Incident: AirAsia Flight 8501 Crash: Rudder System Failure and Crew Response

Published Date: 2015-12-01

Postmortem Analysis
Timeline 1. The software failure incident involving the crash of AirAsia Flight 8501 occurred in December 2014 as reported in [Article 53726] and [Article 53156].
System 1. Rudder travel limiter system on the Airbus A320-200 aircraft [Article 53156] 2. Circuit breaker system on the Airbus A320-200 aircraft [Article 53156]
Responsible Organization 1. The software failure incident on AirAsia Flight 8501 was caused by a technical fault in the rudder travel limiter system, specifically a cracked solder joint on a circuit board, which led to a loss of electrical continuity [53156]. 2. The crew's response to the technical fault, particularly the action of resetting the system by removing and replacing a circuit breaker in an attempt to clear the fault, also contributed to the software failure incident [53156].
Impacted Organization 1. AirAsia - The software failure incident impacted AirAsia as the operator of the Airbus A320-200 that crashed into the Java Sea due to a technical fault and crew response failure [Article 53156]. 2. Airbus - The incident also impacted Airbus as the manufacturer of the aircraft involved in the crash, specifically the Airbus A320-200 [Article 53156]. 3. Indonesia's National Transportation Safety Committee - The software failure incident impacted the committee as they were involved in investigating the crash of AirAsia Flight 8501 and determining the causes of the incident [Article 53156].
Software Causes 1. A technical fault in the computer system that helps control the plane's rudder [Article 53156]. 2. The crew's response to the technical fault, specifically attempting to reset the system by removing and replacing a circuit breaker, which disengaged the plane's autopilot and autothrust systems [Article 53156].
Non-software Causes 1. Mechanical failure involving the limiting deflection of the rudder system on the airplane [53726, 53156]. 2. Faulty component in the rudder system due to a cracked solder joint on a circuit board [53156]. 3. Inadequate maintenance response to the recurring mechanical issues with the rudder system [53726]. 4. Crew actions, including pulling a circuit breaker that disengaged the autopilot and autothrust systems [53156]. 5. Crew's inability to control the aircraft after the autopilot was disengaged [53156].
Impacts 1. The software failure incident involving a faulty component and crew response led to the crash of AirAsia Flight 8501 into the Java Sea, resulting in the tragic loss of all 162 people on board [53156]. 2. The mechanical failure of the rudder system, which had a history of problems on the same airplane, was a contributing factor to the crash [53726]. 3. The crew's actions, including pulling a circuit breaker that disconnected the autopilot and induced a failure in the rudder control system, played a role in the inability to control the aircraft, ultimately leading to the crash [53156]. 4. The crew's response to the software failure incident, such as improper control inputs and delayed reactions, exacerbated the situation and contributed to the aircraft entering a prolonged stall and upset condition [53156]. 5. The incident highlighted the importance of proper training and procedures for handling emergency situations, as well as the need for airlines to implement recommendations to prevent similar incidents in the future [53156].
Preventions 1. Proper repair of the faulty component - The mechanical failure involving the rudder system that occurred multiple times should have been repaired instead of just resetting and replacing parts without fixing the root cause [53726, 53156]. 2. Classification of the malfunction as a repetitive item - If the system issue had been classified as a repetitive item, the source of the malfunction might have been repaired, preventing the tragedy [53726]. 3. Improved crew training and procedures - Crew members should have been better trained to handle such situations, and proper procedures should have been in place to prevent overreactions and incorrect actions in response to system failures [53156]. 4. Enhanced communication and coordination between pilots - The lack of communication and coordination between the pilots, especially in taking control of the aircraft, contributed to the inability to recover from the stall. Improved protocols for transferring control and clear communication during emergencies could have helped prevent the crash [53726]. 5. Implementation of upset recovery training - Airlines should consider implementing upset recovery training, even if the aircraft is equipped with electronic protections, as these protections can degrade in certain circumstances, leading to unexpected situations like the one faced by AirAsia Flight 8501 [53726].
Fixes 1. Implementing recommendations given to the airline, many of which have already been implemented, to prevent similar incidents in the future [53726]. 2. Ensuring that the faulty component causing the software failure is repaired promptly and not classified as a minor issue, as it can lead to catastrophic consequences [53156]. 3. Providing commercial pilots with flight simulator training for emergency situations like the one that led to the crash of AirAsia Flight 8501 [53156].
References 1. Investigators from Indonesia’s National Transportation Safety Committee [Article 53156] 2. Retired Indonesian pilot and member of the investigation team, Nurcahyo Utomo [Article 53156] 3. Head of Indonesia’s National Transportation Safety Committee, Soerjanto Tjahjono [Article 53156] 4. Les Abend, a Boeing 777 captain and CNN aviation analyst [Article 53726]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the AirAsia Flight 8501 crash involved a mechanical failure with the rudder system that had occurred on the same airplane multiple times before the fatal crash. The faulty component, a crack in the electrical soldering, had caused issues at least 23 times prior to the accident [53726, 53156]. (b) The incident also highlighted that the rudder limiter system on the aircraft had problems on 23 occasions in 2014, indicating that similar issues had been experienced by other airlines or aircraft as well, not just limited to AirAsia [53156].
Phase (Design/Operation) design, operation (a) The software failure incident in the AirAsia Flight 8501 crash was primarily attributed to a technical fault related to a cracked solder joint on a circuit board, which led to a loss of electrical continuity in the rudder travel limiter system [53156]. This fault was a result of a design flaw or a manufacturing defect in the system. Additionally, the crew's response to the technical fault, specifically the action of resetting the system by removing and replacing a circuit breaker, exacerbated the situation and led to the disengagement of critical systems like the autopilot and autothrust, ultimately causing the loss of control of the aircraft [53156]. (b) The operation of the system, in this case, refers to the crew's actions in response to the technical fault. The crew's decision to reset the system in-flight by pulling and pushing back in a circuit breaker, a procedure sometimes used on the ground to clear software problems, had fatal consequences in the air. This operation error resulted in the disengagement of critical flight control systems, making it impossible for the pilots to maintain control of the aircraft [53156].
Boundary (Internal/External) within_system (a) The software failure incident related to the crash of AirAsia Flight 8501 can be categorized as within_system. The incident was caused by a technical fault in the rudder travel limiter system, specifically a cracked solder joint on a circuit board, which led to a loss of electrical continuity [53156]. This fault originated from within the system of the aircraft and was not directly caused by external factors such as weather conditions. The failure of the rudder travel limiter system, which restricted rudder movement at high speeds and altitudes, was a critical contributing factor to the crash [53156].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the AirAsia Flight 8501 crash was primarily due to non-human actions. The incident was caused by a technical fault related to a faulty component, specifically a cracked solder joint on a circuit board in the rudder travel limiter system [53156]. This fault led to a loss of electrical continuity, which contributed to the failure of the system and ultimately the crash of the aircraft into the Java Sea. The maintenance records showed that the rudder limiter system had experienced problems on 23 occasions in 2014, indicating a recurring issue with the system [53156]. (b) However, human actions also played a role in the software failure incident. The crew's response to the technical fault exacerbated the situation. An attempt to reset the system by removing and replacing a circuit breaker, a procedure sometimes used on the ground, had fatal consequences in flight as it disengaged the plane's autopilot and autothrust systems, leading to the pilots' inability to control the aircraft [53156]. Additionally, subsequent flight crew actions after the circuit breaker reset resulted in the aircraft entering a prolonged stall and upset condition beyond the capability of the crew to recover [53156].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The crash of AirAsia Flight 8501 was caused by a technical fault related to a cracked solder joint on a circuit board, which led to a loss of electrical continuity in the rudder travel limiter system [53156]. - The failure of the plane's rudder travel limiter system, which restricts rudder movement, was traced back to a cracked solder joint on a circuit board, indicating a hardware-related issue [53156]. (b) The software failure incident occurring due to software: - The incident involved a failed attempt by the crew to deal with the technical fault, which led to the disengagement of the plane's autopilot and autothrust systems, causing the pilots to lose control of the aircraft [53156]. - The crew's actions after the circuit breaker reset resulted in the inability to control the aircraft, indicating a software-related issue in terms of the response to the hardware failure [53156].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident related to the crash of AirAsia Flight 8501 was non-malicious. The incident was caused by a technical fault in the rudder control system and a failed attempt by the crew to deal with it, not by malicious intent. The failure involved a faulty component coupled with the crew's response, which led to the aircraft entering a prolonged stall condition that the crew could not recover from [53156]. The incident was attributed to a cracked solder joint on a circuit board, which caused a loss of electrical continuity in the rudder travel limiter system [53156]. The crew's actions, including pulling and pushing a circuit breaker to reset the system, disengaged critical systems like the autopilot and autothrust, leading to the loss of control of the aircraft [53156].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was poor_decisions. The incident involving the crash of AirAsia Flight 8501 was primarily caused by a technical fault related to a faulty component in the rudder system and a failed attempt by the crew to deal with it. The crew's decision to reset the system by removing and replacing a circuit breaker in-flight had fatal consequences as it disengaged the plane's autopilot and autothrust systems, leading to the pilots being unable to control the aircraft [53156]. Additionally, the crew's response to the mechanical failure, including pulling the circuit breaker, induced the failure of a portion of the rudder control system, ultimately causing the airplane to crash into the Java Sea [53726].
Capability (Incompetence/Accidental) accidental (a) The software failure incident in the AirAsia Flight 8501 crash was not attributed to development incompetence but rather to a technical fault and a failed attempt by the crew to deal with it. The crash was caused by a faulty component coupled with the crew's response, specifically the disengagement of the plane's autopilot and autothrust systems after a circuit breaker was pulled out and pushed in again, leading to electrical distraction and the pilots being unable to keep the aircraft under control [53156]. (b) The software failure incident in the AirAsia Flight 8501 crash was accidental, as it was caused by a technical fault in the rudder travel limiter system, specifically a cracked solder joint on a circuit board, which led to a loss of electrical continuity. The crew's attempt to reset the system by removing and replacing a circuit breaker in response to an alarm warning also contributed to the accident, with fatal consequences of disengaging the autopilot and autothrust systems [53156].
Duration permanent, temporary From the provided articles, the software failure incident related to the crash of AirAsia Flight 8501 can be categorized as both permanent and temporary: (a) Permanent Failure: The incident involved a permanent failure due to contributing factors introduced by all circumstances. The failure of the rudder travel limiter system, which restricts rudder movement, was a contributing factor that led to the crash. The investigators found a cracked solder joint on a circuit board, which caused a loss of electrical continuity, ultimately leading to the inability to control the aircraft [53156]. (b) Temporary Failure: The incident also involved a temporary failure due to contributing factors introduced by certain circumstances but not all. The crew's response to the technical fault, specifically the attempt to reset the system by removing and replacing a circuit breaker, led to disengaging the plane's autopilot and autothrust systems. This temporary action had fatal consequences as it caused electrical distraction and the pilots were unable to keep the aircraft under control [53156].
Behaviour crash, omission, other (a) crash: The software failure incident in the AirAsia Flight 8501 crash was a crash-type failure. The incident led to the system losing its state and not performing its intended functions, ultimately resulting in the airplane crashing into the Java Sea [53726, 53156]. (b) omission: The software failure incident also involved an omission-type failure. After the circuit breaker was removed and reinserted, the aircraft rolled hard to the left before leveling out. The aircraft then climbed at a steep angle and stalled, leading to a loss of control. The report mentioned that subsequent flight crew actions resulted in an inability to control the aircraft, indicating an omission in performing the intended functions [53156]. (c) timing: The timing of the software failure incident was not explicitly mentioned in the articles. (d) value: The software failure incident did not involve a value-type failure. (e) byzantine: The software failure incident did not exhibit a byzantine-type failure. (f) other: The other behavior observed in the software failure incident was the system behaving erroneously with inconsistent responses and interactions. For example, the crew's response to the technical fault led to the system disengaging the plane's autopilot and autothrust systems, causing confusion and an inability to keep the aircraft under control [53156].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence death, harm (a) death: People lost their lives due to the software failure. The consequence of the software failure incident in the AirAsia Flight 8501 crash was the loss of all 162 people on board, who tragically died when the plane crashed into the Java Sea [53726, 53156]. The software failure, coupled with the crew's response to the technical fault, led to the inability to control the aircraft, causing it to depart from the normal flight envelope and enter a prolonged stall condition that the flight crew could not recover from [53156].
Domain transportation The software failure incident discussed in the articles is related to the transportation industry (b). The failed system was on an Airbus A320-200 aircraft, which is used for passenger transportation [Article 53156]. The incident involved a technical fault in the rudder control system of the airplane, which led to the crash of AirAsia Flight 8501 [Article 53156]. The failure of the rudder travel limiter system, which restricts rudder movement, was a key factor in the accident [Article 53156]. The system failure, coupled with the crew's response to the fault, resulted in the inability to control the aircraft, leading to a prolonged stall condition beyond the crew's ability to recover [Article 53156].

Sources

Back to List