Jump to Content
Download Final Report
[PDF: 5.36MB]
 
 
Alternate: [DOC: 18.19MB]
 

On 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. While the aircraft was in cruise at 37,000 ft, one of the aircraft's three air data inertial reference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Two minutes later, in response to spikes in angle of attack (AOA) data, the aircraft's flight control primary computers (FCPCs) commanded the aircraft to pitch down. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment.

Although the FCPC algorithm for processing AOA data was generally very effective, it could not manage a scenario where there were multiple spikes in AOA from one ADIRU that were 1.2 seconds apart. The occurrence was the only known example where this design limitation led to a pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraft manufacturer subsequently redesigned the AOA algorithm to prevent the same type of accident from occurring again.

Each of the intermittent data spikes was probably generated when the LTN-101 ADIRU's central processor unit (CPU) module combined the data value from one parameter with the label for another parameter. The failure mode was probably initiated by a single, rare type of internal or external trigger event combined with a marginal susceptibility to that type of event within a hardware component. There were only three known occasions of the failure mode in over 128 million hours of unit operation. At the aircraft manufacturer's request, the ADIRU manufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmission failures.

At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. The injury rate and injury severity was substantially greater for those who were not seated or seated without their seat belts fastened.

The investigation identified several lessons or reminders for the manufacturers of complex, safety‑critical systems.

 

Animation: [Download AVIavi: Animation 5 MB]

Download Final Report
[PDF: 5.36MB]
 
 
Alternate: [DOC: 18.19MB]
 
 

A key safety message for passengers in the AO-2008-070 final report is the importance of wearing seat belts when seated in flight, even when the seat-belt sign is not illuminated. As stated in the report:

At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. Consistent with previous in-flight upset accidents, the injury rate, and injury severity, was substantially greater for those who were not seated or seated without their seat belts fastened.

Further information on the wearing of seat belts and other advice for minimising injury risk during turbulence and other in-flight upsets is also available in the ATSB Aviation Safety Bulletin titled Staying safe against turbulence available at ATSB website.

Public safety advice about the importance of wearing seat belts on aircraft has also been provided by the Australian Civil Aviation Safety Authority.

A video showing the effects of not wearing seat belts during a simulated in-flight upset is available on the US Federal Aviation Administration website.  The video simulates a turbulence event, whereas the in-flight upset on 7 October 2008 near Learmonth, Western Australia was due to pitch-down commands from the aircraft's flight control system.     

Regardless of why an upset occurs, the message is the same: Wearing a seat belt during all phases of a flight, and having the seat belt fastened low and firm, will significantly minimise the risk of injury in the unlikely event of an in-flight upset.

 
Download Interim Factual No.2
[PDF: 273KB]
 
 
 

Interim Factual report No. 2 released 18 November 2009

This report provides an update to the first Interim Factual Report on this occurrence that was released on 6 March 2009.

The interim report should be read in conjunction with the first interim report. The contents of this second interim report focus on summarising new activities conducted since the previous report, providing information on relevant topics not released in the previous report, and updating information on relevant topics where there have been significant changes. Further details of new and ongoing activities will be provided in the Australian Transport Safety Bureau's (ATSB) final report.

The information contained in this interim factual report is derived from the ongoing investigation of the occurrence. Readers are cautioned that there is the possibility that new evidence may become available during the remainder of the investigation that alters the circumstances as depicted in this report.

The investigation is continuing.

Download Interim Factual No.2
[PDF: 273KB]
 
 
 
 
Download Interim Factual No.1
[PDF: 1.44MB]
 
 
 

Interim Factual report No.1 released 6 March 2009

At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. From about the same time there were various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down, and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down, and descended about 400 ft during this second event.

At 1249, the crew made a PAN urgency broadcast to air traffic control, and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.

One flight attendant and 11 passengers were seriously injured and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened or were standing. As there were serious injuries, the occurrence constituted an accident.

The investigation to date has identified two significant safety factors related to the pitch-down movements. Firstly, immediately prior to the autopilot disconnect, one of the air data inertial reference units (ADIRUs) started providing erroneous data (spikes) on many parameters to other aircraft systems. The other two ADIRUs continued to function correctly. Secondly, some of the spikes in angle of attack data were not filtered by the flight control computers, and the computers subsequently commanded the pitch-down movements.

Two other occurrences have been identified involving similar anomalous ADIRU behaviour, but in neither case was there an in-flight upset.

Download Interim Factual No.1
[PDF: 1.44MB]
 
 
 
 
Download Preliminary Report
[PDF: 1.2MB]
 
 
 

Preliminary report released 14 November 2008

At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. That was accompanied by various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down, and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down, and descended about 400 ft during this second event.

At 1249, the crew made a PAN emergency broadcast to air traffic control, and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin crew of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.

Currently available information indicates that one flight attendant and at least 13 passengers were seriously injured and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened. This constituted an accident under the ICAO definition outlined in Annex 13 to the Chicago Convention and as defined in the Transport Safety Investigation Act 2003.

Examination of flight data recorder information indicates that, at the time the autopilot disconnected, there was a fault with the inertial reference (IR) part of the air data inertial reference unit (ADIRU) number 1. From that time, there were many spikes in the recorded parameters from the air data reference (ADR) and IR parts of ADIRU 1. Two of the angle-of-attack spikes appear to have been associated with the uncommanded pitch-down movements of the aircraft.

Download Preliminary Report
[PDF: 1.2MB]
 
 
 
 

Safety issues

AO-2008-070-SI-01 - AO-2008-070-SI-02 - AO-2008-070-SI-03 - AO-2008-070-SI-04 - AO-2008-070-SI-05 - AO-2008-070-SI-06 - AO-2008-070-SI-07 - AO-2008-070-SI-08 - AO-2008-070-SI-09 - AO-2008-070-SI-10 - AO-2008-070-SI-11 -  

Air data inertial reference unit (ADIRU) failure

One of the aircraft’s three air data inertial reference units (ADIRU 1) exhibited a data-spike failure mode, during which it transmitted a significant amount of incorrect data on air data parameters to other aircraft systems, without flagging that this data was invalid. The invalid data included frequent spikes in angle of attack data. Including the 7 October 2008 occurrence, there have been three occurrences of the same failure mode on LTN-101 ADIRUs, all on A330 aircraft.

Issue Number:AO-2008-070-SI-01
Who it affects:All operators of aircraft fitted with LTN-101 ADIRUs
Status:Partially addressed


 

Angle or attack processing algorithm

There was a limitation in the algorithm used by the A330/A340 flight control primary computers (FCPCs) for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple spikes in AOA from only one of the three ADIRUs could result in a nose-down elevator command.

Issue Number:AO-2008-070-SI-02
Who it affects:All operators of A330/A340 aircraft
Status:Adequately addressed


 

Air data inertial reference unit (ADIRU) fault detection

For the data-spike failure mode, the built-in test equipment of the LTN 101 air data inertial reference unit was not effective, for air data parameters, in detecting the problem, communicating appropriate fault information, and flagging affected data as invalid.

Issue Number:AO-2008-070-SI-03
Who it affects:All operators of aircraft fitted with LTN-101 ADIRUs
Status:Partially addressed


 

Flight control primary computer design

When developing the A330/A340 flight control primary computer software in the early 1990s, the aircraft manufacturer’s system safety assessment and other development processes did not fully consider the potential effects of frequent spikes in the data from an air data inertial reference unit.

Issue Number:AO-2008-070-SI-04
Who it affects:All operators of A330/A340 aircraft
Status:Adequately addressed


 

Seat belts usage

Although passengers are routinely reminded to keep their seat belts fastened during flight whenever they are seated, a significant number of passengers have not followed this advice. At the time of the first in-flight upset, more than 60 of the 303 passengers were seated without their seat belts fastened.

Issue Number:AO-2008-070-SI-05
Who it affects:All aircraft passengers
Status:Partially addressed


 

Limited evaluation of design process

In recent years there have been developments in guidance materials for system development processes and research into new approaches for system safety assessments. However, there has been limited research that has systematically evaluated how design engineers and safety analysts conduct their evaluations of systems, and how the design of their tasks, tools, training and guidance material can be improved so that the likelihood of design errors is minimised.

Issue Number:AO-2008-070-SI-06
Who it affects:All aircraft operators
Status:Not addressed


 

Single event effect general risk to avionics

Single event effects (SEE) have the potential to adversely affect avionics systems that have not been specifically designed to be resilient to this hazard. There were no specific certification requirements for SEE, and until recently there was no formal guidance material available for addressing SEE during the design process.

Issue Number:AO-2008-070-SI-07
Who it affects:All aircraft operators
Status:Partially addressed


 

Air data inertial reference unit (ADIRU) susceptibility to single event effects

The LTN-101 air data inertial reference unit (ADIRU) model had a demonstrated susceptibility to single event effects (SEE). The consideration of SEE during the design process was consistent with industry practice at the time the unit was developed, and the overall fault rates of the ADIRU were within the relevant design objectives.

Issue Number:AO-2008-070-SI-08
Who it affects:All operators of aircraft fitted with LTN-101 ADIRUs
Status:Partially addressed


 

Line-replaceable units problem tracking

Industry practices for tracking faults or performance problems with line-replaceable units are limited, unless the units are removed for examination. Consequently, the manufacturers of aircraft equipment have incomplete information for identifying patterns or trends that can be used to improve the safety, availability or reliability of the units.

Issue Number:AO-2008-070-SI-09
Who it affects:All aircraft operators and maintenance organisations
Status:Not addressed


 

Research into passenger seat belt compliance

There has been very little research conducted into the factors influencing passengers’ use of seat belts when the seat-belt sign is not illuminated, and the effectiveness of different techniques to increase the use of seat belts.

Issue Number:AO-2008-070-SI-10
Who it affects:All aircraft passengers
Status:Not addressed


 

Instructions to wear seat belts in cruise

Although passengers are routinely advised after takeoff to wear their seat belts when seated, this advice typically does not reinforce how the seat belts should be worn.

Issue Number:AO-2008-070-SI-11
Who it affects: All aircraft passengers
Status:Not addressed

 

General details

Date: 07 Oct 2008 Investigation status: Completed 
Time: 1242 WST Investigation type: Occurrence Investigation 
Location:154 km west of Learmonth Occurrence type:Control - Other 
State: WA Occurrence class: Operational 
Release date: 19 Dec 2011 Occurrence category: Accident 
Report status: Final Highest injury level: Serious 
 

Aircraft details

Aircraft manufacturer: Airbus Industrie 
Aircraft model: A330 
Aircraft registration: VH-QPA 
Serial number: 553 
Type of operation: Air Transport High Capacity 
Damage to aircraft: Minor 
Departure point:Singapore
Departure time:0932 WST
Destination:Perth WA

Crew details

RoleClass of licenceHours on typeHours total
Pilot-in-CommandATPL2,45313,592
Co-Pilot/1st OfficerATPL1,87011,650
Second OfficerCommercial4802,070
 
 
Share this page Provide feedback on this investigation
Last update 25 March 2014