On 25 December 2008, at about 0845 Eastern Daylight-saving Time, a Cessna Aircraft Company 172M aircraft, registered VH-ROO, struck a powerline that was located on a property at Kernot, 25 km north-west of Leongatha Aerodrome, Vic.
The aircraft impacted the ground about 100 m from the powerline and caught fire. The pilot, who was the sole occupant, was fatally injured.
Examination of the wreckage did not identify any mechanical defects that would have affected the safe operation of the aircraft.
At about 1145 Eastern Daylight-saving Time, the pilot of a PZL-M18A Dromader aircraft, registered VH-IGT, took off from a road on a property 58 km south-west of Nyngan, NSW. About 10 minutes later, the outboard section of the right wing separated from the aircraft and the aircraft impacted the ground. The pilot, who was the sole occupant, was fatally injured.
Summary
On 29 December 2008, at about 1145 Eastern Daylight-saving Time, a PZL-M18A Dromader (TPE331) aircraft, registered VH-IGT, took off from a road on a property 58 km south-west of Nyngan, New South Wales to conduct agricultural spraying operations. About 10 minutes later, the aircraft was seen flying back towards the road when a witness saw something fall off the aircraft and reported that the aircraft then rolled and impacted the ground. The pilot, who was the sole occupant, was fatally injured.
The investigation found that the outboard 1.8 m of the right wing separated from the aircraft resulting in a loss of control and subsequent impact with the terrain. The separation of the right-wing section could not be conclusively attributed to any particular factor.
During the course of the investigation, it was determined that a number of operators of the aircraft type were not applying the appropriate service life factors to determine the effective hours flown when their aircraft were operated at take-off weights above 4,700 kg. The effect was to overestimate the remaining service life of those aircraft.
It was also found that operators had an interpretation of the Civil Aviation Safety Authority (CASA) exemptions that, by their understanding, permitted operation at weights in excess of the maximum take-off weight and allowed them to operate at higher take-off weights without the need to account for the additional limitation imposed by the manufacturer for operation at those weights.
As a result of the accident, the following safety action has been taken or proposed:
The operator undertook a retrospective process of applying the service life factors to its aircraft fleet during operations that had involved take-off weights above 4,700 kg and will apply them to all relevant future flights.
CASA advised that they had contacted Certificate of Registration holders of M18 Dromader aircraft to verify that they had a procedure for recording and factoring aircraft hours that included overweight operations. Further verification would also occur as part of CASA's routine surveillance program. CASA also advised that they will provide education to operators on the intention of the exemptions and will be revising the exemptions to ensure that the intended interpretation is clear.
On 18 December 2008, a Cessna 152 aircraft and a Liberty XL2 aircraft collided in midair over Casula, NSW, in the proximity of the 2RN reporting point, south-west of Bankstown Airport. The Liberty remained flyable and landed at Bankstown approximately 6 minutes later, while the Cessna descended to the ground and was destroyed. Both occupants of the Cessna were fatally injured.
Final report
Abstract
On 18 December 2008, a Liberty XL-2 aircraft, registered VH-XLY, collided in midair with a Cessna 152 aircraft, registered VH-FMG, near Casula, New South Wales (NSW). The Liberty was engaged in a pilot licence flight test; the Cessna was engaged in pilot training. The pilots of both aircraft were operating in uncontrolled airspace under the visual flight rules, in good weather. The collision severely damaged the Cessna, which descended in an uncontrolled manner before impacting terrain, fatally injuring the two occupants. The Liberty was able to continue flying and landed at Bankstown Airport, NSW.
The two pilots in the Liberty had previously sighted the Cessna while they were tracking towards an inbound reporting point. They subsequently lost sight of the aircraft prior to the collision. The investigation found that the limitations imposed by the visual size of the Cessna and its lack of relative motion in relation to the Liberty, the focussed workload of the student under test at the time, and obstructions posed by the aircraft's structure were likely factors in them being unable to re-sight the Cessna before the collision.
The investigation did not identify any organisational or systemic issues that might adversely affect the future safety of aviation operations. However, the factors involved are a salient reminder to all pilots that there are limitations with visual flight procedures and that, regardless of pilot's experience, they need to remain vigilant at all times. That is particularly the case when in the vicinity of other aircraft.
As a result of a number of midair collisions in Australia, the Civil Aviation Safety Authority (CASA) conducted two reviews into operations at General Aviation Aerodrome Procedure (GAAP) aerodromes. Although this accident occurred in Class G airspace (uncontrolled airspace), due to its proximity to an inbound GAAP reporting point, CASA referred to it in those reviews. Those reviews made a number of recommendations to enhance the provision of GAAP procedures education and training and on the current implementation of GAAP. On 3 June 2010, CASA introduced full Class D airspace at all aerodromes that previously operated under GAAP in Australia.
Response to Coroner’s findings
The ATSB notes that on 2 May 2013 the Deputy State Coroner, Magistrate P. A. McMahon, handed down his findings in the inquest into the deaths of the two occupants of a Cessna 152 aircraft, registered VH-FMG, following a midair collision with a Liberty XL2 aircraft, registered VH-XLY.
The Coroner’s findings were substantially in accordance with those of the ATSB. The Coroner did not make any recommendations arising out of his findings.
The factors identified in the report and the Coroner’s findings highlight the limitations with visual flight procedures and the need for vigilance at all times, particularly in the vicinity of other aircraft and in potentially high traffic areas.
Cooperation with Coroners
Australian Transport Safety Bureau (ATSB) investigations are conducted with the objective of providing findings that can be used to improve transport safety in the future. Coronial Inquests are a separate process to the ATSB investigation and they are usually supported by their own investigation and brief of evidence. However, as Inquests also have the objective of seeking to prevent a death occurring again, the ATSB provides cooperation through the explanation of the ATSB's findings in its report.
The ATSB appreciates the interest of Coroners in working with the ATSB in the interests of improving safety. The Coroner formulated his findings and recommendations independently of the ATSB. However, the ATSB supports the coronial process and in the interests of ensuring that safety information is made available to the broadest audience the ATSB is making this publication.
On 17 December 2008, a Boeing Company 737-4MO aircraft, registered PK-GZJ, made a significant diversion around weather at night while en route to Darwin, Northern Territory from Denpasar, Indonesia. The aircraft was cleared to conduct the runway 11 very high frequency omnidirectional radio range (VOR) approach via the initial approach fix NASUX. After the weather diversion, it was more convenient for the flight crew to make a pilot intercept of the 285 radial from the VOR but there was a period of misunderstanding as a result of a breakdown in the application of standard radiotelephony readbacks.
The flight crew left the previously-cleared altitude of 3,000 ft on descent although they had not been cleared to do so. When this became apparent, no updated clearance for a pilot intercept of the 285 radial was issued by the controller. The aircraft continued to descend on the basis of the runway 11 VOR descent profile, even though it was not conducting the runway 11 VOR approach.
The flight crew used the position calculated by the aircraft's inertial reference system (IRS) to intercept the 285 radial, instead of using the signal from the VOR. The IRS position was not accurate enough for this, and the aircraft tracked to outside of the stipulated 5 degrees tolerance either side of the 285 radial. From then on, the aircraft was no longer 'established' on the 285 radial even though it was below the minimum sector altitude in cloud. When it broke through the cloud, the aircraft was clearly not aligned with the runway and a missed approach was carried out.
The investigation did not identify any organisational or systemic issues that might adversely affect the future safety of aviation operations. However, in response to the occurrence, the aircraft operator developed a corrective action plan that addressed a number of crew resource management and non-precision approach training aspects to the event.
On 3 November 2008, a SAAB Aircraft Company 340B-229 (SAAB), registered VH-ORX, was conducting a regular public transport flight from Orange, NSW to Sydney. The crew reported that, at about 0724 Eastern Daylight-saving Time, when tracking to join a 7 NM (13 km) final for runway 34 Right (34R), a passenger sustained minor injuries following a possible wake turbulence event that resulted in a momentary loss of control of the aircraft.
Examination of the available radar, meteorological and aircraft operational data identified that the momentary upset probably resulted from wake turbulence, which was generated by an Airbus Industrie A380-800 (A380) that was conducting a parallel approach to runway 34 Left (34L). There was a 35 kt left crosswind affecting both aircraft's approaches.
Airservices Australia (Airservices) reported to the SAAB operator that, as a result of this incident, they had introduced a number of interim minor changes to Sydney parallel runway operational procedures during high crosswind conditions. Those minor changes would have effect while Airservices carried out a review of A380 operations. In addition, the Civil Aviation Safety Authority has opened a regulatory change project to review and update wake turbulence separation information in the Manual of Standards Part 172.
At about 2026 Eastern Daylight-saving Time on 7 November 2008, a Piper Aircraft Corp PA-31-350 Chieftain, registered VH-OPC, collided with terrain. The aircraft was seriously damaged, and the four occupants were fatally injured.
Summary
On 7 November 2008, a Piper Aircraft Corp. PA-31-350 Chieftain, registered VH-OPC, was being operated on a private flight under the instrument flight rules from Moorabbin Airport, Vic. to Port Macquarie via Bathurst, NSW. On board the aircraft were the owner-pilot and three passengers.
The flight from Moorabbin to Bathurst was conducted in accordance with the pilot's flight plan and a review of recorded air traffic control data and communications did not reveal any problems during that flight. After refuelling at Bathurst Airport, the pilot departed from runway 35 for Port Macquarie in dark-night conditions with light rain in the area. At about 2024, some 2½ minutes after reporting airborne, residents of Forest Grove to the north of Bathurst Airport, heard a sudden loud noise from an aircraft at low altitude. Shortly after, there was the sound of an explosion and the glow of a fire. The aircraft was found to have impacted terrain resulting in serious damage to the aircraft. The four occupants were fatally injured.
The aircraft had impacted the ground upright, slightly right wing low, at a descent angle greater than 20°. The wreckage trail, oriented on a ground track of 165° M, extended for about 300 m. Almost all of the major aircraft parts were seriously impact and fire damaged. The propellers indicated high rotational energy. The landing gear and wing flaps were retracted.
Due to fire and impact damage, and limited information about the sequence of events after take-off, the evidence available to the investigation was limited. There were no indicators of aircraft malfunction or pilot impairment prior to the accident. After extensive examination, the investigation found there was no evidence of any aircraft unserviceability, and that airworthiness was not likely to have been a contributing factor in the accident. The investigation was unable to establish why the aircraft collided with terrain; however, pilot spatial disorientation or pilot incapacitation could not be discounted.
The ATSB has completed its technical analysis report of the flight recorder data from the Boeing Co. 737-2H6, registration PK-CJG on behalf of the Indonesian National Transportation Safety Committee. The aircraft was operating a flight from Jakarta to Jambi, Indonesia on 27 August 2008 when it overran runway 31 at Jambi airport. The aircraft impacted an occupied house near the end of the runway and came to rest in a field. A number of people on the ground were seriously injured and some aircraft occupants were injured during the subsequent evacuation. The aircraft was substantially damaged.
The National Transportation Safety Committee (NTSC) of Indonesia is responsible for investigating this occurrence. The NTSC requested assistance from the Australian Transport Safety Bureau (ATSB) in the recovery and analysis of information from the flight data recorder and cockpit voice recorder. In accordance with clause 5.23 of Annex 13 to the Convention on International Civil Aviation, the ATSB appointed an Accredited Representative to assist the NTSC and initiated an investigation under the Transport Safety Investigation Act 2003.
The ATSB''s Technical Analysis Report has been sent to the NTSC to assist its ongoing investigation. The NTSC is responsible for releasing a final investigation report regarding this occurrence.
National Transportation Safety Committee Ministry Of Transportation Republic Of Indonesia Transportation Building 3rd Floor Jalan Medan Merdeka Timur No. 5 Jakarta Pusat 10110 Indonesia
On 23 October 2008 at 2357 Eastern Standard Time, a British Aerospace BAe 146-300 aircraft, registered VH-NJM, operating a freighter flight, had a tail strike on landing at Brisbane Airport, Qld.
The aircraft and crew had commenced duty earlier that evening at Adelaide, SA and had flown via Sydney, NSW to Brisbane. The aircraft and crew then did the reverse sectors back to Adelaide. It was only after landing at Adelaide that the crew became aware of the tail strike.
Damage to the aircraft consisted of abrasion to the tail strike indicator through to the fuselage skin and abrasion to the fuselage skin. There was also damage to the aircraft's structural frame under the tail strike indicator.
The aircraft manufacturer had identified an increase in the number of BAe 146-300 tail strikes and has recommended a number of procedural changes for flight crew. The aircraft operator has implemented those changes and issued notices to flight crew highlighting the risks and conditions for tail strike.
On 16 October 2008, at about 0615 Eastern Standard Time, the pilot of a Fairchild Industries SA227, registered VH-UZA, took off from runway 32 at Mackay Airport, Qld. At the same time, the flight crew of another Fairchild Industries SA227, registered VH-EEO, was conducting a backtrack on the active runway 32.
The crews of both aircraft took avoiding action.
There were a number of opportunities for the departing pilot to have confirmed that his aircraft radio was operating correctly, and to have verified the actual position of the backtracking aircraft. Had the departing pilot availed himself of those opportunities, he would have been afforded an increased level of assurance that the runway was clear.
Confirmation that runway 32 was clear prior to commencing the departure was attempted, but not obtained, by the departing pilot.
On 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. While the aircraft was in cruise at 37,000 ft, one of the aircraft's three air data inertial reference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Two minutes later, in response to spikes in angle of attack (AOA) data, the aircraft's flight control primary computers (FCPCs) commanded the aircraft to pitch down. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment.
Basic animation using data from the Digital Flight Data Recorder
Although the FCPC algorithm for processing AOA data was generally very effective, it could not manage a scenario where there were multiple spikes in AOA from one ADIRU that were 1.2 seconds apart. The occurrence was the only known example where this design limitation led to a pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraft manufacturer subsequently redesigned the AOA algorithm to prevent the same type of accident from occurring again.
Each of the intermittent data spikes was probably generated when the LTN-101 ADIRU's central processor unit (CPU) module combined the data value from one parameter with the label for another parameter. The failure mode was probably initiated by a single, rare type of internal or external trigger event combined with a marginal susceptibility to that type of event within a hardware component. There were only three known occasions of the failure mode in over 128 million hours of unit operation. At the aircraft manufacturer's request, the ADIRU manufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmission failures.
At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. The injury rate and injury severity was substantially greater for those who were not seated or seated without their seat belts fastened.
The investigation identified several lessons or reminders for the manufacturers of complex, safety‑critical systems.
Executive Summary
Key investigation outcomes
The in-flight upset on 7 October 2008 occurred due to the combination of a design limitation in the flight control primary computer (FCPC) software of the Airbus A330/A340, and a failure mode affecting one of the aircraft’s three air data inertial reference units (ADIRUs). The design limitation meant that, in a very rare and specific situation, multiple spikes in angle of attack (AOA) data from one of the ADIRUs could result in the FCPCs commanding the aircraft to pitch down.
When the aircraft manufacturer became aware of the problem, it issued flight crew procedures to manage any future occurrence of the same ADIRU failure mode. The aircraft manufacturer subsequently reviewed and improved its FCPC algorithms for processing AOA and other ADIRU parameters. As a result of this redesign, passengers, crew and operators can be confident that the same type of accident will not reoccur.
The investigation identified several lessons or reminders for the manufacturers of complex, safety-critical systems. With the knowledge that systems are becoming increasingly complex, it also identified a need for more research into how design engineers and safety analysts evaluate system designs, and how their tasks, tools, training and guidance materials could be improved to minimise design errors.
Although in-flight upsets are very rare events, the accident on 7 October 2008 also provided a salient reminder to all passengers and crew of the importance of wearing their seat belts during a flight whenever they are seated.
Summary of the occurrence
At 0132 Universal Time Coordinated (0932 local time) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. At 0440:26, while the aircraft was in cruise at 37,000 ft, ADIRU 1 started providing intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Soon after, the autopilot disconnected and the crew started receiving numerous warning and caution messages (most of them spurious). The other two ADIRUs performed normally during the flight.
At 0442:27, the aircraft suddenly pitched nose down. The FCPCs commanded the pitch-down in response to AOA data spikes from ADIRU 1. Although the pitch-down command lasted less than 2 seconds, the resulting forces were sufficient for almost all the unrestrained occupants to be thrown to the aircraft’s ceiling. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment. The FCPCs commanded a second, less severe pitch-down at 0445:08.
The flight crew’s responses to the emergency were timely and appropriate. Due to the serious injuries and their assessment that there was potential for further pitch-downs, the crew diverted the flight to Learmonth, Western Australia and declared a MAYDAY to air traffic control. The aircraft landed as soon as operationally practicable at 0532, and medical assistance was provided to the injured occupants soon after.
FCPC design limitation
AOA is a critically important flight parameter, and full-authority flight control systems such as those equipping A330/A340 aircraft require accurate AOA data to function properly. The aircraft was fitted with three ADIRUs to provide redundancy and enable fault tolerance, and the FCPCs used the three independent AOA values to check their consistency. In the usual case, when all three AOA values were valid and consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs for their computations. If either AOA 1 or AOA 2 significantly deviated from the other two values, the FCPCs used a memorised value for 1.2 seconds. The FCPC algorithm was very effective, but it could not correctly manage a scenario where there were multiple spikes in either AOA 1 or AOA 2 that were 1.2 seconds apart.
Although there were many injuries on the 7 October 2008 flight, it is very unlikely that the FCPC design limitation could have been associated with a more adverse outcome. Accordingly, the occurrence fitted the classification of a ‘hazardous’ effect rather than a ‘catastrophic’ effect as described by the relevant certification requirements. As the occurrence was the only known case of the design limitation affecting an aircraft’s flightpath in over 28 million flight hours on A330/A340 aircraft, the limitation was within the acceptable probability range defined in the certification requirements for a hazardous effect.
As with other safety-critical systems, the development of the A330/A340 flight control system during 1991 and 1992 had many elements to minimise the risk of a design error. These included peer reviews, a system safety assessment (SSA), and testing and simulations to verify and validate the system requirements. None of these activities identified the design limitation in the FCPC’s AOA algorithm.
The ADIRU failure mode had not been previously encountered, or identified by the ADIRU manufacturer in its safety analysis activities. Overall, the design, verification and validation processes used by the aircraft manufacturer did not fully consider the potential effects of frequent spikes in data from an ADIRU.
ADIRU data-spike failure mode
The data-spike failure mode on the LTN-101 model ADIRU involved intermittent spikes (incorrect values) on air data parameters such as airspeed and AOA being sent to other systems as valid data without a relevant fault message being displayed to the crew. The inertial reference parameters (such as pitch attitude) contained more systematic errors as well as data spikes, and the ADIRU generated a fault message and flagged the output data as invalid. Once the failure mode started, the ADIRU’s abnormal behaviour continued until the unit was shut down. After its power was cycled (turned OFF and ON), the unit performed normally.
There were three known occurrences of the data-spike failure mode. In addition to the 7 October 2008 occurrence, there was an occurrence on 12 September 2006 involving the same ADIRU (serial number 4167) and the same aircraft. The other occurrence on 27 December 2008 involved another of the same operator’s A330 aircraft (VH-QPG) but a different ADIRU (serial number 4122). However, no factors related to the operator’s aircraft configuration, operating practices or maintenance practices were found to be associated with the failure mode.
Many of the data spikes were generated when the ADIRU’s central processor unit (CPU) module intermittently combined the data value from one parameter with the label for another parameter. The exact mechanism that produced this problem could not be determined. However, the failure mode was probably initiated by a single, rare type of trigger event combined with a marginal susceptibility to that type of event within the CPU module’s hardware. The key components of the two affected units were very similar, and overall it was considered likely that only a small number of units exhibited a similar susceptibility.
Some of the potential triggering events examined by the investigation included a software ‘bug’, software corruption, a hardware fault, physical environment factors (such as temperature or vibration), and electromagnetic interference (EMI) from other aircraft systems, other on-board sources, or external sources (such as a naval communication station located near Learmonth). Each of these possibilities was found to be unlikely based on multiple sources of evidence. The other potential triggering event was a single event effect (SEE) resulting from a high-energy atmospheric particle striking one of the integrated circuits within the CPU module. There was insufficient evidence available to determine if an SEE was involved, but the investigation identified SEE as an ongoing risk for airborne equipment.
The LTN-101 had built-in test equipment (BITE) to detect almost all potential problems that could occur with the ADIRU, including potential failure modes identified by the aircraft manufacturer. However, none of the BITE tests were designed to detect the type of problem that occurred with the air data parameters.
The failure mode has only been observed three times in over 128 million hours of unit operation, and the unit met the aircraft manufacturer’s specifications for reliability and undetected failure rates. Without knowing the exact failure mechanism, there was limited potential for the ADIRU manufacturer to redesign units to prevent the failure mode. However, it will develop a modification to the BITE to improve the probability of detecting the failure mode if it occurs on another unit.
Use of seat belts
At least 60 of the aircraft’s passengers were seated without their seat belts fastened at the time of the first pitch-down. Consistent with previous in-flight upset accidents, the injury rate, and injury severity, was substantially greater for those who were not seated or seated without their seat belts fastened.
Passengers are routinely reminded every flight to keep their seat belts fastened during flight whenever they are seated, but it appears some passengers routinely do not follow this advice. This investigation provided some insights into the types of passengers who may be more likely not to wear seat belts, but it also identified that there has been very little research conducted into this topic by the aviation industry.
Investigation process
The Australian Transport Safety Bureau investigation covered a range of complex issues, including some that had rarely been considered in depth by previous aviation investigations. To do this, the investigation required the expertise and cooperation of several external organisations, including the French Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile, US National Transportation Safety Board, the aircraft and FCPC manufacturer (Airbus), the ADIRU manufacturer (Northrop Grumman Corporation), and the operator.
Passenger safety
A key safety message for passengers in the AO-2008-070 final report is the importance of wearing seat belts when seated in flight, even when the seat-belt sign is not illuminated. As stated in the report:
At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. Consistent with previous in-flight upset accidents, the injury rate, and injury severity, was substantially greater for those who were not seated or seated without their seat belts fastened.
Further information on the wearing of seat belts and other advice for minimising injury risk during turbulence and other in-flight upsets is also available in the ATSB Aviation Safety Bulletin Staying safe against turbulence.
Public safety advice about the importance of wearing seat belts on aircraft has also been provided by the Australian Civil Aviation Safety Authority.
A video showing the effects of not wearing seat belts during a simulated in-flight upset is available on the US Federal Aviation Administration website. The video simulates a turbulence event, whereas the in-flight upset on 7 October 2008 near Learmonth, Western Australia was due to pitch-down commands from the aircraft's flight control system.
Regardless of why an upset occurs, the message is the same: Wearing a seat belt during all phases of a flight, and having the seat belt fastened low and firm, will significantly minimise the risk of injury in the unlikely event of an in-flight upset.
Second interim report
Report release date: 18/11/2009
This report provides an update to the first Interim Factual Report on this occurrence that was released on 6 March 2009.
The interim report should be read in conjunction with the first interim report. The contents of this second interim report focus on summarising new activities conducted since the previous report, providing information on relevant topics not released in the previous report, and updating information on relevant topics where there have been significant changes. Further details of new and ongoing activities will be provided in the Australian Transport Safety Bureau's (ATSB) final report.
The information contained in this interim factual report is derived from the ongoing investigation of the occurrence. Readers are cautioned that there is the possibility that new evidence may become available during the remainder of the investigation that alters the circumstances as depicted in this report.
The investigation is continuing.
First interim report
Report release date: 06/03/2009
At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. From about the same time there were various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down and descended about 400 ft during this second event.
At 1249, the crew made a PAN urgency broadcast to air traffic control and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.
One flight attendant and 11 passengers were seriously injured, and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened or were standing. As there were serious injuries, the occurrence constituted an accident.
The investigation to date has identified two significant safety factors related to the pitch-down movements. Firstly, immediately prior to the autopilot disconnect, one of the air data inertial reference units (ADIRUs) started providing erroneous data (spikes) on many parameters to other aircraft systems. The other two ADIRUs continued to function correctly. Secondly, some of the spikes in angle of attack data were not filtered by the flight control computers, and the computers subsequently commanded the pitch-down movements.
Two other occurrences have been identified involving similar anomalous ADIRU behaviour, but in neither case was there an in-flight upset.
Preliminary report
Report release date: 14/11/2008
At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. That was accompanied by various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down and descended about 400 ft during this second event.
At 1249, the crew made a PAN emergency broadcast to air traffic control and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin crew of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.
Currently available information indicates that one flight attendant and at least 13 passengers were seriously injured and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened. This constituted an accident under the ICAO definition outlined in Annex 13 to the Chicago Convention and as defined in the Transport Safety Investigation Act 2003.
Examination of flight data recorder information indicates that, at the time the autopilot disconnected, there was a fault with the inertial reference (IR) part of the air data inertial reference unit (ADIRU) number 1. From that time, there were many spikes in the recorded parameters from the air data reference (ADR) and IR parts of ADIRU 1. Two of the angle-of-attack spikes appear to have been associated with the uncommanded pitch-down movements of the aircraft.
