What We Can Learn From Air France Flight 447
On the evening of May 31, 2009, 216 passengers and 12 crew members aboard Air France flight 447 disappeared into the South Atlantic. For almost two years, the mystery remained, until the back boxes were plucked from the sea floor nearly two miles deep, revealing that it was not poor weather conditions that brought down the plane, it was simple human error. In an age of such advanced technology, how could human error override a perfectly functioning airplane? Under pressure, human beings can lose their ability to think clearly and to properly execute the things they have learned in the past. From seven miles of altitude, a co-pilot managed to ignore his training and bring that aircraft crashing down to the remote and frigid ocean.
In a nutshell, while the senior pilot took a break, co-pilot Pierre Cedric Bonin took over the controls. Moments later, the plane entered a large cloud produced by a tropical thunderstorm. Moisture froze on the plane’s air-speed sensors causing a shutdown of the autopilot system. Missing some of the critical information they were accustomed to seeing, the two co-pilots were forced to fly the plane manually. The correct action for Bonin would be to simply hold the plane in a level attitude and consult his checklist to sort out the airspeed issue. Instead, he pulled back on the controls, climbed and pitched the aircraft into an aerodynamic stall. The plane quickly lost altitude and began plunging to the the sea below.
During the last fatal moments, the stall-warning alarm blared 75 times, but the two less experienced co-pilots were baffled. The captain arrived in the cockpit to hear, “We’ve totally lost control of the plane. We don’t understand… we’ve tried everything.” The final words from the pilot as he saw the yoke pulled back was, “no, no no!” Under stress, the human brain can lose its ability to engage in complex reasoning. Psychologists call it brain freeze. It seems that when the amygdala is aroused, the frontal cortex partially shuts down. At this time, the human brain is only capable of executing instinctive, well-learned and practiced behavior. Bonin was inexperienced and in his panic, he simply held the controls until he crashed. This accident reminded us that even though airlines crashes are rare, they are usually caused by human error.
Recently, an experienced diving colleague of mine suffered a serious failure on his rebeather. Some 3000 feet back in a cave, he was suddenly faced with an alarm light alerting him to a problem. According to his display, one sensor was badly out of range from the other two. Voting logic had isolated that sensor and was flying the unit based o the readings of the remaining sensors. His PO2 seemed low and so he added oxygen to bring the loop back to an acceptable level. Continuing to flush oxygen into the loop, he could not figure out why the PO2 was still low. He turned his dive and started swimming out. As he began moving towards the exit, his heart rate increased. The rebreather was not behaving in a predictable way. He felt strange. Suddenly, he was out of oxygen. How could this be? What was going on? He was unable to slow his brain down and sort things out. Thankfully, the instinct to bail to open circuit remained and his conservative gas planning got him out of the cave.
Later diagnosing the issue, he discovered that he may have suffered a simultaneous dual sensor failure. He had been flying the unit based on the two defective sensors. This is the Achilles Heel of any voting logic. It still requires the human brain to interpret the issue and take corrective action if two sensors fail at once. A diluent flush would have confirmed the bad sensors and allowed him to “simply hold the plane in a level attitude and consult his checklist to sort out the issue.” He is extremely fortunate to survive what must have been an extraordinarily high PO2 during those frightful moments.
When faced with any sort of instrument failure, your best immediate action is to ensure a safe gas in the breathing loop. You don’t need displays to know that a diluent flush will bring everything to a safe level while you take your time to consult your mental checklists. After all, when the worst has just happened, your breathing loop is just a container of gas. You have the ability to ensure that big bag of gas is something that is safe to breathe. If all else fails but you have an intact loop and can identify at least one trustworthy sensor with a diluent flush, you still have a useable rebreather with manual oxygen addition to control setpoint.
