In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

ADIRU 1 affected the operation of autopilot 1 but it would not have affectedautopilot 2. After autopilot 1 disconnected, the captain engaged autopilot 2, but hedisconnected it shortly after.The crew made no further attempts to use autopilot 2, which was understandablegiven their decreasing level of trust in the aircraft’s systems. The use of manualcontrol also enabled the captain to more quickly respond to any furtherpitch-downs. Although re-engaging autopilot 2 would have reduced the captain’sworkload, it would not have prevented the pitch-down commands from the FCPCs.In addition, autopilot 2 would have automatically disconnected during each of thepitch-downs.5.5.6 Cabin communicationsFollowing the first upset, the flight crew promptly advised passengers and crew tobe seated and to fasten their seat belts, and they also repeated this message soonafter the second upset.Initially the flight crew were focused on evaluating and managing the problemswith the aircraft’s systems. They realised that the pitch-down was serious andwould have resulted in injuries, and did not need any additional information fromthe cabin at that stage. After the first officer returned to the flight deck they hadadditional information about the extent of injuries and damage, and decided todivert to Learmonth.Soon after deciding to divert, the flight crew requested further information from thecabin. Some of the initial information was provided by an off-duty cabin servicesmanager (CSM) who contacted the flight deck directly. Ideally, communicationsfrom the cabin in this type of situation should occur through the on-duty cabinservices manager (where available), as this will enable the manager to integrate theinformation and minimise unnecessary distractions for the flight crew. In this case,the off-duty CSM’s communications provided useful information to the flight crew.Overall, there was regular and effective communication between the flight deck andthe cabin, and within the cabin crew. The flight crew also regularly kept thepassengers informed of their situation.Some of the passengers and crew were seriously injured and needed medicalattention. The flight crew decided that they could not allow the cabin crew to leavetheir seats because of the risk of further injuries if another upset occurred. Given theuncertain situation they were experiencing, their rationale was justified. Divertingthe aircraft, and landing as soon as possible, was the safest way of getting medicalattention to those who were seriously injured.5.6 Final comments and lessons for new systemsThe investigation into the in-flight upset occurrence involving QPA on 7 October2008 was difficult and took an extensive amount of time. It covered a range ofcomplicated issues, including some that had rarely been considered in depth byprevious aircraft accident investigations (such as system safety assessments andsingle event effects).Ultimately, the occurrence involved a design limitation in the flight control systemthat had not been previously identified by the aircraft manufacturer, and a failure- 210 -