In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

DOCUMENT RETRIEVAL INFORMATIONReport No.AO-2008-070Publication dateDecember 2011ISBN978-1-74251-231-0Publication titleIn-flight upset, 154 km west of Learmonth, Western Australia, 7 October 2008, VH-QPA, AirbusA330-303Prepared ByAustralian Transport Safety BureauPO Box 967, Civic Square ACT 2608 Australia, www.atsb.gov.auAcknowledgementsFigures 1, 2, 26, F1 and F2: Courtesy of Google EarthFigures 4, 5, 9, 10, 11, 13 and 18: Courtesy of AirbusWhere figures from other sources are reproduced, the acknowledgement is provided with thefigure.AbstractOn 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantasflight 72, departed Singapore on a scheduled passenger transport service to Perth, WesternAustralia. While the aircraft was in cruise at 37,000 ft, one of the aircraft’s three air data inertialreference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flightparameters to other aircraft systems. Two minutes later, in response to spikes in angle of attack(AOA) data, the aircraft’s flight control primary computers (FCPCs) commanded the aircraft topitch down. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12of the occupants were seriously injured and another 39 received hospital medical treatment.Although the FCPC algorithm for processing AOA data was generally very effective, it could notmanage a scenario where there were multiple spikes in AOA from one ADIRU that were1.2 seconds apart. The occurrence was the only known example where this design limitation led toa pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraftmanufacturer subsequently redesigned the AOA algorithm to prevent the same type of accidentfrom occurring again.Each of the intermittent data spikes was probably generated when the LTN-101 ADIRU’s centralprocessor unit (CPU) module combined the data value from one parameter with the label foranother parameter. The failure mode was probably initiated by a single, rare type of internal orexternal trigger event combined with a marginal susceptibility to that type of event within ahardware component. There were only three known occasions of the failure mode in over128 million hours of unit operation. At the aircraft manufacturer’s request, the ADIRUmanufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmissionfailures.At least 60 of the aircraft’s passengers were seated without their seat belts fastened at the time ofthe first pitch-down. The injury rate and injury severity was substantially greater for those whowere not seated or seated without their seat belts fastened.The investigation identified several lessons or reminders for the manufacturers of complex,safety-critical systems.- vii -