In-flight upset - Airbus A330-303, VH-QPA, 154 km west of Learmonth, WA, 7 October 2008

On 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. While the aircraft was in cruise at 37,000 ft, one of the aircraft's three air data inertial reference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Two minutes later, in response to spikes in angle of attack (AOA) data, the aircraft's flight control primary computers (FCPCs) commanded the aircraft to pitch down. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment.

Although the FCPC algorithm for processing AOA data was generally very effective, it could not manage a scenario where there were multiple spikes in AOA from one ADIRU that were 1.2 seconds apart. The occurrence was the only known example where this design limitation led to a pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraft manufacturer subsequently redesigned the AOA algorithm to prevent the same type of accident from occurring again.

Each of the intermittent data spikes was probably generated when the LTN-101 ADIRU's central processor unit (CPU) module combined the data value from one parameter with the label for another parameter. The failure mode was probably initiated by a single, rare type of internal or external trigger event combined with a marginal susceptibility to that type of event within a hardware component. There were only three known occasions of the failure mode in over 128 million hours of unit operation. At the aircraft manufacturer's request, the ADIRU manufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmission failures.

At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. The injury rate and injury severity was substantially greater for those who were not seated or seated without their seat belts fastened.

The investigation identified several lessons or reminders for the manufacturers of complex, safety‑critical systems.

Basic animation using data from the Digital Flight Data Recorder

Your browser does not support the video tag.

Preliminary report released 14 November 2008

At 0932 local time (0132 UTC) on 7 October 2008, an Airbus
A330-303 aircraft, registered VH-QPA, departed Singapore on a
scheduled passenger transport service to Perth, Australia. On board
the aircraft (operating as flight number QF72) were 303 passengers,
nine cabin crew and three flight crew. At 1240:28, while the
aircraft was cruising at 37,000 ft, the autopilot disconnected.
That was accompanied by various aircraft system failure
indications. At 1242:27, while the crew was evaluating the
situation, the aircraft abruptly pitched nose-down. The aircraft
reached a maximum pitch angle of about 8.4 degrees nose-down, and
descended 650 ft during the event. After returning the aircraft to
37,000 ft, the crew commenced actions to deal with multiple failure
messages. At 1245:08, the aircraft commenced a second uncommanded
pitch-down event. The aircraft reached a maximum pitch angle of
about 3.5 degrees nose-down, and descended about 400 ft during this
second event.

At 1249, the crew made a PAN emergency broadcast to air traffic
control, and requested a clearance to divert to and track direct to
Learmonth. At 1254, after receiving advice from the cabin crew of
several serious injuries, the crew declared a MAYDAY. The aircraft
subsequently landed at Learmonth at 1350.

Currently available information indicates that one flight
attendant and at least 13 passengers were seriously injured and
many others experienced less serious injuries. Most of the injuries
involved passengers who were seated without their seatbelts
fastened. This constituted an accident under the ICAO definition
outlined in Annex 13 to the Chicago Convention and as defined in
the Transport Safety Investigation Act 2003.

Examination of flight data recorder information indicates that,
at the time the autopilot disconnected, there was a fault with the
inertial reference (IR) part of the air data inertial reference
unit (ADIRU) number 1. From that time, there were many spikes in
the recorded parameters from the air data reference (ADR) and IR
parts of ADIRU 1. Two of the angle-of-attack spikes appear to have
been associated with the uncommanded pitch-down movements of the
aircraft.

Interim Factual report No. 2 released 18 November 2009

This report provides an update to the first Interim Factual Report on this occurrence that was released on 6 March 2009.

The interim report should be read in conjunction with the first interim report. The contents of this second interim report focus on summarising new activities conducted since the previous report, providing information on relevant topics not released in the previous report, and updating information on relevant topics where there have been significant changes. Further details of new and ongoing activities will be provided in the Australian Transport Safety Bureau's (ATSB) final report.

The information contained in this interim factual report is derived from the ongoing investigation of the occurrence. Readers are cautioned that there is the possibility that new evidence may become available during the remainder of the investigation that alters the circumstances as depicted in this report.

The investigation is continuing.

Interim Factual report No.1 released 6 March 2009

At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. From about the same time there were various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down, and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down, and descended about 400 ft during this second event.

At 1249, the crew made a PAN urgency broadcast to air traffic control, and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.

One flight attendant and 11 passengers were seriously injured and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened or were standing. As there were serious injuries, the occurrence constituted an accident.

The investigation to date has identified two significant safety factors related to the pitch-down movements. Firstly, immediately prior to the autopilot disconnect, one of the air data inertial reference units (ADIRUs) started providing erroneous data (spikes) on many parameters to other aircraft systems. The other two ADIRUs continued to function correctly. Secondly, some of the spikes in angle of attack data were not filtered by the flight control computers, and the computers subsequently commanded the pitch-down movements.

Two other occurrences have been identified involving similar anomalous ADIRU behaviour, but in neither case was there an in-flight upset.