Air Asia 8501: The Automation Failed First Followed by the Pilots

The final report on the crash of Air Asia 8501 was released on December 1st and serves to highlight a number of problems with highly automated aircraft and the pilots who fly them. If you'll recall, this was an A320 which crashed into the Java Sea killing all 162 passengers and crew last December.

In short, a broken solder joint had caused multiple fault indications in a rudder control unit during the flight. By itself this was not a huge problem, but when the captain attempted to reset some circuit breakers in response, the autopilot disengaged and the underlying rudder fault became a problem.

From the accident report:

The cracking of a solder joint of both channel A and B resulted in loss of electrical continuity and led to RTLU (rudder travel limiter unit) failure. The existing maintenance data analysis led to unresolved repetitive faults occurring with shorter intervals. The same fault occurred 4 times during the flight.  

The flight crew action to the first 3 faults in accordance with the ECAM messages. Following the fourth fault, the FDR recorded different signatures that were similar to the FAC CBs (circuit breakers) being reset resulting in electrical interruption to the FACs. 

The electrical interruption to the FAC caused the autopilot to disengage and the flight control logic to change from Normal Law to Alternate Law, the rudder deflecting 2° to the left resulting the aircraft rolling up to 54° angle of bank. 

Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted in the aircraft departing from the normal flight envelope and entering prolonged stall condition that was beyond the capability of the flight crew to recover.

So this crew was confronted with a technical issue which had recurred numerous times. It appears that the captain became frustrated with the repeated messages being generated by the faulty rudder unit and finally pulled the FAC circuit breakers. His goal was to reset the computers which he'd seen a maintenance technician do on the ground. It's an understandable impulse, and one that many users of computers have felt: if it's acting wonky, just reboot it.

It should also be noted that this procedure was unauthorized for the situation. The "electronic centralized aircraft monitor"or ECAM, is a display which alerts pilots if something goes wrong and also provides checklist steps to resolve the issue. Pulling circuit breakers is almost never called for and wasn't the correct procedure here. The captain got ticked at having to address the recurring issue and went off the script to apply his own "fix" by recycling the FAC circuit breakers.

The problem was that in resetting the computers, he was in effect sawing off the branch upon which he was sitting. To understand why, we need a little background on the airplane and its flight control systems. The highly automated Airbus has no direct mechanical linkage between the cockpit and the wings, but is rather controlled by a total of seven computers including two flight augmentation computers or FACs. These computers control the movement of the control surfaces using input from the pilots.

Alternate Law

The computers normally provide protection from unsafe flight regimes such as a stall or upset. However, when the computers sense that there is something wrong with their inputs, they revert to a mode known as "Alternate Law" where the computers no longer provide such protections. Pulling the circuit breakers, or essentially cutting power to the computers caused them to revert to alternate law.

It is here where the real problems began. In control of the aircraft at that time was the relatively inexperienced first officer who had just over 2000 hours total time. After the aircraft reverted to alternate law, the rudder malfunction manifested itself in a deflection of the rudder.

A deflected rudder at altitude can quickly upset a swept-wing transport like the A320 due to an aerodynamic phenomenon known as "roll coupling". This is where a yaw input, or movement about the vertical axis, induces a roll. It is an artifact of the swept-wing design of modern airliners and normally not a problem. Here it became a big problem.

Stall Warning

The aircraft immediately rolled to the left at a rapid rate and yet the first officer did not apply any stick input for 9 seconds, which is an eternity when your airplane is rolling over. This may have been due in part to the "startle effect" where a rapid and unexpected change takes some time to recover from or to "regain one's wits". Another possibility is that the first officer was not looking at the primary flight display but had his attention on the autopilot which had disengaged.

One of the primary rules of aviation is to "fly the airplane first", but after the relatively low workload of cruise, having to take manual control of the airplane can be disconcerting. Add to this the aural warnings of a disconnected autopilot and a rapid roll and there is little doubt that the first officer had his eggs scrambled at that point.

He did, however, manage to right the aircraft to a nearly normal bank. It was at this time, while the pilots were in manual control of the aircraft and without computer protection, that they killed themselves.

After the aircraft again rolled left, the first officer's side stick input was a sharp pull. This caused the rapid climb rate followed by a loss of airspeed and a stall. The data recorder showed input from the left side or captain's stick about 30 seconds after the initial roll but confusion on the part of the captain and apparent panic on the part of the first officer doomed the aircraft.

He had just over 2000 hours total time.

After the abrupt climb and stall, the captain instructed the first officer to "pull down" which is a rather confusing command. Pulling means that the nose will go up, not down. The first officer's reaction was to pull even harder on his stick which is the exactly wrong thing to do in a stall. The nose needed to be lowered so the airplane could regain flying airspeed. At the very least the first officer should have asked the captain what he meant, but in any event any aviator worth his salt knows that control forces must be relaxed, and angle of attack must be reduced in a stall. It's aviation 101. Or should be. 

Dual Input

It was also here that the electronic controls on the Airbus contributed to the problem. Unlike a Boeing which has a two control wheels which are connected mechanically, the side sticks on the Airbus can each provide separate, and opposite, instructions to the flight computers. The aircraft doesn't give priority to either pilot's inputs but rather sums the inputs for a resultant signal. So while the captain was making appropriate inputs to recover from the stall, the first officer maintained his hard pull which resulted in a net nose up command to the flight computers.

Another basic axiom of aviation is that only one pilot flies at a time, and it should always be clear who is in control of the aircraft. The captain failed here by not verbalizing his assumption of control to his copilot. A firmly annunciated "I have the aircraft" should have resulted in the first officer releasing his grip to allow the captain to recover from the stall. That never happened.

This is almost the exact scenario which doomed Air France 447 which I wrote about here. In that accident, a minor upset at altitude was exacerbated by one of the pilots maintaining a backwards pull on his side stick which didn't allow the recovery from a stall. Everyone perished in that crash.

Automation as Blessing...and Curse

A common theme on this blog has been that while the introduction and use of automation on airliners has been an overall boon to both safety and economics, it is not now, nor for the foreseeable future, going to be a replacement for having well qualified pilots who can actually fly airplanes.

That day will arrive eventually, but current technology simply can't yet replicate the required safety margins required to carry passengers.  

Automation has been widely deployed around the world by airlines which operate in countries that lack any significant general aviation or military aviation programs from which to draw pilots. Without these so-called "farm leagues" to train and groom pilots, the trend has been to take very inexperienced pilots with a bare minimum of flight time and to place them into highly automated cockpits. It is there that they will be expected to gain experience before moving into the left seat.

The problem is that highly automated cockpits offer virtually no real experience in real stick and rudder flying. The job consists of managing checklists and systems which the first officer on Air Asia 8501 no doubt accomplished adequately. He just couldn't fly the airplane out of a stall.

An old aphorism states that you can't tell who's swimming naked until the tide goes out. Don't get caught with a naked pilot.