Air Asia flight QZ850: A Tale of Two Rudders
The deadly saga of rudders behaving badly may not be over. On 28 December 2014, Air Asia flight QZ8501, an A320 bound for Singapore from the Indonesian city of Surabaya, pitched into the Java Sea, killing all 162 aboard.
Indonesian air investigators are expected to release their report shortly. It was supposed to have been released in August, but promises of a release date must be regarded skeptically. The political, engineering, and human factors issues could involve significant wrangling and discussions to resolve.
The case has many aspects which surrounded the crash of American Airlines flight 587 in November 2001. Shortly after takeoff from New York’s LaGuardia Airport, the rudder effected a reversal — from a deflection on one side rapidly to the other — and the resultant aerodynamic forces ripped the tailfin from the A300-600. The plane plunged into the Belle Harbor residential area in New York City, killing all 260 aboard and five persons on the ground.
During the National Transportation Safety Board (NTSB) hearings into the crash, there was considerable debate over the cause of the rudder reversals that led to structural failure of the tailfin.
Some witnesses from the airplane’s manufacturer, argued that First Officer Sten Molin, the handling pilot, had a history of over-aggressive use of the rudder. To correct the flight path as a result of a wake turbulence encounter, they said he wapped the rudder to the full left/right defection limits, causing structural overload that ripped the tailfin off the aircraft and put it into an unrecoverable dive. They argued that American Airlines’ advanced maneuvering program for pilots, which Molin had completed, predisposed pilots to make excessive use of rudder inputs.
Other experts, including pilot training officials from American Airlines and assorted aerodynamicists, argued that extremely short and light forces on the rudder pedals would yield full deflection with only 1.2 inches of pedal travel, leading to aircraft pilot coupling (APC). APC is a phenomenon in which pilot control inputs can be out of phase with the airplane’s reaction, thereby negatively reinforcing the negative aircraft response.
The NTSB concluded that the rudder control system, in the memorable words of staffer Malcolm Brenner, was “an inherently unfriendly design”.
On 28 May 2004 the NTSB recommended that the rudder travel limiter on A300-600 and A310 designs be modified to prevent rudder reversals. The rudder travel limiter system progressively reduces rudder deflection with an increase in airspeed. The rudder is large and it can induce overwhelming loads on the tailfin if its movement is not restricted at greater airspeeds.
The NTSB was concerned that large rudder pedal forces in the cockpit could result in “rudder pedal position substantially exceeding the designed travel limit.”
Thus, NTSB recommendation number A-04-044 proposed a design modification to the rudder control system such that it would not be “adversely affected” by pedal forces.
What followed was the usual exchange of detailed letters between the Federal Aviation Administration (FAA) and the NTSB — five pages of fine print just to summarize the letters’ contents. The last letter from the FAA informed that Airbus has launched a thorough study of the A300-600 rudder system. On the basis of this declaration, the NTSB closed recommendation A-04-044 as “acceptable action”. Note that the original NTSB recommendation included design modifications and, by implication, their installation. Yet, three years after the accident, the NTSB was apparently satisfied with a promissory note to study the design.
Therefore, this sorry state of affairs culminated even though NTSB technical staffers had developed a means by which the rudder travel limiter design could be made safer.
Meanwhile, reports of uncommanded rudder movement continue to be filed with the FAA.
In August 2013, one of many Service Difficulty Reports (SDRs) submitted on Airbus rudder problems indicated for an A319: “During climb … crew reported three uncommanded rudder inputs. Each input increased in severity. Acft on autopilot… [replaced] nr 1 yaw damper servo actuator … Test flight satisfactory. Cause: actuator Airbus P/N [part number] SC47005 faulty.”
Indeed, since the crash of American Airlines flight 587, a total — as of this writing — of 37 SDRs have been filed regarding uncommanded rudder movements (yaws, kicks, surprise movements, etc.) on A300, A319 and A320 aircraft.
Pilot reports submitted anonymously to the Aviation Safety Reporting System (ASRS) — eight since the crash in 2001 — paint a more gripping picture of rudder systems behaving unnervingly all on their own.
Here are extracts of selected accounts:
- In 2002 aboard an A300-600: “While moving rudder during flt ctls chk [flight controls check] … I noticed that the acft fuselage shuddered violently with an unusual vibration that seemed to start in the rear of the acft and progress forward … [maintenance investigated and cleared the aircraft] …The aircraft was again presented to me for flt on Wed night … I encountered the exact same problem while checking the rudder and taxied the acft back to the chocks. I then informed the company duty officer that I felt unsafe flying what I believed to be a defective acft. I have filed 2 flt safety rpts with company and have notified both the plt’s association union safety office and the FAA safety hotline. It is my opinion the acft has a serious defect with the rudder and I consider it totally unsafe and unfit for flt.”
- In 2002 aboard an A300-600: “I was the captain of [the] flight … during climb out of 10,000 ft, co-pilot and I noticed a yawing motion of the acft, very small in magnitude, as if someone was pushing on the rudder pedals (L and R, and R and L) back and forth. We tried to identify the prob by looking at the ECAM [Electronic Centralized Aircraft Monitoring display] page and noticed slight rudder movements without either of us pushing on the rudder pedals…”
- In 2007 aboard an A320, with the captain declaring an emergency and diverting the flight to the nearest airfield: “I noticed what I thought of as ‘slipperiness’. It seemed like the airplane was slipping a little, as if driving on an icy road … I disengaged the autopilot in smooth air and immediately noticed a jerky yaw. I think it had been there before, but it was more noticeable when hand-flying due to knowing which inputs were mine versus the computer’s. There was no rhythm or smoothness to it. It seemed random, would sometimes jerk left, then left again before jerking right. I told my FO [first officer] ‘that’s not me’ … we paid very close attention to the flight control page once was discovered the anomaly and, to us, it looked like the rudder was being commanded to do what it was doing … I was later asked by maintenance if it could have been a loose actuator or bearing, but having had that problem before, I don’t believe it was. There was no vibration that I could feel at any time during the flight, and the movements of the rudder were larger and more deliberate.”
- In 2008 aboard an A319: “On downwind to RWY 10 L [runway 10 left] … there occurred about 3 or 4 rapid and pronounced lateral displacements of the aircraft … it felt like uncommanded rudder inputs … these occurred while the autoplt [autopilot] was engaged … upon arrival at the gate … I related our experiences to both the … maintenance crew and the oncoming aircraft flt crew. I stressed my concerns that this may indicate a very serious condition. I offered to stay and speak with the maint ctl [maintenance control] representatives (this was a layover leg), but was told that would not be necessary. I do not know what corrective actions were then taken.”
- In 2014 aboard an A319: “Descending through FL [flight level] 240 [24,000 ft.] at 320 kts [knots]. On autopilot, we experienced rudder movement (back and forth wagging) with no input from the flight crew. It was significant enough to hear a thumping noise on the flight deck and enough movement to cause a flight attendant in the rear of the aircraft to fall against the wall/bulkhead… I have no idea what caused this uncommanded rudder movement. We received no ECAM malfunction indications in flight and post flight maintenance reports indicated all normal.”
There is compelling evidence — albeit anecdotal — that some Airbus jetliners have a rudder problem. Most unnerving to the pilots, the problem manifests as surprise movement of the rudder, without any pushing of the rudder pedals by the pilots’ feet.
Which brings us to the crash of the Air Asia A320. From various accounts — not yet substantiated by the overdue investigation — the following sequence of events appears to have occurred:
Approaching a line of thunderstorms at 32,000 feet, the crew made a radio call to air traffic control requesting permission to deviate left, then a second request to increase altitude to 38,000 feet. Other aircraft were in the vicinity, so Jakarta Area Control Center radioed approval to climb to 34,000 feet.
No response was received from the pilots.
A radar plot shows the aircraft climbing rapidly, making a complete circle to the left before disappearing. The cockpit voice recorder, recovered from the undersea wreckage, captured the sound of multiple warnings before impact with the water.
A rudder limiter fault was occurring, and Captain Iriyanto got out of his seat to pull the circuit breakers. First Officer Rémi Plesel, a French national, was the handling pilot.
As the captain moved to the circuit breaker panel, the aircraft started to roll, achieving 40 degrees due to the rudder dispacement. Plesel attempted to rapidly ailerson roll the aircraft back in the original direction, causing upset and loss of control, i.e., a crossed controls situation.
Captain Iriyanto had flown the aircraft previously and had experienced a rudder limiter problem. Maintenance personnel had reset the circuit breakers behind his seat. When the same ECAM message came on during the accident flight, Captain Iriyanto got out of his seat to similarly trip and reset the circuit breakers located behind him.
His actions are thought to have triggered a rudder control reaction, causing FO Plesel to subsequently over-control with side stick and rudder pedal inputs. It is not clear whether Captain Iriyanto succeeded in pulling or resetting the breakers. Pulling and resetting circuit breakers affecting flight control surfaces while under loading from pilot inputs is very questionable. It is quite different from resetting a nulled-out system on the ground. It could be likened to experimentally pulling and resetting fuel control circuit breakers in flight. You would not a high degree of optimism and sub-system knowledge not to expect an engine flame-out in consequence. There are actions that can be taken on the ground (or in a simulator) with impunity, but that should never to attempted while airborne.
What is evident is that a series of abrupt oscillations occurred, leading to excessive pitch up and roll attitudes. The captain could not get back to his seat in time to recover the aircraft — if that was even possible. It must be said that leaving one’s seat to pull and reset circuit breakers to address a flight control issue is seriously non-standard within aviation.
Plesel’s over-controlling with sudden alternating control inputs — if verified by the flight recorder — recalls the NTSB analysis of FO Molin’s inputs preceding the crash of the American Airlines A300-600 at New York in 2001.
In the Air Asia accident, the cockpit crew’s actions may come under scrutiny, if not criticism, but the aberrant rudder limiter system, the previously ineffective maintenance actions, and the basic design of the rudder control system merit a thoroughgoing analysis — and correction. Undesirable feedback, stiction, gyrations, surface flutter and other characteristics are right at the top of “undesirables” for pilots.
One could also argue that the fatal crash in the Java Sea tarnishes greatly the NTSB’s reputation for rigorous investigations and diligent follow-through. The investigation did not fully account for all the reports of Airbus rudder malfunctions (at least 13 before the crash) and did not insist on corrective actions throughout the Airbus fleet. Instead of saving lives, the NTSB may well have left the poor design door open for more lives to be lost.