Air France 447 crashed because frozen pitot tubes confused the autopilot — and the pilots

On June 1, 2009, Air France Flight 447, an Airbus A330 flying from Rio de Janeiro to Paris, crashed into the Atlantic Ocean, killing all 228 people on board. The crash was caused by a combination of frozen pitot tubes (which measure airspeed), autopilot disconnection, and pilot error.

The pitot tubes iced over at cruising altitude, causing inconsistent airspeed readings and disconnecting the autopilot. The pilots, faced with conflicting instrument readings and an unfamiliar manual flight mode, pulled the nose up into a stall — the opposite of the correct recovery. The aircraft stalled for 3.5 minutes before hitting the ocean.

The investigation found that the pilots had not been adequately trained for the scenario of unreliable airspeed at high altitude, and that the Airbus cockpit design did not clearly indicate the stall condition. The case illustrated how automation can create a dependency that leaves pilots unprepared when the automation fails, and how the interface between human and machine is as critical as either one alone.