In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

EXECUTIVE SUMMARYKey investigation outcomesThe in-flight upset on 7 October 2008 occurred due to the combination of a designlimitation in the flight control primary computer (FCPC) software of the AirbusA330/A340, and a failure mode affecting one of the aircraft’s three air data inertialreference units (ADIRUs). The design limitation meant that, in a very rare andspecific situation, multiple spikes in angle of attack (AOA) data from one of theADIRUs could result in the FCPCs commanding the aircraft to pitch down.When the aircraft manufacturer became aware of the problem, it issued flight crewprocedures to manage any future occurrence of the same ADIRU failure mode. Theaircraft manufacturer subsequently reviewed and improved its FCPC algorithms forprocessing AOA and other ADIRU parameters. As a result of this redesign,passengers, crew and operators can be confident that the same type of accident willnot reoccur.The investigation identified several lessons or reminders for the manufacturers ofcomplex, safety-critical systems. With the knowledge that systems are becomingincreasingly complex, it also identified a need for more research into how designengineers and safety analysts evaluate system designs, and how their tasks, tools,training and guidance materials could be improved to minimise design errors.Although in-flight upsets are very rare events, the accident on 7 October 2008 alsoprovided a salient reminder to all passengers and crew of the importance of wearingtheir seat belts during a flight whenever they are seated.Summary of the occurrenceAt 0132 Universal Time Coordinated (0932 local time) on 7 October 2008, anAirbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72,departed Singapore on a scheduled passenger transport service to Perth, WesternAustralia. At 0440:26, while the aircraft was in cruise at 37,000 ft, ADIRU 1started providing intermittent, incorrect values (spikes) on all flight parameters toother aircraft systems. Soon after, the autopilot disconnected and the crew startedreceiving numerous warning and caution messages (most of them spurious). Theother two ADIRUs performed normally during the flight.At 0442:27, the aircraft suddenly pitched nose down. The FCPCs commanded thepitch-down in response to AOA data spikes from ADIRU 1. Although thepitch-down command lasted less than 2 seconds, the resulting forces were sufficientfor almost all the unrestrained occupants to be thrown to the aircraft’s ceiling. Atleast 110 of the 303 passengers and nine of the 12 crew members were injured; 12of the occupants were seriously injured and another 39 received hospital medicaltreatment. The FCPCs commanded a second, less severe pitch-down at 0445:08.The flight crew’s responses to the emergency were timely and appropriate. Due tothe serious injuries and their assessment that there was potential for furtherpitch-downs, the crew diverted the flight to Learmonth, Western Australia anddeclared a MAYDAY to air traffic control. The aircraft landed as soon asoperationally practicable at 0532, and medical assistance was provided to theinjured occupants soon after.- xv -