The High Altitude Stall of AirAsia QZ8501
On the 28th of December 2014, Indonesia Air Asia flight QZ8501 disappeared mid-flight on a routine journey from Surabaya, Indonesia to Singapore.
On the 1st of December 2015, the Komite Nasional Keselamatan Transportasi (KNKT), the Indonesian ministry in charge of aviation investigations in Indonesia, released a report of over 200 pages regarding the accident. The results make for chilling reading.
The aircraft was an Airbus A320-216, registration PK-AXC, built in 2008. Indonesia Air Asia is an Indonesian airline within the Air Asia Group which operates 30 Airbus A320 aircraft for domestic and regional routes.
Flight QZ8501 was a scheduled flight from Surabaya Juanda International Airport, Indonesia to Changi International Airport, Singapore. The crew consisted of two pilots and four flight attendants. There were 156 passengers on board, including 22 children under 15.
The Airbus A320 departed Juanda airport at 22:35 UTC (6:35 in the morning local time). The departure and initial cruise at FL320 (32,000 feet) was uneventful.
At 23:00, 25 minutes after take-off, the Electronic Centralized Aircraft Monitoring set off an advisory alarm. The Master Caution light lit up, a chime sounded and AUTO FLT RUD TRV LIM 1 appeared on the display
To understand this crash, we need to understand first the aircraft system and maintenance as well as the history of this error.
The Airbus A320 has two Flight Augmentation Computers (FACs) which perform four main functions including the yaw functions. Under normal circumstances, FAC1 controls the yaw damper, turn coordination, rudder trim and rudder travel limit while FAC2 is in standby. The A320 also has a Centralised Fault Display which collects issues that arise during aircraft operations. Maintenance personnel access the data through the Post Flight Report (PFR), which can be displayed or printed.
In the month before the accident, the Post Flight Report is dominated by failure messages relating to the Rudder Limiting Function on the Flight Augmentation Computers. On the 19th of December, the flight crew received 11 cautions on the first flight of the day and 13 cautions on the second. Each time, the pilots reset the caution using the emergency cancel button.
The emergency cancel button turns off the master warning light and stops the aural warnings for that particular error condition. It is specifically used to suppress spurious master cautions. There’s no other approved method for cancelling multiple, repetitive cautions.
The personnel doing the daily maintenance of the aircraft saw the error on the Post Flight Report relating to the Rudder Travel Limiter Unit. The Airbus Trouble Shooting Manual is quite clear that the Rudder Travel Limiter Unit electronic module needs to be replaced if the problem persists. However, the initial maintenance action was the BITE test, which tests the system’s electrical and computer connection. Each time maintenance personnel performed the BITE test, the system passed.
The issue was dealt with by resetting the Flight Augmentation Computer and running an operational test. Thus, there was no need to continue on to the next steps in the Trouble Shooting Manual. Aircraft issues highlighted on the Post Flight Report that are resolved using the Trouble Shooting Manual don’t need to be listed on the Maintenance Report.
This means that every maintenance person saw the issue on the PFR as an isolated event, rather than a recurring problem.
On the 25th of December, the captain of the accident flight was in the same aircraft for a scheduled flight to Kuala Lumpur. During push back, the AUTO FLT RUD TRV LIM SYS message appeared and the captain decided to return the aircraft to the parking bay and report the fault.
A company engineer came to the cockpit to trouble-shoot the issue. Based on the advice on the Airbus Trouble Shooting Manual, the engineer reset the circuit breakers for both Flight Augmentation Computers and then performed the BITE test. This appeared to address the issue.
The captain asked the engineer if he could perform the same reset action whenever the problem reappeared. The engineer said that the pilots could reset the circuit breakers whenever instructed on the Electronic Centralized Aircraft Monitoring display.
The aircraft was ready for departure and push back. During the pushback, the AUTO FLT RUD TRV LIM SYS error reappeared. The pilot used the reset button for the Flight Augmentation Computers but it did not fix the error. The engineer saw that the aircraft had not moved and contacted the pilot via the interphone. The captain explained that the rudder travel limiter issue had occurred again and asked if he could reset the system by pulling the circuit breakers for the Flight Augmentation Computers.
The circuit breakers were behind the right seat in the cockpit and could not be reached by either pilot while sitting. The second-in-command, who was not the same pilot as on the accident flight, left his seat, presumably to reset the circuit breakers. The problem still existed and the engineer asked the captain to return the aircraft to gate.
The engineer replaced Flight Augmentation Computer 2 (FAC2) and asked the captain to start both engines. After both engines started, the problem did not reappear. The captain was happy that the fault had been resolved and the flight proceeded as scheduled with only a slight delay. There were no further occurrences of the error in that flight or the next.
Three days later, the 28th of December, the same captain and his first officer were flying over the Java sea when the errors started again.
23:01 Both Rudder Travel Limiter Units failed, triggering a chime and a master caution light. The captain performed the cited action to press the push-buttons on the overhead panel to set Flight Augmentation Computers 1 and 2 to OFF and then to ON, one by one. Both Rudder Travel Limiter Units returned to normal.
23:04 The captain requested a 15 miles deviation left of track to avoid thunderstorms in the area, which was approved.
23:06 The first officer, who was Pilot Flying, did a standard cruise crew briefing, including actions in case of an engine failure or emergency descent and that Semarang Airport would be the alternate.
23:09 Both Rudder Travel Limiter Units failed, triggering a chime and a master caution lights. The captain performed the cited action to press the push-buttons on the overhead panel to set Flight Augmentation Computers 1 and 2 to OFF and then to ON, one by one. Both Rudder Travel Limiter Units returned to normal.
23:11 The flight crew confirmed to Air Traffic Control that they had routed left to avoid the storm. They were asked to report when clear of the water.
23:12 The flight crew requested a climb to flight level 380 (38,000 feet) when possible and were asked to standby.
23:13 Both Rudder Travel Limiter Units failed, triggering a chime and a master caution lights. The captain performed the cited action to press the push-buttons on the overhead panel to set Flight Augmentation Computers 1 and 2 to OFF and then to ON, one by one. Both Rudder Travel Limiter Units returned to normal.
Three failures in just over ten minutes must have been frustrating but it didn’t stop there.
23:15 Both Rudder Travel Limiter Units failed for the fourth time, triggering a chime and a master caution lights.
23:16 Air Traffic Control issued a clearance for the flight to climb to flight level 340. The pilots did not respond.
23:16:27 The master caution was triggered for the fifth time, this time for a fault in Flight Augmentation Computer 1. The Flight Data Recorder recorded the components controlled by Flight Augmentation Computer 1 as fluctuating, which is a pattern which occurs when the data to be recorded is not available.
23:16:39 Flight Augmentation Computer 1 came back online.
23:16:44 The master caution was triggered for the sixth time with a fault in Flight Augmentation Computer 1 and Flight Augmentation Computer 2. The same data fluctuation was logged by the Flight Data Recorder. The autopilot and the auto-thrust disengaged. Flight control law reverted from Normal Law to Alternate Law. The rudder deflected 2°.
The aircraft started to roll.
23:16:54 Flight Augmentation Computer 2 came back online. The autopilot and autothrust remained disengaged. Flight control law remained in Alternate Law.
The Airbus flight control system has two modes in Normal Law: GROUND and FLIGHT. Under Normal Law in flight mode, the pilot has control of the roll and heading but the aircraft limits the roll rate and the bank angle and coordinates the turns. So for example, the pilot can depress the side-stick for a turn at a high bank angle and then release, the bank angle is automatically reduced to 33°. If the pilot holds the side-stick to the full deflection at the side, the bank angle goes to 67° and no further. If Angle-of-Attack protection is active, the bank angle will not go beyond 45°. If High Speed Protection is active, the bank angle will not go beyond 40°.
However, if there are failures in the flight control system, the aircraft will revert to Alternate Law. This means that there are reduced protections and bank angle protection is not provided.
The first four faults were caused by the intermittent failure of the Rudder Travel Limiter Units. Examination of the unit after the crash showed cracked soldering on the electronic module which had caused the repetitive faults.
However, the fifth fault was caused by a failure of Flight Augmentation Computer 1. The push-button on the overhead panel was set to OFF and Flight Augmentation Computer 1 had no power. Power was restored 12 seconds later but the pushbutton on the flight control overhead was not reset, so it did not return to service. All equipment controlled by Flight Augmentation Computer 1 was not operational.
Flight Augmentation Computer 2 was then “de-energised” as the report puts it, causing the sixth master caution that both Flight Augmentation Computers had failed.
The data recorded on the flight data recorder matches the data from 25th December 2014, when the aircraft had the RTLU problem on the ground and the circuit breakers were reset by pulling out and pushing back in.
However, returning the circuit breakers during flight does not re-engage the FAC functions; the FAC push button on the overhead panel must be reset.
The auto-pilot and the auto-thrust disengaged as a result and the rudder deflection of 2° to the left was not automatically corrected.
The quick reference guide for the airbus states that the flight crew should only reset computers listed in the table (which does not include the flight augmentation computers) and that the flight crew must consider and fully understand the consequences.
As the captain had seen the engineer resetting the Flight Augmentation Computer circuit breakers on the ground, he may have considered himself to fully understand the consequences. It may not have occurred to him that the consequences of resetting the circuit breakers mid-flight were very different than on the ground. The action certainly implies that he did not have a good understanding of the aircraft systems and how they hung together.
The investigation report states that there was no evidence on the Cockpit Voice Recorder that the flight crew ever discussed resetting the circuit breakers or that they considered the risks. Even if they discussed the situation during the 54 seconds after the fourth master caution, when the communications were not recorded, it’s quite clear that they did not anticipate the consequences.
The Rudder Travel Limiter Unit failure would stop the rudder limiter at the last position but not affect the rudder operation. The autopilot, auto-thrust and other systems controlled by the Flight Augmentation Computer are still available. The flight safety was not affected.
By pulling out both circuit breakers, the captain put his flight at immediate risk by disabling the Flight Augmentation Computer completely. When the breakers were pushed back in, the flight crew clearly expected the Flight Augmentation Computers to just work, as neither ever pushed the reset button to bring them back online.
The aircraft went into alternate law, disabling everything, and they apparently had no idea why everything had suddenly gone wrong.
It’s not possible to reset the circuit breakers from a seated position. As the first officer was the pilot flying, it seems likely that it was the captain who left his seat and reset the circuit breakers.
After the autopilot disengaged and the rudder deflected at 2°, the aircraft rolled to the left, without pilot input, at a rate of 6° per second; twice the speed of a normal roll rate operation. The master caution triggered with a chime to attract the crew’s attention to the fact that the autopilot was disengaged.
Under normal conditions, a pilot will respond immediately to level the wings when an aircraft is rolling unexpectedly.
It took the first officer nine seconds to respond after the autopilot disengaged. It’s not clear where his attention was or why it took so long to respond.
By the time he responded, the aircraft roll angle was 54°.
23:16:53 The flight data recorder records initial movements of the right side stick, where the first officer was seated. His initial response was a backward movement on the side step up to 15° and to the right to the maximum deflection. In normal law, the 15° pitch up would have allowed the aircraft to climb back to its preset level at a sensible rate. In alternate law, the sidestick motions gave the aircraft the instruction to pitch up fast and roll hard to the right. The aircraft began to climb rapidly and rolled to the right from 54° left to 9° left bank. The pilot flying did not notice the rudder deflection of 2°, which made the aircraft even more difficult to manage.
At this stage, he appeared to suffer from “the leans”, a form of spatial disorientation where the inner ear messages give the wrong feedback as to whether you are banking. Still banking 9° to the left despite his hard roll to the right, he shifted the side stick to the left again. Having never achieved straight-and-level flight, he rolled the aircraft back to the left to 53°.
He then began using gentler movements on the side stick moving it back to the right. The aircraft gently rolled to 2.5º to the left (so still not straight and level) and pitched up to 5°.
The aircraft continued to climb.
23:16:56 The stall warning activated, including a voice message which calls out STALL, STALL.
The voice message activates when the aircraft reaches 8° Angle of Attack: the angle between the oncoming air or relative wind and a reference line on the aircraft or wing. A plane is stalled when the angle of attack is beyond the stalling angle. Under Normal Law, the aircraft system would switch the elevator control to protection mode, so that the angle of attack is proportional to side-stick deflection. Even if the pilot pulls the side-stick all the way back, the angle of attack will not exceed the maximum. If the pilot releases the side-stick, the angle of attack returns to what it should be. This protection against stall and wind shear has priority over all other protections.
However, in Alternate Law, which the flight had been in since the Flight Augmentation Computers had been disconnected, this protection is overridden. When the audio stall warning goes off in Alternate Law, the flight crew recover from the impending stall by lowering the nose to reduce the angle of attack.
The first officer reacted instinctively to the mechanical voice calling STALL, STALL. The right side stick was at neutral and then moved forward for two seconds. The Angle of Attack decreased to below 8° and the stall warning stopped.
One second later, the right-side stick was pulled back again to 12°. The aircraft pitched up and began to climb at a rate of 11,000 feet/minute. The stall warning sounded again. This time, he did not react. He continued to pull back on the side stick and the aircraft continued to pitch up.
The captain called out, “level…level….” There were no side-stick inputs from the captain; he was almost certainly at the circuit breakers and would have found it difficult to get back to the seat.
He may have been referring to the previous high roll angle. In any event, the command appeared to focus the first officer on levelling the wings rather than paying attention to the pitch.
The aircraft continued to climb. The cockpit voice recorder recorded the captain saying “Oh my god!”
23:17:03 The first input from the left-side side stick was logged: the captain was in his seat and apparently attempting to take control of the flight. The first side stick input lasted two seconds. Fifteen seconds later, a second input was logged, also lasting two seconds.
If one pilot uses the side stick, it sends control signals to the computers. If both pilots use their side sticks simultaneously in the same or opposite direction, then the system adds the signals algebraically. Two green Side Stick Priority lights go on and a voice message activates which says DUAL INPUT, DUAL INPUT.
However, in this case the DUAL INPUT voice was overridden by the higher priority STALL, STALL, STALL.
In a stall situation, the captain can should take control of the situation and can take control of the aircraft. The standard call out is “I HAVE CONTROL” to which the other pilot should respond “YOU HAVE CONTROL”. If the captain was not taking control of the flight, then he should not have been touching the side-stick.
The captain could have stopped the dual input by pressing the priority push button which gives his seat priority while the button is depressed. If he held down the priority push button for 40 seconds or more, priority would have been transferred to him and no further input would have been accepted from the other side stick unless the first officer pushed the button to take it back. The captain pressed the push button twice, once for two seconds and once for five.
No comment about transfer of control was ever made. The captain never pressed the priority push button long enough to make a difference, let alone take control. Instead, they worked against each other: the first officer pulled back while the captain pushed forward.
23:17:15 The aircraft pitch reached 24° up. The captain called out “pull down, pull down!”
The captain was Indonesian and the first officer was French; they spoke to each other in English. It is unfortunate that in the heat of the moment, the captain used exactly the wrong phrase for what he wanted the first officer to do.
The aircraft speed was below the stall speed, the engines were on cruise power and the aircraft was descending at 12,000 feet per minute. The pitch and roll were near 0°; the aircraft appeared to be straight and level. This high altitude stall was not standardly taught as a part of pilot training and the first officer might not have ever realised the high angle of attack despite the stall warning and the buffet.
The airline did not train its pilots in Upset Recovery which might have helped the first officer to recognise the situation. Although Airbus’s operator’s training manual included this training, the airline’s Operations Manual said that
The effectiveness of fly-by-wire architecture, and the existence of control laws, eliminates the need for upset recovery maneuvers to be trained on protected Airbus.
The problem with an unstallable plane is that you can’t believe your eyes when it finally stalls.
23:17:29 The left-side side stick is used continuously from this point on. The captain never took priority, so the aircraft continued with dual input.
The average of the side stick inputs recorded on the flight data recorder indicated that the first officer was pulling almost full back input while the Captain was slightly pushing nose down. The sum of both side stick inputs commanded a nose-up pitch.
The aircraft descended at a rate of up to 20,000 feet per minute.
The pilot training for stalls teaches the pilot to recognise the indications of a stall condition and recover. The aircraft system is designed to prevent the stall by providing early warning. Both are intended to avoid the aircraft stalling. There is no training for dealing with an angle of attack over 40° and recovering from this is considered “beyond the competency of an airline pilot”.
Once the angle of attack reached 48°, there was nothing left that they knew how to do.
23:18 AirAsia flight QZ8501 disappeared from the Jakarta Radar controller’s screen.
According to the flight data recording, the STALL, STALL, STALL warning continued and the two pilots continued their dual input, the first officer pulling all the way back while the captain pushed gently forward, until the aircraft crashed into the Java sea.
- The cracking of a solder joint of both channel A and B resulted in loss of electrical continuity and led to RTLU failure.
- The existing maintenance data analysis led to unresolved repetitive faults occurring with shorter intervals. The same fault occurred 4 times during the flight.
- The flight crew action to the first 3 faults in accordance with the ECAM messages. Following the fourth fault, the FDR recorded different signatures that were similar to the FAC CB‟s being reset resulting in electrical interruption to the FACs
- The electrical interruption to the FAC caused the autopilot to disengage and the flight control logic to change from Normal Law to Alternate Law, the rudder deflecting 2° to the left resulting the aircraft rolling up to 54° angle of bank.
- Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted in the aircraft departing from the normal flight envelope and entering prolonged stall condition that was beyond the capability of the flight crew to recover.
One thing I’d like to add. Often, there’s an argument that pilots are no longer being taught how to hand fly and that modern airlines are becoming too reliant on technology. There’s no evidence for that in this instance.
The captain was an Air Force pilot for ten years, flying everything from jet fighters to transport planes. He was a flight instructor on single-engine propeller aircraft. He flew twins and propeller aircraft and Boeings as well as the Airbus A320 and had over 14,000 hours. You couldn’t ask for a more experienced pilot.
The full report is available in English on the KNKT site as a PDF.