Cabin depressurisation involving Airbus A330, VH-EBK, 235 NM (435 km) south-west of Adelaide, South Australia, on 5 February 2021

The occurrence

At 2236 Eastern Daylight-saving Time[1] on 4 February 2021, an Airbus A330-202 registered VH‑EBK and operated by Qantas Airways, departed Sydney, New South Wales, on a scheduled air transport flight to Perth, Western Australia. There were 2 flight crew, 8 cabin crew and 61 passengers on board. The flight crew comprised the captain, who was the pilot flying (PF), and the first officer, who was the pilot monitoring (PM).[2]

The aircraft reached its initial cruise altitude of flight level (FL) 400[3] at 2308. At 0053 on 5 February, shortly after passing position SUBUM,[4] the aircraft’s Electronic Centralized Aircraft Monitor (ECAM) triggered a red warning alert identifying that the cabin altitude had exceeded 9,550 ft (see the section titled Electronic Centralized Aircraft Monitor). This alert triggered the CAB PR EXCESS CAB ALT message, and its associated abnormal procedure was displayed on the primary ECAM display. That procedure required the flight crew to immediately don oxygen masks and commence an emergency descent. The alert also caused the cabin pressure system information to be displayed to the pilots on the System Display (SD). The data presented on that display indicated that the pressurisation system was operating normally.

Delay in actioning alert

As the displayed pressurisation system data conflicted with the ECAM alert, the flight crew did not immediately commence the abnormal procedure. The captain’s uncertainty about the alert’s validity was based on observations that:

• A related pressurisation alert that normally preceded a CAB PR EXCESS CAB ALT alert had not occurred (see the section titled Pressurisation system).
• While the CAB PR EXCESS CAB ALT procedure required an immediate emergency descent, there was no other evidence of depressurisation.

The first officer, while somewhat unsure, assessed that the alert required actioning of the procedure.

Due to the conflicting information, the flight crew sought further information about the condition of the pressurisation system. However, about 1 minute after the alert had triggered, and as they were examining system indications to determine if there was a fault, the Customer Service Manager (CSM) called the flight deck to advise that the cabin lights and seatbelt signs had illuminated (see the section titled Cabin altitude alerts).

On completion of that call, and some 3 minutes after the alert had triggered, the first officer advised the captain of having recently read guidance on cabin pressurisation faults in the Flight Crew Techniques Manual. When the relevant section in that manual was reviewed, the captain found the information to be contradictory, resulting in further discussion about the intent of the guidance. During this discussion, there was also a further brief call from the CSM.

Crew action

After further discussion of the ECAM alert, at 0100, the flight crew donned their oxygen masks. About 2 minutes later, they determined that the abnormal procedure would be actioned. However, they also decided that, instead of an emergency descent, a precautionary descent[5] to 10,000 ft[6] would be conducted and the flight diverted to Adelaide.

Melbourne air traffic control (ATC) was flight following[7] the aircraft through the controller-pilot data link communications[8] however, the first officer called Brisbane ATC using high frequency band radio communications to advise the technical issue. A PAN PAN[9] was declared on that frequency. Brisbane ATC was also notified of the need to descend due to the aircraft’s pressurisation issue, and the intention to divert. During these communications, at 0105, the aircraft commenced a descent from FL 400 and turned towards Adelaide (Figure 1). Brisbane ATC acknowledged the PAN call at 0106.

Figure 1: VH-EBK track and principal events

Source: Google earth, modified by ATSB

About 2 minutes after commencing the descent, the flight crew identified that the cabin pressurisation data presented on the SD page had changed. The cabin altitude was now red (to highlight that it had exceeded 9,550 ft) and now indicating about 12,400 ft, while the other pressurisation indications were indicative of the cabin depressurising. The flight crew immediately responded by commencing an emergency descent. At 0108, the first officer transmitted a MAYDAY[10] call, which was acknowledged by Brisbane ATC.

During the descent, the flight crew diverted the aircraft to the north of the intended direct flight path to Adelaide to avoid significant weather. Brisbane ATC and Qantas attempted to contact the aircraft on a number of occasions during the descent, however, the flight crew did not respond until after the aircraft was established at 10,000 ft.

The flight crew noted that the pressurisation system returned to normal operation during the descent and continued to operate normally for the rest of the flight. The aircraft landed at Adelaide at 0202 without further incident.

Context

Pilot information

Both the captain and the first officer held Air Transport Pilot Licences (Aeroplane) with Class 1 aviation medical certificates and were appropriately qualified for the flight. They also reported being well rested and alert at the commencement of duty. No evidence indicating flight crew fatigue was identified.

The captain had accumulated about 17,100 hours of flight experience, of which about 8,000 hours were on the Airbus A330 (A330). In the previous 90 days, the captain had flown about 4 hours on A330 type aircraft. The first officer had accumulated about 15,700 hours of flight experience, of which about 4,100 hours were on the A330 with 15 hours flown in the previous 90 days.

Refresher training

As a result of the COVID 19 pandemic, the operator had significantly reduced its flight schedule in the 12 months preceding the occurrence. In the case of flight crews, this resulted in their rotation through a period of flying followed by an extended period of furlough. To ensure flight crews met operational standards prior to commencement of a flying cycle following furlough, the operator required them to complete a refresher program comprising simulator and training sessions. Scheduling requirements also ensured that returning flight crew were partnered with flight crew who had already completed several flights.

The captain had just completed the refresher program and the occurrence flight was the first in the new flying cycle. The first officer had completed the refresher cycle in the week preceding the occurrence and had completed 2 sectors 4 days prior to the occurrence.

The flight crew reported that the recency training provided to them by the operator had effectively prepared them for the flying cycle.

Aircraft information

Commercial aircraft, such as the A330, typically fly at altitudes of between 30,000 and 40,000 ft. As the air pressure and temperature at these altitudes is insufficient to maintain consciousness (or support life beyond a few minutes) the aircraft’s cabin must be pressurised. If cabin pressurisation is not maintained below the equivalent of 10,000 ft in altitude, hypoxia becomes a primary safety concern.

Hypoxia

Hypoxia is defined as a lack of oxygen in the body tissues, which is most often the result of a shortage of oxygen in the air being breathed. Individuals differ considerably in their ability to withstand hypoxia, such that in the early stages, one person may be more seriously affected than others.

While hypoxia and its effects are most critical at altitudes above about 20,000 ft, exposure to altitudes within the 11,000 ft to 20,000 ft range can lead to cognitive impairment that can critically affect the performance of flight crew. It is for this reason that flight crew are required to use oxygen when the aircraft’s cabin altitude exceeds 10,000 ft.

The A330 oxygen system

The A330 has separate oxygen systems for the flight crew and the passenger cabin. The flight crew’s oxygen supply is accessible at each flight crew station through a pre-connected full-face quick-donning mask and associated controls. To access oxygen, the flight crew member is required to perform specific steps to extract and then don the mask, which also initiates oxygen flow.

Passengers in the aircraft’s cabin are provided with oxygen through an independent oxygen system. When the cabin’s pressure altitude exceeded about 14,000 ft, detected by a pressure sensor separate to that used for cabin pressure control, individual masks for each passenger deploy above the passenger’s seat. A pre-recorded announcement that broadcasts instructions to the passengers also automatically commences as the masks deploy. The deployment process can also be initiated through a switch selection on the flight deck.

Pressurisation system

The aircraft pressurisation system regulates the flow of air to achieve a cabin pressure equivalent to an altitude that provides sufficient oxygen for normal human function. Pressurisation is achieved by pumping air from air‑conditioning units (commonly referred to as packs) into the cabin and then regulating the outflow of that air, and therefore the cabin’s altitude, through outflow valves (Figure 2). Conditioned air in the A330 is provided to the aircraft’s pressurised zones by 2 packs and controlled through two outflow valves located towards the rear of the fuselage.

Figure 2: Simplified pressurisation system overview

Description: A simplified view of the A330 pressurisation system. Note that the overview does not include other pressurisation system components.

Source: Airbus (modified by ATSB)

The general structure and operation of the A330 pressurisation system (Figure 3) was as follows:

• Two identical, independent, cabin pressure controllers (CPC1 and CPC2) provided automatic cabin pressure control using data from multiple sources within the aircraft. The data enabled the controlling CPC to determine an outflow valve position to achieve the required cabin pressure, and the required rate of change of that pressure. Both CPC1 and CPC2 have their own independent cabin pressure sensor to determine cabin altitude.
• Each CPC controlled its own electric motor on each of the two outflow valves, enabling a single CPC to control both outflow valves’ position.
• A controller and its two motors comprised a system. Only one system operated at a time (control system) while the other acted as a backup (standby system). In normal operation, pressurisation was fully automated through the CPC in control.
• If the controlling system failed, the backup system would automatically take control of the aircraft’s pressurisation. However, this automatic transfer only occurred when the failure was of a specific type. When a faulty CPC remained as the active controller, a forced changeover could be accomplished using a reset procedure.
• If the CPCs were in automatic mode and the cabin altitude reached 15,000 ft, the outflow valves automatically closed. The pressure switch that closed the valves was independent of the CPC pressure sensors.
• In the event of failure of both automatic systems, a third electric motor placed on each outflow valve enabled manual pressurisation control from the flight deck. A third pressure sensor provided cabin pressure data for manual control of aircraft pressurisation.

Figure 3: A330 pressurisation system

Source: Airbus

CPC pressure sensor fault detection

Each CPC monitored for pressure sensor faults by checking whether the sensor’s output:

• was outside of a specified range
• was not plausible, such that the difference between the cabin pressure and the outside pressure was outside of a defined range.
• had not updated for more than 1 second.

If one of these criteria was met, the CPC logged a fault and switched to the other controller’s pressure sensor for cabin pressure control.

Electronic centralized aircraft monitor

The flight crew were provided with engine and aircraft systems information through the electronic centralized aircraft monitor (ECAM), which had two main functions:

• detecting and alerting the flight crew to malfunctions or unsafe conditions through visual and aural cues, and displaying relevant procedural actions for those malfunctions.
• presentation of aircraft systems and sensor data on the engine and warning display (EWD) and the system display (SD) (Figure 4).

Figure 4: Flight deck front panels

The figure shows the location and exploded view of the EWD and SD, with the CAB PR EXCESS CAB ALT procedure and CAB PR alert shown on the EWD and the associated CAB PRESS page displayed on the SD.

Source: Airbus, modified by ATSB.

ECAM used a colour coded system to aid in identifying the importance of information presented on the EWD and SD (Figure 4). The system used:

• red for immediate action required
• amber for awareness but immediate action need not be taken
• green to identify normal operation
• white for titles and remarks
• blue for actions to be carried out or limitations.

The ECAM alert classification and priority system, detailed at Table 1, also used this colour coded system to assist flight crew in identifying the safety urgency of a detected malfunction or unsafe condition.

Table 1: ECAM failure mode alert classification and priority

Alert level	Alert colour	Alert significance	Flight crew response
3	Red	Safety priority	A system failure or condition that alters flight safety. Immediate action by the flight crew is required.
2	Amber	Abnormal priority	A system failure that did not have a direct consequence on flight safety but required crew awareness. Action should be taken without delay, time and situation permitting.
1	Amber	System degradation	A failure that leads to a loss of redundance or system degradation. Crew awareness and then monitoring.

The data presented in this table is a simplified version of the ECAM alert classification system used by Airbus. It has been structured for the purposes of this investigation and should not be used for any other purposes.

Cabin pressurisation information could be displayed on the SD through the cabin pressure (CAB PRESS) system page (see SD at Figure 4). The displayed data was sourced from the controlling CPC and its associated cabin pressure sensor. During normal operations, the displayed information on this page included identification of the controlling CPC system (SYS1 or SYS2), cabin differential pressure (ΔP), cabin vertical speed (V/S), cabin altitude (CAB ALT), and the position of both outflow valves (FWD and AFT).

Cabin altitude alerts

There were two ECAM alerts related to high cabin altitude.

• If the cabin altitude sensed by the controlling CPC was between 8,800 ft and 9,550 ft, an information advisory would be displayed to the flight crew advising that the aircraft’s cabin altitude was outside normal operating parameters. For that advisory, the:
  • EWD would display the CAB ALT advisory alert.
  • cabin altitude indicator on the SD page would pulse green.
  • procedure required to be actioned by the flight crew was contained in the Quick Reference Handbook (QRH) and involved changing the controlling CPC.
• If the cabin altitude sensed by either CPC was above 9,550 ft, the:
  • EWD would display the CAB PR EXCESS CAB ALT warning alert (a level 3 alert).
  • aural and visual alerts associated with a level 3 alert activated.
  • SD would display the CAB PRESS system page.
  • sensed cabin altitude on the SD page would be red.
  • procedure required to be actioned by the flight crew would be displayed on the EWD.
  • cabin and seatbelt signs would illuminate.

Operational information

Manuals

The operator provided flight crew with a suite of operating manuals that contained policy, procedures, and crew actions for most normal and non-normal flight operations. This set of manuals included:

• the Flight Administration Manual (FAM) and Flight Standing Orders (FSO) policy and procedures manuals.
• aircraft operating manuals, which for the A330 comprised the QRH and the Flight Crew Operating Manual (FCOM).
• training and checking manuals, which for the A330 included the Flight Crew Techniques Manual (FCTM).

Policy and procedure manuals

The FAM set out the operator’s policy, standards, and procedures, which were to be adhered to under all circumstances by flight crew when operating company aircraft. FAM policy could limit or provide additional definition or scope in the application of operational procedures.[11]

When abnormal conditions developed, the FAM stated that the flight crew’s hierarchy of references was the ECAM, the QRH, the FCOM and the FAM. The FCTM provided guidance on operating philosophy and practices. Time permitting, the FCTM could be referenced inflight, however, it was not intended to be the prime reference to address abnormal conditions.

Significantly, the FAM stated that flight crew were required to use oxygen whenever the cabin altitude exceeded 10,000 ft.

A330 Quick reference handbook

Some abnormal and emergency procedures were not displayed on ECAM. These procedures were available as checklists in the QRH. The EMERGENCY DESCENT procedure was one of those.

A330 Flight crew operating manual

The Qantas A330 FCOM was an Airbus document that was customised for the operator’s aircraft. It was intended to provide all necessary operating limitations, procedures, performance, and system information to enable flight crews to operate the A330 aircraft safely and efficiently during normal, abnormal, and emergency situations. The FCOM also contained a statement that declared its content to be sufficiently comprehensive to be used as a reference for initial and refresher flight crew training.

Text within the FCOM was arranged into 3 layers, based on its level of importance:

• Layer 1: ‘Need to know’ information.
• Layer 2: ‘Nice to know’ information designed to enable a full understanding of the logic of the aircraft and flight crew interfaces.
• Layer 3: information that provided more detailed explanations, but not necessarily needed in flight.

The FCOM also identified the safety imperative attached to an operating procedure or techniques. This was achieved through the following structure:

Abnormal and emergency procedures

The procedures section of the FCOM included a subsection that covered abnormal and emergency procedures. The presentation of those procedures was, as far as practicable, designed to be identical to how it was displayed on ECAM. Aside from the specific design of the layers, the following observations were relevant to the structure of these procedures:

• All actions and information displayed on ECAM were provided in large text, while other information not on ECAM was provided in small text. This type of information was generally labelled as Layer 1.
• A procedure could have distinct preconditions necessary for the next step. These preconditions were identified and included in the FCOM procedure. If a precondition was to be displayed on ECAM, this was readily identifiable through standardised formatting within the FCOM.

CAB PR EXCESS CAB ALT procedure

When the CAB PR EXCESS CAB ALT alert triggered, the EWD displayed the following procedure to the flight crew:

These ECAM procedural items were to be executed using a ‘read‑&‑do’ principle, where each line item was to be read, applied, and the action monitored before moving onto the next item. As the flight crew actioned each line item, further elements of the procedure would be displayed.

The FCOM content for the procedure included the following additional layer 1 information that preceded the procedure:

Rely on the CAB PR EXCESS CAB ALT warning even if not confirmed on the CAB PRESS SD page. This warning can be triggered by a cabin pressure sensor different from the one used to control the pressure and display the cabin altitude on the SD.

This extra information was not displayed on the EWD when the CAB PR EXCESS CAB ALT alert triggered.

Memory item procedures

Certain procedures or actions required of the flight crew were time critical to ensure safety of flight. In these situations, the flight crew may not have time to refer to the ECAM or the QRH, and so these items were required to be memorised. Procedures that contained these memory items were clearly identified in the FCOM. The EMERGENCY DESCENT was a memory item procedure, but the CAB PR EXCESS CAB ALT procedure was not.

Flight crew techniques manual

The FCTM provided information that was complementary to the FCOM. This included general Airbus operational philosophy, additional information on FCOM procedures, as well as best practice and operating techniques.

The Abnormal and Emergency Procedures Miscellaneous section of the FCTM contained guidance on the conduct of an emergency descent. That guidance commenced with information that was specifically relevant to the CAB PR EXCESS CAB ALT procedure (Figure 5).

Figure 5: FCTM emergency descent guidance

Source: Airbus

The second paragraph contained guidance that the flight crew respond to the CAB PR EXCESS CAB ALT warning by executing the EMERGENCY DESCENT memory item procedure. The content of the EMERGENCY DESCENT procedure and the CAB PR EXCESS CAB ALT abnormal procedure contained the same procedural items, but their order of execution was different. In addition, the CAB PR EXCESS CAB ALT procedure was a read‑&‑do structured procedure.

Operating philosophy

While the policies and procedures necessary to operate an aircraft cover a broad spectrum of normal, abnormal, and emergency operational matters, they cannot cover all possible circumstances. In providing guidance on how to address circumstances not covered by these policies and procedures, both Airbus and the operator made use of an overarching philosophy. That philosophy should set out a clear order of priorities that apply under all circumstances, but which must also be consistent with policies and procedures (Degani 1997).

Airbus operating philosophy

The use of a philosophy of practice was evident in the general structure for the conduct of abnormal and emergency procedures within the A330 FCOM and FCTM. The FCOM contained a procedure that covered the initial actions for an ECAM alert, and while it did not contain any guidance on the general conduct of abnormal procedures, it did make direct reference to FCTM material that covered the management of abnormal operations.

The FCTM contained a section titled Airbus Operational Philosophy. Included within that section was a chapter on procedure design, and in particular, design of abnormal and emergency procedures. The following operational philosophy principles applied to these procedures:

• In most situations the applicable sequence should be, in order of priority, memory items, ECAM and then QRH.
• ECAM listed procedures were to be conducted using a ‘read‑&‑do’ method.

The general procedure for handling an ECAM alert in the FCTM included certain initial actions (Figure 6). The red boxed item identifies that standard ECAM procedure is to confirm an alert through checking flight deck instrument panels and/or the associated SD before taking action ‑ although it was noted that the sensors supplying these panels/SD pages may be different from the sensor that triggered the ECAM alert.

Figure 6: FCTM Airbus philosophy for ECAM actions

Source: Airbus

Qantas operating philosophy

While the FAM had no specific operating philosophy content, particularly in relation to the conduct of abnormal and emergency procedures, the following observations from the FAM were relevant to philosophy content within the rest of the operating suite of manuals:

• The ECAM and FCOM took precedence in the conduct of abnormal and emergency procedures.
• The FAM did not include the need for confirmation of a fault before executing an abnormal or emergency procedure.
• The FCTM was subordinate to the FCOM as a reference source.

In a memo dated June 2020, the operator’s Head of Fleet Operations notified all flight crew of specific requirements for the management of non-normal (abnormal and emergency) events. The memo stated a default position that all flight crew should identify and confirm a malfunction before executing the required procedures. If the alert message could not be positively confirmed as false, then it was to be assumed to be a correct reflection of system status.

The flight crew understood there was a need to confirm a fault before commencing the required procedure.

Training

The operator’s ab initio A330 type training provided flight crew with a computer-based training segment and flight simulator training on the CAB PR EXCESS CAB ALT alert procedure. However, the simulator was limited in its capability to reproduce a scenario that met the circumstances of the preamble to this procedure, being only able to produce the alert in conjunction with abnormal pressurisation indications on the SD page.

When interviewed, the captain stated that the simulator depressurisation training always required evidence of a depressurisation before conducting an emergency descent. The flight crew stated that this resulted in a bias towards seeking evidence of depressurisation for the CAB PR EXCESS CAB ALT alert before commencing the required emergency descent. Simulator training also stressed the need to establish confirmatory evidence of a fault before actioning the relevant procedure (this was in line with both Airbus and the operator’s philosophy described previously).

The captain did not recall that the preamble in the CAB PR EXCESS CAB ALT alert procedure required flight crews to rely on the alert regardless of the SD indications. However, the first officer had recently read the FCTM emergency descent material as part of a self-study component of the post furlough refresher training and hence was aware of the preamble.

In May 2021, the operator conducted an informal survey of a small number of A330 flight crew on their knowledge of the specific requirements of the CAB PR EXCESS CAB ALT procedure’s preamble. Survey responses suggested that this unique requirement was not well known.

Cabin pressure controller system examination

Recorded information

The aircraft was equipped with a quick access recorder (QAR) and flight data recorder (FDR). Figure 7 shows flight data for certain recorded parameters at the time of the incident.

Figure 7: VH-EBK flight data

Source: Data recorders, interpreted by the ATSB

Review of the data identified that:

• CPC2 was in control during the entire flight.
• The aircraft was cruising at FL 400 with CPC1 and CPC2 cabin pressure altitude recording stable values of about 7,100 ft.
• At about 0032, the CPC1 cabin altitude began to increase. The CPC2 cabin altitude remained unchanged at 7,100 ft.
• At about 0053, the CPC1 cabin altitude reached 9,560 ft, triggering the CAB PR EXCESS CAB ALT warning. Meanwhile, CPC2 cabin altitude remained steady at 7,100 ft.
• At about 0105, a precautionary descent was initiated. Shortly after, CPC1 recorded a cabin altitude of about 12,500 ft, and the CPC2 cabin altitude almost instantaneously started to record identical cabin altitude values to CPC1.
• At about 0106, the emergency descent was initiated, and the cabin altitude started to decrease. The CPC1 and CPC2 cabin altitude values remained the same for the rest of the flight.
• At about 0111, with the aircraft’s altitude indicating 11,500 ft and the cabin altitude about 9,500 ft, the CAB PR EXCESS CAB ALT warning deactivated. Shortly after, the aircraft was levelled off at about 10,000 ft.

Maintenance troubleshooting

After the flight, maintenance troubleshooting was conducted on the aircraft’s pressurisation system and each CPC. Pressurisation leak checks were found to be within normal limits, and the pressurisation system seals and valves were in serviceable condition. A post-flight maintenance report indicated that a CPC2 fault message was logged during the flight at 0105. This CPC was subsequently sent to the CPC manufacturer, Nord‑Micro, for examination.

Manufacturer investigation

Nord-Micro’s examination of the CPC2 pressure sensor found that it had experienced an intermittent hardware malfunction. However, the cause of the malfunction could not be determined.

The examination also found that during the flight, at 0032, when the cabin altitude was about 7,100 ft, the CPC2 cabin pressure sensor value appeared to ‘freeze’, but it continued to produce credible data. The faulty pressure sensor affected control of the outflow valves, and over time, this resulted in a loss of cabin pressure. It was not until about 0105, shortly after the precautionary descent was initiated, that the intermittent pressure sensor fault resulted in its output data exceeding any of the CPC’s internal fault detection criteria. At this time, the intermittent fault disappeared, and the pressure sensor started measuring the actual cabin pressure (12,500 ft cabin altitude). According to Nord-Micro, the sharp discontinuity in the pressure sensor value probably exceeded the fault detection criteria, triggering CPC2 to use the CPC1 pressure sensor data for cabin pressure control.

Since the specific cause of the fault could not be determined, Nord-Micro could not confirm if the aircraft’s precautionary descent had any effect on the intermittent fault disappearing.

Previous CPC2 faults

The examination further revealed that the CPC had logged 14 similar fault messages since June 2018 while the aircraft was either on the ground or in cruise flight. Qantas subsequently reviewed QAR data from 2 flights where the fault message was logged. That data showed a similar divergence of the CPC2 cabin altitude value, but the intermittent fault disappeared, and the cabin pressure control returned to normal before any cabin altitude alerts were triggered.

Qantas advised the ATSB that, prior to the occurrence, the CPC2 fault messages were being monitored,[12] but in accordance with the A330 troubleshooting manual, corrective maintenance action was only required within 1,000 flight hours of the logged event.

Airbus corrective action

The preamble

During an investigation into a 2006 in-service A320 cabin depressurisation event, Airbus became aware of a design limitation associated with the CPC systems. In that incident, incorrect but valid pressure sensor values were used by the aircraft’s controlling CPC system, resulting in a loss of control of cabin pressurisation and the eventual triggering of a cabin pressure alert, while at the same time presenting conflicting data on the CAB PRESS system page. The same issue was identified in A330 aircraft during a depressurisation event in 2007.

In order to mitigate the risk of flight crews not executing the required emergency procedure for the cabin pressure alert, a preamble for the CAB PR EXCESS CAB ALT alert was introduced into the A320, A330 and A340 Flight Crew Operating Manuals.[13] This preamble directed flight crew to execute the alert irrespective of the data being presented on the CAB PRESS system page. However, the ECAM EWD procedure associated with the CAB PR EXCESS CAB ALT alert did not include that direction.

Service bulletin

The previous A320 and A330 cabin depressurisation events in 2006 and 2007 were due to similar CPC pressure sensor failures as that experienced by VH-EBK. In those events, a pressure sensor fault in the controlling CPC was not detected, resulting in normal pressurisation indications to the flight crew and no automatic switchover to the standby CPC. In response to the pressurisation system issues, Airbus and Nord-Micro developed, among other safety enhancements, upgrades to the A320, A330 and A340 pressurisation systems to prevent cabin depressurisations from similar CPC pressure sensor faults.

This upgrade was released by Airbus for A330 aircraft in 2012 as part of service bulletin (SB) A330-21-3163, through CPC software logic updates. It had also been installed in aircraft produced since 2012, and was Airbus’ preferred method for addressing the design limitation. Airbus also advised that there had been limited uptake of the SB in aircraft produced before its release. One of those software changes allowed the CPC in control to use the lowest cabin pressure value of the 2 CPC pressure sensors in the event of a large enough deviation (20 hPa) between those sensors. According to Nord-Micro, had VH-‑EBK been fitted with the updated logic, the cabin depressurisation event would not have occurred.

The SB was classified by Airbus as ‘Recommended’[14] to reduce the likelihood of an inadvertent cabin depressurisation. An ATSB review of this SB identified that it did not include a summary of the operational events as background for the release of the SB, or an explanation of the CPC failure modes and how the accomplishment of the SB would prevent those failure modes.

Qantas assessed this SB in 2012 and again in 2015. These assessments concluded that the SB would be incorporated on attrition (when a CPC failed and needed replacement) based on the historically reliable performance of the CPCs. The SB had not been incorporated on VH-EBK at the time of this occurrence. ATSB review of the Qantas assessments identified that the 2012 assessment had not considered the risk related to incorporation of the SB on an attrition basis compared to early, pro-active completion. Additionally, although previously related operational events known to Airbus existed at the time of the 2015 assessment, these events were not included in the SB and therefore not considered by Qantas in their assessment.

Procedure design

The following extract from Human Performance Considerations in the Use and Design of Aircraft Checklists (Federal Aviation Administration, 1995) provides important guidance about the need for all critical components of a procedure to be included within the method for executing that procedure. While the guidance was in relation to checklist design, it applied with the same force to any ‘read & do’ list applicable to an ECAM procedure.

The complexity of today's aircraft requires a systematic approach to operation. The pilot and crew in fact, are an integral part of an aircraft system. Like any other complex system, when a system component fails, the entire system may be subject to failure.

Checklists have been the foundation of pilot standardization and cockpit safety for years. Such procedures, when applied in a disciplined and standard manner, are intended to support human performance by providing a firm foundation for the task, one which the pilot and crew can depend on during a "low" in performance. The checklist is an aid to the memory and helps to ensure that critical items necessary for the safe operation of aircraft are not overlooked or forgotten.

... From a human factors point of view, the checklist is an important interface between the human and the aircraft. In addition to assisting the crew to configure and operate the aircraft properly, the checklist provides a method and a sequence for verifying the overall system operation. It is an important aid in helping the crew to remain focused to the task at hand by eliminating guesswork that often accompanies periods when crew attention is divided especially during periods of stress or fatigue. The checklist is an important and necessary backup for the pilot and crew.

 

… Although it may be published in a manual, a checklist is designed for independent use so that the user does not have to reference a manual. Checklists are used to ensure that a particular series of specified actions or procedures are accomplished in correct sequence and to verify that the correct configuration has been established in specified phases of flight. 

ECAM provides an electronic automated system for the notification and execution of the procedural actions required of flight crew in response to various systems alerts. ECAM’s functions include those of a checklist, that is to ensure that all necessary procedural actions are completed. As such, all essential procedural elements should be presented on ECAM.

Similar occurrences

Airbus reported that the depressurisation event involving VH-EBK was a rare event, but that there had been 7 similar occurrences since 2016, mostly in A320 aircraft. The following summaries of incidents involving CPC sensor failures commences with the originating A320 event. The other 2 occurrences described were also among the 7 similar ones reported since 2016.

A320 depressurisation event, G-MIDW

An Air Accident Investigation Branch (UK) (AAIB) report discussed a depressurisation event that occurred with an A320 aircraft registered as G-MIDW. On 8 October 2006, while en-route to Glasgow at FL 380, the flight crew of that aircraft received a CAB PR EXCESS CAB ALT warning indicating excessive cabin altitude. However, the SD showed the pressurisation parameters, including the cabin altitude, were normal. The crew believed that the warning was spurious, but donned oxygen masks as a precaution. The CAB PR EXCESS CAB ALT procedure did not include the preamble component at that time.

Eighteen minutes later they were advised by the cabin crew that the passenger oxygen masks had deployed. An emergency descent to FL100 was initiated, at which level the flight continued to its destination without further incident. Airbus confirmed an unspecified fault in one of the aircraft’s CPCs and commenced investigation of possible improvements to the cabin pressurisation system.

A340 depressurisation event, G-VGAS

An AAIB report discussed a depressurisation event that occurred with an A340 aircraft registered as G-VGAS. On 23 February 2017, while en-route to New York at FL 400, the crew of that aircraft received a CAB PR EXCESS CAB ALT warning indicating an excessive cabin altitude. Although the SD indicated no abnormalities, the ECAM warning remained. Further, 2 crew members and both pilots believed they had symptoms of hypoxia.

The pilots began a descent but, when passing FL 260, the ECAM warning extinguished. The pilots elected to level off at FL 250 and continue towards their destination but, after approximately 30 minutes, the ECAM warning returned. Indications on the pressurisation system display were still normal but the pilots descended the aircraft to an altitude of 11,000 ft. At the same time as the warning of excessive cabin altitude, a fault was recorded in a CPC. Engineers suspected that this caused the cabin outflow valves to open, resulting in a cabin altitude increase.

A320 depressurisation event, AP-BLV

A Safety Investigation Board of Pakistan report discussed a depressurisation event that occurred with an A320 aircraft registered as AP-BLV. On 18 October 2017, while en-route to Karachi at FL 320, that aircraft experienced several CAB PR EXCESS CAB ALT warnings. The flight crew maintained altitude and attempted to reset the cabin pressurisation system. During this reset all passenger oxygen masks deployed. The aircraft continued to its destination at FL 320.

A post‑flight investigation identified that the controlling CPC failed to regulate the cabin pressure at the desired altitude, and the backup CPC did not automatically take over. The controlling CPC fault caused the cabin altitude to climb, leading to the repeated cabin pressure warnings. The flight crew did not action the alert’s required procedure, but instead unsuccessfully attempted to change controlling CPCs (using an incorrect procedure). The cabin altitude eventually exceeded that required to automatically trigger the cabin masks deployment.

Safety analysis

In the early morning on 5 February 2021, while en route from Sydney to Perth the flight crew of an Airbus A330, registered VH-EBK, received an excess cabin altitude warning during cruise at about 40,000 ft. About 7 minutes later, the flight crew donned their oxygen masks and conducted an emergency descent, diverting to Adelaide without further incident.

The following analysis discusses the circumstances leading to the cabin depressurisation and the factors that influenced the flight crew’s response.

Cabin depressurisation

During cruise with the aircraft’s cabin altitude at 7,100 ft, the controlling cabin pressure controller (CPC2) experienced an intermittent pressure sensor fault, resulting in inaccurate control of the outflow valves. This fault was not automatically detected by CPC2, as the sensor continued to provide credible data. As the automatic transfer of pressurisation control for a sensor fault is dependent on that fault being detected, pressurisation control was not transferred to CPC1, which was functioning correctly. As a result, the aircraft began to slowly depressurise.

About 15 minutes after the undetected pressure sensor fault occurred, the actual cabin altitude (as recorded by CPC1) reached 8,800 ft. However, since CPC2 was still sensing 7,100 ft, the Electronic Centralized Aircraft Monitor (ECAM) advisory message CAB ALT was not activated. This alert was designed to notify the flight crew that the cabin altitude was outside normal operating parameters, but its triggering relied on the controlling CPC detecting this event. About 6 minutes later, the actual cabin altitude exceeded 9,550 ft, and CPC1 triggered the CAB PR EXCESS CAB ALT alert on the ECAM. This also resulted in the cabin pressure information being displayed to the flight crew on the CAB PRESS page on the System Display (SD). However, as CPC2 was still in control and sensing a cabin altitude of 7,100 ft, the cabin pressure indications on the CAB PRESS page appeared normal. Consequently, the flight crew were presented with conflicting information.

Cabin pressure controller fault

The preamble

In 2006, Airbus became aware of a design limitation associated with the CPC systems where a faulty cabin pressure sensor in the controlling CPC could cause misleading information to be presented to the flight crew on the CAB PRESS system page. In response, Airbus introduced a preamble into the flight crew operating manual’s (FCOM’s) CAB PR EXCESS CAB ALT alert procedure. The preamble required an immediate response to the ECAM alert by executing the associated procedure displayed on the engine and warning display, irrespective of system data indications.

A critical function of an emergency procedure checklist, or the ECAM ‘read & do’ procedure, is to ensure that items necessary for the safe operation of aircraft are carried out. Airbus introduced the preamble to the FCOM’s CAB PR EXCESS CAB ALT alert procedure as a risk mitigator against the limitations in the CPC fault detection capabilities. The preamble was unique in that it required flight crews to execute the procedure even without confirmatory data. However, this was contrary to an Airbus operating philosophy for flight crew to seek confirmatory evidence of a fault before executing the associated abnormal procedure.

Despite the importance of the preamble, it was not part of the ‘read‑&‑do’ procedural steps presented on the ECAM, and thus not presented to the flight crew during the execution of the required procedure. Instead, the immediate actioning of the procedure in response to the alert (as required by the preamble) was reliant on flight crew memory recall of the preamble’s requirement.

Service bulletin

Following previous CPC faults, Airbus released service bulletins (SB) for the A320, A330 and A340 aircraft types that included CPC software logic updates. For the A330, one of those software changes allowed the CPC in control to use the lowest cabin pressure value of the two CPC pressure sensors if there was a large enough difference between the values. The aircraft did not have this SB incorporated at the time of the incident.

While the SB would not have prevented the intermittent pressure sensor fault observed on VH‑EBK, its incorporation would have resulted in automatic identification of the pressure difference when the cabin altitude was about 8,000 ft, resulting in CPC2 using the CPC1 pressure sensor for cabin pressure control. This would have prevented the depressurisation event and activation of the CAB PR EXCESS CAB ALT alert.

Crew response

When the red CAB PR EXCESS CAB ALT warning alert was triggered, the flight crew immediately sought confirmatory data consistent with both the Airbus philosophy and the Qantas internal memo dated June 2020. The CAB PRESS page on the SD, however, indicated that the system was operating normally. The captain also identified that there had been no 8,800 ft CAB ALT advisory message preceding the red warning alert, raising questions about whether the controlling CPC was functioning correctly. As previous simulator depressurisation training had reinforced the need to obtain confirmation of a depressurisation before conducting the required emergency descent, the flight crew continued to seek further evidence of depressurisation. Discussion with the customer service manager further delayed the required response.

The first officer retrieved the Flight Crew Techniques Manual (FCTM) for guidance. The captain reported that, upon review, they found the information to be inconsistent and confusing, although the first officer assessed that the information instructed an immediate emergency descent. The confusion over the FCTM information resulted in the flight crew further delaying the execution of the alert’s procedure.

Emergency oxygen

When the aircraft’s cabin altitude exceeds 10,000 ft, the occupants’ risk of hypoxia is significantly elevated. Therefore, the loss of cabin pressurisation notified by the CAB PR EXCESS CAB ALT is a red warning alert, where the immediate imperative for the flight crew is the use of supplemental oxygen.

On activation of the ECAM alert on this occasion, the flight crew focussed on acquiring data to support the cabin altitude warning alert, and in particular the requirement to conduct an emergency descent for a depressurisation. Consequently, they overlooked the first line of the ECAM procedure, which was for both crew members to use oxygen. The risk from hypoxia is relevant in any cabin pressurisation issue, whether through explosive or slow depressurisation. Although the outflow valves would automatically limit the cabin altitude to 15,000 ft, this is still within the hypoxic range.

Use and content of manuals

When presented with conflicting data for the CAB PR EXCESS CAB ALT alert, the flight crew referenced the FCTM and not the FCOM. While the operator’s Flight Administration Manual (FAM) stated that the primary references for operational matters were the ECAM/Quick Reference Handbook (QRH), and then the FCOM and the FAM, the flight crew’s use of the FCTM was probably influenced by the first officer’s recollection that it contained information relevant to depressurisation/emergency descent.

Simulator training

Although actioning the CAB PR EXCESS CAB ALT alert was critical to flight safety and could potentially present a unique situation for flight crew, knowledge of the preamble’s unique requirement was not well known among the operator’s flight crew. 

Further, the depressurisation training in the simulator potentially created a bias as flight crews became accustomed to always having supporting evidence of a cabin depressurisation alongside the CAB PR EXCESS CAB ALT alert. As such, the operator’s training system did not adequately cover the unique requirements of the CAB PR EXCESS CAB ALT alert procedure that may be encountered in flight, increasing the risk of an incorrect or delayed application of the required procedure.

Mitigations to CPC design limitation

In response to the possibility of cabin depressurisation events resulting from the CPC design limitation, Airbus introduced two specific mitigations for the A320, A330 and A340 fleets. These mitigations were:

• to remove the design limitation through the application of improvements to the CPC through application of SBs released in 2012 and 2014
• procedural changes, which included the incorporation of a preamble to the CAB PR EXCESS CAB ALT abnormal procedure around 2006.

As the CAB PR EXCESS CAB ALT alert is a red warning alert, being the highest priority alert, the required procedural response should be designed to ensure a correct application every time with no exceptions. However, since 2016 there have been 7 events of a similar nature to the VH-EBK according to Airbus. Of these 7 events, 2 had indications of the incorrect application of the procedure, where the preamble requirement did not appear to have been applied. The VH-EBK event was a further example.

These events, as well as the potential failure points of the reliance on memory recall and the various operational philosophy aspects, identified that the procedural mitigation did not ensure appropriate management of aircraft experiencing a cabin depressurisation due to the CPC design limitation. Further, while the SB is the Airbus preferred method of addressing the design limitation, there has been very limited uptake in the pre-2012 A320 and A330/340 fleets. Overall, the mitigations introduced to counter the CPC design limitation have not been sufficiently effective.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors. Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the depressurisation involving Airbus A330, VH-EBK that occurred on 5 February 2021.

Contributing factors

• Due to a design limitation associated with the aircraft’s cabin pressure controller (CPC) systems:
  • The controlling CPC was unable to detect a fault with its pressure sensor, resulting in the loss of cabin pressure control and the subsequent increase in cabin altitude.
  • While the backup CPC triggered the CAB PR EXCESS CAB ALT alert as required when the cabin altitude exceeded 9,550 ft, the data presented to the flight crew indicated normal cabin altitude.
• The flight crew responded to the CAB PR EXCESS CAB ALT alert procedure by observing that there was no confirmatory data and, in seeking evidence to verify the failure, delayed executing the required procedure.
• A preamble to the CAB PR EXCESS CAB ALT alert procedure was introduced as a procedural mitigation for the CPC system design limitation. This required flight crew to rely on the alert even if not confirmed by other system data. This mitigation had significant potential for error as:
  • although a critical component to the procedure, the preamble requirement was not part of the ‘read & do’ procedural steps and was reliant on memory recall
  • the required procedural action was contrary to both the operator and aircraft manufacturer’s procedural philosophy of confirming alerts with system data before executing abnormal procedures
• An Airbus service bulletin (SB), introduced as a mitigation to the CPC design limitation, would have prevented the loss of cabin pressure control from the pressure sensor fault. However, the SB had not been incorporated on this aircraft.
• The mitigations introduced by Airbus to counter the design limitation associated with the A330 cabin pressure control systems were ineffective because:
  • changes to the CAB PR EXCESS CAB ALT alert operational procedure did not ensure appropriate management of the fault
  • the service bulletin had very limited uptake in the A330/A340 global fleet. [Safety Issue]
• The operator’s training system did not adequately cover the unique requirements of the CAB PR EXCESS CAB ALT alert procedure, increasing the risk of an incorrect or delayed application of the required procedure. [Safety Issue]

Other factors that increased risk

• Contrary to the operator's Flight Administration Manual policy requirements, the flight crew referenced the Flight Crew Techniques Manual instead of the Flight Crew Operations Manual to resolve the conflicting data presented with the CAB PR EXCESS CAB ALT procedure.
• While determining the need to execute the CAB PR EXCESS CAB ALT alert procedure, the flight crew focussed on the need for confirmatory data to support an emergency descent and consequently, did not don their oxygen masks, increasing the risk of hypoxia.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation. The initial public version of these safety issues and actions will be provided separately on the ATSB website on release of the final investigation report, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website after the release of the final report as further information about safety action comes to hand.

Operator training

Safety issue description

The operator’s training system did not adequately cover the unique requirements of the CAB PR EXCESS CAB ALT alert procedure, increasing the risk of an incorrect or delayed application of the required procedure.

Mitigations to CPC design limitation

Safety issue description

The mitigations introduced by Airbus to counter the design limitation associated with the A330 cabin pressure control systems were ineffective, because:

• changes to the CAB PR EXCESS CAB ALT alert operational procedure did not ensure appropriate management of the fault
• the service bulletin had very limited uptake in the A330/340 global fleet.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Additional safety action addressing the flight crew techniques manual content

Qantas advised of the following modification to the Emergency Descent section of the Flight Crew Techniques Manual:

The flight crew must rely on the CAB PR EXCESS CAB ALT warning, even if not confirmed on the CAB PRESS SD because the CAB PR EXCESS CAB ALT warning can be triggered by a cabin pressure sensor, different from the one used to control the pressure and display the cabin altitude on the SD. In absence of the CAB PR EXCESS CAB ALT warning, the emergency descent should only be initiated on positive confirmation that cabin altitude and rate of climb are excessive and uncontrollable.

The amended content was issued on 1 March 2021.

Qantas maintenance action

Qantas advised of the following maintenance action:

• The Qantas fleet was checked for similar Cabin Pressure Controller (CPC) faults with no other aircraft identified with the same type of fault.
• Qantas established an enhanced CPC fault alert policy to manage suspected faulty CPCs.
• The Qantas A330 fleet was modified to incorporate the Airbus CPC software change and all CPC affected by the subject service bulletin have been modified.

 

Glossary

A330                Airbus type A330 passenger aircraft

ATC                 Air traffic control

CAB PRESS     An ECAM cabin pressurisation system page, which presents data on the current status and operation of the aircraft’s pressurisation system

CPC                 Cabin pressure controller. VH-EBK had two controllers, labelled CPC1 and CPC2.

CPCLD             Controller-pilot data link communications, a system used by ATC for aircraft flight following

CVR                 Cockpit voice recorder

CSM                Customer Service Manager

EWD                Engine and warning display

ECAM              Electronic centralized aircraft monitor

FAM                 Flight administration manual

FCOM              Flight crew operations manual

FCTM               Flight crew techniques manual

FDR                 Flight data recorder

FL                    Flight level

FO                   First officer

MAYDAY          An internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.

Nord-Micro        Manufacturer of the A330 CPC

PAN PAN         An internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Preamble          Text that preceded the FCOM’s CAB PR EXCESS CAB ALT procedure, which identified the need to execute the procedure irrespective of the data presented on the ECAM SD.

PF                    Pilot flying

PM                   Pilot monitoring

QAR                 Quick access recorder, a derivative of a digital flight data recorder

QRH                Quick reference handbook

SD                   System display

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the cockpit voice recorder of VH-EBK
• the flight data recorders of VH-EBK
• the flight crew of VH-EBK
• Qantas Airways
• Civil Aviation Safety Authority
• Airbus
• Nord-Micro.

References

AAIB UK (Air Accident Investigations Branch United Kingdom) (2007) AAIB Bulletin: 7/2007 G-MIDW EW/G2006/10/07, United Kingdom Government Publishing Service website, accessed 26 September 2022.

AAIB UK (2017) AAIB Bulletin: 9/2017 G-VGAS EW/G2017/02/08, United Kingdom Government Publishing Service website, accessed 26 September 2022.

AAIB Pak (Air Accident Investigations Board Pakistan) (2017) SIB-399: SERIOUS INCIDENT OF PIAC FLTGHT PK-369 (ISB TO KHI) A320-214 AIRCRAFT REG NO AP-BLV CABIN PRESSURE LOST FOLLOWED BY OXYGEN MASKS DROPPING DATED 18 OCTOBER 2017, Pakistan Civil Aviation Authority website, accessed 26 September 2022.

CAA UK (Civil Aviation Authority United Kingdom) (2017) CAP 708: Guidance on the design, presentation and use of electronic checklists, CAA UK website, accessed 26 September 2022.

Degani A, and Wiener E L (1997) ‘Philosophy, policies, procedures and practices: The four ‘P’s of flight deck operations’, in McDonald N, Fuller R and Johnston N (eds) Aviation psychology in practice, Routledge, London.

Federal Aviation Administration (1995) Human performance considerations in the use and design of aircraft checklists, US Department of Transportation.

SKYbrary a (n d) Hypoxia, SKYbrary website, accessed 26 September 2022.

SKYbrary b (n.d.) OGHFA – Hypoxia, SKYbrary website, accessed 26 September 2022.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew of VH-EBK.
• Qantas Airways
• Civil Aviation Safety Authority
• Airbus
• Nord-Micro
• Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile

Submissions were received from:

• the flight crew of VH-EBK
• Qantas Airways
• Civil Aviation Safety Authority
• Airbus
• Nord-Micro

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.