Published in April 2016 issue

Eric Auxier & Bill Palmer

Aircraft accident investigations serve an important purpose: to learn what happened, so that we can learn from what happened.  The final Aircraft Accident Investigation Report has been released for AirAsia 8501—the Airbus A320 that crashed on December 28, 2014, killing all 155 passengers and seven crew aboard. The primary investigative body, the KNKT, or Komite Nasional Keselamatan Transportasi (the Indonesian version of the US NTSB), listed several causal factors and recommendations.

In this article, A330 Captain Bill Palmer and I (an A320 Captain) shall attempt to dissect some of these important safety lessons. It is not our intent to point fingers, place blame, or critique the findings of the QZ 8501 accident investigation; rather, it is to review several important issues and to learn from them. While many issues, such as maintenance practices, were addressed in the report, we will only deal with those relevant to Pilots.

SYNOPSIS (SUMMARIZED FROM THE KNKT REPORT):

“On 28 December, 2014, an Airbus A320-216 aircraft registered as PK-AXC was cruising at 32,000 feet on a flight from Juanda Airport, Surabaya, Indonesia to Changi Airport, Singapore with total occupants of 162 persons. The Pilot in Command (PIC) acted as Pilot Monitoring (PM) and the Second in Command (SIC) acted as Pilot Flying (PF).”

“The Flight Data Recorder (FDR) recorded that four master cautions activated following the failure of the Rudder Travel Limiter … The crew performed the ECAM procedure (computer resets) on the first three master caution activations. After the fourth master caution, the FDR recorded [that] … the FAC CBs (circuit breakers) were pulled (presumably by the Pilot—Ed.). This pilot action resulted [in] … AUTO FLT FAC 1+2 FAULT.” “Following two FAC fault, the autopilot and auto-thrust disengaged and the flight control reverted to Alternate Law, which changed the handling characteristics in roll and the aircraft lost several protections available in Normal Law (most notably stall protection) … The aircraft entered an upset condition … The rudder deflected 2° to the left resulting the aircraft rolling up to 54° angle of bank.”

“Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted in the aircraft departing from the normal flight envelope and entering prolonged stall condition that was beyond the capability of the flight crew to recover.”

SEVERAL IMPORTANT EXPLANATIONS:

The Pilot in Command (PIC) is commonly referred to as the Captain, Commander, or, in layman’s terms, the Pilot; the Second in Command (SIC) is commonly referred to as the First Officer (FO), or, in layman’s terms, the co-Pilot. In the case of an airliner, both are fully qualified Pilots and can fly the plane, but the PIC is in command. In this accident, the SIC was flying the plane. The Captain, a 53-year-old Indonesian citizen, had more than 20,500 flight hours to his name, with nearly 5,000 in type; the SIC, a 46-yearold French citizen, had 2,247 flight hours, with almost 1,400 in type.

FAC stands for Flight Augmentation Computer. Among other things, the two FACs calculate the flight envelope, including low and high speed limits and yaw stability. The FACs also control rudder functions such as the rudder travel limit, yaw damping, and rudder trim. Along with five other flight computers (two SECs, or Spoilers Elevator Computers, and three ELACs, or Elevator Aileron Computers), the FACs aid in processing Pilot and autopilot inputs. Specifically, the FACs execute the rudder orders computed by the ELACs.

The Rudder Travel Limiter (RTL or RTLU) is a computer that limits the swing of the rudder tail at high speeds, in order to prevent over-stress. The higher the airspeed, the more the travel is limited. Albeit being an important item that would need to be addressed by maintenance, the failure of the Rudder Travel Limiter should have been a fairly minor issue, having little consequence if procedures had been followed. When a Rudder Travel Limiter warning is triggered, the standard Airbus ECAM procedure (that is, the checklist that pops up on the screen) calls for resetting each FAC, one at a time, via the overhead switches. This, apparently, was the procedure followed for the first three failures. However, it does not call for the simultaneous resetting of both FAC computers, nor does it call for a circuit breaker reset, which, apparently, was what the PIC attempted after the fourth failure—a ‘correction’ that the PIC stated he had seen maintenance personnel perform on the ground.

On the Airbus fleet, ‘Normal Law’ simply means that the plane is fully protected against such issues as stalls and overspeeds.

In ‘Alternate Law’, these protections would have been removed. Moreover, handling in the roll axis would have changed from a rate-of-roll demand to direct aileron control, which could have made roll control more sensitive, but still intuitive. Handling in the pitch axis would instead have remained unchanged. Alternate Law, in itself, is not unsafe; most other aircraft, such as older Boeings, do not have stall and overspeed protections, and operate with direct aileron control to begin with. Certain conditions, such as the double FAC interruption, may also disengage the autopilot.

Again, a double FAC failure should not in itself have been a major issue; flight envelope protections would simply have been removed and the autopilot disengaged. Several other minor factors would have needed to be taken into consideration, such as using the rudder with care due to the loss of the RTL, but this should have been completely manageable by the crew.

A FAILURE TO COMMUNICATE

So, with manageable, relatively minor issues aboard, what caused such a major catastrophe?

The report speculates that the SIC, the Pilot Flying, may have been distracted by the sudden failures, and spatially disoriented by the flight upset created by the autopilot kicking off. At the same time at which the roll correction was being executed, a pitch-up input was also made, perhaps inadvertently, and the aircraft started to climb—with rates of up to 11,000fpm—and lose airspeed.

An initial correction was made, but it was not sufficient to return to straight and level flight:

“This rapid right rolling movement might have caused an excessive roll sensation to the right … The SIC may have experienced spatial disorientation and over-corrected by shifting the side stick to the left, which caused the aircraft to roll back to the left up to 53° … [and by making a] side stick input … resulting in pitch attitude of 9° … beyond the normal angle to regain the pre-set altitude of 32,000 feet (approximately 2°—Ed.) while the guidance from the Flight Director was still available.” (Emphasis added—Ed.)

Then, the Captain, apparently out of his seat, inexplicably shouted, “Pull down! Pull down!”

What he could have meant was, “Push down.” The miscommunication seems to have been exacerbated not only by the stressful situation, but also by the fact that both Pilots, being of different nationalities, had to communicate between themselves in English—a second language for both. In the confusion, the SIC continued to pull—up. With the system degraded into Alternate Law—i.e., without stall protections—the inevitable happened: “The degraded performance and ambiguous commands might have decreased the SIC’s situational awareness and he did not react appropriately in this complex emergency, resulting in the aircraft becoming upset … the stall warning activated … stopped for one second, then continued until the end of recording.”

When the stall warning was triggered, forward sidestick was only applied for a few seconds. Later, as the stall was in full progress and the aircraft had begun a rapid descent, the stall warning stayed constantly on; yet, the SIC’s sidestick remained held full back.

The Captain eventually grabbed his control and pushed down. However, he did not communicate this to the SIC: “The standard call out to take over control described in the operator SOP (Standard Operating Procedure) is, “I HAVE CONTROL,” and responded by the other pilot transferring the control by call out, “YOU HAVE CONTROL.” As a result, both Pilots continued to try to recover—one by pushing and the other by pulling—therefore neutralizing each other’s inputs. This would normally have generated an aural “Dual Input” warning along with associated flashing lights, but that warning was being suppressed by the more critical stall warning annunciation.


April 2016Add to cart | View Details


ANALYSIS

Again, Captain Palmer and I have no intention of armchair-quarterbacking either this tragic accident or the board’s findings, but only to glean important lessons that may be of use to Pilots. To this end, we submit the following:

In any and every situation, Pilots should always ‘Aviate, Navigate, and Communicate’. By ‘Aviate’, we mean, first, foremost, and at all times, FLY THE PLANE. At all times, the crew must have assigned a definitive PF, or Pilot Flying.

By far the most important lesson here is that PFs must shut out the ‘noise’ around them—including their own potentially disorienting sensory inputs. Instrument students have this constantly drilled into their heads: ignore your body’s sensations, keep calm, and trust your instruments. In this case, however, one of those instruments may have been in error. While the report claims that “guidance from the Flight Director was still available”, we believe that, during the times of extreme attitudes, it was not, and that, when it reappeared, it may have been in error. At any rate, when any system aboard an airplane is giving out false information, the experienced Pilot must use his/ her judgment to recognize it and recover by using only the ‘raw data’—which, in this case, would have entailed using the attitude indicator on the PFD, and possibly ignoring the FD commands.

Studies have shown that, in these situations, the first few seconds are critical in establishing control. Once any parameter exceeds the normal envelope, regaining control becomes increasingly difficult.

A stall is an angle-of-attack problem (the stall warning was triggered at an 8° angle of attack) and must be solved quickly by reducing such angle, even if this requires pitch attitudes that are outside of normal. A stall situation is best solved at its first indication, and airline training often tends to focus upon early recognition and recovery, as opposed to recovery from extreme situations, In this case, the angle of attack was in excess of 40°, even when the pitch attitude was as much as 25° nose down. At this high angle of attack, control effectiveness is understandably compromised and, beyond a certain point, the ability to recover—no matter how skilled the Pilot—is in doubt.

When a failure that generates a warning and checklist procedure occurs, Pilots should follow it, within reason. Just as a faulty instrument reading, the checklist procedure generated by the computers may be improper, so Pilots must use their judgment. The crew did indeed follow the proper checklist procedures the first three times, but deviated on the fourth, exacerbating the problem. When a reset is unsuccessful after one or two attempts, it’s time to consider the item as broken. The rudder travel limit system, although inoperative, did not compromise the safety or continuation of the flight.

Pulling circuit breakers is a job for maintenance personnel on the ground, not for Pilots in flight. By and large, this is a SOP strictly adhered to by most airlines. Although some Pilots flying for developing country airlines report that inflight circuit breaker resets are surreptitiously encouraged by their companies, such behaviors could easily result in the wrong CB being pulled, or, as in this case, in too many being pulled at once, producing issues more serious than the original.

In a multi-Pilot crew, communication is critical. This is at the heart of CRM—Crew Resource Management. If, for example, a Captain wishes to take over flying duties, he must definitively state, “I have control”, and the SIC must respond with, “You have control” (the exact phraseology varies between airlines). This standardized communication becomes extra critical in cases of crews of differing nationalities communicating in languages that are foreign to them.

The Captain must maintain situational awareness at all times. In the case of QZ 8501, it appears that the SIC had, in Threat and Error (TEM) parlance, been clearly ‘in the red’; i.e., he was completely overloaded, to the point of not understanding what was happening or how to properly recover. The Captain seems to also have been ‘in the red’ or, at best, ‘in the yellow’— overloaded, but still somewhat situationally aware.

While both Pilots appear to have been properly trained and experienced, the SIC nevertheless had a fairly low flight time—at least compared to his US counterparts—which may have been a contributing factor. Indeed, the FAA requires a minimum of 1,500 flight hours and an ATPL (Airline Transport Pilot License) for all Part 121 (i.e., airline) operators, including First Officers. Realistically, however, Pilots often won’t be hired by a major US airline until they have flown two, three, or more times that number (however, in the face of the possible looming Pilot shortage, this number may be trending down). As previously stated, although the 46-year-old First Officer, who had been the Pilot flying, had 2,247 total flight hours, only 1,367 of these had been flown in the A320. He had just finished flight school prior to joining Air Asia, having previously served in various management fields.

IN CONCLUSION

The Airbus philosophy is to take extremely complex machines and tasks—that is, the tasks involved in flying the machines—and to simplify and automate them in order to minimize distraction, therefore maximizing safety. By and large, this works. But systems, however sophisticated, fail. And that is why training is critical. Often, at the most unexpected and inconvenient times, Pilots are called on to be Pilots and fly aircraft under adverse conditions. Pilot skills are called upon that must be readily available. Performing normal, gentle hand-flown maneuvers while following the Flight Director’s guidance is one thing; calling on skills that are barely there may be a completely different one. However, an airline operation often involves using the autopilot for most of the flight, resulting in little hand-flying practice. Hand-flying the airplane, especially in instrument weather conditions, is a skill that requires practice to acquire and maintain. Many Pilots of high-tech airplanes fail to realize the potential threat presented by dependence on the Flight Director, which, by computing all the required control inputs, reduces flying the airplane to a matter of hand-eye coordination. When the Flight Director is off—or in error—Pilots themselves must determine the proper attitude to fly, which requires a lot more brain work. Precisely flying an airplane under conditions involving degraded flight control behaviors, unexpected roll inputs, alarms going off, and the other Pilot providing contradictory orders (“Pull down!”) is extremely demanding—for any Pilot. Trying to pull that together with skills that are not well-practiced is like being told to give a piano recital on stage—right now, not having practiced for two years. While no airline curriculum can ever prepare for every possible situation, it is essential for simulator sessions to include challenging scenarios wherein the crew must be required not only to have a working knowledge of the airplane’s systems, company SOP’s and basicairmanship, but also to put their heads together to solve problems.

Flying in unusual attitudes, with the body being subjected to the associated unusual forces, can be very disorienting. Such a situation is not conducive to clear thinking. Training in aerobatics or upset recovery on aircraft (and not just in simulators) increases a Pilot’s ability to cope with these situations.