Children of the Magenta (Automation Paradox, pt. 1)

RM: This is 99% Invisible Roman Mars.

RM: On the evening of May 31st, 2009, 216 passengers 3 pilots, and 9 flight attendants boarded an Air France flight in Rio de Janeiro Brazil. The flight was headed across the Atlantic Ocean, to Paris.

KM: A warning, this story might not be a good one to listen to if you’re sitting on a plane right now.

RM: That’s producer Katie mingle letting you know that the closest exit could be behind you.

KM: The plane that took off that evening from Rio with an Airbus 330. The takeoff was unremarkable. The plane reached cruising altitude of 35,000 feet. The passengers read and watched movies and slept as they flew over the floor of the Atlantic Ocean passing the equator…

WL: There was a lot of thunderstorm activity, quite typical nothing really unusual about that.

KM: That’s William Langewiesche, he wrote an article for Vanity Fair about this flight and has written extensively about aviation. He also used to be a pilot.

WL: So I spent, many many thousands of hours in cockpits.

KM: Which means he’s particularly well suited to tell the story of Air France flight 447.

WL: It was a long flight. Um, so they had two co-pilots known as first officers and one captain.

RM: They would fly the plane in shifts, two of them flying while one slept.

WL: We know, that the flight proceeded normally for several hours.

KM: And then…

WL: Then with no communication to the ground or air traffic control, it suddenly disappeared.

RM: Some pieces of the plane and several bodies were found days later floating in the Atlantic. But it would be two more years before most of the wreckage was found deep in the ocean. All 228 people on board had died.

KM: When the wreckage was found they also recovered the cockpit voice recorder and the flight data recorders.

WL: And they were in good shape.

RM: The recordings were able to tell a story about how flight 447 ended up in the bottom of the Atlantic Ocean.

KM: And the story they told was about what happened when the automated system flying the plane suddenly shut off and the pilots were left surprised, confused, and ultimately unable to fly their own plane.

RM: Automation in flight has been around for a long time. The first so-called autopilot was invented by the Sperry Corporation in 1912 and it allowed the plane to fly straight and level without the pilot’s intervention.

KM: In the 1950s the autopilots got better.

WL: So that you could program an autopilot to follow a route, and not just to keep the wings level. This was making the pilot’s job a lot easier.

RM: But there was still a lot to think about in the cockpit of an airplane.

WL: Controlling the electric systems, controlling the hydraulic systems.

KM: And because of all this, most planes had three people in the cockpit. Two pilots, and an engineer.

WL: A flight engineer sat behind the pilots and they manipulated and managed these increasingly complex systems.

RM: But by the 1970s, all of those complex systems were also automated and flight engineers lost their necessity, and their jobs.

KM: By this time the jet engine had replaced the piston engine, making planes much more reliable. And studies were showing that most accidents were being caused not by mechanical error but by human error.

RM: And a French company called Airbus thought that they could make planes safer by letting automation carry an even bigger part of the burden of flying.

WL: Airbus was a leader. Airbus has always been quite radical in its design philosophy.

KM: Led by a guy named Bernard Ziegler, Airbus set out to design what they hoped would be the safest plane yet. A plane that even the worst pilots could fly with ease.

WL: Bernard Ziegler, he famously said that he was building an airplane that has concierge could fly.

RM: Ziegler’s plane not only had auto-pilot, it also had what’s called a fly-by-wire system.

KM: So, this can get a bit technical, but basically an autopilot just does what a pilot tells it to do. Fly-by-wire is a computer-based control system that can interpret what the pilot wants to do and then do it smoothly and safely. So if the pilot pulls back on his or her stick, the fly-by-wire system will say “Oh, I see that you want to pitch up and here, I’ll do it for you at just the right angle and rate.”

RM: Importantly, the fly-by-wire system will also protect you from getting into an aerodynamic stall. So in a car, a stall happens when the engine stops turning. But in a plane, stalling is different.

WL: Basically getting so slow that the wings no longer function correctly, and the airplane you know, loses altitude. Let’s put it that way.

KM: A stall in a plane can happen when the nose of the plane is pitched up at too steep an angle. A steep angle can cause the plane to lose lift and start to descend

RM: Stalling in a plane is not good. Stall for long enough and you will crash. But fly by wire automation makes it impossible to do as long as it’s on.

KM: Unlike autopilot, the fly-by-wire system cannot be turned on and off by the pilot.

WL: You can’t turn this automation off.

KM: But, here’s the thing…

WL: It can turn itself off.

RM: And that’s exactly what it did on May 31st, 2009 as 5447 flew through the night sky, over the Atlantic Ocean.

WL: At some point, having flown normally for a few hours, the captain had gone back to sleep.

KM: This meant the two co-pilots were in control of the plane.

WL: They encountered some weather. It wasn’t rough, they never hit significant turbulence.

KM: So far nothing out of the ordinary. And then…

WL: Suddenly they lost airspeed indications.

RM: A pressure probe on the outside of the plane had iced over. The automation could no longer tell how fast the plane was going.

KM: At this point autopilot disconnected.

WL: At the same time the fly-by-wire system degraded by one step.

RM: So the autopilot turned off and the fly-by-wire system shifted into a different mode. A mode that did not protect against aerodynamic stall.

KM: None of this was ideal, but it also it also wasn’t a reason to panic, according to William. The plane was still basically flying straight and steady.

WL: The airplane was not upset. Had they done nothing, they would have done exactly what they needed to do. Nothing.

KM: But that’s not what happened. The co-pilot in the right seat put his hand on his control stick a little joystick like thing to his right.

WL: And he pulled it back.

RM: Not just a little, he pulled it three-quarters of the way back.

WL: Why he did that is that a major question.

KM: Perhaps he was startled, or reacting to some turbulence. it’s important to note that he did not tell the other pilot in the cockpit, the guy in the left seat, what he had just done. If he had, maybe his co-pilot would have known the dangerous situation they were about to be in.

RM: In an Airbus, the two pilots have separate control sticks that move independently of each other. In other commercial airplanes, the controls would move in unison, so that you would actually feel the moves your copilot was making on their controls. This design variation may also have also have contributed to what was about to become a very bad situation. In any case, as the pilot in the right seat pulled back on his stick…

WL: The airplane pulled, put his nose up and it started to soar upward.

RM: When stall protections are in place, the plane won’t just warn you not to pitch it at such extreme angle, it physically will not let you do it. But remember the plane has shifted into a mode in which it wasn’t offering that underlying protection.

KM: As the angle got steeper and steeper, the air couldn’t flow smoothly across the wings and the plane began to stall.

RM: The plane was angled up trying to gain altitude, but it actually began to lose altitude.

KM: A warning began to sound. The plane couldn’t prevent a stall but it could still warn that a stall was happening.

WL: It said, “Stall, Stall, Stall”

KM: It would have sounded like this: “Stall Stall [ring], Stall Stall [ring] Stall Stall [ring]”

KM: And you’d think that if you heard this alarm someone would say “Hey, I think we might be stalling.” But this never happened.

RM: At one point, one of the copilots did say, “Get your nose down.”

WL: But he didn’t say “we’ve stalled.” and the man the right seat, who’s flying the airplane, the junior copilot, he would put the nose down a couple times then bring it right back up again.

RM: The co-pilots began to ring frantically for the captain to come into the cockpit. At one point where they say “[Bleep!] Where is he?”

WL: The airplane was shaking all kinds of alarms are going off…

KM: One minute and thirty-eight seconds after the episode started, the captain came into the cockpit and asked, “What’s going on here?”
RM: The co-pilots did not say, “we are in a stall.” instead one of them said “we’ve completely lost control of the airplane and we don’t understand anything. We’ve tried everything.”

KM: The captain had walked into a difficult scene to understand. Everyone was confused. Were they descending or climbing? At times they couldn’t seem to figure it out. Finally, they seem to realize they’re in a fast descent. Losing thousands of feet per minute. But why? They couldn’t figure out why.

WL: The captain never assessed correctly what was going on. He was obviously trying to, he wasn’t there to drink coffee or suck his thumb, but he was never able to figure out what was going on even though it should have been amply obvious what was going on.

KM: But for whatever reason, it wasn’t obvious to them what was going on. They didn’t know they were in a stall. If they’d realized it, Williams says the fix would have been clear. It’s basic, it’s pilot school 101.

WL: The recovery would have required them to put the nose down, power doesn’t matter, just get the nose down get a below the horizon regain flying speed and then pull out of the ensuing dive.

RM: The plane continued falling down at a jaw-dropping pace, losing several thousands of feet per minute. But since they started at 37,000 feet for a while there was still time for recovery.

WL: So for quite a long time, a normal crew would have been able to recover and at the very end, at around 16,000 feet the best crew in the world only probably would have been able to recover, and below that altitude, no crew would have been able to enable to recover because they simply didn’t have the space beneath them to execute the dive before hitting the water. But in any case, they never tried to do it. And so they rode this airplane down, expressing confusion the whole time and finally expressing certainty that they were going to die.

KM: Four minutes and twenty seconds after the incident started

WL: They pancaked into the water at a very high descent rate and of course it killed everyone instantly.

KM: Six years after the crash of flight 447 what’s clear is that the pilots didn’t understand what was happening to them. The big question is how? How could they have a computer yelling “Stall!” at them and not understand they were in a stall?

RM: There were various things that contributed to the crash of 447. But automation, which has overwhelmingly made airline travel safer also played a role in this accident.

WL: However much automation has helped the airline passenger by increasing safety, it has had some negative consequences. In this case, it’s quite clear that these pilots had had experience stripped away from them, for years.

RM: William actually did the math on this. The captain of the Air France flight had logged 346 hours of flying over the past 6 months. But of that time there were only about 4 hours in which he was actually in control of an airplane. Takeoffs and landings. The rest of the time, autopilot was flying the plane. That’s 4 hours in 6 months. The co-pilot’s would have had even less time at the controls.

KM: This is not to say pilots do nothing when autopilot is on. They still have an important role to play.

WL: What the good pilots do in flight, they watch the systems that handle navigation and communication, they occasionally program things in flight like path changes, they deal with anticipation of weather, they think about fuel management.

RM: Increasingly Williams says, pilots have become automation managers with fewer and fewer chances to actually fly the plane. He believes this lack of experience at the controls left the pilots of 447 unprepared to take over when the automation turned off.

WL: The pilots were hideously incompetent. Um, that’s, I think no one would disagree with that.

NS: So, I have certainly heard that position from other people before. I think we all have to be very careful none of us was there when this actually happened.

KM: That’s Nadine Sarter, a systems engineer at the University of Michigan who’s studied a lot of aviation accidents related to automation.

NS: My approach to things with different I guess. These pilots were in that airplane with the passengers and I’m sure they have every motivation to keep that flight safe and yet they didn’t. So so then I try to understand well, why did they not? Did they not have the right information? Did they not have the proper training?

RM: When one of the copilots hauled back on his stick he pitched the plane into an angle that eventually caused the stall. But it’s possible he didn’t understand that he was now flying in a different mode. One that would not regulate and smooth out his movements.

KM: This confusion about how the fly-by-wire system responds in different modes is referred to aptly as “Mode Confusion” and it’s come up in other accidents. The plane switches into a different mode and suddenly…

NS: Pilots find it difficult to understand what’s going on at that point. They do not exactly know whether the system is still taking care of the airplane or whether they are in charge now, they don’t necessarily understand whether all of that has disconnected or just parts of it have disconnected.

WL: A lot of what is happening is hidden from view from the pilots. It’s buried. When the airplane starts doing something that is unexpected and the pilot says, “Hey what’s up, now what’s it doing?” That’s a very very standard comment in cockpits today. “What’s it up to now?”

RM: The pilots of Air France flight 447 never quite say, “What’s it doing now?” but they say similar things.

KM: William wasn’t the only person to point out that “What’s it doing now?” is a commonly heard question in the cockpit. It seems to be almost a running joke in the industry. A joke that everyone agrees is a serious problem.

WV: What’s the most often asked ask question in our cockpit? “What is it doing now?” (laughter)

KM: That’s American Airlines captain Warren Vanderburgh addressing a group a group of pilots in 1997. People have been talking about this issue way before the crash of flight 447. It’s just that no one’s really figured out how to solve it yet.

WV: But you see, we have become what I call, Children of the Magenta.

RM: The Children of the Magenta are too dependent on the guiding magenta-colored lines on their screens.

WV: You know we think we have to have those magenta lines on the map, and that magenta bar that’s steering us toward that line.

RM: The Children of the Magenta are too dependent on automation in general.

WV: And if this is you I’m talkin’ about, do not be defensive. In the industry, we created you like this.

KM: Vanderburgh recommends in certain situations, to turn off the autopilot and fly the plane yourself.

WV: When you deem the situation is right to practice your skills, turn off your autopilot, and your autothrottles. Fly your planes. Maintain your skills.

KM: Nadine Sarter agrees that this could help. She also recommends using simulators to let pilots explore different kinds of emergency scenarios.

RM: And then, of course, there are people who think the problem can be solved with more and better automation. But this is a paradox of automation.

WL: Automation accommodates incompetence. In fact, it’s designed to do that.

RM: The Airbus was designed after all for Bernard Ziegler’s concierge to be able to fly.

WL: We appear to be locked into a cycle in which automation begets the erosion of skills or the lack of skills in the first place. And this then begets more automation.

KM: Nadine Sartor thinks it’s a mistake to throw more automation at the problem.

NS: The position I would adopt is one that has been termed human-centered automation, where we see what you need to do instead is make the automation that you have, make it smarter, but importantly make it what we call a team player. And part of that is to provide better feedback, part of it is to have the automation communicate more effectively with the pilot.

KM: No one I talk to is advocating for going back to the bad old days before automation.

NS: So automation in general, the fly-by-wire system all of those certainly do increase safety I would argue.

KM: And even though a lot of the accidents we see these days have to do with the interaction between pilots and automation, William says you have to remember..

WL: One of the reasons for that is that because of automation there hardly any other accidents.

KM: And as far as how we should feel about Air France flight 447 and other accidents involving automation, should they be seen as an acceptable loss in an industry that’s become mostly safer through automation?

WL: I think as a society, the answer to that is yes, um, you know for the end of it individuals is no such thing as an acceptable loss, alright. I mean this is a terrible tragedy, terrible. And for the pilots who died as well.

RM: Airbus planes are not any less safe or any more safe than any other plane on the market planes have accidents. But it should be said that they’re pretty safe too. The accident rate for air travel is very, very low. About 2.8 accidents for every 1 million departures and there are plenty of pilots out there that know how to take control in an emergency. So breathe deep everyone, just relax. It’s gonna be okay.

KM: It’s true there are lots of good pilots out there but in a far-off future we might be flying in pilotless planes.

WL: We’re a long way from that but the technology is definitely coming, and we will, I mean, this will happen it just makes a lot of sense. I don’t think anyone is sort of saying “Great, that’s going to be a wonderful thing.” Um, but I think reasonable people are also not tearing your hair out about it.

KM: Because by the time it happens the automation will be so good and so reliable that humans with all of our human emotions and human fallibility, the Children of the Magenta will really just be in the way.

99% invisible was produced this week by Katie Mingle with Sam Greenspan, Avery Trufleman, and me Roman Mars. We relied heavily on the reporting and expertise of William Langewiesche for this piece, so special thanks to him he went above and beyond for us. And if you want an even more in-depth a minute-by-minute analysis of the crash of flight 447, check out his piece in Vanity Fair it’s called, The Human Factor.

And on the next episode of 99% Invisible, we’re going to take this idea of the automation paradox and use it as a lens to view the next great design challenge in automation when we all potentially become the Children of the Magenta in our self-driving cars. It’s our first 2 part series, so stay tuned.

Now last week I mentioned that we have a new addition to the Radiotopia collective and I’m pleased to announce that Nate DiMeo’s The Memory Palace is doing the gang. When I was first thinking about starting 99% invisible Nate was one of the first people I called because I really loved what he was doing with his show featuring these poignant historical moments and I wanted to do something in the same spirit with stories about design. And so, more than any other program I can say if you love 99% Invisible you will love, love The Memory Palace. Nate & I are friends and he once recommended history book to me and on page 325 I noticed a couple sentences, just a couple of sentences that were a tiny, but really striking digression from the main narrative. And I’d like to think that I would have noticed the charm of its historical footnote on my own but the real reason it stood out to me it was because I knew it sparked an episode of The Memory Palace.

ND: Most Memory palace pieces start on page 325 of some book.

RM: That voice you just heard is Nate DiMeo of the memory palace has a special way of zeroing in on these moments in history that light up your imagination and hit you in the gut or make you smile.

ND: I’d noticed that there were these historical things that would jump out at you from long Ken Burns documentaries or that one moment in that historic home tour when that object on the mantelpiece like actually jumps out and says “wow, that’s amazing! Look at that beautiful thing.” and so often those like, I noticed that the things that move me where these focused things. They were recognizing the single object they were the incredible twist in someone’s story and I wanted to find out on some level if there was a way to cut to the chase, if there was a way to focus so tightly, it was almost just an aesthetic, artistic challenge.

Like, is there a way that I can replicate this feeling of being moved or having my head blown off, or having my heartbroken. This thing that I have once felt. Is there a way that I can get people to feel that same thing. Like, can I retell the story in such a way that they don’t have to take the whole historic home tour. Or they don’t have to sit through all 9 1/2 hours of this documentary series. Is there a way to kind of crystallize it and turn this sweeping historical story into a pop song.

RM: But The Memory Palace is never just a simple historical anecdote there’s always something more going on.

ND: Like there is a subject and then there is meaning. Like there are themes which are different than plot. On some level I’m not merely trying to tell a historical story, I’m trying to conjure it. Trying to have it sort of like, live in the listener’s mind for a bit and then melt away.

RM: I really like his show so much that I had a hard time selecting which episode to present so I asked Nate which episode really stood out to him that did all the things he was hoping to achieve in Memory Palace and he picked this episode, enjoy.

ND: This is the memory palace I’m Nate DiMeo. The world loved the World’s Fair. The Exposition Universelle in Paris in 1889 just killed. The exhibits in the grounds were unparalleled and impeccable. And at the center of it all was this audacious steel structure that managed to be imposing, and elegant in the tallest thing on Earth and unmistakably French all at once. Paris had the Eiffel Tower, and the men planning the next fair the Columbian Exposition in Chicago just a couple of years away needed something that good. Something Eiffel Tower good. And that wasn’t easy to find. The proposals ran from the ridiculous, like a structure that would soar more than 1000 feet above the Land of Lincoln made entirely out of stacked logs and topped with a replica of Abe’s boyhood home, to the extra ridiculous. Something so tall that visitors would take an elevator to the top of a slide that they’d ride down until it dropped them off in New York or San Francisco. The fair’s organizers were panicking. They demanded that America’s designers and engineers step up. And a man named George Ferris stepped forward. When his ferris wheel was completed that summer it rose 264 feet above the ground, which was a lot shorter than the Eiffel Tower, but whatever, that thing didn’t even move. The idea that something so massive but that looks so fragile like a bicycle wheel whose spokes look too thin to keep a bike up, was thrilling, and pretty terrifying. Despite what the engineers said, despite the math and laws of physics, despite the many assurances of the fair’s organizers, there were people who were sure that this ludicrous machine was going to be a disaster; that people going to die. Not only was there no way that that flimsy thing could stand up to a prairie wind or a gale off the lake. Even if it did, the prospect of tumbling through the air in a cage 20 stories above Chicago was full-on craziness. Who in their right mind was going to want to ride that thing? Hundreds of thousands of people did. Despite the fact that during its first test run, hundreds of bolts and loose parts rained down on spectators below. Despite real stories of panicked riders trying to escape through the windows when you realize exactly how high 200 feet was. Despite apocryphal stories of suicides, and severed limbs. This Ferris wheel, this thing that is basically a kiddie ride today was a bigger thrill ride than any quintuple-loop-open-car-reverse-twist-rocket-coaster they might have at Six Flags.

The papers, even some in France, said it was the marvel of the age. Better than the Eiffel Tower. That almost mundane sensation we have now of looking down from above, of moving through space. Up and out and down and back around. No one had ever felt those things before. And of course, now we can’t really feel them again. We’ve gone around too many times, we’ve looped too many loops. But back in 1893 you could pay your $0.50 and climb into a car right after sunset, during the golden hour and experience something entirely new. You could rise up above the World’s Fair where down below Americans were eating hamburgers for the first time. Where Buffalo Bill, and Frederick Douglass, and Mark Twain were sightseeing. Where entire villages from Egypt and Algeria had been brought and reconstructed. Where people heard ragtime for the first time. Saw hula dancers, and belly dancers. You can come back to Earth and walk out, and be among the first people in human history walk around at night, with lights on. But fairs end and they shut down. They pack up and leave, and the Ferris wheel did too. They moved it up to a different park in the north side of the city. And after a while, the novelty was gone, and the Ferris wheel became just a Ferris wheel, and they tore it down. The salvage company bought it for eight grand, blew it up with dynamite and sold the pieces for scrap.

RM: That’s the memory palace from Nate DiMeo. Now from Radiotopia. After a couple years of not put not putting the show out very regularly, he was running TV shows and books and stuff, I’m pleased to say he is releasing weekly episodes through the summer. So get on board. You’re going to want to set aside 5 minutes or so to listen to it the moment each new episode comes out. That’s what I’m going to be doing.

  1. Michel Savard

    Love the podcast…. however this one hit me a little as I remember how heart breaking it was to read the transcripts of the pilots. The emotions I felt the captain must have felt once he realized what was happening, and also realized there was nothing to stop it has stuck with me. In the podcast and in the article above the statement “The pilots, however, never tried to recover, because they never seemed to realize they were in a stall. “… and in the podcast “but in any case they never tried to do it” (it, being to recover from the stall) is not correct. This makes the crew in the story seem incompetent. The truth is both co-pilot Robert Putain and the Captain both tried to recover from the stall. The Captain in the very end DID realize what had been happening.

    “02:13:40 (Robert) Remonte… remonte… remonte… remonte…

    Climb… climb… climb… climb…

    02:13:40 (Bonin) Mais je suis à fond à cabrer depuis tout à l’heure!

    But I’ve had the stick back the whole time!

    At last, Bonin tells the others the crucial fact whose import he has so grievously failed to understand himself.

    02:13:42 (Captain) Non, non, non… Ne remonte pas… non, non.

    No, no, no… Don’t climb… no, no.

    02:13:43 (Robert) Alors descends… Alors, donne-moi les commandes… À moi les commandes!

    Descend, then… Give me the controls… Give me the controls!

    Bonin yields the controls, and Robert finally puts the nose down. The plane begins to regain speed. But it is still descending at a precipitous angle. As they near 2000 feet, the aircraft’s sensors detect the fast-approaching surface and trigger a new alarm. There is no time left to build up speed by pushing the plane’s nose forward into a dive. At any rate, without warning his colleagues, Bonin once again takes back the controls and pulls his side stick all the way back.

    02:14:23 (Robert) Putain, on va taper… C’est pas vrai!

    Damn it, we’re going to crash… This can’t be happening!

    02:14:25 (Bonin) Mais qu’est-ce que se passe?

    But what’s happening?

    02:14:27 (Captain) 10 degrès d’assiette…

    Ten degrees of pitch…

    Exactly 1.4 seconds later, the cockpit voice recorder stops.”

    Langewiesche also says in the podcast “and so they rode this aircraft down, expressing confusion the whole time, finally expressing certainty they were gonna die.” followed by him saying the plane pancaked into the water. They didn’t have uncertainty the whole time. Infact the Captain in the end new exactly what happened. I think this changes the narrative of this event in a big way. The captain realized at the end, the co-pilot was causing the crash by accident. The co-pilot who earlier tried to push the controls forward realizes as well that his co-pilot has been doing the wrong thing and begs for controls. This is a different story then all three men having no clue. It comes down to one poor mans confusion over what mode they were in, who to the VERY end… even after the captain has told him to descend…. still pulled his stick all the way back.

    Love the podcast. Just feel somehow the way this story is told gives a disservice to the men in the cockpit. I’m not blaming Bonin, but to make it seem like all three men were slaves to autopilot and didn’t know what to do without it is wholly incorrect.


    1. Hi Michel

      You’re right that there is some indication that the pilots may have realized what was happening at the very, very end of the ordeal. Though, no one ever says the word “stall” so it’s hard to know for sure. But in any case, by then it was far too late to execute a recovery. So I disagree that this changes the narrative in any significant way. Even if it’s true that they did realize in the last seconds what had gone wrong, there’s still the question of how they could have all been hearing the automation saying “STALL STALL” for something like 85 times in row, and never have said, “Is it possible we’re in stall?” How this could have happened is the question that the piece grapples with, and we give voice to various opinions. One is that the pilots were incompetent due to having experience stripped from them by automated systems, and one is that the automated systems are confusing in their design. Either way, this takes some of the blame off of the pilots themselves.

      Thanks for your comment, and for listening thoughtfully.


  2. Michel Savard’s comment suggests that the podcast should be amended–it was misleading as to who understood what and who did what.

    But since the subject is design, there is another issue–how much did failure to design a robust automation system contribute, by its failure to react properly to a complex situation, to the deadly outcome?

    Assigning the cause of the crash to “human error” may be too simplistic and even inaccurate even if, as in this instance, there were indeed human failures involved. It’s too easy to apply that label. If we leave it at that, then “human error” may block efforts to examine and eliminate systemic causes that contributed to the crash and could have, and should be, eliminated through proper design.

    So yes, the fly-by-wire system disengaged. In my humble opinion, and I know nothing about these systems but still, there could have been a parallel system that would, perhaps by voice instruction, explain what was happening and what was the needed remedy. It could have repeated that over and over. Perhaps the automation could have been improved, and/or the way instruments proactively alerted the crew to the problematic action of the plane and the needed remedy.

    You described a situation in which even the most experienced person in the cockpit had only a few hours of manual flying experience in a space of six months. That’s very predictable, and should have been anticipated. The system failed to adapt and to cope with the real world complexity that the pilots (and planes) were faced with. Yes, the crew could have done better. But yes, the design failed them.

    There is also the question of why the controls were independent, so that the co-pilot on the left was unaware of the actions of the co-pilot on the right. There must be a reason for doing it that way. In normal flight, perhaps it wouldn’t matter, but did that design choice contribute to the loss of life in this, and perhaps other, abnormal incidents?

    Of course the automation systems have increased safety–the statistics verify that. Still, it’s reasonable to ask if the designers were overconfident and failed to provide for the possibility of various failure modes. This is sometimes called resilience engineering. It would take human “failure” as just one possible parameter that design must deal with.

    Maybe, at the time that plane was built, this was the best that could be done. It would be interesting to have heard if there was any reaction to the automation failure which would make this and other opportunities for “human error” less likely to have fatal outcomes now or in the future.


  3. Zach P.

    Really enjoyed listening to this episode! I have some background in aviation and I was familiar with this incident from safety training during flight training.

    I agree that we should look at systemic causes but in the end it was as simple as human error that led to crash. What wasn’t really addressed during the episode was the fact that this took place at night, over a pitch black ocean, in bad weather, at 35k ft… the pilots had no visual references and I am assuming they were completely disoriented. They couldn’t “feel” the stall and they did not trust their instrument. At that point I don’t think it would have made any difference how many warnings, alarm bells, buzzers, verbal instructions they might have heard.

    Spatial disorientation is one of the leading causes of aircraft accidents when visual conditions are not ideal and pilots are trained to recognize and correct it. The aircraft has backup instruments and ideally the pilots should have been able to refer to their backup instruments and bring the plane back under control. There were also breakdowns in communication and procedure that contributed to the accident. The responsibility for this rest squarely with the pilots. This is why the lack of actual stick time is significant to this case. Their manual flying skills were rusty, especially under instrument conditions. I don’t mean to demonize these pilots but its a reality that you have to accept when you step in the cockpit. The pilot is responsible for the safe operation of the aircraft and their #1 job is aircraft control. They crashed a flyable airplane. While automation is meant to make flying safer, pilots cannot become overly reliant on those systems. Some military pilots are required to routinely demonstrate the ability to manually control the aircraft.

    The failure of the design in my opinion is that it was not abundantly clear that the fly by wire was disconnected. Normally the computer would not have let them exceed the flight envelop. I assume that is why the copilot held the stick fully back. When flying manually you would almost never move the controls to the limit of travel. But I can see how a pilot could do that if they expected the computer to limit the control movements for them and they were confused and maybe a little panicked already. If the pilot(s) had known that he was in manual control, training might have kicked in a lot sooner.

    The Asiana flight 214 is another recent instance of a crash caused when the pilots became confused about the automation settings and were unable to manually control the aircraft. Commercial aviation needs to start doing more to address the over reliance on automation.

  4. Eric C

    I have spent 15 years flying airlines on both ends of the modern automation spectrum: long haul flying with two landings per month, and commuter flying with two landings by 9 am. While the podcast was fascinating, and “Children of the Magenta” is a real issue that is a focus of modern training, I disagree that AF447 fell to that problem.

    “Children of the Magenta” refers to an over reliance on automation, but more specifically a reluctance to manually override automation when it is not performing as intended. Misbehaving computers are a puzzle to be solved and pilots naturally try to solve it, allowing the plane to drift off course while they do so. There is also reasonable concern that pilots are reluctant to manually override automation because they have lost the skills to do so, having been reliant on it for so long.

    Neither of these brought down AF447. The pilots didn’t fail to override automation, they had an automation failure thrust upon them coincident with an instrument failure and nasty weather. Neither would a life of less automation have developed the skills to recover from a high altitude stall, any more than a life of walking makes you an adept dancer.

    I believe AF447 exposes the extreme difficulty our minds have in accepting as true an idea strongly considered impossible. For an airline pilot, stalling while in cruise flight seems pretty impossible, doubly so for a fly-by-wire airplane with envelope protection. Sorting through contradictory information while dealing with a frightening emergency only adds to the difficulty, but overall the more impossible we consider an event to be, the more difficult it is to accept that it is happening.

    Consider again the actions of the First Officer. His actions are doing everything possible for a fail-safe climb (if one assumes he believed FBW was still protecting him) yet his airspeed and altitude indications were either not present or indicating a severe descent. For him the idea of stall and steep descent must have seemed impossible. He got lost in the cognitive dissonance of that situation, of one action having an opposite and impossible reaction. That is a very different thing than failing to know what a stall is or how to identify one in progress. It’s a much deeper flaw in the way people interpret the world around them.

    There are ways to ameliorate this problem through training and cockpit design, but blaming the issue on pilots gone lazy with automation is not one of them.

  5. Henry Berg

    I’ve often thought that Air Inter 148 was a particularly interesting case from a design perspective. I remember endless conversations in college about the perils of UI controls that operate differently in different modes and debates about the grouping of related controls. In this accident we saw just such a problem. A single knob would be used to dial in a number which, depending on a separate mode selector, would specify a decent rate in feet per minute OR descent angle. The number was displayed near the knob but might read -33 in the former mode or -3.3 in the latter. A person could (and likely did) easily overlook the decimal point. Another display read out the mode currently selected for the knob but it wasn’t grouped with the controls in question, making it even easier to fall into mode confusion.

    Yes, there were numerous other problems on that flight, I just happen to find this particular detail interesting from a design perspective.

    The controls in question were redesigned after that.

  6. keats79

    I am a commercial airline pilot who has trained on this scenario (prior to this incident) and experienced trying to orient after being “on break”. I have to say this is a pod-simplified version of the incident. First off the “sleep hangover” from a break can last several minutes. This Captain was in the highly unenviable situation of trying to assess a perplexing set of data in the face of multiple alarms and warnings, aural and visual. Additionally, there was a specific design issue that was not mentioned and was not related to the “flight control law mode”. At less than 60 knots ground speed the warnings change (the major one being the “stall warning ceases). As the speed fluctuated above and below that threshold the stall warning went away and then would resume as the nose was lowered and the aircraft accelerated above 60kts GS. The incorrect conclusion is that lowering the nose is inducing the stall.

    Having performed the exact situation in the simulator (prior to this incident) it is severely taxing to one’s piloting skills with no reference to the horizon and conflicting instrument displays.

    The unauthorized use of Captain Vanderberg’s video is upsetting. This was not a “magenta” issue, it was actually a regime that was previously not well understood since it was never explained, taught to pilots or even well understood by Airbus. No engineer envisioned a commercial aircraft being in this regime. To be fair, the angle-of-attack was not widely taught to civilian pilots prior to this incident.

    If the design deficient pitot tubes had been changed to the newer type this incident would have never occurred because the root causal factor would not have been present. The directive to change the pitot tubes to the newer model was out but the allowable time for change had not expired so this aircraft’s pitot system had not been upgraded.

  7. In the future, the airliner cockpit will just have a man and a dog. The man’s job is to feed the dog. The dog’s job is to bite the man if he tries to touch the controls.

  8. “We appear to be locked into a cycle in which automation begets the erosion of skills or the lack of skills in the first place and this then begets more automation.”

    Thanks for this fateful journey of Air France 447.

Leave a Reply

Your email address will not be published. Required fields are marked *

All Categories

Minimize Maximize