Blind to the Problem: The crash of Indonesia AirAsia flight 8501
Note: this accident was previously featured in episode 38 of the plane crash series on May 24th, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
On the 28th of December 2014, an Indonesian airliner disappeared over the Java Sea on its way to Singapore. As air traffic controllers tried unsuccessfully to contact it, the Airbus A320 climbed rapidly to 38,500 feet, turned over, and plunged into the ocean, taking with it the lives of all 162 passengers and crew. The black boxes, pulled from the sea floor along with the shattered wreckage of the plane, revealed how it happened, from its prosaic origins with a minor technical fault, to the flight’s terrifying last moments as it plummeted belly-first toward the water at 12,000 feet per minute. It was a sequence of events defined by poor judgement, even poorer communication, and a baffling absence of airmanship, as the captain’s ill-advised attempt to reset two critical computers spiraled into a needless and preventable loss of control. The most disturbing takeaway however, was that the accident was hardly unique — in fact, it quite clearly raised the specter of Air France flight 447, only this time with an Indonesian twist, as systemic problems in the country’s aviation industry created the conditions for the same type of accident to occur even after the lessons of flight 447 should have been learned.
◊◊◊
In July 2012, France’s Bureau of Inquiry and Analysis released its long-awaited final report on the crash of Air France flight 447, which plunged 35,000 feet into the Atlantic on the night of June 1st, 2009. The findings proved to be among the most explosive and consequential of any accident investigation of the 21st century, revealing how a loss of valid airspeed data caused two supposedly trained and professional pilots to descend into a state of panic, pulling back and stalling a plane which would have continued to fly normally if they had done nothing at all. The central problem was a lack of understanding of basic principles of flight, which had been allowed to arise from a sense of invulnerability imbued by their Airbus A330’s advanced flight envelope protections.
As designed, the A330, like all other modern Airbus models, could prevent the pilots from losing control, no matter how poorly they handled the stick — a fact which Air France pilots had come to take for granted, leaving the crew of flight 447 unprepared to react when those protections were unexpectedly removed. The lesson of the disaster was that pilot training around the world needed to go back to basics, inculcating pilots with an innate feel for the aerodynamic principles that underpin manual flight, even if they rarely have to apply them.
What follows, however, is not a feel-good story of the benefits of this safety revolution, but the story of an airline that so utterly failed to learn this lesson that one wonders whether they were even paying attention.
That airline was Indonesia AirAsia, the Indonesian branch of Malaysian multinational airline AirAsia, which has subsidiaries in countries throughout the region. The relationship between the two airlines is not quite that of a parent company and a subsidiary, however, as Indonesian law forbids foreign ownership of domestic airlines. Malaysia AirAsia holds a minority stake of 49%, with the rest owned by an Indonesian businessman, and while both airlines use the AirAsia brand, most of Indonesia AirAsia’s day-to-day operations are organized locally.
By 2014, Indonesia AirAsia operated a homogenous fleet of 25 Airbus A320s, including one registered as PK-AXC. This unremarkable aircraft was the one scheduled to operate Indonesia AirAsia flight 8501, a regular early morning international service from Surabaya, Indonesia to Singapore on the 28th of December 2014.
In command of the flight was 53-year-old Captain Iriyanto, who had been flying airliners since 1994 and had over 20,000 hours of experience. (Like many Indonesians, he used only one name.) His First Officer that day was a French national, 46-year-old Rémi Emmanuel Plesel, who had spent most of his life working in management at French oil conglomerate Total Energies, before making an abrupt career change in 2012. In December of that year, he was hired by Indonesia AirAsia straight out of flight training in France and placed into the right seat of the A320, where he had since accumulated about 1,400 flight hours.
At 5:35 a.m., with the sun not yet risen, flight 8501 lifted off the runway at Juanda International Airport in Surabaya, headed for Singapore. The plane was mostly full, with 162 people on board, including seven crewmembers and 155 passengers, of whom 41 were members of a single church group.
As the flight climbed away over the Java Sea, the pilots monitored a number of severe thunderstorms in their path, but this was not unusual in Indonesia in December. There was nothing to indicate the possibility of trouble, but at 5:57, the flight attendants warned the passengers of turbulence and instructed them to fasten their seat belts, just in case.
Three minutes later, having leveled off at their cruise altitude of 32,000 feet, the pilots were just about to settle in when a chime sounded in the cockpit, accompanied by the illumination of the Master Caution light. The pilots’ eyes were drawn immediately to the Electronic Centralized Aircraft Monitor, or ECAM, a display which provides information to the crew about the nature of technical faults. Sure enough, a message had appeared on the ECAM screen — “AUTO FLT RUD TRV LIM 1,” it said, using shorthand for “Auto Flight Rudder Travel Limiter 1.” Moments later, the chime sounded again, and the message changed to “AUTO FLT RUD TRV LIM SYS,” indicating that both channels of the Rudder Travel Limiting System had failed.
The rudder travel limiter is a computer-controlled device which artificially limits the maximum deflection of the rudder depending on the speed of the aircraft. The higher the speed, the greater the authority of the rudder; therefore the Rudder Travel Limiter Unit, or RTLU, progressively constricts the rudder’s range of motion in order to prevent large rudder inputs from overstressing the airframe at high speeds. The RTLU is not considered a safety-critical system, and should it fail, the crew need only be reminded not to make large rudder inputs — other than that, normal flight may continue.
In addition to the failure message, however, the ECAM screen also displayed instructions for rectifying the problem with the RTLU. Therefore, Captain Iriyanto called out “ECAM actions,” and the pilots set about following the troubleshooting directions. The procedure had only two steps: first, to turn the number one Flight Augmentation Computer (FAC 1) off and back on again; and second, to do the same with the number two Flight Augmentation Computer (FAC 2).
The two redundant Flight Augmentation Computers are part of the comprehensive computer network that makes up the Airbus A320’s fly-by-wire system. The Airbus A320, and all other modern Airbus aircraft, do not have direct mechanical connections between the cockpit controls and the primary flight control surfaces; instead, when the pilot makes an input using the side stick or rudder pedals, these commands are sent to a bank of computers that decides how far the control surface will deflect, depending on factors such as speed, flap setting, bank angle, and more. This system underpins the A320’s flight envelope protections, which prevent the pilot from flying too fast or too slow, banking more than 67 degrees, pitching up more than 30 degrees, inducing a G-load of more than 2.5 G’s, or exceeding the stall angle of attack (more on that later). Of these diverse functions, the two FACs were responsible for moving the rudder; processing speed information for the pilots’ displays; calculating the minimum and maximum allowable speeds; generating “wind shear” warnings; and calculating the “alpha floor,” the highest allowable angle of attack.
Normally, only FAC 1 is active, but should it fail, all its responsibilities can be transferred to FAC 2. Therefore, it was possible to turn each FAC off and back on again, one at a time, without interfering with the flight in any way. This is what the ECAM instructed the crew to do, and it is what they did — using the two FAC push buttons on the overhead panel, Captain Iriyanto reset the two computers, calling out “FAC one off, and on,” then “FAC two off, and on.” Sure enough, the fix worked, and the caution message about the RTLU went away.
Returning to their normal duties, the pilots observed a storm in their path, and First Officer Plesel called air traffic control to request a diversion. ATC authorized them to deviate around the storm, and Captain Iriyanto instructed the autopilot to take them left of their present course. Plesel then carried out the standard cruise briefing, discussing contingencies in case of problems on approach to Singapore.
Suddenly, at 6:09, a chime was heard and the master caution light illuminated again. The same message then reappeared on the ECAM screen: AUTO FLT RUD TRV LIM SYS, with instructions to turn the FACs off and back on again. Once more, Captain Iriyanto announced “ECAM actions,” and faithfully followed the instructions, causing the caution message to disappear.
The pilots turned their attention again to the weather, as the controller asked them to report when clear of the storm. First Officer Plesel then asked if they could climb to 38,000 feet, and was told to standby.
Before they could get an answer, the chime sounded and the master caution light flicked on, accompanied yet again by the ECAM message, AUTO FLT RUD TRV LIM SYS. The pilots carried out the ECAM actions, but the respite was brief. Less than two minutes later, at 6:15, the message came back for a fourth time. The problem simply refused to go away.
“Any computer reset?” Plesel asked.
“No computer reset,” said Iriyanto. Forget the ECAM actions, he decided — he had a better idea.
◊◊◊
Three days before flight 8501, on December 25th, Iriyanto had been rostered on another flight using the same aircraft, PK-AXC. As the flight was pushing back from the gate, the master caution light illuminated, and the AUTO FLT RUD TRV LIM SYS message appeared on the ECAM display. Iriyanto returned to the parking spot and summoned an AirAsia engineer to the cockpit to solve the issue. The engineer referred to the Airbus troubleshooting manual, where he found an applicable set of procedures which asked him to reset the circuit breakers for both FACs. It should be noted that pulling the circuit breaker is not the same as pressing the FAC push button, as the pilots were doing on flight 8501 — if the push button is like selecting “restart” from the menu on your computer, then resetting the circuit breaker is more like unplugging it from the wall and then plugging it back in again.
After the engineer reset all four circuit breakers associated with the two FACs, the caution message went away, and the problem appeared to be solved. Captain Iriyanto asked if he could reset the circuit breakers in this manner whenever the problem appeared, to which the engineer rather ambiguously told him to just follow the ECAM actions.
Minutes later, the plane pushed back from the gate a second time, only for the same fault message to appear again. The pilots tried the ECAM actions, restarting the FACs using the push buttons, but the message popped up again within seconds. Iriyanto summoned the engineer once more and told him, via the interphone, that the ECAM actions weren’t working, and asked if he could reset the circuit breakers. The engineer granted permission, and the first officer pulled the circuit breakers again — but the message still failed to clear. The pilots returned the plane to the parking spot again, the passengers disembarked, and the engineer worked out a temporary solution: he simply replaced FAC 2 with a module cannibalized from another aircraft. This seemed to resolve the issue, and Iriyanto then flew the plane to Kuala Lumpur and back without the problem recurring.
This event was still fresh in his mind when Iriyanto found himself aboard flight 8501, faced with a fourth consecutive AUTO FLT RUD TRV LIM SYS message within the space of 15 minutes. Restarting the FACs clearly wasn’t working, so it seems he decided it was time to up the ante. Without explaining his plan to First Officer Plesel, he reached up to the overhead panel and pulled both circuit breakers for FAC 1.
As soon as he did so, FAC 1 lost power, triggering the master caution light again, and a “FAC 1 FAULT” message appeared on the ECAM. In the background, the controller could be heard attempting to authorize flight 8501 to climb to 34,000 feet, but nobody replied. Iriyanto pushed the FAC 1 circuit breakers back in, then went to find the breakers for FAC 2.
Here it must be noted that pulling the FAC circuit breakers should never be attempted while the plane is in the air. In fact, the Flight Crew Operations Manual (FCOM) contained a list of all the computers whose breakers could be pulled in flight, as well as the conditions which would require such action, and the FACs were not on the list. Whether he knew it or not, Iriyanto had just committed a serious violation of the standard operating procedures — but he was not done yet, and in fact he was about to make things much worse.
What Iriyanto did not realize was that pushing the FAC circuit breakers back in merely restores power to the computer — it does not actually turn it back on. To restore FAC 1 to full operation, he would have had to press the FAC 1 push button on the overhead panel after resetting the breakers, but he didn’t do this. Consequently, the FAC functions were still being performed by FAC 2, and could not be transferred to FAC 1, when he got out of his seat, walked over to the rear wall panel behind the First Officer, and pulled both breakers for FAC 2 as well.
The consequences of this action were immediate and explosive. With both flight augmentation computers offline, the master caution triggered again, a FAC 1+2 FAULT message appeared on the ECAM, and every function administered by the FACs, from automatic rudder control to low speed warnings to alpha floor protection, was instantly lost. The autopilot disconnected with a loud cavalry charge alarm, the autothrottle disengaged, and the fly-by-wire system flipped from Normal Law to Alternate Law, shedding all of the Airbus’s flight envelope protections. And to make matters even worse, an errant rudder input sent the plane rolling to the left at a rate of six degrees per second, and with no computer control over the rudder, only the pilots could stop it.
Although events in the cockpit from that moment unfolded with stunning rapidity, it would serve us better to take a step back and examine what had actually happened, with a particular focus on the meaning of “Alternate Law.”
Readers familiar with the crash of Air France flight 447 might recall that the Airbus fly-by-wire philosophy incorporates several levels of computer authority over pilot inputs. In Normal Law, which is nearly always in effect during flight, the computers operate at full authority, and all flight envelope protections are active, preventing the pilots from making any inputs that would lead to a loss of control. However, a loss of valid data or the failure of multiple computers will cause the flight controls to enter Alternate Law, in which certain fly-by-wire functions are rescinded, most notably some of the flight envelope protections, which will not work unless all the computers are operating correctly. The computers will continue to modify some pilot inputs in order to produce control surface deflections commensurate with the airplane’s speed and configuration, but they will not and cannot prevent the pilots from banking too steeply or pitching too far up or down. Furthermore, in Alternate Law, the pilot must fly manually, and the autopilot cannot be engaged.
Had Captain Iriyanto understood that he was shutting off both FACs simultaneously, he might have been able to predict that this would disconnect the autopilot and put the controls into Alternate Law. In the event, however, he did not appreciate that resetting the circuit breakers for both FACs sequentially would trip both offline at the same time, and he was totally unprepared for the cascade of warnings which assaulted his senses. The voice recorder in fact captured him exclaiming, “Oh my god,” presumably as he pushed the FAC 2 circuit breakers back in, then scrambled over to his seat on the other side of the cockpit. First Officer Plesel, meanwhile, is thought to have diverted his attention to the ECAM screen, which now displayed numerous fault messages, including “AUTO FLT AP OFF” (autopilot off) and “F/CTL ALTN LAW (PROT LOST)” (flight control alternate law [protection lost]).
Amid the chaos, it took nine seconds for First Officer Plesel to realize that the plane was rolling rapidly to the left. By the time he grabbed his side stick to take manual control, the aircraft had reached 54 degrees of bank, far outside the normal operating envelope — so far, in fact, that it wouldn’t have been possible with the flight controls in Normal Law.* Startled by the massive, unexpected upset, he wrenched his side stick as far to the right as it would go, and the left bank reduced to 9 degrees in just two seconds. This even faster roll only deepened his disorientation, and he immediately countered again, sending the plane back to 53 degrees left. Now fully in the grip of uncontrolled panic, he tried to roll to the right again, but at the same time he tensed up and pulled back hard on his side stick, sending the plane rocketing into a climb.
*(For Airbus aficionados, I will note that it is possible to bank up to 67˚ in Normal Law, but the pilot must maintain side pressure on the stick, or else the bank angle will automatically return to 33˚. The plane will not bank beyond 33˚ on its own.)
◊◊◊
Climbing while at 32,000 feet must be attempted with care. A good explanation of why appeared in my article on Air France flight 447, and I will quote it here as well:
“Fundamentally, as angle of attack — the angle of the plane into the airstream — increases, lift increases, until it reaches the critical point and drops off rapidly, causing the plane to stall. Because the air is thin at high altitudes and provides little lift, a higher speed is necessary to keep the plane airborne, and the critical angle of attack is very low. Pitching up even a few degrees [while at high altitude] could place the plane on the edge of a stall.”
Normally, an Airbus cannot stall, even when the pilot pitches up at high altitude, because the flight envelope protections will not allow the angle of attack to exceed the critical point. This specific function, known as the alpha floor protection, ensures that the pilot cannot stall the aircraft even if they try. But in Alternate Law, there is no alpha floor protection — instead, there is an aural stall warning, featuring a clacker and a robotic voice that calls out the word “stall,” in order to compel the pilot to reduce the angle of attack.
On flight 8501, First Officer Plesel’s excessive nose-up inputs caused the angle of attack to increase until it triggered the stall warning, just seconds after the airplane started to climb. Captain Iriyanto, who had only just strapped himself into his seat, heard the stall warning and knew that the plane would stall unless they reduced the angle of attack by bringing the nose down. But in a tragic twist of fate, his tongue was tied by his lack of a common native language with First Officer Plesel. Because Iriyanto was Indonesian, and Plesel was French, they could only communicate in basic airman’s English, and their repertoire of non-standard phrases was probably limited. And so, at the moment when he needed to urge Plesel to push the nose down, what came out of his mouth was something else entirely: “Pull down,” he shouted. “Pull down! Pull down! Pull down! Pull down!”
When he first heard the stall warning, First Officer Plesel instinctively started to push forward on his stick to bring the nose down, and for one second the stall warning actually stopped, as his inputs began to have an effect. But before he could get far, he heard Captain Iriyanto yelling at him to “pull down,” and he reversed his input. The command to pull down was, of course, contradictory: one pulls the stick to go up, and pushes it to go down, so the phrase “pull down” is open to interpretation. Unfortunately, Plesel concluded that Iriyanto wanted him to pull back on his stick, so he did — all the way to the stop. The plane reared back and hurtled upward at a rate of 11,000 feet per minute, causing a catastrophic loss of speed and increase in angle of attack. The pitch of the airplane reached 48 degrees nose up, way beyond what would be allowed in Normal Law. The stall warning immediately burst back to life, calling out “STALL, STALL!” over and over again.
“What’s going wrong!?” Plesel exclaimed in French.
In a matter of seconds, the angle of attack reached the critical point, and the plane started to stall. Heavy buffeting rocked the aircraft as the airflow over the wings became turbulent and disorganized. Still pitched steeply upward, with the angle of attack approaching 44 degrees, the left wing lost lift and dropped like a rock, causing the plane to roll a dizzying 104 degrees to the left. The speed dropped to just 55 knots, and the altitude peaked at 38,500 feet. For a moment, the plane seemed to hang there, half way upside down, stall warnings blaring, engines straining — and then, with a gut-wrenching lurch, it began to descend.
At this point, with a shout of “My god,” Captain Iriyanto grabbed his own side stick in a desperate attempt to recover control. He rolled right to level the wings and pushed the nose forward to reduce the angle of attack, but he left out one critical step — he forgot to announce, “I have control.”
Unlike the control columns on Boeing aircraft, the side sticks used on modern Airbus models are not mechanically linked, and it is not possible for one pilot to feel the inputs made by the other. Instead, the two inputs are simply added together.
This system is designed with the expectation that pilots will communicate about who is in command, but can break down when this communication does not occur. If both pilots make simultaneous side stick inputs, an automated voice will call out “DUAL INPUT” in order to draw their attention to the problem — but on flight 8501, this warning never sounded, because the stall warning took priority. As a result of these factors, Captain Iriyanto probably never realized that First Officer Plesel had responded to his command to “pull down” by pulling the nose up, and was in fact still holding the side stick as far back as it would go.
Iriyanto could also have locked Plesel out of the controls by holding down his “side stick priority” button, but he never did, either because he didn’t know Plesel was pulling up, or because it failed to occur to him amid the chaos on the flight deck.
Despite having to fight against his First Officer, Iriyanto managed to get the wings level and the pitch angle down to 0 degrees by the time the plane reached 29,000 feet, but this did not bring the plane out of the stall. In fact, they were now falling belly-first toward the sea with an angle of attack of 40 degrees and a rate of descent of 12,000 feet per minute. This put the plane in a highly unusual configuration — the nose and wings were level, and the engines were at cruise thrust, but the aircraft was going down, not forward. Baffled by these conflicting indications, Iriyanto seems to have lost all trust in his instruments, as the flight recorders captured him switching his display to a backup data source to correct a faulty data problem which did not actually exist. The bizarre readings on his instruments were all correct, but the plane had by this time long since exited the A320’s experimentally validated flight envelope, and when faced with indications that no A320 pilot had ever seen before, he simply didn’t believe them.
The only way to recover from the stall at this point would have been to pitch steeply nose down, reducing the angle of attack back below the critical point. They would have needed to enter a steep, high-speed dive, losing thousands of feet of altitude, but they might have survived. Unfortunately, neither pilot ever grasped the nature and magnitude of the task which lay before them. Plesel never stopped pulling back on his stick, and Iriyanto’s half-hearted nose down inputs were insufficient to overcome his First Officer and bring the nose below the horizon. Instead, flight 8501 continued to fall toward the distant ocean, slowly spinning around and around, stall warnings blaring, buffeted by powerful vibrations, beyond any hope of recovery. On and on they went, plummeting inexorably downward, the bewildered pilots fighting over the controls, watching the end rise up to meet them. The forward airspeed reached 132 knots, and the rate of descent softened to 8,400 feet per minute, but still they kept falling, locked into a stall from which they would never escape. The altitude unwound steadily toward zero, until at last, at 6:20 and 35 seconds, Indonesia AirAsia flight 8501 slammed into the surface of the Java Sea and broke apart, with only a brief boom of thunder and a single, mighty splash to mark its passing, before the storm-tossed waters closed once more over the final resting place of the 162 passengers and crew.
◊◊◊
In the Jakarta area control center, controllers watched the entire death spiral of flight 8501 from beginning to end, trying desperately to contact it, only to watch as its altitude ticked down toward zero and its target disappeared, never to rise again. An emergency was declared, rescuers were dispatched, families were gathered at the airport in Singapore to learn the bad news — a routine which for Indonesians has become all too familiar. So was the routine of waiting for answers. After all, before investigators could say what happened to flight 8501, the search teams needed to find it.
Two days went by with no sign of the plane, before several items of floating debris, including an escape slide, luggage, and victims’ bodies, were spotted on December 30th. From there, the rest of the plane was located on the shallow floor of the Java Sea, under just a few dozen meters of water, some 100 kilometers off the coast of Borneo. Global media broadcast images of recovery crews raising the plane’s nearly intact vertical tail and aft cabin roof, followed by the center section, with both wings still attached. The relatively slow descent rate on impact, compared to other similar accidents, meant that much of the wreckage was still recognizable as an airplane — but that wasn’t enough to save the passengers and crew, who all died instantly when the plane smashed into the sea.
The investigation into the crash would be led, as always, by Indonesia’s National Transportation Safety Committee, or KNKT, with help from the French Bureau of Inquiry and Analysis, or BEA, representing the country of manufacture of the aircraft. Although the media speculated from the beginning about the potential role of the stormy weather through which flight 8501 was flying, the KNKT and BEA investigators probably suspected from the start that the cause lay somewhere else. Indeed, when the black boxes were retrieved from the sea floor and brought to Jakarta for analysis, they proved that the crash had nothing to do with the weather — and everything to do with the relationship between the pilots and their plane.
The sequence of events began with a series of malfunctions of the Rudder Travel Limiter Unit. To learn more about why, the unit was taken to the manufacturer, which found the problem right away: a bad solder joint in the RTLU electronic module had cracked, causing an intermittent electrical discontinuity affecting both channels of the RTLU.
According to the maintenance logs, pilots had reported problems with the RTLU on this aircraft 23 times over the course of 2014, including five times in November and nine times in December. The flight data recorder also suggested that there were probably many more instances that were not reported. So why was this recurring failure never addressed?
The answer lay with Indonesia AirAsia’s inadequate maintenance procedures. Investigators noted that maintenance engineers followed up on each RTLU malfunction by running the equipment’s built-in tests or resetting the FACs, which were the actions prescribed by the troubleshooting manual, but only for one-time occurrences. According to the manual, if the problem persisted, then the proper corrective action would be to replace the RTLU electronic module. This would have solved the problem, but it was never attempted. The likely reason was that engineers did not appreciate the recurrent nature of the fault, in part because the majority of instances were not being recorded in the technical log. In fact, at that time pilots in Indonesia were not required to note faults in the technical log, and failure to report faults was deeply imbued in the piloting culture of most Indonesian airlines. Nevertheless, the BEA believed that the engineers should have had enough information at their disposal to conclude that running the computer diagnostics and resetting the FACs was not solving the problem. In any case, however, the failure to replace the RTLU electronic module allowed the fault to persist long after it should have been solved, right up until it occurred again four times on flight 8501.
Although the failure itself was not serious, the repeated fault messages were distracting, and Captain Iriyanto seemed to grow more irritated each time the fault recurred. Recognizing that the prescribed ECAM actions weren’t solving the problem, he decided to try resetting the circuit breakers for both FACs instead, as he had learned from the engineer on the ground three days earlier. This action was not prescribed by any official procedure and was in fact prohibited in flight.
Some disagreement emerged between the KNKT and the BEA about whether he should have known this was prohibited and whether alternative courses of action existed. First of all, the BEA wrote that if the ECAM actions were not solving the problem, then there was nothing stopping the crew from simply clearing the ECAM messages and continuing the flight with the RTLU inoperative. The KNKT, for its part, disagreed, arguing that standard operating procedures obliged the crew to carry out the ECAM actions. Even if this was not allowed, however, it would have been much safer than what they actually did.
The second point was related to the Quick Reference Handbook of abnormal procedures, or QRH, which included a line that said, “WARNING: Do not reset more than one computer at the same time, unless instructed to do so,” and added that the pilots must “consider and fully understand the consequences” before pulling any circuit breaker in flight. Farther down the same section was the line, “In flight, as a general rule, the crew must restrict computer resets to those listed in the table,” followed by a table containing the list of computers that could be reset in flight. In the KNKT’s opinion, the words “as a general rule” and “consider and fully understand the consequences” could have led Captain Iriyanto to believe that he was allowed to reset the FAC circuit breakers as long as he knew the consequences, which he perhaps thought he did, having watched an engineer perform the procedure on the ground. On the other hand, the BEA felt that the language in the QRH was quite straightforward about which computers could be reset in flight and which could not.
As for whether the pilots “fully considered” the consequences before taking action, both parties agreed that they most likely did not. The KNKT wrote that during the 54 seconds between the last RTLU fault and the pulling of the first circuit breaker, the cockpit conversation was unintelligible, but that regardless, this was not enough time to develop and implement a plan to deal with the consequences of pulling the breakers. The BEA, on the other hand, wrote that the contents of the cockpit voice recording during these 54 seconds were “no less unintelligible” than any other part, and in fact there simply was no conversation, except for a brief exchange — “Any computer reset?” and “No computer reset” — which the KNKT did not mention in its final report. Either way, however, the pilots clearly did not know what they were getting into, and that lack of foresight fueled all the events which followed.
When Captain Iriyanto pulled the circuit breakers for FAC 1, he did not ensure that the computer was back online before pulling the breakers for FAC 2, resulting in the loss of both FACs and the consequent autopilot disconnection and reversion of the flight controls to Alternate Law. Furthermore, neither pilot was prepared to react to this sudden reversion to manual flight. When the plane started rolling to the left, First Officer Plesel reacted in a panicked and uncoordinated fashion, making several large roll inputs before pulling the nose up, putting the plane into a steep climb. Such a reaction could perhaps have been avoided if, prior to pulling the breakers, the pilots had discussed what Plesel should do in the event of adverse consequences, but they had not.
From there, the pilots failed to react to the stall warnings in a coherent and coordinated manner. They might have managed to muddle their way to a safe outcome eventually, but Captain Iriyanto’s contradictory exhortation to “pull down” injected even more confusion into the situation. First Officer Plesel should have known that he needed to push down, not pull up, in response to a stall warning, but for whatever reason, he interpreted “pull down” as a command to pull up, so that’s what he did, and in fact he never stopped pulling up until the plane hit the water — just like the First Officer on Air France flight 447 five years earlier.
Rémi Emmanuel Plesel and the Air France 447 First Officer, Pierre-Cedric Bonin, were both products of French flight schools during the same general time period. They both spent only a couple hundred hours flying light aircraft, barely enough to gain an intuitive understanding of flight dynamics, before being placed aboard highly automated Airbus jets that did not require them to spend much, if any time flying manually. And when faced with a sudden, unexpected disconnection of the autopilot, both reacted by instinctively pulling up, even though there was no cause to do so. The common denominator between them was a lack of understanding of the aerodynamic principles which allow airplanes to fly — and which cause them to stop flying if handled improperly. A pilot who understands these principles would never pull the nose up in response to a stall warning, even if the captain told them to, because they would know that this inevitably results in a stall.
Both Bonin and Plesel lacked this sort of aeronautical common sense in part because they had spent their entire flying careers nestled within the comforting embrace of the flight envelope protections. They never had to worry about stalling the airplane, because the airplane would not allow itself to stall, even if they pulled the stick all the way back. Without rigorous training or opportunities to fly by hand, this environment allowed their aeronautical intuition to atrophy until it disappeared. That’s not to say there’s anything inherently wrong with flight envelope protections — in fact, they are probably a net safety benefit — but it is the responsibility of airlines to train their Airbus pilots to fly as though the protections are not there, or else pilots will be at greater risk of losing control if the protections are unexpectedly withdrawn.
In the event, that was exactly what happened. Suddenly finding himself in manual flight at 32,000 feet, something he had probably never done in an Airbus in real life, Plesel made a series of nonsensical inputs that sent the plane hurtling uncontrollably upward. The plane rose to its zenith, stalled, and plummeted toward the sea, but Plesel, like Bonin, seemingly never grasped the fact that his inputs were causing the plane to stall — he simply kept pulling up in the dogged belief that if he did, the plane ought to stop descending.
Investigators identified two training blind spots which contributed to this disastrous failure of airmanship. For one, the airline’s training in high altitude stalls was quite different from the situation in which the pilots actually found themselves. In the training scenarios, the plane would maintain level flight while its speed slowly decreased and its angle of attack slowly increased, until the onset of the stall warning. The pilots were then trained to react by pushing the nose down to the horizon to reduce the angle of attack and avoid the stall. The scenarios did not allow the stall to actually take place, and they did not involve a steep climb at a high pitch angle, as occurred on the accident flight.
Responding to a high pitch angle emergency is not normally part of stall recovery training, but it is included in upset recovery training. Readers of my recent article on Sriwijaya Air flight 182 will recall that this training provides pilots with communication strategies and flying techniques that will help them recover from “in-flight upsets,” such as high bank angles, high or low pitch angles, excessive or insufficient airspeed, and various combinations thereof. Had the pilots received this training, Captain Iriyanto would have been taught standard callouts which he could use to identify a nose high upset and suggest corrective action. These callouts would have given him the tools he needed to compel First Officer Plesel to push the nose down, while in the actual event he had to rely on his own limited knowledge of English, resulting in the misleading command to “pull down.” Interestingly, however Indonesia AirAsia’s A320 flight training manual actually did prescribe upset recovery training — so why did the pilots’ records show that they never received it?
The answer, which garnered only a passing mention in the KNKT’s final report, blows the case wide open when considered in context. As it turned out, Indonesia AirAsia was not actually providing A320 pilots with upset recovery training, even though this was part of the official training curriculum. The reason was right there in the company’s Flight Operations Manual: “The effectiveness of fly-by-wire architecture and the existence of control laws,” it said, “eliminate[s] the need for upset recovery maneuvers to be trained on protected Airbus aircraft.”
This statement is so glaringly false, so brazen in its naïveté, that it’s hard to imagine it was written by an aviation professional. In 2014, the industry was perfectly aware that the existence of flight envelope protections does not make Airbus aircraft immune to loss of control accidents. Air France flight 447 should have been the final nail in the coffin for this dangerous mentality. It was a flashing red warning to the aviation industry about the dangers of letting Airbus pilots believe that they were invulnerable. And yet, five and a half years after the Air France disaster, and two and a half years after the publication of the BEA’s damning conclusions, here was Indonesia AirAsia, still espousing the same dangerously incorrect philosophy which made the crash of flight 447 inevitable.
This abject failure to learn the most obvious lesson from flight 447 was sadly symptomatic of the broader aviation safety culture in Indonesia. In fact, if you read my recent article on the 2021 crash of Sriwijaya Air flight 182, much of what has been said thus far probably sounds pretty familiar, from the pilots’ inability to react to a sudden in-flight upset, to the airline’s failure to properly apply the troubleshooting manual to identify and fix a recurring mechanical problem. In fact, this type of accident has been happening in Indonesia for some time, dating back at least as far as the 2007 crash of Adam Air flight 574, which also went out of control while the pilots were attempting to resolve a minor computer glitch. The fact that this was a known problem in Indonesia makes Indonesia AirAsia’s decision not to give upset and recovery training to its Airbus pilots even more unforgivable.
In 2014, upset and recovery training was not mandatory in Indonesia, which was how the airline got away with this short-sighted policy. In the wake of the crash of flight 8501, however, that finally changed. As a result of a KNKT recommendation stemming from the disaster, Indonesia’s Directorate General of Civil Aviation mandated that all Indonesian airlines provide their pilots with upset and recovery training beginning in 2018. As the recent Sriwijaya Air crash showed, however, implementation and enforcement have been uneven, as Sriwijaya Air’s half-hearted attempt to provide upset recovery training proved insufficient to prevent the pilots of flight 182 from losing control of their Boeing 737, more than six years after the crash of flight 8501 highlighted the extent of Indonesia’s training deficiencies.
◊◊◊
The crash of Indonesia AirAsia flight 8501 is a stark example of the risks of belligerently clinging to an outdated ideology that subordinated human responsibility to a blind belief in technological progress. Well-known former NTSB investigator John Goglia described the accident as “utterly preventable” — certainly by the pilots, who failed to exercise good judgment and common sense — but especially by the airline, which could not have failed to hear about the harsh lessons of what is now one of the most studied accidents in aviation history, but for whatever reason, chose not to learn them. It is possible that the driving factor was the bottom line — better training wasn’t required, so why lay down the capital to implement it? Unwilling to go the extra mile, Indonesia AirAsia buried its head in the sand, insisting that loss of control accidents are not an Airbus problem. One cannot even say that the crash proved them wrong, because they were already wrong, and the rest of the world knew it. Instead, 162 people lost their lives, enduring four straight minutes of terror, before it was all so needlessly ended, their collective fate sealed by a company that failed to teach its pilots to just fly the airplane.
_________________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 230 similar articles
