Full text

1. Introduction: final authority on paper

United States federal aviation regulations state the principle in a single sentence: "The pilot in command of an aircraft is directly responsible for, and is the final authority as to, the operation of that aircraft" (14 CFR §91.3(a)). Equivalent rules exist across the world's aviation systems. They reflect a hard-won conviction that, whatever the sophistication of the machine, a human being must have the last word over a vehicle carrying hundreds of people.

The conviction is right. The question this paper asks is what it takes to make it true. Authority is a relation between a person and the thing they control. A pilot can be formally the final authority and still lack what that authority needs in practice, and the cases below show how that happens.

The paper proceeds in six steps. Section 2 sets out the safety record, which is the necessary context for any criticism of automation: it has saved many lives. Section 3 introduces the theoretical tools. Sections 4 and 5 examine Air France 447 and the Boeing 737 MAX accidents in detail, using the official reports. Section 6 adds three comparison cases. Sections 7 and 8 draw the ethical lessons and translate them into policy.

The five accidents were chosen against two tests. Each had to sit on the boundary between crew and automation, so that the question of who was controlling the aircraft at the decisive moment is central to the investigators' account. And each had to be documented by an official investigation in a public, dated report. Air France 447 and Lion Air 610 meet both tests most fully and get the most space. Ethiopian 302 is treated through the NTSB's 2019 safety recommendation report, which addresses the assumptions common to both 737 MAX accidents, and the paper does not draw on the Ethiopian authorities' own final report. Emirates 521 was added for two reasons. It is a Boeing aircraft in which automation behaved exactly as designed, which keeps the argument from turning into a case against one manufacturer or one malfunction. It was also investigated by the UAE's own General Civil Aviation Authority. Qantas 72 is the control case. Nobody died, and it is the only one of the five in which the crew recovered the aircraft. The selection is skewed in one obvious way. Accident reports are written when things go wrong, so the sample contains no flight on which automation silently prevented an accident, and the paper cannot weigh the many such flights against the few examined here. Section 2's fleet-wide data are there to correct that imbalance. The three conditions set out in section 3.4 were refined while reading these reports, and they should be read as a framework drawn from the cases. Whether they hold for accidents outside this set is a question the paper leaves open.

2. The safety record: a system that works, and where it still fails

Any argument about cockpit automation must start from the fact that flying has become extraordinarily safe. Boeing's annual statistical summary, which covers the worldwide commercial jet fleet, reports that since 1959 there have been 998 million departures, with 33.1 million departures and 78.3 million flight hours in 2025 alone (Boeing 2026, p.9). Comparing the decade 2016–2025 with 2006–2015, the accident rate fell by 35 per cent, the hull-loss rate by 58 per cent and the fatal accident rate by 60 per cent, while departures increased by 22 per cent (p.7).

Table 1. Worldwide commercial jet fleet: change between the last two decades (2016–2025 compared with 2006–2015)

Source: Boeing, Statistical Summary of Commercial Jet Airplane Accidents, Worldwide Operations 1959–2025, 57th edition (April 2026), p.7.

Automation is one of several reasons for this improvement, alongside better training, crew resource management, terrain awareness systems and data-driven safety management. It would be perverse to read the accidents examined below as a case against automation as such. They are a case about how authority is shared between people and machines.

That case becomes clearer when the remaining risk is broken down. In the decade 2016–2025 there were 31 fatal accidents in the worldwide commercial jet fleet, causing 1,115 onboard fatalities and 66 external fatalities (Boeing 2026, p.14). Loss of control in flight (LOC-I) caused 428 of the onboard deaths, more than any other category and more than the next two categories combined (bird strike, 179, and non-powerplant system failure, 160).

Table 2. Fatalities by accident category, worldwide commercial jet fleet, 2016–2025

Source: Boeing (2026), p.14 (values read from the published chart; totals match Boeing's stated totals of 1,115 onboard, 66 external and 31 fatal accidents). Boeing notes that EgyptAir 804 (2016) was recategorised from UNK to F-NI and is now included. Categories follow the CAST/ICAO Common Taxonomy Team definitions.

The phase-of-flight data add a second pattern. Cruise accounts for 57 per cent of the time in a typical 1.5-hour flight but only 10 per cent of fatal accidents; landing accounts for 1 per cent of flight time and 35 per cent of fatal accidents. The climb phase after flap retraction produced 347 onboard fatalities, more than any other phase (Boeing 2026, p.15).

The record therefore says two things at once. The system is far safer than it was. And the accidents that still kill the most people are disproportionately those in which control of the aircraft itself is lost, the very domain in which the division of authority between pilot and automation is decided.

3. Theoretical tools: ironies, misuse and crumple zones

3.1 Bainbridge's ironies

In 1983 the psychologist Lisanne Bainbridge published a short paper that has become the founding text of the field. Its central observation was paradoxical: "the more advanced a control system is, so the more crucial may be the contribution of the human operator" (Bainbridge 1983, p.775). Automation takes over the routine tasks, leaving the human with the rare, difficult and unanticipated ones, precisely the tasks for which a human who no longer performs the routine is least prepared. Bainbridge identified a second irony in monitoring: "the automatic control system has been put in because it can do the job better than the operator, but yet the operator is being asked to monitor that it is working effectively" (p.776).

Both ironies bear directly on authority. A pilot whose role is to monitor a system that flies better than they do is a supervisor without practice, and final authority in an emergency falls to that supervisor.

3.2 Use, misuse, disuse and abuse

Raja Parasuraman and Victor Riley's 1997 review distinguished four relations between humans and automation. Use is 'the voluntary activation or disengagement of automation by human operators'. Misuse is 'overreliance on automation, which can result in failures of monitoring or decision biases'. Disuse is defined thus: 'Disuse, or the neglect or underutilization of automation, is commonly caused by alarms that activate falsely.' Abuse is 'the automation of functions by designers and implementation by managers without due regard for the consequences for human performance' (Parasuraman and Riley 1997, p.230). The fourth category is the one most often forgotten and the most important for this paper. Abuse is a failure of the people who decide what the machine will do. The operators inherit its consequences.

3.3 The moral crumple zone

Madeleine Clare Elish introduced the term "moral crumple zone" to describe how responsibility for a failure in a complex system is often attributed to the human operator with the least control over it. "Just as the crumple zone in a car is designed to absorb the force of impact in a crash," she writes, "the moral crumple zone protects the integrity of the technological system, at the expense of the nearest human operator" (Elish 2019, p.41). Elish uses Air France 447 as one of her examples. The concept warns against a familiar reflex in accident aftermaths: to treat "pilot error" as the explanation, when the pilot's error was the last link in a chain that designers, certifiers and trainers forged.

3.4 From these tools to a theory of authority

Together these ideas suggest a test for when final authority is real. Authority over an aircraft requires three things. The pilot must be able to know what the automation is doing and why. The pilot must be able to take control in a state from which recovery is possible. And the pilot must have the competence to fly the aircraft when the automation cannot. Each condition corresponds to one of the failures documented in the cases below.

4. Air France 447: authority handed back in the dark

On 1 June 2009 Air France flight 447, an Airbus A330-203 registered F-GZCP, was flying from Rio de Janeiro to Paris at night over the Atlantic with 228 people on board: 216 passengers and 12 crew. The captain had left the cockpit for his rest period shortly after 02:00 UTC, leaving the two co-pilots at the controls. At 02:10:05 the autopilot and then the autothrust disconnected, likely following the obstruction of the pitot probes by ice crystals, which made the measured airspeeds inconsistent. The pilot flying said "I have the controls" (BEA 2012).

What followed lasted four minutes and twenty-three seconds. The speed shown on the left primary flight display fell abruptly from about 275 knots to 60 knots and the left-side speed indication was invalid for 29 seconds. At 02:10:16 the pilot not flying said "we've lost the speeds". The flight control laws reverted from normal to alternate law, in which some of the aircraft's protections no longer applied. The aircraft climbed to about 38,000 feet. At 02:10:51 the stall warning sounded continuously, the thrust levers were placed in the take-off/go-around detent and the trimmable horizontal stabiliser moved from 3 to 13 degrees nose-up, where it remained for the rest of the flight. The captain re-entered the cockpit at around 02:11:42. In the seconds that followed, all recorded speeds became invalid and the stall warning stopped, after having sounded continuously for 54 seconds; the angle of attack then exceeded 40 degrees and the aircraft was descending at about 10,000 feet per minute (BEA 2012, §1.1). At 02:12:02 a co-pilot said "I have no more displays". The recording ended at 02:14:28 with a vertical speed of −10,912 feet per minute and a pitch attitude of 16.2 degrees nose-up (BEA 2012).

Table 3. Air France 447: key events in the final minutes (times UTC, 1 June 2009)

Source: BEA, Final Report on the accident on 1 June 2009 to the Airbus A330-203 registered F-GZCP (July 2012), synopsis and section 1.1.

The wreckage was located nearly two years later, on 2 April 2011, at a depth of 3,900 metres. The BEA's final report made 41 safety recommendations (BEA 2012, synopsis, p.17).

The report is notable for what it says about the pilots' understanding. The crew, the BEA concluded, "likely never understood that it was faced with a 'simple' loss of three sources of airspeed information" (p.199). It is equally notable for what it says about training: "Current training practices do not fill the gap left by the non-existence of manual flying at high altitude", and they "limit the pilots' abilities to acquire or maintain basic airmanship skills" (p.185). Among the causes it lists "the absence of any training, at high altitude, in manual aeroplane handling" (p.201).

Two findings matter most for the question of authority. The first is that the automation handed authority back at the worst possible moment. It disconnected because its inputs had become unreliable, which is a sound design principle, and returned control to two pilots who had to diagnose an ambiguous failure at night, in turbulence, at high altitude, in a flight control law they rarely experienced, with a speed indication that made no sense. Authority returned to the humans in a degraded state of information and with the aircraft already moving towards a regime they had not been trained to handle by hand.

The second finding concerns the stall warning, which sounded repeatedly and was not acted upon. The BEA observes that recognising the warning "supposes that the crew accords a minimum level of 'legitimacy' to it" (p.200), and that the safety model behind the design had failed "in 'common failure mode'": the same underlying problem, unreliable air data, was degrading both the crew's picture and the credibility of the warnings meant to correct it. This is a remarkable sentence for an accident report. It says, in effect, that a warning has authority only if the people receiving it have reason to trust it, and that this trust can be eroded by the same failure the warning is meant to address.

Air France 447 shows the first failure of authority: the handback of control in an unrecoverable or barely recoverable state. The pilots held final authority from 02:10:05. Whether they ever had the means to exercise it, in the sense defined in section 3.4, is the question the BEA's findings on training and comprehension answer in the negative.

5. The Boeing 737 MAX: authority the pilots did not know existed

5.1 Lion Air 610

On 29 October 2018 Lion Air flight 610, a Boeing 737 MAX 8 registered PK-LQP, departed Jakarta and crashed into the Java Sea about eleven minutes after take-off (airborne 23:20:40 UTC; recording ended 23:31:54 UTC), killing all 189 people on board (8 crew and 181 passengers). The accident sequence began with a replacement angle-of-attack sensor on the left side that had a bias of about 21 degrees (KNKT 2019). That erroneous input activated the Manoeuvring Characteristics Augmentation System (MCAS), a function designed to command nose-down stabiliser trim in certain flight conditions. MCAS relied on a single angle-of-attack sensor. The "AOA DISAGREE" alert, which would have told the crew that the two sensors disagreed, was not available on the aircraft (KNKT 2019).

The pilots fought the system for more than six minutes. Compiling the activations from the flight recorder narrative in the KNKT report gives 25 automatic nose-down trim commands attributed to MCAS between 23:25:27 and 23:31:53 UTC, ranging from about one to eight seconds each. The narrative also records an 8-second automatic nose-down (AND) trim at 23:31:00 that it does not attribute to MCAS, and automatic AND trim from 23:22:33, before the flaps were fully retracted for the last time. Each time, the crew trimmed back nose-up; each time, MCAS reactivated. In the final activations the first officer, who was then flying, applied column forces recorded at 65, 82 and 93 pounds. The rate of descent exceeded 10,000 feet per minute shortly before the recording ended at 23:31:54 (KNKT 2019).

Table 4. Lion Air 610: MCAS activations compiled from the KNKT final report (times UTC, 28 October 2018)

Source: KNKT, Final Report KNKT.18.10.33.04 (October 2019), section 1.1. The local date was 29 October 2018. Compilation by EPIC; durations as stated or derived from the report's narrative.

The KNKT's list of contributing factors begins with design and certification. The first states that during the design and certification of the 737 MAX, "assumptions were made about flight crew response to malfunctions which, even though consistent with current industry guidelines, turned out to be incorrect" (KNKT 2019, p.215).

5.2 Ethiopian Airlines 302 and the grounding

On 10 March 2019 Ethiopian Airlines flight 302, another 737 MAX 8, crashed shortly after departing Addis Ababa, killing all 157 people on board. The flight data recorder showed the left angle-of-attack sensor reading about 59 degrees higher than the right, which activated MCAS; as on the Lion Air flights, the same erroneous input also triggered the stick shaker and airspeed and altitude disagreement alerts, and the Ethiopian crew also received a master caution (NTSB 2019, p.7). The Federal Aviation Administration grounded the type on 13 March 2019. The grounding lasted more than twenty months, until the FAA rescinded its order on 18 November 2020 after design changes to MCAS and new training requirements (Federal Register 2020).

5.3 The assumptions behind the design

In September 2019 the US National Transportation Safety Board issued a safety recommendation report on exactly the question the KNKT raised. It examined the assumptions Boeing had used in its safety assessment of MCAS, which included the expectation that pilots would recognise an uncommanded stabiliser movement and take immediate corrective action. The NTSB concluded that these assumptions "did not adequately consider and account for the impact that multiple flight deck alerts and indications could have on pilots' responses" (NTSB 2019, p.8). On both accident flights the MCAS activation came with a cascade of other alerts that demanded attention at the same time.

The US House Committee on Transportation and Infrastructure went further in its final report of September 2020. "The MAX crashes were not the result of a singular failure, technical mistake, or mismanaged event," it wrote. "They were the horrific culmination of a series of faulty technical assumptions by Boeing's engineers, a lack of transparency on the part of Boeing's management, and grossly insufficient oversight by the FAA" (House Committee on Transportation and Infrastructure 2020, p.6). The report documented that "Federal guidelines assume pilots will respond to this condition within four seconds", and that in a 2012 simulator test a Boeing test pilot took more than ten seconds to respond to uncommanded MCAS activation, an outcome the test pilot described as "catastrophic" (pp.13–14). It described a "culture of concealment" (p.13) and documented commercial pressure to avoid simulator training: Boeing's contract with Southwest Airlines, for an order of 200 aircraft, committed Boeing to pay US$1 million per aircraft if the 737 MAX required simulator training for pilots already qualified on the previous generation (House Committee 2020).

Table 5. The 737 MAX accidents and their aftermath: key documented facts

5.4 What kind of authority MCAS exercised

Air France 447 was a failure of handback. The 737 MAX was its mirror image: an exercise of authority by the automation that the pilots did not know they were sharing. The House Committee documented that, hours after the approval of a redesign that increased MCAS's authority to move the stabiliser at low speed, Boeing sought and the FAA approved the removal of references to MCAS from the Flight Crew Operations Manual. "As a result," the Committee found, "737 MAX pilots were precluded from knowing of the existence of MCAS and its potential effect on aircraft handling without pilot command" (House Committee 2020, p.20). On JT610 it repeatedly took control of the pitch trim, a primary means of controlling the aircraft, on the strength of a single faulty sensor, and the crew had no alert telling them the sensors disagreed.

In terms of the conditions in section 3.4, this was a failure of knowledge. The pilot in command remained the final authority under the law. But final authority over a system presupposes knowing which other agents are acting on it. A pilot cannot overrule what they do not know is there. They can only struggle against its effects, which is exactly what the Lion Air crew did, 25 times.

It was also a case of what Parasuraman and Riley called abuse. The decisions that mattered most (to rely on one sensor, to leave the function out of the manual, to assume a four-second response, to avoid simulator training) were taken by designers, managers and certifiers, far from the cockpit. The crew in Elish's moral crumple zone was the crew least able to change any of them.

5.5 Authority by redesign

One detail in the House Committee's account deserves separate attention because it concerns authority in the most literal sense. MCAS was originally conceived as a function with limited ability to move the stabiliser. During development it was redesigned to give it greater authority to do so at low speed, in order to meet certification requirements for stall characteristics (House Committee 2020, p.20). The word "authority" is used here in its engineering sense, meaning the range of control a function is permitted to exercise. But the engineering sense and the moral sense converge. A design change that enlarged the authority of an automated function over a primary control surface was made at roughly the same time as its description was removed from the pilots' manual. The authority of the machine grew; the pilots' knowledge of it shrank.

This is the clearest illustration in the record of why final authority cannot be secured by regulation alone. The rule that the pilot in command is the final authority did not change. What changed was the distribution of real control in the aircraft and the information available to the person nominally in charge of it. Any system of certification that tracks the first without the second will keep producing pilots who are final authorities in law and spectators in fact.

The episode also shows how the question of authority is settled in documents long before it is tested in the air. The decisive acts were a design change, a safety classification, an assumption about response time and an approval to edit a manual. None of these was taken by a pilot. Each of them determined what the pilots of Lion Air 610 and Ethiopian 302 would be able to know and do.

6. Three further cases

6.1 Qantas 72: automation errs, pilots recover

On 7 October 2008 Qantas flight 72, an Airbus A330-303 registered VH-QPA, was cruising at 37,000 feet from Singapore to Perth when one of its three air data inertial reference units began producing intermittent incorrect values. Two minutes later, in response to spikes in angle-of-attack data, the flight control computers commanded the aircraft to pitch down. At least 110 of the 303 passengers and nine of the 12 crew were injured, 12 occupants seriously. The ATSB found that the computers' algorithm, generally very effective, could not manage multiple spikes 1.2 seconds apart, and that this was the only known case in which the limitation led to a pitch-down command in more than 28 million flight hours on A330 and A340 aircraft (ATSB 2011, p.vii). The crew regained control and diverted to Learmonth.

Qantas 72 is the counterpart to the 737 MAX. Automation exercised authority wrongly, and the pilots, who understood that the aircraft was doing something they had not commanded, were able to recover. Authority was contested and the human side prevailed. The case illustrates the condition of knowledge from the other direction: the crew could see that the automation was acting, and could therefore act against it.

6.2 Emirates 521: reliance on automation at the runway

On 3 August 2016 Emirates flight 521, a Boeing 777-300 registered A6-EMW with 300 people on board, attempted a go-around at Dubai International Airport after the commander was unable to land within the touchdown zone. The aircraft had touched down for six seconds. As designed, the touchdown inhibited the take-off/go-around switches, which therefore had no effect on the autothrottle; the crew were not aware of the touchdown. The aircraft climbed to 85 feet with both thrust levers still at idle, sank, and struck the runway 18 seconds after the go-around began (GCAA 2020, p.ix). Apart from the commander and the senior cabin crew member, who left after the explosion, all occupants evacuated through the usable slides in about 6 minutes 40 seconds; four cabin crew were seriously injured. About 9 minutes 40 seconds after the aircraft came to rest the centre wing tank exploded, and a falling section of wing skin fatally injured a firefighter (GCAA 2020, p.ix).

The UAE General Civil Aviation Authority listed among the contributing factors "the flight crew reliance on automation and lack of training in flying go-arounds from close to the runway surface and with the TO/GA switches inhibited", which "significantly affected the flight crew performance in a critical flight situation which was different to that experienced by them during their simulated training" (GCAA 2020, p.135).

EK521 is a precise example of the knowledge condition at a small scale. A design logic that was sensible in itself (inhibit the go-around switches once the aircraft is on the ground) produced a state the crew did not perceive, in a manoeuvre their training had not prepared them to fly from that position. The pilots believed they had commanded thrust. The automation, following its own rules, had not delivered it.

6.3 Comparing the cases

Table 6. Five investigations compared through the three conditions of real authority

Sources: ATSB (2011); BEA (2012); GCAA (2020); KNKT (2019); NTSB (2019). Assessments in the three condition columns are EPIC's summary of the investigators' findings.

7. The ethics of shared control

7.1 Three failures of authority

The cases reveal three distinct ways in which final authority can be formally intact and practically empty.

Hidden authority. The automation acts on the aircraft in ways the pilot does not know about (the 737 MAX) or in a state the pilot does not perceive (EK521). The pilot cannot exercise authority over an agent they cannot see. The ethical failure lies with whoever decided what the pilot would be told.

Handback without means. The automation withdraws and returns authority to the pilot at the moment it is hardest to exercise, without the information or the margin needed to recover (AF447). Withdrawal when inputs become unreliable is often the right engineering choice. The ethical question is whether the system, the training and the procedures have prepared the human for what they will receive.

Erosion of competence. The pilot's ability to fly the aircraft by hand in the situations that matter decays because the automation flies it the rest of the time. The BEA's findings on high-altitude manual flying (2012, pp.185, 201) and the GCAA's on near-runway go-arounds (2020, p.135) document this. The FAA's 2013 report on flight path management systems made the same point across the industry. It found that pilots "sometimes rely too much on automated systems and may be reluctant to intervene", that "autoflight mode confusion errors continue to occur", and that manual flying skills were a vulnerability (FAA PARC/CAST Flight Deck Automation Working Group 2013).

7.2 Authority requires a matching capability

The philosophical point underneath these failures is simple and frequently forgotten. Authority and responsibility are paired with capability. It is unjust to hold someone responsible for an outcome they had no means to influence, and it is empty to grant someone authority they have no means to exercise. The regulation that names the pilot in command the "final authority as to the operation of that aircraft" (14 CFR §91.3(a)) is a commitment by the whole system, manufacturers, certifiers, operators and trainers included, to give the pilot what that authority requires. When the commitment is not honoured, the formal allocation of authority becomes the mechanism by which blame is moved to the cockpit. That is Elish's moral crumple zone in its regulatory form.

7.3 The case for machine authority

The most serious challenge to this paper comes from the design tradition that gave the automation more authority than the pilot over part of the flight envelope, and it deserves to be put at full strength.

On Airbus fly-by-wire aircraft, the computers in normal law do not simply advise. The BEA describes normal law on the A330 as offering "complete protection of the flight envelope", limiting pitch and bank, load factor, speed and angle of attack (BEA 2012, p.38). Its account of the stall protection is blunt: "When this protection works, the aeroplane can not stall even if the crew maintains a nose-up control input to the stop" (p.43). The pilot keeps the sidestick and the computer keeps the boundary. Airbus presents the protections as minimising the risk of over-controlling, losing control or overstressing the aircraft (Airbus 2023a), and since 2020 it has extended protections and alerts into alternate law, where they used to disappear (Airbus 2023b).

The argument for this philosophy draws strength from the accident record, including this paper's own cases. Air France 447 was lost after the protections had dropped away. The aircraft was in alternate law, the high angle-of-attack protection was gone, and the aircraft stalled and never recovered. In the BEA's words, "The PF was still applying nose-up inputs and the angle of attack continued to increase" (BEA 2012, §2.1.3.2, p.179). Had normal law still been available, the BEA's own description of the protection implies that the same inputs could not have stalled it. Loss of control in flight remains the largest single cause of onboard deaths in the worldwide jet fleet (section 2, Table 2). On this view, the lesson of AF447 is that the machine let go too early, and that a better design would have kept it in charge for longer. The human factors literature has its own reasons for caution about pilots. One study of operations on the A320 takes "automation surprises" as its title (Sarter and Woods 1997). A critic in this tradition would say that the conditions of section 3.4 all ask more of the human, when the record suggests the human is the part that fails under surprise.

This is a strong case, and parts of it should be accepted. Within the range where its data are good, a hard limit is better than a startled pilot. Nobody gains from a final authority that includes the freedom to stall a serviceable aircraft by mistake, and the law does not require one. Section 91.3 makes the pilot in command the final authority "as to the operation" of the aircraft. That is authority over the flight, and it does not entitle the pilot to every surface position at every moment. A pilot who flies inside a protected envelope still holds it.

The case for machine authority fails at its foundation, which is the data. The protections act on what the sensors say, and when the sensors are wrong the hard limit becomes a hard error. Qantas 72 shows it. The pitch-downs that injured more than a hundred people were commanded by the A330's own protection logic, responding to false angle-of-attack spikes. The ATSB found that the elevator movement recorded on the first pitch-down came from the high angle-of-attack protection and the anti pitch-up compensation together. For about 1.8 seconds, while the false value stayed above the trigger threshold, "the flight crew's sidestick inputs would have had no influence on the aircraft's pitch" (ATSB 2011, p.80). That was a protection, designed in good faith, overruling the pilots on the strength of a faulty input. Structurally, it is the same failure as MCAS on Lion Air 610. The difference is that on Qantas 72 the authority was brief and the crew knew the aircraft was doing something they had not commanded.

The design tradition knows this, which is why its protections are built to withdraw. The ATSB explains that the A330's flight control system reverted to a lower control law when faults meant "it could not provide flight envelope protections with the appropriate level of reliability" (ATSB 2011, p.69). That is a sound principle, and it is precisely the handback this paper describes in section 4. Hard protection leaves the moment at which authority returns to the pilot in place, and moves it to the situations where the machine has already decided its own picture of the world cannot be trusted. Those situations usually come at altitude or at night, with conflicting indications and in a control law the crew rarely flies. Air France 447 is the result. The more completely the machine guards the envelope in normal operation, the less practice the crew has at guarding it themselves. The BEA found exactly that in Air France's training. The two co-pilots had met the stall mainly in exercises at low altitude, "with particular attention on the operation of the aircraft's protections in normal law" (BEA 2012, p.185). The report also notes that the manufacturer's training manual stated that the existence of protections made unusual-attitude recovery training superfluous (p.153).

The paper's reply, then, is a qualification of its conditions. Machine authority over part of the envelope is legitimate, and often better than human authority, while the inputs it acts on are valid. Its legitimacy ends where its data become doubtful, and the design question that matters is what happens next. Two things decide it: whether the crew can tell which mode of authority they are in, and whether the state the aircraft is handed back in leaves room to recover. Airbus's recent work on keeping protections and backup speed information alive in degraded modes is the right direction precisely because it addresses the moment of handback. That work leaves the pilot's final authority intact while accepting that the pilot will always inherit the cases the machine could not resolve, and tries to make them easier to inherit.

7.4 Assumptions as moral commitments

The most important lesson of the 737 MAX may be about assumptions. Every certified aircraft embeds assumptions about how pilots will respond to failures: how quickly, with what information, under what workload. The KNKT and NTSB findings show that these assumptions are not neutral engineering parameters. They are commitments about what human beings will be able to do, made on their behalf, often years before they meet the situation. An assumption that a pilot will respond correctly within four seconds to an uncommanded trim movement amid multiple warnings is a decision to allocate risk to that pilot. It should be tested with the seriousness that such an allocation deserves.

7.5 Authority as a design variable

A useful way to state the argument of this paper is that authority in the cockpit is a design variable, set by engineers, certifiers and trainers, and only exercised by pilots. The cases show four places where it is set.

The first is the interface: what the crew is told about the state of the aircraft and of its automation. The absence of the AOA DISAGREE alert on PK-LQP and the crew's unawareness of the TO/GA inhibition on A6-EMW are interface decisions.

The second is the logic of engagement and disengagement: when automation acts, when it withdraws and in what state it leaves the aircraft. AF447's disconnection and MCAS's repeated reactivation are both properties of that logic.

The third is the certification record: the assumptions about human response that a design is allowed to rely on. The KNKT's first contributing factor and the NTSB's report locate the 737 MAX accidents here.

The fourth is training: whether the people who will hold final authority have practised exercising it in the situations where it will be handed to them. The BEA and the GCAA locate part of the AF447 and EK521 accidents here.

At each of these points, a decision about the machine is also a decision about the human. Treating them that way, and documenting them as allocations of authority, would change how they are made.

8. Policy recommendations

8.1 Certify human response. Regulators should require that assumptions about pilot response used in safety assessments be validated with representative line pilots in realistic conditions, including multiple simultaneous alerts and the surprise of an unannounced failure. The NTSB's 2019 recommendations point in this direction. The validation data should form part of the certification record. Training requirements belong in the same independent process. The Southwest contract clause documented by the House Committee shows how commercial terms can bear on whether pilots receive the training a design requires, and contracts that create financial penalties tied to training determinations deserve regulatory scrutiny.

8.2 No hidden authority. A pilot must always be able to know which agents are acting on the aircraft. Any automated function capable of moving a primary flight control surface or changing thrust should be described in crew documentation and covered in training, with a clear indication to the crew when it is acting and a simple, trained means of overriding or disabling it.

8.3 Design handback for recoverability. Where automation disconnects because its inputs are unreliable, the design and the procedures should aim to return the aircraft in a state from which an average crew can recover, with the minimum of ambiguity about what has failed. The BEA's observation about the legitimacy of warnings (2012, p.200) suggests that alerts should be designed and trained so that crews have reason to trust them even when other indications are in conflict.

8.4 Train the authority the regulation grants. The BEA and GCAA findings document a need for recurrent training in the regimes where authority is most likely to be handed back. It should include manual flying in those regimes: high-altitude handling, upset recovery, go-arounds close to the ground with automation in unusual states and responses to unreliable airspeed.

8.5 Investigate the whole system. Accident investigation in aviation is already among the most rigorous in any industry, and the reports cited here show it at its best. Public and media discussion should follow their lead. The phrase "pilot error" should be treated as the start of an explanation.

8.6 Implications for the UAE. The UAE is home to major international carriers and hub airports that operate large fleets of highly automated wide-body aircraft. Its General Civil Aviation Authority produced, in the EK521 report, one of the clearest official statements of how reliance on automation interacts with training gaps. The UAE is therefore well placed to lead on two of the measures above: international work, through ICAO, on validating pilot-response assumptions in certification, and the integration of automation-boundary scenarios into recurrent training standards. A national aviation system that combines large fleets of the most automated aircraft with an investigative authority prepared to name reliance on automation as a contributing factor has both the data and the standing to shape the standard.

9. Conclusion

The rule that the pilot in command is the final authority over the aircraft is one of the oldest and best principles in aviation. The documented record of the past two decades shows that it is also one of the easiest to hollow out. On Air France 447 authority came back to the crew in a state they could not understand. On Lion Air 610 and Ethiopian 302 authority was exercised by a function the crews had not been told about, on the basis of assumptions about their response that the investigators found to be wrong. On Emirates 521 a sensible design logic produced a thrust state the crew did not perceive, in a manoeuvre their training had not covered. On Qantas 72 the crew knew the aircraft was doing something they had not commanded, and they recovered it.

Each of the three conditions set out in section 3.4 depends on decisions made long before the flight, by people who will never sit in the cockpit. The regulation names one person as the final authority, and whether that designation holds in practice is settled by the designers, certifiers, operators and trainers who set the conditions for it.

References

ATSB (Australian Transport Safety Bureau) (2011) In-flight upset, 154 km west of Learmonth, WA, 7 October 2008, VH-QPA, Airbus A330-303. Aviation Occurrence Investigation AO-2008-070, Final, December 2011. Canberra: ATSB. Originally available at: https://www.atsb.gov.au/sites/default/files/investigation-reports/ao2008070.pdf (retrieved via the Internet Archive).

Bainbridge, L. (1983) 'Ironies of automation', Automatica, 19(6), pp.775–779.

BEA (Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile) (2012) Final Report on the accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France, flight AF 447 Rio de Janeiro – Paris. Le Bourget: BEA, July 2012. Available at: https://bea.aero/fileadmin/documents/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf

Boeing (2026) Statistical Summary of Commercial Jet Airplane Accidents, Worldwide Operations 1959–2025. 57th edition, April 2026. Seattle: The Boeing Company. Available at: https://www.boeing.com/content/dam/boeing/v2/safety/statsum.pdf (retrieved 20 October 2026).

Elish, M.C. (2019) 'Moral Crumple Zones: Cautionary Tales in Human-Robot Interaction', Engaging Science, Technology, and Society, 5, pp.40–60. doi:10.17351/ests2019.260

FAA PARC/CAST Flight Deck Automation Working Group (2013) Operational Use of Flight Path Management Systems. Final report, 8 September 2013. Washington, DC: Federal Aviation Administration.

Federal Register (2020) 'Airworthiness Directives; The Boeing Company Airplanes' (Boeing 737-8 and 737-9 MAX), FR Doc. 2020-25864, published 20 November 2020, accompanying the FAA's rescission on 18 November 2020 of its emergency order of 13 March 2019.

GCAA (General Civil Aviation Authority, United Arab Emirates) (2020) Air Accident Investigation Final Report: Runway Impact During Attempted Go-Around, Dubai International Airport, 3 August 2016, Boeing 777-31H, A6-EMW. Final Report AIFN/0008/2016, issued 20 January 2020. Available via ICAO at: https://www.icao.int/sites/default/files/safety/airnavigation/AIG/Documents/Safety-Recommendations-to-ICAO/Final-Reports/UAE_B777_A6-EMW_3Aug2016.pdf

House Committee on Transportation and Infrastructure (2020) Final Committee Report: The Design, Development & Certification of the Boeing 737 MAX. Majority staff report, September 2020. Washington, DC: US House of Representatives. Available at: https://democrats-transportation.house.gov/imo/media/doc/2020.09.15%20FINAL%20737%20MAX%20Report%20for%20Public%20Release.pdf

KNKT (Komite Nasional Keselamatan Transportasi) (2019) Aircraft Accident Investigation Report: PT. Lion Mentari Airlines, Boeing 737-8 (MAX), PK-LQP, Tanjung Karawang, West Java, Republic of Indonesia, 29 October 2018. Final Report KNKT.18.10.33.04, October 2019. Jakarta: KNKT. Available at: https://knkt.go.id/Repo/Files/Laporan/Penerbangan/2018/KNKT.18.10.33.04-Final-Report.pdf

NTSB (National Transportation Safety Board) (2019) Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance. Safety Recommendation Report ASR-19-01, 19 September 2019. Washington, DC: NTSB. Available at: https://www.ntsb.gov/investigations/AccidentReports/Reports/ASR1901.pdf

Parasuraman, R. and Riley, V. (1997) 'Humans and Automation: Use, Misuse, Disuse, Abuse', Human Factors, 39(2), pp.230–253. doi:10.1518/001872097778543886

United States (2026) Code of Federal Regulations, Title 14, §91.3, 'Responsibility and authority of the pilot in command'. Electronic Code of Federal Regulations. Available at: https://www.ecfr.gov/current/title-14/chapter-I/subchapter-F/part-91/subpart-A/section-91.3