There was a limitation in the algorithm used by the A330/A340 flight control primary computers (FCPCs) for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple spikes in AOA from only one of the three ADIRUs could result in a nose-down elevator command.
The FCPC algorithm for processing angle of attack data has been redesigned to eliminate the design limitation and ensure that the algorithm is not affected by incorrect data from any one of the aircraft's three air data inertial reference units.
On 15 October 2008, the aircraft manufacturer issued Operations Engineering Bulletin (OEB) OEB-A330-74-1, which was applicable to all A330 aircraft fitted with Northrop Grumman ADIRUs. The OEB stated that, in the event of a NAV IR [1, 2 or 3] FAULT (or an ATT red flag being displayed on either the captain’s or first officer’s primary flight display), the flight crew were required to select the air data reference (ADR) part of the relevant ADIRU OFF and then select the relevant inertial reference (IR) part of the relevant ADIRU OFF. The problem was described as a ‘significant operational issue’ and operators were advised to inform their pilots of the OEB without delay and insert the procedure in the Flight Crew Operations Manual. A compatible temporary revision was issued to the Minimum Master Equipment List at the same time.
Note: Operators were advised of the OEB and the associated problem in an operator information telex that was issued on 14 October 2008.
The OEB procedure was subsequently amended in December 2008 to cater for a situation where the IR and ADR pushbuttons were selected OFF and the OFF lights did not illuminate. The new OEB (A330-74-3) required crews to select the IR mode rotary selector to the OFF position if the lights did not illuminate.
Following the 27 December 2008 occurrence, the aircraft manufacturer issued another OEB (A330-74-4, 4 January 2009). This OEB provided a revised procedure for responding to a similar ADIRU-related event to ensure incorrect data would not be used by other aircraft systems. The procedure required the crew to select the relevant IR OFF, select the relevant ADR OFF, and then turn the IR mode rotary selector to the OFF position.
The manufacturer issued similar OEBs to operators of A340 aircraft.
The ATSB is satisfied that related action being taken by the aircraft manufacturer to redesign the algorithm will satisfactorily address the safety issue.
The aircraft manufacturer introduced an interim modification to the flight control primary computer (FCPC) software standard (P9A/M18A) that was promulgated using a Service Bulletin. The interim standard incorporated the modified monitoring and filtering of five parameters, including AOA. The standard was retrofitted to the operator’s fleet of A330 aircraft, and completed in November 2009.
The revised algorithm for processing AOA data again based AOAFCPC input on the average of AOA 1 and AOA 2, but it did not include the 1.2-second memorisation period. Additional processes were used to monitor the consistency of the three AOA values The new algorithm also introduced a mechanism to monitor the overall consistency or oscillation of each AOA, with the associated ADR being rejected for the remainder of the flight if a problem was detected. In the event that an ADR was rejected due to a problem with AOA data, the flight warning system (FWS) would not issue any spurious stall warnings associated with that ADR’s data.
Subsequent FCPC software standards were developed for use on all A330/A340 aircraft. These later standards included the redesign of the AOA algorithm (as discussed above), as well as modified algorithms for a number of other ADIRU parameters used by the FCPCs. During 2011, the new software standards were certified by EASA for all but one of the A330/A340 models. The standard for the last model was expected to be certified in February 2012.
When retrofit action has been completed, the aircraft manufacturer (in consultation with EASA) will cancel the relevant OEBs.
The ATSB is satisfied that the action being taken by the aircraft manufacturer will satisfactorily address the safety issue.
The Operations Engineering Bulletins (OEBS) issued by Airbus were subsequently issued as airworthiness directives by the relevant regulatory agencies.
More specifically:
The EASA directives also applied to A340 aircraft.
The ATSB is satisfied that related action being taken by the aircraft manufacturer will satisfactorily address the safety issue.
On 15 October 2008, in response to the initial advice from the aircraft manufacturer, the operator issued Flight Standing Order 134/08 for its A330 operations. On 24 October 2008, this order was replaced by Flight Standing Order 136/08, which incorporated the material from the initial Airbus Operations Engineering Bulletin (OEB).
In addition, a program of focused training during simulator sessions and route checks was initiated to ensure that flight crew undertaking recurrent or endorsement training were aware of the contents of the Flight Standing Order. Subsequent Flight Standing Orders were issued in response to the modified OEBs in December 2008 and January 2009.
