How does a flyable plane go from 30,000 feet to crash into the ocean in just over 4 minutes? Do not read this if you're getting ready to take a flight. A cascade of events, of which human error played a big role. The key is to learn from such an event so the lives lost were not in vain.
Cockpit Resource Management (CRM) was begun in 1979 as a result of a NASA workshop. One of the key elements was to make sure that co-pilots would be more responsive to warning/advising the pilot. In the case of Air France Flight 447, they didn’t even get to that stage, with two co-pilots, both of whom tried to control the plane. Instead of working together, they actually worked against each other.The situation got worse when the Captain entered the cockpit, with neither co-pilot filling him in on the sequence of events and vital readings which might have allowed the Captain to quickly assess the situation.
One minute 38 seconds
One minute 38 seconds
How Did A Flyable Plane Crash in Just Over Four Minutes?
Why Did Air France 447,
a Flyable Plane, Crash?
Last warning from the flight
computer: “Pull up.”
Co-pilot yells: “We’re going to
crash. I don’t believe it. But what’s
Seconds later one of the co-pilots
exclaims: “F@ck! We’re dead.”
Air France 447
Human-Machine Interface Failure
The Rule of Seven:
Every catastrophe has 7 events.
Six Cascade Events leading to the
final event, the catastrophe. At
least one of the Cascade Events
involves human error. Thus most
catastrophes can be avoided.
Anatomy of Catastrophe
On 1 June 2009, an Airbus A330 owned by Air
France entered a high altitude stall and four
minutes and twenty-three seconds later
crashed into the ocean. All 228 passengers
and crew on board were killed.
As with any plane crash, the Rule of Seven
applies, with a mechanical failure initiating a
catastrophic series of events.
31 May 2009; 10:29 GMT: Air France Flight
447 takes off from Rio de Janeiro en route
1 June 2009: The plane is approaching a
line of storms along the equator.
02:01:46 am: After briefing the co-pilots,
the Captain leaves the cockpit.
02:10:05 am: Pitot tubes freeze, causing
the air speed indicator to provide faulty
readings; causing autopilot to disengage,
transitioning control of the aircraft from
‘normal law’ (computer control) to
‘alternate law’ (pilot control). Auto-thrust
disengages three seconds later. Co-pilot
over-corrects, putting aircraft dangerously
02:10:11 am: First stall warning. Nose still
02:10:22 am: Plane reaches apex, stalls,
starts to drop, eventually reaching a
downward speed of 10,000 feet per
02:11:43 am: Captain re-enters the cabin:
“What the fuck are you doing?” No one
seems to understand the plane is in a
02:12:30 am: One Co-pilot asks: “Am I
going down now?”
02:13:23 am: Both Co-pilots are trying to
control the aircraft from their seats,
giving dual inputs that are contradictory.
02:14:14 am: Last warning from the
computer: “Pull up.” Co-pilot yells: “We’re
going to crash. I don’t believe it. But
what’s happening?” Seconds later one of
the co-pilots exclaims “F@ck. We’re
02:14:28 am: Air France 447 hits the
water with a downward speed of 11,000
feet per minute (125 miles per hour).
ELAPSED TIME FROM FIRST INDICATION
OF TROUBLE: 4 MINUTES 23 SECONDS
A tired pilot and inexperienced co-pilots.
The Captain and co-pilots, arrived in Rio de Janeiro 3
days before the flight. The Captain reportedly spent his
time with an off-duty flight attendant and had only 1
hour of sleep the night before the flight. One co-pilot
had his wife with him for the trip. The other co-pilot
was doing the flight to maintain his flight proficiency
since he had matriculated to an executive position at
Air France. Fatigue most likely did play a factor,
especially since the Captain was supposedly asleep
when the initial problem occurred and was slow to
respond to calls from the cockpit for help. The off-duty
attendant was also on board the fatal flight.
Lesson: Physical condition is often a factor in
catastrophes; and personal issues can also
Flight planning designed to save fuel, not
anticipate problems, might have kept them
from diverting around the storms. The
Intertropical Convergence Zone lay directly in
their path. The storm topped out too high for
the plane to climb over, but there were gaps
that could be negotiated if one deviated from
the straight-line course. Flight 447 flew directly
into the system. Why?
By standards, with a destination of Paris, the
flight’s fuel supply did not have a sufficient safety
margin. But the pilot didn’t enter Paris as the
destination for the fuel requirement; he entered
Rio to Paris: 9,163 kilometers; 5,963 miles.
Rio to Bordeaux: 8,679 kilometers; 5,392 miles.
The safety margin was satisfied if the plane was
going to land at Bordeaux. Any diversion around
the storm would have burned fuel the plane
needed to make it to its actual destination, Paris.
LESSON: Circumventing rules by finding
loopholes can cause disaster.
The air speed indicator pitot tubes froze up.
Mechanical failure often has a history. Actually,
multiple histories: rarely do they occur
unannounced and rarely is the fatal failure the first
time the mechanical failure occurred.
The specifications and licensing for pitot tubes for
airspeed indicators dates back to 1947. Before jet
planes were used.
The air speed indicator pitot tubes froze up.
A failure of airspeed indicators was fraught with danger,
especially with the increasing reliance on the autopilot. In
1998, a Lufthansa plane lost its airspeed indicator while over
Frankfurt Airport. Fortunately, the pitot tube de-iced when
the plane descended and it was able to land safely.
Even the manufacturer of the tubes realized that a failure of
their product could cause a crash. They formed a task force,
a red flag of danger, to look into the problem four years
before Air France Flight 447.
Airbus also knew the pitot tubes were a problem, with a
history of 9 incidents in 6 months in 2008. A year before Air
France Flight 447.
LESSON: Delays in dealing with potential mechanical
problems that have been noted can easily be a key
cascade event leading to a catastrophe.
Often, the cause of the delay is cost cutting or the
reluctance to spend additional funds. The backwards
looking funding for safety is ultimately more
expensive than prevention and spending.
One co-pilot reacted inappropriately.
At 2:10:05 am, on 1 June 2009, the pitot tubes
on Air France 447 froze up. This caused the air
speed indicator to fail. This caused the
autopilot to disengage. The auto thrust
disengaged at 2:10:08.
At this point, the plane was still flying level, at a
steady speed and altitude. If the pilots did
nothing, nothing would have changed.
The co-pilots did something.
One co-pilot reacted inappropriately.
The flight controls on an Airbus are unlike those
in the movies with the traditional yoke. Instead,
a computer keyboard could be pulled out in
front. To the right side for each pilot, was a
control stick, much like that for a video game.
The co-pilot nominally in charge, reacted. The flight
recorder showed he was putting too much input
into the stick, most likely from gripping it too hard.
He also did something that was dangerous: he
pulled back. It was the wrong response. Six seconds
later, with the stick pulled back 3/4th of the way, the
plane entered an unsustainable climb. The co-pilot
kept pulling back.
A mechanical male voice intoned that word once in
the cockpit six seconds after the co-pilot took
control. The machine was trying to tell the human
he was making a mistake. The problem was easily
solvable, but they had a new problem. The nose of
the aircraft was 12 degrees up. An unsustainable
02:10:22 am: Plane reaches apex, plane stalls, starts
to drop, eventually reaching a downward speed of
10,000 feet per minute.
LESSON: As we become more reliant on machines, we
lose some of our skills to react and control situations
when the machines fail. For planes, the line between
normal operation and disaster is a thin one given the
machines involved. As the systems get increasingly
complex, the possibility of errors increases
exponentially. The machine can try, but not
completely compensate for human error.
Leadership confusion in the cockpit, compounded
by control design.
When the captain left the cockpit, he did not
specifically designate which of the two co-pilots
was in charge. There are two sticks in the cockpit
and each can over-rule the other in the Airbus
One minute and seventeen seconds after the pitots
froze, the captain had still not appeared. The plane
reached apogee at 38,000 feet. With nose up at 23
degrees and essentially stalled out, the plane
begins to drop, quickly reaching a descent of 4,000
feet per minute.
A co-pilot told the Captain when he arrived in the
cockpit: “We completely lost control of the
airplane, and we don’t understand anything.”
Lesson: Teamwork is more important than individual
skills, especially in a complex scenario such as an
airplane cockpit. And in any situation, a leader must
always be clearly designated.
The humans and the machine were at odds. Every
time they lowered the nose, stall alarms went back
on—but the plane was already stalled.
The Captain entered the cockpit one minute and
thirty-eight seconds after the problem began, an
incredibly long time in a dangerous situation.
The humans and the machine were at odds.
Finally the stall alarm went off. But not because the
situation had been fixed. It was because the
situation was so bad it went beyond the
parameters of the computer, which rejected the
flight data is was receiving as invalid.
In other words, Air France Flight 447 was in such
bad shape, the computer had not been
programmed for this situation.
At this point they were dropping through
thirteen thousand feet. This altitude was their
last chance to save the plane and themselves. It
would have required a pilot to go against
instincts, ignore the stall warning, and put the
nose down thirty degrees. Then dive to regain
an angle of attack that gave the wings lift. It
would have taken almost all their altitude,
brought them down to just above the wave
tops, but it was possible.
It did not happen.
LESSON: The same human and machine problems
that get one into a deadly situation often prevent
one from getting out of it.
Plane impacts with water.
Four minutes and twenty seconds is all it
took from first problem to death.
The forward airspeed at impact was only
107 knots even though the engines were at
full thrust. The downward speed was
11,000 feet per minute.
Everyone was instantly killed on impact.
LESSON: Most of us think we’re better than we
really are and unless we are truly in a life-
threatening situation, we don’t know how we will
really react. The problem with the machine-human
interface is that almost all the time the machine is
right, but when it fails, humans have to do things
they might not be prepared for.
LESSON: Given that drones are conducting so many
military missions now, and autopilots do the vast
majority of piloting on civilian airplanes, it is almost
inevitable that the day will come when there will be
no pilots in the cockpit and machines will do all the
flying. In the same way, we are seeing the dawn of
where cars will drive themselves and we will simply
But we have to ask ourselves:
Do we trust machines more than we trust
Seven Ways to Prevent Catastrophes
1. Have a Special Ops preparation mindset
2. Focus by utilizing both big picture & detail
3. Conduct Special Forces Area Studies
4. Use the Special Forces CARVER formula
5. Have a “10th man”
6. Conduct After Action Reviews
7. Write and USE Standing Operating
Are you interested in a presentation about various
catastrophes and how the cascade events could have been
Events covered range from human-machine interface, to
leadership, to communication, cost-cutting, engineering, group
think, perseverance, systematic failure, and more?
Catastrophes are cascade events culminating in disastrous
chaos. War is chaos. Special Forces is the most elite unit
trained for a variety of combat situations.
What makes Special Forces elite is our mindset and
Are you interested in a presentation on how to use Special
Forces tactics, techniques and mental attitude to help your
organization anticipate and prevent potential catastrophes?
Please email firstname.lastname@example.org
Free downloadable Powerpoint
slideshows on survival, history
writing, and interesting information
is available HERE
The guide on the left is a complete preparation and
survival guide. The one on the right is a pocket-size
manual focusing on survival essentials.
New York Times bestselling author, graduate of West Point
and former Green Beret. He’s had over 75 books published,
including the #1 bestselling series Green Berets, Shadow
Warriors, Time Patrol, Area 51, and Atlantis. Born in the
Bronx and having traveled the world he now lives peacefully
with his wife and dogs. Sort of.