In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

5 ANALYSIS5.1 OverviewThe 7 October 2008 occurrence involving the Airbus A330-303 aircraft, registeredVH-QPA (QPA), occurred when the aircraft suddenly pitched nose down while incruise at FL370 (37,000 ft). A second, less significant pitch-down occurred2 minutes later.Data from the aircraft’s recorders and simulations by the aircraft manufacturershowed that the pitch-downs were due to nose-down movements of the aircraft’selevators. The evidence also showed that the elevator movements were not initiatedby turbulence, flight crew inputs, autopilot inputs, problems with the aircraft’sweight or balance, or a technical fault with the elevators or other relevant parts ofthe electrical flight control system (EFCS).The elevator movements were in fact commanded by the EFCS’s flight controlprimary computers (FCPCs). More specifically:• The FCPCs were designed to command a pitch-down if they detected that theaircraft’s angle of attack (AOA) was too high. The relevant correctivemechanisms were high AOA protection and anti pitch-up compensation.• A subsequent review of the FCPC algorithm for processing AOA data identifieda very specific (and unintended) scenario in which incorrect AOA data fromonly one of the aircraft’s three air data inertial reference units (ADIRUs) couldtrigger a pitch-down command. The scenario required two AOA spikes, with thesecond being present 1.2 seconds after the start of the first.• Two minutes before the first pitch-down, ADIRU 1 started outputting spikes inAOA data (and other ADIRU parameters), and the spikes were present at thetime of both pitch-downs.• Simulations by the aircraft manufacturer confirmed that AOA spikes of themagnitudes recorded during the flight could initiate the elevator movementsobserved during the pitch-downs.A summary of the main factors involved in the occurrence is presented in Figure 53.In essence, a design limitation with the FCPC software combined with an ADIRUfailure to falsely activate the corrective mechanisms and produce the pitch-downs.The subsequent vertical accelerations led to a large number of injuries to theaircraft’s occupants, with the number and extent of these injuries being exacerbatedby many of the occupants not wearing seat belts.This analysis discusses each of these factors, and several other topics of interest,including the reporting and recording of technical faults, flight crew performance,and cabin safety aspects.- 191 -