You, Me, and Air France 447

My guess is that “Air France 447” probably doesn’t ring a bell with most airline passengers–nor should it, really. But it means a lot to me.

But I probably read airline accident reports with a different mindset than those for whom “flying” is actually riding, kind of like the tandem jumpers who pay to fall out of a plane hooked to an “experienced” parachutist–then say they’ve “sky-dived.” That’s because what goes on between the time passengers board my jet to touchdown and deplaning thousands of miles later rests squarely on my shoulders.

Certainly, I mourn the loss of the 228 souls on board the Airbus 330 aircraft, but I have to think beyond that. My job is to ask, when it comes to the mechanical failure the pilots of AF 447 encountered, what are my blind spots, my vulnerabilities? How can I successfully handle this challenge when it happens on my flight?

If you’re the kind that prefers to just “hook up to some guy and jump,” more power to you. That’s part of my profession, allowing you that confidence by doing the post-mortem, reading the report and figuring out for myself what I need to learn for myself–and you–when faced with a similar situation.

Want to come along and see how that’s done? Fine, here we go. Not interested? That’s fine too. See you next week.

The Accident Report

Here’s a summary of the accident from a source that is usually reliable, and here is the actual report itself if you care to read the whole thing.


Here’s the knee-jerk reaction that’s hard to avoid when you’re a pilot: there they go again, making the flight crew the scapegoats. And that’s a legitimate complaint and bias from pilots, because clearly, the aircraft experienced a major mechanical failure. The trail of accident factors in a car wreck doesn’t end with the driver: why did the brakes fail? Why did the tire blow out? Were there design issues that created the problem? Manufacturing flaws? Supervisory lapses that allowed damage to occur or go undetected? Regulatory and oversight failures that allowed the threat to exist undetected–or allowed to continue on a slower than immediate abatement schedule?

This last point is a major headache for pilots and risk factor for everyone who flies. That is, in our country, the NTSB (National Transportation Safety Board) has responsibility for conducting accident investigation, then reporting on causes and issuing recommendations to prevent recurrence. But the NTSB has no authority to enforce these recommendations. That authority rests with the FAA, who negotiates with the airlines to implement some of the NTSB recommendations on a gradual basis so as not to unduly affect flight operations and incur huge costs and monetary losses.

Meaning, as in the case of AF 447, that a known problem with the pitot-static system that induced the loss of control sequence of events, occurred in flight before the recommended system modifications could be made. It should be made clear that Air France is not subject to the NTSB or FAA, unless operating in the US and this accident occurred in South America. But it should also be said that this exact same pitot-static failure had become a well-known vulnerability in this model of aircraft, and that modifications to the system were being accomplished fleet-wide on a gradual basis, and that the Air France pilots’ union had long been recommending that the aircraft not be flown until the modifications were complete.

The Flightcrew

I have nothing to say about the AF 447 flightcrew other than god rest their souls. I wasn’t on the flight deck on that dark, stormy night over the Atlantic, I don’t know what they saw or felt or how the four minutes from cruise altitude to the ocean’s surface transpired or how the plane handled throughout.

The crew I care about is my own. Are we prepared for this malfunction, for complete loss of pitot-static instruments? Are we astute and engaged enough to detect the root cause of the problem and to work around the lack of airspeed and vertical velocity data?

Because it’s not that simple, although the sequence of events is very simple: the autoflight modes trip off. Meaning, the autopilot and autothrottles disengage, leaving the crew to handle power, pitch and roll inputs.

Fine. But the reason the automation quit was because it no longer had the normal performance data of airspeed and altitude upon which to base its flight control and throttle commands–so the pilots taking over manually were denied that critical information as well.

But here’s where the forest and the trees take over: as a pilot, I could waste a lot of time trying to figure out why both automated modes failed. But that’s not as important as flying the aircraft.

The tendency with advanced flight automation, and we certainly have exactly that in the Boeing 737-800 I fly, plus the Airbus fleet is the poster child for autoflight, is that it’s easy to get wrapped up in the automation function. And that is often at the expense of direct aircraft control.

At American Airlines, our boss the Chief Pilot started a campaign last year aimed at exactly this vulnerability. It’s called “Aggressively Safe,” meaning intervene in the automation cycle at the first sign of a problem with any system: disconnect the automation and hand-fly the aircraft until the validity of all automated systems can be verified and restored–or simply left disengaged.

That’s smart, considering the present vector of automation, which Boeing explicitly warns thus: “The new generation automated flight systems of the 787 level aircraft now outpaces the human capacity to do backup calculations.” In other words, a pilot can’t do the calculations associated with a flight maneuver fast enough to verify the accuracy and correctness of the automation performing the flight maneuver. Hence my boss’s wise counsel to intervene now, fly the aircraft safely, verify as soon as you can.

But in the case of total pitot-static failure, it’s not really a matter of disconnecting the automation, because it’s disconnected itself. In which case, there are two roads to go down, and one of them is a dead end.

As a pilot, I hope to god the road I choose is this: fly the jet, period. Worry about what happened later. The dead end road is to search for the cause of the failure or even worse, the cause of the automation disconnect–unless and until one pilot is decisively and exclusively flying the aircraft. Then the other pilot can concentrate on exactly that–which again, is standard American Airlines operating procedure.

But there again, the “why” of the malfunction isn’t as important as “how” of the work-around: you still have to control the jet and establish straight and level flight before anyone diverts attention to diagnostics and system restoration.

We’re fortunate on the Boeing -800 fleet to have displayed at all times an angle of attack gage, telling us at a glance the performance of the airfoil. And we also have–I assume Airbus has as well, but I don’t know–a valid groundspeed readout regardless of the pitot-static systems. Can I control the aircraft with just those two information streams? The answer is a resounding “yes,” and we practice exactly that at least once a year in the simulator.

But what you can’t easily ensure is the thought process that prioritizes aircraft control over system diagnosis and remediation. As I said, there’s a fork in the road: you either get your head in the flight game (groundspeed, engine power settings, angle of attack), or you go into the what-ifs of automation that has so many layers and so much complexity that you’re soon way deep into the forest and out of the stick and rudder flying realm. I’ve been doing this a long time–long enough to know I ain’t smart enough to travel both roads at once. And in the case of pitot-static failure, we need both of us traveling down the aircraft control road before anyone even attempts a side trip in automation land.

Going Forward

In my experience, automation failure is usually attributable to three factors: power failure, data-input error, or data/program corruption. So when the automation trips off–and it does, often enough, on an average flight–I have those three things in the back of my mind. In the front of my mind is the flight path and aircraft attitude. Stick and rudder always works. And as one wise old fighter pilot who taught crew management to captains at my airline used to say, no matter what emergency is going on in flight, there’s always time to take a deep breath and say to yourself, “Can you believe this sonofabitch is still flying?”

And that’s the key: flying. Not troubleshooting, diagnosing, or otherwise attending to systems. Unless and until the “flying” part is assured, which is easier said than done. That’s because most pilots are technicians, experienced in working with complex flight management and navigation systems. Many have engineering backgrounds and are naturally inclined to solve technical problems.

Fine–except once you go down that rabbit hole, the other guy is solo and worse, if both pilots succumb to the lure of technical “what’s it doing” or what’s wrong with this system?” tail chase–then whose undivided attention is manning the stick and rudder?

So rewind. What do I take away from this accident report? First, when the autoflight systems fail, it’s time for old fashioned stick and rudder application–period. Troubleshooting? Systems analysis? Later–and only after one pilot is firmly established and solely concentrated on aircraft control.

Second, in a pitot static failure, GPS groundspeed and angle of attack will let you extrapolate straight and level flight. On our jets, the Heads Up Display–HUD–will also display energy potential. Also, the FMS will display the required engine power setting for level flight–set it, leave it, watch it. Divide and conquer: since the HUD is only on my side, I’m flying, copilot is running through the systems checklists.


Like every other flight and flightcrew, I realize my own vulnerability when it comes to systems failures and autoflight malfunctions: the distracting technical rabbit hole luring pilots away from the stick and rudder application and into the layered, complex technical realm of autoflight to detect and “fix” a problem. That’s the real problem.

The designers who built the jet designed it to fly despite the systems failures, if we as pilots attend to the flying as top priority. And my old fighter pilot friend filled in the blank to the final question: just take a deep breath and keep the jet flying.

It’s just that simple, and just that complex. The irony is, if I’m successful, you’ll never know the difference, and that’s pretty much my goal, and that’s also my plan. The rest is going to be, on your part, a leap of faith.


42 Responses to “You, Me, and Air France 447”

  1. I love your posts. I can’t understand why the crew didn’t go to manual either. QANTAS A330 had a similar problem but it was during the day so perhaps that made a difference. I understand that if you set the aircraft to fly with nose up (5 degrees or something like that) and 75% (or85% or some such thing) power, the plane will fly level until you can verify your readings. I know that super chilled water will form ice instantly around a nucleus but wouldn’t you think there would be heaters in the peto-static ports that are substantial enough do keep the system clear?

    • You’re right, but there was a malfunction in the system and a deficiency in the design that allowed ice to form which completely invalidated the speed inputs. But, as you said, if your head’s in the flying game rather than going down the engineering rabbit hole, the rudimentary cues (setting the expected power is as you mention key) are there to maintain level flight. I’m staking my life on that–yours too–every day in the air.

  2. UberMitch Says:

    Meaning, the autopilot and autothrottles disengage, leaving the crew to handle power, pitch and roll inputs.

    Why no love for yaw?

  3. Fr. Jeremiah Says:

    Good post, Captain! I can’t imagine being in their shoes; but as I read through the report and the CVR transcripts, I found myself wondering over and over again “Who’s flying the plane???” In any case, may eternal repose be theirs and new-found wisdom ours. Thanks again!

    • I agree on the eternal repose, and you point out a major problem: who’s flying? And as it turns out, it was both of them making control inputs but, because of the Airbus design, neither was aware of the other’s inputs. That’s because the Airbus has a side stick rather than a control wheel and to add to the confusion, the stick doesn’t move. It senses pressure, but unlike the control wheel in most jets, it doesn’t mirror inputs on the other side. If either pilot makes an input with the control yoke, the other pilot knows right away. Ditto the throttles: they move forward and aft on conventional jets. I can’t fault Airbus designers for expecting pilots to follow the correct protocol and designate who is actually flying (it requires a positive statement, “I have the aircraft”) but in this case, it’s two first officers in the seats, a pretty much equal valence, as opposed to the captain saying, “I have the aircraft” and the First Officer relinquishing control.

      The captain and F/O dynamic works best, in my experience, and while I’m never shy about saying “I have the aircraft,” that is followed by an over dose of me asking, “Telling me what I’m missing here, what I’m not thinking, what you’re thinking .” Two heads in the game are always better than one.

      • T. Wright Barnes Says:

        From an aerospace engineer’s point of view, I do have concerns with the design choices in the Airbus side-stick flight controls design that does not provide feedback for either other crewmember flight control inputs or trim position (particularly pitch trim). I think this is one of the areas that merits further study in light of the AF447 tragedy.

  4. Cedarglen Says:

    Thanks Chris. A lot of non-pilots have been waiting for the AF-447 report and some professional analysis from drivers of big airplanes. While you skirted the crew issue with grace, you have explained what any good flyer should do in a similar situation. Asking, “What is it doing now,” is not a great response. Fly the airplane, using only ‘steam’ indicators known to be reliable when necessary. In the end, the Captain is responible for everything. That includes knowing more than enough about the automation, when to turn it off and of course HOW to fly in stick and rudder mode, even at extreme altitude and speed. You and most of your senior colleagues seem to understand the physics of high altitude and high speed flight, but I wonder about the automation-centric junior flyers. Do you try to teach them when they are flying a leg, or do you just monitor to assure a safe, on-time arrival.
    As a whole, a darn good post and thank you. I understand your reluctance to comment on or discuss the AF-447 pilot’s actions and comments, but other will. The real point is, did they FLY or did they address problems with their automation? I think that the CVR transcripts have answererd that question rather well. Understanding the various automation systems is a good thing, but with hundreds of lives in the balance, those two (or more) souls up front still need to know how to fly – in manual mode. Thanks for the rushed post and even more thanks for knowing how to hand-fly your airplanes.

  5. Very well written Chris. It makes pilots and enthusiasts alike think about some very important things. One of the first things we were taught on the 747 was EPR and pitch angle settings for various phases of flight. Our instructors words were effectively, you can forget everything else, but if you remember this it will save your life.

    I was also taught many years ago that 80% thrust and 2-3 degrees nose up should keep just about any airplane flying long enough to be able to save the day.

    Lessons learned and lives lost, an unfortunate way this business works, but a reality we are stuck with.

    • I should add that the above comment was related strictly to a pitot static failure. This would not be at all effective for the deep stall condition these poor guys found themselves in.

      • Agreed. But you have to wonder, given that the AF pilots’ union was raising awareness of the pitot-static anomaly on the -330, why the crew seemingly wasn’t aware of the symptoms or apparently, a strategy to deal with them. There’s no indication that they clearly recognized the problem or the solution.

        I guess it’s a testimony to the stability of the A-330 that in a deep stall it never departed controlled flight. And the vulnerability of the pilot mindset comes up subtly: because there was no stall warning (due to lack of a valid air data computer input) doesn’t mean there’s no stall. But the fact that there was no warning made it easy to overlook the stall as a possibility if you’re thinking mechanically rather than aerodynamically.

  6. It is good to get a pilot’s perspective on this.

  7. Interesting to hear you guys go to full manual control – I fly 737NGs with the Air Force (not USAF). They’re big on us going to simple modes, but much more hesitant to revert to raw data.

    Arguably that’s to prevent a bunch of junior guys with hardly any flying time (300 hours for me) losing too much SA. Still, I’d be very interested to hear more about what you guys consider to be the pro’s and cons if it.

  8. I was taught: Aviate, navigate, communicate. In that order.

    Excellent post Captain.

  9. Back in the days of stick-and-rudder aviation (but not so far back as “needle-ball-airspeed”) the emergency section of the -1 started with the trilogy for ALL emergencies: 1.) Maintain aircraft control; 2.) Analyze the situation and take proper action; 3.) Land as soon as practicable.

    Not necessarily as cut/dried as it seems though. AOA makes it all a lot simpler, but if other cues such as pitot/static and air data computer info are disrupted you may not have AOA either.

    I’m bothered by the layers of computer “laws” used in definition of the various auto-flight modes today. I think I would always be searching for some basics, just as you prescribe. A power setting and trim default that would result in a known flight condition, particularly for situations such as AF447 where you start with a lot of altitude.

    One nit-pick, Chris. Don’t discount YAW. Many a swept-wing aircraft has been flown very effectively without recourse to ailerons/spoilers because swept wings respond to yaw very cleanly to roll. A DC-10 in an Iowa corn-field used the technique through differential power when all flight controls went south.

    • Good points all, Ed. One thing no one seems to be mentioning that may be significant is that the A-330 fleet had experienced multiple pitot-static failures prior to AF 447 and the Air France pilots’ union had tried to force the airline to ground the 330s until fleetwide upgrades to the system could be made. Which makes me wonder why neither guys in the seat had that pitot-static failure in mind when things started to go haywire. It would almost be flawed reasoning but a natural tendency to be spring-loaded to suspect this known vulnerability at the first sign of auto-flight malfunction–but in this case it would have at least put them on the right track.

      My biggest worry ain’t the malfunction–stuff breaks/goes haywire all the time–it’s the rabbit hole of technical layers that can lure pilots away from the primary task: flying the g*ddam jet. Fortunately, I wasn’t never afflicted with any type of engineering background so my approach is all stick-and-rudder in most cases.

      Good point about yaw. The Boeing rudder can make nice heading corrections on final without incurring the drag of spoiler float. No reason why it can’t help restore coordinated flight in adverse conditions like AF experienced.

      • M. C. Hanna Says:

        Hey, Chris. Nice piece of narrative. Tommy Pasqualle might be very pleased with the explanations. As an old 75 and 76 ” graduate,” I appreciate this forum. Been retired since ’96 out of ORD and am still pushing the “little iron” around but your comments fit there as well. I was doing a practice ILS to ROC yesterday in a C-210 when the bumps made me mis-touch the iPad I was playing with. After a few moments of “aw s___! I decided to revert back to the raw data which showed the LOC and GS very nicely, thank you. Plus, the power was where it should have been. Thanks to the hours – and years of Sim time – at GSW it turned out to be a non-issue, the GPS, iPad and other goodies notwithstanding.

        Keep up the good work! Stay united but fly American!

        Mike Hanna

  10. Hello,

    i’ve got a few questions from a newbie :
    * how can you fly the plane without any external visual reference and any instrument validity ?
    * is there a angle of attack display on A330 ?

    From my newbie point (PPL with not a lot of experience) when i’m reading your note it looks easy to fly the plane and secondly thinking of the malfunction.
    But I’d like to underscore the fact that in a storm, by night they suddenly loose a lot of measurements and a ton of alarms rang. There was also variations in the stall warning alarm due to its conception.

    Thanks in advance for your answers


    • There *is* instrument reliability: as I said, the GFMS indicates groundspeed. And there are standard (the FMS will indicate them) power settings. That’s the foundation. I don’t know if the A-330 has angle-of-attack or a “fast/slow” indicator, which is essentially AOA.

      Really doesn’t matter that you’re in a storm and “a ton of alarms” ring: that’s the design of the aircraft, and you ain’t making it through your rating ride in the simulator without besting that exact scenario, because if you can’t sort all of that out, you shouldn’t carry revenue passengers.

      Here’s a question for you: would you really, as a passenger, fly on an aircraft knowing that if the pitot-static system failed, the aircraft was uncontrollable?

      • Thank you for your answer, again i’m very beginner with flying and i just would like to understand with my basic skills…. no airbus/boeing trolling behind my questions.

        I don’t know if the pilots in the plane had time enough to get which measure they could trust.

        Only with the GPS ground speed how can a pilot know how to manage the stick ? If the automation was out, the fast/slow device is also out, right ?

        What i just meant with the storm and alarms things is just a short phrase to make non-flying people understand that it was a kind of nightmare in the cockpit. It was not a minor incident with pilots forgetting to fly the plane. Of course i understand and i fully agree with the paradigm that Flying the plane is the only way to get out of sh*t situations. But was the plane “flyable” ?

        About your last question, of course it’s a big issue. Now as a young pilot i understand a little bit more the challenge of flying a plane. But i’m not aware of all the potentiel issues with each kind of aircraft, that’s impossible for a simple customer, even with some understanding of flying.

      • Hey, what do I know? You da man–we’ll go with your theory:

        –The time between the pitot-static failure and impact was 4 minutes, which is not enough time for pilots to “get which measure they could trust.”
        –Even though AOA is not part of the pitot static-system or the automation, “if the automation is out, so is the fast/slow” and AOA.
        –While groundspeed indicates climb or descent by velocity change at a stable thrust setting, there is no way for a pilot to “know how to manage the stick.”
        –If alarms are going off, pilots cannot be expected to control the aircraft.
        –And finally, if pitot-static failure occurs, the aircraft is unflyable and everyone aboard is doomed.

        Did I get everything? Well that does it: next time I need to get from Brazil to France–I’m driving!

    • Seriously Remi-dude, what does “variations in the stall warning alarm due to its conception” mean? Thanks for underscoring the fact that in a storm and in the dark, we’re all dead meat if anything goes wrong. Now I have to go find a new job. This pilot business is too scary.

      • Hello,
        page 46-47 of the english final report you can read how the stall warning works. Below a threshold speed the alarm stops. This is to avoid “false alarms”.

        Page 88-89 you can read some stuff about the variations of the stall warning during the accident.

        What i just wanted to underscore is that the environment also plays a great role in the drama. As usual the Reason model applies. In my job i’m also used with critical situations needing to do the right thing very quick, i know that sh*t happens and i’ve to manage this (i’m MD in critical care medicine)

        Of course every professional involved with critical situation is trained for that and should act in the right way but i’d like to say that despite this great tenet human factors also play a role and nobody is perfect.

        For me it’s to easy to say “ok just fly the plane”. This sentence is very correct but its simplicity hides the complexity of the problem.

        I beg your pardon for my poor english, i just would like to express my point of view and it’s not easy to convey a message in a foreign language

      • No worries about the language problems–English is my native language and I still mangle it.

        I think what you’re butting up against is a paradox of your own making: you proceed from the premise that you’ve flown very little, then draw broad conclusions that are based on your own lack of experience, which doesn’t sit well with many who actually do have decades of flight experience (you haven’t seen, and won’t, the comments on your musings I’ve deleted).

        I personally realize this paradox, and the futility of debating with one who has decided what they want to believe regardless of what they really know or understand of the situation. I’ve seen how that turns out in the end, when a new pilot doesn’t listen and learn, presuming they pretty much know what’s what in flight. You’re in for some exciting times in the pilot business.

  11. The process sounds a lot like what doctors do when a patient is lost.
    Flew recently – remember thinking about your posts during the flight – and hoping the pilot was cut of the same cloth.
    It’s not just skill, but an instinct… and hoping all had enough sleep (problem for doctors and pilots?)

  12. @ChrisManno Thank you for letting me express my opinion here.

    You’re right about the fact that there is a big gap between what i understand of the problem and what professional pilots understand of the problem.

    I’m sorry if my comments were unpleasant for anyone. That’s not my aim at all.

    The only thing i’d like to say to resume my thoughts is that it was a complex situation with a lot of factors (Reason model) and it’s really difficult to get a whole picture of the chaining of the drama. And this, also as a professional involved in critical situation i can affirm it.

    Of course this is a kind of truism but it seems important for me to say it again.

    Goodbye !

  13. “CAPTAIN ROY” ASKS: No one has addressed the key issue regarding the icing over of the pitot static system. Why was this flight even close to those HUGE TSTMS when other flights diverged from their vicinity? A later meteorological report stated their size as over 57,000 feet in altitude with opposing vertical wind shafts of over 100 knots… I am sure that the Captain received a briefing on their presence near his route of flight and he certainly had radar that would have depicted the storm’s presence in an area known for these hazards. He was in the bunk at the time of the start of the problem! These storms were huge, why was this flight ever allowed to be near them so as to experience the moisture and icing situation? This Captain’s abrogation of a primary duty is, in my opinion, the root cause of the accident. Tie that in with a known defective pitot static system and there was no other outcome but for the crew to be highly challenged in flight, a situation that NO CREW should ever place themselves, their flight and passengers in… My Company’s flight policy was to be no closer than 25 miles from the extremes of any TSTM due to possible presence of super cooled vapors and hail shafts.

    • I get what you’re saying, although I’m not ready to specifically indict the captain for “abrogation of duty.”

      Plus, my definition of “root cause” encompasses the foundational condition that initiated the accident sequence, and that goes back a lot farther than the captain not directing a wider margin around the TCU.

      I know on paper “25 miles” sounds good, but I guarantee that in real life, if every airliner maintained that margin no one would get anywhere, especially in the summer. In fact, you couldn’t even take off in Minneapolis if there was a storm in St. Paul.

      • Captain Roy Says, I don’t believe that “No one would get anywhere…” is a good measure of safety values when the CAPTAIN IS SOLELY THE ONE RESPONSIBLE FOR THE SAFETY AND SURVIVAL OF HIS PASSENGERS. If the detouring does create a schedule problem, so be it. As stated, other airliners DID circumvent the storms and there was nothing in the news about any problems that they encountered as a result of their actions. I have detoured and even gone to alternates when necessary to avoid class 4 and 5 tstms at my destination airport. Sure the passengers were upset with me at first over the diversion to STL from MCI but when the Tower personnel bail out of the tower because of Wx conditions and tornadoes created by these storms at MCI then the picture becomes clearer.
        The passengers thanked me the next morning when they discovered the facts at MCI.

      • You’re running a couple of things together. Tower staff evacuating, diversion: what does that have to do with the stream of dozens of jets from as many airlines picking their way through a line of thunderstorms in gaps smaller than 25 miles as they do all across the world every day?

        AF was doing just that, not deciding, like in your personal anecdote, to land twenty minutes away.

        With what airline and when did “Captain Roy” do all this? How does he manage weather avoidance on trans-oceanic crossings?

      • Captain Roy says: Chris, I know what you are saying and I’m sure that the diversions less than 25 miles occur quite often as I have done that myself, but only after an assessment of the size of the storm. (There is no evidence that AF 447 DID attempt to elude those storms at all like other flights that requested a diversion)
        One must assess the dangers from force 4 or 5 tstms that have hail; shafts that can project out from that storm. (We had a case of a L-1011 Captain who flew between two storms, breaking the rule of “25” and he suffered over $300,000 dollars worth of damage to every leading edge of his aircraft, including shattered windshields. Lucky he didn’t lose the aircraft…
        I flew 33 years for TWA, 20m years as a Flight Manager- (Pilot Supervisor) 10 years on the Safety-Standards Board in NYC, Last Chief Pilot, General Manager of Flying in SFO and the last 3 years flew as an International check Captain-training Captain on the 747 having had over 12 years Int’l flying (Atlantic and Pacific) and a lot of domestic flying. AFter retiring from TWA I served 16 years as a senior safety analyst in Mt. View, CA with the NASA/ASRS program and presented 3 papers at Ohio State University for 3 of their every other year “Aviation Safety Sypmosiums”. One of my presentations was “Confusion on the Flight Deck” delivered in 1993 at Ohio State.
        You ask, “How does he manage weather avoidance on trans-oceanic crossings?” What you do is you request a track change or if that off is not a viable option for Oceanic Control, you declare an emergency. Diversions in excess of 6 miles void the track protection as a “violation” or “track deviation”.
        Keep up the good work Chris, it does take a devotion that most don’t have.

      • That’s all well and good, but you seem to be muddling terms and concepts: okay, you “diverted” from STL to MCI, but no one “diverts” around weather.

        Plus, there never was or is any question about (all caps in yours) captain’s authority and responsibility. Going back even further, there’s no discrepancy in the dispatch of a flight with pitot-static systems operational, even if the jet or fleet had a past history of write-ups.

        Finally, as I learned formally at USC Flight Safety & Accident Investigation school, the least productive way to disrupt a latent chain of cause factors is to fixate on one link (all caps in your indictment of the deceased captain), never mind what we all learned informally as line pilots about drawing explicit conclusions and making indictments about crew dynamics on a flight deck we didn’t personally occupy.

        Most of us see a CVR and even FDR transcript for what it is: the view through a straw, absent of any actual or realtine context.

        Which is why most experienced airline pilots–including me–are reluctant to make sweeping claims about such incidents and the pilots involved.

      • “Captain Roy” says: Chris, your statement of “but you seem to be muddling terms and concepts: okay, you “diverted” from STL to MCI, but no one “diverts” around weather. ” does not make sense to me. It was from “ORD,short of destination of MCI and a turn back to STL. You did not even understand what I was saying to you.
        By saying, “Which is why most experienced airline pilots–including me–are reluctant to make sweeping claims about such incidents and the pilots involved.” Is to imply that I am NOT an experienced pilot. That sounds rather shabby. It IS OK to point a finger at a Crew or a Pilot if he is not paying attention to the enroute weather… and what does your remark about “but no one “diverts” around weather.” mean?
        Also, what does this mean: “Going back even further, there’s no discrepancy in the dispatch of a flight with pitot-static systems operational, even if the jet or fleet had a past history of write-ups.”?? C’mon Captain, communicate!

      • Divert means land at an alternate, right?
        And you’re either hyper-sensitive or just don’t read well between the lines, so let me spell it out for you: as an experiences pilot, you should have both the decorum and decency to not throw around public indictments of other pilots in an accident.

        But not all have both, or either.

  14. Excellent post as usual, Cap’n Manno.

    Flying the A320 class, this is a personal one for me. In our last PC, we emulated the (then-speculative) root cause of the issue, and I was shocked at HOW FAST things went to hell in a hand basket! When 2 of 3 systems agree on something, they cut the 3rd one out automatically–even if that happens to be the “right” one! Garbage in, garbage out.

    I was quickly reminded of the sage, age-old advice of “stick and rudder”–turn off the magic and FLY the plane FIRST!!

    And it also calls in mind the tragic ’78 United crash in Portland. For want of obsessing over troubleshooting a burned out landing gear light bulb, the plane ran out of fuel and everyone aboard lost!

    • That’s it in a nutshell, plus CRM: I know you can’t, and I certainly can’t, imagine this malfunction scenario without saying, “I have the aircraft and the radios–you get into the QRH.” That it was 2 F/Os in the seat is part of that dynamic oversight, but even when the captain returned to the cockpit, it doesn’t seem like anyone was taking charge.

      Does the Bus have AOA displayed? Will the GFMS give groundspeed independent of the pitot static system?

  15. ed williams Says:


    While surfing the AMR restructuring website (or was it Grey Eagles?) I came across your post and read it with great interest. As your contemporary at AA, when I taught at GSW on the 727, I would often take some extra time to run a blocked pitot tube scenario. It was “no risk” since the check ride was over and we had time.

    Specifically, the scenario was the Air Florida crash at Washington National airport due to icing of the EPR probe. While some were able to discern and correctly fly the aircraft, all the pilots were able to correctly fly after we went back to basics: pitch and power(N1). (I know there were very different, difficult circumstances that night on AF447 and I appreciate your tactful handling of the issues.)

    One further note: years later, while subsequently flying the line on the MD-80, after the 727 went away, I had a similar problem on climb out from FL250 to FL310. In stable climb, the airspeed indicators started to increase rapidly, which the FO and I both noted. A quick check of the N1 and EPRs showed no discrepancies; however, by now the overspeed warning had alerted and the airspeed was indicating over .85 Mach. In the interest of full disclosure, we were VFR and the sight picture (pitch) was appropriate for that altitude in climb. After we leveled off at FL 310, the airspeed indicator resumed its proper indication and we motored to the west coast for our SEA turnaround. Pretty much a non-event with a write-up back at DFW. I still thank God for the fine instructors in the USAF and AA for instilling the basics!

    I’ve been retired for almost three years now, and sure miss all the great guys and gals at AA. I grieve for all the employees with the BK. Keep up the good work and I always enjoyed all your cartoons. Go Falcons!

  16. Great to see this discussion from a Boeing perspective.

    In relation to the comment: >>Airbus has a side stick rather than a control wheel and to add to the confusion, the stick doesn’t move. It senses pressure, but unlike the control wheel in most jets, it doesn’t mirror inputs on the other side.<<
    Actually, the sidestick DOES move. It is spring loaded to the center, but it does not have any artificial feel in response to the aerodynamic situation.

    The sidestick controller (like the control wheel in the 777 and 787) demands a combination of pitch rate and g-load for pitch, but does not have speed stability (like the two Boeings do). So, as a result the pitch will stay where the pilot puts it, until a speed or AOA limit is approached. The sidestick tells the airplane "what to do" (pitch rate, gload), not "how to do it" (move the elevator):

    Since the sidestick commands a change from the current state, pitch trim is strictly a behind-the-scenes operation. It's job is to try to keep the elevator near neutral to the stabilizer. There is the ability to trim manually, but that is really only used in the third level of the flight control laws: Direct Law – where it essentially becomes a 737.
    In the case of AF447, the low speed limits were inoperative so the nose was able to stay high and the AOA degrade to very high angles with little pilot input.

    Contrary to the statement that "there was no stall warning," actually there was. In fact, the stall warning sounded for more than 50 seconds in a row (that's a loooong time). This occurred after they zoom climbed to FL380 and lost about 100 knots in the process.
    True it does not work when the IAS is below 60 knots (well, you must be on the ground, right?). This only became a factor when the airplane was falling with AOA's greater than 45°, thus putting the pitot and static pressures nearly equal, decaying the IAS, and disabling the AOA vane's input. It's doubtful that this made much difference since the warning was disregarded as a pitch problem (not an engine problem) for so long. However, when the captain returned to the cockpit, the stall warning had just silenced from its 50+ second run. No one can know if he would have been able to give better guidance if he had heard it on for a long time. Afterall, he was more of a round-dial guy. The PF had likely never flown a jet without the flight director on.

    The crew did react to the stall warning—exactly as they were trained to—by applying full power. However, as you know, at FL350 applying full power is about as effective as wishing a stall away.

    Due to the Airbus specific flight control laws, there are several additional lessons for Airbus pilots to grasp in addition to the ones you point out so well. Essentially: "what exactly is the sidestick commanding?"

    So practice hand flying. Turn the flight director off when you do, since it's doing 80% of the mental work for you when it's on. Hand flying with the flight director on is like an artist practicing with paint-by-number.

    As a long-time Airbus instructor, I ended up writing a book about all of theses subjects that I think you'll find quite interesting: Understanding Air France 447.

  17. Hello Bill Palmer. Are you still listening after 18 months? I will read your book soon. Maybe it has answer, maybe not. BUT in 2009 A 330, what instrument readings were still displayed after computer “switched off” the “unreliable” ones? AND how is pilot supposed to test the validity of the ones he wants to follow? in VFR easy, but in night thunderstorm?? The lack of easily identified reliable data is a major contributor to the crash. Chris Manno July-2012 says ground speed and engine thrust are available — but AF447 had to also dodge storm cells — which means that simple flying becomes more complicated.

    • Sure, flying in weather with pitot-static loss is “complicated,” but necessary: fly GS and AOA with power settings. We practice that annually and there’s really no alternative–you have to surmount the challenge, which isn’t that difficult.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: