Seconds to Disaster: US Edition by Ray Ronan Page B

automation might fail. Such a review also requires improved
communication from the aircraft’s automation, so as to aid flight crews
recognize quickly the exact nature of what has gone wrong.
    Accident chronicles may record
human error, but on the many occasions when technically troubled flights are
saved by airline crews they are often not made publically known, or even
exposed within an airline. The Miracle on the Hudson was one such Black Swan
event that did achieve worldwide attention for obvious reasons.
    But unfortunately, not all
technical disasters are overcome.

Chapter 14
Air France Flight
447
The Aftermath of a tragedy
    Many things
that are wrong with the airline industry converged on the tragic night over the
Atlantic when AF447 disappeared. As always with any accident, it poses many
questions, not least of which is why so many passengers and crew lost their
lives in a calamitous accident that never should have happened.
    According to the French investigators, the
catalysts for this tragedy were small but potentially harmful ice crystals that
blocked up the aircraft’s pitot tubes.
    Poking out from the aircraft skin, these
pitot tubes measure the inflow of air so that the aircraft’s computers may
calculate current speed and altitude.
    That night over the Atlantic as first
officers Robert and Bonin checked their radar due to thunderstorm activity in
their vicinity, they discussed icing risks, which was standard procedure for
their route of flight.  Meanwhile, tiny ice crystals began to form inside the
pitot tubes. Manufactured by Thales, these tubes had a known history of
technical problems due to icing.
    As first officers Robert and Bonin flew
their aircraft in the vicinity of the thunderstorms, suddenly the
autopilot and the automatic thrust of the engines tripped out and the
previously tranquil flight deck plummeted into a cascade of alarms. Synthetic
voices shouted out warnings and the aircraft speed displayed on the pilot’s
screens became unreliable and confusing.
    The Airbus computers, which would normally
prevent the pilots from moving the aircraft into a dangerous flight condition, abruptly
handed back control to the crew.
    But how could experienced pilots lose
control of their aircraft?
    The instant transition from a normal flight
into a possible life threatening scenario may have plunged the two first
officers into an information overload,
overwhelming them. In the words of David Learmount of Flight Global, “the pilots were confronted with a
situation they clearly didn’t recognize, or didn’t believe, or didn’t
understand.” [59]
    Did the cockpit design contribute to the disaster?
    (A
new human factors sub group created within the AF447 investigation team will
likely offer some important conclusions about this question and ought to be
noted in the final report.) [60]
    The Airbus design is one of the most
complex of any aircraft, in that it relies heavily — if not completely — on
computers. Airbus design philosophy is such that reliance of onboard computerization is almost taken to the point of infallibility.
    In a 1994 documentary called Fatal Logic, German
journalist Tim Van Beveren challenged the concept of infallibility assumed by
not only airbus designers but by the founder of the fly-by-wire philosophy.
    (Fly-by-wire is an automated system of
control of the aircraft, which eliminates certain controls which were formally
of a mechanical nature.)
    Van Beveren interviewed at length the
spiritual father of automation in the cockpit, Bernard Ziegler of Airbus. [61] When presented with a
significant fault discovered by pilots regarding the A340 aircraft design software,
Zeigler admitted that even an aircraft as automated as an Airbus cannot cope
with every eventuality. “This is one of the highly remote probabilities where
you really need a crew to interpret. You cannot cover such low probabilities
with a computer”. [62]
    According to Van Beveren, the airing of
this comment was