An Air France flight from Rio de Janeiro to Paris crashed into the Atlantic Ocean in 2009, killing all 228 people on board. The crash was caused by a series of events according to the Rule of Seven. Initially, frozen pitot tubes caused incorrect airspeed readings and disengaged the autopilot. A co-pilot then inappropriately pulled back on the controls, stalling the plane. Confusion in the cockpit along with fatigue and inexperience among the pilots prevented them from recovering from the stall. Over several minutes, the plane lost altitude until it crashed into the ocean. The document examines the human and technical factors that combined to cause the catastrophe.

1. Why Did Air France 447,
a Flyable Plane, Crash?

2. Last warning from the flight
computer: “Pull up.”
Co-pilot yells: “We’re going to
crash. I don’t believe it. But what’s
happening?”
Seconds later one of the co-pilots
exclaims: “F@ck! We’re dead.”
Air France 447
Human-Machine Interface Failure

3. The Rule of Seven:
Every catastrophe has 7 events.
Six Cascade Events leading to the
final event, the catastrophe. At
least one of the Cascade Events
involves human error. Thus most
catastrophes can be avoided.
Anatomy of Catastrophe

4. On 1 June 2009, an Airbus A330 owned by Air
France entered a high altitude stall and four
minutes and twenty-three seconds later
crashed into the ocean. All 228 passengers
and crew on board were killed.
As with any plane crash, the Rule of Seven
applies, with a mechanical failure initiating a
catastrophic series of events.
THE FACTS

5. 31 May 2009; 10:29 GMT: Air France Flight
447 takes off from Rio de Janeiro en route
to Paris.
1 June 2009: The plane is approaching a
line of storms along the equator.
02:01:46 am: After briefing the co-pilots,
the Captain leaves the cockpit.
THE TIMELINE

6. 02:10:05 am: Pitot tubes freeze, causing
the air speed indicator to provide faulty
readings; causing autopilot to disengage,
transitioning control of the aircraft from
‘normal law’ (computer control) to
‘alternate law’ (pilot control). Auto-thrust
disengages three seconds later. Co-pilot
over-corrects, putting aircraft dangerously
nose-up.
THE TIMELINE

7. 02:10:11 am: First stall warning. Nose still
up.
02:10:22 am: Plane reaches apex, stalls,
starts to drop, eventually reaching a
downward speed of 10,000 feet per
minute.
THE TIMELINE

8. 02:11:43 am: Captain re-enters the cabin:
“What the fuck are you doing?” No one
seems to understand the plane is in a
stall.
02:12:30 am: One Co-pilot asks: “Am I
going down now?”
02:13:23 am: Both Co-pilots are trying to
control the aircraft from their seats,
giving dual inputs that are contradictory.
THE TIMELINE

9. 02:14:14 am: Last warning from the
computer: “Pull up.” Co-pilot yells: “We’re
going to crash. I don’t believe it. But
what’s happening?” Seconds later one of
the co-pilots exclaims “F@ck. We’re
dead.”
02:14:28 am: Air France 447 hits the
water with a downward speed of 11,000
feet per minute (125 miles per hour).
THE TIMELINE

10. ELAPSED TIME FROM FIRST INDICATION
OF TROUBLE: 4 MINUTES 23 SECONDS
THE TIMELINE

11. A tired pilot and inexperienced co-pilots.
The Captain and co-pilots, arrived in Rio de Janeiro 3
days before the flight. The Captain reportedly spent his
time with an off-duty flight attendant and had only 1
hour of sleep the night before the flight. One co-pilot
had his wife with him for the trip. The other co-pilot
was doing the flight to maintain his flight proficiency
since he had matriculated to an executive position at
Air France. Fatigue most likely did play a factor,
especially since the Captain was supposedly asleep
when the initial problem occurred and was slow to
respond to calls from the cockpit for help. The off-duty
attendant was also on board the fatal flight.
Cascade 1

12. Lesson: Physical condition is often a factor in
catastrophes; and personal issues can also
impinge.

13. Flight planning designed to save fuel, not
anticipate problems, might have kept them
from diverting around the storms. The
Intertropical Convergence Zone lay directly in
their path. The storm topped out too high for
the plane to climb over, but there were gaps
that could be negotiated if one deviated from
the straight-line course. Flight 447 flew directly
into the system. Why?
Cascade 2

14. By standards, with a destination of Paris, the
flight’s fuel supply did not have a sufficient safety
margin. But the pilot didn’t enter Paris as the
destination for the fuel requirement; he entered
Bordeaux.
Rio to Paris: 9,163 kilometers; 5,963 miles.
Rio to Bordeaux: 8,679 kilometers; 5,392 miles.
The safety margin was satisfied if the plane was
going to land at Bordeaux. Any diversion around
the storm would have burned fuel the plane
needed to make it to its actual destination, Paris.
Cascade 2

15. LESSON: Circumventing rules by finding
loopholes can cause disaster.

16. The air speed indicator pitot tubes froze up.
Mechanical failure often has a history. Actually,
multiple histories: rarely do they occur
unannounced and rarely is the fatal failure the first
time the mechanical failure occurred.
The specifications and licensing for pitot tubes for
airspeed indicators dates back to 1947. Before jet
planes were used.
Cascade 3

17. The air speed indicator pitot tubes froze up.
A failure of airspeed indicators is fraught with danger,
especially with the increasing reliance on the autopilot. In
1998, a Lufthansa plane lost its airspeed indicator while over
Frankfurt Airport. Fortunately, the pitot tube de-iced when
the plane descended and it was able to land safely.
Even the manufacturer of the tubes realized that a failure of
their product could cause a crash. They formed a task force,
a red flag of danger, to look into the problem four years
before Air France Flight 447.
Airbus also knew the pitot tubes were a problem, with a
history of 9 incidents in 6 months in 2008. A year before Air
France Flight 447.
Cascade 3

18. LESSON: Delays in dealing with potential mechanical
problems that have been noted can easily be a key
cascade event leading to a catastrophe.
Often, the cause of the delay is cost cutting or the
reluctance to spend additional funds. The backwards
looking funding for safety is ultimately more
expensive than prevention and spending.

19. One co-pilot reacted inappropriately.
At 2:10:05 am, on 1 June 2009, the pitot tubes
on Air France 447 froze up. This caused the air
speed indicator to fail. This caused the
autopilot to disengage. The auto thrust
disengaged at 2:10:08.
At this point, the plane was still flying level, at a
steady speed and altitude. If the pilots did
nothing, nothing would have changed.
The co-pilots did something.
Cascade 4

20. One co-pilot reacted inappropriately.
The flight controls on an Airbus are unlike those
in the movies with the traditional yoke. Instead,
a computer keyboard could be pulled out in
front. To the right side for each pilot, was a
control stick, much like that for a video game.
Cascade 4

21. The co-pilot nominally in charge, reacted. The flight
recorder showed he was putting too much input
into the stick, most likely from gripping it too hard.
He also did something that was dangerous: he
pulled back. It was the wrong response. Six seconds
later, with the stick pulled back 3/4th of the way, the
plane entered an unsustainable climb. The co-pilot
kept pulling back.
Cascade 4

22. “STALL.”
A mechanical male voice intoned that word once in
the cockpit six seconds after the co-pilot took
control. The machine was trying to tell the human
he was making a mistake. The problem was easily
solvable, but they had a new problem. The nose of
the aircraft was 12 degrees up. An unsustainable
climb.
02:10:22 am: Plane reaches apex, plane stalls, starts
to drop, eventually reaching a downward speed of
10,000 feet per minute.
Cascade 4

23. LESSON: As we become more reliant on machines, we
lose some of our skills to react and control situations
when the machines fail. For planes, the line between
normal operation and disaster is a thin one given the
machines involved. As the systems get increasingly
complex, the possibility of errors increases
exponentially. The machine can try, but not
completely compensate for human error.

24. Leadership confusion in the cockpit, compounded
by control design.
When the captain left the cockpit, he did not
specifically designate which of the two co-pilots
was in charge. There are two sticks in the cockpit
and each can over-rule the other in the Airbus
model.
Cascade 5

25. One minute and seventeen seconds after the pitots
froze, the captain had still not appeared. The plane
reached apogee at 38,000 feet. With nose up at 23
degrees and essentially stalled out, the plane
begins to drop, quickly reaching a descent of 4,000
feet per minute.
A co-pilot told the Captain when he arrived in the
cockpit: “We completely lost control of the
airplane, and we don’t understand anything.”
Cascade 5

26. Lesson: Teamwork is more important than individual
skills, especially in a complex scenario such as an
airplane cockpit. And in any situation, a leader must
always be clearly designated.

27. The humans and the machine were at odds. Every
time they lowered the nose, stall alarms went back
on—but the plane was already stalled.
The Captain entered the cockpit one minute and
thirty-eight seconds after the problem began, an
incredibly long time in a dangerous situation.
Cascade 6

28. The humans and the machine were at odds.
Finally the stall alarm went off. But not because the
situation had been fixed. It was because the
situation was so bad it went beyond the
parameters of the computer, which rejected the
flight data is was receiving as invalid.
In other words, Air France Flight 447 was in such
bad shape, the computer had not been
programmed for this situation.
Cascade 6

29. At this point they were dropping through
thirteen thousand feet. This altitude was their
last chance to save the plane and themselves. It
would have required a pilot to go against
instincts, ignore the stall warning, and put the
nose down thirty degrees. Then dive to regain
an angle of attack that gave the wings lift. It
would have taken almost all their altitude,
brought them down to just above the wave
tops, but it was possible.
It did not happen.
Cascade 6

30. LESSON: The same human and machine problems
that get one into a deadly situation often prevent
one from getting out of it.

31. Plane impacts with water.
Four minutes and twenty seconds is all it
took from first problem to death.
The forward airspeed at impact was only
107 knots even though the engines were at
full thrust. The downward speed was
11,000 feet per minute.
Everyone was instantly killed on impact.
Final Event

32. LESSON: Most of us think we’re better than we
really are and unless we are truly in a life-
threatening situation, we don’t know how we will
really react. The problem with the machine-human
interface is that almost all the time the machine is
right, but when it fails, humans have to do things
they might not be prepared for.
Final Event

33. LESSON: Given that drones are conducting so many
military missions now, and autopilots do the vast
majority of piloting on civilian airplanes, it is almost
inevitable that the day will come when there will be
no pilots in the cockpit and machines will do all the
flying. In the same way, we are seeing the dawn of
where cars will drive themselves and we will simply
be passengers.
But we have to ask ourselves:
Do we trust machines more than we trust
ourselves?
Final Event

34. Seven Ways to Prevent Catastrophes
1. Have a Special Ops preparation mindset
2. Focus by utilizing both big picture & detail
thinkers
3. Conduct Special Forces Area Studies
4. Use the Special Forces CARVER formula
5. Have a “10th man”
6. Conduct After Action Reviews
7. Write and USE Standing Operating
Procedures (SOPs)

35. More Free Information
If you want to go directly to a document with live
links to all free apps, gear, library, and Jeep stuff,
use your camera on this QR Code. Or copy and
paste:
https://www.dropbox.com/scl/fi/vwgilkne2vsq4jrhkpgi
c/GEAR-
LINKS.docx?dl=0&rlkey=i858w1e2zd3irup2lcvhvlbm
a

36. More Free Information
Since Slideshare no longer supports links,
I’ve also put all the links to free apps, gear and web
pages on my web site at
www.bobmayer.com
Use the pop up from the following image there and
scroll through for what you want:

37. This book walks you through your personal situation,
your home, and your Area of Operations.

38. AMAZON

41. New York Times bestselling author, is a graduate of West Point and
former Green Beret. He’s had over 80 books published, including the #1
bestselling series Green Berets, Time Patrol, Area 51, and Atlantis. He’s
sold over 5 million books. He was born in the Bronx and has traveled the
world. He’s lived on an island off the east coast, an island off the west
coast, in the Rocky Mountains, the Smoky Mountains and other places,
including time in East Asia studying martial arts.
They haven’t caught him yet.
www.bobmayer.com