Approximate geographic markers for the departure, wreckage location and intended destination. Basemap: Natural Earth, public domain.Read supporting evidence
Indonesia AirAsia QZ8501 was cruising at 32,000 feet from Surabaya to Singapore when a recurring rudder travel limiter fault triggered four cautions. The crew followed the displayed procedure for the first three. After the fourth, recorder signatures were consistent with resetting the flight augmentation computer circuit breakers. Electrical interruption disconnected the autopilot and autothrust, changed the control law and produced a left roll. Subsequent control inputs led to a steep climb and prolonged stall. The aircraft struck the sea, killing all 162 occupants.
Read the full incident Follow what happened, from the flight to the investigation findings.
What investigators concluded
KNKT identified cracked solder joints, unresolved recurring faults, electrical interruption to the flight augmentation computers and subsequent crew control actions as contributing factors. It found ineffective communication and coordination, opposing side-stick inputs and gaps in upset recovery training.
From recurring limiter faults to a prolonged stall
1,570 words / about 8 minutes to read. Based on the investigation records cited below.
A recurring fault before departure
PK-AXC was a six-year-old Airbus A320-216 operated by Indonesia AirAsia. Its rudder travel limiter restricted the amount of rudder movement available as speed increased. The aircraft had two flight augmentation computers, or FACs, which provided yaw damping, turn coordination, rudder trim and rudder travel limitation, together with flight envelope and warning functions. A fault in the limiter had repeatedly appeared during the year before the accident. The maintenance records assembled for the investigation contained 23 occurrences from January through 27 December 2014.
Engineers commonly responded by resetting a FAC and running an operational test of the automatic flight system. The test passed, and the defect was closed. The intervals between malfunctions shortened during the final three months. The airline's maintenance management system drew its defect information from technical log entries, cabin maintenance and scheduled inspections. It did not use the full post-flight report data generated by the aircraft. Maintenance work initiated from those reports had no clearly defined recording policy, and repeated faults could escape the process for escalating recurring defects.
On 25 December, the captain who would command QZ8501 was in PK-AXC when the limiter caution appeared during preparations for a Surabaya to Kuala Lumpur flight. He watched an engineer reset the FAC circuit breakers. The fault returned during a second pushback, and the aircraft returned to the gate again. Engineers replaced FAC 2 using a computer from another aircraft. A replacement sent from Jakarta was installed the next day. On 27 December, the limiter caution appeared momentarily during taxi-in at Surabaya. Another reset and successful test followed.
QZ8501 left Surabaya at 05:35 local time on 28 December, corresponding to 22:35 UTC on 27 December. Its destination was Singapore Changi. Two pilots, four flight attendants and 156 passengers were aboard, with a company engineer included in the passenger total. The first officer was flying and the captain was monitoring. The aircraft reached its cruise altitude of 32,000 feet at 22:49 UTC and followed airway M635. KNKT found that it was operating within the approved weight and balance envelope.
At 22:57 the first officer requested anti-ice, and a flight attendant asked passengers to return to their seats and fasten their belts because of weather and possible turbulence. At about 23:04 the crew obtained approval to deviate 15 miles left of the route for weather avoidance. They subsequently informed Jakarta control about the deviation and requested a climb to 38,000 feet. The controller instructed them to stand by. KNKT found that the recorder data showed no weather effect on the aircraft and concluded that weather did not contribute to the accident.
Meanwhile, the rudder limiter warnings returned. An amber advisory appeared at 23:00, followed by a system fault and master caution at about 23:01. The captain followed the electronic centralized aircraft monitoring system, or ECAM, instructions by switching the FAC overhead pushbuttons off and on, one at a time. The system resumed normal functioning. The same fault occurred at about 23:09 and again at 23:13:41. On each occasion the crew repeated the displayed procedure and the limiter resumed functioning. At 23:15:36 the fourth system fault triggered another chime and master caution.
After the fourth limiter caution, the flight data recorder showed a different sequence. FAC 1 became de-energized, followed roughly 17 seconds later by FAC 2. Parameters from equipment controlled by each computer alternated between minimum and maximum values when their data became unavailable. Investigators compared this signature with the recorded ground event of 25 December. KNKT concluded that the electrical interruption was likely caused by resetting the FAC circuit breakers. The flight data showed the computers being re-energized, but their functions remained unavailable because the overhead pushbuttons had not subsequently been reset.
With both FAC functions lost, the autopilot and autothrust disengaged and the control system reverted from Normal Law to Alternate Law. Several protections available in Normal Law were lost. The rudder deflected two degrees left. The resulting roll developed at about six degrees per second. For nine seconds neither pilot used a side-stick to counter it, and the aircraft reached 54 degrees of left bank. Jakarta control's clearance to climb to 34,000 feet received no reply. No further crew communication with air traffic control was recorded after autopilot disconnection.
The first officer then moved the right side-stick backward and to the right. Left bank reduced to nine degrees before increasing again to about 53 degrees. The pitch-up command also raised the nose and began a steep climb. KNKT found that the delay in responding was likely associated with the first officer's attention being away from the primary flight display. The investigation could not determine where his attention was directed. Its analysis also considered possible startle and spatial disorientation during the rapid changes in bank.
A short stall warning sounded at about 23:16:56. The first officer briefly commanded nose-down movement, and pitch stabilized for several seconds. Backward side-stick inputs then resumed and the aircraft continued climbing, with the climb rate reaching about 11,000 feet per minute. The captain called for the aircraft to be levelled and later used the words 'pull down'. KNKT found those commands ambiguous. The first officer's backward input increased after repeated 'pull down' calls, raising pitch and angle of attack further.
The sustained stall warning began at about 23:17:17. It paused for one second at 23:17:22 and then continued to the end of the recordings. The left side-stick had moved briefly earlier in the sequence; from 23:17:29 both sticks remained active. The first officer was applying predominantly maximum nose-up input while the captain supplied nose-down commands or left his stick near neutral. The A320 control system added their simultaneous inputs algebraically. The captain's forward commands therefore failed to produce the effective, sustained nose-down movement needed to reduce angle of attack.
The captain pressed his side-stick priority button twice, for two seconds and five seconds. Neither press latched the other stick out, which required a press lasting at least 40 seconds. The cockpit recording contained no standard announcement transferring control between pilots. The 'dual input' voice alert was suppressed by the stall warning. At 23:17:41 the standby instrument altitude reached 38,500 feet and bank reached 104 degrees left. The aircraft descended rapidly, momentarily at up to 20,000 feet per minute. It subsequently returned to an approximately level pitch and roll attitude while continuing to lose height.
With the wings and nose approximately level, the aircraft remained deeply stalled. Angle of attack was around 40 degrees and the average descent rate was about 12,000 feet per minute. The engines were producing cruise power. The cockpit had no indication of the high angle of attack. KNKT found that the crew had trained to recover from an approach to stall, commonly associated with a nose-high attitude, and had not experienced the combination of nearly level attitude and sustained aerodynamic stall encountered during this descent.
The captain ordered selection of the CAPT 3 air data source late in the descent. KNKT considered that he might have attributed the fluctuating airspeed indications to an air data error. The flight data did not show the effective nose-down recovery action specified in the stall procedure. The right side-stick continued to command nose-up movement. Both recorders stopped at 23:20:35 UTC. The aircraft struck the water in the Karimata Strait and was destroyed. All 162 occupants died.
Search teams recovered floating wreckage and bodies on 30 December, about 30 nautical miles southeast of the last radar position. The main wreckage lay in approximately 30 metres of water. The flight data recorder was recovered on 12 January 2015 and the cockpit voice recorder the following day. The flight recorder provided about 174 hours of data covering 74 flights, including the accident flight. This let investigators examine the earlier limiter faults and the circuit breaker reset on the ground as well as the final flight.
The recovered rudder travel limiter was examined under KNKT's investigation with BEA and Airbus participation. Magnified inspection confirmed cracked solder joints on both electronic channels. Thermal cycles associated with powered and unpowered conditions and with ground and flight conditions could fatigue the solder, interrupt electrical continuity and create intermittent faults. KNKT identified the cracks as a contributing factor. Its maintenance analysis found that successful reset tests had repeatedly closed defects while the underlying fault remained unresolved, and that incomplete use of post-flight data had prevented effective recognition of the recurring pattern.
KNKT also found ineffective communication and coordination during the upset. The operator's approved training manual contained upset recovery training, but the airline had not implemented it for the A320. Management had relied on the manufacturer's training philosophy for aircraft protected by fly-by-wire control laws. The regulator's audits had identified neither this training gap nor the inadequate maintenance processes for recurring faults. The investigation's contributing factors linked the technical defect and maintenance history to the electrical interruption and the subsequent control actions that produced a prolonged stall beyond the crew's recovery capability.
Indonesia AirAsia reported actions involving maintenance records, repetitive defect monitoring, crew communication, upset and stall recovery training, manual flying and circuit breaker policy. KNKT recommended renewed emphasis on standard calls and control transfer procedures. It asked the Indonesian regulator to ensure compliance with approved training manuals, timely simulator upset recovery training and maintenance systems capable of detecting and addressing repetitive faults. It also asked Airbus to consider ways to manage repeated master cautions and review standard calls, and supported training requirements for taking control of aircraft equipped with uncoupled side-sticks.
Electrical interruption was likely caused by circuit breaker resets. Autopilot and autothrust disconnected, and flight controls changed to Alternate Law.
A simplified reading of the investigation findings. The sequence does not replace the full report or imply that every contributing factor is shown.
Sequence of events
UTC for the flight sequence, on 27 December 2014. Local time in Surabaya and at the accident site was UTC plus seven hours, on 28 December. Times are rounded where marked. Expand an event to see its evidence.
22:35Departure from Surabaya
QZ8501 took off for Singapore and reached FL320 at 22:49.
Both FAC functions became unavailable. The autopilot and autothrust disconnected, the aircraft changed to Alternate Law, and a two-degree left rudder deflection initiated a roll.
Investigators confirmed cracked solder joints in both channels of its electronic module. The cracks interrupted electrical continuity and produced intermittent failures.
Why did both pilots using the controls hinder recovery?
The flight control computers added simultaneous side-stick commands. The first officer maintained nose-up input, which opposed the captain's nose-down commands. Neither pilot latched side-stick priority, and there was no recorded standard call transferring control.
The fault was intermittent. Resetting a computer and completing a successful test led to closure of the defect. Repeated occurrences were treated as new defects, and incomplete post-flight report data prevented the maintenance system from identifying the full recurring pattern.
The flight history gives a last airspeed of 132 knots from the standby instrument and radio altitude of 118 feet. The findings list 83 knots and 187 feet at the same end time.
Actions and recommendations are described at the dates of the cited records. A recommendation is not proof of implementation.
Operator actions reported in 2015
Indonesia AirAsia described improvements to repetitive defect handling, storage of post-flight and test reports, engineer training and maintenance monitoring.
The operator reported reviews of upset and stall recovery training, manual handling and circuit breaker policy. KNKT recommended stronger standard calls and control transfer procedures.
KNKT called for oversight of approved training and recurring fault systems. It asked Airbus to consider managing repetitive master cautions and asked the FAA and EASA to expedite mandatory upset recovery training.
These comparisons connect specific research topics. Shared circumstances do not establish identical causes. Evidence from both investigations is provided below.
Further investigation records
Explore the records below for additional context. They open on the publisher's site and are not all included in our report search. Source reuse terms apply.
Appendix 6.13 contains comments from participating investigation authorities.
Sources and transparency
KNKT final report KNKT.14.12.29.04, 2015.
Source limitations
The right primary flight display was not recorded in the flight data recorder. KNKT used standby instrument data when the left display source became unavailable.
Aircraft Accident Investigation Report: PT. Indonesia Air Asia, Airbus A320-216, PK-AXC, 28 December 2014
Kevin Murphy writes the incident accounts on AirlineIncidents.com, out of a long interest in aviation safety and the lessons each investigation leaves behind.
Prepared by
AirlineIncidents editorial desk
Report citation check
Independent expert review
Not completed
Citation checks compare supporting text with the indexed report pages. They do not constitute independent expert review. How these pages are prepared.
