State-of-the-art cockpit death trap

Airline pilots were once the heroes of the skies. Today, in the quest for safety, airplanes are meant to largely fly themselves. Which is why the 2009 crash of Air France Flight 447, which killed 228 people, remains so perplexing and significant. William Langewiesche explores how a series of small errors turned a state-of-the-art cockpit into a death trap.

I. Into the Night

On the last day of May in 2009, as night enveloped the airport in Rio de Janeiro, the 216 passengers waiting to board a flight to Paris could not have suspected that they would never see daylight again, or that many would sit strapped to their seats for another two years before being found dead in the darkness, 13,000 feet below the surface of the Atlantic Ocean. But that is what happened. Air France Flight 447 carried a crew of nine flight attendants and three pilots—their numbers augmented because of duty-time limitations on a 5,700-mile trip that was expected to last nearly 11 hours. These were highly trained people, flying an immaculate wide-bodied Airbus A330 for one of the premier airlines of the world, an iconic company of which all of France is proud. Even today—with the flight recorders recovered from the sea floor, French technical reports in hand, and exhaustive inquests under way in French courts—it remains almost unimaginable that the airplane crashed. A small glitch took Flight 447 down, a brief loss of airspeed indications—the merest blip of an information problem during steady straight-and-level flight. It seems absurd, but the pilots were overwhelmed.

To the question of why, the facile answer—that they happened to be three unusually incompetent men—has been widely dismissed. Other answers are more speculative, because the pilots can no longer explain themselves and had slid into a state of frantic incoherence before they died. But their incoherence tells us a lot. It seems to have been rooted in the very advances in piloting and aircraft design that have improved airline safety over the past 40 years. To put it briefly, automation has made it more and more unlikely that ordinary airline pilots will ever have to face a raw crisis in flight—but also more and more unlikely that they will be able to cope with such a crisis if one arises. Moreover, it is not clear that there is a way to resolve this paradox. That is why, to many observers, the loss of Air France 447 stands out as the most perplexing and significant airline accident of modern times.

The crew arrived in Rio three days before the accident and stayed at the Sofitel hotel on Copacabana Beach. At Air France, the layover there was considered to be especially desirable. The junior co-pilot, Pierre-Cédric Bonin, 32, had brought along his wife for the trip, leaving their two young sons at home, and the captain, Marc Dubois, 58, was traveling with an off-duty flight attendant and opera singer. In the French manner, the accident report made no mention of Dubois’s private life, but that omission then required a finding that fatigue played no role, when the captain’s inattention clearly did. Dubois had come up the hard way, flying many kinds of airplanes before hiring on with Air Inter, a domestic airline subsequently absorbed by Air France; he was a veteran pilot, with nearly 11,000 flight hours, more than half of them as captain. But, it became known, he had gotten only one hour of sleep the previous night. Rather than resting, he had spent the day touring Rio with his companion.

Flight 447 took off on schedule at 7:29 P.M. with 228 people aboard. The Airbus A330 is a docile twinjet airplane with an automated cockpit and a computer-based fly-by-wire control system that serves up an extraordinarily stable ride and, at the extremes, will intervene to keep pilots from exceeding aerodynamic and structural limits. Over the 15 years since the fleet’s introduction, in 1994, not a single A330 in line service had crashed. Up in the cockpit, Dubois occupied the left seat, the standard captain’s position. Though he was the Pilot in Command, and ultimately responsible for the flight, he was serving on this run as the Pilot Not Flying, handling communications, checklists, and backup duties. Occupying the right seat was the junior co-pilot, Bonin, whose turn it was to be the Pilot Flying—making the takeoff and landing, and managing the automation in cruising flight. Bonin was a type known as a Company Baby: he had been trained nearly from scratch by Air France and placed directly into Airbuses at a time when he had only a few hundred flight hours under his belt. By now he had accumulated 2,936 hours, but they were of low quality, and his experience was minimal, because almost all of his flight time was in fly-by-wire Airbuses running on autopilot.

Bonin switched on the autopilot four minutes after lifting off from Rio. This was standard procedure, as is the practice of flying by autopilot until just before touchdown. The route of the flight had been decided by company dispatchers in France and entered into the airplane’s flight-management computer at the gate: it was a direct course up the coast of Brazil, over the city of Natal, then northeast across the Atlantic. The initial cruising altitude was to be 35,000 feet. The only weather complication was a line of thunderstorms associated with the Intertropical Convergence Zone, spanning the Atlantic just north of the equator. Satellite pictures suggested a developing pattern perhaps stronger than normal, and with storm clusters too high to top, but with gaps that could be negotiated laterally.

For now the night was smooth and clear. Thirty-one minutes after takeoff, the autopilot leveled the airplane at 35,000 feet, nearly as high as the Airbus could fly, given the outside air temperature and the airplane’s weight; the automatic throttles set the thrust to achieve the selected 0.82 Mach, which in thin air translated into an aerodynamic speed of 280 knots, and, with the tailwind factored in, delivered a ground speed of 540 miles an hour. More than a thousand parameters were registered start to finish, for the entire duration of the trip, by the airplane’s data recorder. The cockpit voice recorder, by contrast, was a self-erasing loop, a bit more than two hours long, restricted because of long-standing privacy concerns by pilots. As a result, the voice recording opened on the scene two hours and five minutes before the end, or one hour and forty minutes into the flight.

It was 9:09 P.M. Rio time. Captain Dubois and the young Bonin had settled in for the ride, and the cockpit was mostly quiet. Someone shuffled papers. Someone adjusted a seat. At 9:24, Dubois mentioned that they might have to wait a bit longer for dinner, and Bonin replied affably that he too was getting hungry. Though they had not previously been acquaintances, the two men addressed each other using the informal “tu,” a mannerism that has become de rigueur among Air France pilots. But as subsequent exchanges would demonstrate, Bonin was almost too deferential, and perhaps too aware of rank.

A flight attendant entered the cockpit to deliver the meal. She said, “All is well?”

Bonin answered brightly, “Tutti va bene!”

Dubois said nothing. Apparently he was wearing headphones and listening to opera on a portable device. Addressing him, the flight attendant said, “And you too? All is well?”

Dubois said, “Huh?”

“All is well? No coffee, no tea?”

“All is well,” he said.

Dubois handed his portable device to Bonin, urging him to listen to the opera piece. Bonin did not say, “Thank you, no, we’re on autopilot, but I’m supposed to be the Pilot Flying,” or “Thank you, no, I’m not interested in your girlfriend’s music.” He put on the headset, listened for a few minutes, and said, “All that’s missing is the whiskey!”

That was the end of the opera. Dubois indicated a line on an electronic map and said, “It’s the equator.”

“O.K.”

“You understood, I suppose.”

Bonin did not say, “Look, Captain Dubois, I’ve already flown five rotations to South America.” He said, “I figured . . . ”

Dubois said, “I like to feel where we’re going.”

Bonin agreed. He said, “Yeah.”

A weather text came in from the dispatchers in Paris, accompanied by a depiction of the developing line of thunderstorms ahead. Neither pilot made mention of it, but later comments hint that Bonin was growing nervous. Dubois then sowed confusion by answering an air-traffic controller’s call to another Air France flight and insisting on it despite Bonin’s weak suggestions that he had gotten the call sign wrong. After a few minutes the controller gracefully sorted out the tangle and gave Flight 447 a frequency change. Similar confusions arose over required reporting points and frequencies ahead, but Bonin did not intervene. Conversation in the cockpit was desultory, generally about flight planning, sometimes not. The airplane sailed over the port city of Natal and headed out to sea.

Dubois said, “We were not hassled by thunderstorms, huh?” This might have been an opportunity for Bonin to express his uncertainty about the weather ahead, but at that moment the cockpit door opened and a flight attendant walked in, asking that the temperature in the baggage hold be lowered because she was carrying some meat in her suitcase. Bonin lowered the temperature. Fifteen minutes later a flight attendant called the cockpit on the intercom to report that passengers in the back were cold. Bonin mentioned the meat in the baggage hold.

By 10:30 P.M., the airplane had moved well offshore, and beyond view of air-traffic-control radar. Dubois checked in with Brazilian oceanic control, known as Atlantico. He gave a position report and the time estimates for two waypoints to come. The controller thanked him and instructed him to maintain 35,000 feet. Bonin said, “Eh, well, there you are.” Dubois radioed, “Wilco.” The controller answered, “Thank you.” It was the flight’s last verbal exchange with land.

Bonin was anxious to cross the Intertropical Convergence Zone at a higher altitude in order to stay in smooth air by remaining above the clouds if possible. He was disturbed by Dubois’s acceptance of the altitude assigned. He said, “We won’t delay asking to climb nonetheless.” Dubois answered, “Yeah,” but did not make the request. As he saw it, there was nothing unusual about the Convergence Zone that night: they might encounter some turbulence during the crossing, but the heavy stuff could be avoided by using the airplane’s weather radar in a normal manner to zigzag loosely around the largest storms. Furthermore, there was no reason to believe that by flying a bit higher they would encounter significantly different weather. Finally there was this: the next-highest standard altitude for their direction of flight was 37,000 feet, which was shown on a screen as the current “recommended maximum,” or REC MAX. This was an altitude where, under current conditions, the performance margins would be tight, because the airplane would be flying at a relatively low airspeed and close to an aerodynamic stall. Standard procedure at Air France was to maintain greater margins by avoiding flight as high as REC MAX. Both pilots understood this. One of the enduring mysteries of Air France 447 is why Bonin kept wanting to climb.

All was black outside. Bonin saw the first storm on the radar, perhaps 200 miles in front. He said, “So we have a thing straight ahead.” Dubois barely answered. He said, “Yeah, I saw that,” and dropped the subject. A minute later, he commented on the outside air temperature, which was frigid at that altitude but 12 degrees Celsius warmer than standard. Bonin said, “Yeah, yeah, still, otherwise we’d have, we’d have a lot higher cruising altitude.” Dubois said, “Ah yeah . . . ” He was reading a magazine. He steered the conversation to an article about tax havens. Bonin tried to match his nonchalance. At 10:45 he said, “We’re crossing the equator. Did you feel the bump?”

“Huh?”

“Did you feel the bump?”

“Oh shit, no.”

“Well, there you are.”

There were no bumps; the night remained smooth as the airplane gradually approached the weather. Dubois said, “Bon, we’ll just take whatever measures are required.” It was the closest he came to advising Bonin of a plan. Bonin lowered the cockpit lighting and switched on the landing lights to illuminate the outside. They entered a cloud layer. Dubois answered an intercom call from a flight attendant, who told him she was taking the night duty in case he needed anything. He answered with a French endearment, “Yes, my flea,” and ended the call. Although thunderstorms lay ahead and were showing on the radar, no lightning was visible. They were in mild turbulence, without any need yet to deviate from the straight-line course. Bonin said, “It would have been good to climb, huh?” Dubois said, “If there’s turbulence.” He meant significant turbulence, which the record later showed they never encountered. Referring to rules associated with distance from potential diversionary airports, Dubois said, “We’re entering the ETOPS zone, the death zone,” and Bonin answered, “Yeah, exactly.” The airplane was building up a static charge, causing some popping on the radios. Bonin got the impression that they were flying close to the top of the cloud layer. Once again he suggested a climb. “We try to ask for 3–6 [36,000 feet] nonstandard? We’re really at the limits [of the layer]. Even 3–6 would be good.” Dubois for once was unambiguous. He said, “We’re going to wait a bit, see if this passes.” The ghostly lights of Saint Elmo’s fire danced across the windscreen.

With most of the weather still lying ahead and an anxious junior pilot at the controls, Dubois decided it was time to get some sleep. The chief French investigator, Alain Bouillard, later said to me, “If the captain had stayed in position through the Intertropical Convergence Zone, it would have delayed his sleep by no more than 15 minutes, and because of his experience, maybe the story would have ended differently. But I do not believe it was fatigue that caused him to leave. It was more like customary behavior, part of the piloting culture within Air France. And his leaving was not against the rules. Still, it is surprising. If you are responsible for the outcome, you do not go on vacation during the main event.”

Just before 11 P.M. Rio time, Dubois brightened the cockpit lighting, limiting the view outside, and he rang the flight-rest compartment, a small cabin containing two berths just behind the cockpit. A second co-pilot had been dozing there, and he knocked on the wall in response. He was David Robert, 37, another Company Baby who, however, had more than twice the flight experience of Bonin and was the senior of the two. Robert had graduated from ENAC, one of the elite Grandes Écoles, and had recently migrated into the airline’s executive ranks, where he now had a management job at the operations center. He had opted for this trip in order to maintain his currency as a pilot, and had flown the outbound leg from Paris, and had made the landing in Rio, his first in three months. After his summons to the cockpit, he took two minutes to arrive.

II. Cockpit Resource Management

In the short history of airline safety, the great turning point occurred in the 1950s with the introduction of jet airplanes, which were far more reliable and easy to fly than the complex piston-engine behemoths that preceded them. Over the next two decades, as the global jet fleet grew, whole categories of accidents related to mechanical failures and weather were largely engineered away. The safety improvement was dramatic. It opened the way to airline travel as we know it today.

But by the 1970s, a new reality had come into view. Though the accident rate had been reduced, the accidents that continued to occur were being caused almost entirely by pilots—the very people, many of them still at the controls, who had earned a nearly heroic reputation for having stood in the way of the mechanical or weather-related failures of the past. Pilot error had long been a recognized problem, but after the advent of jets it was as if an onion had been peeled to reveal an unexpectedly imperfect core. The problem was global. In Europe and the United States, a small number of specialists began to focus on the question. They were researchers, regulators, accident investigators, test pilots, and engineers. The timing was unfortunate for line pilots, who had begun to fight a futile rear-guard action, ongoing today, against an inexorable rollback in salaries and status. The rollback was a consequence of the very improvements in technology that had made the airlines safer. Simply put, for airline pilots the glory days were numbered, and however unfortunate that was for them, for passengers it has turned out to be a good thing.

In the late 1970s, a small team of researchers at a NASA facility in Mountain View, California, began a systematic assessment of airline-pilot performance. One of them was a young research psychologist and private pilot named John Lauber, who later served for 10 years as a member of the National Transportation Safety Board and went on to run the safety division at Airbus in France. As part of the NASA effort, Lauber spent several years riding in airline cockpits, observing the operations and taking notes. This was at a time when most crews still included a flight engineer, who sat behind the pilots and operated the airplane’s electrical and mechanical systems. What Lauber found was a culture dominated by authoritarian captains, many of them crusty old reactionaries who brooked no interference from their subordinates. In those cockpits, co-pilots were lucky if occasionally they were allowed to fly. Lauber told me about one occasion, when he entered a Boeing 727 cockpit at a gate before the captain arrived, and the flight engineer said, “I suppose you’ve been in a cockpit before.”

SOURCE: http://www.vanityfair.com/business/2014/10/air-france-flight-447-crash

Rocketeer