There was a limitation in the algorithm used by the A330/A340 flight control primary computers (FCPCs) for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple spikes in AOA from only one of the three ADIRUs could result in a nose-down elevator command.
Single event effects (SEE) have the potential to adversely affect avionics systems that have not been specifically designed to be resilient to this hazard. There were no specific certification requirements for SEE, and until recently there was no formal guidance material available for addressing SEE during the design process.
When developing the A330/A340 flight control primary computer software in the early 1990s, the aircraft manufacturer’s system safety assessment and other development processes did not fully consider the potential effects of frequent spikes in the data from an air data inertial reference unit.
Patrick Terminals’ safe work instructions for lashing/unlashing did not specifically cover the recognised safe practices of not working under containers or between moving containers and fixed objects. Consequently, there was a discontinuity between the level of awareness regarding these dangers and the training new employees received during their induction period.
Patrick Terminals’ risk assessment process for lashing and unlashing operations had not anticipated a fatal accident resulting from being struck by items falling from a portainer or cargo, or from being struck by a moving container. As a result, while the appropriate risk control for this occurrence had been covered during employee training, this was not reinforced in safe work instructions, an important risk control measure.
Patrick Terminals’ hazard identification process had not identified the dangers of working near or under containers being loaded.
Although passengers are routinely advised after takeoff to wear their seat belts when seated, this advice typically does not reinforce how the seat belts should be worn.
Industry practices for tracking faults or performance problems with line-replaceable units are limited, unless the units are removed for examination. Consequently, the manufacturers of aircraft equipment have incomplete information for identifying patterns or trends that can be used to improve the safety, availability or reliability of the units.
The culture which existed in the Patrick terminal did not encourage the reporting of non-compliances or unsafe acts. Consequently, two critical parts of an effective safety system, which had a direct impact upon its ability to effectively manage safety in the terminal, the ‘reporting’ culture and the ‘just’ culture, were either not present or were misunderstood in Patrick’s safety system.
One of the aircraft’s three air data inertial reference units (ADIRU 1) exhibited a data-spike failure mode, during which it transmitted a significant amount of incorrect data on air data parameters to other aircraft systems, without flagging that this data was invalid. The invalid data included frequent spikes in angle of attack data. Including the 7 October 2008 occurrence, there have been three occurrences of the same failure mode on LTN-101 ADIRUs, all on A330 aircraft.
The LTN-101 air data inertial reference unit (ADIRU) model had a demonstrated susceptibility to single event effects (SEE). The consideration of SEE during the design process was consistent with industry practice at the time the unit was developed, and the overall fault rates of the ADIRU were within the relevant design objectives.
Patrick Terminals had no formalised policy in place to provide clear guidance to its stevedoring employees about where they could or could not work on a ship when cargo was being loaded or discharged.
Although passengers are routinely reminded to keep their seat belts fastened during flight whenever they are seated, a significant number of passengers have not followed this advice. At the time of the first in-flight upset, more than 60 of the 303 passengers were seated without their seat belts fastened.
The existing take-off certification standards, which were based on the attainment of the take-off reference speeds, and flight crew training that was based on monitoring of and responding to those speeds, did not provide crews a means to detect degraded take-off acceleration.
A number of operators of the PZL M-18 Dromader aircraft had not applied the appropriate service life factors to the aircraft’s time in service for operations conducted with take-off weights greater than 4,700 kg, as required by the aircraft’s service documentation. Hence the operators could not be assured that their aircraft were within their safe service life.
The lack of a designated position in the pre-flight documentation to record the green dot speed precipitated a number of informal methods of recording that value, lessening the effectiveness of the green dot check within the loadsheet confirmation procedure.
The operator’s training and processes in place to enable flight crew to manage distractions during the pre-departure phase did not minimise the effect of distraction during safety critical tasks.
The failure of the digital flight data recorder (DFDR) rack during the tail strike prevented the DFDR from recording subsequent flight parameters.
Operation of the M-18A in accordance with Civil Aviation Safety Authority exemptions EX56/07 and EX09/07 at weights in excess of the basic Aircraft Flight Manual maximum take-off weight (MTOW), up to the MTOW listed on the Type Certificate Data Sheet, may not provide the same level of safety intended by the manufacturer when including that weight on the Type Certificate.
The lack of a requirement for a charter-specific risk assessment in this case meant that the risks associated with the charter were not adequately addressed.
