After AF447, what now?

 

The global airline industry faces a decision: whether to take radical and inevitably expensive action as a result of lessons learned; or accept that crashes such as AF447 occasionally happen but are sufficiently rare that a cost/benefit analysis of the investment in further safety improvements does not stack up. If the latter view prevails, it is much the same as saying that another widebody crash with similar causes is acceptable.
The accident that prompted this soul-searching occurred just after 02:00h on 1 June 2009. Flight AF447, an Airbus A330-200 with 12 crew and 216 passengers on board, was cruising through the darkness in slight turbulence at 35,000ft (10,700m) and Mach 0.82, with "typical" weather conditions for the inter-tropical convergence zone (ITCZ) it was passing through. Then it went missing, without a word from the crew.
Because the aircraft was out of radar range and the pilots were having trouble with radio communication in the high-frequency band they use for long-range transmissions, it was many hours before Air France was forced to the unthinkable conclusion that the aircraft was lost.
Following a two-year search of unprecedented cost and technical difficulty, the main wreckage and the still-working flight recorders were recovered from the deep seabed. This year, three years after the event, the final accident report was delivered by French accident investigator, the BEA.

DISCUSSING THE CAUSES

The BEA's official verdict on AF447's "causes" (plural) was unusual in its style and presentation. The whole report was 200 pages long, not including its annexes and appendices, but the summary of causes alone comprised nearly 1,000 words. Its style was discursive rather than prescriptive, reflecting the dominance of human factors in the accident's causal chain, and the impossibility of knowing beyond all doubt what personal mental picture of the aircraft's performance led the pilots to act in an entirely unpredicted manner.
The word "unpredicted" applied to piloting activity is significant where aircraft design is concerned. When aircraft are first certificated by their aviation authority, their design and airworthiness of the airframe and its components is tested, but the certification logic also contains assumptions that pilots have certain basic competencies.
This has to be so because the pilots are as fundamental a component of the aircraft's operation as its wings. If the pilots do not demonstrate those assumed competencies and predicted behaviours effectively - and on the day of the accident, the BEA's report states, the AF447 pilots did not - the assumptions on which the aircraft was certificated are rendered invalid.
The "causes" section of the BEA report began with a narrative description of the sequence of events, starting with how the pilots were "completely surprised" by a temporary lack of airspeed information, then the pilot flying (PF) made "inappropriate control inputs that destabilised the flight path".
Following that self-generated upset, states the report, both pilots failed repeatedly to recognise or interpret what the aircraft instruments were showing them. The BEA ended its description with a series of proposals as to why the pilots' failures of cognitive perception occurred.
The occurrence that triggered the sequence of events leading to the AF447 crash was the temporary loss of reliable airspeed data when fine ice crystals momentarily blocked the pitot tubes (external airspeed sensors). This caused the autopilot to trip out - to which the PF reacted by affirming aloud that he had control - and caused the flight control law to change from "normal" [flight envelope protection] to "alternate" [no protection].
It is not certain that the pilots mentally absorbed the significance of the loss of flight envelope protection, although the electronic centralised aircraft monitor displayed the warning ALTN LAW (PROT LOST), and the pilot-not-flying (PNF) read aloud that piece of information.
All this occurred a few minutes after the aircraft commander had left the flightdeck for the crew rest cabin. His place in the left-hand seat was taken by the relief pilot, an experienced first officer who adopted the role of PNF, also known as "pilot monitoring".
During the handover, the captain had stayed on the flightdeck to hear the PF (in the right-hand seat) brief the newly arrived PNF about flight progress and weather situation in the ITCZ, including the light turbulence affecting the aircraft as they were speaking.
The captain did not give direct instructions about the task facing the pilots in the ITCZ, nor about the crew hierarchy he expected them to adopt during his rest, but he implied that the PF was in charge.
Normal procedure at Air France, notes the report, is for the pilot replacing the captain to take the decision-making role, no matter whether acting as PF or as pilot monitoring. The BEA says in its report that the captain's failure to make the pilots' roles clear may have set the tone for the almost total absence of effective co-operation (crew resource management) the pair subsequently displayed when things started to go wrong.
When the relief pilot arrived to take over, the captain's seat had been motored fully back and to the left to allow the captain's exit and provide access for his replacement. However, when the relief pilot sat down he never motored the seat forward to put himself within easy reach of the controls. He fastened his lap strap, but not the crotch strap. About 10 minutes later when the aircraft hit the dark sea, the seat was still against its back-stop.
THE UPSET
When the autopilot tripped out, there was a small indicated altitude loss (90m), to which the PF reacted with a dramatic rearward input on his sidestick. The vertical acceleration imparted was 1.6g, the nose pitched up reaching an attitude of +12˚, and the aircraft's speed began to drop fast. Exactly 46sec after the loss of reliable airspeed information, states the report, the stall warning sounded. Then, 2sec later, the aircraft exited its flight envelope, with buffet indicating a full stall. Meanwhile, the crew rapidly lost situational awareness and control of the aircraft, never to recover it.
Slightly less than 2min after the initial upset, says the BEA, control inputs meant the aircraft had established a nose-up attitude of +15˚, the angle of attack was 40˚, the engines were delivering maximum thrust, and the rate of descent was 10,000ft/min (51m/s). Looking at the instruments, the PF said: "I have no more displays." The PNF said: "We have no valid indications."
The report does not say it explicitly, but the pilots must either have stopped believing what they were seeing or, if they did give it any credence, their minds were rejecting the horrific implications of this combination of nose-high attitude, rapid rate of descent, and high power.
The shock of not understanding what they were seeing appeared to have immobilised them, although at that point, if they had been able to recognise the aircraft's flight profile, they could still have recovered control by employing the stall recovery procedure.
THE MENTAL PICTURE
The BEA's explanation as to why the pilots performed as they did is summed up in this single sentence in the report: "Human operators notice and react according to their mental representation of the situation, not to the real situation." This is a well-established piece of psychological wisdom on which pilot training techniques for instrument flying - also called "blind flying" - are based. The human mind and body, while working to control an aircraft's flightpath at night or in cloud, can easily be confused by the lack of external visual cues combined with subtle accelerations or rotations about any of the three flight axes.
Thus, pilots can develop a powerful but false mental picture of what the aircraft is doing. If the picture presented to the pilots by the flight instruments clashes with their physical feelings and mental images, they can become disorientated. US fliers refer to this feeling as "vertigo", because of its giddying power. Hence "blind flying" training is designed to drill into pilots that they should derive the cues on which they make their aircraft-guidance decisions exclusively from the working instruments, and they should reject signals from "the seat of their pants", however powerful these feelings may be.
In AF447, the report is able to state categorically that the crew were afflicted with at least one particularly powerful misconception: once the aircraft was in a high angle-of-attack stall, the cockpit voice recorder reveals the pilots interpreted the stall-related buffeting and the loud and unfamiliar slipstream noise as aircraft overspeed, which was the absolute reverse of reality. This overspeed illusion may have been all or part of the reason why the PF never released the pitch-up demand he applied to his sidestick.
The question now exercising the industry is this: the Air France pilots had been trained according to today's regulations and international standards. They were also reasonably experienced and current in all their qualifications. So does this imply that all their pilot peers - in Air France and in other carriers - are equally likely to be unable to cope with relatively minor unexpected occurrences under blind flying conditions? (See feature: AF447 foreshadowed).
The BEA report's presentation style changed again from discursive to prescriptive when listing its recommendations for action by the regulator and the industry: the BEA placed the reinforcement of pilot training at the top of the list of priorities for the European Aviation Safety Agency action (See Box: Training recommendations).
TRAINING PILOTS FOR TODAY
Meanwhile EASA, concerned about the growing evidence of the effect of high levels of aircraft automation on traditional piloting skills, has conducted a study on the subject. The headline finding was this: "Basic manual and cognitive flying skills tend to decline because of lack of practice, and feel for the aircraft can deteriorate."
EASA is not alone in its concern. Several industry groups have been studying - and continue to study - what might be done about this artificial separation of pilots from their aircraft, but no new or different training requirements have been mandated by regulators.
A few airlines have voluntarily incorporated an "upset recovery" or "recovery from unusual attitudes" component into their crews' recurrent training, but other carriers dispute its usefulness.
In an accident in 2001, these hastily-learned upset recovery skills caused an American Airlines A300-600 co-pilot to mishandle the rudder so dramatically he set up a fierce tail oscillation and sideslip, the fin broke off and the aircraft crashed. The US National Transportation Safety Board's report stated that this over-use of the rudder took place when the aircraft encountered rough - but not dangerous - wake turbulence.
There is a general consensus that honing pilot knowledge and skills should best concentrate on "staying in control", as EASA puts it, rather than recovering when the aircraft has already adopted an extreme attitude. Others take the "belt and braces" approach, demanding both.
The industry knows pilots are not getting the training they need for flying modern aircraft in a fast-developing, increasingly intense environment, so the question is: should they train more, or train differently? Because they cannot stay the same.
Read David Learmount's full analysis of Air France flight AF447