggered. Two captains were alarmed enough by the events on their flights to add that the failure was "detrimental" or "destabilizing" creating confusion and difficulty in analyzing what was going on. (This final characterization is a regular feature in the here-and-now as the ability to design highly-complex airplanes flies far ahead of pilots' ability to understand them.)

But getting back to the report, these nine events all occurred in cruise flight and altitude having its privileges, none took the fateful downturn to become accidents. To its credit, Air France did take the reports to Airbus along with its concern that the Thales pitot probes were the problem. The Airbus reply, and I'm printing it exactly as it appears in the report, is - pardon the pun - chilling.

"Airbus stated that there was no solution that could totally eliminate the risk of probe icing, that the three types of probes installed on the Airbus satisfy criteria that are much higher than the regulatory requirements for certification in relation to icing" Let me paraphrase because I've heard this argument before. Never mind how it performs, our calculations show it is safe.


In November 2008, in March 2009, on April 3 and again on April 15th that same year, Air France brought new cases of loss of airspeed to Airbus until finally, the plane maker acknowledged the airline was right; the probes should be replaced. Air France wanted to use BF Goodrich probes, but Airbus, for reasons I did not see in the report, wanted to stick with Thales. It offered up a new model with this caveat; ice crystals was a "new phenomenon that was not considered in the development" of the probe, but the new Thales probes should fix the problem, nonetheless.


Air France would replace probes on F-GZCP as soon as the new ones arrived, but of course, it was too late. Many passengers on the ill fated flight had already purchased their tickets when the first replacement probes arrived in Paris on May 26, 2009 and six days later, those travelers boarded the plane.

Of such timing great tragedies are made. But it would also be tragic if the legacy of this crash remains at the cockpit level, mired in criticism of pilot performance.

Long before the crew boarded the plane in Rio, air travelers had already been denied the safest possible environment and the responsibility for that goes to the airline and the airplane manufacturer who having realized they had a systemic problem that could leave pilots confused and disoriented, failed to promptly fix it.

27 comments:

Jim Blaszczak said...

Christine

Once again, you have provide some very insightful comments. You hit the nail on the head by drawing attention to the pilots' confusion. I came to the same conclusion and wrote about it in my post from last week.

Jim Blaszczak

Jim Blaszczak said...

PS Here' the link to my post

http://mrknowitall777.blogspot.com/

Thanks, Jim Blaszczak

Christine Negroni said...

Thanks Jim for sharing that link. The crash you reference is fascinating. Planes change, pilots don't, I guess. Or at least pilots don't change as fast as the planes they fly.

Jan Paul Peters said...

any statement like: " .... they satisfy criteria that are much higher than the regulatory requirements for certification " in a respond to a failure report should make people suspicious from now on.

Fortunately the French BEA persisted searching the wreckage and found it after 22 months and managed to reveal the causation of the accident.

Cedarglen said...

A reasonably good popst, but like too many others it just bypasses the Pilot error issue or covers it a cloud of other lesser issues. Of course the pilots were g etting bad information - we know that. Sadly, rather than thoroughly understanding their airplane and its systems - in normal and error modes, all three of them continued asking t he proverbial, "why is it doing that?" rather than find ways to oftain the data necessary to control and save their airplane. There WERE ways around the problem, if they had looked in the right places. Was their training lacking? Heavens yes! they still blew it, especially the 'highly experienced' captain. Responsible pilots would own the problem, demand that the training be improved and simply not fly that airplane until they were damn sure that they could overcome a situation such as occured on AF-447. That's why pilots need to thoroughly understand ALL of the interaction of the systems on their 'smart' airplanes and know when to turn-off the automation and had fly the SOB if necesssary - in t he air, not in the water. A perfectly healthy airplane, save a couple of iced pitot tubes COULD have been flown out o f that mess. Shame on Air France and AirBus, but also shame on them, especially the 'experienced' Captain. I hate to see it as much as anyone else, but it is still pilot error.

JP Mainville said...

Cedarglen, I agree the flight crew made the final errors which brought this plane down. The concern I have is the shortsightedness of your comments.

Accidents are rarely caused by a single circumstance. Multiple errors and opportunities for prevention almost always exist. Does the training need to be reviewed? Of Course! But would this guarantee this accident would never be repeated? Most likely not!

It is important to find all causes, specifically those related to the incident but contributing factors should not be ignored. As Christine points out in her article, it was possible to put systems in place (make engineering changes to the aircraft) to prevent the crew being placed into the conditions that led to their errors. These must not be ignored simply because we know that the accident would not have occurred without their error.

Christine Negroni said...

JP is correct. As one could say the crash would not have happened without the pilots' errors, the crash would not have happened had the instrumentation been giving the flight crew correct information. And on and on and on up the chain. Otherwise, why bother with the investigation? We've known since the FDR was recovered that the pilots did not respond correctly. But that cannot be the end of the story or all the other needed fixes will go unaddressed.

Denis Caruana said...

The only failing in Christine's blog is that she is too polite.

By contrast Cedarglen is presumptuous to the to point of being obnoxious.

Armchair aviation experts seem to crawl out of the woodwork at times like these and they all have the same failing: the short-sightedness to blame the the guys caught holding the short end of the stick sprouting from a whole tree-trunk of design, certification, operational and training failings.

Because human factors are difficult to asses and counteract we sweep the problem under the carpet. The human vestibular mechanism has not yet evolved and adapted to the alien environment that it is subjected to in an aircraft. Pilots are given visual cues on their instruments which are in direct conflict with other sensory receptors...or that "seat of the pants feeling". As much as we train, the first reaction will always be subservient to the vestibulum.

Cedarglen's disparaging "parenthesis" of the Commander's experience is indeed obtuse. The Commander had only been in the flight deck for two minutes and forty six seconds before the CVR stopped recording. He did not have time to settle in his seat let alone assess and control the situation. This begs the question: is Cedarglen qualified to fly an A330 standing behind the pilots seat?

What is evident is that, in the flight deck, the more critical the failure, the less things are what they seem to be and woe betide any pilot who does not understand the idiosyncrasies of perceptual design. The Helios crash is testament to this; why should the same warning have a different meaning, leaving the crew to their own devices to understand why the manufacturer could be so devious.

There is only one thing that we can learn from this accident: The industry and certifying authorities have let the pilots ( and of course, the passengers) down.

The root cause of the problem resides with the pitot sensors and their inherent design inability to cope with ice-crystals. Had the pitot static system not failed, I would not be making this post.

So, lets design an airplaine that is really "smart" and is in tune with the humans behind the controls.

Your really cannot change the way people work, but you can change the environment that they work in. This is what aircraft designers should be focusing on.

Christine Negroni said...

Well, Denis, I'm liking the characterization that I'm polite because earlier this week an Alabaman taking offense to an earlier post said I was not.

Anyway, regarding your comments about the Helios pilots and their confusion with the altitude warning/improper takeoff configuration horn, the circumstances are quite similar in one way. With Helios there were several precursor events that should have led Boeing to conclude the horn might not alert a hypoxia-impaired crew. For more on this, I'll urge you to read my article on the subject which you can find here.
http://www.thecrashdetectives.com/uploads/The_Crash_Detectives_chapter_1_webv.pdf

Stefan Sobol said...

Certainly there were some system failures, but when the plane is pitched way up and the engines are at full power and the altimeter is unwinding rapidly, any pilot should be able to tell you that something isn't right whether the airspeed indicators are working or not. Sitting there and saying you don't know what is happening shows a fundamental lack of understanding how an airplane flies. In at least some of the Boeing aircraft (maybe all) in the QRH there is a checklist item for "flight with unreliable airpseed indications". This tells the pilot that with a certain thrust setting and pitch attitude, the plane will be flying at a certain speed (more or less). This allows the pilot to maintain control of the airplane without reference to the airspeed indicators. I would hope that Airbus provides similar information in their QRH. If it was there, the question is why the pilots did not refer to it.

Shem Malmquist said...

Most interesting. Christine (and those supporting her position) are correct of course, but what is interesting is that those that are arguing otherwise was clearing suffering from the same thing that killed AF447. Confirmation bias. There is a little fundamental attribution error coupled with it, of course!

http://airlinesafety.wordpress.com/

Shem Malmquist said...

Hmm, "clearing" should have read "clearly". Typing too fast and failure to proof read. That's a different sort of error.

AcesAero said...

I’ve personally experienced, in a Boeing 757, similar conditions and indications as the Air France 447 accident while skirting convective activity in the weather at FL280 most likely due to supercooled water drops since the SAT was -15 degrees. We lost all airspeed indications causing the autopilot to pitch the plane up into a 2000 fpm climb, the auto throttles to retard toward idle, and multiple flight control and air data computer caution advisories and warnings. As the pilot flying, I had to manually fly the plane using pitch and power as taught to me over 30 years ago by the USAF. Although unexpected and confusing, I recovered the aircraft and landed safety at our destination. What did I do differently than the Air France pilots? See my blog for that answer plus my opinions that were written prior to the final mishap report.http://acesaero.com/air-france-447-a-non-bureaucratic-assessment

AcesAero said...

I’ve personally experienced, in a Boeing 757, similar conditions and indications as the Air France 447 accident while skirting convective activity in the weather at FL280 most likely due to supercooled water drops since the SAT was -15 degrees. We lost all airspeed indications causing the autopilot to pitch the plane up into a 2000 fpm climb, the auto throttles to retard toward idle, and multiple flight control and air data computer caution advisories and warnings. As the pilot flying, I had to manually fly the plane using pitch and power as taught to me over 30 years ago by the USAF. Although unexpected and confusing, I recovered the aircraft and landed safety at our destination. What did I do differently than the Air France pilots? See my blog for that answer plus my opinions that were written prior to the final mishap report.http://acesaero.com/air-france-447-a-non-bureaucratic-assessment

Karlene Petitt said...

So much "could have/should have." I wish it were possible to make equipment that doesn't fail. As one that says, "never say never"...It's not going to happen.

Our aircraft manufacturers should build the best planes possible. But things break. Planes break. This is why it's up to the pilots to "know" how to fly.

Unfortunately people break too. Did this crew crack under pressure? I don't know.

What I do know is you could ask any pilot if they are at altitude and they now nothing else... all their instruments are gone... what will happen if they pull the controls back?

I will tell you they all "know" the plane will stall.

Did he panic? Was he prepared? Was he trained? Did he understand aerodynamics?

The real issues should be taking a step back, and looking at the type of training, and the length of training, that the pilots on automated aircraft are getting and ask yourself why is the FAA approving this? Is it enough?

When something happens like this, it's a wake-up call. On many levels. If we place blame on a component of "the" system, instead of looking at the whole, our focus will be very limited, and we won't be addressing what really needs to be addressed.

Jim Blaszczak said...

Amen Ms. Petitt. Flying an automated airplane is exactly like flying the earlier generation aircraft only different. It is the whole system that must be looked at in context. I absolutely agree!

Anytime humans are involved there are many avenues for system failure. Why must the patient wear a colored wrist band when having a procedure done? So the doctor knows it's a colonoscopy not a vasectomy. Why must the highly trained Board certified orthopedic surgeon sign the limb he is operating on?

There are many other reasons why humans do the wrong thing even when they have been trained to do the right thing besides incompetence. It's not that simple.

Well said!!

Karlene Petitt said...

Thank you Jim. I have this theory~
A competent, mentally healthy, rested, trained pilot can fly a broken plane to success. But a broken pilot in control of a perfect plane, we could have problems. Now take the broken pilot and have the plane break too, we're looking at another catastrophe.

Broken means any of the above lacking...poorly trained, health, fatigue...etc.

Jim Blaszczak said...

I am enjoying this dialog.

Terrorists not withstanding, no airline pilot, on any flight, has ever intended to achieve anything less than the best outcome.

Consider this.......Unlike airplanes, humans are always "broken" to some extent. Even competent, mentally healthy, rested, trained humans can "miss the gorilla", (see www.theinvisiblegorilla.com) The human that knows they're not ok is OK, but the human that thinks they're ok is NOT OK.

To err IS human. The question is, What do we do with that reality?

Karlene Petitt said...

I love the invisible gorilla. We watched that at an instructor's meeting many years ago. It speaks volumes on the power of concentration and how we can miss something so huge.

The real problem with the pilot personality (which is a good problem on most cases) that we can do anything. We are the worst to diagnose ourselves. So if there is an issue, we travel down that great river DeNile.

Okay...back to watch the gorilla movie again. :)

Uncle Rimley said...

I'm surprised that no-one has cited the basic Airbus premise in design: 1) The computer can make better decisions than the human crew; and 2)"Il fait avoir d'confiance." ["You (the crew) must have confidence."]
AB's decision to replace movable controls (yoke & throttle levers) with force transducers deprives the PNF of a critical source of cognitive input - what the PF is doing, without having to parse three levels of abstraction.
The only crewmember missing from AF447 was the dog to bite the PF and keep him from touching anything.

Grumpy said...

Interesting that none of those commenting raised the subject of "Corporate Culture." AB early on professed "Il fait avoir d'confiance"; "You must have confidence." Confidence that the computer could/would fly the plane better than a human informed its entire concept & design culture, trickling down to operators of their planes. We have not seen the last of problems which arise from that misplaced trust.

Manny Puerta said...

Ref Karlene's comment on July 13...

Well said, and I agree, but I think there were those in the industry who provided wakeup calls ref pilot performance during automation failure, and no one really listened. Now we have a body count wakeup call in the form of AF447, which appears to be making a difference. Unfortunately, real reform is usually driven by body count instead of listening to flight operations and training experience mis-characterized as bloviating dinosaurs. Body count, as sad as it is, is historically the big motivator for real change.

Jim Blaszczak said...

Three current and qualified pilots on the flight deck of that aircraft. The CVR transcript clearly indicates that none of them understood the predicament they were in. It is hard to recover from an aircraft state that you don't understand.

The result is the most accurate indication of the effectiveness of any process. Sure looks like the training these pilots received to identify and manage their situation was not effective.

There are many links to the chain that resulted in the loss of AF447. Lack of desire to recover the aircraft was not one of them.

Anonymous said...

Pilots should be trained for fighter jet flight as well as passenger jet flight. If a pilot knows enough about how an aeroplane works and has the necessary manual controls and rigorous training, he or she should be able to fly a plane, whether it be an airbus or a eurofighter. If the Airbus didn't have good enough manual controls (and I've heard it didn't even have an Angle of Attack indicator!) then it's just no good. Autopilots are not there to do everything.

Anonymous said...

pilot error,and pilot error only. an airbus a330 cannot sustain flight at 15 degrees nose up at 38000ft. just commonsense,nothing else. 85% n1,and 3-5 degrees nose up,fly the plane,and stay alive..hell,they weren't even watching their heading,and started turning,stalled,back to brazil,before the atlantic stopped them.

Anonymous said...

http://stallwarning.wordpress.com/

Shem Malmquist said...

An article outlining the issues here:

http://airlinesafety.wordpress.com/2014/04/21/the-role-of-cognitive-bias-in-aircraft-accidents/