FACTUAL INFORMATION The aircraft was being operated as a scheduled passenger service from Singapore to Sydney, with the co-pilot as the handling pilot. Whilst cruising at flight level (FL) 370 over the centre of the Australian continent, turbulence was encountered. A diversion of about 30 NM to the right of track was carried out to avoid local storms, before returning to the original track. The seat belt signs had been on for some time and the cabin crew needed to resume the meal service which had been in progress. The pilot in command (PIC) requested a clearance to climb to FL390, which was approved. Conditions were smooth and clear at the higher level so the seat belt signs were turned off and the meal service resumed. The aircraft was being controlled by the number two auto-pilot. Later, prior to reaching the top of descent, the co-pilot commenced the pre-descent review and briefing, which included a review of the aircraft fuel status. When the fuel system synoptic display was selected on the electronic centralised aircraft monitor (ECAM), a lateral fuel imbalance was observed, with the left inner fuel tank about 800 kg heavier than the right. The PIC elected to correct the situation and the fuel imbalance checklist was reviewed. The checklist required that the four fuel crossfeed valves be opened by depressing the four fuel crossfeed valve switches on the centre overhead panel, then turning off the fuel pumps in the lighter tank. The valve positions are monitored by observing the fuel system synoptic on the ECAM screen on the centre instrument panel. The engine driven hydraulic pump push button switches are also located on the centre overhead panel, immediately above the fuel crossfeed valve switches. These switches are similar to the fuel crossfeed valve switches and are activated by the same push-button switching action. The engine driven hydraulic pump push button switches are not guarded to prevent inadvertent activation. All valve positions are monitored on the respective fuel or hydraulic system synoptic displays on the ECAM, on the centre instrument panel. Standard operating procedures require that, when a switch is manually activated, the respective valve position is monitored on the ECAM before any further switching actions are performed. This procedure is to confirm that the correct selection has been made. The PIC reported that he raised his hand and placed his right index finger on a fuel crossfeed valve switch. Before depressing the switch, the co-pilot remarked that the fuel management was under automatic control, and in the forward transfer configuration at the time. The PIC removed his finger from the switch to refer back to the fuel system synoptic on the ECAM but then decided to continue with the fuel imbalance procedure. He then depressed what he thought was the number one fuel crossfeed valve switch, then the remaining switches in succession, leaving his finger on the last switch. He observed the white switch lights illuminate as each switch was activated but neither of the crew monitored the valve positions on the fuel system synoptic on the ECAM. After depressing the last switch, the PIC observed the green hydraulic system low pressure warning on the ECAM, heard one warning chime, together with the master caution light and alarm, and also heard the auto-pilot disconnect warning. He looked up and saw that he had inadvertently pushed all four engine driven hydraulic pump push button switches off and immediately switched them all back on. When the auto-pilot disconnected automatically, due to the reduction in hydraulic pressure, the aircraft began to pitch up and the stall warning sounded twice. The PIC advised the co-pilot that he was taking control of the aircraft and gave a nose-down command to his side stick control, but did not utilise his side stick priority push button. At the same time the co-pilot also gave a momentary nose-down command to his side stick control before realising that the PIC had control. The aircraft pitched down, then up, before level flight was regained and the auto-pilot was re-engaged. During the event the aircraft climbed about 350 ft before returning to FL390. The loss of hydraulic pressure to the hydraulically powered flight controls and the prevailing aerodynamic forces acting on the airframe, resulted in the aircraft pitching nose up. This configuration could not be reversed until hydraulic power was restored. However, during this period both crew had instinctively moved their respective side stick controls to a nose-down command. As the side stick inputs are summed, this action resulted in a rapid pitch reversal as hydraulic pressure was restored, and required a further nose-up correction before level flight was regained. The resulting negative and positive vertical accelerations which occurred caused unrestrained passengers and cabin crew in the rear of the aircraft to be thrown about and injured. ANALYSIS The investigation identified a safety deficiency in that there were several factors which increased the potential for the inadvertent activation of the engine driven hydraulic pump push button switches. The switches were not guarded; they were similar in appearance to the fuel crossfeed valve switches; and were activated by the same push button switching action. They were also located immediately above the fuel crossfeed valve switches on the centre overhead panel. The PIC had initially placed his finger on a fuel crossfeed valve switch. However, before he activated it, his attention was drawn to the ECAM fuel system synoptic on the centre instrument panel, when co-pilot commented that the fuel system was in automatic forward transfer. Whilst his attention was drawn to the ECAM his finger moved slightly higher and was then positioned over an engine driven hydraulic pump push button switch. Deciding that he would continue with the fuel imbalance procedure, the PIC looked up to the centre overhead panel to what he thought was the fuel panel and depressed the switch to the off position. He then continued to depress the remaining three engine driven hydraulic pump push button switches to the off position. Neither of the crew were alerted to the incorrect selection at that time as the ECAM fuel system synoptic was still displayed. As the aircraft was relatively new, there would have been minimal internal hydraulic system leakage. The aircraft was flying in still air so there was little demand on auto-pilot input to the various flying control hydraulic actuators. The hydraulic system accumulators continued to provide some residual pressure whilst the main hydraulic pressure was bleeding off, so it took some time before the hydraulic pressure depleted sufficiently to trigger the hydraulic system low pressure warning, though the hydraulic pump low pressure warnings had occurred. This time allowed the PIC time to switch off all the hydraulic pumps before a warning was observed and corrective action taken. SIGNIFICANT FACTORS 1. The four engine driven hydraulic pump push button switches were not guarded to prevent inadvertent activation. 2. Inadvertent selection of the four engine driven hydraulic pump switches to the off position resulted in the loss of hydraulic system pressure to the hydraulically powered flight controls. The auto-pilot disengaged automatically due to the reduced hydraulic pressure. 3. The crew did not monitor the fuel crossfeed valve positions on the ECAM fuel system synoptic, following each switching action, in accordance with standard operating procedure. SAFETY ACTION As a result of the investigation into this accident, the Bureau of Air Safety Investigation issued the following safety advisory notice SAN960163: "Airbus Industrie, Civil Aviation Authority (Singapore), Bureau Enquetes-Accidents (France), Civil Aviation Authority (UK), Transportation Safety Board (Canada), Federal Aviation Administration (USA) and the Civil Aviation Safety Authority (Australia) should note the circumstances surrounding this occurrence and the safety deficiency identified by BASI's investigations." SAFETY ACTION BY MANUFACTURER Airbus Industrie, as a result of this advisory notice, and subsequent investigations by their own staff, undertook the following safety actions: 1. Issued a notification to all operators of the aircraft type of the details surrounding the occurrence. 2. As an additional precautionary measure, Airbus Industrie has decided to develop a modification introducing a guard on each engine driven hydraulic pump push button switch.