The Australian Transport Safety Bureau has released an interim factual report into the accident involving the Qantas Airbus A330-303 in-flight upset, 154 km west of Learmonth WA, 7 October 2008.
The ATSB's preliminary report, released on 14 November 2008, provided details of the circumstances of the accident, in which the aircraft abruptly pitched nose-down twice while in normal cruise flight. The aircraft (registered VH-QPA) was being operated on a scheduled passenger service (QF72) from Singapore to Perth. At 1240, while cruising at 37,000 ft, the aircraft experienced two significant uncommanded pitch-down events while responding to various system failure indications. The crew made a PAN urgency broadcast to air traffic control and requested a clearance to divert to and track direct to Learmonth. After receiving advice from the cabin of several serious injuries, the crew declared a MAYDAY. The aircraft landed at Learmonth without further incident at 1350.
The interim factual report released today contains information on progress, and future direction, of the investigation. Analysis of the factual information and findings as to the factors that contributed to the accident are subject to ongoing work and will be included in the final report.
The investigation to date has identified two significant safety factors related to the pitch-down movements. Firstly, immediately prior to the autopilot disconnect, one of the air data inertial reference units (ADIRUs) started providing erroneous data (spikes) on many parameters to other aircraft systems. The maintenance post-flight report from the aircraft's central maintenance computer and built-in test equipment (BITE) data for several systems indicated a problem with ADIRU 1, but no data indicated a problem with ADIRU 2 or ADIRU 3. Testing of other relevant systems and components identified no problems with these systems or components which were related to the circumstances of the occurrence.
Secondly, some of the spikes in angle of attack were not filtered by the aircraft's flight control computers. The A330 used a variety of redundancy and error-checking mechanisms to minimise the probability of erroneous ADIRU data having a detrimental effect on the aircrafts flight controls. On the A330, angle of attack data was processed differently to other parameters and, in a very specific situation, the flight control computers could generate an undesired pitch-down elevator command. The aircraft manufacturer reported that it was not aware of any previous event where angle of attack spikes had resulted in an in-flight upset.
The three ADIRUs from the aircraft were despatched to the ADIRU manufacturer's facility in Los Angeles. After agreeing a detailed test plan, testing of the number-1 ADIRU has been ongoing since 17 November 2008.
Completed testing includes physical inspection, ground integrity test, software program verification, BITE data download, built-in test and manufacturing test procedures, bus tests, internal visual inspection and environmental tests. The environmental testing included subjecting ADIRU 1 to electromagnetic interference (EMI) tests in accordance with the frequencies and field strengths specified in international standards. In addition, it was subjected to specific conducted susceptibility tests at 19.8 kHz, the same frequency as the Harold E. Holt Naval Communication Station near Learmonth, and at a field strength of 100 Volts/metre (about 1,700 times the electromagnetic field strength to which the aircraft was exposed at the time of the in-flight upset when the aircraft was 170 km away from the transmitting station). None of the testing completed to date on ADIRU 1 has produced any faults that were related to the pitch-down events.
Testing of ADIRU 1 from VH-QPA is ongoing and will include further EMI testing, including frequencies associated with onboard transmitters and other onboard systems that have been nominated by the investigation team for particular attention. This testing will be completed before unit disassembly to prevent disturbance to the unit's hardware that could otherwise be detrimental to the EMI testing. After disassembly, individual modules will be tested separately.
Two other occurrences have been identified involving similar anomalous ADIRU behaviour to the 7 October 2008 occurrence, but in neither case was there an in-flight upset. The first occurred in September 2006 and involved the same aircraft and the same ADIRU as the 7 October 2008 occurrence. Maintenance records for this earlier event indicate that there were no faults found following systems testing and an ADIRU re-alignment.
The second event occurred on 27 December 2008, when another Qantas A330-303 aircraft (VH-QPG) was on a flight from Perth to Singapore. In response to a similar pattern of fault messages as occurred on the 7 October 2008 flight, the crew completed the relevant procedures (introduced since the 7 October 2008 occurrence) to select both parts of the ADIRU off and returned to Perth for a normal landing. A test plan for the ADIRU 1 of VH-QPG is being developed.
In addition to the ongoing testing of the ADIRU 1 from both VH-QPA and VH-QPG:
- the operator has initiated a detailed review as well as specific ongoing monitoring of ADIRU performance across its A330 fleet, the results of which will continue to be reported to the ATSB investigation team
- the ADIRU manufacturer is conducting a theoretical analysis of ADIRU software and hardware to identify possible fault origins
- the aircraft manufacturer is conducting a detailed analysis of differences in aircraft configuration between the operator's A330 aircraft and other operators' A330 aircraft with the same type of ADIRU
- a detailed analysis is being conducted of whether there were any commonalities in operational, environmental or maintenance aspects of the flights/aircraft that were involved in the occurrences
- the investigation is examining various aspects of the PRIM software development cycle, including design, hazard analysis, testing and certification
- the investigation is examining the performance of the electronic centralized aircraft monitor and its effectiveness in assisting crews to manage aircraft system problems.
One flight attendant and 11 passengers were seriously injured in the 7 October 2008 accident. Eight other crew members and at least 95 other passengers received minor injuries. The investigation has received responses to a questionnaire or other information from 47% of the passengers. Analysis of this information indicates that most of the injuries involved passengers who were seated without their seatbelts fastened or were standing. However, the investigation has identified a potential design problem which can lead to inadvertent release of a seatbelt if it is loosely fastened. The seatbelt manufacturer, aircraft manufacturer, aircraft operator, the Civil Aviation Safety Authority (CASA) and overseas investigation agencies have all reported that they were previously unaware of this potential problem. Further investigation will consider the scope of the problem across different types of aircraft, as well as relevant design requirements for seatbelts and seats.
The ATSB is also aware that a post-incident multi-agency debrief has been conducted. The debrief included representatives from all available private, government and non-government organisations involved in the emergency response to the accident and the Western Australia Airports Corporation is coordinating actions from that meeting. The ATSB will review those outcomes in relation to information obtained at interviews and from responses to the passenger questionnaire.
Safety action to minimise future risk associated with the issues identified by the investigation has been taken by the aircraft manufacturer through the issue of an Operations Engineering Bulletin (OEB) which provides procedures for crews of Airbus A330 and A340 aircraft to follow in the event of a similar anomalous ADIRU behaviour in the future. A revised version was issued following the 27 December 2008 event. The European Aviation Safety Agency (EASA) and CASA have subsequently issued these bulletins as Airworthiness Directives.
The aircraft operator issued a Flight Standing Order incorporating material from OEB. In addition, a program of focussed training during simulator sessions and route checks was initiated to ensure that flight crew undertaking recurrent or endorsement training were aware of the contents of the Flight Standing Order.
In its media statements providing updates on the investigation on 8 and 10 October 2008, the ATSB noted that this accident served as a reminder to all people who travel by air of the importance of keeping seatbelts fastened at all times when seated in an aircraft. Further, on 27 October 2008, the Australian Civil Aviation Safety Authority issued a media release that stated that the occurrence was a timely reminder to passengers to 'remain buckled up when seated at all stages of flight'. The media release also highlighted the importance of passengers following safety instructions issued by flight crew and cabin crew, including watching and actively listening to the safety briefing given by the cabin crew at the start of each flight.
The ATSB expects to release a final report into this accident towards the end of 2009. However, the ATSB will immediately bring any critical or significant safety issue(s) to the attention of the relevant organisations best placed to address them, should any such issue(s) arise. The ATSB will also publish details of any such issue(s).