The
Human Factor

(By William Langewiesche, downloaded and edited without changing the content by Rik Nieuwenhuys for easyJet Flight Operations – please do not distribute this document outside easyJet)

Airline pilots were once the heroes of the skies. Today, in the quest for safety, airplanes are meant to largely fly themselves. Which is why the 2009 crash of Air France Flight 447, which killed 228 people, remains so perplexing and significant.

William Langewiesche explores how a series of small errors turned a state-­‐of-­‐ the-­‐art cockpit into a death trap.

TROUBLE AHEAD Inside the automated cockpit of an Airbus A330—like the one belonging to Air France that crashed into the equatorial Atlantic in 2009.

1

I. Into the Night

On the last day of May in 2009, as night enveloped the airport in Rio de Janeiro, the 216 passengers waiting to board a flight to Paris could not have suspected that they would never see daylight again, or that many would sit strapped to their seats for another two years before being found dead in the darkness, 13,000 feet below the surface of the Atlantic Ocean. But that is what happened. Air France Flight 447 carried a crew of nine flight attendants and three pilots— their numbers augmented because of duty-­‐time limitations on a 5,700-­‐mile trip that was expected to last nearly 11 hours. These were highly trained people, flying an immaculate wide-­‐bodied Airbus A330 for one of the premier airlines of the world, an iconic company of which all of France is proud. Even today—with the flight recorders recovered from the sea floor, French technical reports in hand, and exhaustive inquests under way in French courts—it remains almost unimaginable that the airplane crashed. A small glitch took Flight 447 down, a brief loss of airspeed indications—the merest blip of an information problem during steady straight-­‐and-­‐level flight. It seems absurd, but the pilots were overwhelmed.

To the question of why, the facile answer—that they happened to be three unusually incompetent men—has been widely dismissed. Other answers are more speculative, because the pilots can no longer explain themselves and had slid into a state of frantic incoherence before they died. But their incoherence tells us a lot. It seems to have been rooted in the very advances in piloting and aircraft design that have improved airline safety over the past 40 years. To put it briefly, automation has made it more and more unlikely that ordinary airline pilots will ever have to face a raw crisis in flight—but also more and more unlikely that they will be able to cope with such a crisis if one arises. Moreover, it is not clear that there is a way to resolve this paradox. That is why, to many observers, the loss of Air France 447 stands out as the most perplexing and significant airline accident of modern times.

The crew arrived in Rio three days before the accident and stayed at the Sofitel hotel on Copacabana Beach. At Air France, the layover there was considered to be especially desirable. The junior co-­‐pilot, Pierre-­‐Cédric Bonin, 32, had brought along his wife for the trip, leaving their two young sons at home, and the captain, Marc Dubois, 58, was traveling with an off-­‐duty flight attendant and opera singer. In the French manner, the accident report made no mention of Dubois’s private life, but that omission then required a finding that fatigue played no role, when the captain’s inattention clearly did. Dubois had come up the hard way, flying many kinds of airplanes before hiring on with Air Inter, a domestic airline subsequently absorbed by Air France; he was a veteran pilot, with nearly 11,000 flight hours, more than half of them as captain. But, it became known, he had gotten only one hour of sleep the previous night. Rather than resting, he had spent the day touring Rio with his companion.

2

Flight 447 took off on schedule at 7:29 P.M. with 228 people aboard. The Airbus A330 is a docile twinjet airplane with an automated cockpit and a computer-­‐ based fly-­‐by-­‐wire control system that serves up an extraordinarily stable ride and, at the extremes, will intervene to keep pilots from exceeding aerodynamic and structural limits. Over the 15 years since the fleet’s introduction, in 1994, not a single A330 in line service had crashed. Up in the cockpit, Dubois occupied the left seat, the standard captain’s position. Though he was the Pilot in Command, and ultimately responsible for the flight, he was serving on this run as the Pilot Not Flying, handling communications, checklists, and backup duties. Occupying the right seat was the junior co-­‐pilot, Bonin, whose turn it was to be the Pilot Flying—making the takeoff and landing, and managing the automation in cruising flight. Bonin was a type known as a Company Baby: he had been trained nearly from scratch by Air France and placed directly into Airbuses at a time when he had only a few hundred flight hours under his belt. By now he had accumulated 2,936 hours, but they were of low quality, and his experience was minimal, because almost all of his flight time was in fly-­‐by-­‐wire Airbuses running on autopilot.

Bonin switched on the autopilot four minutes after lifting off from Rio. This was standard procedure, as is the practice of flying by autopilot until just before touchdown. The route of the flight had been decided by company dispatchers in France and entered into the airplane’s flight-­‐management computer at the gate: it was a direct course up the coast of Brazil, over the city of Natal, then northeast across the Atlantic. The initial cruising altitude was to be 35,000 feet. The only weather complication was a line of thunderstorms associated with the Intertropical Convergence Zone, spanning the Atlantic just north of the equator. Satellite pictures suggested a developing pattern perhaps stronger than normal, and with storm clusters too high to top, but with gaps that could be negotiated laterally.

For now the night was smooth and clear. Thirty-­‐one minutes after takeoff, the autopilot leveled the airplane at 35,000 feet, nearly as high as the Airbus could fly, given the outside air temperature and the airplane’s weight; the automatic throttles set the thrust to achieve the selected 0.82 Mach, which in thin air translated into an aerodynamic speed of 280 knots, and, with the tailwind factored in, delivered a ground speed of 540 miles an hour. More than a thousand parameters were registered start to finish, for the entire duration of the trip, by the airplane’s data recorder. The cockpit voice recorder, by contrast, was a self-­‐erasing loop, a bit more than two hours long, restricted because of long-­‐standing privacy concerns by pilots. As a result, the voice recording opened on the scene two hours and five minutes before the end, or one hour and forty minutes into the flight.

It was 9:09 P.M. Rio time. Captain Dubois and the young Bonin had settled in for the ride, and the cockpit was mostly quiet. Someone shuffled papers. Someone adjusted a seat. At 9:24, Dubois mentioned that they might have to wait a bit longer for dinner, and Bonin replied affably that he too was getting hungry.

3

Though they had not previously been acquaintances, the two men addressed each other using the informal “tu,” a mannerism that has become de rigueur among Air France pilots. But as subsequent exchanges would demonstrate, Bonin was almost too deferential, and perhaps too aware of rank.

A flight attendant entered the cockpit to deliver the meal. She said, “All is well?”

Bonin answered brightly, “Tutti va bene!”

Dubois said nothing. Apparently he was wearing headphones and listening to opera on a portable device. Addressing him, the flight attendant said, “And you too? All is well?”

Dubois said, “Huh?”

“All is well? No coffee, no tea?”

“All is well,” he said.

Dubois handed his portable device to Bonin, urging him to listen to the opera piece. Bonin did not say, “Thank you, no, we’re on autopilot, but I’m supposed to be the Pilot Flying,” or “Thank you, no, I’m not interested in your girlfriend’s music.” He put on the headset, listened for a few minutes, and said, “All that’s missing is the whiskey!”

That was the end of the opera. Dubois indicated a line on an electronic map and said, “It’s the equator.”

“O.K.”

“You understood, I suppose.”

Bonin did not say, “Look, Captain Dubois, I’ve already flown five rotations to South America.” He said, “I figured . . . ”

Dubois said, “I like to feel where we’re going.”

Bonin agreed. He said, “Yeah.”

4

A weather text came in from the dispatchers in Paris, accompanied by a depiction of the developing line of thunderstorms ahead. Neither pilot made mention of it, but later comments hint that Bonin was growing nervous. Dubois then sowed confusion by answering an air-­‐traffic controller’s call to another Air France flight and insisting on it despite Bonin’s weak suggestions that he had gotten the call sign wrong. After a few minutes the controller gracefully sorted out the tangle and gave Flight 447 a frequency change. Similar confusions arose over required reporting points and frequencies ahead, but Bonin did not intervene. Conversation in the cockpit was desultory, generally about flight planning, sometimes not. The airplane sailed over the port city of Natal and headed out to sea.

Dubois said, “We were not hassled by thunderstorms, huh?” This might have been an opportunity for Bonin to express his uncertainty about the weather ahead, but at that moment the cockpit door opened and a flight attendant walked in, asking that the temperature in the baggage hold be lowered because she was carrying some meat in her suitcase. Bonin lowered the temperature. Fifteen minutes later a flight attendant called the cockpit on the intercom to report that passengers in the back were cold. Bonin mentioned the meat in the baggage hold.

By 10:30 P.M., the airplane had moved well offshore, and beyond view of air-­‐ traffic-­‐control radar. Dubois checked in with Brazilian oceanic control, known as Atlantico. He gave a position report and the time estimates for two waypoints to come. The controller thanked him and instructed him to maintain 35,000 feet. Bonin said, “Eh, well, there you are.” Dubois radioed, “Wilco.” The controller answered, “Thank you.” It was the flight’s last verbal exchange with land.

Bonin was anxious to cross the Intertropical Convergence Zone at a higher altitude in order to stay in smooth air by remaining above the clouds if possible. He was disturbed by Dubois’s acceptance of the altitude assigned. He said, “We won’t delay asking to climb nonetheless.” Dubois answered, “Yeah,” but did not make the request. As he saw it, there was nothing unusual about the Convergence Zone that night: they might encounter some turbulence during the crossing, but the heavy stuff could be avoided by using the airplane’s weather radar in a normal manner to zigzag loosely around the largest storms. Furthermore, there was no reason to believe that by flying a bit higher they would encounter significantly different weather. Finally there was this: the next-­‐ highest standard altitude for their direction of flight was 37,000 feet, which was shown on a screen as the current “recommended maximum,” or REC MAX. This was an altitude where, under current conditions, the performance margins would be tight, because the airplane would be flying at a relatively low airspeed and close to an aerodynamic stall. Standard procedure at Air France was to maintain greater margins by avoiding flight as high as REC MAX. Both pilots understood this. One of the enduring mysteries of Air France 447 is why Bonin kept wanting to climb.

5

All was black outside. Bonin saw the first storm on the radar, perhaps 200 miles in front. He said, “So we have a thing straight ahead.” Dubois barely answered. He said, “Yeah, I saw that,” and dropped the subject. A minute later, he commented on the outside air temperature, which was frigid at that altitude but 12 degrees Celsius warmer than standard. Bonin said, “Yeah, yeah, still, otherwise we’d have, we’d have a lot higher cruising altitude.” Dubois said, “Ah yeah . . . ” He was reading a magazine. He steered the conversation to an article about tax havens. Bonin tried to match his nonchalance. At 10:45 he said, “We’re crossing the equator. Did you feel the bump?”

“Huh?”

“Did you feel the bump?”

“Oh shit, no.”

“Well, there you are.”

There were no bumps; the night remained smooth as the airplane gradually approached the weather. Dubois said, “Bon, we’ll just take whatever measures are required.” It was the closest he came to advising Bonin of a plan. Bonin lowered the cockpit lighting and switched on the landing lights to illuminate the outside. They entered a cloud layer. Dubois answered an intercom call from a flight attendant, who told him she was taking the night duty in case he needed anything. He answered with a French endearment, “Yes, my flea,” and ended the call. Although thunderstorms lay ahead and were showing on the radar, no lightning was visible. They were in mild turbulence, without any need yet to deviate from the straight-­‐line course. Bonin said, “It would have been good to climb, huh?” Dubois said, “If there’s turbulence.” He meant significant turbulence, which the record later showed they never encountered. Referring to rules associated with distance from potential diversionary airports, Dubois said, “We’re entering the ETOPS zone, the death zone,” and Bonin answered, “Yeah, exactly.” The airplane was building up a static charge, causing some popping on the radios. Bonin got the impression that they were flying close to the top of the cloud layer. Once again he suggested a climb. “We try to ask for 3–6 [36,000 feet] nonstandard? We’re really at the limits [of the layer]. Even 3–6 would be good.” Dubois for once was unambiguous. He said, “We’re going to wait a bit, see if this passes.” The ghostly lights of Saint Elmo’s fire danced across the windscreen.

With most of the weather still lying ahead and an anxious junior pilot at the controls, Dubois decided it was time to get some sleep. The chief French investigator, Alain Bouillard, later said to me, “If the captain had stayed in position through the Intertropical Convergence Zone, it would have delayed his sleep by no more than 15 minutes, and because of his experience, maybe the story would have ended differently. But I do not believe it was fatigue that caused him to leave. It was more like customary behavior, part of the piloting culture within Air France. And his leaving was not against the rules. Still, it is surprising. If you are responsible for the outcome, you do not go on vacation during the main event.”

6

Just before 11 P.M. Rio time, Dubois brightened the cockpit lighting, limiting the view outside, and he rang the flight-­‐rest compartment, a small cabin containing two berths just behind the cockpit. A second co-­‐pilot had been dozing there, and he knocked on the wall in response. He was David Robert, 37, another Company Baby who, however, had more than twice the flight experience of Bonin and was the senior of the two. Robert had graduated from ENAC, one of the elite Grandes Écoles, and had recently migrated into the airline’s executive ranks, where he now had a management job at the operations center. He had opted for this trip in order to maintain his currency as a pilot, and had flown the outbound leg from Paris, and had made the landing in Rio, his first in three months. After his summons to the cockpit, he took two minutes to arrive.

II. Cockpit Resource Management In the short history of airline safety, the great turning point occurred in the 1950s with the introduction of jet airplanes, which were far more reliable and easy to fly than the complex piston-­‐engine behemoths that preceded them. Over the next two decades, as the global jet fleet grew, whole categories of accidents related to mechanical failures and weather were largely engineered away. The safety improvement was dramatic. It opened the way to airline travel as we know it today.

But by the 1970s, a new reality had come into view. Though the accident rate had been reduced, the accidents that continued to occur were being caused almost entirely by pilots—the very people, many of them still at the controls, who had earned a nearly heroic reputation for having stood in the way of the mechanical or weather-­‐related failures of the past. Pilot error had long been a recognized problem, but after the advent of jets it was as if an onion had been peeled to reveal an unexpectedly imperfect core. The problem was global. In Europe and the United States, a small number of specialists began to focus on the question. They were researchers, regulators, accident investigators, test pilots, and engineers. The timing was unfortunate for line pilots, who had begun to fight a futile rear-­‐guard action, ongoing today, against an inexorable rollback in salaries and status. The rollback was a consequence of the very improvements in technology that had made the airlines safer. Simply put, for airline pilots the glory days were numbered, and however unfortunate that was for them, for passengers it has turned out to be a good thing.

In the late 1970s, a small team of researchers at a NASA facility in Mountain View, California, began a systematic assessment of airline-­‐pilot performance. One of them was a young research psychologist and private pilot named John Lauber, who later served for 10 years as a member of the National Transportation Safety Board and went on to run the safety division at Airbus in France. As part of the NASA effort, Lauber spent several years riding in airline cockpits, observing the operations and taking notes. This was at a time when most crews still included a flight engineer, who sat behind the pilots and operated the airplane’s electrical and mechanical systems. What Lauber found was a culture dominated by authoritarian captains, many of them crusty old reactionaries who brooked no interference from their subordinates. In those cockpits, co-­‐pilots were lucky if occasionally they were allowed to fly.

7

Lauber told me about one occasion, when he entered a Boeing 727 cockpit at a gate before the captain arrived, and the flight engineer said, “I suppose you’ve been in a cockpit before.”

“Well, yes.”

“But you may not be aware that I’m the captain’s sexual adviser.”

“Well, no, I didn’t know that.”

“Yeah, because whenever I speak up, he says, ‘If I want your fucking advice, I’ll ask for it.’ ”

At Pan American World Airways, once the de facto U.S. flag carrier, such captains were known as Clipper Skippers, a reference to the flying boats of the 1930s. NASA talked the airline into lending it a full-­‐motion simulator at the San Francisco airport with which to run an experiment on 20 volunteer Boeing 747 crews. The scenario involved a routine departure from New York’s Kennedy Airport on a transatlantic flight, during which various difficulties would arise, forcing a return. It was devised by a self-­‐effacing British physician and pilot named Hugh Patrick Ruffell Smith, who died a few years later and is revered today for having reformed global airline operations, saving innumerable lives. John Lauber was closely involved. The simulator runs were intended to be as realistic as possible, including bad coffee and interruptions by flight attendants.

Lauber told me that at Pan Am some of the operations managers believed the scenario was too easy. “They said, ‘Look, these guys have been trained. You’re not going to see much of interest.’ Well, we saw a lot that was of interest. And it had not so much to do with the pilots’ physical ability to fly—their stick-­‐and-­‐ rudder skills—or their mastery of emergency procedures. Instead, it had everything to do with their management of the workload and internal communication. Making sure that the flight engineer was doing what a flight engineer needs to be doing, that the co-­‐pilot was handling the radios, that the captain was freeing himself to make the right decisions.”

It all depended on the captains. A few were natural team leaders—and their crews acquitted themselves well. Most, however, were Clipper Skippers, whose crews fell into disarray under pressure and made dangerous mistakes. Ruffell Smith published the results in January 1979, in a seminal paper, “NASA Technical Memorandum 78482.” The gist of it was that teamwork matters far more than individual piloting skill. This ran counter to long tradition in aviation but corresponded closely with the findings of another NASA group, which made a careful study of recent accidents and concluded that in almost all cases poor communication in the cockpit was to blame.

8

The airlines proved receptive to the research. In 1979, NASA held a workshop on the subject in San Francisco, attended by the heads of training departments from around the world. To describe the new approach, Lauber coined a term that caught on. He called it Cockpit Resource Management, or C.R.M., an abbreviation since widened to stand for Crew Resource Management. The idea was to nurture a less authoritarian cockpit culture—one that included a command hierarchy but encouraged a collaborative approach to flying, in which co-­‐pilots (now “first officers”) routinely handled the airplanes and were expected to express their opinions and question their captains if they saw mistakes being made. For their part, the captains were expected to admit to fallibility, seek advice, delegate roles, and fully communicate their plans and thoughts. Part of the package was a new approach to the use of simulators, with less effort spent in honing piloting skills and more emphasis placed on teamwork. This was known as line-­‐oriented flight training. As might be expected, the new ideas met with resistance from senior pilots, many of whom dismissed the NASA findings as psychobabble and derided the early seminars as charm schools. As in the old days, they insisted that their skill and authority were all that stood in the way of death for the public. Gradually, however, many of those pilots retired or were forced to change, and by the 1990s both C.R.M. and line-­‐oriented flight training had become the global standard, albeit imperfectly applied.

Though the effect on safety is difficult to quantify, because these innovations lie inseparably among others that have helped to improve the record, C.R.M. is seen to have been so successful that it has migrated into other realms, including surgery, where doctors, like pilots, are no longer the little gods they were before. In aviation, the change has been profound. Training has changed, co-­‐pilots have been empowered, and the importance of airplane-­‐handling skills by individual pilots has implicitly been de-­‐valued. But the most important point as it applies to Air France 447 is that the very design of the Airbus cockpit, like that of every recent Boeing, is based upon the expectation of clear communication and good teamwork, and if these are lacking, a crisis can quickly turn catastrophic.

The tenets of C.R.M., which emerged from the United States, fit naturally into the cultures of Anglo-­‐Saxon countries. Acceptance has been more difficult in certain Asian countries, where C.R.M. goes against the traditions of hierarchy and respect for elders. A notorious case was the 1997 crash of a Korean Air Boeing 747 that hit a hillside on a black night, while on approach to Guam, after a venerated captain descended prematurely and neither the co-­‐pilot nor the flight engineer emphatically raised concerns, though both men knew the captain was getting things wrong. In the impact 228 people died. Similar social dynamics have been implicated in other Asian accidents.

9

And Air France? As judged from the cockpit management on display in Flight 447 before it went down, NASA’s egalitarian discipline has devolved within the airline into a self-­‐indulgent style of flying in which co-­‐pilots address the captain using the informal “tu” but some captains feel entitled to do whatever they like. The sense of entitlement does not occur in a void. It can be placed in the context of a proud country that has become increasingly insecure. A senior executive at Airbus mentioned to me that in Britain and the United States the elites do not become airline pilots, whereas in France, as in less developed countries, they still do. This makes them difficult to manage. Bernard Ziegler, the visionary French test pilot and engineer behind the Airbus design, once said to me, “First you have to understand the mentality.”

I said, “Do you really think they are so arrogant?”

He said, “Some, yes. And they have the flaw of being too well paid.”

“So there must be no problem in the United States.”

But Ziegler was serious. He said, “Second, the union’s position is that pilots are always perfect. Working pilots are perfect, and dead pilots are, too.”

In the case of Air France 447 the union has gone so far as to suggest that it is immoral to blame the pilots because they cannot defend themselves. At the extreme, a 447 victims’ family group has even taken their side. It is an old pattern, deeply rooted. In 1953, when an Air France crew flew a perfectly good Constellation into a mountain during a routine descent into Nice, Ziegler’s father, who was the airline’s managing director, went with the chief pilot to report to the French prime minister. The prime minister opened by saying, “What did your pilot do wrong?,” and the chief pilot answered, “Monsieur, the pilot is never wrong.”

Ziegler smiled ironically. He is so blunt that for a while he required police protection. He was building airplanes so docile, he once declared, that even his concierge could fly them. We spoke soon after Air France 447 had crashed, and before the recorders had been recovered. France is a great aviation nation. And Ziegler is a patriot. But he is also a modernist. He has designed the most advanced airliners ever built. His point was that at Air France the piloting culture has not changed with the times.

10

III. Loss of Control

On the night of May 31, 2009, the pilots of Flight 447 certainly did not serve their passengers well. After Captain Dubois left the cockpit to get some sleep, Robert, the senior co-­‐pilot, sat on the left, serving as the Pilot Not Flying. Bonin, on the right, continued to handle the basic flying chores. The airplane was on autopilot doing .82 Mach, progressing toward Paris at 35,000 feet, mushing slightly with its nose two degrees up and its wings meeting the oncoming air at a positive angle of about three degrees—the all-­‐important, lift-­‐producing angle of attack.

As the angle of attack increases, so does lift efficiency—but only up to the point where the angle becomes too steep and the oncoming air can no longer flow smoothly over the tops of the wings. At that point, the airplane stalls. The phenomenon is characteristic of all airplanes and has nothing to do with the engines. When an airplane stalls, it loses lift and its wings begin to plow through the sky with enormous drag, far greater than engine thrust can overcome. The airplane enters a deep, mushing, nose-­‐high descent, often accompanied by difficulties in roll control. The only solution is to reduce the angle of attack by lowering the nose and diving. This is counter-­‐intuitive but basic to flight. The recovery requires altitude, but in cruise there is plenty of altitude to spare.

As usual with airliners at high altitude, Air France 447 was flying just shy of a problematic angle of attack. Three degrees higher, at 5 degrees, a warning would have sounded in the cockpit, and 5 degrees higher still, at an angle of attack of about 10 degrees, theoretically the airplane would have stalled. The last is theoretical because in the A330, under an all-­‐encompassing automation regime known as Normal Law, the flight-­‐control system intervenes to protect against the stall: it lowers the nose and advances the power in a manner that cannot be overridden by the pilots. Such interventions are extremely rare. Pilots spend their entire careers without experiencing them—unless something goes really wrong with their judgment.

Something went really wrong here, but for now nothing was out of the ordinary. In front of each pilot, Bonin and Robert, were two independently sourced flat-­‐ screen displays. The easiest for casual observers to understand were the navigational displays—moving maps showing heading, course, waypoints, and ground speed, with weather radar superimposed. But the more important were the primary flight displays, each built around a symbolic representation of the airplane in relation to a horizon line—showing pitch (nose up or down) and bank (wings level or not), along with heading, altitude, airspeed, and climb or descent rates. A third, standby display showed much the same, though in smaller form. It is on the basis of such marvels of informational presentation that pilots maintain control while flying by hand at night or in clouds, when the actual horizon cannot be seen.

11

After Dubois turned up the cockpit lights, the view outside was black. The airplane entered another cloud layer and was jostled by light turbulence. In the passenger cabin the seat-­‐belt sign was on. Bonin rang the forward flight-­‐ attendant station and said, “Yes, Maryline, it’s Pierre up front. Listen, in about two minutes we ought to be in an area where it will start moving around a bit more than now.” He advised the cabin crew to take their seats and rang off with “I’ll call you when we’re out of it.” As it happened, he never did.

The turbulence increased slightly. Bonin kept lamenting the inability to climb. He mentioned again the unusually warm temperature outside: “Standard plus 13.” Then he said, “Putain la vache. Putain!” Very roughly this translates into “Fucking hell. Fuck!” There was no particular reason for his outburst. He was anxious. He said, “We’re really at the very top of the cloud deck. It’s too bad. I’m sure that with a nonstandard 3–6-­‐0 [36,000 feet], if we did that, it would be good . . . ”

Robert did not respond. He was looking at his navigational display, which showed a thunderstorm dead ahead. He said, “You want to go a little to the left?” The suggestion was posed as a question. Bonin said, “Excuse me?” Robert said, “You can eventually go a bit to the left.” This was closer to a command. Bonin selected a heading 20 degrees to the left, and the airplane dutifully turned. The exchange was the first step in a confusing shift by which Bonin began to acquiesce to Robert’s authority without acceding to it completely.

They entered an area of heavier weather, and the cockpit filled with the muted roar of ice crystals hitting the windscreen. Bonin dialed back the airplane’s speed by selecting .80 Mach. Robert shrugged verbally. He said, “It costs nothing.” The automatic throttles responded by reducing the thrust. The angle of attack slightly increased. The turbulence was light to occasionally moderate. The noise of the ice crystals continued.

Unbeknownst to the pilots, the ice crystals began to accumulate inside the airplane’s three air-­‐pressure probes, known as pitot tubes, which were mounted on the underside of the nose. The clogging of that particular probe design was a known issue on certain Airbus models, and though it occurred only under rare high-­‐altitude conditions and had never led to an accident, it was considered to be serious enough that Air France had decided to replace the probes with ones of an improved design and had sent out an advisory to warn pilots of the problem. The first of the replacement probes had just arrived in Paris and were waiting in a storeroom to be installed.

12

For Flight 447, it was too late: the probes were quickly clogged. Just after 11:10 P.M., as a result of the blockage, all three of the cockpit’s airspeed indications failed, dropping to impossibly low values. Also as a result of the blockage, the indications of altitude blipped down by an unimportant 360 feet. Neither pilot had time to notice these readings before the autopilot, reacting to the loss of valid airspeed data, disengaged from the control system and sounded the first of many alarms—an electronic “cavalry charge.” For similar reasons, the automatic throttles shifted modes, locking onto the current thrust, and the fly-­‐by-­‐wire control system, which needs airspeed data to function at full capacity, reconfigured itself from Normal Law into a reduced regime called Alternate Law, which eliminated stall protection and changed the nature of roll control so that in this one sense the A330 now handled like a conventional airplane. All of this was necessary, minimal, and a logical response by the machine.

So here is the picture at that moment: the airplane was in steady-­‐state cruise, pointing straight ahead without pitching up or down, and with the power set perfectly to deliver a tranquil .80 Mach. The turbulence was so light that one could have walked the aisles—though perhaps a bit unsteadily. Aside from a minor blip in altitude indication, the only significant failure was the indication of airspeed—but the airspeed itself was unaffected. No crisis existed. The episode should have been a non-­‐event, and one that would not last long. The airplane was in the control of the pilots, and if they had done nothing, they would have done all they needed to do.

Naturally the pilots were surprised. At first they understood only that the autopilot had disengaged. Light turbulence tilted the airplane into a gentle bank. Bonin reached for the side-­‐stick to his right, a device similar in appearance to a gaming stick. He said, “I’ve got the controls!,” and Robert answered, “O.K.” A C-­‐ chord alert sounded because the indications of altitude had deviated from the selected 35,000 feet. It is likely that Bonin was gripping his control stick much too hard: the data recorder, which measures stick movements, later showed that he was flailing from the start, trying to level the wings but using high-­‐amplitude inputs like a panicked driver over-­‐controlling a car. It caused the airplane to rock left and right. This was possibly the result of Bonin’s unfamiliarity with handling the Airbus in Alternate Law, particularly at high altitude, where conventional roll characteristics change. Had he been more seasoned, he might have loosened his grip—backed off to his fingertips—and settled things down. The record shows that he never did.

But worse—far worse—was what Bonin did in the vertical sense: he pulled the stick back. Initially this may have been a startle response to the false indication of a minor altitude loss. But Bonin didn’t just ease the stick back—he hauled it back, three-­‐fourths of the way to the stop, and then he kept on pulling. Alain Bouillard, the French investigator, equated the reaction to curling instinctively into a fetal position. The airplane responded by pitching up into an unsustainable climb, causing its speed to slow and its angle of attack to increase.

13

Six seconds after Bonin assumed control, with the C-­‐chord altitude alert chiming in the cockpit, a brief stall warning sounded. It was a loud synthetic male voice. It said STALL one time. The C-­‐chord alert resumed. Robert said, “What was that?” The airplane answered, STALL STALL, and again the C-­‐chord sounded. Neither pilot grasped the message. The angle of attack had increased to about 5 degrees, and the wings were still flying well, but it was time to do something about the warning. Bonin said, “We don’t have a good indication of . . . speed!,” and Robert concurred, saying, “We’ve lost the speeds!”

With that realization—that the airspeed indications had dropped out—the problem should have been solved. Though Bonin had reacted wildly on the controls, the crew had assessed the failure correctly within 11 seconds of the onset, about as quickly as could be expected. The nose was 11 degrees up, which was excessive at high altitude but not in itself extreme. The solution was simple, and fundamental to flying. All Bonin had to do was to lower the nose to a normal cruising pitch—about to the horizon—and leave the thrust alone. The airplane would have returned to cruising flight at the same speed as before, even if that speed could not for the moment be known.

But Bonin continued to pull back on the stick, jerkily pitching the nose higher. Was he yearning for the clear sky he believed was just above? Was he remembering an “unreliable airspeed” procedure that is meant for low altitude, where power is ample and the biggest concern is to climb away from the ground? Did he think that the airplane was going too fast? Evidence emerged later that he may have, but if so, why? Even if he did not hear the stall warning, the nose was up, the available thrust was low, and with or without valid indications, high-­‐ speed flight in those conditions was physically impossible. A renowned cockpit designer at Boeing—himself a transport pilot—once said to me, “We don’t believe there are any bad pilots. We believe there are average pilots who have bad days.” He called this a principle that underlies Boeing’s cockpit designs. But if Bonin was an average pilot, what does that say about the average?

At least one answer takes the form of the man on his left. After Robert concurred that the airspeed indications had been lost, he looked away from the main flight displays, thereby abandoning his primary role as the Pilot Not Flying, which according to the tenets of C.R.M. should have been to monitor Bonin’s actions. Instead he started reading aloud from a message screen that ranks and displays certain system conditions, and in some cases provides abbreviated advice on procedures. In this case the advice was irrelevant to the situation, but it led Bonin to switch off the thrust lock, which caused the engines to spool up automatically to full thrust. It was the first of a series of seesaw power changes that complicated the picture for the pilots and must have caught the attention of some passengers.

Robert kept reading from the message screen. He said, “Alternate Law. Protections Lost.” This at least was relevant. It meant that the wings could stall, and that the warnings had to be heeded. It is not clear, however, that Robert had processed his own words or that Bonin had heard them.

14

Robert said, “Wait, we’re losing . . . ” He stopped. Twenty seconds had passed since the loss of airspeed indications. They were soaring upward through the thin air at 36,000 feet and bleeding off speed. The nose was 12 degrees up.

Robert returned to the primary flight displays. He said, “Pay attention to your speed! Pay attention to your speed!” By this he must have meant the airplane’s pitch, since the airspeed indications remained obviously invalid. Bonin may have understood the same, because he said, “O.K., I’m going back down!” He lowered the nose, but by only half a degree. The airplane continued to climb.

Robert said, “You stabilize!”

Bonin said, “Yeah!”

“You go back down!” Robert pointed to a measure of climb rate or altitude. “We’re climbing, according to this! According to all three, you’re climbing! So you go back down!”

“O.K.!”

“You’re at . . . Go back down!”

This is not the time for a dissertation on the Airbus flight-­‐control system, which is criticized by Boeing, but to the extent that it embodies a mistake in design, it is that the pilot’s and co-­‐pilot’s side-­‐sticks are not linked and do not move in unison. This means that when the Pilot Flying deflects his stick, the other stick remains stationary, in the neutral position. If both pilots deflect their sticks at the same time, a DUAL INPUT warning sounds, and the airplane responds by splitting the difference. To keep this from causing a problem in the case of a side-­‐ stick jam, each stick has a priority button that cuts out the other one and allows for full control. The arrangement relies on clear communication and good teamwork to function as intended. Indeed, it represents an extreme case of empowering the co-­‐pilot and accepting C.R.M. into a design. More immediately, the lack of linkage did not allow Robert to feel Bonin’s flailing.

Bonin pushed the stick forward, and the nose pitched down, but a little too quickly for Robert’s taste, lightening the load to 0.7 G’s, a third of the way to weightlessness. Robert said, “Gently!” Apparently he realized only now that the engines had spooled up. He said, “What is that?”

15

Bonin said, “We’re in climb!” It seems that one of the pilots now pulled the throttles back to idle, and six seconds later the other advanced them again. It is not clear who did what, but it seems likely that Bonin opted for idle and Robert for thrust. Bonin by then had gotten the nose down to a six-­‐degree pitch, and the climb had tapered. Though they remained in an untenable position, all he had to do was lower the nose another few degrees and they would have been back where they started. But Bonin for some reason did not do it, and Robert seemed to run out of ideas. He kept trying to rouse the captain, Dubois, by repeatedly pushing the call button to the flight-­‐rest compartment, behind the cockpit. He said, “Fuck, where is he?”

Bonin began to pull back on the stick again, raising the nose 13 degrees above the horizon. The angle of attack increased, and three seconds later the airplane began to shake with the onset of a stall. The shaking is known as a buffet. It occurs as the flow of air boils across the wings. As the stall develops more fully, it becomes rough enough in the cockpit to make the instruments hard to read.

Carried by inertia, the airplane continued to climb. A flight attendant called onto the intercom, apparently in response to Robert, who may unintentionally have rung her while trying to rouse the captain. She said, “Hello?” As if the buffet weren’t enough of an indication, the stall warning erupted again, alternating between STALL STALL STALL and a chirping sound. The warnings sounded continuously for the next 54 seconds.

The flight attendant said, “Yes?”

Robert ignored her. He may have realized that they had stalled, but he did not say, “We’ve stalled.” To Bonin he said, “Especially try to touch the lateral controls as little as possible.” This is a minor part of stall recovery, and nothing compared with lowering the nose.

The flight attendant said, “Hello?”

Struggling with the controls, and with increasing difficulty keeping the wings level, Bonin said, “I’m at TOGA, huh?” TOGA is an acronym for maximum thrust. It is another minor part of stall recovery, especially at high altitude, near an airplane’s propulsive ceiling, where maximum thrust means very little thrust at all. Bonin kept raising the nose, pulling it as high as 18 degrees.

Robert said, “Fuck, is he coming or not?”

The flight attendant said, “It doesn’t answer,” and hung up with a click.

16

By then the pitot tubes had unfrozen, and the airspeed indicators were working normally again—though this would not have been obvious to Bonin or Robert, in part because they had no idea of the speed that the indications at this point should have shown, and apparently did not have the presence of mind to extrapolate from the G.P.S.-­‐derived ground speed, which had been displayed on the navigational screen all along. For the next 12 seconds, neither pilot spoke. Amid repeated stall alarms, the airplane ran out of the inertial ability to climb, topped a parabolic arc at 38,000 feet, and started down on the far side with its nose up and, out at the wings, an angle of attack as steep as 23 degrees. One minute and 17 seconds had passed since the trouble had started, and that is a very long time. The descent rate rapidly grew to 3,900 feet per minute, and as a result, the angle of attack further increased. The buffeting grew heavy.

Dubois finally knocked on the cockpit wall, signaling that he was coming. Robert kept urgently ringing the call button anyway. He said, “But we’ve got the engines! What the hell is happening?” STALL. STALL. STALL. He said, “Do you understand what’s happening, or not?”

Bonin said, “Fuck, I don’t have control of the airplane anymore! I don’t have control of the airplane at all!” Because the right wing was stalled more deeply than the left, the airplane was rolling in that direction.

Robert said, “Controls to the left!” Using the priority button on his side-­‐stick, he assumed control of the airplane. He had it for only a second before Bonin, using his own priority button, and without saying a word, took control back. This left Robert with a sense that his side-­‐stick had failed. He said, “Fuck, what’s going on?”

Bonin said, “I have the impression we’re going crazily fast.” With the nose up and little thrust available? How could he have been so confused? We do not know.

The cockpit door opened, and Dubois entered. All was commotion. Rather calmly he asked, “What’s happening?” STALL. STALL. STALL. The cockpit was shaking heavily.

Robert did not say, “We lost airspeed indications, and this guy pulled up. We’re in Alternate Law. We climbed to 38,000 feet, and now we’re going down.” He said, “I don’t know what’s happening!”

Bonin said, “We’re losing control of the airplane!”

The Airbus was passing through the original altitude of 35,000 feet; the nose was 15 degrees up; the descent rate was 10,000 feet per minute and increasing; the angle of attack, though not indicated in the cockpit, was an incredible 41 degrees; the right wing was down unstoppably by 32 degrees; and the airplane was arcing off course through the blackness over the mid-­‐Atlantic.

Robert said to Dubois, “We completely lost control of the airplane, and we don’t understand anything! We tried everything!”

17

IV. Flying Robots Robert’s confusion was later reflected in the frustration of engineers and air-­‐ safety specialists worldwide. The A330 is a masterpiece of design, and one of the most foolproof airplanes ever built. How could a brief airspeed-­‐indication failure in an uncritical phase of the flight have caused these Air France pilots to get so tangled up? And how could they not have understood that the airplane had stalled? The roots of the problem seem to lie paradoxically in the very same cockpit designs that have helped to make the last few generations of airliners extraordinarily safe and easy to fly.

This is as true for Boeing as for Airbus, because, whatever their rivalries and differences, both manufacturers have come to similar cockpit solutions. The first was the elimination of the flight-­‐engineer position, despite loud objections by the pilots’ unions, which claimed that safety would be compromised. This occurred in the late 1970s, at the same time that John Lauber and the NASA researchers were pursuing their systematic studies of flight-­‐crew performance and were coming up with the idea of Crew Resource Management. By then the individual aircraft systems—engines, fuel, electronics, pressurization, hydraulics, and so on—had become sufficiently self-­‐regulating that there was no longer a need for a third crew member to control them manually. Airbus was the underdog, hemorrhaging public funds and making airplanes that did not sell. It decided on a no-­‐compromise gamble to produce the most technologically advanced airliners that could be designed. Ignoring the union clamor, it started by imposing a two-­‐ person cockpit on its models, kicking off an argument about the value of pilots that still comes into view every time an Airbus crashes. Boeing, which was developing the 757 and 767 concurrently, took a more polite position, but the writing was on the wall. The Boeing 737 and Douglas DC-­‐9 had already been certified to operate with two-­‐pilot crews, without a flight engineer aboard. After a presidential task force in the United States studied the matter and concluded that a third crew member in the cockpit constituted, if anything, a distraction, the unions accepted defeat.

The question was how to design cockpits for the two-­‐pilot crews, particularly in light of advances in micro-­‐computing power, digital sensing, bright-­‐screen displays, and new navigational possibilities that invited the use of electronic moving maps. The manufacturers scrapped the crowded electro-­‐mechanical panels of the past and, using proof-­‐of-­‐concept work done by NASA, equipped their new airplanes with “glass” cockpits built around flat-­‐panel displays. The new displays offered many advantages, including the ability to de-­‐clutter the cockpit by consolidating basic flight information onto a few screens, using improved symbols, and burying much of the rest—but in readily available form. Like C.R.M., it was all about getting better, more consistent performance from pilots—and it has done that.

18

Automation is an integral part of the package. Autopilots have been around since nearly the start of aviation, and component systems have been automated since the 1960s, but in glass-­‐cockpit designs, the automation is centralized and allows the systems to communicate with one another, to act as parts of an integrated whole, and even to decide which information should be presented to the pilots, and when. At the core are flight-­‐management computers—with keypads mounted on central pedestals—which are largely pre-­‐programmed on the ground according to optimizations decided upon by airline dispatchers, and which guide the airplane’s autopilots through the full complexity of each flight. By the mid-­‐1980s, many such airplanes, both Airbuses and Boeings, had entered the global fleet, for the most part leaving their pilots to simply observe the functioning of the systems. In 1987, Airbus took the next step by introducing the first fly-­‐by-­‐wire airliner, the smallish A320, in which computers interpret the pilots’ stick inputs before moving the control surfaces on the wings and tail. Every Airbus since has been the same, and Boeing has followed suit in its own way.

These are generally known as “fourth generation” airplanes; they now constitute nearly half the global fleet. Since their introduction, the accident rate has plummeted to such a degree that some investigators at the National Transportation Safety Board have recently retired early for lack of activity in the field. There is simply no arguing with the success of the automation. The designers behind it are among the greatest unheralded heroes of our time. Still, accidents continue to happen, and many of them are now caused by confusion in the interface between the pilot and a semi-­‐robotic machine. Specialists have sounded the warnings about this for years: automation complexity comes with side effects that are often unintended. One of the cautionary voices was that of a beloved engineer named Earl Wiener, recently deceased, who taught at the University of Miami. Wiener is known for “Wiener’s Laws,” a short list that he wrote in the 1980s. Among them:

• Every device creates its own opportunity for human error. • Exotic devices create exotic problems. • Digital devices tune out small errors while creating opportunities for large errors. • Invention is the mother of necessity. • Some problems have no solution. • It takes an airplane to bring out the worst in a pilot. • Whenever you solve a problem, you usually create one. You can only hope that the one you created is less critical than the one you eliminated. • You can never be too rich or too thin (Duchess of Windsor) or too careful about what you put into a digital flight-­‐guidance system (Wiener).

19

Wiener pointed out that the effect of automation is to reduce the cockpit workload when the workload is low and to increase it when the workload is high. Nadine Sarter, an industrial engineer at the University of Michigan, and one of the pre-­‐eminent researchers in the field, made the same point to me in a different way: “Look, as automation level goes up, the help provided goes up, workload is lowered, and all the expected benefits are achieved. But then if the automation in some way fails, there is a significant price to pay. We need to think about whether there is a level where you get considerable benefits from the automation but if something goes wrong the pilot can still handle it.”

Sarter has been questioning this for years and recently participated in a major F.A.A. study of automation usage, released in the fall of 2013, that came to similar conclusions. The problem is that beneath the surface simplicity of glass cockpits, and the ease of fly-­‐by-­‐wire control, the designs are in fact bewilderingly baroque—all the more so because most functions lie beyond view. Pilots can get confused to an extent they never would have in more basic airplanes. When I mentioned the inherent complexity to Delmar Fadden, a former chief of cockpit technology at Boeing, he emphatically denied that it posed a problem, as did the engineers I spoke to at Airbus. Airplane manufacturers cannot admit to serious issues with their machines, because of the liability involved, but I did not doubt their sincerity. Fadden did say that once capabilities are added to an aircraft system, particularly to the flight-­‐management computer, because of certification requirements they become impossibly expensive to remove. And yes, if neither removed nor used, they lurk in the depths unseen. But that was as far as he would go.

Sarter has written extensively about “automation surprises,” often related to control modes that the pilot does not fully understand or that the airplane may have switched into autonomously, perhaps with an annunciation but without the pilot’s awareness. Such surprises certainly added to the confusion aboard Air France 447. One of the more common questions asked in cockpits today is “What’s it doing now?” Robert’s “We don’t understand anything!” was an extreme version of the same. Sarter said, “We now have this systemic problem with complexity, and it does not involve just one manufacturer. I could easily list 10 or more incidents from either manufacturer where the problem was related to automation and confusion. Complexity means you have a large number of subcomponents and they interact in sometimes unexpected ways. Pilots don’t know, because they haven’t experienced the fringe conditions that are built into the system. I was once in a room with five engineers who had been involved in building a particular airplane, and I started asking, ‘Well, how does this or that work?’ And they could not agree on the answers. So I was thinking, If these five engineers cannot agree, the poor pilot, if he ever encounters that particular situation . . . well, good luck.”

20

In the straight-­‐on automation incidents that concern Sarter, the pilots overestimate their knowledge of the aircraft systems, then do something expecting a certain result, only to find that the airplane reacts differently and seems to have assumed command. This is far more common than the record indicates, because rarely do such surprises lead to accidents, and only in the most serious cases of altitude busting or in-­‐flight upsets are they necessarily reported. Air France 447 had an additional component. The blockage of the pitot tubes led to an old-­‐fashioned indication failure, and the resulting disconnection of the autopilot was an old-­‐fashioned response: trust the pilots to sort things out. There were definitely automation complications in what followed, and to that mix one can add the design decision not to link the two control sticks. But on Air France 447, the automation problem ran still deeper. Bonin and Robert were flying a fourth-­‐generation glass-­‐cockpit airplane, and unlike the pilots who think they know more than they do, these two seemed to fear its complexities. The Airbus was reacting in a conventional manner, but once they ventured beyond the routine of normal cruise they did not trust the nature of the machine. It is hard to imagine that this would have happened under the old Clipper Skippers, the stick-­‐and-­‐rudder boys. But Bonin and Robert? It was as if progress had pulled the rug out from beneath elementary aeronautical understanding.

V. The Final Descent

Captain Dubois entered the cockpit 1 minute and 38 seconds after the pitot tubes malfunctioned. It is not known whether he knelt or stood behind Bonin and Robert, or sat in the jump seat. Likewise, the conditions in the passenger cabin are not known. Though the unusual motions must have been noticed by some, and the passengers seated in front may have heard the cockpit alarms, there is no evidence that panic broke out, and no screams were recorded.

In the cockpit, the situation was off the scale of test flights. After Dubois arrived, the stall warning temporarily stopped, essentially because the angle of attack was so extreme that the system rejected the data as invalid. This led to a perverse reversal that lasted nearly to the impact: each time Bonin happened to lower the nose, rendering the angle of attack marginally less severe, the stall warning sounded again—a negative reinforcement that may have locked him into his pattern of pitching up, assuming he was hearing the stall warning at all.

Dubois pointed to an indication on a flight display. He said, “So, here, take that, take that.”

Robert repeated the order more urgently. “Take that, take that! But try to take that!”

The stall warning erupted again. Bonin said, “I have a problem—it’s that I don’t have a vertical-­‐speed indication anymore!” Dubois merely grunted in response. Bonin said, “I have no more displays!” This was not correct. He had displays but didn’t believe them. The descent rate was now 15,000 feet per minute.

21

Robert was suffering from the same disbelief. He said, “We don’t have a single valid display!”

Bonin said, “I have the impression we’re going crazily fast! No? What do you think?” He reached for the speed-­‐brake lever and pulled it.

Robert said, “No. No! Above all don’t extend the brakes!”

“No? O.K.!” The speed brakes retracted.

At times both of them were on their side-­‐sticks, countermanding each other on the controls. Bonin said, “So, we’re still going down!”

Robert said, “Let’s pull!”

For 23 seconds Captain Dubois had said nothing. Robert finally roused him. He said, “What do you think? What do you think? What do you see?”

Dubois said, “I don’t know. It’s descending.”

It is said in his defense that he faced an indecipherable scene, having arrived after the loss of control, but his observer status was actually an advantage. He knew nothing of the original airspeed-­‐indication failure. Now he had a functional panel, showing low airspeeds, a low ground speed, a nose-­‐high attitude, and a big descent under way. Add to that the repeated stall warnings, the telltale buffeting, and the difficulty in controlling roll. It might have been helpful to have an angle-­‐ of-­‐attack display—one capable of indicating such extremes—but what else could this be but a stall?

Bonin had managed to come out of the sustained right bank. He said, “There you are! There—it’s good. We’ve come back to wings level—no, it won’t . . . ” The airplane was rocking between left-­‐ and right-­‐bank angles up to 17 degrees.

Dubois said, “Level the wings. The horizon, the standby horizon.”

Then things got even more confused. Robert said, “Your speed! You’re climbing!” He probably meant that Bonin was raising the nose, because the airplane was emphatically not climbing. He said, “Descend! Descend, descend, descend!,” again apparently referring to pitch.

Bonin said, “I am descending!”

Dubois picked up the language. He said, “No, you’re climbing.”

Bonin may have realized that the reference was to pitch. He said, “I’m climbing? O.K., so we’re going down.”

22

Communication in the cockpit was withering. Robert said, “O.K., we’re at TOGA.”

Bonin asked, “What are we now? In altitude, what do we have?” Apparently he was too busy to see for himself.

Dubois said, “Fuck, it’s not possible.”

“In altitude what do we have?”

Robert said, “What do you mean ‘in altitude’?”

“Yeah, yeah, I’m descending, no?”

“You’re descending, yes.”

Bonin never got his answer, but the airplane was dropping through 20,000 feet. It rolled into a steep, 41-­‐degree bank to the right. Dubois said, “Hey, you, you’re in . . . Put, put the wings level!”

Robert repeated, “Put the wings level!”

“That’s what I’m trying to do!”

Dubois was not happy. He said, “Put the wings level!”

“I’m at full left stick!”

Robert moved his own side-­‐stick. A synthetic voice said, DUAL INPUT.

Dubois said, “The rudder.” This did the trick, and the airplane righted. Dubois said, “Wings level. Go gently, gently!”

In confusion, Robert said, “We’ve lost everything on the left wing! I have nothing left there!”

Dubois answered, “What do you have?,” then “No, wait!”

Though precise modeling was never pursued, the investigators later estimated that this was the last moment, as the airplane dropped through 13,000 feet, when a recovery would theoretically have been possible. The maneuver would have required a perfect pilot to lower the nose at least 30 degrees below the horizon and dive into the descent, accepting a huge altitude loss in order to accelerate to a flying angle of attack, and then rounding out of the dive just above the waves, pulling up with sufficient vigor to keep from exceeding the airplane’s speed limit, yet not so violently as to cause a structural failure. There are perhaps a handful of pilots in the world who might have succeeded, but this Air France crew was not among them. There is an old truth in aviation that the reasons you get into trouble become the reasons you don’t get out of it.

23

Bonin said, “We’re, we’re there, we’re getting to level 100!” Level 100 is 10,000 feet. It’s a standard call in normal operations. It used to be said that below 10,000 you were in “Indian country.” Now it’s said that the cockpit should be sterile, meaning there must be no distractions.

Robert said, “Wait! Me, I have the, I have the controls, me!” He did not push his priority button, and Bonin did not relinquish his stick. The synthetic voice said, DUAL INPUT. The airplane’s angle of attack remained at 41 degrees.

Bonin said, “What is it? How is it that we’re continuing to descend so deeply?”

Robert directed Captain Dubois to the overhead switching panel. He said, “Try to see what you can do with your controls up there! The primaries, etc.”

Dubois said, “It won’t do anything.”

Bonin said, “We’re getting to level 100!” Four seconds later he said, “Nine thousand feet!” He was struggling to keep the wings level.

Dubois said, “Easy on the rudder.”

Robert said, “Climb, climb, climb, climb!” He meant, Pitch up!

Bonin said, “But I’ve been at full-­‐back stick for a while!” DUAL INPUT.

Dubois said, “No, no, no! Do not climb!” He meant, Do not pitch up!

Robert said, “So go down!” DUAL INPUT.

Bonin said, “Go ahead—you have the controls. We are still in TOGA, eh.” Someone said, “Gentlemen . . . ” Otherwise, for the next 13 seconds none of them spoke. Count it on a clock. Robert was doing the flying. The cockpit was lousy with automated warnings.

Dubois said, “Watch out—you’re pitching up there.”

Robert said, “I’m pitching up?”

“You’re pitching up.”

Bonin said, “Well, we need to! We are at 4,000 feet!” But pitching up is what had gotten them into trouble to start with. The ground-­‐proximity warning system sounded. A synthetic voice said, SINK RATE. PULL UP.

Dubois said, “Go on, pull.” With that, it seems, he had resigned himself to death.

Bonin was younger. He had a wife in the back and two little children at home. He assumed control, saying, “Let’s go! Pull up, pull up, pull up!”

24

Robert said, “Fuck, we’re going to crash! It’s not true! But what’s happening?”

In sequence the alarms were sounding PULL UP, C-­‐chord, STALL, C-­‐chord, PULL UP, PRIORITY RIGHT. At the same time either Robert or Bonin said, “Fuck, we’re dead.”

Dubois calmly said, “Ten degrees pitch.”

Thousand one, thousand two. Flight 447 then pancaked into the equatorial Atlantic. The time in Rio was 11:14 P.M., 4 hours and 15 minutes into the flight, and 4 minutes and 20 seconds into the upset. Two years later, when the flight-­‐ data recorder was retrieved, it showed that by the last moment the airplane had turned 225 degrees off course and was flying due west with its nose 16 degrees up and its wings nearly level; thoroughly stalled, it was progressing at merely 107 knots, but with a descent rate, despite full thrust, of 11,000 feet per minute. The impact was shattering. Everyone aboard died instantly, and the wreckage sank in deep water. In the small debris field soon found floating on the surface lay 50 bodies, including that of Captain Marc Dubois.

VI. Brave New World

For commercial-­‐jet designers, there are some immutable facts of life. It is crucial that your airplanes be flown safely and as cheaply as possible within the constraints of wind and weather. Once the questions of aircraft performance and reliability have been resolved, you are left to face the most difficult thing, which is the actions of pilots. There are more than 300,000 commercial-­‐airline pilots in the world, of every culture. They work for hundreds of airlines in the privacy of cockpits, where their behavior is difficult to monitor. Some of the pilots are superb, but most are average, and a few are simply bad. To make matters worse, with the exception of the best, all of them think they are better than they are. Airbus has made extensive studies that show this to be true. The problem in the real world is that the pilots who crash your airplanes or simply burn too much fuel are difficult to spot in the crowd. A Boeing engineer gave me his perspective on this. He said, “Look, pilots are like other people. Some are heroic under pressure, and some duck and run. Either way, it’s hard to tell in advance. You almost need a war to find out.” But of course you can’t have a war to find out. Instead, what you do is try to insert your thinking into the cockpit.

First, you put the Clipper Skipper out to pasture, because he has the unilateral power to screw things up. You replace him with a teamwork concept—call it Crew Resource Management—that encourages checks and balances and requires pilots to take turns at flying. Now it takes two to screw things up. Next you automate the component systems so they require minimal human intervention, and you integrate them into a self-­‐monitoring robotic whole. You throw in buckets of redundancy. You add flightmanagement computers into which flight paths can be programmed on the ground, and you link them to autopilots capable of handling the airplane from the takeoff through the rollout after landing. You design deeply considered minimalistic cockpits that encourage teamwork by their very nature, offer excellent ergonomics, and are built around

25

displays that avoid showing extraneous information but provide alerts and status reports when the systems sense they are necessary. Finally, you add fly-­‐ by-­‐wire control. At that point, after years of work and billions of dollars in development costs, you have arrived in the present time. As intended, the autonomy of pilots has been severely restricted, but the new airplanes deliver smoother, more accurate, and more efficient rides—and safer ones too.

It is natural that some pilots object. This appears to be primarily a cultural and generational matter. In China, for instance, the crews don’t care. In fact, they like their automation and rely on it willingly. By contrast, an Airbus man told me about an encounter between a British pilot and his superior at a Middle Eastern airline, in which the pilot complained that automation had taken the fun out of life, and the superior answered, to paraphrase, “Hey asshole, if you want to have fun, go sail a boat. You fly with automation or find some other job.”

He kept his job. In professional flying, a historic shift has occurred. In the privacy of the cockpit and beyond public view, pilots have been relegated to mundane roles as system managers, expected to monitor the computers and sometimes to enter data via keyboards, but to keep their hands off the controls, and to intervene only in the rare event of a failure. As a result, the routine performance of inadequate pilots has been elevated to that of average pilots, and average pilots don’t count for much. If you are building an airliner and selling it globally, this turns out to be a good thing. Since the 1980s, when the shift began, the safety record has improved fivefold, to the current one fatal accident for every five million departures. No one can rationally advocate a return to the glamour of the past.

Nonetheless there are worries even among the people who invented the future. Boeing’s Delmar Fadden explained, “We say, ‘Well, I’m going to cover the 98 percent of situations I can predict, and the pilots will have to cover the 2 percent I can’t predict.’ This poses a significant problem. I’m going to have them do something only 2 percent of the time. Look at the burden that places on them. First they have to recognize that it’s time to intervene, when 98 percent of the time they’re not intervening. Then they’re expected to handle the 2 percent we couldn’t predict. What’s the data? How are we going to provide the training? How are we going to provide the supplementary information that will help them make the decisions? There is no easy answer. From the design point of view, we really worry about the tasks we ask them to do just occasionally.”

I said, “Like fly the airplane?”

Yes, that too. Once you put pilots on automation, their manual abilities degrade and their flight-­‐path awareness is dulled: flying becomes a monitoring task, an abstraction on a screen, a mind-­‐numbing wait for the next hotel. Nadine Sarter said that the process is known as de-­‐skilling. It is particularly acute among long-­‐ haul pilots with high seniority, especially those swapping flying duties in augmented crews. On Air France 447, for instance, Captain Dubois had logged a respectable 346 hours over the previous six months but had made merely 15 takeoffs and 18 landings. Allowing a generous four minutes at the controls for

26

each takeoff and landing, that meant that Dubois was directly manipulating the side-­‐stick for at most only about four hours a year. The numbers for Bonin were close to the same, and for Robert they were smaller. For all three of them, most of their experience had consisted of sitting in a cockpit seat and watching the machine work.

The solution might seem obvious. John Lauber told me that with the advent of C.R.M. and integrated automation, in the 1980s, Earl Wiener went around preaching about “turn-­‐it-­‐off training.” Lauber said, “Every few flights, disconnect all that stuff. Hand-­‐fly it. Fly it like an airplane.”

“What happened to that idea?”

“Everybody said, ‘Yeah. Yeah. We gotta do that.’ And I think for a while maybe they did.”

Sarter, however, is continuing with variations on the theme. She is trying to come up with improved interfaces between pilot and machine. In the meantime, she says, at the very least revert to lower levels of automation (or ignore it) when it surprises you.

In other words, in a crisis, don’t just start reading the automated alerts. The best pilots discard the automation naturally when it becomes unhelpful, and again there appear to be some cultural traits involved. Simulator studies have shown that Irish pilots, for instance, will gleefully throw away their crutches, while Asian pilots will hang on tightly. It’s obvious that the Irish are right, but in the real world Sarter’s advice is hard to sell. The automation is simply too compelling. The operational benefits outweigh the costs. The trend is toward more of it, not less. And after throwing away their crutches, many pilots today would lack the wherewithal to walk.

This is another unintended consequence of designing airplanes that anyone can fly: anyone can take you up on the offer. Beyond the degradation of basic skills of people who may once have been competent pilots, the fourth-­‐generation jets have enabled people who probably never had the skills to begin with and should not have been in the cockpit. As a result, the mental makeup of airline pilots has changed. On this there is nearly universal agreement—at Boeing and Airbus, and among accident investigators, regulators, flight-­‐operations managers, instructors, and academics. A different crowd is flying now, and though excellent pilots still work the job, on average the knowledge base has become very thin.

It seems that we are locked into a spiral in which poor human performance begets automation, which worsens human performance, which begets increasing automation. The pattern is common to our time but is acute in aviation. Air France 447 was a case in point. In the aftermath of the accident, the pitot tubes were replaced on several Airbus models; Air France commissioned an independent safety review that highlighted the arrogance of some of the company’s pilots and suggested reforms; a number of experts called for angle-­‐of-­‐ attack indicators in airliners, while others urged a new emphasis on high-­‐

27

altitude-­‐stall training, upset recoveries, unusual attitudes, flying in Alternate Law, and basic aeronautical common sense. All of this was fine, but none of it will make much difference. At a time when accidents are extremely rare, each one becomes a one-­‐off event, unlikely to be repeated in detail. Next time it will be some other airline, some other culture, and some other failure—but it will almost certainly involve automation and will perplex us when it occurs. Over time the automation will expand to handle in-­‐flight failures and emergencies, and as the safety record improves, pilots will gradually be squeezed from the cockpit altogether. The dynamic has become inevitable. There will still be accidents, but at some point we will have only the machines to blame.

28