When Air France flight 447 disappeared over the Atlantic Ocean on 1 June 2009, with the loss of all on board, there was consternation. Modern passenger aircraft are not supposed to fall out of the sky. It was vital to find out what happened.

Three major searches failed to find the aircraft’s data and cockpit voice recorders, but a fourth search in May 2011 discovered both, at a depth of about 12,000 feet, thus enabling the Bureau d’Enquetes et d’Analyses (BEA), the French air accident investigation body, to start piecing together what had gone wrong.

So far, the BEA has issued three interim reports, with a final report expected in the autumn. But the contents of the interim reports give substantial pointers to the cause of the accident, and raise considerable - if predictable - concerns about the relationship between human beings and highly automated systems.

Fly-by-wire passenger aircraft, such as the Airbus 330, largely fly themselves, with the automatic systems depending on computer analysis of the data fed in by the various sensors. Additionally, the automatics have built-in protections, preventing the pilot from making excessive control inputs that might take the aircraft beyond its designed parameters.

It is hardly surprising that the automatics, which are tireless, reliable and precise, are perceived as the safest method of conducting a flight. Indeed, there is ample reason to prefer the automation of any hazardous process to the alternative of control by a human brain, which evolution has not always equipped to provide an unemotional, rational, or consistent response.

But if automatic systems receive inaccurate data, they turn from being reliable to potentially hazardous. This is what happened on AF477, when the 3 pitot tubes - which sense indicated air speed - appear to have simultaneously iced up. Finding that none of the readings agreed with each other, the automatic pilot cut out and handed control back to the crew.

Situational awareness

There is debate all over the professional forums about what the pilots should have done next and why they didn’t do it. But, in a nutshell, the pilot flying appears to have lost situational awareness, put the aircraft into a steep climb and stalled it. This was possible because the automatic protections had been lost when control was handed to the pilots. Thereafter, none of the crew seemed to have recognised what was happening and, rather than drop the nose and attempt to regain flying speed, persisted in pulling the aircraft’s nose up even though they were losing 10,000 feet per minute.

And here we have the implicit risks hidden in automation. If the automatics fail, it is up to the human operator to resolve the potential emergency. But if the human lacks direct experience of the system (because the automatics have always done the job), they have less to rely on. And since there is evidence that much decision-making derives directly from the recognition of similarities between current events and past experience, his decision-making capacity may be impaired.

A sufficient back-up plan?

How do you train humans rigorously enough to make the right decisions when automation fails, without incurring the costs (and risks) of disabling the automatics in order to gain hands-on experience? A common answer is to use standard operating procedures and checklists. The aircraft industry uses both, plus simulator training. But these may not cover a particular emergency, or, as may have happened in AF447, the standard operating procedure for one situation may not be the correct solution for what occurs.

And in the difficult and confusing environment of a cockpit ringing with aural warnings, in darkness, possibly in turbulence - the chances of standard procedures and checklists being an adequate substitute for decades of hands-on experience are limited.