Aftermath: It Just Doesn’t Compute

The rudder travel limiter of the Indonesia AirAsia Airbus A320 began acting up in January 2014. Attempts to fix it were unsuccessful, and failures became increasingly frequent. In the course of 74 flights between December 19 and December 27, 2014, the airplane’s electronic centralized aircraft monitoring system, or ECAM, reported more than 30 faults. Many crews, evidently advised that the system, which limits rudder deflection above 160 kias, was unreliable, simply left it alone if a fault occurred.

On December 25, however, the captain of a departing flight in that aircraft, observing the fault annunciation just after pushback, summoned a maintenance technician. The technician resolved the problem by pulling and resetting the circuit breakers on the main flight computers. The pilot asked whether he could always use that technique 
to reset the limiter, and the technician replied that the 
pilot could “whenever instructed on the ECAM.”

What the technician did was quite different from what previous crews had done and different from the ECAM procedure, which is to press the reset buttons for the two main flight computers. The reset buttons, which do not interrupt power to the computers, are overhead, within easy reach of the pilots. The ECAM said nothing about the main flight computer circuit breakers, which are on a separate panel well behind the pilots’ seats and out of their reach.

No sooner had the airplane pushed back again than the same fault occurred. The captain reached the technician by telephone and asked whether he could reset the main computer breakers. The official account omits the technician’s reply, but he, observing through the cockpit  windows, saw the first officer get out of his seat. The inference is that he got up to reach the breaker panel.

When this still did not resolve the problem, the airplane returned to the gate, and one flight computer was replaced. The rudder limiter fault did not recur, and the flight from Surabaya to Kuala Lumpur and back took place without further incident.

This annoying, but essentially trivial, event was soon to have massive consequences. On December 28, the same captain was in charge of the same aircraft, this time flying from Surabaya to Singapore. The first officer was the pilot flying. They were cruising at FL 320 when the ECAM announced a rudder limiter fault. Repeatedly 
the pilots pressed the reset buttons, only to have the fault reappear after a few minutes.

When the fault recurred for the fourth time, someone apparently pulled and reset the main flight computer circuit breakers, one after the other. Who did it and what discussion preceded the action are unclear because whatever conversation the cockpit voice recorder contained, if any, is not included in the accident report.

What happened next is remarkably similar to what happened on Air France Flight 447, the Airbus A330 that went down in the mid-Atlantic in 2009. The autopilot disconnected and the fly-by-wire flight control system reverted to “alternate law,” dropping its protections against stalling. The airplane rolled into a steep left bank. After leveling the wings, the right-seat pilot for some reason held his stick full back. The airplane climbed to FL 380, stalled, and settled into a stable post-stall descent at 12,000 fpm in a level pitch attitude but with an angle of attack of 40 degrees.

During the agonizing descent, the captain pushed his control stick nose-down while repeatedly telling his French-speaking copilot to “pull down,” an instruction that could only have confused him. But the 20,000-hour captain, who was experienced in many types and categories of aircraft and probably recognized that the A320 was stalled, neither verbally asserted control nor held the priority button on his sidestick long enough to take over. Neither pilot can feel the other’s stick inputs, and if they differ, the airplane averages them. As a result, neither pilot had effective command of the airplane, which, after three minutes, slammed into the sea, killing all 162 people on board.

The Indonesian accident investigation authority, the KNKT, like the French BEA but unlike our NTSB, does not assign blame for an accident. Commentators, however, did not hesitate to accuse the crew of putting a “perfectly good airplane” into the ocean. Indeed, the crew’s actions, starting with turning off the main computers to solve a minor rudder problem, were at first ill-advised and then, when all hell broke loose, inept. Some writers, including our own Les Abend in a column for CNN online, pointed out that there was enough blame to go around. The airline, on the theory that in an Airbus an upset can never occur, did not provide its 
pilots with upset training, and its maintenance crews had failed to remedy a problem — a cracked solder joint — that had persisted for nearly a year.

The French BEA, consulting with the Indonesians, noted the similarity of this accident to AF447. Only by reading the BEA’s analysis of that accident, however, can you understand the aerodynamic situation both airplanes found themselves in and why recovery, which was not impossible, would have required at least one of the pilots to understand the relationship between the airplane’s level pitch attitude, its low indicated airspeed, and its high rate of descent. The Airbus PFD, on the reasoning that it would add complexity, does not include angle of attack information in the pilots’ flight displays.

Both this crew and the Air France crew were unable to disentangle the seemingly conflicting messages from their flight displays. No doubt the concept that an airliner could be in a stable descent with a 40-degree angle of attack while appearing to be in level flight is far outside most line pilots’ training or imagination. But there was a further difficulty: To understand the concept required complex thinking. The Indonesian report is crammed with indigestible detail, and the translation to English is rather a hard slog. But near its end is a section of surprising limpidity, obviously written by a native English speaker, of great importance to pilots. It is, in fact, an unacknowledged crib from the Flight Crew Human Factors Handbook of the British Civil Aviation Authority.

Titled “Surprise and Startle,” the chapter deals with the fact that fear impairs the ability of pilots to deal with a confusing situation. The gist is that in a sufficiently stressful fight-or-flight situation, the brain 
rejects complex reasoning and instead confines itself to simple, instinctive reactions. This will not come as a surprise to any pilot who has experienced a life-threatening emergency in the air, and it helps to explain the apparent paralysis of the AirAsia and AF447 crews. The “right stuff” in test pilots is perhaps an innate lack of susceptibility to this sudden increase in mental viscosity.

Airbus software makes no allowance for the unreliability of a startled crew. It might be helpful after an autopilot disconnect if some very basic form of stability augmentation, no more complicated than a wing leveler, survived to prevent the airplane from rolling and to allow the crew to analyze the situation without having to hand-fly at the same time. And while I’m redesigning Airbuses, it seems to me beyond debate that angle of attack should be displayed on the PFDs and that the two sidesticks ought to be mechanically connected.

Another thing that I think could have saved both airplanes, though I don’t expect to see it in cockpits any time soon, is a computer-synthesized outside-in display of the airplane, such as any flight simulator program or game can provide. A rotatable 3-D image with a direction-of-flight arrow added would have made the situation clear without requiring complex intellectual analysis.

But perhaps it would be too childishly simple for an Airbus.