Air France 447: when automation suddenly stops

It's night. You're cruising at 35,000 feet over the Atlantic. The aircraft is perfectly serviceable, the autopilot is engaged, and it's a routine flight.

Then the airspeed indications become unreliable. The autopilot disconnects. Warnings start.

On 1 June 2009, this is what happened to Air France Flight 447, an Airbus A330 flying from Rio de Janeiro to Paris. In a little over four minutes, the aircraft went from cruise to impact with the ocean. All 228 people on board lost their lives.

There was no structural failure, no explosion and no engine loss. The aircraft could have been flown.

What happened — in brief

The investigation by France's BEA, published in 2012, describes the sequence:

1. While crossing an area of convective weather, the pitot probes were temporarily obstructed by ice crystals, causing inconsistent airspeed indications.
2. The autopilot and autothrust disconnected, and the flight control law changed to alternate law, removing some of the usual protections.
3. The pilot flying made sustained nose-up inputs. The aircraft climbed, lost energy and entered a stall.
4. The stall warning sounded repeatedly, but the situation was not recognised as a stall by the crew. The aircraft remained stalled, descending at a very high rate, until it struck the sea.

The airspeed indications recovered within about a minute. By then, the aircraft was already in a state the crew did not understand.

The lessons

• Startle and surprise can degrade performance dramatically, especially when a calm situation changes suddenly at night.
• Manual flying at high altitude behaves differently from low-level flying; small inputs matter and energy is limited.
• Recognising a stall — and applying the recovery (reduce angle of attack first) — must be trained until it is automatic, including in situations where the aircraft is not "supposed" to stall.
• Crew coordination broke down: who was flying, what each pilot was doing with the controls, and what the shared picture was.
• Unreliable airspeed procedures exist precisely for this situation: fly a known pitch and power, then troubleshoot.

What changed afterwards

The accident accelerated changes across the industry, including:

• Upset Prevention and Recovery Training (UPRT) requirements in pilot licensing and operator training (introduced in the EU from 2019),
• greater emphasis on manual handling and unreliable airspeed scenarios in recurrent training,
• the wider adoption of Evidence-Based Training, with startle and surprise built into scenarios,
• improvements in pitot probe standards for operation in ice-crystal conditions.

The question for the future

We often discuss AI co-pilots, increasing autonomy and single-pilot operations. AF447 leaves an uncomfortable question at the centre of that debate:

If automation handles almost everything, are we still training humans for the moment it suddenly stops?

Check yourself

Further reading

• BEA, Final Report on the accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP, operated by Air France, flight AF 447 Rio de Janeiro – Paris (July 2012).

#AF447#Automation#Upset Recovery#Human Factors#Case Study