|
ATSB TRANSPORT SAFETY REPORT
Aviation Occurrence Investigation AO-2008-070
Interim Factual
In-flight upset
154 km west of Learmonth, WA
7 October 2008
VH-QPA
Airbus A330-303
- i -
ATSB TRANSPORT SAFETY REPORT
Aviation Occurrence Investigation
AO-2008-070
Interim Factual
In-flight upset
154 km west of Learmonth, WA
7 October 2008
VH-QPA
Airbus A330-303
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
- ii -
Published by: Australian Transport Safety Bureau
Postal address: PO Box 967, Civic Square ACT 2608
Office location: 62 Northbourne Ave, Canberra City, Australian Capital Territory
Telephone: 1800 020 616; from overseas + 61 2 6257 4150
Accident and incident notification: 1800 011 034 (24 hours)
Facsimile: 02 6247 3117; from overseas + 61 2 6247 3117
E-mail: atsbinfo@atsb.gov.au
Internet: www.atsb.gov.au
© Commonwealth of Australia 2009.
This work is copyright. In the interests of enhancing the value of the information contained in this
publication you may copy, download, display, print, reproduce and distribute this material in
unaltered form (retaining this notice). However, copyright in the material obtained from other
agencies, private individuals or organisations, belongs to those agencies, individuals or
organisations. Where you want to use their material you will need to contact them directly.
Subject to the provisions of the Copyright Act 1968, you must not make any other use of the
material in this publication unless you have the permission of the Australian Transport Safety
Bureau.
Please direct requests for further information or authorisation to:
Commonwealth Copyright Administration, Copyright Law Branch
Attorney-General’s Department, Robert Garran Offices, National Circuit, Barton ACT 2600
www.ag.gov.au/cca
ISBN and formal report title: see ‘Document retrieval information’ on page i.
- iii -
CONTENTS
THE AUSTRALIAN TRANSPORT SAFETY BUREAU ................................ vii
ABBREVIATIONS.............................................................................................. viii
FACTUAL INFORMATION ................................................................................ 1
History of the flight........................................................................................... 1
Injuries to persons............................................................................................. 4
Damage to the aircraft....................................................................................... 5
Personnel information....................................................................................... 7
Aircraft information .......................................................................................... 7
General information.............................................................................. 7
Flight control system ............................................................................ 8
Air data and inertial reference system .................................................. 9
Meteorological information ............................................................................ 13
Flight recorders ............................................................................................... 14
Overview ............................................................................................ 14
Recording system operation ............................................................... 14
Recorder recovery .............................................................................. 15
Results ................................................................................................ 15
Sequence of events ............................................................................. 16
FDR information related to ADIRUs ................................................. 17
Aircraft examination ....................................................................................... 20
Structural examination........................................................................ 20
Cargo hold inspection......................................................................... 20
Wiring examinations .......................................................................... 21
Central maintenance system ............................................................... 21
Data downloads from aircraft systems ............................................... 22
System testing..................................................................................... 23
Flight control primary computers (PRIMs) ........................................ 24
Probe heat computer ........................................................................... 24
Angle of attack sensor ........................................................................ 24
ADIRU testing ................................................................................................ 24
ADIRU test plan ................................................................................. 25
Participants ......................................................................................... 25
ADIRU test schedule.......................................................................... 25
Completed ADIRU tests..................................................................... 25
ADIRU test results ............................................................................. 26
- iv -
Review of PRIM monitoring functions........................................................... 27
Review of PRIM angle of attack processing................................................... 28
Other ADIRU-related occurrences.................................................................. 31
ADIRU reliability............................................................................... 31
ADIRU failures affecting flight controls............................................ 31
VH-QPA, 12 September 2006............................................................ 31
VH-QPG, 27 December 2008............................................................. 33
Search for similar events .................................................................... 34
VH-EBC, 7 February 2008................................................................. 35
Electromagnetic interference .......................................................................... 35
General information............................................................................ 35
Electromagnetic compatibility standards............................................ 36
Potential sources of EMI in the geographical area ............................. 37
Cabin safety .................................................................................................... 38
Passenger seating disposition ............................................................. 38
Passenger questionnaire...................................................................... 39
Passenger description of first in-flight upset ...................................... 39
General injury information ................................................................. 39
Seated passengers ............................................................................... 40
Non-seated passengers........................................................................ 40
Crew member injury details ............................................................... 41
Passenger seatbelts ............................................................................. 41
ONGOING INVESTIGATION ACTIVITIES .................................................. 43
Air data inertial reference units....................................................................... 43
Flight control system....................................................................................... 43
Electronic centralized aircraft monitor (ECAM) ............................................ 43
Cabin safety .................................................................................................... 44
Flight recorders ............................................................................................... 44
Other activities................................................................................................ 44
SAFETY ACTION ............................................................................................... 45
Aircraft manufacturer...................................................................................... 45
Operational procedures....................................................................... 45
Flight control system .......................................................................... 46
Aircraft operator ............................................................................................. 46
Seatbelt reminders........................................................................................... 46
APPENDIX A: ELECTRONIC INSTRUMENT SYSTEM............................. 47
Failure mode classifications ............................................................... 47
- v -
Electronic centralized aircraft monitor (ECAM)................................ 48
Primary flight displays ....................................................................... 48
APPENDIX B: FLIGHT DATA RECORDER PLOTS.................................... 49
- vi -
DOCUMENT RETRIEVAL INFORMATION
Report No.
AO-2008-070
Publication date
6 March 2009
No. of pages
53
ISBN
097-1-921602-20-7
Publication title
In-flight upset, 154 km west of Learmonth, WA, 7 October 2008, VH-QPA, Airbus A330-303
Prepared by
Australian Transport Safety Bureau
PO Box 967, Civic Square ACT 2608 Australia
www.atsb.gov.au
Reference No.
Mar2009/INFRA-08418
Acknowledgements
Figure 4, Figure 9, Figure 10 and diagrams included in Appendix A by permission of Airbus.
Abstract
At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VHQPA,
departed Singapore on a scheduled passenger transport service to Perth, Australia. On board
the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three
flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected.
From about the same time there were various aircraft system failure indications. At 1242:27,
while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft
reached a maximum pitch angle of about 8.4 degrees nose-down, and descended 650 ft during the
event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple
failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event.
The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down, and descended
about 400 ft during this second event.
At 1249, the crew made a PAN urgency broadcast to air traffic control, and requested a clearance
to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin of
several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at
Learmonth at 1350.
One flight attendant and 11 passengers were seriously injured and many others experienced less
serious injuries. Most of the injuries involved passengers who were seated without their seatbelts
fastened or were standing. As there were serious injuries, the occurrence constituted an accident.
The investigation to date has identified two significant safety factors related to the pitch-down
movements. Firstly, immediately prior to the autopilot disconnect, one of the air data inertial
reference units (ADIRUs) started providing erroneous data (spikes) on many parameters to other
aircraft systems. The other two ADIRUs continued to function correctly. Secondly, some of the
spikes in angle of attack data were not filtered by the flight control computers, and the computers
subsequently commanded the pitch-down movements.
Two other occurrences have been identified involving similar anomalous ADIRU behaviour, but
in neither case was there an in-flight upset.
The investigation is continuing.
- vii -
THE AUSTRALIAN TRANSPORT SAFETY BUREAU
The Australian Transport Safety Bureau (ATSB) is an operationally independent
multi-modal bureau within the Australian Government Department of
Infrastructure, Transport, Regional Development and Local Government. ATSB
investigations are independent of regulatory, operator or other external
organisations.
The ATSB is responsible for investigating accidents and other transport safety
matters involving civil aviation, marine and rail operations in Australia that fall
within Commonwealth jurisdiction, as well as participating in overseas
investigations involving Australian registered aircraft and ships. A primary concern
is the safety of commercial transport, with particular regard to fare-paying
passenger operations.
The ATSB performs its functions in accordance with the provisions of the
Transport Safety Investigation Act 2003 and Regulations and, where applicable,
relevant international agreements.
Purpose of safety investigations
The object of a safety investigation is to enhance safety. To reduce safety-related
risk, ATSB investigations determine and communicate the safety factors related to
the transport safety matter being investigated.
It is not the object of an investigation to determine blame or liability. However, an
investigation report must include factual material of sufficient weight to support the
analysis and findings. At all times the ATSB endeavours to balance the use of
material that could imply adverse comment with the need to properly explain what
happened, and why, in a fair and unbiased manner.
Developing safety action
Central to the ATSB’s investigation of transport safety matters is the early
identification of safety issues in the transport environment. The ATSB prefers to
encourage the relevant organisation(s) to proactively initiate safety action rather
than release formal recommendations. However, depending on the level of risk
associated with a safety issue and the extent of corrective action undertaken by the
relevant organisation, a recommendation may be issued either during or at the end
of an investigation.
The ATSB has decided that when safety recommendations are issued, they will
focus on clearly describing the safety issue of concern, rather than providing
instructions or opinions on the method of corrective action. As with equivalent
overseas organisations, the ATSB has no power to implement its recommendations.
It is a matter for the body to which an ATSB recommendation is directed (for
example the relevant regulator in consultation with industry) to assess the costs and
benefits of any particular means of addressing a safety issue.
About ATSB investigation reports: How investigation reports are organised and
definitions of terms used in ATSB reports, such as safety factor, contributing safety
factor and safety issue, are provided on the ATSB web site www.atsb.gov.au.
- viii -
ABBREVIATIONS
ACARS Aircraft communications, addressing and reporting system
ADIRS Air data and inertial reference system
ADIRU Air data inertial reference unit
ADR Air data reference
AIRMAN AIRcraft Maintenance ANalysis database
AOA Angle of attack
AP Autopilot
ATSB Australian Transport Safety Bureau
BEA Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation
civile (France, Bureau of Investigations and Analysis for the Safety
of Civil Aviation)
BITE Built-in test equipment
CASA Civil Aviation Safety Authority
CMC Central maintenance computer
CMS Central maintenance system
CVR Cockpit voice recorder
EASA European Aviation Safety Agency
ECAM Electronic centralized aircraft monitor
EMI Electromagnetic interference
FAA Federal Aviation Administration (US)
FCPC Flight control primary computer (also known as PRIM)
FCSC Flight control secondary computer (also known as SEC)
FDR Flight data recorder
FL Flight level
FMGEC Flight management guidance envelope computer
GPS Global positioning system
HF High frequency
IR Inertial reference
ICAO International Civil Aviation Organization
NTSB National Transportation Safety Board (US)
OEB Operations engineering bulletin
- ix -
PED Personal electronic device
PFD Primary flight display
PFR Post flight report
PRIM Common name for flight control primary computer (FCPC)
QAR Quick access recorder
SEC Common name for flight control secondary computer (FCSC)
UTC Universal time, coordinated
VLF Very low frequency
- x -
- 1 -
FACTUAL INFORMATION
This interim report provides a summary of factual information that has been
derived from the continuing investigation of the subject occurrence – building upon
the information presented in the preliminary report (ISBN 978-1-921490-84-2). As
the investigation is ongoing, readers are cautioned that there is the possibility that
new evidence may become available that alters the circumstances as depicted in the
report.
History of the flight
At 0932 local time (0132 UTC1) on 7 October 2008, an Airbus A330-303 aircraft,
registered VH-QPA, departed Singapore on a scheduled passenger transport service
to Perth, Australia. On board the aircraft (operating as flight number QF72) were
303 passengers, nine cabin crew and three flight crew2 (captain, first officer and
second officer). The captain was the handling pilot for the flight.
The flight crew reported that the departure and climb-out from Singapore proceeded
normally. By 1001, the aircraft was cruising at 37,000 ft (flight level 370) in
automatic flight mode with the autopilot number 1 and autothrust systems engaged.
The flight crew reported that the weather was fine and clear and there had been no
turbulence during the flight. At about 1239, the first officer left the flight deck for a
scheduled rest break. The second officer then occupied the right control seat.
At 1240:28, the autopilot disengaged. The crew reported that there was an
associated ECAM3 warning message (AUTO FLT AP OFF) and that they also
started receiving master caution chimes. The captain took manual control of the
aircraft using the sidestick. He reported that he attempted to engage autopilot 2 and
then autopilot 1, but neither action was successful.4 The flight data recorder (FDR)
showed that, during this period, the aircraft’s altitude increased to 37,200 ft before
returning to the assigned level.
The crew reported that they cleared the AUTO FLT message from the ECAM. They
then received a NAV IR1 FAULT message on the ECAM.5 The crew were also
receiving aural stall warning indications at this time, and the airspeed and altitude
1 UTC: Universal time, coordinated (previously Greenwich Mean Time or GMT). Local time in
both Singapore and Western Australia was UTC plus 8 hours.
2 The A330 was designed to be operated by two pilots (captain and first officer). Depending on the
length of the sectors on a trip, second officers were carried to relieve the captain and first officer
during long sectors. On this day, the flight crew were rostered to operate the Singapore-Perth
flight and then a Perth-Singapore flight. Second officers do not normally occupy either of the
control seats during landing or takeoff.
3 ECAM: Electronic centralized aircraft monitor (see Appendix A).
4 The flight data recorder shows that autopilot 2 did engage for 16 seconds. The recorder also
indicated that the disconnection was initiated by the crew. The captain could not recall receiving
any indication that autopilot 2 had engaged.
5 NAV: navigation systems. IR: inertial reference part of the air data inertial reference unit
(ADIRU) (see Aircraft information).
- 2 -
indications on the captain’s primary flight display (PFD) were also fluctuating.
Given the situation, the captain asked the second officer to call the first officer back
to the flight deck.
At 1242:27, while the second officer was using the cabin interphone to ask a flight
attendant to send the first officer back to the flight deck, the aircraft abruptly
pitched nose-down. The captain reported that he applied back pressure on his
sidestick to arrest the pitch-down movement. He said that initially this action
seemed to have no effect, but then the aircraft responded to his control input and he
commenced recovery to the assigned altitude. The aircraft reached a maximum
pitch angle of about 8.4 degrees nose-down during the event, and a maximum g
loading of -0.80 g6 was recorded. The aircraft descended 650 ft during the event.
The flight crew described the pitch-down movement as very abrupt, but smooth. It
did not have the characteristics of a typical turbulence-related event and the
aircraft’s movement was solely in the pitching plane. They did not detect any
movement in the rolling plane.
During the initial upset event, the second officer activated the seatbelt sign to ON
and made a public address for passengers and crew to return to their seats and
fasten their seatbelts immediately.
The flight crew reported that, after returning the aircraft to 37,000 ft, they
commenced actions to deal with multiple ECAM messages. They completed the
required action to deal with the first message (NAV IR1 FAULT) by switching the
captain’s ATT HDG (attitude heading) switch from the NORM position to CAPT
ON 3 position, and then cleared that message. The next message was PRIM 3
FAULT.7 The crew completed the required action by selecting the PRIM 3 off,
waiting 5 seconds and then selecting it on again.
At 1245:08, shortly after the crew selected PRIM 3 back on, the aircraft
commenced a second uncommanded pitch-down event. The captain reported that he
again applied back pressure on his sidestick to arrest the pitch-down movement. He
said that, consistent with the first event, that action was initially unsuccessful, but
the aircraft then responded normally and he commenced recovery to the assigned
altitude. The aircraft reached a maximum pitch angle of about 3.5 degrees nosedown,
and descended about 400 ft during the second event. The flight crew
described the event as being similar in nature to the first event, though of a lesser
magnitude and intensity.
The captain announced to the cabin for passengers and crew to remain seated with
seatbelts fastened. The second officer made another call on the cabin interphone to
get the first officer back to the flight deck. The first officer returned to the flight
deck at 1248 and took over from the second officer in the right control seat. The
second officer moved to the third occupant seat.
6 Acceleration values used in this report were sensed by a triaxial accelerometer located
near the aircraft's centre-of-gravity and were recorded by the aircraft's flight data
recorder and quick access recorder. 1 g is the nominal value for vertical acceleration that is
recorded when the aircraft is on the ground. In flight, vertical acceleration values represent the
combined effects of flight manoeuvring loads and turbulence.
7 The term PRIM is the common name for a flight control primary computer (FCPC).
- 3 -
After discussing the situation, the crew decided that they needed to land the aircraft
as soon as possible. They were not confident that further pitch-down events would
not occur. They were also aware that there had been some injuries in the cabin, but
at that stage they were not aware of the extent of the injuries. At 1249, the crew
made a PAN8 emergency broadcast to air traffic control, advising that they had
experienced ‘flight control computer problems’ and that some people had been
injured. They requested a clearance to divert to and track direct to Learmonth, WA.9
Clearance to divert and commence descent was received from air traffic control.
Figure 1 shows the track of the aircraft and time of key events.
Figure 1: Aircraft track and key events
Following the second upset event, the crew continued to review the ECAM
messages and other flight deck indications. The IR1 FAULT light and the PRIM 3
FAULT light on the overhead panel were illuminated. There were no other fault
lights illuminated. Messages associated with these faults were again displayed on
the ECAM, along with several other messages. The crew reported that the messages
were constantly scrolling, and they could not effectively interact with the ECAM to
action and/or clear the messages. The crew reported that master caution chimes
associated with the messages were regularly occurring, and they continued to
receive aural stall warnings.
The captain reported that, following the first upset event, he was using the standby
flight instruments and the first officer’s primary flight display (PFD, see Appendix
A) because the speed and altitude indications on his PFD were fluctuating and he
8 A PAN transmission is made in the case of an urgency condition which concerns the safety of an
aircraft or its occupants, but where the flight crew does not require immediate assistance.
9 The first upset event occurred when the aircraft was 154 km (83 NM) west of Learmonth.
Learmonth was the closest aerodrome suitable for an A330 landing.
- 4 -
was unsure of the veracity of the other displayed information. After the second
upset event, he had observed that the automatic elevator trim was not functioning
and he had begun trimming the aircraft manually. He later disconnected the
autothrust and flew the aircraft manually for the remainder of the flight.
The flight crew spoke to a flight attendant by interphone to get further information
on the extent of the injuries. The flight crew advised the cabin crew that, due to the
nature of the situation, they did not want them to get out of their seats, but to use the
cabin interphones to gather the information. At 1254, after receiving advice from
the cabin of several serious injuries, the crew declared a MAYDAY10 and advised
air traffic control they had multiple injures on board, including a broken leg and
some cases of severe lacerations.
The crew continued attempts to further evaluate their situation and, at 1256,
contacted the operator’s maintenance watch unit11, located in Sydney, by
SATPHONE to seek assistance. There were several subsequent communications
during the flight between the flight crew and maintenance watch, who advised that
the various faults reported by the crew were confirmed by data link, but that they
were not able to diagnose reasons for the faults. During one of the conversations,
maintenance watch suggested that the crew could consider switching PRIM 3 off,
and this action was carried out. This action did not appear to have any effect on the
scrolling ECAM messages, or the erratic airspeed and altitude information.
The crew conducted a visual descent via a series of wide left orbits, maintaining
aircraft speed below 330 kts (maximum operating speed). They completed the
approach checklist and conducted a flight control check above 10,000 ft. They were
unable to enter an RNAV (GNSS)12 approach into the flight management computer;
however, the aircraft was positioned at about 15 NM for a straight-in visual
approach to runway 36. The precision approach path indicator (PAPI) was acquired
at about 16 km (10 NM) and the aircraft landed without further incident at
Learmonth at 1350.
Injuries to persons
Table 1 presents a summary of known information on the extent of passenger
injuries. As some of the people on board received serious injuries, the occurrence
was classified as an accident.13
10 A MAYDAY transmission is made in the case of a distress condition and where the flight crew
requires immediate assistance.
11 Maintenance watch provides 24-hour assistance to enroute flight crews regarding technical issues.
12 RNAV (GNSS) approach: area navigation global navigation satellite system non-precision
approach. Previously termed a ‘GPS approach’.
13 Consistent with the ICAO definition outlined in Annex 13 to the Chicago Convention, an accident
is defined in the Transport Safety Investigation Act 2003 as an investigable matter involving an
aircraft where a person dies or suffers a serious injury, or the aircraft is destroyed or seriously
damaged.
- 5 -
Table 1: Number and level of injuries
Injuries Crew Passengers Other Total
Fatal - - - -
Serious 1 11 - 12
Minor 8 95 - 103
None 3 197 - 200
Total 12 303 - 315
The Western Australia Department of Health reported that 53 people from the flight
received medical treatment at a hospital, and that 12 of those people were admitted
to hospital. Under the Transport Safety Investigation Regulations (2003), a serious
injury is defined as ‘an injury that requires, or would usually require, admission to
hospital within 7 days after the day when the injury is suffered’.14
Given that information about injuries was not able to be obtained from all
passengers, the number of minor injuries would be higher than shown in Table 1.
Further information on injuries and cabin safety matters is presented in Cabin
safety.
Damage to the aircraft
No structural damage to the aircraft was found during an inspection at Learmonth
(see Aircraft examination).
Inspection of the aircraft interior revealed damage mainly in the centre and rear
sections of the passenger cabin. The level of damage varied significantly. Much of
the damage was in the area of the personal service units (located above each
passenger seat) and adjacent panels. The damage was typically consistent with that
resulting from an impact by a person or object. There was evidence of damage
above approximately 10 per cent of the seats in the centre section of the cabin, and
above approximately 20 per cent of the seats in the rear section of the cabin. In
addition, some ceiling panels above the cabin aisle-ways had evidence of impact
damage, and many had been dislodged from their fixed position.
Oxygen masks had deployed from above nine of the seats where there had been
damage to overhead personal service units or adjacent panels. Some of the cabin
portable oxygen cylinders and some of the aircraft first aid kits had been deployed.
Examples of the more significant damage are shown in Figure 2 and Figure 3.
14 The definition of serious injury in the ICAO Annex 13 to the Chicago Convention includes several
conditions, such as hospitalisation for more than 48 hours, fracture of any bone (except simple
fractures of fingers, toes and nose), and lacerations which cause severe haemorrhage. Using the
ICAO definition, there were also 12 serious injuries. However, four of those people were different
to the 12 who were admitted to hospital.
- 6 -
Figure 2: Example of damage to ceiling panels above passenger seats
Figure 3: Example of damage to ceiling panels in aisle
- 7 -
Personnel information
Table 2 summarises the operational experience of the flight crew at the time of the
occurrence. All the flight crew reported that they were well rested prior to the flight.
Table 2: Flight crew experience
Captain First Officer Second Officer
Licence category ATPL15 ATPL CPL
Total flying hours 13,592 11,650 2,070
Total command 7,505 2,020 1,400
Total A330 2,453 1,870 480
Total last 90 days 165 198 188
Total last 30 days 64 78 62
Aircraft information
General information
Aircraft type: Airbus A330-303
Serial number: 0553
Year of manufacture: 2003
Registration: VH-QPA
Certificate of Registration: 31 October 2003
Certificate of Airworthiness: 26 November 200316
Total airframe hours: 20,040
Total airframe cycles: 3,740
Last ‘C’ maintenance check: 1-13 March 2008
The take-off weight of the aircraft was 207,065 kg. The weight of the aircraft and
centre of gravity were within the prescribed limits.
Preliminary analysis of maintenance records for the aircraft and pertinent systems
has been conducted. Initial indications are that the aircraft met all relevant
airworthiness requirements.
15 Air Transport Pilot License.
16 The aircraft was delivered to the operator as an A330-301 model in November 2003. The original
Certificate of Airworthiness was dated 26 November 2003. The aircraft was modified in
December 2004 which changed the model from a -301 to a -303. A new Certificate of
Airworthiness was issued on 10 December 2004 to reflect the correct model number.
- 8 -
Flight control system
General description
Figure 4 shows the flight control surfaces on the A330. All of the surfaces were
electronically controlled and hydraulically activated. The horizontal stabiliser could
also be mechanically controlled.
Figure 4: Overview of flight control surfaces
The aircraft’s flight control surfaces could be operated using the autopilot17 or
through pilot controls. When the autopilot was not engaged, pilots used sidesticks to
manoeuvre the aircraft in pitch and roll. Computers interpreted the pilot inputs and
moved the flight control surfaces, as necessary, to follow their orders within the
limitations of a set of flight control laws.
The aircraft’s flight control system included three flight control primary computers
(FCPCs, commonly known as PRIMs) and two flight control secondary computers
(FCSCs, commonly known as SECs). In normal operation, one PRIM functioned as
the master. It processed and sent orders to other computers, which executed them
using servo-controls (see also Review of PRIM monitoring functions).
The flight control computers received data from a variety of sources, including
from the air data inertial reference units (ADIRUs).
Pitch control
Pitch control was achieved by two elevators and the trimmable horizontal stabiliser
(THS). Maximum elevator deflection was 30 degrees nose up and 15 degrees nose
17 The A330 had two autopilots. The flight crew could engage either autopilot 1 or autopilot 2 by
pressing the corresponding pushbutton. The autopilot could be disconnected intentionally by the
crew or it could automatically disconnect as a result of a number of different conditions.
- 9 -
down. The maximum THS deflection was 14 degrees nose up, and 2 degrees nose
down.
The elevators and THS were normally controlled from PRIM 1. If a failure occurred
with PRIM 1 or an associated hydraulic system, the pitch control was automatically
transferred to PRIM 2. Mechanical trim control of the THS was available to the
flight crew using the pitch trim wheels on the centre pedestal in the flight deck.
Control laws
The electronic flight control system operated according to a set of control laws. In
‘normal law’, regardless of the flight crew’s input, computers prevented exceedance
of a predefined safe flight envelope. The flight control system could detect when
the aircraft was past or approaching the limits of certain flight parameters, and was
capable of commanding control surface movement in order to prevent the aircraft
from exceeding those limits. Automatic flight envelope protections included load
factor limitation, pitch and roll attitude protection, high angle-of-attack protection
(alpha prot), and high speed protection.
If there were certain types or combinations of failures within the flight control
system or its components, the control law automatically changed to a different
configuration level: alternate law or direct law. Under alternate law, the different
types of protection were either not provided or were provided using alternate logic.
Under direct law, no protections were provided and control surface deflection was
proportional to sidestick and rudder pedal movement.
Air data and inertial reference system
General description
The air data and inertial reference system (ADIRS) included three identical air data
inertial reference units (ADIRUs), known as ADIRU 1, ADIRU 2 and ADIRU 3.18
The ADIRUs provided data for multiple aircraft systems, including the flight
control system.
Figure 5 provides a simplified representation of the relationship between the
ADIRS and the flight control system. In simple terms, various air data sensors
provided data to the ADIRUs, which then provided data to the flight control
computers.
18 Details for the units on VH-QPA were as follows. Model name: LTN-101 Global Navigation Air
Data Inertial Reference Unit (GNADIRU). Part Number: 465020-0303-0316. ADIRU 1 Serial
Number 4167, ADIRU 2 Serial Number 4687, ADIRU 3 Serial Number 4663.
- 10 -
Figure 5: Simplified air and inertial data path
Air data inertial reference unit (ADIRU)
Each ADIRU was divided in two parts: the air data reference (ADR) part and the
inertial reference (IR) part. Each part could operate separately in the case of the
failure of the other part. Figure 6 shows ADIRU 1 from VH-QPA.
Figure 6: ADIRU 1 from VH-QPA
Inertial
reference
part
Air data
part
Flight
control
computers
(PRIMs
and SECs)
ADIRUs
Air data
sensors
- 11 -
The ADR part of the ADIRU supplied barometric altitude, speed, Mach, angle of
attack (AOA) and temperature information to other aircraft systems. It received air
data from the aircraft’s pitot probes, static pressure ports, AOA sensors, and total
air temperature probes. Air data modules converted pneumatic data from pitot and
static sources into electrical signals for the ADIRUs.
The IR part supplied attitude, flight path vector, track, heading, accelerations,
angular rates, ground speed, vertical speed and aircraft position information to other
systems. Two GPS receivers were connected to the IR part of the ADIRUs.
For most types of data, each ADIRU obtained its data from a different sensor. For
example, ADIRU 1, ADIRU 2 and ADIRU 3 each obtained AOA data from a
different AOA sensor. Each of the PRIMs monitored the outputs from each of the
ADIRUs. Figure 7 provides a simplistic representation of the relationship between
the sensors, ADIRUs and PRIMs using the AOA sensors as an example.
Figure 7: Angle of attack inputs to ADIRUs and PRIMs
Angle of attack sensors
Angle of attack19 (AOA) data was sourced from three AOA sensors (AOA 1, AOA
2, and AOA 3), installed on the forward fuselage. AOA 1 and 2 were installed on
the left and right sides of the fuselage respectively. AOA 3 was installed below
AOA 2. Figure 8 shows the AOA 2 and AOA 3 sensors of VH-QPA.
Each AOA sensor utilised two identical outputs (A and B for each sensor) for
redundancy. The relevant ADIRU checked the A and B signals to ensure that they
agreed. If they agreed, the data was passed on to other systems.
19 Angle of attack: the angle between the wing chord (centreline) and the airflow direction.
AOA PRIM 1
sensor 1
AOA
sensor 2
AOA
sensor 3
ADIRU 3
ADIRU 2
ADIRU 1
PRIM 2
PRIM 3
- 12 -
Figure 8: Right side AOA sensors (AOA 2 and AOA 3)
ADIRS control panel
An ADIRS control panel was located on the overhead panel in the flight deck
(Figure 9). The panel provided local fault indications for the parts of the system. If
there was a fault with the ADR part of an ADIRU (see item 1 in the figure), an
amber fault light illuminated. The relevant part could be deactivated by pressing the
push-button switch below the fault indication light. The IR part of the ADIRU
operated in the same manner (see item 2).
The IR rotary mode selector (see item 3 in Figure 9) allowed the flight crew to
select either the NAV position (supplied full inertial data to aircraft systems for
normal operation), ATT (supplied only attitude and heading information) or OFF
(ADIRU was not energised and ADR and IR information was not available).
Attitude heading and air data selectors
ADIRU 1 was connected to the captain’s displays and ADIRU 2 was connected to
the first officer’s displays. ADIRU 3 could be manually switched to either the
captain’s or first officer’s position in the event of a failure of ADIRU 1 or ADIRU
2. This was achieved using either the ATT HDG switch (for IR parameters) and/or
the AIR DATA switch (for ADR parameters). The switches were located on the
pedestal panel in the flight deck (see item 1 in Figure 10).
- 13 -
Figure 9: ADIRS control panel schematic
Figure 10: ATT HDG and AIR DATA switches
Meteorological information
The Bureau of Meteorology provided the following information regarding the
weather conditions prevailing at the location and time of the occurrence:
• A ridge extended over southern Western Australia with a surface trough
developing along the north and west coasts during the day.
• A sharpening upper level trough extended from the Great Australian Bight
through Perth and into the Indian Ocean.
• Some thunderstorm activity was recorded from about Karratha to just north of
Learmonth, with cloud tops to about flight level (FL) 330 (33,000 ft).
• The axis of a 120 kt sub-tropical jet stream lay north-west to south-east between
Learmonth and Carnarvon at FL 400 (40,000 ft). A shear line was developing
south of the jet-stream as the upper trough developed.
- 14 -
• Data obtained at 0600 UTC (1400 local time) on 7 October 2008 showed a shear
line associated with the upper level trough well south of the jet stream. There
was no evidence of any penetration of cold air under the jet stream that could
have lead to increased vertical wind shear.
• Three model-generated forecasts predicted an area of moderate turbulence
associated with the jet stream.
• At the time of the occurrence, the aircraft appeared to be in the vicinity of the
sub-tropical jet stream, to the near north of a shear line and well south of any
significant convection activity.
• Turbulence at a moderate or greater level was unlikely to have influenced the
aircraft at the time of the occurrence.
Flight recorders
Overview
The aircraft was fitted with three flight recorders:
• a cockpit voice recorder (CVR)
• a flight data recorder (FDR)
• a quick access recorder (QAR).
The CVR and FDR are the so-called ‘black-boxes’ and are required by regulation to
be installed on certain types of aircraft. Information recorded by the CVR and FDR
is stored in crash-protected modules.
The QAR is an optional recorder that the operator had chosen to fit to all their A330
aircraft. Information recorded by the QAR is not crash-protected. As the name
suggests, QARs allow quick access to flight data whereas FDRs require specialist
downloading equipment. The parameters that are recorded by an FDR are defined
by regulatory requirements. However, QAR systems can be configured by an
operator to record different parameters. Operators routinely use QAR data for
engineering system monitoring and fault-finding, incident investigation and flight
operations quality assurance programs.
Recording system operation
CVR system
The CVR recorded the total audio environment in the cockpit area, which may
include crew conversation, radio transmissions, aural alarms, control movements,
switch activations, engine noise and airflow noise. The CVR installed in VH-QPA
retained the last 2 hours of information in solid-state memory, operating on an
endless-loop principle.
FDR system
The FDR recorded aircraft flight data and, like the CVR, operated on an endlessloop
principle. The recording duration was required to be at least 25 hours and the
- 15 -
FDR typically recorded when at least one engine was operating and stopped
recording 5 minutes after the last engine was shutdown. The FDR installed in VHQPA
recorded approximately 1,100 parameters and used solid-state memory as the
recording medium.
QAR system
Like the FDR, the QAR20 recorded aircraft flight data. The QAR installed in VHQPA
stored data on a removable magneto-optical disk with a capacity of 230
Mbytes and recorded approximately 250 parameters. Operators balance the logistics
of handling large quantities of QAR disks with the benefits of obtaining the data as
soon as possible after a flight has occurred. Typically most operators would leave a
disk inserted in the QAR for several days until the aircraft returned to a suitable
maintenance base.
Recorder recovery
The Australian Transport Safety Bureau (ATSB) supervised the removal of the
CVR, FDR and QAR disk from the aircraft in Learmonth and their dispatch to the
ATSB’s technical facilities in Canberra.21 They were received in Canberra on 8
October 2008 and were replayed immediately. Preliminary FDR data was provided
to the investigation team on 9 October 2008.
Results
CVR download
The entire 2 hours of recorded audio was successfully downloaded by ATSB
investigators in Canberra. Analysis of the audio showed that power had been
removed from the CVR soon after the aircraft arrived at the terminal in Learmonth.
As a consequence, the CVR had retained the audio recorded during the accident
sequence from prior to the initial autopilot disconnection and including both pitchdown
events.
FDR download
The FDR was downloaded by ATSB investigators in Canberra. The FDR had
recorded over 217 hours of aircraft operation, comprising the accident flight and 24
previous flights. The oldest flight recorded was QF51 on 23 September 2008.
For the accident flight, continuous data from engine start on the ground in
Singapore until after engine shutdown at Learmonth was successfully recovered.
FDR data was used to produce a sequence of events (see below) and plots (refer to
Appendix B). Figure B1 provides summary data for the whole flight, and Figures
20 As the parameters recorded by the QAR were configurable by the airline, it is described as a
Digital ACMS Recorder (DAR) in Airbus terminology. To avoid confusion, the generic term QAR
is used in this report. ACMS is an abbreviation for Aircraft Condition Monitoring System.
21 CVR details: Part Number 2100-1020-02, Serial Number 000252164. FDR details: Part Number
2100-4043-02, Serial Number 000428627.
- 16 -
B2 and B3 provide more detailed data for the period covering the two in-flight
upsets. Figures B4 and B5 provide specific information for each of the upsets.
QAR download
Files stored on the QAR disk were recovered by the ATSB. Flight data from seven
flights was successfully recovered. The flights recorded were:
• 4 October 2008: Sydney – Adelaide, Adelaide – Singapore
• 5 October 2008: Singapore – Perth, Perth – Singapore
• 6 October 2008: Singapore – Perth, Perth – Singapore
• 7 October 2008: Singapore – Learmonth
For the accident flight, continuous data from engine start on the ground in
Singapore until after engine shutdown at Learmonth was successfully recovered.
Sequence of events
Table 3 provides a sequence of events prepared from data obtained from the
aircraft’s FDR. Times use UTC; local time was UTC plus 8 hours. Shaded areas
indicate events within the two in-flight upsets.
Table 3: Occurrence flight sequence of events
Time (UTC)
(hh:mm:ss)
Time relative
to event
(hh:mm:ss)
Event:
01:32:02 -03:10:23 Takeoff at Singapore
02:01:16 -02:41:09 Aircraft reached top of climb (37,000 ft or FL370)
04:40:28 -00:01:57 Autopilot 1 disconnect (involuntary)
04:40:28 -00:01:57
First master warning was recorded. Warnings
occurred during the remainder of the flight.
04:40:29 -00:01:56
First master caution was recorded. Cautions occurred
during the remainder of the flight.
04:40:31 -00:01:54
IR 1 Fail indication commenced (duration: remainder
of the flight)
04:40:34 -00:01:51
First angle-of-attack (AOA) spike for the captain’s (or
Left) AOA parameter – the spike value was +50.6
degrees. AOA spikes continued for the remainder of
the flight.
04:40:41 -00:01:44
First ADR 1 Fail indication (duration: less than 4
seconds)
04:40:50 -00:01:35 First stall warning (duration: less than one second)
04:40:54 -00:01:31
First overspeed warning (duration: less than one
second)
04:41:12 -00:01:13 Autopilot 2 engaged
04:41:14 -00:01:11
Aircraft reached 37,180 ft and began to descend to
37,000 ft
- 17 -
04:41:28 -00:00:57 Autopilot 2 disconnected
04:42:27 0:00:00 First pitch-down event commenced
04:42:28 0:00:01 Captain applied back pressure to the sidestick
04:42:28 0:00:01
A maximum nose-down elevator position of +10.3
degrees was recorded
04:42:29 0:00:01
A minimum vertical acceleration of -0.80 g was
recorded
04:42:29 0:00:04 A minimum pitch angle of -8.4 degrees was recorded
04:42:30 0:00:05 PRIM master changed from PRIM 1 to PRIM 2
04:42:31 0:00:05
A maximum vertical acceleration of +1.56 g was
recorded
04:42:31 0:00:06 PRIM 3 Fault (duration: 120 seconds)
04:43:45 0:01:20 Captain switched his IR source from IR 1 to IR 3
04:45:08 0:02:43 Second pitch-down event commenced
04:45:09 0:02:44 Captain applied back pressure to the sidestick
04:45:10 0:02:45 PRIM master changed from PRIM 2 to PRIM 1
04:45:11 0:02:46
A maximum nose-down elevator position of +5.4
degrees was recorded
04:45:11 0:02:46 PRIM 3 Fault (duration: remainder of the flight)
04:45:11 0:02:46
Flight controls’ ‘normal law’ changed to ‘alternate law’
(duration: remainder of the flight)
04:45:12 0:02:47
A minimum vertical acceleration of +0.20 g was
recorded
04:45:12 0:02:47 A minimum pitch angle of -3.5 degrees was recorded
04:45:13 0:02:48
A maximum vertical acceleration of +1.54 g was
recorded
04:47:25 0:05:00 Autothrust disengaged
04:49:05 0:06:40
A radio transmission commenced. Correlation with the
CVR showed that this was the PAN transmission.
04:54:24 0:11:59
A radio transmission commenced. Correlation with the
CVR showed that this was the Mayday transmission.
05:32:08 0:49:43 Aircraft touched down at Learmonth
05:42:12 1:02:47 Aircraft stopped at terminal
05:50:32 1:08:07 Power removed from FDR
FDR information related to ADIRUs
Recorded ADIRU parameters
Air data reference parameters that were recorded by the FDR included:
• pressure altitude
• computed airspeed
• mach number
- 18 -
• static air temperature
• angle of attack (AOA) from both the captain’s (AOA 1) and first officer’s (AOA
2) sensors
Inertial reference parameters that were recorded by the FDR included:
• pitch angle
• roll angle
• groundspeed
• inertial vertical speed
• drift angle
• heading
• latitude and longitude.
Some parameters required inputs from both the ADR and IR functions. They
included wind speed and wind direction.
IR 1 and ADR 1 Fail indications
At 0440:28 UTC (1240:28 local time), autopilot 1 disconnected involuntarily22 and
the inertial reference system (IR) function of ADIRU 1 began to indicate ‘Fail’
(04:40:31). The IR 1 Fail indication continuously indicated ‘Fail’ until after landing
at Learmonth.
As the IR 1 Fail indication was only sampled once every 4 seconds, it may have
preceded the autopilot disconnection. A review of the recorded data and system
functionality determined that the autopilot probably disconnected due to a
discrepancy between the values of an ADIRU parameter received by the Flight
Management Guidance Envelope Computer (FMGEC23 1). The specific parameter
associated with the disconnection could not be determined.
The first ADR 1 ‘Fail’ indication began at 0440:41 UTC. This indication lasted for
less than 4 seconds. Unlike the IR Fail indication, the ADR Fail indication did not
continuously indicate ‘Fail’. In total, 20 ADR 1 ‘Fail’ indications were recorded
before the aircraft touched down at Learmonth. As the ADR 1 ‘Fail’ parameter was
sampled once every 4 seconds, a brief ADR 1 fail indication may not necessarily be
sampled and recorded. As a result, the number of actual ADR 1 ‘Fail’ indications
may have been larger than the number recorded by the FDR.
There were no Fail indications associated with ADIRU 2 or ADIRU 3 throughout
the flight.
22 An involuntary autopilot disconnection occurs automatically without any action by the crew.
23 The FMGECs were part of the autoflight system and provided output commands to the control
surfaces via the PRIMs and to the engines via the engine electronic control units.
- 19 -
Spikes in FDR and QAR data
Spikes24 from ADIRU 1 were evident in the following parameters:
• angle of attack
• pressure altitude
• computed airspeed
• mach number
• static air temperature
• pitch angle
• roll angle
• wind speed
• wind direction.
The spikes appeared to be random in nature and occurred for different parameters at
different times.
Angle of attack spikes
For an A330, during all phases of flight, the typical operational range of AOA is +1
degree to +10 degrees. In cruise, a typical AOA is +2 degrees.
The first AOA 1 spike occurred at 0440:34 UTC. AOA 1 values changed from +2.1
degrees to +50.6 degrees and back to +2.1 degrees over three successive samples.
In total, 42 AOA 1 spikes were recorded before the aircraft touched down at
Learmonth. As AOA 1 was sampled by the FDR once per second, a spike may not
necessarily be sampled and recorded. As a result, the number of actual AOA 1
spikes may have been larger than the number recorded.
One of the recorded AOA spikes occurred at 04:42:26 UTC, immediately prior to
the first pitch-down (04:42:27). Another of the recorded spikes occurred at 04:45:08
UTC, immediately prior to the second pitch-down (04:45:09). Both of those spikes
had a magnitude of +50.6 degrees.
Effects of the spikes on failure indications
A stall warning parameter was recorded by the FDR. The first stall warning
occurred at 0440:50 UTC and numerous stall warnings were recorded from this
time until 0512:00 UTC when the aircraft was descending through an altitude of
12,400 ft. As the stall warning parameter was sampled once per second, a brief
warning may not necessarily be sampled and recorded. As a result, the number of
actual stall warnings received by the crew may have been larger than the number
recorded. Examination of other recorded parameters indicated that the stall
warnings were spurious.
24 A spike is a short duration transient which exceeds the normal value by a large amount.
- 20 -
An overspeed parameter was recorded by the FDR. The first overspeed warning
occurred at 0440:54 UTC and numerous warnings were recorded from this time
until 0502:01 UTC when the aircraft was descending through an altitude of 25,400
ft. As the overspeed warning parameter was sampled once per second, a brief
warning may not necessarily be sampled and recorded. As a result, the number of
actual overspeed warnings received by the crew may have been larger than the
number recorded. Examination of other recorded parameters indicated that the
overspeed warnings were spurious.
ADIRU 1 normally supplies the captain’s PFD with IR and ADR parameters. The
spikes in many of these parameters would have led to fluctuations and loss of data
on the captain’s PFD. At 0443:45 UTC, the source of IR parameters for the
captain’s PFD was switched from IR 1 (ADIRU 1) to IR 3 (ADIRU 3).25 This
action provided valid IR parameters to the PFD; however ADR parameters were
still being sourced from ADR 1 (ADIRU 1).
A master caution aural alert (a single chime) occurs when certain types of failure
messages appear on the ECAM. Separate master caution parameters for the captain
and first officer were recorded by the FDR. The first master caution occurred at
0440:29 UTC and repetitive master cautions were recorded from this time until the
FDR was powered down on the ground at Learmonth.
The PRIM faults are discussed in Review of PRIM monitoring functions.
Aircraft examination
Structural examination
Visual inspection of the aircraft found no missing or loose fasteners, no creases or
folds in the fuselage skin and no signs of distress to any of the fuselage, wing or
empennage skin, fairing panels or flight controls.
The FDR data showed that the peak g loadings during the flight were +1.56 g and
- 0.80 g, with almost no lateral g loading. The conditional inspection section of the
Aircraft Maintenance Manual (AMM) (Section 05-51-17, Inspections after flight in
excessive turbulence or in excess of VMO) defined the normal flight operating range
as -1.0 g to +2.5 g. Aircraft operation within this environment did not require
additional inspections. Based on the review of the FDR data, the aircraft
manufacturer asked for a visual inspection of the elevator servo-control attachment
fittings. The inspection found no problems.
Cargo hold inspection
Inspection of the cargo area found all cargo was loaded in the correct position as
recorded on the load manifest for the flight and no load shift was evident. All of the
cargo containers and palletised cargo remained properly secured by the integral
cargo restraint systems built into the floor of the cargo holds. Each individual
freight container and pallet was also examined for load shift or break out of
25 This change was consistent with the crew selecting the ATT HDG switch to the CAPT ON 3
position at about this time in response to an ECAM message.
- 21 -
individual items from within each unit. None was evident. After removal of the
cargo, the aircraft hold’s structure and restraint systems were inspected for damage
which might be attributed to the event. No anomalies were found.
Once removed from the aircraft, and under the supervision of Australian Quarantine
and Customs officers, the cargo was inspected for items which might be possible
sources of electronic or electromagnetic interference. None were identified.
Wiring examinations
Due to the level of damage to ceiling panels in the cabin, all the ceiling panels were
removed and wiring looms were visually inspected. No defects were observed.
After the aircraft had been ferried to a maintenance base, the operator conducted
precautionary checks of the aircraft’s ADIRU interface wiring. The checks involved
continuity, short circuit, electrical bonding and shielding tests. No problems were
found.
Central maintenance system
The central maintenance system (CMS) enabled trouble-shooting and return-toservice
testing to be carried out rapidly from the flight deck. The hub of the CMS
was the central maintenance computer which assisted in the diagnosis of faulty
systems.
Central maintenance computer (CMC)
Each aircraft system has built-in test equipment (BITE) which is used to test system
components and detect faults and to confirm system operation following any
maintenance. Each of the aircraft’s systems communicates with the CMC and sends
it information on detected faults and any warnings indicated to the flight crew.
When the aircraft was on the ground, maintenance engineers could access the CMC
using a multi-purpose control and display unit (MCDU) from the flight deck and
obtain information from the most recent flight or earlier flights. Through using the
MCDU, BITE information from aircraft systems could be interrogated and the
systems tested.
Aircraft systems could detect faults in two ways: internally, by monitoring its own
operation, or externally, by another aircraft system which received and monitored
information from the ‘faulty’ system. For example, a fault with an ADIRU could be
detected by the ADIRU itself or by another ADIRU or system.
Post flight report (PFR)
The CMC produced various reports that were accessible through the MCDU when
the aircraft was on the ground. Those reports included the post flight report (PFR),
which was produced and printed at the end of a flight. The PFR contained fault
information received from other aircraft systems’ BITE and which was sent to the
CMC during flight.
- 22 -
When the CMC produced the PFR at the end of a flight, it carried out some
correlation between the warnings provided by the flight warning computer (FWC)
and the fault data provided by aircraft system BITE.
The PFR had some limitations:
• fault information was only recorded to the nearest minute
• it only showed the first occurrence of a fault, so an intermittent occurrence of
the same fault message would not be shown
• the correlation performed by the CMC, at the time that the first fault was
detected, was designed to group all the same ATA26 chapter faults together and
would only show the first fault that was detected along with a list of systems that
detected the fault.
The PFR recorded that, between 0440 and 0442, a fault was detected with ADIRU 1
by several aircraft systems. At about the same time, several related fault messages
were provided to the ECAM, including:
• NAV IR 1 FAULT
• NAV GPWS FAULT
• FLAG ON CAPT ND MAP NOT AVAIL
• NAV GPS 1 FAULT
• NAV GPS 2 FAULT
• NAV IR NOT ALIGN
Starting at 0440, there were also a series of related messages which were associated
with the anti-icing aspect of the ADIRS sensors, including A.ICE L CAPT STAT
HEAT, A.ICE R CAPT STAT HEAT, A.ICE CAPT PROBES HEAT, A.ICE
CAPT PITOT HEAT and A.ICE CAPT AOA HEAT.
The PFR recorded that a fault was detected with PRIM 1 and PRIM 3 at 0442.
Related fault messages provided to the ECAM included:
• F/CTL PRIM 1 PITCH FAULT
• F/CTL PRIM 3 FAULT
The PFR also recorded that a fault was detected with PRIM 2 at 0445. Related fault
messages provided to the ECAM included:
• F/CTL PRIM 2 PITCH FAULT
• F/CTL ALTN LAW (see also Review of PRIM monitoring functions).
Data downloads from aircraft systems
As the PFR only shows a summary of the warnings and faults, to obtain complete
information, further interrogation of the BITE information from individual systems
could be performed. When the aircraft was on the ground, reports generated from
system BITE memory could be printed using the MCDU.
26 The Air Transport Association (ATA) categorises aircraft systems based on a chapter numbering
system. This categorisation is widely used in aircraft documentation.
- 23 -
Based on an examination of the FDR data, the aircraft manufacturer recommended
removing ADIRU 1 and the number-1 PHC before conducting any data downloads
or testing of the aircraft’s systems. Replacement units were then installed and BITE
data downloaded from the following aircraft equipment and systems while the
aircraft was at Learmonth:
• electronic flight control system (including the PRIMs, flight control secondary
computers and flight control data concentrators)
• autoflight system including the flight management guidance envelope computers
(FMGECs)
• air data and inertial reference system
• landing gear control interface units (LGCIUs)
• enhanced ground proximity warning system (EGPWS)
• probe heat computers
• multi-mode receivers
• electrical power generation system.
Pertinent results were as follows:
• FMGEC 1 and 2 were each connected to ADIRUs 1, 2 and 3. Both FMGECs 1
and 2 detected anomalous behaviour of ADIRU 1 but did not detect any
problems with ADIRUs 2 and 3.
• LGCIUs 1 and 2 were connected to ADIRUs 1 and 3 (ADR part only). Both
LGCIUs 1 and 2 detected anomalous behaviour of ADIRU 1 but did not detect
any problems with ADIRU 3.
• EGPWS was connected to ADIRU 1 only. EGPWS detected anomalous
behaviour of ADIRU 1.
In summary, the BITE data for several systems indicated a problem with ADIRU 1
but no data indicated a problem with ADIRU 2 or ADIRU 3 (see also ADIRU test
results).
System testing
After PFR and BITE data were downloaded, operational tests were performed on
the following aircraft systems at Learmonth in accordance with the aircraft
manufacturer's recommended maintenance procedures:
• electronic flight control system
• inertial reference systems
• air data reference systems
• probe heat computers
• multi-mode receivers
• flight guidance computers
• electrical power generation system
• elevator hydraulic actuation and pitch control.
- 24 -
A fault was identified with the elevator hydraulic control, but this was considered
by the aircraft manufacturer to be unrelated to the circumstances of the occurrence.
The fault had a known cause that was only triggered under a very specific set of
circumstances, different to those seen during the occurrence. The aircraft systems
passed all other tests.
Flight control primary computers (PRIMs)
The three PRIMs were removed from the aircraft and examined by an authorised
agency. It was confirmed that each PRIM was loaded with identical operational
software (version P7/M16). The PRIMs were tested and the BITE data was
downloaded from each unit. The results were:
• FCPC 1 (serial number 7270): During testing, no fault was found. No faults
were stored in BITE data.
• FCPC 2 (serial number 6165): During testing, no fault was found. The BITE
data did not contain any faults relevant to the pitch-down events.
• FCPC 3 (serial number 6170): During testing, the unit failed a lightning
protection test. The aircraft manufacturer advised that this result was unrelated
to the pitch-down events. The BITE data did not contain any faults relevant to
the pitch-down event.
Based on a review of the recorded data and system functionality, the PRIM faults
recorded by the FDR and PFR were found to be consequences of the pitch-down
events (see Review of PRIM monitoring functions).
Probe heat computer
Some of the PFR messages indicated a potential fault with the number-1 probe heat
computer (PHC). Those messages could be generated by either a PHC fault or by an
ADIRU fault. The PHC (serial number 2083) was tested by an authorised agency
and no fault was found. Based on a review of available information, the messages
related to the PHC were considered to be spurious.
Angle of attack sensor
The AOA 1 sensor (serial number 0861ED-972) was tested by an authorised
agency. No fault was found with the sensor and all test parameters were within
limits.
ADIRU testing
The ATSB took custody of ADIRU 1 (serial number 4167) in Learmonth on 10
October 2008 while ADIRUs 2 and 3 (serial numbers 4687 and 4663 respectively)
remained installed in the aircraft. On 15 October 2008, after the aircraft had been
ferried back to Sydney, ADIRUs 2 and 3 were removed from the aircraft and
quarantined by the operator. Also on 15 October 2008, custody of ADIRU 1 was
transferred from the ATSB to the operator.
The three ADIRUs were despatched to the ADIRU manufacturer’s facility in Los
Angeles. ADIRU 1 was received on 17 November 2008 while ADIRUs 2 and 3
- 25 -
were received on 18 November 2008. All three ADIRUs were quarantined on
arrival and locked in a secure storage room awaiting the arrival of the investigation
team.
ADIRU test plan
To make the testing process efficient, it was necessary to have an agreed test plan in
place before the investigation teams arrived at the manufacturer’s facility. The
testing priorities were to:
• minimise the chance of losing perishable data
• use standard test procedures before testing the ADIRUs with novel procedures
• review current test results before proceeding with the next test
• order the testing so that ‘whole box’ testing was completed before an ADIRU
was disassembled
To minimise the chance of losing perishable data or the chance that test
equipment/procedures might damage an ADIRU, an exemplar ADIRU was
included in the testing. The exemplar unit was provided by the ADIRU
manufacturer and was functionally identical to ADIRU 1, and had the same
hardware/software modification status. ADIRU testing was performed on the
exemplar unit before being performed on ADIRU 1.
Participants
The following organisations attended the ADIRU testing at the manufacturer’s
facilities in the US: the ATSB; the French Bureau d’Enquêtes et d’Analyses pour la
sécurité de l’aviation civile (BEA); the US National Transportation Safety Board
(NTSB); the aircraft manufacturer; the ADIRU manufacturer; the operator; and the
US Federal Aviation Administration (FAA).
ADIRU test schedule
Testing commenced on 17 November 2008 with all the participating organisations
present. Daily reviews and discussions of the test results were held. Once it was
realised that an obvious fault with ADIRU 1 was not going to be found, an ongoing
test program was developed and agreed. The witnessed testing period concluded on
25 November 2008 and the test program is continuing at the manufacturer’s facility.
Protocols are in place for the oversight of the testing, regular reporting of the results
to investigation team members and analysis of the results.
Completed ADIRU tests
The tests completed at the time of publication of this report were:
• Physical inspection: the three ADIRUs were inspected visually for damage with
particular emphasis on the connector pins.
• Ground integrity test: various connector pins on ADIRU 1 were electrically
tested for ground integrity.
- 26 -
• Program verification: the three ADIRUs were connected to a test bench and the
operational flight program (OFP) software was downloaded from the units to
check that it was the correct version and was not corrupted.
• Recorded data download: BITE data from the three ADIRUs was downloaded
and analysed.
• Built-in test and manufacturing test procedure: the three ADIRUs were
connected to a test bench and the units’ internal test equipment was run.
Additional functional tests were also performed on the bench.
• Bus tests: ADIRU 1 was connected to a test bench and the bus traffic was
recorded while different bus load impedances were simulated. The bus output
waveforms were also recorded and analysed for comparison with the
specification.
• Internal visual inspection: the case of ADIRU 1 was opened and an internal
visual inspection was completed without removing any internal equipment.
• Environmental tests: ADIRU 1 was subjected to a range of environmental tests
including vibration and temperature. One environmental stress screening test
used a temperature range of -40 °C to +70 °C. ADIRU 1 was also subjected to
electromagnetic interference (EMI) tests in accordance with the frequencies and
field strengths specified in DO-160C.27 In addition to the frequencies specified
in the standard, ADIRU 1 was also subjected to specific conducted susceptibility
tests at the Harold E. Holt Naval Communication Station frequency of 19.8 kHz
and a field strength of 100 Volts/metre (see Electromagnetic interference).
ADIRU test results
The BITE data from ADIRUs 2 and 3 was successfully recovered and showed that
there were anomalies in the way that ADIRU 1 had been transmitting data to other
aircraft systems. The BITE data did not show any problems with the performance of
ADIRUs 2 and 3.
BITE data from ADIRU 1 was recovered and showed:
• No data had been stored for the time periods relating to the pitch-down events.
• Several routine BITE messages that were expected to have been stored were not
recorded.
• There were anomalies in the BITE elapsed time interval parameter.
Following the BITE downloads and successful completion of the standard
manufacturing test procedures, the investigation team agreed that no further testing
of ADIRUs 2 and 3 was required.
None of the testing that has been completed to date on ADIRU 1 has produced any
faults that were related to the pitch-down events. While some faults have been
detected during the extensive testing, they have been confirmed as being due to the
artificial nature of the testing or problems with the test equipment.
27 DO-160C, Environmental Conditions and Test Procedures for Airborne Equipment,
produced by the Radio Technical Commission for Aeronautics (RTCA). Issued 12 April
1989.
- 27 -
Further testing of ADIRU 1 is in progress (see ONGOING INVESTIGATION
ACTIVITIES).
Review of PRIM monitoring functions
The aircraft’s flight control system included three flight control primary computers
(FCPCs, commonly known as PRIMs) and two flight control secondary computers
(FCSCs, commonly known as SECs). One PRIM functioned as the master while the
other two PRIMs could take over as master if a fault in the current master was
detected. The master PRIM processed and sent control surface deflection orders to
other computers, which executed them using servo-controls. The two other PRIMs
continuously computed control orders and monitored control surface deflections but
those orders were not actioned.
Each PRIM consisted of two independent parts, a Command (COM) part and a
Monitor (MON) part. The MON part monitored the performance of the COM part
and the position of the control surfaces. If there was a discrepancy between COM
and MON, then the PRIM would ‘fault’ itself. The fault could be for only a part of
the PRIM (for example, pitch channel) or for the whole PRIM. A PRIM could not
generate a fault for the whole PRIM unless it was the master. The PRIM Fault
parameter recorded by the FDR was active only for a fault of the whole PRIM and
not for a partial fault (for example, a pitch channel fault). However, partial faults
were recorded by the PFR.
For elevator control, the active servo-controller in normal operation was PRIM 1.
The servo-controller priority order was PRIM 1, PRIM 2, SEC 1 and SEC2. If
PRIM 1 could not perform this function, then the servo-control function reverted to
PRIM 2 and so on.
Table 4 provides a sequence of events for the PRIMs and is based on a review of
the FDR and PFR data by the aircraft manufacturer and investigation team.
Table 4: PRIM sequence of events
Time (UTC):
(hh:mm:ss)
Master
PRIM:
Active
Law:
Pitch
servocontroller:
Event:
Prior to
04:42:30
PRIM 1 Normal PRIM 1 Uneventful flight (takeoff, climb and
initial cruise)
04:42:30 PRIM 3 Normal PRIM 2 F/CTL PRIM 1 Pitch Fault (during first
pitch-down event). PRIM 3 became
master PRIM.
04:42:31 PRIM 2 Normal PRIM 2 PRIM 3 Fault (duration: 120 seconds).
PRIM 2 became master PRIM.
04:43:31 PRIM 2 Normal PRIM 2 PRIM 3 status changed from Fault to
No Fault. This was consistent with it
having been reset by the crew.
04:45:10 PRIM 3 Normal SEC 1 F/CTL PRIM 2 Pitch Fault (during
second pitch-down event). PRIM 3
became master PRIM.
From 04:45:10
until the end of
flight
PRIM 1 Alternate SEC 1 PRIM 3 Fault. PRIM 1 became master
PRIM, but because it already had a
Pitch Fault it could not operate in
- 28 -
normal law and reverted to alternate
law.
In summary, the PRIM PITCH FAULTs and PRIM 3 FAULTs that occurred during
the flight were consistent with the system design. They were consequences of the
pitch-down events and not the initiators of those events.
Review of PRIM angle of attack processing
In addition to identifying the nature of the ADIRU failure which led to erroneous
data outputs, a key aspect of the investigation was to determine why the erroneous
data outputs had an undesirable and abrupt effect on the aircraft’s elevator
positions. As part of the investigation, the manufacturer conducted a detailed
review of how AOA data was processed by the PRIMs on the A330.
General ADIRU data processing algorithms
As with other modern airline aircraft, the A330 used a variety of redundancy and
error-checking mechanisms to minimise the probability of erroneous ADIRU data
having a detrimental effect on the aircraft’s flight controls.
For most of the ADIRU parameters, the PRIMs obtained three different values of
the same parameter. Each value came from a different sensor and was processed by
a different ADIRU. The PRIMs compared the value of the parameter coming from
each ADIRU. If the value of any of the parameters differed from the median
(middle) value by more than a threshold amount for more than a set period of time,
then the relevant part (that is, ADR or IR) of the associated ADIRU would no
longer be used by the PRIMs.
In addition, for ADIRU parameters except for AOA, when all three values were
valid, the median value was used for calculating the flight control commands. The
use of the median values was robust to any error from one data source.
Angle of attack data processing algorithms
There was a potential for the AOA sensors on the right side of the aircraft (AOA 2
and AOA 3) to provide different values to the AOA sensor on the left side of the
aircraft (AOA 1) in some situations due to aircraft sideslip.28 In order to minimise
the potential effect of this difference, the PRIMs used different processes for AOA
compared with other parameters when determining the value to use for calculating
flight control commands. More specifically, the processing of AOA data involved
the following:
• As with the other parameters, the PRIMs would continuously monitor the AOA
values from the three ADIRUs. AOA data was sampled about 20 times per
second.
• To confirm the validity of the AOA data, the PRIMs would compare the median
value from all three ADIRUs with the value from each ADIRU. If the difference
was greater than a set value for more than 1 second continuously, then the PRIM
28 Sideslip: a condition in which the oncoming airflow is at a sideways angle to the aircraft’s
centreline.
- 29 -
would flag the ADR part of the associated ADIRU as faulty and ignore its data
for the remainder of the flight.
• To calculate a value of AOA to use for calculating flight control commands, the
PRIMs would use the average value of AOA 1 and AOA 2. In other words,
(AOA 1 + AOA 2)/2. This value was passed through a rate limiter to prevent
rapid changes in the value of the data due to short-duration anomalies (for
example, as a result of turbulence).
• If the difference between AOA 1 (or AOA 2) and the median value from all
three ADIRUs was higher than a set value, the PRIMs memorised the last valid
average value and used that value for a period of 1.2 seconds. After 1.2 seconds,
the current average value would be used.
In summary, in contrast to other parameters, only two values of AOA were used by
the PRIMs when determining flight control commands. However, several risk
controls were in place to minimise the potential for data inaccuracies to affect the
flight control system.
Scenario where AOA spikes could influence flight controls
The aircraft manufacturer advised that the AOA processing algorithms would
prevent most types of erroneous AOA inputs provided by the ADIRUs having an
influence on flight control commands. This included situations such as an AOA
‘runaway’ (or a continuous divergence from the correct value), single AOA spikes
and most situations where there were multiple AOA spikes. However, the
manufacturer identified that, in a very specific situation, the PRIMs could generate
an undesired nose-down elevator command. This specific situation involved
multiple AOA data spikes with the following properties:
• there were at least two short duration, high amplitude spikes
• the first spike was shorter than 1 second
• the second spike occurred and was still present 1.2 seconds after the detection of
the first spike.
Recorded flight data from the accident flight showed that there were 42 recorded
spikes in AOA 1 data. Due to recorder sampling rate limitations, it is likely that
there were additional AOA 1 spikes that were not evident in the recorded data and it
is not possible to reconstruct the exact duration and timing of any of the spikes.
Although a large number of AOA 1 spikes occurred on the accident flight, on all
but two of those occasions, the processing algorithm filtered them out and they had
no influence on the flight controls.
The aircraft manufacturer advised that AOA spikes may occur on many flights, but
in its experience, there were usually only a very small number of spikes on any
particular flight. It was not aware of any previous event where AOA spikes had met
the above conditions and resulted in an in-flight upset.
Simulation studies
As part of the investigation, the manufacturer reported that it had performed
simulation studies concerning the filtering of AOA spikes by a PRIM. The
simulation studies confirmed that the input of two AOA spikes which met the
- 30 -
conditions listed above, were not effectively filtered by the PRIM, and could lead to
undesired nose-down elevator commands.
Flight envelope mechanisms influenced by AOA spikes
The aircraft manufacturer reported that, based on its analysis of the available data
and its review of system design, two of the flight envelope mechanisms were
influenced by the AOA spikes during the accident flight: high angle of attack
protection (alpha prot) and anti pitch-up compensation.
Alpha prot was designed to protect the aircraft from high AOAs which could lead to
a stall and loss of control. If the PRIMs detected that the aircraft’s AOA exceeded a
predefined threshold, the computers would command a nose-down elevator
movement to reduce the AOA. Alpha prot was only available when the aircraft was
in normal law. When the aircraft was above 500 ft above ground level, alpha prot
was effective immediately, while below 500 ft it was only active after the AOA
exceeded the threshold for 2 seconds or more.
Anti pitch-up was a pre-command included in the control laws to compensate for a
pitch-up at high Mach due to aerodynamic effect.29 The compensation was available
above Mach 0.65 and when the aircraft was in a ‘clean’ configuration (that is, with
the landing gear and flaps retracted). The maximum authority of the anti pitch-up
compensation was 6 degrees of elevator movement.
The aircraft manufacturer advised that the 10-degree elevator command associated
with the first in-flight upset, was the result of 4 degrees of alpha prot and the 6
degree authority of the anti pitch-up compensation. The 10-degree command was
close to the worst possible scenario that could arise from the design limitation in the
AOA processing algorithm.
For the accident flight, there was only a limited potential for additional upsets to
occur. After the second upset, alpha prot was no longer operative as the flight
control law had reverted from normal law to alternate law. From approximately 18
minutes after the second upset, the aircraft was below Mach 0.65 and anti pitch-up
compensation was no longer active.
The manufacturer advised that a simulation performed with the AOA profile
identified during the first pitch-down event, showed that such an AOA profile
would not have produced a pitch-down event had the aircraft been below 500 ft.
Relevance to other aircraft types
The manufacturer advised that the AOA processing algorithms used by A330
aircraft were also used by A340 aircraft. However, different algorithms were in use
on other Airbus types, which were reported to be more robust to AOA spikes. The
manufacturer advised that AOA spikes matching the above scenario would not have
caused a pitch-down event on Airbus aircraft other than an A330 or A340.
29 Pitch-up is an aerodynamic anomaly that can occur in aircraft with swept wings at high altitude
and at high speed.
- 31 -
Other ADIRU-related occurrences
ADIRU reliability
Most components on modern aircraft, including ADIRUs, are highly reliable.
Nevertheless, failures do occur. The aircraft manufacturer reported that the average
mean time between failure30 (MTBF) for ADIRUs of the model used on VH-QPA,
was about 17,500 flight hours.
ADIRU failures affecting flight controls
It is extremely rare for any ADIRU failures to have an undesirable effect on an
aircraft’s flight controls.
The ATSB investigated an in-flight upset occurrence related to an ADIRU failure
on a Boeing 777-200 aircraft, which occurred on 1 August 2005, 240 km north-west
of Perth. The ADIRU on that aircraft was made by a different manufacturer and of a
different type to that on VH-QPA. Further details of that investigation can be found
on the ATSB web site.31
Airbus has reported that it is unaware of any previous occurrences where an
ADIRU failure on one of its aircraft has resulted in undesirable elevator commands.
However, there have been two other known occasions where ADIRUs have
exhibited similar anomalous behaviour to that which occurred on the 7 October
2008 accident flight, although those problems did not result in any adverse affect on
the aircraft’s flight controls. Those events occurred on 12 September 2006 and 27
December 2008.
VH-QPA, 12 September 2006
On 12 September 2006, VH-QPA was on a scheduled passenger transport service
(QF68) between Hong Kong and Perth, Australia. At 2052 UTC (0452 local time),
while the aircraft was in cruise at 41,000 ft, there was a failure of ADIRU 1. The
ADIRU was the same unit (serial number 4167) as on the 7 October 2008 flight.
The flight crew entered the problem into the aircraft’s technical log, noting that
there had been a NAV ADR 1 FAULT and that they had received numerous ECAM
messages.
The PFR showed that there was a NAV IR1 FAULT at 2052 and, subsequently, a
NAV ADR 1 FAULT at 2122. Maintenance records stated that, in accordance with
the manufacturer’s maintenance procedures for the relevant PFR fault messages, an
ADIRU re-alignment was conducted and a system test of both the IR and ADR was
conducted. No faults were found.
Following the 7 October 2008 accident, further information was obtained regarding
the 12 September 2006 occurrence. The crew reported that the event occurred at
night and that the aircraft was in clear conditions at the time of the event. The first
30 In this context, MTBF is the average time between two failures of any type requiring the unit to be
repaired.
31 See http://www.atsb.gov.au/publications/investigation_reports/2005/AAIR/aair200503722.aspx.
- 32 -
officer was the handling pilot and autopilot 2 was engaged. The crew reported that
they received numerous ECAM warning and caution messages. The messages
changed rapidly and consequently they could not be read properly or actioned.
There were also overspeed and stall warnings present.
The crew reported that they contacted maintenance watch, but subsequent
discussions could not resolve the issue. A scan of the overhead panel identified a
very weak and intermittent ADR 1 fault light. The crew decided to turn off the
ADR 1. Following that action, the warning and caution messages ceased and the
flight continued without further incident. The crew reported that at no stage was
there any effect on the aircraft’s flight controls. The autopilot and autothrust
remained engaged throughout the event.
No FDR or QAR data was available for the 12 September 2006 flight. The location
of the aircraft at the time of the NAV IR 1 FAULT was estimated using positions
reported by ACARS32 messages transmitted before and after the fault occurred.
That technique gave a position 980 km (530 NM) north of Learmonth (Figure 11).
Figure 11: Locations for each occurrence (the point shown is where the
anomalous ADIRU behaviour commenced)
The PFR for the flight contained a series of messages associated with ADIRU 1
which were similar to the PFR for the 7 October 2008 flight. Consistent with there
being no in-flight upset, there were no PRIM FAULTS or PRIM PITCH FAULTS
on the 12 September 2006 PFR. The NAV ADR 1 FAULT, which was recorded 30
minutes after the NAV IR 1 FAULT, may have been associated with the crew
action of turning ADR 1 off.
32 ACARS: Aircraft communications, addressing and reporting system. ACARS transmits
maintenance and operational messages at intervals throughout a flight.
- 33 -
VH-QPG, 27 December 2008
Sequence of events
On 27 December 2008, an Airbus A330-303 aircraft, registered VH-QPG, was on a
scheduled passenger transport service (QF71) from Perth to Singapore. At about
0829 UTC (1729 local time), while the aircraft was in cruise at 36,000 ft, the
autopilot (autopilot 1) disconnected and the crew received an ECAM message
(NAV IR 1 FAULT). ADIRU 1 was the same model but a different unit (serial
number 4122) to that involved in the 12 September 2006 and 7 October 2008
events. Table 5 presents a summary of the sequence of events based on FDR and
QAR data.
Table 5. VH-QPG sequence of events
Time (UTC)
(hh:mm:ss)
Time relative
to event
(hh:mm:ss)
Event:
07:49:55 -00:39:01 Takeoff at Perth
08:14:01 -00:14:55 Aircraft reached top of climb (36,000 ft or FL360)
08:28:55 -00:00:01
IR 1 Fault indication commenced. Sampled once every
four seconds.
08:28:56 00:00:00 Autopilot 1 disconnect (involuntary)
08:29:20 00:00:24
ADR 1 Fault indication commenced. Sampled once
every four seconds.
08:30:21 00:01:25 Autopilot 1 re-engaged
08:32:25 00:03:29 Captain’s PFD source switched to IR 3
09:25:45 00:56:49
Touchdown at Perth (aircraft gross weight was 195.3
tonnes)
The crew reported that they actioned the relevant operational procedure33 by
selecting the IR 1 push-button to OFF and the ADR 1 push-button to OFF. Both
OFF lights illuminated.
The crew also reported that, even though the procedure had been completed, they
continued to receive multiple ECAM messages. Those messages were constantly
scrolling on the display. The ECAM procedure for the NAV IR 1 FAULT was
displayed and it recommended switching the IR rotary mode selector to the ATT
position. The crew reported that they completed this action (see Table 5, 0832:25),
but it was unsuccessful in preventing further ECAM messages. The crew elected to
return to Perth and an uneventful overweight landing was conducted. The crew
reported that at no stage was there any effect on the aircraft’s flight controls.
Examination of the FDR/QAR data showed that at 0829:20, there was an ADR 1
Fault indication recorded on the FDR, which was consistent with the crew turning
off ADR 1. Recorded data confirmed that the ADR 1 was selected OFF and was not
providing further data to the aircraft’s systems from that time. However, even
33 This procedure was different to that which applied at the time of the 7 October 2008 occurrence.
The relevant procedure at the time of the 27 December 2008 occurrence was based on Airbus
Operations Engineering Bulletin (OEB) 74-3 issued in December 2008 (see SAFETY ACTION).
- 34 -
though the IR 1 push-button had also been selected OFF, the IR 1 continued to
supply erroneous data to the aircraft’s systems.
At the time that the autopilot disconnected, the aircraft was approximately 260 NM
north-west of Perth Airport and approximately 650 km (350 NM) south of
Learmonth Airport (Figure 11).
The PFR for the 27 December 2008 flight contained a series of messages associated
with ADIRU 1 which were similar to the PFR for the 7 October 2008 flight.
Consistent with there being no in-flight upset, there were no PRIM FAULTS or
PRIM PITCH FAULTS. There was a NAV ADR 1 FAULT recorded 1 minute after
the NAV IR 1 FAULT, and this was associated with the crew action of turning
ADR 1 off.
Examination of ADIRU 1 from VH-QPG
Following the incident on 27 December 2008, the ADIRU initially remained on the
aircraft but was unpowered. The unit was later removed from the aircraft and sent
to the manufacturer’s facility in Los Angeles. It was received on 8 January 2009
and was locked in a secure storage room while a test plan was developed.
The investigation team agreed that the ADIRU should undergo a standard
manufacturer’s test procedure and BITE download and the results analysed.
Examination of the BITE data showed anomalous results that were similar to those
obtained from the BITE download of ADIRU 1 from VH-QPA. More specifically:
• BITE data was recovered but it did not contain information from the time period
relating to the anomalous ADIRU behaviour
• several routine BITE messages that were expected to have been stored were not
recorded
• there were anomalies in the BITE elapsed time interval parameter.
At the time of publication, the source of the fault with ADIRU 1 from VH-QPG had
not been identified and the unit has been securely stored until testing on ADIRU 1
from VH-QPA had been progressed.
Search for similar events
Following the 7 October 2008 occurrence and based on information available at the
time, the aircraft manufacturer and ADIRU manufacturer advised that they were not
aware of any other occurrence involving similar anomalous ADIRU behaviour.
They also advised that, if such a problem had occurred and no fault was found in a
subsequent ground test of the unit, then the event would probably not be reported to
them.
Following the 27 December 2008 event, Airbus conducted a review of PFRs using
the AIRcraft Maintenance ANalysis (AIRMAN) database. AIRMAN is a groundbased
software tool that assists operators of Airbus aircraft to identify and manage
unscheduled maintenance. Fault data is downloaded in real time, and PFRs are
stored and available for subsequent analysis. The use of AIRMAN is an operatorbased
decision, with most Airbus operators electing to use the tool. AIRMAN is
currently used to monitor over 2,000 aircraft worldwide.
- 35 -
Airbus searched the AIRMAN database for PFRs which contained a similar pattern
of fault messages as occurred on the 12 September 2006, 7 October 2008 and 27
December 2008 flights. For the period January 2005 to December 2008 for
A330/A340 aircraft with ADIRUs of the same model, four matching PFRs were
identified: three for the events already identified and another event from a related
operator (see VH-EBC, 7 February 2008). No matching PFRs were identified for
single-aisle Airbus aircraft (A318, A319, A320, A321) or A330/340 aircraft with
different model ADIRUs.
Airbus advised that there were about 900 A330/A340 aircraft in operation, and 397
had the same model of ADIRU as fitted to VH-QPA and VH-QPG. AIRMAN data
was available for 248 of those aircraft in the 2005 to 2008 period. The sample of
248 aircraft included 48 operators, and those included several airlines that operated
flights to and from Australia.
VH-EBC, 7 February 2008
On 7 February 2008, an Airbus A330-200 aircraft, registered VH-EBC, was on a
scheduled passenger transport service (JQ07) from Sydney to Saigon, Vietnam. At
0604 UTC, while the aircraft was in cruise, there was a failure of ADIRU 1. The
ADIRU was the same model but a different unit (serial number 5155) to those
involved in the other three events.
The crew reported in the aircraft’s technical log that they received a NAV IR 1
FAULT message. After consulting the ECAM and operations manual, they
switched the IR rotary mode selector to the ATT position and the ATT HDG switch
to the CAPT ON 3 position. Following the identification of this event via the
AIRMAN search, the crew of EBC on 7 February 2008 were interviewed about the
event. Their recollection was consistent with the technical log entry. After
following the specified procedure, they received no additional ECAM messages and
the flight continued without further incident.
No FDR/QAR data was available for the 7 February 2008 flight. The PFR showed
that there were many similar fault messages associated with ADIRU 1 as occurred
for the other three events. Consistent with there being no in-flight upset, there were
no PRIM FAULTS or PRIM PITCH FAULTS.
The location of the aircraft at the time of the NAV IR 1 FAULT was estimated
using positions reported by ACARS messages transmitted before and after the fault
occurred. That technique gave a position 700 km (380 NM) north-west of Sydney
and 3,250 km (1,760 NM) east of Learmonth.
At the time of publication, the investigation team had not confirmed whether or not
this event was related to the other occurrences.
Electromagnetic interference
General information
All electrical systems generate some electromagnetic emissions, commonly called
radio waves, either as an intended function of the system or as an unintended
consequence of the physical properties of its electrical circuits. All systems can also
- 36 -
be disturbed, to varying levels, by emissions from another source. Electromagnetic
interference (EMI) is an undesired disturbance in the function of an electrical
system as a result of electromagnetic emissions from another source.
Electrical systems, particularly aircraft avionics, are designed to be resilient to
undesirable disturbances as a result of emissions from other systems, and also to
minimise emissions that may cause disturbances in other systems. For example, the
signal strengths within a system are designed to be far greater than the amount of
currents and voltages that are expected to be induced by other systems, so that the
magnitude of any unintentionally induced signal is too low to have an undesirable
effect on the system.
Emissions can be divided into two types: conducted and radiated. Conducted
emissions travel along wire interconnects between systems or parts of a system.
Radiated emissions travel through free space and are generated by time-varying
electrical signals in a conductor. However, radiated emissions can induce currents
in electrical wiring, and currents in wiring can emit electromagnetic radiation.
A system may produce both conducted and radiated emissions over a range of
frequencies and varying magnitudes. Conversely, a system may also be susceptible
to conducted or radiated interference over a range of frequencies and magnitudes.
Those characteristics of a system’s emissions and susceptibilities are a consequence
of the physical properties of the system, mostly by design. For example, a piece of
electrical equipment may be enclosed in a metal housing that prevents internal
radiated emissions from emanating outside the unit and also shields the unit from
external radiated emissions. However, the system’s physical properties may change
over time as a result of environmental effects and ageing, or if there is a hardware
fault. For example, an electrical connection may degrade and result in undesired
emissions.
In an aircraft, emissions may originate from a number of sources:
• from aircraft systems
• from personal electronic devices (PEDs) carried by passengers or crew, or active
electronic devices in the aircraft’s cargo
• from external artificial sources such as radar sites and communications facilities
• from natural sources such as electrical storms, rain particles, electrostatic
discharge, and solar and cosmic radiation.
Electromagnetic compatibility standards
The A330 aircraft type was certified to meet European and US airworthiness
requirements. As such, the aircraft and equipment were required to be resistant to
EMI, demonstrated through aircraft and equipment design and testing.
US Federal Aviation Regulations required the systems to be resistant to
electromagnetic field strengths of 50 to 3,000 volts per metre (V/m), depending on
frequency. At very low frequencies (VLF), the limit was 50 V/m.
Equipment may be vulnerable to conducted and radiated emissions, and special test
methods can be used to determine the susceptibility to both types. Conducted
susceptibility tests induce interference on the wiring interfaces of the equipment,
- 37 -
while radiated susceptibility tests subject the equipment to high strength radio
waves.
Conducted susceptibility tests covered the 10 kHz to 400 MHz range (such as audio
and VLF frequencies), and radiated susceptibility tests covered the 30 MHz to 18
GHz range (such as high frequency radio and radar frequencies).
As part of the certification of the ADIRU design, a sample ADIRU was tested to
limits specified by the DO-160C standard. The limits for that standard were 100
V/m field strength for radiated susceptibility and 150 milliamperes (mA) induced
current for conducted susceptibility.
Potential sources of EMI in the geographical area
As shown in Figure 11, the three known related events occurred within 1,000 km of
Learmonth. The operator reported that its A330 aircraft conducted 9,149 sectors in
2008. Approximately 19 per cent of those sectors were flights between Perth and
Singapore or Hong Kong and passed in relatively close proximity to Learmonth.
Approximately 29 per cent of its A330 flights passed within 1,500 km of
Learmonth. In addition, other A330/A340 operators conducted regular flights
between Asian locations and Perth.
Given that the events all occurred in a broadly similar geographical area, the
investigation reviewed information concerning potential sources of EMI in the area.
Harold E. Holt Naval Communication Station
The 7 October 2008 occurrence occurred within 170 km of the Harold E. Holt
Naval Communication Station near Learmonth, Western Australia. The station
transmitted at a frequency of 19.8 kHz which is within the VLF band. The
transmission power was about 1 megawatt using an omni-directional antenna.
The station transmitted almost continuously with the exception of weekly
maintenance periods, and was transmitting at the time of the three A330 ADIRUrelated
occurrences under investigation (12 September 2006, 7 October 2008, and
27 December 2008).
The Australian Department of Defence advised that:
• no equipment malfunctioned near to or during the time of the events
• the frequency of 19.8 kHz had been in use for over 10 years
• there had been no changes in the nature of the transmissions in recent years.
The Harold E. Holt station has been in operation since 1967. VLF transmitters are
also located in other countries including the USA, UK, China, France, India, Japan
and Russia.
Estimated field strengths as a result of transmissions from the station, at the three
locations where the ADIRU-related events occurred, are provided in Table 6. Those
field strength values were significantly below the levels at which the ADIRU design
was tested during certification.
- 38 -
Table 6: Estimated field strengths as a result of transmissions from the
Harold E. Hold Naval Communication Station
Event Aircraft Approximate
distance to station
(km)
Approximate
electromagnetic
field strength
(V/m)
12 Sep 2006 VH-QPA 950 0.011
7 Oct 2008 VH-QPA 170 0.059
27 Dec 2008 VH-QPG 700 0.014
As noted in ADIRU testing, the test plan for the ADIRU 1 from QPA included
testing the unit at the frequency used by the VLF transmitter. No problems were
found with the performance of ADIRU 1. This testing only involved conducted
susceptibility.34
High Frequency (HF) radio communications site
A high frequency (HF) radio communications site is also located on North West
Cape near Learmonth. The site can transmit signals in the HF frequency band (3 to
30 MHz) at a signal power of 10 kilowatts or less. Records indicate that the site was
transmitting at the time of the 12 September 2006 and 27 December 2008 events. It
was not transmitting at the time of the 7 October 2008 event.
Cabin safety
Passenger seating disposition
There were 297 passenger seats on the aircraft: 30 located in business class (rows 1
to 5, between doors 1 and 2), 148 in the centre of the aircraft (rows 23 to 41,
between doors 2 and 3), and 119 in the rear of the aircraft (rows 45 to 60, between
doors 3 and 4).
The 303 passengers included three infants who were seated with a parent for the
takeoff. Three of the passengers on staff travel arrangements were located on nonpassenger
seats for takeoff; one in the fourth occupant seat on the flight deck and
two in the cabin crew rest area (four seats located in rows 40 and 41). During the
flight, the two passengers seated in the cabin crew rest area moved to the cabin
crew jump seats located at the front of the aircraft.
At the time of the in-flight upsets, the meal service had been completed and the
service carts were secured in the galleys. Many passengers reported that they had
recently returned from or were in the process of going to the toilets.
34 Low-frequency radiated susceptibility tests require very specialised transmitting equipment that
was not available to the investigation. In practice, low frequency susceptibility is usually
evaluated using conducted emissions as that method is both practical and representative of actual
low-frequency electromagnetic coupling.
- 39 -
Passenger questionnaire
A passenger questionnaire was developed to obtain information from passengers
about their experience and observations during the upset events. It also included
questions on safety information, use of seatbelts, injuries and use of personal
electronic devices. The questionnaire could be completed electronically or on a hard
copy form, or by interview if requested by the passenger.
Distribution of the questionnaire commenced on 28 October 2008. It was not able to
be sent to all passengers as contact details were incomplete.
As of 26 January 2009, 95 surveys had been received. Those surveys also included
details for six children. In addition to the surveys, the ATSB obtained some
information by interview or email from 29 other adult passengers, which included
information for 11 other children. In the survey responses and additional
information received, some passengers provided information about other
passengers.
Multiple attempts were made to contact passengers who were seriously injured or
attended hospital and did not respond to the survey. However, information from a
small number of those passengers was not able to be obtained.
Passenger description of first in-flight upset
Passengers reported that they noticed nothing unusual about the flight prior to the
upset. Some passengers and cabin crew reported that, a few minutes prior to the
upset, they noticed a reduction in thrust, whereas some other passengers described a
slight change in the aircraft’s flight similar to the commencement of the descent for
landing. Both of those observations were consistent with the aircraft’s descent from
37,200 ft back down to 37,000 ft following the autopilot disconnect.
Passengers reported that the upset occurred without any prior warning. They first
noticed a sudden movement of the aircraft, generally described as a ‘drop’ or a
‘pitch down’. Many passengers and loose items were thrown upwards, and many of
these hit ceiling panels or overhead lockers.
General injury information
In addition to information obtained from passengers, basic information on
passenger injuries was obtained from the Western Australia Department of Health
and the operator. A review of the available data identified the following:
• Almost all of the injuries occurred at the time of the first in-flight upset.
• Of the 106 passengers known to be injured, seven were located in the front
section of the aircraft, 55 located in the centre section, and 44 were located in
the rear section.
• Of the 51 passengers who attended hospital, 32 were located in the centre
section and 19 were located in the rear section.
• Of the 11 passengers who were seriously injured, seven were located in the
centre section and four were located in the rear section. The severity of injuries
of both those who attended hospital and those who did not attend hospital,
varied considerably.
- 40 -
Seated passengers
Based on the information provided by passengers, 82 passengers were seated with
seatbelts fastened and 61 were seated without seatbelts fastened. Although most of
the remaining passengers would have been seated, there was no information
available regarding whether they had their seatbelts fastened. Therefore, the overall
compliance rate for wearing seatbelts could not be reliably estimated. However,
information obtained from many of the passengers suggested that there were more
than 61 passengers who did not have their seatbelts on at the time of the first inflight
upset.
For the passengers reported to have their seatbelts fastened:
• 35 per cent of those passengers were reported to be injured and 13 per cent
attended hospital.
• The most common type of injury was a strain / sprain of the neck or back. Some
passengers reported injuries due to being hit by another person or by an object,
or bruises due to hitting arm rests.
• Two of the passengers received serious injuries. One of those passengers was a
child who received abdominal contusions from a seatbelt. The other passenger
experienced a stroke three days after the flight.
For the passengers reported to not have their seatbelts fastened:
• 91 per cent of the passengers were reported to be injured and 38 per cent
attended hospital.
• The most common type of injuries were head or neck injuries from hitting the
ceiling or overhead lockers, and bruising or other injuries of the back, legs or
other parts of the body when landing on a seat or the floor.
• Three of the passengers received serious injuries. Two received spinal injuries
and an infant received minor head injuries.
Four passengers reported that, even though they were wearing seatbelts, they were
not restrained in their seats and they subsequently hit the ceiling or were thrown
from their seat. Three of those passengers advised that they had their seatbelts
loosely fastened and one advised they had their seatbelt firmly fastened.
Non-seated passengers
Eighteen passengers were reported to have been standing or walking in the cabin at
the time of the first upset. Most of them were reported to be on their way to or from
a toilet and some were attending to children. All of those passengers were injured,
and 67 per cent attended hospital. Four of the standing / walking passengers
received serious injuries. All of the seriously injured received multiple injuries,
including spinal injuries.
Two passengers were reported to be in toilets at the time of the first upset. One
passenger received serious injuries and the other attended hospital. Both passengers
experienced multiple injuries, including spinal injuries.
- 41 -
Crew member injury details
At the time of the first in-flight upset event, three flight attendants and the first
officer were standing in the forward galley and one flight attendant had just left that
galley. The first officer and two of the attendants received minor injuries and the
other was uninjured.
Four of the flight attendants were in the cabin crew rest area at the time of the first
in-flight upset. They were all preparing to leave the crew rest area either because
their break was about to end or because they reported feeling something similar to
the ‘top of decent’ prior to the first in-flight upset. As a result, none had their
seatbelts fastened at the time.
Another flight attendant was standing in the rear galley at the time of the first inflight
upset and received serious injuries.
Passenger seatbelts
Seatbelt description
The passenger seatbelts on the aircraft were a common type of lap belt with a liftlatch
release mechanism (Figure 12). The buckle was on the passenger’s left side
and the tongue on the right side. Passengers could adjust the tightness of the belt by
adjusting the distance of the buckle from its anchor point. In general, when the
seatbelt was firmly fastened, the buckle was centred across the passenger’s hips.
Figure 12: Seatbelt buckle of type fitted to VH-QPA
- 42 -
Seatbelt examinations
A sample of 51 seatbelts was examined in detail. The sample included the seatbelts
of the four passengers who reported that they were wearing their seatbelts, but the
seatbelts did not restrain them to their seats. It also included other passengers who
attended hospital and it was not known whether or not they were wearing seatbelts
at the time of the occurrence. No problems were identified with the condition of the
webbing, buckle or tongue of any of those seatbelts.
Potential for inadvertent seatbelt release
During the seatbelt examination, investigators identified a scenario by which a
loosely fastened seatbelt could inadvertently release. The scenario involved the
following:
• The seatbelt had to be loosely fastened. The buckle of the seatbelt could then
slide down off a passenger’s right hip.
• The buckle had to be positioned under the passenger’s right armrest.
• If a vertical force was then applied, the lift-latch part of the buckle could get
caught on a ridge on the underside of the armrest. If the lift-latch got caught on
the ridge, the buckle would release.
When the buckle of a loosely fastened belt was placed in a position underneath the
armrest, investigators could consistently make the buckle release by positioning the
buckle underneath the armrest and then standing up. In general, for the scenario to
be fulfilled, the belt had to be adjusted to be near the end of its adjustment range.
Subsequent examination has shown that this potential for inadvertent release is not
restricted to seats on the A330 aircraft type or the operator’s aircraft. A similar
potential has been identified on aircraft from multiple other operators and other
manufacturers, though it is not present on all aircraft and more difficult to do on
some seats than others. The potential appears to depend on a range of factors,
including the design of the seat and armrest.
The seatbelt manufacturer, aircraft manufacturer, aircraft operator, the Civil
Aviation Safety Authority, the ATSB and other investigation agencies, were
previously unaware of this inadvertent release scenario. Initial research by the
ATSB has not identified this scenario to be associated with injuries in previous inflight
upsets.
The seatbelt manufacturer has advised that seatbelts are not designed to be worn
improperly adjusted. It also reported that it would not be possible to ensure proper
placement of the seatbelt on the body when seatbelts were worn ‘extremely loosely
fastened’.
- 43 -
ONGOING INVESTIGATION ACTIVITIES
Air data inertial reference units
ADIRU testing is ongoing in accordance with a test program that was developed
and agreed by the investigation team. Protocols are in place for the oversight of the
testing, regular reporting of the results to investigation team members and analysis
of the results.
Further testing of ADIRU 1 from VH-QPA (unit 4167) will include the following
activities:
• Further EMI testing. The frequencies to be covered are associated with onboard
transmitters and other onboard systems that have been nominated by the
investigation team for particular attention. This testing will be conducted before
unit disassembly to prevent disturbance to the unit’s hardware that could
otherwise invalidate the EMI testing.
• The unit will be disassembled and the individual modules tested separately.
• Pending the results of the additional EMI and component testing, the test plan
may be expanded to include additional testing.
A test plan for ADIRU 1 from VH-QPG (unit 4122) and ADIRU 1 from VH-EBC
(unit 5155), will be developed and further testing conducted.
In addition to the testing of the specific units, the following related activities are
being conducted:
• The operator has initiated a detailed review as well as specific ongoing
monitoring of ADIRU performance across its A330 fleet. The results will
continue to be reported to the investigation team.
• The ADIRU manufacturer is conducting a theoretical analysis of ADIRU
software and hardware to identify possible fault origins.
• The aircraft manufacturer is conducting a detailed analysis of differences in
aircraft configuration between the operator’s A330 aircraft and other operators’
A330 aircraft with the same type of ADIRU. The results of these configuration
comparisons may lead to additional ADIRU testing requirements.
• A detailed analysis is being conducted of whether there were any commonalities
in operational, environmental or maintenance aspects of the flights/aircraft that
were involved in the occurrences.
Flight control system
The investigation is examining various aspects of the PRIM software development
cycle including design, hazard analysis, testing and certification.
Electronic centralized aircraft monitor (ECAM)
The investigation is examining the performance of the ECAM and its effectiveness
in assisting crews to manage aircraft system problems.
- 44 -
Cabin safety
Further work on cabin safety aspects is ongoing, including the following:
• Further analysis of information obtained from passengers to determine patterns
related to the occurrence or severity of injuries.
• Further examination of the potential for inadvertent seatbelt release associated
with loosely fastened seatbelts. The examination will consider the scope of the
problem across different types of aircraft, as well as relevant design
requirements for seatbelts and seats.
• Review of relevant aviation industry requirements regarding the use of seatbelts.
Flight recorders
Examination of CVR, FDR and QAR information from VH-QPA is on-going and
includes the following:
• analysis of CVR audio regarding aural warnings, crew actions, aircraft handling
and crew/cabin communications during the pitch-down events and the
subsequent approach and landing at Learmonth
• analysis of QAR data to assist in evaluating the performance of aircraft systems
• analysis of FDR data to produce a detailed sequence of events and assist in
evaluating the performance of aircraft systems
• a review of the earlier flights recorded by the FDR and QAR for any evidence of
anomalous performance of aircraft systems.
Examination of FDR and QAR information from VH-QPG is on-going and includes
the analysis of data to assist in evaluating the performance of aircraft systems and to
produce a detailed sequence of events.
The aircraft manufacturer and the operator are examining the feasibility of
recording additional parameters from ADIRUs 1 and 2 on the QAR. This would
require wiring changes to the operator’s A330 aircraft to access an additional
ADIRU databus and modifications to the aircraft condition monitoring system
(ACMS) software.
Other activities
The ATSB is aware that a post-incident multi-agency debrief has been conducted.
The debrief included representatives from all available private, government and
non-government organisations involved in the emergency response to the accident
and the Westralia Airports Corporation is coordinating actions from that meeting.
The ATSB will review those outcomes in relation to information obtained at
interviews and from responses to the passenger questionnaire.
- 45 -
SAFETY ACTION
Aircraft manufacturer
Operational procedures
On 14 October 2008, as soon as a preliminary analysis of the occurrence was
conducted, Airbus published Operator Information Telex (OIT) / Flight Operations
Telex (FOT) SE 999.0083/08/LB (‘A330 in-flight incident’). The telex was issued
to Airbus operators, who were asked to distribute it to all A330/A340/A340-
500/A340-600 flight crews without delay. The telex provided brief details known
about the occurrence. It also provided operational recommendations applicable for
A330/A340 aircraft fitted with Northrop Grumman air data inertial reference units
(ADIRUs). The telex stated that, pending final resolution, Airbus would issue an
OEB [Operations Engineering Bulletin] 74-1 that would instruct flight crew to
select OFF the whole ADIRU in the case of an inertial reference (IR) failure,
instead of switching OFF only the IR part.
On 15 October, OEB-A330-74-1 was dispatched, applicable to all A330 aircraft
fitted with Northrop Grumman ADIRUs. The OEB stated that, in the event of a
NAV IR FAULT (or an ATT red flag being displayed on either the captain’s or first
officer’s PFD), the required procedure was for the crew to select OFF the relevant
ADR and then select OFF the relevant IR. A compatible temporary revision was
issued to the Minimum Master Equipment List at the same time. The procedure in
the OEB was subsequently issued as an Emergency Airworthiness Directive by the
European Aviation Safety Agency (EASA) (No. 2008-0203-E) effective on 19
November 2008 and the Civil Aviation Safety Authority (CASA) (AD/A330/95)
effective on 20 November 2008.
The OEB procedure was subsequently amended in December 2008 to cater for a
situation where the IR and ADR pushbuttons are selected to OFF and the OFF
lights did not illuminate. If the lights did not illuminate, the new OEB (74-3)
required crews to select the IR rotary mode selector to the OFF position. This OEB
was subsequently issued as an Emergency Airworthiness Directive by EASA (No.
2008-0225-E) effective on 22 December 2008 and CASA (AD/A330/95
Amendment 1) effective on 22 December 2008.
Following the 27 December 2008 event, Airbus issued another OEB (74/4) on 4
January 2009. This OEB provided a different procedure for responding to a similar
ADIRU-related event to ensure erroneous data would not be used by other aircraft
systems. The procedure required the crew to select OFF the relevant IR, select OFF
the relevant ADR, and then turn the IR rotary mode selector to the OFF position.
The modified procedure was subsequently issued as an Emergency Airworthiness
Directive by EASA (No. 2009-0012-E) effective on 19 January 2009 and CASA
(AD/A330/95 Amendment 2) effective on 19 January 2009.
Similar OEBs were issued by Airbus for A340 aircraft, and the EASA
Airworthiness Directives also applied to A340 aircraft.
- 46 -
Flight control system
Airbus is in the process of developing a modification to its PRIM software to make
it more robust to AOA spikes.
Aircraft operator
On 15 October 2008, in response to the Airbus releases, the operator issued Flight
Standing Order 134/08 for its A330 operations. On 24 October 2008, this order was
replaced by Flight Standing Order 136/08, which incorporated the material from the
Airbus OEB. In addition, a program of focussed training during simulator sessions
and route checks was initiated to ensure that flight crew undertaking recurrent or
endorsement training were aware of the contents of the Flight Standing Order.
Subsequent Flight Standing Orders were issued in response to the modified OEBs
in December and January 2009.
Seatbelt reminders
In its media statements providing updates on the investigation on 8 and 10 October
2008, the ATSB noted that this accident served as a reminder to all people who
travel by air of the importance of keeping seatbelts fastened at all times when seated
in an aircraft.
On 27 October 2008, the Australian Civil Aviation Safety Authority issued a media
release that stated that the occurrence was as a timely reminder to passengers to
‘remain buckled up when seated at all stages of flight’. The media release also
highlighted the importance of passengers following safety instructions issued by
flight crew and cabin crew, including watching and actively listening to the safety
briefing given by the cabin crew at the start of each flight.
- 47 -
APPENDIX A: ELECTRONIC INSTRUMENT SYSTEM
This appendix provides general background information on the A330 electronic
instrument system. It is based on information contained in the operator’s A330
Flight Crew Operating Manual, Volume 1: Systems Description. The information is
not exhaustive.
Figure A1 shows the general layout of the electronic instrument system. Key
components of the system are the electronic centralized aircraft monitor (ECAM)
and the primary flight display (PFD).
Figure A1: Overview of electronic instrument system
Failure mode classifications
Failures of an aircraft system are classified at three levels:
• Level 3 failure or ‘warning’, associated with the colour red. The configuration
or failure requires immediate action by the flight crew.
• Level 2 failure or ‘caution’, associated with the colour amber. The flight crew
should be aware of the configuration or failure, but need not take immediate
action.
• Level 1 failure or ‘caution’, associated with the colour amber. Requires crew
monitoring.
For a level 3 warning, the MASTER WARN red light flashes (or specific red light
illuminates), and a continuous repetitive chime (or other specific aural signal)
sounds in the cockpit. For a level 2 caution, a steady MASTER CAUT amber light
illuminates and there is a single chime. The lights and signals cease when the
warning/caution situation no longer exists or when the flight crew press the
respective ‘attention getter’ light or press other controls on the electronic
centralized aircraft monitor (ECAM).
- 48 -
Electronic centralized aircraft monitor (ECAM)
ECAM provides information on the status of the aircraft and its systems on two
display units. The upper unit or engine/warning display (E/WD) presents
information such as engine primary indications, fuel quantity information and
slats/flap positions. It also presents warning or caution messages when a failure
occurs, and memo messages when there are no failures. The lower or system
display (SD) presents aircraft synoptic diagram and status messages. Figure A1
shows the location of the ECAM display units. Figure A2 presents a more detailed
overview of the E/WD.
Figure A2: Engine / warning display of ECAM
Level 3 warning messages are displayed on the E/WD in red. Level 2 and level 1
caution messages are displayed in amber. In the event of a level 3 or level 2 failure,
the E/WD will display the relevant warning or caution message, together with
relevant actions the crew should take in response to the failure. The system display
also shows the system page for the affected system.
The ECAM system is designed to prioritise error messages, with level 3 failures
having priority over level 2 failures, which have priority over level 1 failures.
In addition to the ECAM messages and the ‘attention getters’, a local warning light
directly controlled by the affected system may illuminate (for example, the IR lights
on the overhead panel discussed above).
Primary flight displays
The electronic flight instrument system (EFIS) displays flight parameters and
navigational data on the primary flight displays (PFDs) and navigational displays
(NDs).
The PFD provides flight information such as aircraft attitude, airspeed, altitude,
vertical speed, heading and track, autoflight information, vertical and lateral
deviations, and radio navigation information. Various ‘flags’ and messages
pertaining to specific parameters are also displayed on the PFD.
- 49 -
APPENDIX B: FLIGHT DATA RECORDER PLOTS
Figure B1: Data plot for complete flight duration
- 50 -
Figure B2: Plot showing selected data during period of both in-flight upset events
- 51 -
Figure B3: Plot showing selected data during period of both in-flight upset events
- 52 -
Figure B4: Plot showing selected data for first in-flight upset event
- 53 -
Figure B5: Plot showing selected data for second in-flight upset event |
IP卡
狗仔卡
发表于 2010-8-24 12:22:31
分享
收藏
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
显身卡
发表于 2010-11-11 10:00:29