The High Altitude Stall of AirAsia QZ8501
On the 28th of December 2014, Indonesia Air Asia flight QZ8501 disappeared mid-flight on a routine journey from Surabaya, Indonesia to Singapore.
On the 1st of December 2015, the Komite Nasional Keselamatan Transportasi (KNKT), the Indonesian ministry in charge of aviation investigations in Indonesia, released a report of over 200 pages regarding the accident. The results make for chilling reading.
The aircraft was an Airbus A320-216, registration PK-AXC, built in 2008. Indonesia Air Asia is an Indonesian airline within the Air Asia Group which operates 30 Airbus A320 aircraft for domestic and regional routes.
Flight QZ8501 was a scheduled flight from Surabaya Juanda International Airport, Indonesia to Changi International Airport, Singapore. The crew consisted of two pilots and four flight attendants. There were 156 passengers on board, including 22 children under 15.
The Airbus A320 departed Juanda airport at 22:35 UTC (6:35 in the morning local time). The departure and initial cruise at FL320 (32,000 feet) was uneventful.
At 23:00, 25 minutes after take-off, the Electronic Centralized Aircraft Monitoring set off an advisory alarm. The Master Caution light lit up, a chime sounded and AUTO FLT RUD TRV LIM 1 appeared on the display
To understand this crash, we need to understand first the aircraft system and maintenance as well as the history of this error.
The Airbus A320 has two Flight Augmentation Computers (FACs) which perform four main functions including the yaw functions. Under normal circumstances, FAC1 controls the yaw damper, turn coordination, rudder trim and rudder travel limit while FAC2 is in standby. The A320 also has a Centralised Fault Display which collects issues that arise during aircraft operations. Maintenance personnel access the data through the Post Flight Report (PFR), which can be displayed or printed.
In the month before the accident, the Post Flight Report is dominated by failure messages relating to the Rudder Limiting Function on the Flight Augmentation Computers. On the 19th of December, the flight crew received 11 cautions on the first flight of the day and 13 cautions on the second. Each time, the pilots reset the caution using the emergency cancel button.
The emergency cancel button turns off the master warning light and stops the aural warnings for that particular error condition. It is specifically used to suppress spurious master cautions. There’s no other approved method for cancelling multiple, repetitive cautions.
The personnel doing the daily maintenance of the aircraft saw the error on the Post Flight Report relating to the Rudder Travel Limiter Unit. The Airbus Trouble Shooting Manual is quite clear that the Rudder Travel Limiter Unit electronic module needs to be replaced if the problem persists. However, the initial maintenance action was the BITE test, which tests the system’s electrical and computer connection. Each time maintenance personnel performed the BITE test, the system passed.
The issue was dealt with by resetting the Flight Augmentation Computer and running an operational test. Thus, there was no need to continue on to the next steps in the Trouble Shooting Manual. Aircraft issues highlighted on the Post Flight Report that are resolved using the Trouble Shooting Manual don’t need to be listed on the Maintenance Report.
This means that every maintenance person saw the issue on the PFR as an isolated event, rather than a recurring problem.
On the 25th of December, the captain of the accident flight was in the same aircraft for a scheduled flight to Kuala Lumpur. During push back, the AUTO FLT RUD TRV LIM SYS message appeared and the captain decided to return the aircraft to the parking bay and report the fault.
A company engineer came to the cockpit to trouble-shoot the issue. Based on the advice on the Airbus Trouble Shooting Manual, the engineer reset the circuit breakers for both Flight Augmentation Computers and then performed the BITE test. This appeared to address the issue.
The captain asked the engineer if he could perform the same reset action whenever the problem reappeared. The engineer said that the pilots could reset the circuit breakers whenever instructed on the Electronic Centralized Aircraft Monitoring display.
The aircraft was ready for departure and push back. During the pushback, the AUTO FLT RUD TRV LIM SYS error reappeared. The pilot used the reset button for the Flight Augmentation Computers but it did not fix the error. The engineer saw that the aircraft had not moved and contacted the pilot via the interphone. The captain explained that the rudder travel limiter issue had occurred again and asked if he could reset the system by pulling the circuit breakers for the Flight Augmentation Computers.
The circuit breakers were behind the right seat in the cockpit and could not be reached by either pilot while sitting. The second-in-command, who was not the same pilot as on the accident flight, left his seat, presumably to reset the circuit breakers. The problem still existed and the engineer asked the captain to return the aircraft to gate.
The engineer replaced Flight Augmentation Computer 2 (FAC2) and asked the captain to start both engines. After both engines started, the problem did not reappear. The captain was happy that the fault had been resolved and the flight proceeded as scheduled with only a slight delay. There were no further occurrences of the error in that flight or the next.
Three days later, the 28th of December, the same captain and his first officer were flying over the Java sea when the errors started again.
23:01 Both Rudder Travel Limiter Units failed, triggering a chime and a master caution light. The captain performed the cited action to press the push-buttons on the overhead panel to set Flight Augmentation Computers 1 and 2 to OFF and then to ON, one by one. Both Rudder Travel Limiter Units returned to normal.
23:04 The captain requested a 15 miles deviation left of track to avoid thunderstorms in the area, which was approved.
23:06 The first officer, who was Pilot Flying, did a standard cruise crew briefing, including actions in case of an engine failure or emergency descent and that Semarang Airport would be the alternate.
23:09 Both Rudder Travel Limiter Units failed, triggering a chime and a master caution lights. The captain performed the cited action to press the push-buttons on the overhead panel to set Flight Augmentation Computers 1 and 2 to OFF and then to ON, one by one. Both Rudder Travel Limiter Units returned to normal.
23:11 The flight crew confirmed to Air Traffic Control that they had routed left to avoid the storm. They were asked to report when clear of the water.
23:12 The flight crew requested a climb to flight level 380 (38,000 feet) when possible and were asked to standby.
23:13 Both Rudder Travel Limiter Units failed, triggering a chime and a master caution lights. The captain performed the cited action to press the push-buttons on the overhead panel to set Flight Augmentation Computers 1 and 2 to OFF and then to ON, one by one. Both Rudder Travel Limiter Units returned to normal.
Three failures in just over ten minutes must have been frustrating but it didn’t stop there.
23:15 Both Rudder Travel Limiter Units failed for the fourth time, triggering a chime and a master caution lights.
23:16 Air Traffic Control issued a clearance for the flight to climb to flight level 340. The pilots did not respond.
23:16:27 The master caution was triggered for the fifth time, this time for a fault in Flight Augmentation Computer 1. The Flight Data Recorder recorded the components controlled by Flight Augmentation Computer 1 as fluctuating, which is a pattern which occurs when the data to be recorded is not available.
23:16:39 Flight Augmentation Computer 1 came back online.
23:16:44 The master caution was triggered for the sixth time with a fault in Flight Augmentation Computer 1 and Flight Augmentation Computer 2. The same data fluctuation was logged by the Flight Data Recorder. The autopilot and the auto-thrust disengaged. Flight control law reverted from Normal Law to Alternate Law. The rudder deflected 2°.
The aircraft started to roll.
23:16:54 Flight Augmentation Computer 2 came back online. The autopilot and autothrust remained disengaged. Flight control law remained in Alternate Law.
The Airbus flight control system has two modes in Normal Law: GROUND and FLIGHT. Under Normal Law in flight mode, the pilot has control of the roll and heading but the aircraft limits the roll rate and the bank angle and coordinates the turns. So for example, the pilot can depress the side-stick for a turn at a high bank angle and then release, the bank angle is automatically reduced to 33°. If the pilot holds the side-stick to the full deflection at the side, the bank angle goes to 67° and no further. If Angle-of-Attack protection is active, the bank angle will not go beyond 45°. If High Speed Protection is active, the bank angle will not go beyond 40°.
However, if there are failures in the flight control system, the aircraft will revert to Alternate Law. This means that there are reduced protections and bank angle protection is not provided.
The first four faults were caused by the intermittent failure of the Rudder Travel Limiter Units. Examination of the unit after the crash showed cracked soldering on the electronic module which had caused the repetitive faults.
However, the fifth fault was caused by a failure of Flight Augmentation Computer 1. The push-button on the overhead panel was set to OFF and Flight Augmentation Computer 1 had no power. Power was restored 12 seconds later but the pushbutton on the flight control overhead was not reset, so it did not return to service. All equipment controlled by Flight Augmentation Computer 1 was not operational.
Flight Augmentation Computer 2 was then “de-energised” as the report puts it, causing the sixth master caution that both Flight Augmentation Computers had failed.
The data recorded on the flight data recorder matches the data from 25th December 2014, when the aircraft had the RTLU problem on the ground and the circuit breakers were reset by pulling out and pushing back in.
However, returning the circuit breakers during flight does not re-engage the FAC functions; the FAC push button on the overhead panel must be reset.
The auto-pilot and the auto-thrust disengaged as a result and the rudder deflection of 2° to the left was not automatically corrected.
The quick reference guide for the airbus states that the flight crew should only reset computers listed in the table (which does not include the flight augmentation computers) and that the flight crew must consider and fully understand the consequences.
As the captain had seen the engineer resetting the Flight Augmentation Computer circuit breakers on the ground, he may have considered himself to fully understand the consequences. It may not have occurred to him that the consequences of resetting the circuit breakers mid-flight were very different than on the ground. The action certainly implies that he did not have a good understanding of the aircraft systems and how they hung together.
The investigation report states that there was no evidence on the Cockpit Voice Recorder that the flight crew ever discussed resetting the circuit breakers or that they considered the risks. Even if they discussed the situation during the 54 seconds after the fourth master caution, when the communications were not recorded, it’s quite clear that they did not anticipate the consequences.
The Rudder Travel Limiter Unit failure would stop the rudder limiter at the last position but not affect the rudder operation. The autopilot, auto-thrust and other systems controlled by the Flight Augmentation Computer are still available. The flight safety was not affected.
By pulling out both circuit breakers, the captain put his flight at immediate risk by disabling the Flight Augmentation Computer completely. When the breakers were pushed back in, the flight crew clearly expected the Flight Augmentation Computers to just work, as neither ever pushed the reset button to bring them back online.
The aircraft went into alternate law, disabling everything, and they apparently had no idea why everything had suddenly gone wrong.
It’s not possible to reset the circuit breakers from a seated position. As the first officer was the pilot flying, it seems likely that it was the captain who left his seat and reset the circuit breakers.
After the autopilot disengaged and the rudder deflected at 2°, the aircraft rolled to the left, without pilot input, at a rate of 6° per second; twice the speed of a normal roll rate operation. The master caution triggered with a chime to attract the crew’s attention to the fact that the autopilot was disengaged.
Under normal conditions, a pilot will respond immediately to level the wings when an aircraft is rolling unexpectedly.
It took the first officer nine seconds to respond after the autopilot disengaged. It’s not clear where his attention was or why it took so long to respond.
By the time he responded, the aircraft roll angle was 54°.
23:16:53 The flight data recorder records initial movements of the right side stick, where the first officer was seated. His initial response was a backward movement on the side step up to 15° and to the right to the maximum deflection. In normal law, the 15° pitch up would have allowed the aircraft to climb back to its preset level at a sensible rate. In alternate law, the sidestick motions gave the aircraft the instruction to pitch up fast and roll hard to the right. The aircraft began to climb rapidly and rolled to the right from 54° left to 9° left bank. The pilot flying did not notice the rudder deflection of 2°, which made the aircraft even more difficult to manage.
At this stage, he appeared to suffer from “the leans”, a form of spatial disorientation where the inner ear messages give the wrong feedback as to whether you are banking. Still banking 9° to the left despite his hard roll to the right, he shifted the side stick to the left again. Having never achieved straight-and-level flight, he rolled the aircraft back to the left to 53°.
He then began using gentler movements on the side stick moving it back to the right. The aircraft gently rolled to 2.5º to the left (so still not straight and level) and pitched up to 5°.
The aircraft continued to climb.
23:16:56 The stall warning activated, including a voice message which calls out STALL, STALL.
The voice message activates when the aircraft reaches 8° Angle of Attack: the angle between the oncoming air or relative wind and a reference line on the aircraft or wing. A plane is stalled when the angle of attack is beyond the stalling angle. Under Normal Law, the aircraft system would switch the elevator control to protection mode, so that the angle of attack is proportional to side-stick deflection. Even if the pilot pulls the side-stick all the way back, the angle of attack will not exceed the maximum. If the pilot releases the side-stick, the angle of attack returns to what it should be. This protection against stall and wind shear has priority over all other protections.
However, in Alternate Law, which the flight had been in since the Flight Augmentation Computers had been disconnected, this protection is overridden. When the audio stall warning goes off in Alternate Law, the flight crew recover from the impending stall by lowering the nose to reduce the angle of attack.
The first officer reacted instinctively to the mechanical voice calling STALL, STALL. The right side stick was at neutral and then moved forward for two seconds. The Angle of Attack decreased to below 8° and the stall warning stopped.
One second later, the right-side stick was pulled back again to 12°. The aircraft pitched up and began to climb at a rate of 11,000 feet/minute. The stall warning sounded again. This time, he did not react. He continued to pull back on the side stick and the aircraft continued to pitch up.
The captain called out, “level…level….” There were no side-stick inputs from the captain; he was almost certainly at the circuit breakers and would have found it difficult to get back to the seat.
He may have been referring to the previous high roll angle. In any event, the command appeared to focus the first officer on levelling the wings rather than paying attention to the pitch.
The aircraft continued to climb. The cockpit voice recorder recorded the captain saying “Oh my god!”
23:17:03 The first input from the left-side side stick was logged: the captain was in his seat and apparently attempting to take control of the flight. The first side stick input lasted two seconds. Fifteen seconds later, a second input was logged, also lasting two seconds.
If one pilot uses the side stick, it sends control signals to the computers. If both pilots use their side sticks simultaneously in the same or opposite direction, then the system adds the signals algebraically. Two green Side Stick Priority lights go on and a voice message activates which says DUAL INPUT, DUAL INPUT.
However, in this case the DUAL INPUT voice was overridden by the higher priority STALL, STALL, STALL.
In a stall situation, the captain can should take control of the situation and can take control of the aircraft. The standard call out is “I HAVE CONTROL” to which the other pilot should respond “YOU HAVE CONTROL”. If the captain was not taking control of the flight, then he should not have been touching the side-stick.
The captain could have stopped the dual input by pressing the priority push button which gives his seat priority while the button is depressed. If he held down the priority push button for 40 seconds or more, priority would have been transferred to him and no further input would have been accepted from the other side stick unless the first officer pushed the button to take it back. The captain pressed the push button twice, once for two seconds and once for five.
No comment about transfer of control was ever made. The captain never pressed the priority push button long enough to make a difference, let alone take control. Instead, they worked against each other: the first officer pulled back while the captain pushed forward.
23:17:15 The aircraft pitch reached 24° up. The captain called out “pull down, pull down!”
The captain was Indonesian and the first officer was French; they spoke to each other in English. It is unfortunate that in the heat of the moment, the captain used exactly the wrong phrase for what he wanted the first officer to do.
The aircraft speed was below the stall speed, the engines were on cruise power and the aircraft was descending at 12,000 feet per minute. The pitch and roll were near 0°; the aircraft appeared to be straight and level. This high altitude stall was not standardly taught as a part of pilot training and the first officer might not have ever realised the high angle of attack despite the stall warning and the buffet.
The airline did not train its pilots in Upset Recovery which might have helped the first officer to recognise the situation. Although Airbus’s operator’s training manual included this training, the airline’s Operations Manual said that
The effectiveness of fly-by-wire architecture, and the existence of control laws, eliminates the need for upset recovery maneuvers to be trained on protected Airbus.
The problem with an unstallable plane is that you can’t believe your eyes when it finally stalls.
23:17:29 The left-side side stick is used continuously from this point on. The captain never took priority, so the aircraft continued with dual input.
The average of the side stick inputs recorded on the flight data recorder indicated that the first officer was pulling almost full back input while the Captain was slightly pushing nose down. The sum of both side stick inputs commanded a nose-up pitch.
The aircraft descended at a rate of up to 20,000 feet per minute.
The pilot training for stalls teaches the pilot to recognise the indications of a stall condition and recover. The aircraft system is designed to prevent the stall by providing early warning. Both are intended to avoid the aircraft stalling. There is no training for dealing with an angle of attack over 40° and recovering from this is considered “beyond the competency of an airline pilot”.
Once the angle of attack reached 48°, there was nothing left that they knew how to do.
23:18 AirAsia flight QZ8501 disappeared from the Jakarta Radar controller’s screen.
According to the flight data recording, the STALL, STALL, STALL warning continued and the two pilots continued their dual input, the first officer pulling all the way back while the captain pushed gently forward, until the aircraft crashed into the Java sea.
Contributing Factors
- The cracking of a solder joint of both channel A and B resulted in loss of electrical continuity and led to RTLU failure.
- The existing maintenance data analysis led to unresolved repetitive faults occurring with shorter intervals. The same fault occurred 4 times during the flight.
- The flight crew action to the first 3 faults in accordance with the ECAM messages. Following the fourth fault, the FDR recorded different signatures that were similar to the FAC CB‟s being reset resulting in electrical interruption to the FACs
- The electrical interruption to the FAC caused the autopilot to disengage and the flight control logic to change from Normal Law to Alternate Law, the rudder deflecting 2° to the left resulting the aircraft rolling up to 54° angle of bank.
- Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted in the aircraft departing from the normal flight envelope and entering prolonged stall condition that was beyond the capability of the flight crew to recover.
One thing I’d like to add. Often, there’s an argument that pilots are no longer being taught how to hand fly and that modern airlines are becoming too reliant on technology. There’s no evidence for that in this instance.
The captain was an Air Force pilot for ten years, flying everything from jet fighters to transport planes. He was a flight instructor on single-engine propeller aircraft. He flew twins and propeller aircraft and Boeings as well as the Airbus A320 and had over 14,000 hours. You couldn’t ask for a more experienced pilot.
The full report is available in English on the KNKT site as a PDF.
This must have been an avoidable accident, reading the article. But one thing crops up: it suggests sloppy maintenance procedures.
There is something else: experience is not always a guarantee. When the “glass cockpit” made it’s way into aviation, when the CVR was played the most overheard remark was “I wonder what caused that ?”
I once knew a captain who had been flying propeller aircraft. When, towards the end of his career, he had to make the transition from the DC-6 to the jets, he had great trouble adjusting. Remember the first Air France A320 that crashed at Molsheim? The crew were new to the high amount of automation had did not program the aircraft for the fly-past. They did not understand fully what the aircraft could, or could not do.
It seems that the F/O was flying. He was trained up on automated aircraft. But how much time did the captain have on the Airbus? He was more than likely still a product of the “old school” and no doubt very good. But in an aircraft that is stalling, perhaps already in an unstable condition, he may have been confused as well and possibly subjected to forces that prevented him to get into his seat and take control in time. I am not engaged in “finger pointing”, I am merely trying to put myself in the situation and am brainstorming. Great basic flying skills are not normally an immediate requirement in the A320, but a solid understanding of the electronics definitely IS. A fighter pilot has to rely on his / her basic flying ability. If things get too far out of hand: eject. Which is not an option, of course, in an airliner.
The A320, according to pilots who fly or flew them, is like a big but very complex, computer game. In a situation like the one now on you website, there are suddenly so many inputs to deal with that it is easy to get confused. Especially, as you mentioned yourself Sylvia, a stall in an aircraft that normally is not supposed to be able to stall.
Agreed, pilots were put in an impossible position flying a heap of junk with persistent maintenance problems told by ATC the could not climb therefore had to fly into a thunder cell which placed incredible strains on the rudder anyway.
This was not a crew fault but a systemic maintenance failure by management.
Could hardly disagree more. These pilots were not in an impossible position, it was a recoverable one. Professional pilots should not allow a minor alarm to bring the aircraft down. If the pilots followed the mantra of flying the aircraft above everything else when the stall occurred it would not have crashed. How you can continually pull back on the controls when the unmistakable stall warnings occur is beyond me, there was no reason to panic at that time, look at your instruments and fly the plane. Anytime I have heard a stall warning, the instinctive response is to release pressure on the controls and let the nose drop.
As for the captains experience, not sure how that matters if he has been rewired to place too much trust in the technology, in this case the training is at fault and it seems that way from the quoted manual text. His issue was a complete breakdown of CRM.
Oh, btw: most aircraft are not really supposed to be hand-flown at high altitude. E.g. the Learjet 25, with straight jet engines was extremely thirsty at altitudes below 35.000 ft. Even on a short hop we would climb to FL 310 or 330 and normal cruise was at FL 450 or higher. So in effect, if the autopilot was not functioning the aircraft was not airworthy.
Although perhaps not as critical as the Lear, a stall at high altitude is bad news in any aircraft.
Surely far and away the most critical point in this tragedy is that two well trained pilots applied opposing inputs via their side sticks resulting in the aircraft stalling into the sea whilst neither was aware what the other was doing!
This is a carbon copy of the AF447 disaster.
Why aren’t Airbus addressing this obvious major ergonomic design problem?
Nearly 400 people have now died as a result!
Which, Steve, goes back to the fact that even very experienced pilots, but experienced on “CONVENTIONAL” aircraft, do not always grasp the intricacies of “fly-by-wire”. Like: of his considerable experience, how much time did the captain have on Airbus A320? No pilot of his experience would have allowed an aircraft to exceed 40 degree angle of attack to develop. Are you sure that this is not a “typo”, Sylvia? The aircraft would have stalled long before reaching such an angle. At high cruising level, it is even very difficult to imagine a pitch angle exceeding 25 degrees. Fighter aircraft, yes and so can most light aircraft. But angle of attack? This sounds less than believable. The Airbus would have been in a nose-up attitude so steep it must have felt (and looked, if anyone could have seen it) as it the aircraft was starting a looping. But most aircraft will have stalled before exceeding 16 degrees angle of attack. Does the A320 have a stick shaker and -pusher? If so, were they de-activated by the alternate law?
In an unusual situation, the captain may have fallen back on his earlier skill set, flying conventional aircraft that, incidentally, do not have “split” control input..
Remains the importance of CVR recordings, that seem to suggest that the captain may have been struggling to get back in his seat after re-setting the cb’s. Why was there no clear “I have control” with the standard response “you have control” and was there a communication problem adding to the confusion?
It requires but a small action to transfer all control to the captain’s side. Was the aircraft swinging so violently that the captain did not manage to hold the “priority” button long enough to transfer authority to his side? If so, perhaps a modification requiring only a few seconds should be considered?
All together, it seems that the company may have been a bit lax with the adherence to “SOP’s”. But, again, this is pure speculation.Just the same: This accident seems to generate more questions than answers.
Speaking for myself: I do not know how I would have dealt with a computer, if I had qualified on the A320. The BAC 1-11 had “manual reversion”, bypassing the hydraulics in the event of a loss of fluid in the control system. The controls would be coupled directly which would increase the force required to manipulate the controls considerably. It might have been necessary to ask the other pilot to assist. But it was not possible for one “side” to cancel out inputs from the other side !
Rudy, a minor comment to yours.
I did not read the full report, but according to the post – ” The pitch and roll were near 0°; the aircraft appeared to be straight and level.” The “angle of attack” was 40 degrees… The highest aircraft pitch attitude reported was 24 degrees NU at 23:17:15 – “23:17:15 The aircraft pitch reached 24° up. The captain called out “pull down, pull down!”
As you pointed out (indirectly), pitch is one thing, AoA is another and it is possible to attain 40 degrees AoA in a nearly level pitch, hence the STALL. Could be a Typo but I don’t see the situation as improbable. Once stalled, if pitch inputs are kept the aircraft would attain a descending path in any attitude and could reach 40 degrees AoA. This is similar to what happened to AF447 ( https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf ).
Regards.
In my last comment: read “…I do not know how I would have dealt with a malfunctioning computer, if I had qualified on the A320.” One word omitted makes a big difference !
Steve, I think you are absolutely right! This disconnected side-stick issue is something that Airbus really needs to fix. Either they need to swallow their pride and admit that it doesn’t work and just mechanically link them, or install some kind to stick shaker, that tries to push the stick in the direction that other pilot is pushing it.
The problem with the “DUAL INPUT” warning is that it doesn’t sound during a stall. This is a major design flaw, because this critical moment is where CRM is most likely to break down. Pilots can panic, just like any human would, and they can get confused and will do things instinctively without telling the other pilot. The captain tried to take control, but he didn’t say “I have control,” probably because he was just focused on getting the plane out of a stall!
The other thing we need to address is “why do so many pilots pull up in a stall?” Pushing down is supposed to be taught before you even solo! Perhaps the stall warning should also add a “PUSH DOWN” message in the same way that the GPWS tells the pilots to “PULL UP!”
There is a new generation of the 320 coming out of the prod line. Shouldn’t it be time to act and implement the necessary changes before those planes hit the flight line?
Following on what Rudy has said, few more things come to mind.
1) As Andrew says the stall warning should not override the dual input warning.
2) 40 seconds is a ridiculously long time in a crisis to gain control.
3) How about a warning visual or aural saying “left stick (or right) has control” whenever both sticks are moved or the priority button is pressed? And a light or a solenoid activated widget changing the shape of the active stick as well!
4) It cannot make sense to arithmetically add or average the two stick inputs in ANY circumstances!
5) We now have two near identical disasters where non critical system malfunctions have caused sufficient stress and confusion in the minds of well trained, experienced pilots to cause them to make fatal errors of judgement. I am not trained for IMC so I wouldn’t comment on the stall aspect but don’t think any amount of special further training can overcome the dual input issue.
TomcatViP, I’m really sorry but your comments got caught up in the spam filter. You’ve now been added, so in future your comments will appear immediately. I’m in the midst of moving and so didn’t notice for a couple of days, sorry!
I quite agree with the last two reactions. But it seems totally inexplicable that any reasonably experienced pilot would maintain back pressure on the flight controls in a stall. And any pilot with a CPL, possibly a “frozen” ATPL, a multi-engine rating, an instrument rating, a high-altitude certificate and a type-rating on a medium-sized airliner of any description has logged at least 200 flying hours and passed a comprehensive simulator test. So even a new F/O is by any description reasonably experienced. So why are pilots reacting so completely and utterly contrary to elementary flight training when they experience a stall?
I myself, it is long enough to own up, was once in a rather unusual stall. Okay, it was a Piper Super Cub but even so..
I was young and took a girl for a spin. And yes, I was showing off. So I did a low-level looping and as I pulled up again, instead of pulling the Cub around for a second looping, I kept the aircraft pointing up vertically. The speed dropped to near zero, I held the stick neutral, kicked the rudder and around she came in a perfect stall turn. We ended up again in an absolutely vertical attitude, but now we were pointing straight down. We were over water, a harbour in Germany. We were pointing directly at a ferry boat and I was looking the people on the back deck, watching us, straight in the eye. So my instinctive reaction was to start pulling. To my surprise, the aircraft shuddered but otherwise kept pointing straight down. The ASI was showing about 30 or 40 mph, we were stalled in a vertical dive ! But I immediately knew that we had to gain airspeed first so I relaxed the stick pressure, we built up some speed and I could pull up out of the dive. I did not even have to think about it.
We were darned low, probably below 150 feet and yes, I had been foolish. Extremely so.
I did not have anything near the experience the captain of that Airbus had but there was no need to tell me that in a stall you do not keep pulling back. Not even when you are low enough to see individual faces below you and “below” is directly in front of you because you are pointing straight at them.
But, even if a modification should be made to the A320 and other similarly controlled aircraft to disable dual input, perhaps by automatically giving the captain priority in similar cases. But then, could that in itself lead to another problem ?
And, btw.: I do not “buy” the 48 degree angle of attack, not even the Rafale can go to that high an angle.
The only logical explanation I have seen for why a pilot would pull back on the stick in a stall is that when descending vertically stalled at up to 20,000 ft per minute there must have been a terriffic amount of wind noise. If the pilot’s senses told him that was due to excess forward airspeed then you have an explanation.
There have been comments of disbelief at the 40 degrees angle of attack. It seems in both cases that you are confusing AOA with pitch attitude of the aircraft. You can have an angle of attack (airflow relative to the chord line of the wing) much higher than stalling angle of attack when the aircraft is descending at high rates (as in this event and AF447) in a seemingly normal “level” flight attitude and low forward speed. Just work out the resultant AOA of a horizontal (within 5 degrees) wing chord line travelling forward at (say) 40kts (67fps) and descending at 10 thousand fps
A number of comments are questioning the captains capability to fly the super complex computer plane. However, I find that besides poor CRM, his piloting actions are correct. The poor CRM could be attributed to his fighter background which are mostly Solo cockpits.
And 40 seconds to gain priority in an aircraft – what a terrifyingly stupid design, just as algebraically adding up inputs. Someone needs to tell Airbus that there is a difference between synchronised swimming and piloting an aircraft
“The aircraft went into alternate law, disabling everything…” is just no true at all.
“The problem with the “DUAL INPUT” warning is that it doesn’t sound during a stall…” is partially true. The aural warning will no be heard (stall warning has priority) but the visual green arrow will be lit.
Fly by wire is a necessity. There’s no denying that once aircraft go beyond a certain size, the old model of control has to be replaced with something capable of dealing with the forces involved. However, it is my opinion that the implementation of fly by wire has been flawed.
I’ll start with one simple premise; a control should behave predictably. The volume of an audio device should increase when the control is turned clockwise, for example. By having alternate “laws” which alter this behavior depending upon operating circumstances, this basic ergonomic principle is severely bent, if not outright broken. When we are in an emergency situation, our short-term memory is saturated and no matter how well we are trained, we can easily miss the fact that the rules have changed because a flight control system is now operating according to an alternate “law”.
Even without alternate laws enacted, human factors can result in just the wrong action on the part of a pilot as is born witness in this accident, as the FO pulls back on the stick and keeps the aircraft in a stall. It’s a common rookie error, but even a highly experienced pilot can make this mistake if they are overwhelmed in an emergency.
I am a firm believer in stick and rudder skills and believe that every pilot should practice these basics on a regular basis, no matter how experienced they are. The astronauts used to fly T-38s in order to keep their basic skills in order. Frankly, I’d be more than supportive of having ATPs do a little bit of time in a Cub or a Citabria on a regular basis, for just this purpose.
But no matter how proficient a pilot is, and no matter how great their stick and rudder skills, if the aircraft responds differently based upon an uncommanded shift to a different “law”, these skills may be of limited use.
“ The aircraft went into alternate law, disabling everything, and they apparently had no idea why everything had suddenly gone wrong.”
To my way of thinking, this is the ultimate root cause of the crash. The pilots had become accustomed to the airplane preventing them from overcontrolling and keeping them safe from stalling. But then the computer changed the rules of the game and they were, for all intents. Playing by the same set of rules which govern the flight such aircraft as the aforementioned Cubs or Citabrias.
Even in my humble experience as a pilot, I developed a sense for how the wing was flying. I remember how hard 2G turns were when I first learned to fly and I had a heck of a time getting these up to Private Pilot standards. Then I did the Commercial maneuvers and by the time I got these into shape, a 2G turn was a casual matter, almost automatic. The point is that stick and rudder skills come with practice.
I’m not so certain that some of these fly-by-wire aircraft are helping their pilots to maintain their stick and rudder skills. These are basic, but they are vital. Obviously a Transport Category aircraft can’t fly around practicing 2G turns with a load of passengers, but I really believe that as automated flight controls become more and more common, pilots will have to be proactive about their stick and rudder skills.
I believe these pilots have to undergo simulator training regularly. That provides an opportunity to practice a high altitude stall in alternate law, or perhaps even 2G turns.
The simulator training is informed by actual accidents and incidents.