9 ms·

The Human Factor – the 2009 crash of Air France Flight 447

75 points by celadevra_ 12y ago

pinpoll 12y ago
Being a privat pilot myself, I was fascinated by the story of AF Flight 447 from both a human and technical point of view, since many times, a combination of these two factors would eventually lead to an unpleasant situation. This documentary about AF Flight 447 is the best I found so far: https://www.youtube.com/watch?v=TsgyBqlFixo https://www.youtube.com/watch?v=TsgyBqlFixo ...including the last words of the pilots.
- ivanche 12y ago
  I also recommend documentary shown on National Geographic about this flight. I believe it's one of the Air Crash Investigation series.
- Koahku 12y ago
  After watching this this it baffles me that: There is no (central) display indicating the current position of both control sticks. There is no redundant system allowing the pilots to see their speed, even if the method used is inaccurate it would still be better than nothing (GPS, heated pitot tubes, ...) Same for the altimeter. Flight recorders aren't designed to float and broadcast their position, or at least release a small beacon that would give rescue teams a general idea about where to search.
  - gambiting 12y ago
    >>Flight recorders aren't designed to float and broadcast their position, or at least release a small beacon that would give rescue teams a general idea about where to search. They are not designed to float, because there is no guarantee that the flight recorder will separate from the rest of the wreckage, but most importantly because accidents at cruise altitude are incredibly rare, it's the safest time of the flight - and you are very unlikely to be over the ocean in any other mode of flight. Even with airports close to the sea, a crash few km from the shore would not be difficult to locate. And flight recorders have auxiliary batteries and actually broadcast their location for a month after the crash - the problem here was that no one had an idea where the plane crashed, something that's very,very improbable in its own right.
gambiting 12y ago
I feel like this exact same problem is going to be encountered when automatic cars are introduced. Automatic systems will be good enough to take care of 98% of situations, but in the 2% when the system is just not good enough, the humans will not fare much better, if at all. Good drivers will still exist, average drivers will remain average, while people who should never be in command of a moving vehicle will now be "driving".Only very few of them will be able to cope with truly critical situations. Of course all of that will be dismissed on the basis of automatic cars saving innumerable human lives, but I believe we will observe the exact same phenomenon.
- userbinator 12y ago
  In some ways one can draw parallels with this and the increasingly complex multilayered abstractions of software - it decreases effort so people can throw together a bunch of libraries and quickly create some app that does something useful, but at the same time decreases motivation to understand the details of what they're building or how things actually work, making it much harder for them to troubleshoot when things go wrong.
- metrix 12y ago
  I can see the day when teenagers can't drive a non-automated car, just like most people today have a hard time driving a vehicle with a standard transmission. It wasn't that long ago that everyone had to know how to drive a standard.
  - gambiting 12y ago
    In EU if you passed your test in a vehicle with an automatic transmission you can't drive a manual, unless you re-take the test in one. So that kind of already happened. My point is that if we let teenagers drive fully automated cars,they might find themselves in a truly critical situation they will not be able to get out of, due to their lack of experience and training. People will then say - if they were experienced drivers, and if not for all this automation, they would be able to get out of this situation. Because that's exactly what this article is saying - if the aircraft wasn't as automated, and the pilots had a lot more experience actually flying, they would have realised that the plane was, in fact, stalling, and maybe would have saved it. That does not change the fact that automation, overall, saves more lives than it takes.
duchy 12y ago
a flight attendant walked in, asking that the temperature in the baggage hold be lowered because she was carrying some meat in her suitcase. Bonin lowered the temperature. Fifteen minutes later a flight attendant called the cockpit on the intercom to report that passengers in the back were cold. Bonin mentioned the meat in the baggage hold. This is a bit douchy, no? Or is it common practice?
jnsaff2 12y ago
Recently there have been many articles and different takes on the AF447 crash. To anyone who is truly interested I would highly recommend to read the official Final Report [1] as it gives a much more nuanced and complete picture than the journalistic dramatizations and heavy handed simplification. [1] http://www.bea.aero/en/enquetes/flight.af.447/rapport.final.en.php http://www.bea.aero/en/enquetes/flight.af.447/rapport.final....
- MichaelGG 12y ago
  But really, all the other interesting stuff aside (cascading errors, modal input), it really boils down to the undefensible decision by Airbus to average inputs from both pilots.
  - MrBuddyCasino 12y ago
    This one is really mind blowing. Also I don't get why they switched to joysticks instead of the traditional yoke. With mechanical feedback, yokes should be much more intuitive. I'd love to hear a pilot's opinion who has used both.
    - jasode 12y ago
      Captain Chesley Sullenberger (the famous pilot of the Hudson River crash landing) has the opinion that mechanically linked yokes (Boeing philosophy) is superior to independent fly-by-wire joysticks (Airbus philosophy). A video from CBS shows a very eye-opening demonstration of tactile feedback the mechanical linkage can provide. It's a feedback loop that the non-flying pilot can't ignore. http://youtu.be/kERSSRJant0?t=3m9s http://youtu.be/kERSSRJant0?t=3m9s However, it doesn't mean there aren't other pilots who prefer fly-by-wire joysticks and can list (safety) advantages over mechanical linkages.
    - mikeash 12y ago
      I'm a glider pilot, and gliders universally use sticks (presumably because they're mechanically simpler and considerably smaller, and space is at a premium). I've flown planes with yokes before, and have on rare occasions more recently, and I don't like the feel of it at all. The stick gives much better control and feedback in my opinion. However, that could just be because it's what I'm used to. In any case, I don't think the joystick is a problem, but rather how it's implemented, with no feedback in the system. A yoke implemented in the same way would have had the same problem.
dmm 12y ago
> As if the buffet weren’t enough of an indication, the stall warning erupted again, alternating between STALL STALL STALL and a chirping sound. Off topic but how does the airplane know it's stalling if the airspeed indicators are not working?
- Serow225 12y ago
  Angle Of Attack sensors would be my thought.
- gambiting 12y ago
  Article mentions that the aircraft also provides GPS-based speed, so maybe that's how? That's just an educated guess, I have no real idea. Edit: Reading through the official investigation document: "The angle of attack is the parameter that allows the stall warning to be triggered; if the angle of attack values become invalid, the warning stops. " So like said in another comment - even with no valid speed values, the angle of attack can trigger a stall warning.
  - celadevra_ 12y ago
    Yes, and the angle of attack sensor also stops the stall warning if it reads a value above a certain threshold, discarding the value as invalid. But apparently the airplane can still fly for a short time even at this crazily large angle. Therefore when the pilot did the right thing to reduce the angle, he triggered the stall warning again and completely got confused. I think this is a major design flaw in Airbus's system.
    - gambiting 12y ago
      Yeah, even though it's suicidal, the angle of attack can physically be larger than 40 degrees, so I am not sure why would it be discarded as invalid. Most likely Airbus engineers decided that since no one would try to ascend at such ridiculous angle(especially since the autopilot will correct if the angle of attack is larger than 15 degrees), then such high values must indicate a broken sensor. A decision which contributed to the catastrophe, unfortunately.
benihana 12y ago
We can't have a discussion about the human factors in automated systems without talking about Sidney Dekker's book The Field Guide To Understand Human Error: http://www.amazon.com/Field-Guide-Understanding-Human-Error/dp/0754648257 http://www.amazon.com/Field-Guide-Understanding-Human-Error/... Fantastic read about the futility of placing blame on a single human in a catastrophe like this. It makes a strong case for why more automation often causes more work. Definitely worth checking out, Etsy has applied it to their engineering work by using it to facilitate blameless post mortems: http://codeascraft.com/2012/05/22/blameless-postmortems/ http://codeascraft.com/2012/05/22/blameless-postmortems/
- gmu3 12y ago
  Nicholas Carr's new book is also about the dangers of too much automation: http://www.amazon.com/Glass-Cage-Automation-Us/dp/0393240762 http://www.amazon.com/Glass-Cage-Automation-Us/dp/0393240762
- dllthomas 12y ago
  Seems related to http://www.ctlab.org/documents/How%20Complex%20Systems%20Fail.pdf http://www.ctlab.org/documents/How%20Complex%20Systems%20Fai...
- barrkel 12y ago
  It's worth bearing in mind that that the accident rate is a fifth of what it was, according to the article. The automation may have created new dangers, but it probably reduced more common errors.
S_A_P 12y ago
So it appears that the co-pilot was very agitated and possibly having a mild panic attack, at least from the perspective of the story. On that night, it would appear that he needed to be relieved of duty and someone else handle the flying since the thunderstorm seemed to scare him and make him agitated. Had the captain flown through the storm, I bet 447 would have landed without incident.
clueless123 12y ago
From the article: "fourth-generation jets have enabled people who probably never had the skills to begin with and should not have been in the cockpit" To me, as an experienced pilot, that says it all.
- inflagranti 12y ago
  But isn't one huge issue here also that the way the airbus flight controls are designed it made it very hard for the experienced pilots to realize the wrong inputs the 'unskilled' pilot made and essentially allowed him to silently control the plane? This seems to heavily undermine the whole purpose of having senior people on board. And to rely solely on verbal communication to coordinate the input controls seems a very fragile concept to me.
relic 12y ago
I don't have much experience with the 330, but I assume it had some sort of stall-recovery mechanism, like a stick pusher. Why did it not override the pilots' inputs and force a pitch-down? Also, the 330 is not equipped with pitot heaters? The military aircraft (simulators) that I've messed with will start to complain if you don't have the pitot heaters on, well before you ever leave the ground.

75 points by celadevra_ 12y ago

Being a privat pilot myself, I was fascinated by the story of AF Flight 447 from both a human and technical point of view, since many times, a combination of these two factors would eventually lead to an unpleasant situation. This documentary about AF Flight 447 is the best I found so far: https://www.youtube.com/watch?v=TsgyBqlFixo https://www.youtube.com/watch?v=TsgyBqlFixo ...including the last words of the pilots.

ivanche 12y ago
I also recommend documentary shown on National Geographic about this flight. I believe it's one of the Air Crash Investigation series.
Koahku 12y ago
After watching this this it baffles me that: There is no (central) display indicating the current position of both control sticks. There is no redundant system allowing the pilots to see their speed, even if the method used is inaccurate it would still be better than nothing (GPS, heated pitot tubes, ...) Same for the altimeter. Flight recorders aren't designed to float and broadcast their position, or at least release a small beacon that would give rescue teams a general idea about where to search.
- gambiting 12y ago
  >>Flight recorders aren't designed to float and broadcast their position, or at least release a small beacon that would give rescue teams a general idea about where to search. They are not designed to float, because there is no guarantee that the flight recorder will separate from the rest of the wreckage, but most importantly because accidents at cruise altitude are incredibly rare, it's the safest time of the flight - and you are very unlikely to be over the ocean in any other mode of flight. Even with airports close to the sea, a crash few km from the shore would not be difficult to locate. And flight recorders have auxiliary batteries and actually broadcast their location for a month after the crash - the problem here was that no one had an idea where the plane crashed, something that's very,very improbable in its own right.

gambiting 12y ago

I feel like this exact same problem is going to be encountered when automatic cars are introduced. Automatic systems will be good enough to take care of 98% of situations, but in the 2% when the system is just not good enough, the humans will not fare much better, if at all. Good drivers will still exist, average drivers will remain average, while people who should never be in command of a moving vehicle will now be "driving".Only very few of them will be able to cope with truly critical situations. Of course all of that will be dismissed on the basis of automatic cars saving innumerable human lives, but I believe we will observe the exact same phenomenon.

userbinator 12y ago
In some ways one can draw parallels with this and the increasingly complex multilayered abstractions of software - it decreases effort so people can throw together a bunch of libraries and quickly create some app that does something useful, but at the same time decreases motivation to understand the details of what they're building or how things actually work, making it much harder for them to troubleshoot when things go wrong.
metrix 12y ago
I can see the day when teenagers can't drive a non-automated car, just like most people today have a hard time driving a vehicle with a standard transmission. It wasn't that long ago that everyone had to know how to drive a standard.
- gambiting 12y ago
  In EU if you passed your test in a vehicle with an automatic transmission you can't drive a manual, unless you re-take the test in one. So that kind of already happened. My point is that if we let teenagers drive fully automated cars,they might find themselves in a truly critical situation they will not be able to get out of, due to their lack of experience and training. People will then say - if they were experienced drivers, and if not for all this automation, they would be able to get out of this situation. Because that's exactly what this article is saying - if the aircraft wasn't as automated, and the pilots had a lot more experience actually flying, they would have realised that the plane was, in fact, stalling, and maybe would have saved it. That does not change the fact that automation, overall, saves more lives than it takes.

duchy 12y ago

a flight attendant walked in, asking that the temperature in the baggage hold be lowered because she was carrying some meat in her suitcase. Bonin lowered the temperature. Fifteen minutes later a flight attendant called the cockpit on the intercom to report that passengers in the back were cold. Bonin mentioned the meat in the baggage hold. This is a bit douchy, no? Or is it common practice?

jnsaff2 12y ago

Recently there have been many articles and different takes on the AF447 crash. To anyone who is truly interested I would highly recommend to read the official Final Report [1] as it gives a much more nuanced and complete picture than the journalistic dramatizations and heavy handed simplification. [1] http://www.bea.aero/en/enquetes/flight.af.447/rapport.final.en.php http://www.bea.aero/en/enquetes/flight.af.447/rapport.final....

MichaelGG 12y ago
But really, all the other interesting stuff aside (cascading errors, modal input), it really boils down to the undefensible decision by Airbus to average inputs from both pilots.
- MrBuddyCasino 12y ago
  This one is really mind blowing. Also I don't get why they switched to joysticks instead of the traditional yoke. With mechanical feedback, yokes should be much more intuitive. I'd love to hear a pilot's opinion who has used both.
  - jasode 12y ago
    Captain Chesley Sullenberger (the famous pilot of the Hudson River crash landing) has the opinion that mechanically linked yokes (Boeing philosophy) is superior to independent fly-by-wire joysticks (Airbus philosophy). A video from CBS shows a very eye-opening demonstration of tactile feedback the mechanical linkage can provide. It's a feedback loop that the non-flying pilot can't ignore. http://youtu.be/kERSSRJant0?t=3m9s http://youtu.be/kERSSRJant0?t=3m9s However, it doesn't mean there aren't other pilots who prefer fly-by-wire joysticks and can list (safety) advantages over mechanical linkages.
  - mikeash 12y ago
    I'm a glider pilot, and gliders universally use sticks (presumably because they're mechanically simpler and considerably smaller, and space is at a premium). I've flown planes with yokes before, and have on rare occasions more recently, and I don't like the feel of it at all. The stick gives much better control and feedback in my opinion. However, that could just be because it's what I'm used to. In any case, I don't think the joystick is a problem, but rather how it's implemented, with no feedback in the system. A yoke implemented in the same way would have had the same problem.

dmm 12y ago

> As if the buffet weren’t enough of an indication, the stall warning erupted again, alternating between STALL STALL STALL and a chirping sound. Off topic but how does the airplane know it's stalling if the airspeed indicators are not working?

Serow225 12y ago
Angle Of Attack sensors would be my thought.
gambiting 12y ago
Article mentions that the aircraft also provides GPS-based speed, so maybe that's how? That's just an educated guess, I have no real idea. Edit: Reading through the official investigation document: "The angle of attack is the parameter that allows the stall warning to be triggered; if the angle of attack values become invalid, the warning stops. " So like said in another comment - even with no valid speed values, the angle of attack can trigger a stall warning.
- celadevra_ 12y ago
  Yes, and the angle of attack sensor also stops the stall warning if it reads a value above a certain threshold, discarding the value as invalid. But apparently the airplane can still fly for a short time even at this crazily large angle. Therefore when the pilot did the right thing to reduce the angle, he triggered the stall warning again and completely got confused. I think this is a major design flaw in Airbus's system.
  - gambiting 12y ago
    Yeah, even though it's suicidal, the angle of attack can physically be larger than 40 degrees, so I am not sure why would it be discarded as invalid. Most likely Airbus engineers decided that since no one would try to ascend at such ridiculous angle(especially since the autopilot will correct if the angle of attack is larger than 15 degrees), then such high values must indicate a broken sensor. A decision which contributed to the catastrophe, unfortunately.

benihana 12y ago

We can't have a discussion about the human factors in automated systems without talking about Sidney Dekker's book The Field Guide To Understand Human Error: http://www.amazon.com/Field-Guide-Understanding-Human-Error/dp/0754648257 http://www.amazon.com/Field-Guide-Understanding-Human-Error/... Fantastic read about the futility of placing blame on a single human in a catastrophe like this. It makes a strong case for why more automation often causes more work. Definitely worth checking out, Etsy has applied it to their engineering work by using it to facilitate blameless post mortems: http://codeascraft.com/2012/05/22/blameless-postmortems/ http://codeascraft.com/2012/05/22/blameless-postmortems/

gmu3 12y ago
Nicholas Carr's new book is also about the dangers of too much automation: http://www.amazon.com/Glass-Cage-Automation-Us/dp/0393240762 http://www.amazon.com/Glass-Cage-Automation-Us/dp/0393240762
dllthomas 12y ago
Seems related to http://www.ctlab.org/documents/How%20Complex%20Systems%20Fail.pdf http://www.ctlab.org/documents/How%20Complex%20Systems%20Fai...
barrkel 12y ago
It's worth bearing in mind that that the accident rate is a fifth of what it was, according to the article. The automation may have created new dangers, but it probably reduced more common errors.

S_A_P 12y ago

So it appears that the co-pilot was very agitated and possibly having a mild panic attack, at least from the perspective of the story. On that night, it would appear that he needed to be relieved of duty and someone else handle the flying since the thunderstorm seemed to scare him and make him agitated. Had the captain flown through the storm, I bet 447 would have landed without incident.

clueless123 12y ago

From the article: "fourth-generation jets have enabled people who probably never had the skills to begin with and should not have been in the cockpit" To me, as an experienced pilot, that says it all.

inflagranti 12y ago
But isn't one huge issue here also that the way the airbus flight controls are designed it made it very hard for the experienced pilots to realize the wrong inputs the 'unskilled' pilot made and essentially allowed him to silently control the plane? This seems to heavily undermine the whole purpose of having senior people on board. And to rely solely on verbal communication to coordinate the input controls seems a very fragile concept to me.

relic 12y ago

I don't have much experience with the 330, but I assume it had some sort of stall-recovery mechanism, like a stick pusher. Why did it not override the pilots' inputs and force a pitch-down? Also, the 330 is not equipped with pitot heaters? The military aircraft (simulators) that I've messed with will start to complain if you don't have the pitot heaters on, well before you ever leave the ground.