AIR ASIA A320 Accident - Java Sea
28 Dec 2014

Loss of rudder travel limiter
Report released today 1 Dec 2015

Historical Background

On Mar 1/1962, an American Airlines 707 rolled over and crashed into Jamaica Bay after take-off from NY Intl Airport (Idlewild, later JFK).  The aircraft dug a 10 ft deep crater in the mud at the bottom of the bay.  After retrieving wreckage, it was determined the rudder had experienced an uncommanded deflection.

The Board determines that the probable cause of this accident was a rudder control system malfunction producing yaw, sideslip and roll leading to a loss of control from which recovery action was not effective.

The malfunction described was caused by a signal generated by a short circuit in the rudder servo unit.  The short occurred between two damaged wires in the unit.  Inspection of other units found similar wire damage, leading to inspection of units on the manufacturer's assembly line.  More damaged units were found there and  it was "determined that this damage had occurred as a result of improper use of tweezers when tying the wire bundles to the motor housing."  (My recollection of this was that the culprit was actually a pair of needle-nosed pliers that had small nibs on the clamping surfaces that punctured the wire insulation when they were used to grasp a wire.)

Truly a case of "For want of a nail, the Kingdom was lost."  The full report here:

http://specialcollection.dotlibrary.dot.gov/Document?db=DOT-AIRPLANEACCIDENTS&query=(select+738)

The CAB Recommendations included inspecting all units in the field (see note at bottom of page.)

On December 28, 2014, an Air Asia Airbus A320 experienced a loss of control in cruise flight over the Java Sea and dove into the ocean.  The proximate cause was an uncommanded rudder deflection that caused the aircraft to experience a roll that in turn led to an upset from which the crew was unable to recover.  The cause of the rudder deflection was an intermittent conductivity in a rudder control unit caused by cracks in the unit's electrical solder joints.  The Probable Cause could have been lifted verbatim from the 1962 Accident Report.

My Analysis

This Air Asia accident is an instant replay of the Air France A330 accident in the S. Atlantic, and the Air New Zealand A-320 accident near Perpignon, France, and is reflective of the dangers of having the French Accident Investigation authority - the BEA - involved in any accident involving a French built aircraft.

In the Air France accident, the airspeed sensing pitot probes iced over and caused the system to think the airspeed had dropped to unsafe levels.  The BEA report rambles on about crew training and CRM issues without ever getting to the main point.  In fact, there had been several dozen previous pitot icing incidents - several were serious - with little attention by Airbus or EASA, the European aviation safety authority.

In the ANZ accident, the AOA vanes froze at altitude following water ingress during washing, and resulted in erroneous air data inputs and subsequent FBW flight control problems, stall and loss of aircraft control.  The BEA accident report mentions the primary cause merely in passing and concentrates the report on irrelevant subjects such as having adequate flight test procedures and crew qualifications to perform flight tests after maintenance.  Frozen AOA vanes had also been experienced before.

In the most recent Air Asia case, cracked solder joints on a circuit board resulted in loss of electrical continuity and failure of a rudder control unit.  The flight crew mishandled the resulting condition (as did the Air France and ANZ crews) -  a likely outcome in the Airbus Fly-by-Wire flight control architecture.

The cracked solder joints were buried in the unit and caused repeated and intermittent failures.  These type failures are very difficult to pinpoint and were unlikely to be uncovered by the operator's maintenance shops.  Line Maintenance performed their usual activities, resetting, conducting BITE checks, replacing units.  Actually, the failed unit had been returned to the manufacturer, who found no fault.  Examination of the crashed unit was performed by the BEA using high powered magnification equipment.  No operators would examine failed line units to this extent, nor would they be expected to.  The resulting intermittent failures would result in continual "bench checks OK" findings as units cycle through the avionics shops.

Airbus was aware of  cracking of these solder joints and had opened a TFU (Technical Follow-Up) in 1993 to improve the circuit board.  This TFU was closed in 1996.  When the fix did not fix the problem, another TFU was opened in 2000 to make further improvements to the solder connections.  In 2002, another "improved" board was released to correct the problems.  This TFU was not closed until 2014 - 14 years later.  The unit on the accident airplane had a circuit board incorporating both of the previous upgrades (which, now obviously, still did not fix the problem.)

The only discussion of this situation in the 204 pages of this report is on Page 66.  Nowhere in the rest is there any discussion of history, inspection of other units and airplanes, visits to the manufacturer, Airbus follow-up actions, regulatory activity, etc.  Nowhere in the Causes, Safety Actions or Safety Recommendations is there any recommendation that the circuit board be further improved, that installed and on-shelf units be inspected for defects, etc.  Compare that to the CAB Report actions shown below on the 1962 707 accident mentioned above.)

And, since, in common with other Airbus FBW accidents, that involved reversion from Normal to degraded flight control Laws, nowhere is there any mention of the designed-in hazards and inadequacies that lead to upsets and non-recoveries by AB flight crews presented with a stream of "What's it doing now?" scenarios.

Instead, we find reams of the usual discussions about training and procedures and how pilots or maintenance should deal better with the failures and upsets inherent in Airbus FBW airplanes.  It's been on my To-Do List for some time to re-write the AF and ANZ accident reports.   Now, with this accident, I have a third case.  A Hat Trick.  I think maybe this abomination needs to be a book.

Whatever shortcomings Airbus (or other French airplanes - e.g. ATR icing issues)  have with regard to flight safety (my personal opinion - they have a lot), - they will never be addressed with BEA whitewash jobs that never adequately address the proximate issues (pitot icing, AOA vane bearing icing, and cracked solder joints), or the larger issues of seriously defective flight control FBW architecture.

Like the Air France accident, we have the co-pilot pulling full aft (nose up) on his side stick, in a stall (+48 degrees AOA, airspeed down to 55 kts), and like all three accidents, we have the horrible Airbus sidestick mish-mash present with both pilots using their sidesticks simultaneously, sometimes in opposite directions, each action unbeknownst to the other pilot,  and with the flight control computers, now operating in degraded modes,  resolving the situations in ways unfathomable by the crew.  Except that all three airplanes ended in a mighty splash in the ocean.

All three accidents have another common theme - all had a previous failure history - and in all, both Airbus and EASA minimized the importance of the failures and failed to evaluate the possible downstream effects.  I have a saying I repeat endlessly to my hapless friends:  "Airplanes are always talking to us, sending messages.  It is up to us to be Listening."  Airbus has a long history of being tone deaf.

There's a certain irony about AB airplanes - airplanes that are designed from the outset to be "pilot-proof", whose computers are empowered to "protect the airplane from the pilot", designed to be flown by ab-initio pilots with multi-crew licenses and minimal experience, airplanes that have pitch and bank angle limits and are touted as having Alpha-floor protections (i.e. stall-proof) - and yet they keep crashing after stalling in-flight, at high altitude and low altitude, resulting in gross departures from the certified flight envelope.  And the subsequent call seems to be always the same - more and better training.  Why so much training for airplanes dumbed down to be flown by the least capable pilots?  And a FBW flight control system, that is "so sophisticated" that three different component level failures (pitot probe, AOA vane, rudder servo) have each been sufficient to bring down the airplane.

Might I add that the lessons of AF 447 - i.e. don't pull back on your sidestick when the airplane stalls - were lost on the crew of Air Asia - where the co-pilot was also the Pilot Flying at the time of the incident (and a French national, to boot!)  So much for the improvements to the training.

Hopefully, some day, some investigative body other than the BEA will be involved in an Airbus crash investigation, and start turning over rocks, and calling spades - spades.  For, you can be sure, with regard to accidents, there will be another one.

Bob Bogash


A320 Accident - Java Sea - Stall and Upset

With the above as a preamble, on 28 Dec 2014, an Indonesia Air Asia Airbus A320-200, registration PK-AXC performing flight QZ-8501 from Surabaya (Indonesia) to Singapore with 155 passengers and 7 crew, was enroute at FL320 over the Java Sea about 120nm eastsoutheast of Pulau Belitung Island at about 06:16L (23:16Z Dec 27th) when radar and radio contact was lost with the aircraft while it was deviating around weather; last recorded radar position was S3.3708 E109.6911.



"Debris and bodies of the aircraft were located on Dec 30th 2014 in the Java Sea about 110nm from Pulau Belitung, about 10km/5nm from the last radar position. First bodies have been recovered by helicopters. Additional debris has been located 150nm eastsoutheast of Pulau Belitung/100nm southwest of Pangkalan Bun, a shadow on the sea floor of what appears to be the aircraft has been located about 86nm southwest of Pangkalan Bun and 150nm eastsoutheast of Pulau Belitung."



The aircraft wreckage was subsequently located and recovered from the sea floor.





On Dec 1st 2015 Indonesia's NTSC, with 'assistance' from the French BEA, released their final report concluding the causes of the crash were cracking of a solder joint of both channel A and B resulted in loss of electrical continuity and led to RTLU (rudder travel limiter unit) failure.  This, in turn, caused the autopilot to disengage and the flight control logic to change from Normal Law to Alternate Law, the rudder deflecting 2° to the left resulting in the aircraft rolling up to 54° angle of bank.

Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted in the aircraft departing from the normal flight envelope and entering a prolonged stall condition that was beyond the capability of the flight crew to recover.
Details below.

Contributing factors

The cracking of a solder joint of both channel A and B resulted in loss of electrical continuity and led to RTLU (rudder travel limiter unit) failure. The existing maintenance data analysis led to unresolved repetitive faults occurring with shorter and shorter intervals. The same fault occurred 4 times during this flight.

The flight crew action to the first 3 faults was in accordance with the ECAM messages. Following the fourth fault, the FDR recorded different signatures that were similar to the FAC CB's being reset resulting in electrical interruption to the FAC's.


Abridged Narrative

The captain (53, ATPL, 20,537 hours total, 4,687 hours on type, Indonesian national) was pilot monitoring, the first officer (46, ATPL, 2,247 hours total, 1,367 hours on type, French national) was pilot flying.

On Dec 28th 2014, the day of the crash, the aircraft departed Surabaya without incident and was enroute at FL320 over the Karimata Strait when the captain instructed the F/O to turn anti-ice on and activated the fasten seat belt signs due to weather and possible turbulence ahead. About 3 minutes later the ECAM displayed amber advisory "AUTO FLT RUD TRV LIM 1", the first officer called for the ECAM actions.

One minute later the flight data recorder recorded the failure of both rudder travel limiter units triggering a chime and master caution associated with the ECAM message "AUTO FLT RUD TRV LIM SYS". The captain read the relevant checklists and pressed the pushbutton for FAC1 and FAC2 on the overhead panel to OFF and back to ON one by one. Both FACs successfully reset and both rudder travel limiter units returned to normal function.

Another 3 minutes later the captain requested and was approved a 15nm deviation around weather. The first officer subsequently performed a crew briefing indicating that in case of an emergency the next alternate airport would be Semarang.

9 minutes after the RTLUs failed for the first time the crew received a second indication that the units had failed again, the crew worked the checklists again and successfully reset both RTLUs.

The crew talked to ATC confirming they had deviated left off their track to avoid weather and requested to climb to FL380, ATC verified their position on radar and acknowledged the request by "standby".

A minute later the RTLUs failed again and were again reset using the checklist procedure. However, 110 seconds later the RTLUs failed a fourth time, ATC cleared the flight to climb to FL340 which was not acknowledged.

Several seconds later the flight data recorder recorded the failure of the FAC1, 17 seconds later the failure of both FAC1 and FAC2, the FBW reverted to Alternate Law, the aircraft rolled left up to 54 degrees of bank. Nine seconds after both FACs failed the right side stick activated, the bank angle reduced to 9 degrees left and then rolled back to 53 degrees left bank angle, the side stick was mainly pulled back, the aircraft pitched up and climbed reaching up to 11,000 feet per minute rate of climb. 34 seconds after both FACs failed a stall warning activated, briefly ceased for 1 second after 4 seconds, then remained active until end of recording.



The standby airspeed indicator recorded a lowest airspeed of 55 KIAS then settled at around 140 KIAS until end of recording. The highest altitude was recorded at 38,500 feet and a left bank angle of 104 degrees, the aircraft subsequently lost height at a rate of descent up to 20,000 fpm.

Descending through about 29,000 feet the wings were level, the airspeed was between 100 and 160 KIAS, the angle of attack was at approximately +40 degrees, the stall warning remained active and the aircraft lost height at about 12,000 fpm until end of recording.

Jakarta Radar lost transponder (ADSB) contact with the aircraft as it descended through 24,000 feet at S3.6143 E109.6974.

The flight data recorder stored the last sample at a radio height of 118 feet, the airspeed was 132 KIAS and the rate of descent 8400 fpm.

The NTSC reported no emergency message was transmitted by the crew.





Investigation

The captain had flown on PK-AXC three days prior to the crash and had experienced a rudder travel limiter unit failure during push back from Surabaya that day, Dec 25th 2014, called maintenance who assured they would have fixed the problem in no time, performed a BITE test, reset both flight augmentation computers (FAC) by pulling the circuit breakers and pushing them back in and the problem apparently went away. The captain asked whether he could repeat the same reset actions, the engineer stated that the captain could repeat that reset action whenever instructed by the ECAM. The aircraft was pushed back again, the problem resurfaced, the captain attemtped the reset procedure but the problem remained. The aircraft was pulled onto the stand again, the engineer advised it might take longer, the passengers were asked to disembark. The engineer replaced FAC2, then suggested to have both engines running, thereafter the problem did not resurface. The passengers were boarded again and the flight departed for a rotation from Surabaya to Kuala Lumpur and back without further incident.

The NTSC reported that the aircraft documentation recorded 23 events concerning the RTLUs in the year prior to the crash, with increasing frequency, 2 events were recorded in October 2014, 5 events in Nov 2014 and 9 events thereof in December 2014.

The FAC2, that had been removed from the aircraft on Dec 25th 2014 was examined by the manufacturer who found no fault with the unit, the unit returned to service on Jan 26th 2015.

The NTSC wrote: "An evaluation of the maintenance data showed that the maintenance action following the RTLU problems were in accordance with the TSM (TroubleShooting Manual). The actions were mostly resolved by resetting the computer by either pulling the associated CB or resetting the FAC push button and followed by an AFS test. The replacement of FAC2 was the only different action taken by the line maintenance personnel."

The RTLUs recovered from the sea bed were taken to the BEA for examination. The BEA engineering report summarised:

The examination was carried out by performing visual and other inspection of the external part as well as the internal part, including the electronic modules of the RTLU.

The channel A and channel B boards were visually examined under magnification at BEA.

The presence of cracks on solders was confirmed on the surface of both channels (Figure 35).



The summary of the examination found the electronic cards showing evidence of cracking of soldering of both channel A and channel B. Those cracks could generate loss of electrical continuity and lead to a TLU failure.

The NTSC analyzed: "Between 2301 UTC to 2313 UTC the FDR and CVR recordings indicated three Rudder Travel Limiter Unit failures occurred and triggered the chime and master caution, followed by PIC actions to ECAM actions to reset FAC 1 and 2 push-buttons on the overhead panel to OFF then to ON. Thereafter both of Rudder Travel Limiter Units returned to function normally. At 2315:36 UTC, the fourth failure on both Rudder Travel Limiter Units and triggered ECAM message “AUTO FLT RUD TRV LIM SYS” and triggered the chime and master caution light. At 2316:29 UTC, the FDR recorded parameters which indicate that FAC 1 was de-energized leading to the ECAM FAC 1 FAULT message associated with the 5th master caution. 17 seconds later the FDR recorded parameters indicate that FAC 2 was also de-energized leading to the FAC 1+2 FAULT message associated with the 6th master caution. The FAC 1+2 FAULT was followed by rudder deflected 2° to the left, the aircraft flight control status reverted from Normal Law to Alternate Law and the Auto Pilot (A/P) and the Auto thrust (A/THR) disengaged. As consequence, the pilot should fly the aircraft manually. The fault on FACs was associated with electrical interruption due to loss of 26VAC and 28VDC. Refer to the information provided by Airbus, when the loss of 26VAC was detected by the FAC, the FAC logic associated to the computation time and rudder movement inertia created a Rudder movement of about 2°. As both FAC were disengaged this rudder movement was not automatically compensated. The FDR recorded that when FAC 1 was de-energized, the rudder deflected of about 0.6° at this time the FAC 2 took over the function of FAC 1 and the auto-pilot was still engaged. The FDR also showed the deflection of aileron to compensate the aerodynamic roll caused by rudder deflection hence the FDR did not record any heading change. The FDR did not record re-engagement of the FAC 1. Seventeen seconds after the FAC 1 being de-energized, the FDR recorded that the FAC 2 was also de-energized leading to the FAC 1+2 FAULT message. As a consequence the A/P and A/THR disengaged, flight control law reverted from Normal Law to Alternate Law, and the rudder deflected 2° to the left causing the aircraft rolled to the left with rate of 6°/second. After the auto pilot disengaged the pilot had to fly the aircraft manually. However when the aircraft rolled, neither pilot input the side stick to counter the aircraft roll until nine seconds later thereby the aircraft rolled left up to 54°. The investigation concluded that the un-commanded roll was caused by the rudder deflection, the autopilot disengaged and no pilot input for nine seconds."

The NTSC continues analysis: "At 2316:39 UTC, the FDR recorded that the FAC 1 was re-energized indicated by stopping of parameter alternation. However because the FAC1 pushbutton on overhead panel was not reset by put to OFF then ON, the FAC1 functions remained unavailable and all equipment controlled by FAC 1 did not operating."

At 2316:46 UTC, the FDR parameters indicated that FAC 2 was also de-energized leading to the FAC 1+2 FAULT message associated with the 6th master caution ... At 2316:54 UTC the FAC 2 was re-energized indicated by stopping of parameter alternation. ... Returning FAC CB back in during flight does not automatically make the FAC functions to be re-engaged and recover the function of the FAC, it requires resetting the FAC push button on the overhead panel as mentioned on ECAM Procedures. Without resetting the FAC pushbutton the FAC and all related systems remain not engaged even though the FDR shows some FAC FDR parameters are re-computed and recorded."



The NTSC analyzed with respect to resetting the FACs: "The Airbus developed the statement to open the possibility for the operator in some circumstances allowed to reset another computer CB when “fully understand the consequences”. One way of doing this is by consulting to Airbus. The PIC had seen the engineer resetting the FAC CB on the ground. Having experience of witnessing and performing FAC CB reset, the PIC might consider that he “fully understand the consequences”. Resetting the FAC CB on the ground and in flight has different consequences. The FAC CBs were not included in the list of the CB allowed in OEB and TDUs to be reset in flight. The consequences of resetting FAC CBs in flight are not described in Airbus documents. It requires good understanding of the aircraft system to be aware of the consequences."

With respect to the left roll the NTSC analyzed: "After electrical interruption the autopilot disengaged and the rudder deflected at 2° then the aircraft rolled to the left without pilot input with a rate of 6° per second. This rate of roll was two times faster than normal roll rate operation. The SIC who acted as Pilot Flying responded 9 seconds after the autopilot off when the roll angle had reached 54°. Normally a pilot will respond immediately to level the wings when an aircraft is rolling without input by the pilot or normal system. During the [event] the autopilot disengages and the ECAM message changed which triggered the master caution and chime this might attracted the crew attention. The delayed response of SIC as PF was likely due to his attention not being on the PFD, however the investigation could not determine to what the SIC's attention was directed at that time."

With respect to the response to the stall warning the NTSC analyzed: "The operator manual (FCOM and QRH) stated that at this condition, the flight crew must apply the stall recovery procedure by lowering the nose to reduce AOA as soon as they recognized any stall indication either the stall warning or aircraft buffet. Stall recovery procedures have been trained for both pilots. During the stall warning activated, the right side stick was at neutral then moved forward for two seconds. It caused the AOA decreased below 8°, and the aural stall warning stopped. The pitch up input of the right side stick has made the aircraft AOA increase and activated the stall warning which ceased after pitch down action was performed."

The NTSC analyzed that there initially had been responses to the upset on the right hand side stick only, later followed by responses on the left side stick and wrote: "The first left side stick input was at 2317:03 UTC for 2 seconds, then 15 seconds later another input for 2 seconds, and at 2317:29 continued in dual input until the end of the recording. The sidestick priority logic, when one pilot operates the sidestick, it will send the control signals to the computers. When both pilots move both sidesticks simultaneously in the same or opposite direction and neither takes priority, the system adds the signals algebraically. When this occurred, the two green Side Stick Priority lights are ON and followed by “DUAL INPUT” voice message activation. If this occurred, the PF or depending on the PIC instruction, should stop provides input on the sidestick or a pilot should stop the "dual input‟ by pressing the priority pushbutton for 40 seconds or more to latch the priority condition. The FDR did not record neither pilots pressed such button for more than 40 seconds. The CVR did not record “DUAL INPUT” voice message as it was suppressed by “STALL” voice warning. The FDR recorded at 2317:15 UTC the aircraft pitch reached 24° up. The PIC commanded "pull down...pull down‟ and at 2317:17 UTC the FDR recorded a second Stall Warning. Following the command "pull down...pull down‟ the FDR recorded the SIC side stick backward input increased. The aircraft pitch and AOA were increasing. The average of the side stick inputs recorded on the FDR since the A/P and A/THR disengaged until the aircraft encountered the second stall warning indicated that the SIC was pulling almost full back input while the PIC was slightly pushing nose-down. The sum of both side stick inputs commanded nose up pitch. The pitch up input resulted in the AOA reaching a maximum of 48° which was beyond the flight director envelope and the flight director would have been disappeared from the PFD. The pilot would no longer have guidance from the flight director. The pilot training for stall was intended to introduce the indications of approach to stall condition and recover it. While the aircraft system designed to prevent the stall by providing early warning. The pilot training and the aircraft system were intended to avoid stall. The condition of AOA 40° as recorded on the FDR was beyond any airline pilot training competency as they never been trained or experienced. The degraded SIC performance and ambiguous command of the PIC may have decreased the SIC's situational awareness. Consequently, the SIC did not react appropriately in this complex emergency situation. This resulted in an aircraft upset from which recovery was beyond the procedures and philosophy of training that was provided to flight crew and the increasing difficulty of aircraft handling as the result of the rudder deflection which provided roll tendency."

With respect to maintenance activities the NTSC analysed: "Based on PK-AXC 1 Year report, 23 occurrences related with the RTLU problem were recorded since January 2014. The line maintenance personnel performed similar action by resetting the FAC and doing the AFS Operational test which resulted satisfactory and the problem was considered closed. Any repeating defect was treated as a new defect. Refer to the CMM chapter 5.3 Defect & Repetitive Defect stated : A defect is deemed to be repetitive when it has been reported more than once in 7 flight sectors or 3 days where 3 rectification attempts have not positively cleared the defects. Evaluation of MR1 data December 2014 found 10 pilot reports related to RTLU occurred on 1, 12, 14, 19, 21, 24, 25 (two cases), 26 and 27 December 2014. On 19 December 2014, the repetitive RTLU problem was inserted to MR2. Repetitions of the problem were not classified as repetitive problem as the rectification by AFS test were resulted satisfactory and the problems were considered solved. Actually the rectification by AFS test did not completely solve the problem. ... The company did not clearly state the policy of recording defect handling captured by the CFDS system or printed PFR and mainly based on MR1. It resulted in the line maintenance personnel did not aware of similar problem and repeat similar maintenance action, and also the problem was not recorded as a repetitive problem. None of the issues reported was identified as meeting the repetitive defect definition which would have triggered maintenance actions under the CMM requirements."

Some main stream media reported the Report called for adoption of the Boeing control system that would link the sidesticks (Boeing uses control wheels).  No such recommendation can be found in the official Report.

On Page 125 are the rather tepid Safety Recommendations:

5 SAFETY RECOMMENDATIONS

While the KNKT acknowledges the safety actions taken by the aircraft operator, there still remain safety issues that need to be considered. The KNKT issues the following Safety Recommendations addressed to:

5.1 Aircraft Operator

1. The KNKT recommends that Indonesia AirAsia to re-emphasize the importance of the Standard Call-Outs in all phases of flight.
2. The KNKT recommends that Indonesia AirAsia to re-emphasize the taking over control procedure in various critical situations of flight.

5.2 Directorate General Civil Aviation

1. The KNKT recommends that the Directorate General Civil Aviation to ensure the implementation of air operators‟ training of flight crew is in accordance with the approved operations manual.
2. The KNKT recommends that the Directorate General Civil Aviation to ensure that air operators under CASR 121 conduct simulator upset recovery training in timely manner.
3. The KNKT recommends that the Directorate General Civil Aviation ensures that air operator maintenance system has the ability to detect and address all repetitive faults appropriately.
4. The KNKT recommends the Directorate General Civil Aviation ensures the Indonesian Civil Aviation Safety Regulations to regulate the duties of the pilot in command as specified by ICAO Annex 6.

5.3 Aircraft Manufacturer

1. The KNKT recommends that Airbus to consider in developing a means for flight crews to effectively manage multiple and repetitive Master Caution alarms to reduce distraction.
2. The KNKT recommends that Airbus to consider and review the FCTM concerning the Standard Call-Outs in all phases of flight.

5.4 United States Federal Aviation Administration and European Aviation Safety Agency

1. The KNKT supports the previous French BEA recommendation (Recommendation FRAN-2015-024) on ensuring that future programs to include initial and recurrent training relating to taking over control of aircraft equipped with non-coupled control stick.
2. The KNKT recommend expediting the implementation of mandatory for upset recovery training earlier than 2019.

The whole report here:

http://kemhubri.dephub.go.id/knkt/ntsc_aviation/baru/Final%20Report%20PK-AXC.pdf

Bob Bogash


* Recommendations at the end of the AA 707 Accident Report:

> Recommendations
 
 The Board presently has made three recommendations to the Administrator of the Federal Aviation Agency as a result of this accident. The first of these was that an Airworthiness Directive be issued to require a one-time inspection of the servo rate generator motors on all Eclipse-Pioneer Model PB-20D Automatic Flight Control Systems for damaged wire bundles, and that the Agency take measures as necessary to insure satisfactory quality control during manufacture and overhaul. The second was that an Airworthiness Directive be issued to require mandatory incorporation of applicable Boeing Service Bulletins pertaining to replacement of the Gladden solenoid-operated valves in the flight control and hydraulic interconnect systems due to flaking of the nickel plating tending to contaminate the hydraulic fluid. The last was that the current airworthiness requirements for automatic flight control systems in Section 4b.612(d) of the Civil Air Regulations and the related CAM material, as specifically applied to the high speed swept-wing design turbojet aircraft, be reevaluated for the purpose of establishing realistic time allowances for recognition of abnormal airplane motions, decision to take corrective action, and initiation of the proper correction in all pertinent flight regimes; and that necessary changes to the requirements be applied retroactively to turbojet aircraft equipped with automatic flight control systems. As of the date of this report the Federal Aviation Agency has taken appropriate action on the first two recommendations and has the third under study.

BY THE CIVIL AERONAUTICS BOARD
 

Solving one problem and creating another.... 

As an aside, the EU regulators outlawed the use of lead solder for environmental reasons in a series of directives (beginning in 1996), primarily to eliminate lead (and other heavy metals) from the waste stream of electronic units.  Lead-free solder may remove certain hazards associated with lead in the environment, but introduces a long list of new hazards associated with manufacturing electronic units, including changed flux requirements for electrical soldering.  Even more deleterious were the risks created in 1) properly soldering connections with lead-free solder, and 2) in-service performance problems due to lower melting points (board temperatures that can re-melt the solder), tin whiskering, and in particular, brittleness, which can lead to cracking.

The type solder and conditions associated with the solder cracking in this situation are unknown, but it appears entirely possible that removing one hazard created another even more deadly one.  The Law of Unintended Consequences - as ever - alive and well.

None of this is discussed in the report, although it may have been investigated.