FRANCE: Lessons From AirAsia 8501

Aircraft accident investigations serve an important purpose: to learn what happened, so we can learn from what happened.

The final Aircraft Accident Investigation Report has been released for AirAsia 8501—the Airbus A320 that crashed December 28, 2014, killing all 155 passengers and 7 crew aboard. The primary investigative body, the KNKT, or Komite Nasional Keselamatan Transportasi (the Indonesian version of the US’s NTSB), listed several causal factors and recommendations.

In this article, A330 Captain Bill Palmer, author of “Understanding Air France 447,” and I (an A320 Captain) shall attempt to dissect some of these important safety lessons.

Note: it is not the intent of this article to point fingers, place blame, nor critique the findings of the QZ 8501 accident; rather, it is to review several important issues raised, and to learn from them. Further, while many issues such as maintenance practices were addressed in the report as well, we will only address those points relevant to pilots.

“On 28 December 2014 an Airbus A320-216 aircraft registered as PK-AXC was cruising at 32,000 feet on a flight from Juanda Airport, Surabaya, Indonesia to Changi Airport, Singapore with total occupants of 162 persons. The Pilot in Command (PIC) acted as Pilot Monitoring (PM) and the Second in Command (SIC) acted as Pilot Flying (PF).

“The Flight Data Recorder (FDR) recorded that 4 master cautions activated following the failure of the Rudder Travel Limiter….The crew performed the ECAM procedure (computer resets) on the first three master caution activations. After the 4th master caution, the FDR recorded…the FAC CBs (circuit breakers) were pulled (presumably by the pilot—Ed.).

This pilot action resulted (in)… AUTO FLT FAC 1+2 FAULT.
“Following two FAC fault, the autopilot and auto-thrust disengaged and the flight control reverted to Alternate Law…

“Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted in the aircraft departing from the normal flight envelope and entering prolonged stall condition that was beyond the capability of the flight crew to recover.”

—The Pilot in Command (PIC), is commonly referred to as the Captain or “pilot;” the Second in Command (SIC) is commonly referred to as the First Officer (FO) “co-pilot.” In an airliner, both are fully qualified pilots and can fly the plane, but the PIC is in command. In this incident, the SIC was flying the plane. The QZ 8501 Captain, a 53-year-old Indonesian, had over 20,500 flight hours, with nearly 5,000 in type; the SIC, a 46-year-old Frenchman, had 2,247 flight hours, with almost 1,400 in type.

—FAC stands for “Flight Augmentation Computer.” Among other things, the 2 FAC’s calculate the flight envelope and control rudder functions such as rudder travel limit, yaw damping, and rudder trim. Along with 5 other flight computers (3 SEC’s, or Spoilers Elevator Computers, and 2 ELAC’s, or Elevator Aileron Computers), the FAC’s aid in processing pilot and autopilot inputs.

—Rudder Travel Limiter (RTL or RTLU) is a computer which limits the swing of the rudder tail at high speeds, in order to prevent over-stress. The higher the airspeed, the more the travel is limited. While an important item that would need to be addressed by maintenance, the failure of the Rudder Travel Limiter should be a fairly minor issue, with little consequence if procedures are followed.

—When a Rudder Travel Limiter warning is triggered, the standard Airbus ECAM procedure (that is, the checklist that pops up on the screen) calls for resetting each FAC, one at a time, via the overhead switches. This was apparently the procedure followed for the first 3 failures. However, it does not call for the simultaneous resetting of both FAC computers, nor does it call for a circuit breaker reset, which was apparently what the PIC attempted after the 4th failure—a “correction” which the PIC stated he had seen maintenance personnel perform on the ground.

—On the Airbus fleet, “Normal Law” simply means the plane is fully protected against such issues as stalls and over-speeds. In “Alternate Law,” these protections are removed.“Alternate Law” is in itself is not unsafe; most other aircraft, such as older Boeings, do not have these protections.

So, with manageable, relatively minor issues aboard, what caused such a major catastrophe?

The report speculates that the SIC, the Pilot Flying, may have been distracted by the sudden failures, and spatially disoriented by the flight upset created when the autopilot kicked off:

“The rudder deflected 2°… without pilot input for 9 seconds, resulting the aircraft rolling to the left un-commanded up to 54°…. The delayed response of the SIC was likely due to his attention not being directed to the PFD (Primary Flight Display—Ed.), as many events occurred at this time.”

At the same time that the roll correction was made, a pitch-up input was also made, perhaps inadvertently, and the aircraft started to climb—with rates up to 11,000 fpm—and lose airspeed.

An initial correction was made, but not enough to return to straight and level flight:

“This rapid right rolling movement might cause an excessive roll sensation to the right. The SIC may have experienced spatial disorientation and over-corrected while the guidance from the Flight Director was still available”

While the report claims that the Flight Directors had been available throughout this time, this may not have entirely been the case. The Airbus manual states that Flight Directors disappear at their limits of 45° roll and +25°/-13° pitch. Once back within those limits, they will reappear. However, once they reappeared, they may have reverted to heading/vertical speed values at the time of reappearance—that is, guiding the unthinking pilot to continue in this extreme pitch attitude. (This is speculation on our part, based on the systems.) Regardless of Flight Director guidance, however, pilots are trained to fly without them. Moreover, pilots are supposed to be trained in unusual attitude upset recoveries as well, such as this scenario.

The Captain, apparently still out of his seat, then inexplicably shouted, “Pull down! Pull down!” What he apparently meant to say was, “Push down.” The miscommunication seems to have been exacerbated not only by the stressful situation, but the fact both pilots, of different nationalities, had to use English—a second language for both—to communicate.

In the confusion, the SIC continued to Pull—up. With the system degraded into Alternate Law—i.e. with no stall protections—the inevitable happened:

“The degraded performance and ambiguous commands might have decreased the SIC’s situational awareness and he did not react appropriately in this complex emergency, resulting in the aircraft becoming upset…”

When the stall warning triggered, forward sidestick was only applied for a few seconds. Later, as the stall fully progressed, and the aircraft began a rapid descent, the stall warning remained on constantly, yet the FO’s sidestick remained held full back.
The Captain eventually grabbed his control and pushed down. However, he did not communicate this to the SIC:

“The standard call out to take over control described in the operator SOP (Standard Operating Procedure) is, “I HAVE CONTROL,” and responded by the other pilot transferring the control by the call out, “YOU HAVE CONTROL.”

As a result, both pilots continued to try to recover—one by pushing and the other pulling—and therefore neutralizing each other’s inputs. This would normally generate an aural “Dual Input” warning along with associated flashing lights, but the DUAL INPUT warning was suppressed by the more critical stall warning annunciation:

“…At 2317:41 UTC the aircraft reached the highest altitude of 38,500 feet and (the) largest roll angle of 104° to the left. The aircraft then lost altitude with a rate of up to 20,000 feet per minute….The last data recorded by the FDR were at 2320:35 UTC with the airspeed of 83 kts, pitch 20° up, AOA 50°, roll 8° to left, with the rate of descent of 8,400 Ft/minute at a radio altitude of 187 feet….”

Again, Captain Palmer and I have no intention of armchair-quarterbacking this tragic accident nor the board’s findings, but mean solely to glean important lessons that may be of use to pilots. To that end, we submit the following:

• In any and every situation, pilots should always “Aviate, Navigate, and Communicate.” By “Aviate,” we mean, first, foremost and at all times, FLY THE PLANE. At all times, the crew must have assigned a definitive PF, or Pilot Flying.

• By far the most important lesson here is that the PF must shut out the “noise” around him—including his or her own potentially disorienting sensory inputs. Instrument students constantly have this drilled into their heads: ignore the body’s sensations, keep calm and trust your instruments. In this case, however, one of those instruments may have been in error. While the report claims that “guidance from the Flight Director was still available”, we believe that, during the extreme attitudes, they were not, and when reappeared may have been in error. Regardless, however, the experienced pilot must use his/her judgement to recognize that and recover using only the “raw data.”

• A stall is an angle-of-attack problem and must be solved quickly by reducing the angle of attack, even if it requires pitch attitudes that are outside of normal. It is best solved at the first indication of a stall, and airline training often tends to focus on early recognition and recovery as opposed to recovery from extreme situations. Control effectiveness is understandably compromised at higher angles of attack, and beyond a certain point the ability to recover—no matter how skilled the pilot—is in doubt.

• When a failure occurs that generates a warning and checklist procedure, pilots should follow them, within reason. Just as in the case of a faulty instrument, the checklist procedure generated by the computers may be improper, so pilots must use their judgement. The crew did indeed follow the proper checklist procedures the first 3 times, but then deviated on the 4th, exacerbating the problem. When a reset is not successful after one or two tries, it’s time to consider the item broken. The rudder travel limit system, while inoperative, did not compromise the safety or continuation of the flight.

• Pulling circuit breakers is a job for maintenance personnel on the ground, not for pilots in flight. By and large, this is a SOP strictly adhered to by most airlines.

• In a multi-pilot crew, Communication is critical. This is the heart of CRM—Crew Resource Management. If, for example, a Captain wishes to take over flying duties, he must definitively state, “I have Control,” and the SIC must respond with, “You have control” (exact phraseology varies between airlines.) This standardized communication becomes extra critical when working with crews of differing nationalities and communicating in a foreign language.

• The Captain must at all times maintain situational awareness. In the case of QZ 8501, it appears that the SIC was clearly “in the red,” in Threat and Error (TEM) parlance. That is, he was completely overloaded to the point of not understanding what was happening, nor how to properly recover. The Captain seemed to be in the red as well, or at best “in the yellow”—overloaded, but still somewhat situationally aware.

• While both pilots appeared to be properly trained and experienced, the SIC nevertheless had fairly low time—at least relative to his US counterparts—which may have been a contributing factor. Indeed, the FAA requires a minimum of 1,500 flight hours and an ATPL (Airline Transport Pilot License) for all Part 121 (i.e., airline) operators, including First Officers. Pilots hired by a major US airline typically have several times that number. As previously stated, the 46-year-old First Officer, who was the pilot flying, had a 2247 total hours, with all but 880 of those were in the A320.

The philosophy of the Airbus is to take an extremely complex machine and task—that is, the task of flying the machine—and simplify and automate it in order to minimize distraction, and therefore maximize safety. By and large, through its highly sophisticated systems, this works.

But, systems fail, and that is why training is critical.

Often, at the most unexpected and inconvenient times, pilots are called on to be pilots and fly the airplane under adverse conditions. An airline operation often involves using the autopilot for most of the flight, and hand-flying the airplane, especially in instrument weather conditions, is a skill that requires practice to acquire and to maintain. Over-dependence on the flight directors is a potential threat, for when the flight directors are off—or in error—the pilot must determine the proper attitude to fly him/herself.

Precisely flying the airplane with degraded flight control behaviors, unexpected roll inputs, alarms going off, and the other pilot providing contradictory orders (“Pull down”) is much more difficult—for any pilot. Trying to pull that together when those skills were not well-practiced is like being told you’re to give a piano recital on stage—right now, and you haven’t practiced for two years.

While no airline curriculum can ever train for every possible scenario, it is endemic that simulator sessions include challenging scenarios wherein the crew must not only have a working knowledge of the airplane’s systems, company SOP’s and basic airmanship, but must also put their heads together to solve the problem.

Flying in unusual attitudes, with the associated unusual forces on the body, can be very disorienting. The situation is not conducive to clear thinking. Skills learned in training and practice have to take over. If those skills and abilities are not there to begin with, or are weak, the chances of success decrease.

Pilots must always:
—Fly the Plane. All other considerations are secondary.
—Trust your instruments, unless it is obvious they are wrong. Sometimes, in a highly automated airplane, it is best to simply “turn off the magic and fly.”
— Respect the stall warning (unless you have a good reason to believe it is erroneous) and reduce the angle of attack promptly.
—Follow SOP’s Studies have shown that not doing so can double errors.
—Follow Checklists, but use judgement to ensure the proper one is followed.
—Don’t play mechanic inflight; that’s for the mechanics on the ground.
—In good weather, frequently practice autopilot/autothrust/flight director-off “raw data” flying.
—Communicate, using standard phraseology.
— At all times while flying an aircraft: Aviate, Navigate, and Communicate.