Crash Flight QZ8501 Under Individual or Collective Maintenance Responsibility

On 28 December 2014, an Airbus A320-216 aircraft registered as PK-AXC was being operated by PT. Indonesia Air Asia on a scheduled flight from Juanda International Airport Surabaya, Indonesia to Changi International Airport, Singapore. The aircraft departed at 0535 LT (2235 UTC, 27 December 2014) and was cruising at 32,000 feet (FL320) via ATS (Air Traffic Services) route Mike 635 (M635) with total occupants of 162 persons. The Pilot in Command (PIC) acted as Pilot Monitoring (PM) and the Second in Command (SIC) acted as Pilot Flying (PF).	Em 28 de dezembro de 2014, uma aeronave Airbus A320-216 registrada como PK-AXC estava sendo operada pela empresa privada Indonesia Air Asia num voo regular a partir do Aeroporto Internacional de Juanda, Surubaya, Indonésia para o aeroporto Internacional de Changi, Singapore. A aeronave partiu às 05:35 Local Time (22:35 UTC, em 27 DEZ 2014) e estava cruzando a 32.000 pés (Flight Level 320) na rota ATS (Serviços de Tráfego Aéreo) Mike 635 (M635) com o total de 162 pessoas a bordo. O Piloto em Comando (PIC) atuava como Pilot Monitoring (PM) e o Segundo Piloto em Comando (SIC) atuava como Pilot Flying (PF).
The totals of 162 persons were on board this flight consisted of two pilots, four flight attendants and 156 passengers including one company engineer.	O total de 162 pessoas que estavam a bordo deste voo consistia de dois pilotos e quatro comissários de bordo e 156 passageiros, incluindo um engenheiro de empresa.
The sequence of events was retrieved from both of Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR).	A sequência de eventos foi recuperada de ambos os gravadores, Flight Data Recorder (FDR) e  Cockpit Voice  Recorder (CVR).

The way pilots responded to a technical malfunction resulted in the crash of Air Asia Flight QZ8501, investigators said Tuesday [DEC 29, 2015]. The ill-fated plane was en route to Singapore from the Indonesian city of Surabaya on December 28 last year when it crashed into the Java Sea, killing all 162 people on board.	A maneira que os pilotos responderam a um mau funcionamento técnico resultou no acidente da Air Asia Voo QZ8501, os investigadores disseram na Terça-feira [29 DEZ 2015]. O malfadado avião estava em rota para Singapura a partir da cidade Indonésia de Surabaia, em 28 de Dezembro no ano passado quando ele caiu no Mar de Java, matando todas as 162 pessoas a bordo.
The plane’s flight control computer had a cracked solder joint that kept malfunctioning. Aircraft maintenance records found it had malfunctioned 23 times in the year before the crash, and the interval of those became shorter in the three months prior to the crash. “Subsequent flight crew action resulted in inability to control the aircraft… causing the aircraft to depart from the normal flight envelope and enter a prolonged stall condition that was beyond the capability of the flight crew to recover,” Indonesia’s National Transport Safety Committee said in a report.	O computador de controle de voo do avião que o mantinha funcionando teve uma junta de solda rachada. Nos registros da manutenção da aeronave descobriu-se que ela [aeronave] tinha sofrido mau funcionamento 23 vezes no ano antes do acidente, e o intervalo desses maus funcionamentos tornou-se mais curto nos três meses antes do acidente. "A ação subsequente da  tripulação de voo resultou na incapacidade de controlar a aeronave... causando à aeronave afastar-se do envelope de voo normal e entrar em uma condição prolongada de estol que foi além da capacidade da tripulação de voo para recuperar [o voo normal]," O Comitê Nacional de Segurança de Transporte da Indonésia disse em um relatório.
The investigation concluded that contributing factors to this accident were: ·	A investigação concluiu que os fatores contribuintes para este acidente foram:
·         The cracking of a solder joint of both channel A and B resulted in loss of electrical continuity and led to RTLU failure.	·         A quebra de uma junta de solda de ambos os canais, A e B, resultado da perda de continuidade elétrica e que conduziu à falha da RTLU. [Rudder Travel Limiter Unit = Unidade Limitadora do Percurso do Leme].
·         The existing maintenance data analysis led to unresolved repetitive faults occurring with shorter intervals. The same fault occurred 4 times during the flight.	·         A análise de dados de manutenção existentes conduziu para as falhas repetitivas não solucionadas ocorrendo em intervalos mais curtos. A mesma falha ocorreu 4 vezes durante o voo.
·         The flight crew action to the first 3 faults in accordance with the ECAM messages. Following the fourth fault, the FDR recorded different signatures that were similar to the FAC CB‟s being reset resulting in electrical interruption to the FAC‟s.	·         A ação da tripulação de voo para as 3 primeiras falhas em conformidade com as mensagens do ECAM [Electronic Centralized Aircraft Monitoring]. Após a quarta falha, o FDR [Flight Data Recorder] gravou sinais diferentes que eram semelhantes aos [sinais] do  FAC CB‟s [Flight Augmentation Computer circuit brakes = fusíveis elétricos] reposicionados resultando em interrupção elétrica para os FAC‟s.
·         The electrical interruption to the FAC caused the autopilot to disengage and the flight control logic to change from Normal Law to Alternate Law, the rudder deflecting 2° to the left resulting the aircraft rolling up to 54° angle of bank.	·         A interrupção elétrica do FAC causou ao piloto automático desengajar e à lógica de controle de voo para mudar de Normal Law para Alternate Law, [e  ainda causou] a deflexão do leme 2° para a esquerda, resultando a aeronave rolar até o ângulo de 54° de inclinação lateral.
·         Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted in the aircraft departing from the normal flight envelope and entering prolonged stall condition that was beyond the capability of the flight crew to recover.	·         A ação subsequente da tripulação de voo conduziu à incapacidade para controlar a aeronave [no modo] Alternate Law o que resultou na aeronave saindo do envelope de voo Normal e entrando na condição  prolongada de stall que foi além da capacidade da tripulação de voo para recuperar.

RUDDER and YAW DAMPER

RUDDER and LOADS

CONSIDERATIONS

• The rudder deflection is the sum of:

– the order from the pedal input

– the order from the “Yaw Damper” function.

• This deflection is limited by the RTLU (Rudder Travel Limit Unit) for structural considerations.

• The Rudder trim merely moves the pedals.

Role of the “Yaw Damper” on FBW aircraft: A320

• The “Yaw Damper functions are achieved by the ELAC when handflying the Aircraft:

– Dutch Roll Damping and Turn Coordination

– Lateral Control Law objectives (eg: ß = f(rudder pedal), engine out …)

• The FAC transmits the ELAC rudder deflection orders to the Y/D actuator and achieves the Rudder Travel Limit function.

Operational Consequences

• On most commercial A/C, the rudder

MUST NOT BE USED:

– to induce Roll,

– to counter Roll induced by any type of turbulence,

– for turn coordination (exceptionally in Direct Law, with a double hydraulic failure where YD is lost).

• On most commercial A/C, the rudder

IS ACTUALLY USED ONLY:

– during T/O and LANDING Roll,

– in case of Engine Out, as a yaw corrective action,

– during the last phase of a flare with crosswind for decrab purpose.

  

• On most commercial A/C:

– there is no need to act on the rudder abruptly,

– in case of failure leading to a loss of TLU, the rudder is to be used with   care, as per ECAM,

– there is no roll control restriction with an engine failed.

Aircraft Airbus 320-216 Flight Controls Laws

AIRBUS FLIGHT CONTROL LAWS
High AOA Protection	Load Factor Limitation	Pitch Attitude Protection
NORMAL LAW
High Speed Protection	Flight Augmentation (Yaw)	Bank Angle Protection

Low Speed Stability	Load Factor Limitation
ALTERNATE LAW
High Speed Stability	Yaw Damping Only

	Load Factor Limitation
ABNORMAL ALTERNATE LAW w/o Speed Stability
	Yaw Damping Only

DIRECT LAW

FLIGHT CONTROL LAWS SUMMARY
NORMAL LAW
Normal operating configuration of the system. Failure of any single computer does not affect normal law. Covers 3-axis control, flight envelope protection, and load alleviation. Has 3 modes according to phase of flight.
Ground Mode	Active when aircraft is on the ground. Direct proportional relationship between the sidestick deflection and deflection of the flight controls. Is active until shortly after liftoff. After touchdown, ground mode is reactivated and resets the stabilizer trim to zero.
Flight Mode	Becomes active shortly after takeoff and remains active until shortly before touchdown. Sidestick deflection and load factor imposed on the aircraft are directly proportional, regardless of airspeed. With sidestick neutral and wings level, system maintains a 1 g load in pitch. No requirement to change pitch trim for changes in airspeed, configuration, or bank up to 33 degrees. At full aft/fwd sidestick deflection system maintains maximum load factor for flap position. Sidestick roll input commands a roll rate request. Roll rate is independent of airspeed. A given sidestick deflection always results in the same roll rate response. Turn coordination and yaw damping are computed by the ELACs and transmitted to the FACs. No rudder pedal feedback for the yaw damping and turn coordination functions.
Flare Mode	Transition to flare mode occurs at 50' RA during landing. System memorizes pitch attitude at 50' and begins to progressively reduce pitch, forcing pilot to flare the aircraft In the event of a go-around, transition to flight mode occurs again at 50' RA.
Protections	Load factor Limitation Prevents pilot from overstressing the aircraft even if full sidestick deflections are applied. Attitude Protection Pitch limited to 30 deg up, 15 deg down, and 67 deg of bank. These limits are indicated by green = signs on the PFD. Bank angles in excess of 33 deg require constant sidestick input. If input is released the aircraft returns to and maintains 33 deg of bank. High Angle of Attack Protection (alpha): When alpha exceeds alpha prot, elevator control switches to alpha protection mode in which angle of attack is proportional to sidestick deflection. Alpha max will not be exceeded even if the pilot applies full aft deflection High Speed Protection: Prevents exceeding VMO or MMO by introducing a pitch up load factor demand. The pilot can NOT override the pitch up command. Low Energy Warning: Available in CONF 2,3, or FULL between 100' and 2,000' RA when TOGA not selected. Produces aural "SPEED SPEED SPEED" when change in flight path alone is insufficient to regain a positive flight path (Thrust must be increased).

UTC (Universal Time Coordinate) is the primary time standard by which the world regulates clocks and time. It is, within about 1 second, mean solar time at 0° longitude; it does not observe daylight saving time. It is one of several closely related successors to Greenwich Mean Time (GMT). Local time of the point of departure and the accident site was UTC + 7.  

The sequence of events retrieved from both of Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR) were as follows:

2231 UTC, the aircraft started to taxi.

2235 UTC, the aircraft took off.

2249 UTC, the flight reached cruising altitude of 32000 feet (Flight Level 320).

At 2257 UTC, the PF asked for anti-ice ON and the flight attendant announced to the passengers to return to their seat and fasten the seat belt due to weather condition and possibility of turbulence.

At 2300 UTC, the Electronic Centralized Aircraft Monitoring (ECAM) amber advisory AUTO FLT RUD TRV LIM 1 appeared. The PF asked “ECAM action”.

At 2301 UTC, FDR recorded failure on both Rudder Travel Limiter Units and triggered a chime and master caution light. The ECAM message showed “AUTO FLT RUD TRV LIM SYS” (Auto Flight Rudder Travel Limiter System). The PIC read and performed the ECAM action of AUTO FLT RUD TRV LIM SYS to set Flight Augmentation Computer (FAC) 1 and 2 push-buttons on the overhead panel to OFF then to ON one by one. Both Rudder Travel Limiter Units returned to function normally.

At 2304 UTC, the PM requested to the Ujung Pandang Upper West2 controller to deviate 15 miles left of track for weather avoidance and was approved by the controller. The aircraft then flew on a heading of 310°.

At 2306UTC, the SIC conducted cruise crew briefing including in the case of one engine inoperative or emergency descent and that Semarang Airport would be the alternate airport.

At 2309 UTC, the FDR recorded the second failure on both Rudder Travel Limiter Units and triggered a chime and master caution light. The pilots repeated the ECAM action and both Rudder Travel Limiter Units returned to function normally.

At 2311 UTC, the pilot contacted the Jakarta Upper Control3 controller and informed that the flight turned to the left off the M635 to avoid weather. The information was acknowledged and identified on the radar screen by the Jakarta Radar controller. The Jakarta Radar controller instructed the pilot to report when clear of the weather.

At 2312 UTC, the pilot requested for a higher level to FL 380 when possible and the Jakarta Radar controller asked the pilot to standby.

At 2313:41 UTC, the single chime sounded and the amber ECAM message “AUTO FLT RUD TRV LIM SYS” was displayed. This was the third failure on both Rudder Travel Limiter Units on this flight. The pilots performed the ECAM actions and the system returned to function normally.

At 2315:36 UTC, the fourth failure on both Rudder Travel Limiter Units and triggered ECAM message “AUTO FLT RUD TRV LIM SYS”, chime and master caution light.

At 2316 UTC, the Jakarta Radar controller issued a clearance to the pilot to climb to FL 340 but was not replied by the pilot. The Jakarta Radar controller then called the pilot for several times but was not replied.

At 2316:27 UTC, the fifth Master Caution which was triggered by FAC 1 FAULT followed by FDR signature of alteration 4of parameters of components controlled by FAC 1 such as RTLU 1, Windshear Detection 1 and Rudder Travel Limiter Actuator 1.

At 2316:44 UTC, the sixth Master Caution triggered by AUTO FLT FAC 1 + 2 FAULT and followed by FDR signature of alteration of parameters of components controlled by FAC 2 such as RTLU 2, Windshear Detection 2 and Rudder Travel Limiter Actuator 2. The Auto Pilot (A/P) and the Auto-thrust (A/THR) disengaged. Flight control law reverted from Normal Law to Alternate Law. The aircraft started to roll to the left up to 54° angle of bank.

Nine seconds after the autopilot disengaged, the right side-stick activated. The aircraft roll angle reduced to 9° left and then rolled back to 53° left. The input on the right side-stick was mostly pitch up and the aircraft climbed up to approximately 38,000 feet with a climb rate of up to 11,000 feet per minute.

At 2317:18 UTC, the stall warning activated and at 2317:22 UTC stopped for 1 second then continued until the end of recording.

The first left side stick input was at 2317:03 UTC for 2 seconds and at 2317:15 UTC another input for 2 seconds, then since 2317:29 UTC the input continued until the end of the recording.

The right side stick input was mostly at maximum pitch up until the end of recording.

The lowest ISIS speed recorded was 55 knots. The ISIS speed recorded fluctuated at an average of 140 knots until the end of the recording.

At 2317:41 UTC the aircraft reached the highest ISIS altitude of 38,500 feet and the largest roll angle of 104° to the left. The aircraft then lost altitude with a descent rate of up to 20,000 feet per minute.

At approximately 29,000 feet the aircraft attitude was wings level with pitch and roll angles of approximately zero with the airspeed varied between 100 and 160 knots. The Angle of Attack (AOA)5 was almost constant at approximately 40° up and the stall warning continued until the end of recording. The aircraft then lost altitude with an average rate of 12,000 feet per minute until the end of the recording.

At 2318 UTC, the aircraft disappeared from the Jakarta Radar controller screen. The aircraft last position according to the Automatic Dependent Surveillance- Broadcasting (ADS-B) radar was on coordinate 3°36‟48.36”S - 109°41‟50.47”E and the aircraft altitude was approximately 24,000 feet.

The last data recorded by FDR was at 2320:35 UTC with ISIS airspeed of 132 kts, pitch 20° up, AOA 50° up, roll 8° to left, the rate of descent 8400 ft/minute and the radio altitude was 118 feet. No emergency message was transmitted by the crew.

Characteristic of pitch and lateral

Pitch Control

When the PF performs sidestick inputs, a constant G-load maneuver is ordered, and the aircraft responds with a G-Load/Pitch rate. Therefore, the PF‟s order is consistent with the response that is "naturally" expected from the aircraft: Pitch rate at low speed; Flight Path Rate or G, at high speed.

So, if there is no input on the stick:

• The aircraft maintains the flight path, even in case of speed changes

• In case of configuration changes or thrust variations, the aircraft compensates for the pitching moment effects

• In turbulence, small deviations occur on the flight path. However, the aircraft tends to regain a steady condition.

Airbus Pitch Characteristic

Sidestick Pitch (P) input Positive (+) value means nose down input

Sidestick Roll (R) input Positive (+) value means aircraft rolls to the left

Rudder Position Positive (+) means left rudder input (left yaw)

Elevator Position Positive (+) means TE down (nose-down)

Trimmable Stabilizer (THS) Position Range: -13.5° to +4° Positive: trailing edge (TE) up (nose-down)

Aileron Position Positive (+) means trailing edge (TE) down (nose up).

Operational Recommendation:

From the moment the aircraft is stable and auto-trimmed, the PF needs to perform minor corrections on the sidestick, if the aircraft deviates from its intended flight path. The PF should not force the sidestick, or over control it. If the PF suspects an over control, they should release the sidestick.

Lateral Control

When the PF performs a lateral input on the sidestick, a roll rate is ordered and naturally obtained.

Therefore, at a bank angle of less than 33°, with no input on the sidestick, a zero roll rate is ordered, and the current bank angle is maintained. Consequently, the aircraft is laterally stable, and no aileron trim is required.

However, lateral law is also a mixture of roll and yaw demand with:

‐ Automatic turn coordination

‐ Automatic yaw damping

‐ Initial yaw damper response to a major aircraft asymmetry.

In addition, if the bank angle is less than 33°, pitch compensation is provided. If the bank angle is greater than 33°, spiral stability is reintroduced and pitch compensation is no longer available. This is because, in normal situations, there is no operational reason to fly with such high bank angles for a long period of time.

Airbus Lateral Characteristic

Operational Recommendation:

During a normal turn (bank angle less than 33°), in level flight:

• The PF moves the sidestick laterally (the more the sidestick is moved laterally, the greater the resulting roll rate - e.g. 15°/s at max deflection)

• It is not necessary to make a pitch correction

• It is not necessary to use the rudder.

In the case of steep turns (bank angle greater than 33°), the PF must apply:

• Lateral pressure on the sidestick to maintain bank

• Aft pressure on the sidestick to maintain level flight.

Rudder Travel Limitation

This function limits rudder deflection based on speed in order to avoid high structural loads. It is governed by the following law:

If both FACs lose the rudder travel limitation function, the value of the rudder deflection limit is locked at the time of the second failure.

When the slats are extended, the FACs automatically set the rudder deflection limit at the low-speed setting (maximum authorized deflection).

The CVR contained 2 hours and 4 minutes of good quality recording data. The significant excerpts from the CVR are as follow:

Airplane Upset: An airplane in flight unintentionally exceeding the parameters normally experienced in line operations or training:

• Pitch attitude greater than 25 degree, nose up.

• Pitch attitude greater than 10 degree, nose down.

• Bank angle greater than 45 degree.

• Within the above parameters, but flying at airspeeds inappropriate for the conditions.  

The summary of the examination found the electronic cards shows the evidence of cracking of soldering of both channel A and channel B. Those cracks could generate loss of electrical continuity and lead to a TLU failure.

Thermal cycles associated to powered/not-powered conditions and ground/flight conditions, generate fatigue phenomenon of the soldering, and may result in soldering cracking. Soldering cracking could induce a disconnection of components from the circuit. The disconnections could create a loss of the affected RTLU channel.

The electronic module pictures are shown above.