The National Transportation Safety Committee (NTSC) of Indonesia has released their final report on the December 2014 crash of Indonesia AirAsia flight QZ8501, which plunged into the Java Sea while enroute from Surabaya to Singapore-Changi International. As with any accident, this crash occurred after a series of cascading events took place, ultimately resulting in the deaths of all 162 passengers and crew onboard.

Airliner crash investigations are painstakingly exhaustive, and rarely the result of any single incident (the recent Metrojet Airbus crash in Egypt could be one of those rare instances) but more often the chain of cascading events that lead to an unrecoverable situation. Indonesia’s NTSC identified several contributing factors in their final report, so let’s take a look at what happened.

Three days prior to the crash of QZ8501, the Airbus A320 registered PK-AXC was operating a flight from Surabaya to Kuala Lumpur. The same captain (with over 20,000 total hours, over 4600 in type) made a call to maintenance with a failure of the rudder travel limit system. After resetting the flight augmentation computer (FAC) circuit breakers, the problem went away, only to resurface shortly. Upon replacing the #2 FAC, the aircraft departed for Kuala Lumpur without incident.

Fast forward to December 28^th, and the same captain was flying the same aircraft out of Surabaya with the first officer acting as pilot flying. Once enroute, the Flight Data Recorder (FDR) showed the master caution activating four times with the rudder travel limiter failure. After the first three master cautions, the crew complied with the Electronic Centralized Aircraft Monitoring (ECAM) procedure. Yet on the fourth, the FDR recorded a different response, this time akin to the action several days prior of resetting the FAC circuit breakers. This action produced a less than desirable (but not yet dangerous) result when the master caution activated again as a result of the FAC 1 & 2 faults. Consequently, the autopilot and auto-throttle systems failed and the aircraft’s flight control logic switched from Normal Law to Alternate Law.

The newly re-energized FACs created a sudden rudder deflection of 2° left. That might not sound like much, but for a jet traveling along at cruise speed it is sufficient to cause an upset. The A320 began an uncommanded bank, rolling left at a rate of 6° per second, reaching 54° before any pilot input was recorded. The first officer’s control input however, was full up and right, and the aircraft almost returned to wings level but quickly rolled left again, this time to 53° of bank. Since the FO continued to hold backpressure on the stick, the aircraft began climbing at a rapid rate, up to 11,000 feet per minute.

With that rate of climb the airspeed rapidly decreased and soon the stall warning activated, and soon after the captain also began making control inputs and continued doing so until impact with the ocean. The FO also stayed on the controls, applying mostly maximum back pressure for the now short remainder of the flight.

So here’s the situation. An aircraft’s nice and stable cruise flight is upset, and the response from the FO is to pull fully back on the stick. The airplane begins to stall, and the stall warning should have been a trigger for the crew to promptly apply the stall recovery procedure. The captain adds opposite control inputs and says “pull down” (an entirely misleading and ambiguous command). So both pilots have their hands on the sidestick, but give differing inputs. Who’s really in control?

The normal sidestick logic averages each of the inputs, so with the FO pulling all the way back on the sidestick and the captain pushing forward slightly, the average command was still nose up – not the stall recovery procedure. Airbus incorporated a cutout, so that whoever presses the sidestick takeover pushbutton allows for positive control to be maintained, but doesn’t deactivate the other pilot’s sidestick at the outset. Pushing the takeover button for at least 40 seconds deactivates the opposing sidestick and had the captain exercised that option, it could have resulted in AirAsia 8501 recovering from the stall.

It’s entirely possible that both pilots were simply unaware of what the other was doing and what control inputs were being made. In contrast to the traditional center-pedestal yoke controls on most other airliners, the Airbus utilizes a side-stick design with the stick outboard of each pilot. This means that instead of being able to directly see and observe the other pilot’s control inputs right in front of you on a yoke, the much smaller control stick on your side remains stationary regardless of the other pilot’s inputs. Usually this isn’t a problem, but when you find yourself in a deep stall and literally dropping from the sky, clear and appropriate communication between pilots is absolutely imperative.

The aircraft stalled and descended towards the ocean at up to 20,000 feet per minute, maintaining an angle of attack (AOA) of about 40 degrees which is well above the A320’s critical angle of attack.

The AirAsia Airbus Flight Crew Training Manual (FCTM) states that: “The effectiveness of fly-by-wire architecture and the existence of control laws eliminate the need for upset recovery maneuvers to be trained on protected Airbus aircraft.” Clearly this is has proven to be an absurd statement, with several in-flight upsets resulting in fatal crashes even in recent years. Sound familiar at all?

The QZ8501 investigation report continues, “FBW (Fly by Wire) and conventional aircraft on FBW aircraft, following certain malfunctions, in particular in case of sensor or computer failure, the flight controls cannot ensure the protections against the stall.” This is very similar to Air France 447, an Airbus A330 that crashed off the coast of Brazil in June 2009. When the autopilot was disconnected after disagreements in airspeed indications, the pilot flying (PF) fought the airplane all the way to the water by applying maximum back pressure on the stick, having never fully realized the A330 was stalling.

Part of the design philosophy of Airbus, and the associated training, is to recover the aircraft from a stall when the warning is activated – an “approach to stall” – while not actually stalling the aircraft. This same philosophy was present in US airlines as well, prior to the crash of Colgan 3407 in February 2009. The problem with this philosophy is that it doesn’t involve recovering an aircraft from an upset situation – it simply attempts to avoid the situation altogether. While admirable and effective for the most part, this means that some situations can take a crew by surprise, like QZ8501 and AF447. Flight crews, having never been in a similar situation, can easily become overwhelmed and initiate the wrong response.

An additional contributing factor was the rudder travel limiter system failure that had surfaced 23 times in the previous year, with the number of events spiking sharply in the weeks prior to the crash. It was eventually linked to cracking in the soldering on the electronic module of the Rudder Travel Limiter Unit.

Though troubling in and of itself, this annoying AUTO FLT RUD TVL LIM SYS failure message should not have caused a modern Airbus to plunge into the ocean. It took a non-standard procedure (pulling circuit breakers to reset the system in-flight) resulting in further system failures, followed by a crew that was not well-versed in recovering an aircraft from the subsequent upset or unusual attitude situations and did not maintain positive control over the aircraft.

While stalls and other unusual attitudes can be somewhat replicated in high-fidelity full-motion simulators, hands-on experience in an aircraft as part of an upset recovery program provides numerous benefits for aircrews that might find themselves in a seemingly perilous situation. Unfortunately these programs are not cheap, and airlines aren’t exactly scrambling to use their millions in baggage fees to send their pilots through specialized upset training. Though it won’t bring back the lives lost in AF447 or QZ8501, programs like this might help save lives in the future, and that alone is worth the investment.

(Featured image: AP Photo/Achmad Ibrahim)