Progress updated: 7 August 2018
Since commencing this investigation, the ATSB has identified that it was considerably more complex than originally envisaged. This has expanded the scope and depth of the investigation, which in turn has influenced the time taken to complete the investigation. The investigation is ongoing; however, in the interim, the following update on the incident and the anticipated completion of the investigation report is provided.
Sequence of events
On the morning of 12 September 2015, a Virgin Australia Regional Airlines Airbus A320-321 aircraft, registered VH-FNP, was being operated on a charter flight from Perth Airport, Western Australia (WA) to Boolgeeda Airport, WA On board were the two flight crew, seven cabin crew and 139 passengers.
At 0650 Western Standard Time, the aircraft took off from runway 21 to the south before making a right turn to the west (Figure 1). About 4 minutes later, as the aircraft was climbing through 8,000 ft, the autothrust system disconnected. Ten seconds later, the autopilot disconnected and the master warning activated, bringing alerts on the electronic centralised aircraft monitoring (ECAM) system to the attention of the flight crew. The ECAM alerts confirmed that the autopilot had disconnected, and informed the flight crew that the engines had identified a fault and degraded thrust control from EPR mode to N1 mode.
Noting the information provided on the ECAM, the captain took over manual control of the aircraft, continued the climb, and turned the aircraft to the north so they were clear of some showers that were in the area. Several attempts were made to re-engage the autopilot, but without success. Given the likelihood of a return to Perth, the captain decided to climb to a reduced altitude of flight level (FL) 200, rather than the planned FL 350, while they carried out some troubleshooting.
After levelling off at FL 200, and about 8 minutes after the autopilot had disconnected, the flight crew completed the actions required for the engine faults and cleared the corresponding alerts from the ECAM. This resulted in the ECAM presenting a NAV ADR DISAGREE alert to the flight crew. This alert was generated at the same time as the engine alerts, but due to the limited space on the ECAM, was likely off the bottom of the display. This alert indicated to the flight crew that the aircraft systems had detected a disagreement between the air data reference (ADR) systems. This could be a disagreement either between the computed airspeeds or between the angle of attack sensors.
The NAV ADR DISAGREE procedure, presented on the ECAM, required the flight crew to compare the airspeeds on all three (captain’s, first officer’s and standby) airspeed indicators to determine if there was an airspeed discrepancy. The flight crew checked the airspeeds and found that all three were displaying 250 kt. Thus, in accordance with the NAV ADR DISAGREE procedure, the flight crew determined that the disagreement was between the angle of attack sensors. Information associated with that procedure indicated that in this case, there was a risk of ‘undue’ stall warning.
After clearing the NAV ADR DISAGREE alert on the ECAM, the flight crew were presented with further alerts informing them that the flight control system had reverted to alternate law, and others relating to the rudder travel limiter system. Over a period of about 20 minutes, the flight crew actioned the procedures associated with these alerts, while referring to additional information in the aircraft documentation to assist them in managing the situation. After completing the actions associated with the rudder travel limiter system, the flight crew were able to re-engage the autopilot.
At 0723, the flight crew turned the aircraft around for a return to Perth, which was now about 245 km to the south of them. While travelling south, the flight crew prepared for the landing.
While on descent into Perth, the flight crew noticed that the captain’s airspeed was decreasing and was not consistent with the other airspeed indicators. The captain changed his air data source to the back-up system, and it returned to a speed consistent with the first officer’s airspeed indicator. About 2 minutes later, the autopilot disconnected and rudder travel limiter system faults were again presented on the ECAM. The flight crew continued the descent under manual control.
During the descent, the captain decided that he required a little more time to prepare the aircraft for the landing, so was cleared by aircraft traffic control (ATC) to make an orbit to the west of the inbound track. During the orbit, the captain contacted ATC and declared a PAN, informing ATC that they had ‘flight control issues’ and were manually flying the aircraft in alternate law. The captain accepted the assistance of emergency services as a precaution, when offered by ATC.
On completion of the orbit, while extending the flaps and turning to capture the instrument landing system, the aircraft generated a stall warning that lasted for about 6 seconds. The approach was continued and the aircraft landed on runway 21 without further incident.
Source: Background - Google earth; flightpath and annotations - ATSB
During a post-flight maintenance inspection, water was found in all three pitot systems. One of the two drain ports in two of the pitot probes and both drains of one probe were found blocked. A foreign object was also ejected from the standby pitot probe when being cleaned. The object was not captured by the maintenance crew, so could not be identified. No issues with the angle of attack sensor system were identified.
As part of the investigation, the ATSB has interviewed the flight crew, analysed information recorded on the flight data recorder and cockpit voice recorder, reviewed and analysed system information, and liaised with the aircraft manufacturer. This has resulted in the ATSB obtaining a detailed understanding of the sequence of events.
The ATSB has identified that the interactions between the sources of the system faults, and the presentation of the alerts and their associated procedures was much more complex than was initially apparent. The ATSB has been investigating how these interactions affected the flight crew’s interpretation of the state of the aircraft and how they then managed the situation.
As a result of the detailed understanding obtained during the investigation, the ATSB is considering the potential broader safety implications of how the flight crew’s understanding of the situation they encountered was influenced by how the aircraft’s alerting system prioritised and, presented those alerts and their associated procedures.
The ATSB recognises the extended timeframe of this investigation. Together with other internal resourcing factors and safety priorities, it has taken significantly longer to complete the investigation to a level commensurate with the complexity and importance of the safety factors identified.
The investigation is nearing completion and is at a stage where the final report is being drafted. Once the draft of the report has been completed, it will be subject to internal review before the directly involved parties (DIPs) will be offered the opportunity to review the factual accuracy of report. In accordance with international protocols, the DIPs will have 60 days in which to prepare a response to the ATSB and provide evidence of any possible factual inaccuracies.
The final report will be released following the review of any DIP submissions.
The ATSB will bring any safety issues, identified during the course of the investigation, to the attention of those affected and seek safety action to address the issue.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this update. As such, no analysis or findings are included in this update.
- Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
- The ECAM provides information to the crew on the status of the aircraft and its systems. It also presents the required steps of applicable procedures when an abnormal condition has been detected by the monitoring system.
- The engine has two basic modes of thrust control: EPR (engine pressure ratio – ratio of the turbine discharge pressure divided by the compressor inlet pressure) or N1 (the rotational speed of the low-pressure compressor in a turbine engine). The normal thrust control mode is EPR mode, but if the engine control system is unable to determine the engine pressure ratio (the ratio of the air pressure at the inlet end exhaust) it will change to N1 mode.
- Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 200 equates to 20,000 ft
- The ECAM alert message area can present a maximum of seven lines of text. If there are multiple alerts, or if the associated procedure requires more lines than available, they are not displayed until cleared. To alert the crew to the presence of more information, the ECAM presents a green arrow adjacent to the list. The ECAM presents messages in the order of the priority assigned to them by the manufacturer.
- The ADR system measures and supplies information about the airflow to the aircraft’s systems. This includes the static (ambient) air pressure, total air pressure (a combination of the static air pressure and the pressure increase resulting from the speed of the aircraft), total air temperature, and angle of attack. This information is used to determine, among other things, the aircraft’s airspeed and altitude. There are three independent ADR systems in the Airbus A320, one for the captain, one for the first office, and a standby system.
- The Airbus A320 has a digital ‘fly-by-wire’ control system, which has three modes of operation: normal law, alternate law and direct law. The system usually operates in normal law, which includes a raft of flight envelope protections. Alternate law is a back-up flight control mode that is used when there are insufficient inputs for the system to operate properly in normal law. The system operation is effectively the same as normal law, but has a reduced level of flight envelope protection. Direct law is a further degradation in the flight control system, with further reduction in the level of protection.
- An internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants, but where the flight crew does not require immediate assistance.
- Instrument landing system (ILS): a precision runway approach aid, which provides pilots with both vertical and horizontal guidance during an approach to land.
- An aerodynamic stall occurs when airflow separates from the wing’s upper surface and results in significantly reduced lift. The wing will stall when the angle of attack (the relative angle between the wing chord and the airflow) reaches a critical angle. When the A320 is in normal law, the flight control system will automatically prevent the aircraft from stalling. In alternate and direct law, the A320 will generate a stall warning before the critical stall angle is reached, allowing the flight crew to take actions to prevent a stall.
- The part of the air data reference system used to measure the total (also referred to as pitot) air pressure.