The Long Way Down: The crash of Air France flight 447
Note: this accident was previously featured in episode 10 of the plane crash series on November 11th, 2017, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
In the early hours of the first of June 2009, Air France flight 447 from Rio de Janeiro to Paris disappeared in a radar dead zone over the mid-Atlantic. The Airbus A330 with 228 people on board had vanished into the night without a distress call, leaving behind little to explain its sudden and dramatic end. What could have brought down a modern passenger jet, flying for a world class airline, during what should have been the safest part of the flight? For two years, the world could only speculate, as search teams scoured a vast area of the ocean floor in search of the elusive black boxes.
When the recorders were finally found in May 2011, they revealed a story at once more prosaic and more inexplicable than anyone had imagined. A brief interruption to their airspeed indications, lasting less than a minute, had thrown two trained Air France pilots into a state of paralyzed agitation. Through a series of increasingly misguided control inputs, they sent flight 447 plummeting towards the ocean, all the while trying desperately to understand what was wrong, only grasping too late that they themselves were the problem. How could such a thing happen? To this day, most people still struggle to understand it. But there is a reason, written between the lines of the cockpit voice recorder transcript, hidden away within the mysterious code that governs human behavior, a key to the secrets of the profoundly irrational. Its lessons could not be more important, even for those who believe themselves above the doomed crew of flight 447, as the boundary between the responsibilities of man and machine grows ever dimmer.
◊◊◊
It’s 1:00 a.m., the middle of the Atlantic Ocean. 35,000 feet above the night-dark waves, dim overhead lights illuminate the cockpit of Air France flight 447. Captain Marc Dubois has headphones on, listening to opera. The pilot flying, First Officer Pierre-Cédric Bonin, stares dully at the instrument panel.
Dubois hands Bonin his headset, and for a few moments they listen together. “All that’s missing is the whiskey!” Bonin eventually says, handing the headset back to his captain, one might imagine with a smile. Flight 447 flies on into the night. Red and green lights steady, white lights blinking. No one knows it, but they are passing into that strange realm between life and death, hurtling onward into the void, unaware that they have already walked for the last time among the living.
Three hours earlier in Rio de Janeiro, Brazil, 216 passengers and 12 crew boarded Air France flight 447 for an overnight flight to Paris. The plane was an Airbus A330, a fully fly-by-wire wide body jet with an impeccable safety record; since its introduction in 1994, the type had never had a fatal accident in passenger service. The flight crew consisted of 58-year-old Captain Marc Dubois, a veteran pilot with nearly 11,000 hours; 32-year-old First Officer Pierre-Cédric Bonin, an inexperienced copilot with 2,000 hours who had recently come up through Air France’s in-house training program; and 37-year-old Relief First Officer David Robert, who would fill in during the middle of the flight so that Captain Dubois could get his legally mandated rest. Robert had also learned to fly at Air France, but had since graduated to an executive position, and had joined the crew of flight 447 in order to keep his type rating. His landing in Rio de Janeiro during the inbound trip was his first in three months.
For Air France pilots, the Rio de Janeiro rotation was a coveted trip, complete with a three-day layover at a beachside hotel in Copacabana. Pilots often spent their rest days partying, sightseeing, and restaurant-hopping. First Officer Bonin had brought his wife along for the ride, leaving their kids at home in France; Captain Dubois had also brought his girlfriend, an off-duty flight attendant and opera singer, with whom he had been seen out on the town the night before the flight. Dubois was said to have gotten just one hour of sleep before boarding flight 447.
Although none of the pilots were well-rested, they also knew that their advanced plane could bail them out. Unlike older generations of jets, the A330 was designed to minimize the consequences of crew errors, incorporating flight envelope protections that would make it impossible for the pilots to pitch too steeply up or down, fly too fast or too slow, bank too far to one side, or generate G-loads that could overstress the airframe. Furthermore, thanks to the plane’s advanced flight management system, they could enter the entire flight plan before departure, and the plane would all but fly itself from just after takeoff until right before landing. The pilots’ job primarily consisted of tactical decision-making and monitoring the instruments.
Flight 447 took off from Rio de Janeiro at 22:29 UTC, climbed to its cruising altitude of 35,000 feet, and proceeded northeast up the coast of Brazil. Bonin was the pilot flying, although he had little reason to touch the controls, and Dubois monitored the instruments. David Robert hung back in the crew quarters, trying to get some sleep before going on duty.
As the flight passed off Natal and headed out into the Atlantic, the pilots mostly kept to themselves. Dubois pointed out the equator, and Bonin joked about “feeling the bump” as they passed over it. An hour passed. Everything seemed to be going smoothly.
At around 1:30 a.m. UTC, the Brazilian oceanic control center, Atlantico, contacted the crew and instructed them to remain at flight level 350–35,000 feet. “Eh, well there you are,” said Captain Dubois. Keying his mic, he replied to the controller, “Okay, will do.” It would be flight 447’s last communication with the outside world.
First Officer Bonin had been using the cockpit weather radar to observe a growing band of thunderstorms in their path, a region known as the Intertropical Convergence Zone, where thunderstorms are practically a permanent fixture. All the pilots on flight 447 had flown through it many times before, crossing over it twice on every trip to South America. But tonight Bonin seemed more nervous than usual. “We’ll soon ask to climb, surely,” he said, expressing his dissatisfaction with the controller’s order to stay at 35,000 feet, and his desire to get above the worst of the weather.
But Captain Dubois knew that there was no need to change altitude. In his judgment the weather was unlikely to be any better at 37,000 feet, the highest they could fly at their current weight, nor was it likely to be dangerous at any flight level. At most they could expect some mild turbulence or icing. And if they really needed to, then they could divert around it.
“So we’ve got a… thing straight ahead,” Bonin said, sounding nervous.
“Yes, I saw that,” said Dubois.
Eleven minutes later, Bonin said, “It looks like we’re entering the cloud cover.”
Dubois had no comment.
“It would have been good to climb now, eh?” Bonin said.
“Yeah, if it’s turbulence,” Dubois said, without the slightest hint of worry.
Now deep in the oceanic sector, the plane was outside the radar range of any airport. Out here, planes were kept apart by keeping northbound traffic on odd flight levels and southbound traffic on even flight levels. But the next highest odd level, 37,000 feet, was close to their maximum altitude — maybe too close. Bonin suggested that they request a non-standard altitude of 36,000 feet.
“We’ll wait a little, see if it goes that way,” Dubois replied.
Bright flashes of light streaked across the windscreen, the eerie glow of St. Elmo’s fire. The sound of ice crystals hitting the plane rose to a dull roar in the background.
At this point Captain Dubois decided it was time to turn in for the night. He rang the call button to summon First Officer Robert from the bunk room. To Bonin, he said, “Er, who’s doing the landing, is it you? Well, he’s going to take my place. You’re a PL, right?”
“Yeah,” said Bonin.
This was the closest Dubois ever came to deciding who would be in command after he left the flight deck.
Two minutes later, Robert entered the cockpit. “Did you sleep?” Bonin asked.
“So-so,” Robert replied.
“You didn’t sleep?” Dubois interjected.
“He said so-so, so-so,” said Bonin.
“Well, then I’m out of here,” said Dubois.
Bonin briefed Robert on the situation: they were cruising at 35,000 feet, there was a storm ahead but they couldn’t climb to 37,000. Their attempt to log on with the oceanic control system in Dakar, Senegal had failed, but this was not an uncommon occurrence and Bonin knew it. All around, nothing terribly unusual. Robert settled in for the next leg of the flight.
About six minutes later, noting the storm cell in their path, Robert said, “Don’t you maybe want to go to the left a bit?”
“Excuse me?”
“You can possibly go a bit to the left,” Robert repeated.
With two first officers in the cockpit, and the less experienced one at the controls, it was unclear who was in charge. Decisions seemed to be taken by mutual agreement. Bonin never replied to Robert’s suggestion, so nothing was done.
Now a smell of ozone started to seep into the cockpit, a not unusual phenomenon when flying through highly charged thunder clouds. But Bonin didn’t seem to recognize it, and it was making him nervous. The ozone, the Saint Elmo’s fire, the storms — none of it was out of the ordinary for a transatlantic crossing, but for some reason it was starting to get to him.
For the past several minutes, they had been flying through a cloud of high-altitude ice crystals within the upper reaches of the thundercloud. Normally this would not be a problem, but if the concentration of crystals is high enough, they can clog the pitot tubes — the airspeed sensors — faster than the built-in heaters can melt them. This is what occurred on flight 447.
The A330 has three pitot tubes, one each for the captain, the first officer, and the standby instruments. Each pitot tube measures the pressure of the oncoming air, which is then compared to the static pressure to derive the plane’s airspeed. This data in turn is used to calculate a number of other parameters, including Mach number, vertical speed, and altitude, which are all displayed instantaneously to the pilots. But if ice crystals clog the pitot tubes, air cannot enter them, causing the measured pressure to drop, which in turn causes a decrease in indicated airspeed.
On flight 447, as all three pitot tubes filled up with ice, the airspeed readings quickly became invalid. Sensing a growing discrepancy between the three sources of airspeed data, at 2:10 a.m. and four seconds the autopilot disconnected with a sudden cavalry charge warning. The auto thrust shut off a split second later. Taken completely by surprise, First Officer Bonin announced, “I have the controls!” and reached for his side stick.
Behind the scenes, the loss of valid airspeed data had triggered a shift in the Airbus’s complex flight control laws. In “normal law,” computers interpret pilots’ side stick inputs and move the control surfaces in accordance with what is reasonable at that altitude, speed, and configuration. This improves the handling of the airplane to such an extent that no particular skill is required to fly it gracefully. Normal law also comes with full flight envelope protections in roll, pitch, speed, and load factor.
If sensor failures occur, the controls drop down a level to “alternate law.” This law contains several sub-laws with slightly different configurations, but in general, alternate law means that some or all computer moderation of control inputs remains, but flight envelope protections are removed. The autopilot and auto thrust cease to function.
In the event of further failures, the controls can enter direct law, in which there are no flight envelope protections and side stick inputs correspond directly to the position of the control surfaces, with no adjustment by the computer. This makes the airplane fly rather like a classic airliner, similar to most older Boeing models.
When the airspeed readings became invalid on flight 447, the control law changed to “alternate 2B,” which is specific to loss of speed data. In this law, load factor protection remains, but there is no autopilot, no auto thrust, and no high or low speed protection; furthermore, lateral (roll) control functions as it does in direct law. All of this happened near instantaneously, leaving the pilots completely in control of the airplane with little advance warning.
As soon as the autopilot disconnected, turbulence caused the plane to roll eight degrees to the right; Bonin immediately grabbed the side stick and rolled it back to the left, his inputs rough and jerky. At the same time, he pulled back on the stick, putting the plane into a climb. The A330 began to ascend rapidly from its cruise altitude of 35,000 feet, zooming upward through the impenetrable blackness, as multiple alarms blared over the cockpit speakers.
Climbing while at high altitudes above 30,000 feet is something that requires care and consideration. At these altitudes, a plane’s maximum safe speed and minimum safe speed are quite close together (and at a certain height they will in fact meet, a zone that pilots call the “coffin corner”). Fundamentally, as angle of attack — the angle of the plane into the airstream — increases, lift increases, until it reaches the critical point and drops off rapidly, causing the plane to stall. Because the air is thin at high altitude and provides little lift, a higher speed is necessary to keep the plane airborne, and the critical angle of attack is very low. Pitching up even a few degrees could place the plane on the edge of a stall. And in fact, as Bonin pulled back on his stick, the plane’s stall warning activated for three seconds, informing him that the angle of attack, for a moment anyway, was dangerously high.
But the warning proved transient, and neither pilot recognized it. Robert asked, “What was that?”
Bonin did not directly address the question. “We haven’t got a good… we haven’t got a good display of speed,” he said. A continuous C-chord pinged away in the background, warning that they had left their assigned altitude.
A number of warning messages had appeared on the computer screen, and Robert began to read them off in a disjointed, confused manner. None of them explicitly stated the cause of the failure, only the symptoms, including the disconnection of the autoflight systems and the switch to alternate law. By now, flight 447 was climbing through 37,000 feet, still going up, but decelerating alarmingly.
Robert must have noticed their high pitch angle, because he said to Bonin, “Watch your speed, watch your speed!” But neither pilot had a valid airspeed reading.
“Okay, okay, okay, I’m going back down,” said Bonin, lowering the nose. But he didn’t lower it enough to stop climbing, and he reduced engine thrust, exacerbating the loss of airspeed even further.
“Go back down! According to that we’re going up,” Robert said, presumably pointing at their altitude readout. “According to all three you’re going up, so go back down.”
“Okay.”
“You’re at… go back down!”
“It’s going, we’re going back down,” Bonin insisted, restoring engine thrust to maximum. But the plane kept climbing.
Robert started switching Bonin’s instruments to alternate sources, but in a wholesale manner, indicating that he had not identified what instruments were actually faulty. Having done this, he started trying to summon Captain Dubois, ringing the call button with almost frenetic urgency. Clearly both pilots were in over their heads; only Dubois, it seemed, could help them. By now the airspeed indications had returned to normal, but the pilots had already set in motion a sequence of events which could not be undone.
At that moment the plane’s angle of attack, now rising through ten degrees, again triggered the stall warning, and this time it didn’t go away. Accompanied by continuous clicking, an automated voice began to call out, “STALL! STALL!”
Flight 447 reached a peak altitude of 38,000 feet, stalled, and began to descend. Nose high, engines straining, the plane started to accelerate downward, following a long descending arc that grew steeper with every passing second.
“STALL! STALL!”
Bonin was frantically trying to keep the wings level, but the disrupted airflow and his own jerky control inputs made this all but impossible. The plane swayed wildly from side to side, reaching bank angles of up to forty degrees. “Above all, try to touch the lateral controls as little as possible, eh?” Robert suggested.
“STALL! STALL!”
“I’m in TOGA, eh?” Bonin said, referring to takeoff/go around, the highest normal thrust setting. He didn’t seem to understand why, if he had engine power set to TOGA, they were descending.
“Is he coming or not!?” Robert said, searching for some sign of the captain.
“STALL! STALL!”
“But we’ve got the engines, what’s happening?” Robert exclaimed. “Do you understand what’s happening or not?”
“STALL! STALL!”
“I don’t have control of the airplane anymore now!” said Bonin. “I don’t have control of the airplane at all!” With the nose pitched up and the engines at max thrust, he simply couldn’t fathom why they weren’t climbing. Overwhelmed by the noise of the warnings, the terrifying vibrations, and the wildly fluctuating instrument readings, his brain seemed to shut down, paralyzed by confusion and fear.
By now the plane was falling toward the ocean at a rate of 10,000 feet per minute, and accelerating. The angle of attack was more than forty degrees. The only way to recover was to push the nose down, regain airspeed, and then pull out at a lower altitude. But Bonin just kept pulling his side stick back, forcing the nose up.
“Controls to the left,” Robert said, still worried about their bank angle. Pressing the priority button on his side stick, he took control and locked out Bonin, but Bonin immediately pressed his own priority button and assumed control again.
“STALL! STALL!”
Bonin said something which might be best translated as, “I have the impression that we’re going crazy fast.” His impression couldn’t have been further from the truth.
At that moment, Captain Dubois returned to the cockpit to find a scene of chaos. “Er, what are you doing?” he said, glancing around in an attempt to figure out what was going on.
“What’s happening?” Robert asked. “I don’t know, I don’t know what’s happening!”
“We’re losing control of the airplane,” said Bonin.
“We lost all control of the airplane, we don’t understand anything, we’ve tried everything!” Robert said, desperation in his voice. But in fact they had tried nothing at all.
“STALL! STALL!”
“I have a problem, it’s that I don’t have vertical speed indication,” said Bonin. His vertical speed indicator was working perfectly; he just didn’t believe what it said. “I have no more displays!” he opined, although again, all indications were correct and all his instruments were working.
“We have no more displays!” Robert repeated.
“I have the impression that we have some crazy speed, no?” Bonin said. “What do you think?”
“STALL! STALL!”
“So we’re still going down,” Bonin said.
“We’re pulling,” said Robert. “What do you think about it, what do you think — what do we need to do?”
“There — I don’t know, it’s going down!” said Dubois. He had made no effort to assume control, continuing to look over his first officers’ shoulders instead.
As the plane plummeted toward the Atlantic Ocean, the pilots only became more confused and agitated. Recovery was already impossible; the fates of all on board were carved in stone. All that followed was a final, terrible fight to the death.
“The wings to flat horizon, the standby horizon!”
“The horizon!”
“Speed?”
“You’re climbing!”
“You’re going down, down, down!”
“Am I going down now?”
“Go down!”
“No, you’re climbing!”
“I’m climbing, okay, so we’re going down!”
“STALL! STALL!”
“Okay what are we here? On altitude, what do we have here?”
“…It’s impossible,” Captain Dubois said, completely baffled.
“STALL! STALL!”
“What do you mean, on altitude?
“Yeah yeah yeah, I’m going down no?”
“You’re going down, yes!”
“Hey you, you’re in — get the wings horizontal!”
“Get the wings horizontal!”
“That’s what I’m trying to do! I’m at the limit with the roll!”
“We lost it all! I’ve got nothing here!”
“We’re there, we’re passing level 100!” Flight 447 was falling through 10,000 feet, still deeply stalled, headed straight into the jaws of oblivion.
“Wait, me — I have the controls!” Robert said. But Bonin didn’t stop pulling up.
“What is… how come we’re continuing to go down right now?” Bonin asked.
“STALL! STALL!”
“Nine thousand feet!” Bonin cried out.
“Climb, climb, climb, climb…” Robert said, as though trying to will the plane to stop falling.
“But I’ve been at maximum nose up for a while!” said Bonin.
It was at that point that Captain Dubois finally understood what was happening. “No no no, don’t climb!” he shouted. But it was already much too late to intervene. Not even the most skilled pilot on earth could have saved them.
These final moments of Air France flight 447 would go down in aviation history as some of the most tragic and the most baffling.
“So go down!” said Robert. “So give me the controls, the controls to me, controls to me!”
“Go ahead, you have the controls!” said Bonin.
“STALL! STALL!”
“Watch out, you’re pitching up there!” said Dubois. Incredibly, both Bonin and Robert were still hauling back on their side sticks.
“I’m pitching up,” said Robert.
“You’re pitching up!” Dubois shouted.
“Well we need to, we are at four thousand feet!” said Bonin. It was true, it was far too late to recover by pitching down. Not that it would matter anyway.
“PULL UP,” said the ground proximity warning system. “PULL UP! PULL UP!”
“Go on, pull,” Dubois said. Was this comment a sardonic resignation to fate?
“PULL UP! PULL UP!”
“We’re going to crash!” Bonin cried out. “This can’t be true! But what’s happening?”
“PULL UP! PULL UP!”
“Ten degrees pitch attitude,” Dubois drily commented. His would be the last words on the cockpit voice recording. Less than two seconds later, with a forward airspeed of just 107 knots and a descent rate of 11,000 feet per minute, Air France flight 447 slammed belly-first into the Atlantic Ocean. In a fraction of a second, like so many candles, 228 lives flickered and went out.
◊◊◊
It would not be until 4:00 a.m. UTC, nearly two hours after the crash, that controllers in Senegal began to realize that they should have heard from Air France 447, but had not. They tried everything — contacting nearby control centers, asking other planes, asking Air France — but no one had spoken to flight 447 since shortly before 2:00 in the morning. At 4:59, having tried and failed to establish contact with flight 447 via satellite, an Air France dispatcher told the Dakar control center that something must be seriously wrong. 24 minutes later, fearing that the plane had gone down in the Atlantic, Brazil and Senegal issued an alert to rescue services, and the search for the plane began.
The problem was that Air France flight 447 had apparently vanished within an area that had no radar coverage, no possibility of witnesses, and only spotty radio contact. No one knew exactly when or where the plane went down, and with each passing hour, any floating debris would drift farther from its point of origin. By the time the first search planes actually departed, more than ten hours had passed since the crash, and the debris was already scattering.
Meanwhile, investigators with France’s Bureau of Inquiry and Analysis (BEA) set up an elite team to investigate what promised to be the most complicated and most important accident in the history of French aviation. Although they didn’t have the airplane, they didn’t start with nothing: like all modern aircraft, the Airbus A330 regularly broadcasts data to the airline for diagnostic purposes. This system, known as ACARS, sent a burst of data approximately every ten minutes, with additional messages if certain warning conditions were met. The last regular message, sent at 2:10, indicated that there was a problem with the pitot-static system, the autopilot had disengaged, and the controls were in alternate law. Several additional messages sent between 2:10 and 2:14 indicated faults with the Air Data Reference units, the computers which process airspeed, and an abnormally high rate of descent. It was just enough to prompt speculation, but not enough to explain what had happened, or why.
One thing that investigators suspected from the very beginning was a problem with the pitot tubes. At the time of its disappearance, flight 447 was flying through storms in the intertropical convergence zone, the perfect conditions for pitot tube icing. This particular model of pitot tube had been shown on several occasions to experience ice accumulation greater than the heaters could remove, leading to a loss of airspeed data. In fact, Air France, Airbus, and the pitot tube manufacturer had been holding meetings on the matter since 2008, and earlier in 2009 a study had shown that a newer model of Thales pitot tube could significantly reduce the frequency of such incidents. Air France quickly ordered the new pitot tubes for all of its Airbus A330s, and the first airplane was retrofitted on May 30th, just hours before Air France flight 447 left Rio de Janeiro. Although the airline had been proactive, their efforts came ever so slightly too late for the 228 passengers and crew now presumed lost at sea.
But to know how exactly frozen pitot tubes, a relatively minor malfunction, could have led to the catastrophic crash of a wide body jet with a flawless record, investigators needed the black boxes. Everyone knew that they would be hard to find — but few could have guessed just how difficult it would turn out to be.
By the afternoon of June 1st, French officials had already acknowledged that there was “no hope for survivors,” but the scope of the sea search only continued to increase. On June 2nd, a Brazilian plane spotted an apparent oil slick and light floating debris; on the 6th of June, two bodies were found, along with personal effects, and the plane’s vertical stabilizer was located on the 7th. In all, by the end of June searchers had found over 600 pieces of the airplane and the bodies of 50 victims, including Captain Dubois. Engineering analysis of the debris and autopsies of the victims revealed that the plane had impacted the water in a nearly flat pitch attitude with a high rate of descent, but again, investigators couldn’t say why. The answers, as ever, lay with the flight recorders.
The A330’s two black boxes were equipped with pingers that could be detected by specialized equipment, but the batteries which powered the pingers were only rated to last 30 days. Although authorities moved quickly to bring in search ships capable of detecting the pingers, their chances of finding the black boxes inside the 30-day window were slim. With the plane likely resting at a depth of up to 4,000 meters, surface vessels would need to get very close to the site of the wreckage in order to pick up the signal, and with no radar record, it was impossible to know with any specificity where the plane had actually entered the water. It was unfortunately no surprise that the 30-day period went by with no sign of the black boxes.
At that point, the search entered its third phase: a methodical sonar examination of an area extending 75 kilometers in all directions from the plane’s last known position, as reported by ACARS. Carried out between April and May 2010, this search failed to turn up any sign of the plane. All data indicated that the plane should have been within the search area, but covering every square kilometer in detail was difficult, and a more precise search would be needed.
The fourth phase began in the spring of 2011, focusing on areas not covered by the previous search within a limited 37-kilometer radius around the last known position. This search began on the 25 of March, and had been in progress for just seven days when sonar imagery detected the presence of a large debris field on the ocean floor. On the 3rd of April, a submarine equipped with a camera reached the debris field, returning images that left investigators speechless: after nearly two long years, there lay Air France flight 447, shattered on the barren floor of the abyssal plain, four kilometers beneath the Atlantic.
Examining the debris field inch by inch, searchers managed to find the flight recorders by the beginning of May, followed soon after by several substantial chunks of wreckage and the bodies of a further 104 passengers and crew. Another 74 bodies were never found, having apparently been lost to the sea.
The much-anticipated readout of the black boxes occurred at the BEA headquarters in Paris in May 2011. At long last, investigators listened, transfixed, to the voices of the doomed crew on that fateful night in 2009 — voices that some had doubted they would ever hear. But as those haunting conversations played out over the two hour tape, it became clear that the black boxes would raise just as many questions as they answered.
By integrating the cockpit voice recorder and the flight data recorder, investigators were able to show that at the moment the airspeeds became invalid and the autopilot disconnected, First Officer Pierre-Cédric Bonin began to pull back on his side stick, raising the nose, and that he maintained this input almost continuously until impact. The data was indisputable; Bonin had stalled the airplane, sending it to its doom. But this explanation in fact explained very little. Every airline pilot should know that such inputs will lead to a stall, so why did Bonin seem to be oblivious to the danger?
Answering this question proved to be by far the most complicated part of the entire investigation. Understanding what went through the minds of the pilots requires a second-by-second analysis of the final four minutes of the flight, considering all of the disparate cues which each pilot was trying to assimilate.
But first, it is critical to understand who Pierre-Cédric Bonin was as a pilot. In the popular consciousness, a pilot is a semi-heroic figure who flies a plane by hand, guiding it through all manner of dangers. Bonin was perhaps living proof that this type of pilot has not existed for decades.
In fact, the job of a modern pilot on a plane like the A330 is far more abstract. The average A330 pilot will hand-fly an airplane for maybe four minutes out of every flight, and will pilot only two or three flights a week, sometimes fewer. The vast majority of their time is spent programming automation, monitoring computer activity, and making broad, tactical decisions about the flight. Physical skill is far less important than emotional intelligence, good memory, and an ability to communicate. And on a highly automated plane like the A330, it’s all but impossible to discover who possesses such physical skill in the first place.
Physical, or traditional, piloting skills are typically developed through extensive experience flying small aircraft which have little or no automation. These aircraft force a pilot to develop an intuitive understanding of how airplanes behave in various regimes of flight, and anyone who cannot develop these skills will wash out at an early stage. Captain Marc Dubois no doubt had these skills: between 1977 and 1987, he obtained type ratings on no less than 17 different light aircraft and accrued thousands of hours flying them. If he had been in the pilot’s seat when the airspeed indicators failed on flight 447, there is little doubt that he would have reacted correctly: he surely had an intuitive understanding that, in the absence of any configuration changes, the plane will continue to fly on its previously established trajectory, even if all the instruments are lost — a sort of airman’s object permanence. He would have known that all he needed to do was nothing.
Bonin, on the other hand, had a completely different background. He had followed a fast-track trajectory to the right seat of the Airbus A330, flying small planes just long enough to get his private and air transport pilot’s licenses before being inducted into Air France with just a couple hundred flight hours. He was immediately trained to fly the advanced fly-by-wire Airbus A320, before upgrading to the Airbus A340 and finally the A330, all of which were heavily automated. Any rudimentary “traditional” skills which he had gained during his brief time flying light aircraft would have quickly degraded. Although Bonin would have learned about the principles of aircraft dynamics in a classroom setting, such instruction is an order of magnitude less valuable than getting to feel the principles in action while at the controls of a fully mechanical airplane. Instead, he spent the next 2,000 flight hours watching as computers flew the jet on his behalf. His total time actually hand-flying an airliner couldn’t have been more than a couple dozen hours, all of them within the bounds of the flight envelope protections, which he knew made it impossible for him to lose control. If you asked him, Bonin probably could have told you what a stall is and how it works, but could he have identified one in real life?
The extent of his stall-related training leaves room for doubt. Air France did not train its pilots on prevention or recovery from high altitude stalls, even though these have several fundamental differences from low-altitude stalls. If the stall warning activates during the initial climb away from an airport, a scenario which Bonin practiced many times in the A330 simulator, it is possible to avert the stall by applying maximum thrust and maintaining a nose up attitude of about twelve degrees. The denser air closer to sea level ensures that the plane is stable in such a configuration. But at 35,000 feet, this will not work: pitch angles as low as four or five degrees will be sufficient to activate the stall warning, and an actual stall will follow soon after.
However, all of that is hypothetical, because nearly all of the time, Airbus aircraft cannot stall. The flight envelope protections simply will not allow any inputs which raise the angle of attack above the critical point, and with these protections in place, there isn’t even a stall warning, because a stall will not and cannot occur. A pilot can haul back on the side stick with all their might, and the plane will rear up to whatever angle the algorithms determine is safe. Nothing the pilot can do will make it pitch up more.
With these facts in mind, consider the scenario actually faced by the crew of flight 447. They were at high altitude where even a mild nose up input could quickly escalate into a stall. Bonin and Robert were probably only vaguely aware of this fact, which was rather esoteric in an environment where the flight envelope was clearly limited (although it was their duty to know it). And then suddenly all the protections vanish, as the loss of airspeed data forces the controls to slip into alternate law. After all, the computer can’t protect against a stall if it doesn’t know how fast the plane is going. Does Bonin know that the plane is in alternate law? And if he does, does he understand what that means? In theory it’s his job to know, but he doesn’t.
At the moment that the airspeed data became invalid, a curious quirk of the plane’s internal calculations might have set the whole sequence of events in motion. Because of the location of the A330’s static ports, which measure the basic outside air pressure, the reading is somewhat affected by the plane’s airspeed, due to leakage of rushing air into the ports. Generally this results in a slightly elevated static pressure reading. Because static pressure increases as altitude decreases, this design quirk would cause the sensor to continually underestimate the plane’s altitude. To account for this, an algorithm applies a small correction to the static pressure reading based on the airspeed reported by the pitot tubes, in the process correcting the altitude to its true, higher value. But if the pitot tubes suddenly start reporting an erroneously low airspeed — say they’re blocked by ice — the size of the applied correction will be smaller, and the plane’s indicated altitude will decrease, even though it is in fact flying straight and level.
Consequently, at the moment the pitot tubes froze on Air France flight 447, the indicated altitude dropped by about 350 feet, and the vertical speed indicator briefly displayed a descent rate of 600 feet per minute. Bonin didn’t comment on these figures, so we can’t prove that he saw them. But if he did, it would explain his initial decision to pull the nose up: he probably thought the airplane was descending. And what did he think would happen if he pulled the nose up? Most likely, that the plane would climb at a protected angle, safely below the stall margin, no matter how hard he pulled back on the stick or how long he held it there. There was no need for such an extreme input, but it seems he was caught by the startle effect, feeling compelled to take drastic action, but without understanding what form that action should take, and believing that the computer would bail him out if he did something wrong.
It is somewhat more difficult to explain why Bonin kept pulling on the stick even after his instruments showed the plane passing back through its initial cruise altitude and continuing toward 37,000 feet. But his comments earlier in the flight, in which he repeatedly expressed a desire to climb above the weather, provide a possible reason. If he thought the plane would be out of the clouds at around 37,000 feet, and if he was concerned about the possibility of turbulence or other severe conditions inside the storm, his first instinct upon seeing the cascade of warnings might have been to try to escape from the area of bad weather. Perhaps he wanted to climb as high as the plane would let him, not knowing that all such protections had been withdrawn.
At the same time, there is considerable evidence that Bonin was more concerned about flying too fast than he was about flying too slow. Pilots in general were aware, to an almost superstitious extent, that exceeding the maximum operating speed could lead to the breakup of the airplane in flight, and that at high altitudes this maximum speed was not that much faster than the normal cruising speed. In fact, on an Airbus operating in normal law, the airspeed indicator in front of each pilot displays markers representing the maximum and minimum allowable speeds (as defined by the flight envelope protections), and the actual speed in cruise is usually much closer to the former than the latter. Many pilots, including Bonin, had probably developed a false belief that overspeed was a more pressing danger than stalling. In fact, it’s the other way around: in the 20 years leading up to the crash of flight 447, there had been considerably more crashes involving high-altitude stalls than crashes involving overspeed-related breakup.
In light of these assumptions, when Bonin saw the plane appearing to descend in the first seconds after the failure, his instinctive reaction may have been to protect the plane against entering an overspeed condition. Furthermore, when the max/min speed markers disappeared during the transition to alternate law, his sense of where these boundaries lay became uncertain. This uncertainty, and the irrational fear of flying too fast, may have pre-conditioned him to ignore cues which indicated that he was actually flying too slowly.
It is also worth noting that Bonin and Robert had both undergone training on unreliable airspeed events, during which pilots were instructed to adopt a known power setting and pitch angle which would result in a stable flight path. However, much like the stall training, it was assumed that the most critical unreliable airspeed scenario is one which occurs at low altitude during initial climb. Although procedures for other phases of flight could be found in the manual, the training conditioned pilots to expect unreliable airspeed events during climb, to which they would respond with a steady nose-up pitch and high power setting that would ensure a shallow ascent. Such a response would be completely inappropriate in cruise.
Investigators found that because of this conditioning, in a dozen or so previous cases of unreliable airspeed in cruise on the Airbus A330 and the similar A340, not a single crew had correctly identified the anomaly and applied the stabilization procedure. In one case, the pilot even applied nose-up inputs which triggered a stall warning, although deviation from the flight path was ultimately minimal. Therefore Bonin and Robert were not the exception in failing to initially identify the cause of the malfunctions and apply the known solution. In all of these cases, part of the problem was that in the actual events, the loss of speed data was accompanied by a series of alarms and warning messages which were not present in the simulator scenarios, and none of these messages explicitly stated that there was a problem with the pitot tubes, contributing to pilots’ difficulty identifying the root cause.
Having pitched their plane up to the very brink of a stall, Bonin and Robert could have saved the day by reacting correctly to the stall warning which began to sound as the plane approached 38,000 feet. There are however several possible reasons why they ignored it. One is that their minds were already so saturated with information that they simply never heard it. Instrument indications were seemingly going haywire, nobody knew what instruments they could trust, the pilots were desperately trying to figure out what the plane was doing, the computer screen was covered in warning messages, and a continuous C-chord chime was running in the background. Scientific studies have shown that in such situations, the capacity of the human brain to tune out seemingly obvious auditory cues is considerable.
Another possible reason is that the stall warning had previously activated for three seconds shortly after the disconnection of the autopilot, when Bonin initially pitched up. At that time the stall warning was unexpected and difficult for the pilots to rationalize. Crews involved in similar incidents reported that they assumed the brief stall warnings were generated by the erroneous airspeed readings, a not unreasonable interpretation which breaks down only when one learns that the stall warning calculations are based on angle of attack and do not incorporate any airspeed data. Thus, the stall warnings in all such cases were real. But in a situation where they were not expecting a stall warning, and in which they might have believed the plane could not stall, it’s not hard to imagine that Bonin and Robert heard the stall warning but simply didn’t believe it.
At this point, Robert, despite his greater experience, failed to stop Bonin from stalling the airplane, even though he appeared to recognize that his fellow pilot was pitching up too steeply. Investigators noted that during most of the period between the onset of the event and the stall, Robert was trying to interpret the warning messages and was not directly paying attention to the flight path. Although he did tell Bonin to “go down,” Bonin’s halfhearted response was apparently enough to satisfy him, as he went right back to analyzing the problem. It is also worth noting that Robert had the same non-traditional piloting background as Bonin; he was likely operating on little sleep; and he had barely flown since being promoted into airline management. All things considered he was just as unprepared for the situation as Bonin was.
Once the airplane actually stalled, the crew of flight 447 found themselves beyond the scope of anything they had learned in training. Training scenarios never allowed the stall to fully develop, in part because the simulators in use at Air France could not faithfully simulate the behavior of the aircraft after exiting the normal flight envelope. The scenarios thus focused on preventing stalls, not recovering from them, and while the pilots likely knew in principle that they would need to pitch down to recover from a fully developed stall, this knowledge would have been purely academic in nature. Neither Bonin nor Robert had ever attempted such a maneuver, not in a simulator and definitely not in real life.
This lack of practical knowledge combined with several conflicting cues to cement Bonin’s pre-established desire to pull up and climb. One of these cues came from the flight director, an overlay on the pilot’s attitude indicator which provides command bars that the pilot can follow in order to achieve a desired flight path. Normally the flight directors will disappear if the airspeed data becomes unreliable, and at first they did. But if the pilots don’t turn them off, they will come back as soon as two of the three Air Data Reference computers provide it with airspeed readings that are consistent with one another. On flight 447, the pilots never attempted to turn off the flight directors, and they came back as soon as the pitot tubes unfroze and the airspeed data became valid again, which occurred just before the onset of the stall. Not knowing the intentions of the crew, when the flight directors come online, they automatically instruct the pilot to maintain the current trajectory, until the pilot programs them to do otherwise. The result was that the flight directors re-engaged not in cruise mode, but in vertical speed mode with a target climb rate of 1,400 feet per minute — the exact rate at which flight 447 was climbing at that particular moment. From then on the flight directors, whenever they had valid data, instructed the pilots to attain an approximately 12-degree nose up attitude in order to reach this target vertical speed. Flight data indicates that at several points during the stall, Bonin may have been attempting to follow this erroneous flight director instruction.
In fact, by coincidence the target pitch angle displayed by the flight director was almost exactly equal to the target pitch angle Bonin had learned to use while powering out of a low-altitude stall. This finding raises the question of whether Bonin thought that following the flight director would lead to the stabilization of the flight path. This interpretation is supported by Bonin’s comments to the effect that high power and a high pitch angle should cause them to climb. It seems likely that he not only thought he was flying the stall avoidance procedure, but that he believed the flight director was instructing him to do so as well. He apparently never recognized that the plane was already in a fully developed stall, and that this procedure was completely irrelevant to their actual situation.
During flight 447’s plunge toward the sea, the flight directors disappeared every time the forward airspeed dropped below 60 knots. This was because an airspeed below 60 knots while in flight is so anomalous that the computers are programmed to reject such a reading as false. Furthermore, at an angle of attack threshold which corresponded quite closely to 60 knots, the stall warning would cease for exactly the same reason. This created an unfortunate correlation, wherein Bonin would pitch up, the angle of attack and airspeed would exceed the rejection thresholds, the flight director would stop telling him to fly up, and the stall warning would cease; then if he attempted to pitch down, the angle of attack data would become valid again, the flight director would tell him to pitch up, and the stall warning would return. This perverse Pavlovian relationship could have subconsciously conditioned Bonin to believe that pitching down was causing the plane to approach the stall envelope, and that by pitching up he was actually protecting the plane against stalling. This violated basic aeronautical common sense, but by this point Bonin and common sense might as well have been on different planets.
David Robert, had he taken decisive action, could perhaps have saved the plane if he had recognized that Bonin was causing the stall. At times he seemed aware that Bonin was pulling up, at times not; but many experts believe that the very design of the Airbus made it harder for him to understand his copilot’s actions. Unlike most other airliners, the control sticks on Airbus models are not mechanically linked and the pilots cannot directly feel what the other pilot is doing. Although this usually doesn’t present a problem — in the course of normal flight, pilots rarely touch the side stick —this can become a liability in an emergency situation involving a breakdown in communication. The design of the side stick assumes that the pilots are well-trained in crew resource management and are communicating their actions to one another, but this ideal appears dangerously naive in light of the confusion on the flight deck of Air France 447. Airbus has stuck to its guns, and no change of the side stick design appears imminent, but the debate rages on, and it is widely believed that a linked side stick could have allowed Robert to recognize and correct the situation well before Dubois arrived to bail him out.
Unfortunately, by the time Captain Dubois entered the cockpit, the stall was already well advanced and their chances of survival were slim. Had he immediately recognized the problem, kicked Robert out of his seat, locked out Bonin from the controls, and executed a flawless stall recovery maneuver he might have saved the plane. But despite his expertise, he only seemed to realize what was happening shortly before impact. His difficulty understanding the situation could be explained by the first officers’ panic, the large number of extraneous indications and alarms, and the fact that he was operating on one hour of sleep. In theory, he should have seen that they were pitched up with the engines at high power and descending rapidly, a configuration that could only mean they were in a stall; there was no other explanation. But for whatever reason, he didn’t make the connection. In the fog of confusion, it took him too long to put two and two together, and by the time he did, he already knew there was no hope of recovery.
In the end, there is no single interpretation of the situation which fully explains why Bonin did what he did. In all likelihood, his actions were the result of a confused mixture of conflicting ideas, which caused him to make decisions which were based on completely contradictory scenarios. Did he think they were in overspeed, or did he think he was applying a stall recovery procedure? The answer may not be either-or; in such a state of mind, rational thought tends to break down, and moment-by-moment instincts take over. It’s entirely possible that he held both opinions during the fatal descent, maybe even at the same time.
Looking back on this bewildering body of evidence, the loss of Air France flight 447 kind of starts to make sense, in a distorted sort of way, like real life reflected in a funhouse mirror. We can start to see how a pilot who fundamentally does not understand his aircraft could fall into this trap, grasping wildly at trees without seeing the forest. What Bonin and Robert needed was aeronautical common sense, and they didn’t have it. It is so easy for those of us who have read about Air France flight 447 and similar accidents to point the finger and say the accident was Bonin’s fault, that he alone killed 227 other people. But such an accusation ignores the fact that Bonin was systematically underprepared for the situation in which he found himself. It is easy, from the vantage point of 2021, living in a world where Air France flight 447 has become one of the most studied accidents of all time, to say that he should have known better. And indeed he should have, but that’s not the point: the point is that Bonin was only a symptom of a deeper problem.
In fact, Air France flight 447 represented a turning point in how the global aviation industry approaches the subject of automation. There is no denying that automation has made flying much safer; the data supporting this conclusion is irrefutable. But amid the swift march of progress, it is important not to lose sight of the foundations on which that progress is built. Just like Alternate Law always lurks beneath Normal Law, underneath a layer of automation there lies the same need for traditional piloting skill that has always existed, and will continue to exist for the foreseeable future. We catch fewer glimpses into that realm than we used to, but it is still there, visible whenever something goes wrong with the automation. The fundamental paradox, one outlined by famed aviation author William Langewiesche, is this: the rarer such moments become, the harder it is to ensure that pilots are ready for them; and yet at the same time, their readiness becomes all the more important. After the crash of flight 447, solving this paradox became the foremost priority of aviation safety experts around the world, and the fruits of their efforts are only now becoming apparent.
Today, flying is not the same as it was in 2009, when Dubois, Robert, and Bonin boarded their Airbus A330 for the last time. Training again emphasizes basic piloting skills and aeronautical common sense; high altitude stalls are a major training topic; and increased simulator fidelity has allowed the widespread introduction of Upset and Recovery Training, now mandatory in the United States and Europe, which confronts pilots with extreme situations and forces them to fly their way out. There are some pilots out there who still lack these skills, but there are surely fewer of them now than there were ten or fifteen years ago. A marked decline in the number of major airline accidents in the second half of the 2010s has testified to this fact. But it would be a mistake to believe that the problem is, or even can be, fully solved. As long as humans fly airplanes, some amount of information will always be lost while translating between man and machine, and from these imperfections spring the seeds of catastrophe. The next major crash of a large airliner, wherever it may occur, will almost certainly have something to do with the interaction between pilots and the automation that they oversee. In the meantime, it would be beneficial, even for those of us who are not pilots, to look on the events of Air France flight 447 and accept that we are human, that our capacity to err is unbound by reason, and that the best way to avoid disaster is to learn from the mistakes of others.
_______________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read and discuss over 200 similar articles.
You can also support me on Patreon.
