On 4 February 2021, VH-EBK, an Airbus A330-202 operated by Qantas Airways, departed Sydney, New South Wales, on a scheduled air transport flight to Perth, Western Australia. About 2 hours into the flight the Electronic Centralized Aircraft Monitor (ECAM) triggered a red CAB PR EXCESS CAB ALT warning alert due to the cabin altitude exceeding 9,550 ft. The alert’s procedure required the flight crew to don their oxygen masks and initiate an emergency descent.
The aircraft’s pressurisation data, however, indicated that the pressurisation system was operating normally, leading the flight crew to doubt the validity of the alert. As a result, they sought additional information, including guidance from the Flight Crew Techniques Manual (FCTM). This, and other distractions, resulted in the flight crew delaying the actioning of the required procedural response. About 7 minutes after the alert triggered, the flight crew donned their oxygen masks, and commenced a diversion to Adelaide with a precautionary descent to 10,000 ft. Shortly after the descent was initiated, the pressurisation system data indicated a sudden increase in the displayed cabin altitude, to which the flight crew responded by immediately commencing an emergency descent. The aircraft levelled at 10,000 ft and continued to Adelaide without further incident.
What the ATSB found
The aircraft was fitted with dual Cabin Pressure Controllers (CPCs) that automatically controlled the aircraft’s pressurisation—one CPC controlled pressurisation while the other operated as a backup. During the flight, a fault occurred in the pressure sensor of the CPC in control, but due to design limitations, that CPC was unable to detect the fault. The fault resulted in the loss of cabin pressure control and the aircraft to slowly depressurise. The loss of cabin pressure was detected by the standby CPC, which triggered the CAB PR EXCESS CAB ALT alert when the cabin altitude exceeded 9,550 ft. The design limitation meant that the systems display continued to present pressurisation data from the CPC in control, which directly conflicted with the alert.
An Airbus service bulletin that would have corrected the design limitations and prevented the loss of cabin pressure control from the pressure sensor fault was not incorporated on VH-EBK.
As the data presented by the faulty CPC conflicted with the alert, the flight crew responded to the red warning alert by seeking evidence to verify the failure, thereby delaying the execution of the required procedure. The delay was further compounded by uncertainty on the procedural guidance in the FCTM. The crew focussed on the need for data to support an emergency descent and did not consider the potential risk of depressurisation, delaying their use of oxygen to avoid the risk of hypoxia.
In response to the design limitations, Airbus required flight crew to action the CAB PR EXCESS CAB ALT alert irrespective of whether there was confirmatory data. However, both the operator’s and Airbus’ operating philosophies encouraged flight crew to seek confirmatory evidence of a failure before executing the required procedure. While the specific Airbus requirement for this alert was contained within a preamble to the FCOM abnormal procedure; it was not part of the ‘read and do’ procedural steps in response to the alert, and reliant on memory recall.
The mitigations introduced by Airbus to counter the design limitation associated with the A330 cabin pressure control systems were ineffective because the CAB PR EXCESS CAB ALT alert operational procedure did not ensure appropriate management of the fault, while the service bulletin had very limited uptake in the global fleet.
The investigation further identified that the operator’s training system did not adequately cover the unique requirements of the CAB PR EXCESS CAB ALT alert procedure, increasing the risk of an incorrect or delayed application of the procedure.
What has been done as a result
The operator modified its training to ensure that the unique requirements of the CAB PR EXCESS CAB ALT red warning alert procedure are properly covered in all aspects of the training program. The operator and Airbus have modified the FCTM content to properly reflect the requirements of the preamble to the CAB PR EXCESS CAB ALT alert procedure in the FCOM.
The operator’s fleet was checked for similar CPC faults. No other aircraft were identified with the same type of fault. All applicable CPCs within that fleet have been upgraded via the SB. The operator also established an enhanced CPC fault alert policy and monitoring system to manage suspected faulty CPCs.
Airbus advised that an evaluation of the mitigations used to address the design limitations associated with the cabin pressure control system in the A330 aircraft was underway as part of a product enhancement activity. However, as proposed safety action and a timeline were not provided, the ATSB issued a safety recommendation to support Airbus’ intended action.
When there is a risk of aircraft depressurisation and hypoxia, the flight crew’s priority must be to immediately commence the use of oxygen.
Checklists are an aid to the memory and help ensure that critical items necessary for the safe operation of the aircraft are not overlooked or forgotten. Therefore, all essential components of a procedure must be included within that procedure’s checklist, whether the checklist is electronic or in paper form.
Airbus A320, A330, and A340 aircraft operators are encouraged to pro-actively incorporate the Airbus service bulletins intended to prevent similar cabin depressurisations from Cabin Pressure Controller pressure sensor faults.
At 2236 Eastern Daylight-saving Time on 4 February 2021, an Airbus A330-202 registered VH‑EBK and operated by Qantas Airways, departed Sydney, New South Wales, on a scheduled air transport flight to Perth, Western Australia. There were 2 flight crew, 8 cabin crew and 61 passengers on board. The flight crew comprised the captain, who was the pilot flying (PF), and the first officer, who was the pilot monitoring (PM).
The aircraft reached its initial cruise altitude of flight level (FL) 400 at 2308. At 0053 on 5 February, shortly after passing position SUBUM, the aircraft’s Electronic Centralized Aircraft Monitor (ECAM) triggered a red warning alert identifying that the cabin altitude had exceeded 9,550 ft (see the section titled Electronic Centralized Aircraft Monitor). This alert triggered the CAB PR EXCESS CAB ALT message, and its associated abnormal procedure was displayed on the primary ECAM display. That procedure required the flight crew to immediately don oxygen masks and commence an emergency descent. The alert also caused the cabin pressure system information to be displayed to the pilots on the System Display (SD). The data presented on that display indicated that the pressurisation system was operating normally.
Delay in actioning alert
As the displayed pressurisation system data conflicted with the ECAM alert, the flight crew did not immediately commence the abnormal procedure. The captain’s uncertainty about the alert’s validity was based on observations that:
- A related pressurisation alert that normally preceded a CAB PR EXCESS CAB ALT alert had not occurred (see the section titled Pressurisation system).
- While the CAB PR EXCESS CAB ALT procedure required an immediate emergency descent, there was no other evidence of depressurisation.
The first officer, while somewhat unsure, assessed that the alert required actioning of the procedure.
Due to the conflicting information, the flight crew sought further information about the condition of the pressurisation system. However, about 1 minute after the alert had triggered, and as they were examining system indications to determine if there was a fault, the Customer Service Manager (CSM) called the flight deck to advise that the cabin lights and seatbelt signs had illuminated (see the section titled Cabin altitude alerts).
On completion of that call, and some 3 minutes after the alert had triggered, the first officer advised the captain of having recently read guidance on cabin pressurisation faults in the Flight Crew Techniques Manual. When the relevant section in that manual was reviewed, the captain found the information to be contradictory, resulting in further discussion about the intent of the guidance. During this discussion, there was also a further brief call from the CSM.
After further discussion of the ECAM alert, at 0100, the flight crew donned their oxygen masks. About 2 minutes later, they determined that the abnormal procedure would be actioned. However, they also decided that, instead of an emergency descent, a precautionary descent to 10,000 ft would be conducted and the flight diverted to Adelaide.
Melbourne air traffic control (ATC) was flight following the aircraft through the controller-pilot data link communications however, the first officer called Brisbane ATC using high frequency band radio communications to advise the technical issue. A PAN PAN was declared on that frequency. Brisbane ATC was also notified of the need to descend due to the aircraft’s pressurisation issue, and the intention to divert. During these communications, at 0105, the aircraft commenced a descent from FL 400 and turned towards Adelaide (Figure 1). Brisbane ATC acknowledged the PAN call at 0106.
Figure 1: VH-EBK track and principal events
Source: Google earth, modified by ATSB
About 2 minutes after commencing the descent, the flight crew identified that the cabin pressurisation data presented on the SD page had changed. The cabin altitude was now red (to highlight that it had exceeded 9,550 ft) and now indicating about 12,400 ft, while the other pressurisation indications were indicative of the cabin depressurising. The flight crew immediately responded by commencing an emergency descent. At 0108, the first officer transmitted a MAYDAY call, which was acknowledged by Brisbane ATC.
During the descent, the flight crew diverted the aircraft to the north of the intended direct flight path to Adelaide to avoid significant weather. Brisbane ATC and Qantas attempted to contact the aircraft on a number of occasions during the descent, however, the flight crew did not respond until after the aircraft was established at 10,000 ft.
The flight crew noted that the pressurisation system returned to normal operation during the descent and continued to operate normally for the rest of the flight. The aircraft landed at Adelaide at 0202 without further incident.
Both the captain and the first officer held Air Transport Pilot Licences (Aeroplane) with Class 1 aviation medical certificates and were appropriately qualified for the flight. They also reported being well rested and alert at the commencement of duty. No evidence indicating flight crew fatigue was identified.
The captain had accumulated about 17,100 hours of flight experience, of which about 8,000 hours were on the Airbus A330 (A330). In the previous 90 days, the captain had flown about 4 hours on A330 type aircraft. The first officer had accumulated about 15,700 hours of flight experience, of which about 4,100 hours were on the A330 with 15 hours flown in the previous 90 days.
As a result of the COVID 19 pandemic, the operator had significantly reduced its flight schedule in the 12 months preceding the occurrence. In the case of flight crews, this resulted in their rotation through a period of flying followed by an extended period of furlough. To ensure flight crews met operational standards prior to commencement of a flying cycle following furlough, the operator required them to complete a refresher program comprising simulator and training sessions. Scheduling requirements also ensured that returning flight crew were partnered with flight crew who had already completed several flights.
The captain had just completed the refresher program and the occurrence flight was the first in the new flying cycle. The first officer had completed the refresher cycle in the week preceding the occurrence and had completed 2 sectors 4 days prior to the occurrence.
The flight crew reported that the recency training provided to them by the operator had effectively prepared them for the flying cycle.
Commercial aircraft, such as the A330, typically fly at altitudes of between 30,000 and 40,000 ft. As the air pressure and temperature at these altitudes is insufficient to maintain consciousness (or support life beyond a few minutes) the aircraft’s cabin must be pressurised. If cabin pressurisation is not maintained below the equivalent of 10,000 ft in altitude, hypoxia becomes a primary safety concern.
Hypoxia is defined as a lack of oxygen in the body tissues, which is most often the result of a shortage of oxygen in the air being breathed. Individuals differ considerably in their ability to withstand hypoxia, such that in the early stages, one person may be more seriously affected than others.
While hypoxia and its effects are most critical at altitudes above about 20,000 ft, exposure to altitudes within the 11,000 ft to 20,000 ft range can lead to cognitive impairment that can critically affect the performance of flight crew. It is for this reason that flight crew are required to use oxygen when the aircraft’s cabin altitude exceeds 10,000 ft.
The A330 oxygen system
The A330 has separate oxygen systems for the flight crew and the passenger cabin. The flight crew’s oxygen supply is accessible at each flight crew station through a pre-connected full-face quick-donning mask and associated controls. To access oxygen, the flight crew member is required to perform specific steps to extract and then don the mask, which also initiates oxygen flow.
Passengers in the aircraft’s cabin are provided with oxygen through an independent oxygen system. When the cabin’s pressure altitude exceeded about 14,000 ft, detected by a pressure sensor separate to that used for cabin pressure control, individual masks for each passenger deploy above the passenger’s seat. A pre-recorded announcement that broadcasts instructions to the passengers also automatically commences as the masks deploy. The deployment process can also be initiated through a switch selection on the flight deck.
The aircraft pressurisation system regulates the flow of air to achieve a cabin pressure equivalent to an altitude that provides sufficient oxygen for normal human function. Pressurisation is achieved by pumping air from air‑conditioning units (commonly referred to as packs) into the cabin and then regulating the outflow of that air, and therefore the cabin’s altitude, through outflow valves (Figure 2). Conditioned air in the A330 is provided to the aircraft’s pressurised zones by 2 packs and controlled through two outflow valves located towards the rear of the fuselage.
Figure 2: Simplified pressurisation system overview
Description: A simplified view of the A330 pressurisation system. Note that the overview does not include other pressurisation system components.
Source: Airbus (modified by ATSB)
The general structure and operation of the A330 pressurisation system (Figure 3) was as follows:
- Two identical, independent, cabin pressure controllers (CPC1 and CPC2) provided automatic cabin pressure control using data from multiple sources within the aircraft. The data enabled the controlling CPC to determine an outflow valve position to achieve the required cabin pressure, and the required rate of change of that pressure. Both CPC1 and CPC2 have their own independent cabin pressure sensor to determine cabin altitude.
- Each CPC controlled its own electric motor on each of the two outflow valves, enabling a single CPC to control both outflow valves’ position.
- A controller and its two motors comprised a system. Only one system operated at a time (control system) while the other acted as a backup (standby system). In normal operation, pressurisation was fully automated through the CPC in control.
- If the controlling system failed, the backup system would automatically take control of the aircraft’s pressurisation. However, this automatic transfer only occurred when the failure was of a specific type. When a faulty CPC remained as the active controller, a forced changeover could be accomplished using a reset procedure.
- If the CPCs were in automatic mode and the cabin altitude reached 15,000 ft, the outflow valves automatically closed. The pressure switch that closed the valves was independent of the CPC pressure sensors.
- In the event of failure of both automatic systems, a third electric motor placed on each outflow valve enabled manual pressurisation control from the flight deck. A third pressure sensor provided cabin pressure data for manual control of aircraft pressurisation.
Figure 3: A330 pressurisation system
CPC pressure sensor fault detection
Each CPC monitored for pressure sensor faults by checking whether the sensor’s output:
- was outside of a specified range
- was not plausible, such that the difference between the cabin pressure and the outside pressure was outside of a defined range.
- had not updated for more than 1 second.
If one of these criteria was met, the CPC logged a fault and switched to the other controller’s pressure sensor for cabin pressure control.
Electronic centralized aircraft monitor
The flight crew were provided with engine and aircraft systems information through the electronic centralized aircraft monitor (ECAM), which had two main functions:
- detecting and alerting the flight crew to malfunctions or unsafe conditions through visual and aural cues, and displaying relevant procedural actions for those malfunctions.
- presentation of aircraft systems and sensor data on the engine and warning display (EWD) and the system display (SD) (Figure 4).
Figure 4: Flight deck front panels
The figure shows the location and exploded view of the EWD and SD, with the CAB PR EXCESS CAB ALT procedure and CAB PR alert shown on the EWD and the associated CAB PRESS page displayed on the SD.
Source: Airbus, modified by ATSB.
ECAM used a colour coded system to aid in identifying the importance of information presented on the EWD and SD (Figure 4). The system used:
- red for immediate action required
- amber for awareness but immediate action need not be taken
- green to identify normal operation
- white for titles and remarks
- blue for actions to be carried out or limitations.
The ECAM alert classification and priority system, detailed at Table 1, also used this colour coded system to assist flight crew in identifying the safety urgency of a detected malfunction or unsafe condition.
Table 1: ECAM failure mode alert classification and priority
Flight crew response
A system failure or condition that alters flight safety.
Immediate action by the flight crew is required.
A system failure that did not have a direct consequence on flight safety but required crew awareness.
Action should be taken without delay, time and situation permitting.
A failure that leads to a loss of redundance or system degradation.
Crew awareness and then monitoring.
The data presented in this table is a simplified version of the ECAM alert classification system used by Airbus. It has been structured for the purposes of this investigation and should not be used for any other purposes.
Cabin pressurisation information could be displayed on the SD through the cabin pressure (CAB PRESS) system page (see SD at Figure 4). The displayed data was sourced from the controlling CPC and its associated cabin pressure sensor. During normal operations, the displayed information on this page included identification of the controlling CPC system (SYS1 or SYS2), cabin differential pressure (ΔP), cabin vertical speed (V/S), cabin altitude (CAB ALT), and the position of both outflow valves (FWD and AFT).
Cabin altitude alerts
There were two ECAM alerts related to high cabin altitude.
- If the cabin altitude sensed by the controlling CPC was between 8,800 ft and 9,550 ft, an information advisory would be displayed to the flight crew advising that the aircraft’s cabin altitude was outside normal operating parameters. For that advisory, the:
- EWD would display the CAB ALT advisory alert.
- cabin altitude indicator on the SD page would pulse green.
- procedure required to be actioned by the flight crew was contained in the Quick Reference Handbook (QRH) and involved changing the controlling CPC.
- If the cabin altitude sensed by either CPC was above 9,550 ft, the:
- EWD would display the CAB PR EXCESS CAB ALT warning alert (a level 3 alert).
- aural and visual alerts associated with a level 3 alert activated.
- SD would display the CAB PRESS system page.
- sensed cabin altitude on the SD page would be red.
- procedure required to be actioned by the flight crew would be displayed on the EWD.
- cabin and seatbelt signs would illuminate.
The operator provided flight crew with a suite of operating manuals that contained policy, procedures, and crew actions for most normal and non-normal flight operations. This set of manuals included:
- the Flight Administration Manual (FAM) and Flight Standing Orders (FSO) policy and procedures manuals.
- aircraft operating manuals, which for the A330 comprised the QRH and the Flight Crew Operating Manual (FCOM).
- training and checking manuals, which for the A330 included the Flight Crew Techniques Manual (FCTM).
Policy and procedure manuals
The FAM set out the operator’s policy, standards, and procedures, which were to be adhered to under all circumstances by flight crew when operating company aircraft. FAM policy could limit or provide additional definition or scope in the application of operational procedures.
When abnormal conditions developed, the FAM stated that the flight crew’s hierarchy of references was the ECAM, the QRH, the FCOM and the FAM. The FCTM provided guidance on operating philosophy and practices. Time permitting, the FCTM could be referenced inflight, however, it was not intended to be the prime reference to address abnormal conditions.
Significantly, the FAM stated that flight crew were required to use oxygen whenever the cabin altitude exceeded 10,000 ft.
A330 Quick reference handbook
Some abnormal and emergency procedures were not displayed on ECAM. These procedures were available as checklists in the QRH. The EMERGENCY DESCENT procedure was one of those.
A330 Flight crew operating manual
The Qantas A330 FCOM was an Airbus document that was customised for the operator’s aircraft. It was intended to provide all necessary operating limitations, procedures, performance, and system information to enable flight crews to operate the A330 aircraft safely and efficiently during normal, abnormal, and emergency situations. The FCOM also contained a statement that declared its content to be sufficiently comprehensive to be used as a reference for initial and refresher flight crew training.
Text within the FCOM was arranged into 3 layers, based on its level of importance:
- Layer 1: ‘Need to know’ information.
- Layer 2: ‘Nice to know’ information designed to enable a full understanding of the logic of the aircraft and flight crew interfaces.
- Layer 3: information that provided more detailed explanations, but not necessarily needed in flight.
The FCOM also identified the safety imperative attached to an operating procedure or techniques. This was achieved through the following structure:
Abnormal and emergency procedures
The procedures section of the FCOM included a subsection that covered abnormal and emergency procedures. The presentation of those procedures was, as far as practicable, designed to be identical to how it was displayed on ECAM. Aside from the specific design of the layers, the following observations were relevant to the structure of these procedures:
- All actions and information displayed on ECAM were provided in large text, while other information not on ECAM was provided in small text. This type of information was generally labelled as Layer 1.
- A procedure could have distinct preconditions necessary for the next step. These preconditions were identified and included in the FCOM procedure. If a precondition was to be displayed on ECAM, this was readily identifiable through standardised formatting within the FCOM.
CAB PR EXCESS CAB ALT procedure
When the CAB PR EXCESS CAB ALT alert triggered, the EWD displayed the following procedure to the flight crew:
These ECAM procedural items were to be executed using a ‘read‑&‑do’ principle, where each line item was to be read, applied, and the action monitored before moving onto the next item. As the flight crew actioned each line item, further elements of the procedure would be displayed.
The FCOM content for the procedure included the following additional layer 1 information that preceded the procedure:
Rely on the CAB PR EXCESS CAB ALT warning even if not confirmed on the CAB PRESS SD page. This warning can be triggered by a cabin pressure sensor different from the one used to control the pressure and display the cabin altitude on the SD.
This extra information was not displayed on the EWD when the CAB PR EXCESS CAB ALT alert triggered.
Memory item procedures
Certain procedures or actions required of the flight crew were time critical to ensure safety of flight. In these situations, the flight crew may not have time to refer to the ECAM or the QRH, and so these items were required to be memorised. Procedures that contained these memory items were clearly identified in the FCOM. The EMERGENCY DESCENT was a memory item procedure, but the CAB PR EXCESS CAB ALT procedure was not.
Flight crew techniques manual
The FCTM provided information that was complementary to the FCOM. This included general Airbus operational philosophy, additional information on FCOM procedures, as well as best practice and operating techniques.
The Abnormal and Emergency Procedures Miscellaneous section of the FCTM contained guidance on the conduct of an emergency descent. That guidance commenced with information that was specifically relevant to the CAB PR EXCESS CAB ALT procedure (Figure 5).
Figure 5: FCTM emergency descent guidance
The second paragraph contained guidance that the flight crew respond to the CAB PR EXCESS CAB ALT warning by executing the EMERGENCY DESCENT memory item procedure. The content of the EMERGENCY DESCENT procedure and the CAB PR EXCESS CAB ALT abnormal procedure contained the same procedural items, but their order of execution was different. In addition, the CAB PR EXCESS CAB ALT procedure was a read‑&‑do structured procedure.
While the policies and procedures necessary to operate an aircraft cover a broad spectrum of normal, abnormal, and emergency operational matters, they cannot cover all possible circumstances. In providing guidance on how to address circumstances not covered by these policies and procedures, both Airbus and the operator made use of an overarching philosophy. That philosophy should set out a clear order of priorities that apply under all circumstances, but which must also be consistent with policies and procedures (Degani 1997).
Airbus operating philosophy
The use of a philosophy of practice was evident in the general structure for the conduct of abnormal and emergency procedures within the A330 FCOM and FCTM. The FCOM contained a procedure that covered the initial actions for an ECAM alert, and while it did not contain any guidance on the general conduct of abnormal procedures, it did make direct reference to FCTM material that covered the management of abnormal operations.
The FCTM contained a section titled Airbus Operational Philosophy. Included within that section was a chapter on procedure design, and in particular, design of abnormal and emergency procedures. The following operational philosophy principles applied to these procedures:
- In most situations the applicable sequence should be, in order of priority, memory items, ECAM and then QRH.
- ECAM listed procedures were to be conducted using a ‘read‑&‑do’ method.
The general procedure for handling an ECAM alert in the FCTM included certain initial actions (Figure 6). The red boxed item identifies that standard ECAM procedure is to confirm an alert through checking flight deck instrument panels and/or the associated SD before taking action ‑ although it was noted that the sensors supplying these panels/SD pages may be different from the sensor that triggered the ECAM alert.
Figure 6: FCTM Airbus philosophy for ECAM actions
Qantas operating philosophy
While the FAM had no specific operating philosophy content, particularly in relation to the conduct of abnormal and emergency procedures, the following observations from the FAM were relevant to philosophy content within the rest of the operating suite of manuals:
- The ECAM and FCOM took precedence in the conduct of abnormal and emergency procedures.
- The FAM did not include the need for confirmation of a fault before executing an abnormal or emergency procedure.
- The FCTM was subordinate to the FCOM as a reference source.
In a memo dated June 2020, the operator’s Head of Fleet Operations notified all flight crew of specific requirements for the management of non-normal (abnormal and emergency) events. The memo stated a default position that all flight crew should identify and confirm a malfunction before executing the required procedures. If the alert message could not be positively confirmed as false, then it was to be assumed to be a correct reflection of system status.
The flight crew understood there was a need to confirm a fault before commencing the required procedure.
The operator’s ab initio A330 type training provided flight crew with a computer-based training segment and flight simulator training on the CAB PR EXCESS CAB ALT alert procedure. However, the simulator was limited in its capability to reproduce a scenario that met the circumstances of the preamble to this procedure, being only able to produce the alert in conjunction with abnormal pressurisation indications on the SD page.
When interviewed, the captain stated that the simulator depressurisation training always required evidence of a depressurisation before conducting an emergency descent. The flight crew stated that this resulted in a bias towards seeking evidence of depressurisation for the CAB PR EXCESS CAB ALT alert before commencing the required emergency descent. Simulator training also stressed the need to establish confirmatory evidence of a fault before actioning the relevant procedure (this was in line with both Airbus and the operator’s philosophy described previously).
The captain did not recall that the preamble in the CAB PR EXCESS CAB ALT alert procedure required flight crews to rely on the alert regardless of the SD indications. However, the first officer had recently read the FCTM emergency descent material as part of a self-study component of the post furlough refresher training and hence was aware of the preamble.
In May 2021, the operator conducted an informal survey of a small number of A330 flight crew on their knowledge of the specific requirements of the CAB PR EXCESS CAB ALT procedure’s preamble. Survey responses suggested that this unique requirement was not well known.
Cabin pressure controller system examination
The aircraft was equipped with a quick access recorder (QAR) and flight data recorder (FDR). Figure 7 shows flight data for certain recorded parameters at the time of the incident.
Figure 7: VH-EBK flight data
Source: Data recorders, interpreted by the ATSB
Review of the data identified that:
- CPC2 was in control during the entire flight.
- The aircraft was cruising at FL 400 with CPC1 and CPC2 cabin pressure altitude recording stable values of about 7,100 ft.
- At about 0032, the CPC1 cabin altitude began to increase. The CPC2 cabin altitude remained unchanged at 7,100 ft.
- At about 0053, the CPC1 cabin altitude reached 9,560 ft, triggering the CAB PR EXCESS CAB ALT warning. Meanwhile, CPC2 cabin altitude remained steady at 7,100 ft.
- At about 0105, a precautionary descent was initiated. Shortly after, CPC1 recorded a cabin altitude of about 12,500 ft, and the CPC2 cabin altitude almost instantaneously started to record identical cabin altitude values to CPC1.
- At about 0106, the emergency descent was initiated, and the cabin altitude started to decrease. The CPC1 and CPC2 cabin altitude values remained the same for the rest of the flight.
- At about 0111, with the aircraft’s altitude indicating 11,500 ft and the cabin altitude about 9,500 ft, the CAB PR EXCESS CAB ALT warning deactivated. Shortly after, the aircraft was levelled off at about 10,000 ft.
After the flight, maintenance troubleshooting was conducted on the aircraft’s pressurisation system and each CPC. Pressurisation leak checks were found to be within normal limits, and the pressurisation system seals and valves were in serviceable condition. A post-flight maintenance report indicated that a CPC2 fault message was logged during the flight at 0105. This CPC was subsequently sent to the CPC manufacturer, Nord‑Micro, for examination.
Nord-Micro’s examination of the CPC2 pressure sensor found that it had experienced an intermittent hardware malfunction. However, the cause of the malfunction could not be determined.
The examination also found that during the flight, at 0032, when the cabin altitude was about 7,100 ft, the CPC2 cabin pressure sensor value appeared to ‘freeze’, but it continued to produce credible data. The faulty pressure sensor affected control of the outflow valves, and over time, this resulted in a loss of cabin pressure. It was not until about 0105, shortly after the precautionary descent was initiated, that the intermittent pressure sensor fault resulted in its output data exceeding any of the CPC’s internal fault detection criteria. At this time, the intermittent fault disappeared, and the pressure sensor started measuring the actual cabin pressure (12,500 ft cabin altitude). According to Nord-Micro, the sharp discontinuity in the pressure sensor value probably exceeded the fault detection criteria, triggering CPC2 to use the CPC1 pressure sensor data for cabin pressure control.
Since the specific cause of the fault could not be determined, Nord-Micro could not confirm if the aircraft’s precautionary descent had any effect on the intermittent fault disappearing.
Previous CPC2 faults
The examination further revealed that the CPC had logged 14 similar fault messages since June 2018 while the aircraft was either on the ground or in cruise flight. Qantas subsequently reviewed QAR data from 2 flights where the fault message was logged. That data showed a similar divergence of the CPC2 cabin altitude value, but the intermittent fault disappeared, and the cabin pressure control returned to normal before any cabin altitude alerts were triggered.
Qantas advised the ATSB that, prior to the occurrence, the CPC2 fault messages were being monitored, but in accordance with the A330 troubleshooting manual, corrective maintenance action was only required within 1,000 flight hours of the logged event.
Airbus corrective action
During an investigation into a 2006 in-service A320 cabin depressurisation event, Airbus became aware of a design limitation associated with the CPC systems. In that incident, incorrect but valid pressure sensor values were used by the aircraft’s controlling CPC system, resulting in a loss of control of cabin pressurisation and the eventual triggering of a cabin pressure alert, while at the same time presenting conflicting data on the CAB PRESS system page. The same issue was identified in A330 aircraft during a depressurisation event in 2007.
In order to mitigate the risk of flight crews not executing the required emergency procedure for the cabin pressure alert, a preamble for the CAB PR EXCESS CAB ALT alert was introduced into the A320, A330 and A340 Flight Crew Operating Manuals. This preamble directed flight crew to execute the alert irrespective of the data being presented on the CAB PRESS system page. However, the ECAM EWD procedure associated with the CAB PR EXCESS CAB ALT alert did not include that direction.
The previous A320 and A330 cabin depressurisation events in 2006 and 2007 were due to similar CPC pressure sensor failures as that experienced by VH-EBK. In those events, a pressure sensor fault in the controlling CPC was not detected, resulting in normal pressurisation indications to the flight crew and no automatic switchover to the standby CPC. In response to the pressurisation system issues, Airbus and Nord-Micro developed, among other safety enhancements, upgrades to the A320, A330 and A340 pressurisation systems to prevent cabin depressurisations from similar CPC pressure sensor faults.
This upgrade was released by Airbus for A330 aircraft in 2012 as part of service bulletin (SB) A330-21-3163, through CPC software logic updates. It had also been installed in aircraft produced since 2012, and was Airbus’ preferred method for addressing the design limitation. Airbus also advised that there had been limited uptake of the SB in aircraft produced before its release. One of those software changes allowed the CPC in control to use the lowest cabin pressure value of the 2 CPC pressure sensors in the event of a large enough deviation (20 hPa) between those sensors. According to Nord-Micro, had VH-‑EBK been fitted with the updated logic, the cabin depressurisation event would not have occurred.
The SB was classified by Airbus as ‘Recommended’ to reduce the likelihood of an inadvertent cabin depressurisation. An ATSB review of this SB identified that it did not include a summary of the operational events as background for the release of the SB, or an explanation of the CPC failure modes and how the accomplishment of the SB would prevent those failure modes.
Qantas assessed this SB in 2012 and again in 2015. These assessments concluded that the SB would be incorporated on attrition (when a CPC failed and needed replacement) based on the historically reliable performance of the CPCs. The SB had not been incorporated on VH-EBK at the time of this occurrence. ATSB review of the Qantas assessments identified that the 2012 assessment had not considered the risk related to incorporation of the SB on an attrition basis compared to early, pro-active completion. Additionally, although previously related operational events known to Airbus existed at the time of the 2015 assessment, these events were not included in the SB and therefore not considered by Qantas in their assessment.
The following extract from Human Performance Considerations in the Use and Design of Aircraft Checklists (Federal Aviation Administration, 1995) provides important guidance about the need for all critical components of a procedure to be included within the method for executing that procedure. While the guidance was in relation to checklist design, it applied with the same force to any ‘read & do’ list applicable to an ECAM procedure.
The complexity of today's aircraft requires a systematic approach to operation. The pilot and crew in fact, are an integral part of an aircraft system. Like any other complex system, when a system component fails, the entire system may be subject to failure.
Checklists have been the foundation of pilot standardization and cockpit safety for years. Such procedures, when applied in a disciplined and standard manner, are intended to support human performance by providing a firm foundation for the task, one which the pilot and crew can depend on during a "low" in performance. The checklist is an aid to the memory and helps to ensure that critical items necessary for the safe operation of aircraft are not overlooked or forgotten.
... From a human factors point of view, the checklist is an important interface between the human and the aircraft. In addition to assisting the crew to configure and operate the aircraft properly, the checklist provides a method and a sequence for verifying the overall system operation. It is an important aid in helping the crew to remain focused to the task at hand by eliminating guesswork that often accompanies periods when crew attention is divided especially during periods of stress or fatigue. The checklist is an important and necessary backup for the pilot and crew.
… Although it may be published in a manual, a checklist is designed for independent use so that the user does not have to reference a manual. Checklists are used to ensure that a particular series of specified actions or procedures are accomplished in correct sequence and to verify that the correct configuration has been established in specified phases of flight.
ECAM provides an electronic automated system for the notification and execution of the procedural actions required of flight crew in response to various systems alerts. ECAM’s functions include those of a checklist, that is to ensure that all necessary procedural actions are completed. As such, all essential procedural elements should be presented on ECAM.
Airbus reported that the depressurisation event involving VH-EBK was a rare event, but that there had been 7 similar occurrences since 2016, mostly in A320 aircraft. The following summaries of incidents involving CPC sensor failures commences with the originating A320 event. The other 2 occurrences described were also among the 7 similar ones reported since 2016.
A320 depressurisation event, G-MIDW
An Air Accident Investigation Branch (UK) (AAIB) report discussed a depressurisation event that occurred with an A320 aircraft registered as G-MIDW. On 8 October 2006, while en-route to Glasgow at FL 380, the flight crew of that aircraft received a CAB PR EXCESS CAB ALT warning indicating excessive cabin altitude. However, the SD showed the pressurisation parameters, including the cabin altitude, were normal. The crew believed that the warning was spurious, but donned oxygen masks as a precaution. The CAB PR EXCESS CAB ALT procedure did not include the preamble component at that time.
Eighteen minutes later they were advised by the cabin crew that the passenger oxygen masks had deployed. An emergency descent to FL100 was initiated, at which level the flight continued to its destination without further incident. Airbus confirmed an unspecified fault in one of the aircraft’s CPCs and commenced investigation of possible improvements to the cabin pressurisation system.
A340 depressurisation event, G-VGAS
An AAIB report discussed a depressurisation event that occurred with an A340 aircraft registered as G-VGAS. On 23 February 2017, while en-route to New York at FL 400, the crew of that aircraft received a CAB PR EXCESS CAB ALT warning indicating an excessive cabin altitude. Although the SD indicated no abnormalities, the ECAM warning remained. Further, 2 crew members and both pilots believed they had symptoms of hypoxia.
The pilots began a descent but, when passing FL 260, the ECAM warning extinguished. The pilots elected to level off at FL 250 and continue towards their destination but, after approximately 30 minutes, the ECAM warning returned. Indications on the pressurisation system display were still normal but the pilots descended the aircraft to an altitude of 11,000 ft. At the same time as the warning of excessive cabin altitude, a fault was recorded in a CPC. Engineers suspected that this caused the cabin outflow valves to open, resulting in a cabin altitude increase.
A320 depressurisation event, AP-BLV
A Safety Investigation Board of Pakistan report discussed a depressurisation event that occurred with an A320 aircraft registered as AP-BLV. On 18 October 2017, while en-route to Karachi at FL 320, that aircraft experienced several CAB PR EXCESS CAB ALT warnings. The flight crew maintained altitude and attempted to reset the cabin pressurisation system. During this reset all passenger oxygen masks deployed. The aircraft continued to its destination at FL 320.
A post‑flight investigation identified that the controlling CPC failed to regulate the cabin pressure at the desired altitude, and the backup CPC did not automatically take over. The controlling CPC fault caused the cabin altitude to climb, leading to the repeated cabin pressure warnings. The flight crew did not action the alert’s required procedure, but instead unsuccessfully attempted to change controlling CPCs (using an incorrect procedure). The cabin altitude eventually exceeded that required to automatically trigger the cabin masks deployment.
In the early morning on 5 February 2021, while en route from Sydney to Perth the flight crew of an Airbus A330, registered VH-EBK, received an excess cabin altitude warning during cruise at about 40,000 ft. About 7 minutes later, the flight crew donned their oxygen masks and conducted an emergency descent, diverting to Adelaide without further incident.
The following analysis discusses the circumstances leading to the cabin depressurisation and the factors that influenced the flight crew’s response.
During cruise with the aircraft’s cabin altitude at 7,100 ft, the controlling cabin pressure controller (CPC2) experienced an intermittent pressure sensor fault, resulting in inaccurate control of the outflow valves. This fault was not automatically detected by CPC2, as the sensor continued to provide credible data. As the automatic transfer of pressurisation control for a sensor fault is dependent on that fault being detected, pressurisation control was not transferred to CPC1, which was functioning correctly. As a result, the aircraft began to slowly depressurise.
About 15 minutes after the undetected pressure sensor fault occurred, the actual cabin altitude (as recorded by CPC1) reached 8,800 ft. However, since CPC2 was still sensing 7,100 ft, the Electronic Centralized Aircraft Monitor (ECAM) advisory message CAB ALT was not activated. This alert was designed to notify the flight crew that the cabin altitude was outside normal operating parameters, but its triggering relied on the controlling CPC detecting this event. About 6 minutes later, the actual cabin altitude exceeded 9,550 ft, and CPC1 triggered the CAB PR EXCESS CAB ALT alert on the ECAM. This also resulted in the cabin pressure information being displayed to the flight crew on the CAB PRESS page on the System Display (SD). However, as CPC2 was still in control and sensing a cabin altitude of 7,100 ft, the cabin pressure indications on the CAB PRESS page appeared normal. Consequently, the flight crew were presented with conflicting information.
Cabin pressure controller fault
In 2006, Airbus became aware of a design limitation associated with the CPC systems where a faulty cabin pressure sensor in the controlling CPC could cause misleading information to be presented to the flight crew on the CAB PRESS system page. In response, Airbus introduced a preamble into the flight crew operating manual’s (FCOM’s) CAB PR EXCESS CAB ALT alert procedure. The preamble required an immediate response to the ECAM alert by executing the associated procedure displayed on the engine and warning display, irrespective of system data indications.
A critical function of an emergency procedure checklist, or the ECAM ‘read & do’ procedure, is to ensure that items necessary for the safe operation of aircraft are carried out. Airbus introduced the preamble to the FCOM’s CAB PR EXCESS CAB ALT alert procedure as a risk mitigator against the limitations in the CPC fault detection capabilities. The preamble was unique in that it required flight crews to execute the procedure even without confirmatory data. However, this was contrary to an Airbus operating philosophy for flight crew to seek confirmatory evidence of a fault before executing the associated abnormal procedure.
Despite the importance of the preamble, it was not part of the ‘read‑&‑do’ procedural steps presented on the ECAM, and thus not presented to the flight crew during the execution of the required procedure. Instead, the immediate actioning of the procedure in response to the alert (as required by the preamble) was reliant on flight crew memory recall of the preamble’s requirement.
Following previous CPC faults, Airbus released service bulletins (SB) for the A320, A330 and A340 aircraft types that included CPC software logic updates. For the A330, one of those software changes allowed the CPC in control to use the lowest cabin pressure value of the two CPC pressure sensors if there was a large enough difference between the values. The aircraft did not have this SB incorporated at the time of the incident.
While the SB would not have prevented the intermittent pressure sensor fault observed on VH‑EBK, its incorporation would have resulted in automatic identification of the pressure difference when the cabin altitude was about 8,000 ft, resulting in CPC2 using the CPC1 pressure sensor for cabin pressure control. This would have prevented the depressurisation event and activation of the CAB PR EXCESS CAB ALT alert.
When the red CAB PR EXCESS CAB ALT warning alert was triggered, the flight crew immediately sought confirmatory data consistent with both the Airbus philosophy and the Qantas internal memo dated June 2020. The CAB PRESS page on the SD, however, indicated that the system was operating normally. The captain also identified that there had been no 8,800 ft CAB ALT advisory message preceding the red warning alert, raising questions about whether the controlling CPC was functioning correctly. As previous simulator depressurisation training had reinforced the need to obtain confirmation of a depressurisation before conducting the required emergency descent, the flight crew continued to seek further evidence of depressurisation. Discussion with the customer service manager further delayed the required response.
The first officer retrieved the Flight Crew Techniques Manual (FCTM) for guidance. The captain reported that, upon review, they found the information to be inconsistent and confusing, although the first officer assessed that the information instructed an immediate emergency descent. The confusion over the FCTM information resulted in the flight crew further delaying the execution of the alert’s procedure.
When the aircraft’s cabin altitude exceeds 10,000 ft, the occupants’ risk of hypoxia is significantly elevated. Therefore, the loss of cabin pressurisation notified by the CAB PR EXCESS CAB ALT is a red warning alert, where the immediate imperative for the flight crew is the use of supplemental oxygen.
On activation of the ECAM alert on this occasion, the flight crew focussed on acquiring data to support the cabin altitude warning alert, and in particular the requirement to conduct an emergency descent for a depressurisation. Consequently, they overlooked the first line of the ECAM procedure, which was for both crew members to use oxygen. The risk from hypoxia is relevant in any cabin pressurisation issue, whether through explosive or slow depressurisation. Although the outflow valves would automatically limit the cabin altitude to 15,000 ft, this is still within the hypoxic range.
Use and content of manuals
When presented with conflicting data for the CAB PR EXCESS CAB ALT alert, the flight crew referenced the FCTM and not the FCOM. While the operator’s Flight Administration Manual (FAM) stated that the primary references for operational matters were the ECAM/Quick Reference Handbook (QRH), and then the FCOM and the FAM, the flight crew’s use of the FCTM was probably influenced by the first officer’s recollection that it contained information relevant to depressurisation/emergency descent.
Although actioning the CAB PR EXCESS CAB ALT alert was critical to flight safety and could potentially present a unique situation for flight crew, knowledge of the preamble’s unique requirement was not well known among the operator’s flight crew.
Further, the depressurisation training in the simulator potentially created a bias as flight crews became accustomed to always having supporting evidence of a cabin depressurisation alongside the CAB PR EXCESS CAB ALT alert. As such, the operator’s training system did not adequately cover the unique requirements of the CAB PR EXCESS CAB ALT alert procedure that may be encountered in flight, increasing the risk of an incorrect or delayed application of the required procedure.
Mitigations to CPC design limitation
In response to the possibility of cabin depressurisation events resulting from the CPC design limitation, Airbus introduced two specific mitigations for the A320, A330 and A340 fleets. These mitigations were:
- to remove the design limitation through the application of improvements to the CPC through application of SBs released in 2012 and 2014
- procedural changes, which included the incorporation of a preamble to the CAB PR EXCESS CAB ALT abnormal procedure around 2006.
As the CAB PR EXCESS CAB ALT alert is a red warning alert, being the highest priority alert, the required procedural response should be designed to ensure a correct application every time with no exceptions. However, since 2016 there have been 7 events of a similar nature to the VH-EBK according to Airbus. Of these 7 events, 2 had indications of the incorrect application of the procedure, where the preamble requirement did not appear to have been applied. The VH-EBK event was a further example.
These events, as well as the potential failure points of the reliance on memory recall and the various operational philosophy aspects, identified that the procedural mitigation did not ensure appropriate management of aircraft experiencing a cabin depressurisation due to the CPC design limitation. Further, while the SB is the Airbus preferred method of addressing the design limitation, there has been very limited uptake in the pre-2012 A320 and A330/340 fleets. Overall, the mitigations introduced to counter the CPC design limitation have not been sufficiently effective.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the depressurisation involving Airbus A330, VH-EBK that occurred on 5 February 2021.
- Due to a design limitation associated with the aircraft’s cabin pressure controller (CPC) systems:
- The controlling CPC was unable to detect a fault with its pressure sensor, resulting in the loss of cabin pressure control and the subsequent increase in cabin altitude.
- While the backup CPC triggered the CAB PR EXCESS CAB ALT alert as required when the cabin altitude exceeded 9,550 ft, the data presented to the flight crew indicated normal cabin altitude.
- The flight crew responded to the CAB PR EXCESS CAB ALT alert procedure by observing that there was no confirmatory data and, in seeking evidence to verify the failure, delayed executing the required procedure.
- A preamble to the CAB PR EXCESS CAB ALT alert procedure was introduced as a procedural mitigation for the CPC system design limitation. This required flight crew to rely on the alert even if not confirmed by other system data. This mitigation had significant potential for error as:
- although a critical component to the procedure, the preamble requirement was not part of the ‘read & do’ procedural steps and was reliant on memory recall
- the required procedural action was contrary to both the operator and aircraft manufacturer’s procedural philosophy of confirming alerts with system data before executing abnormal procedures
- An Airbus service bulletin (SB), introduced as a mitigation to the CPC design limitation, would have prevented the loss of cabin pressure control from the pressure sensor fault. However, the SB had not been incorporated on this aircraft.
- The mitigations introduced by Airbus to counter the design limitation associated with the A330 cabin pressure control systems were ineffective because:
- changes to the CAB PR EXCESS CAB ALT alert operational procedure did not ensure appropriate management of the fault
- the service bulletin had very limited uptake in the A330/A340 global fleet. [Safety Issue]
- The operator’s training system did not adequately cover the unique requirements of the CAB PR EXCESS CAB ALT alert procedure, increasing the risk of an incorrect or delayed application of the required procedure. [Safety Issue]
Other factors that increased risk
- Contrary to the operator's Flight Administration Manual policy requirements, the flight crew referenced the Flight Crew Techniques Manual instead of the Flight Crew Operations Manual to resolve the conflicting data presented with the CAB PR EXCESS CAB ALT procedure.
- While determining the need to execute the CAB PR EXCESS CAB ALT alert procedure, the flight crew focussed on the need for confirmatory data to support an emergency descent and consequently, did not don their oxygen masks, increasing the risk of hypoxia.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions will be provided separately on the ATSB website on release of the final investigation report, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website after the release of the final report as further information about safety action comes to hand.
Safety issue description
The operator’s training system did not adequately cover the unique requirements of the CAB PR EXCESS CAB ALT alert procedure, increasing the risk of an incorrect or delayed application of the required procedure.
Mitigations to CPC design limitation
Safety issue description
The mitigations introduced by Airbus to counter the design limitation associated with the A330 cabin pressure control systems were ineffective, because:
- changes to the CAB PR EXCESS CAB ALT alert operational procedure did not ensure appropriate management of the fault
- the service bulletin had very limited uptake in the A330/340 global fleet.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action addressing the flight crew techniques manual content
Qantas advised of the following modification to the Emergency Descent section of the Flight Crew Techniques Manual:
The flight crew must rely on the CAB PR EXCESS CAB ALT warning, even if not confirmed on the CAB PRESS SD because the CAB PR EXCESS CAB ALT warning can be triggered by a cabin pressure sensor, different from the one used to control the pressure and display the cabin altitude on the SD. In absence of the CAB PR EXCESS CAB ALT warning, the emergency descent should only be initiated on positive confirmation that cabin altitude and rate of climb are excessive and uncontrollable.
The amended content was issued on 1 March 2021.
Qantas maintenance action
Qantas advised of the following maintenance action:
- The Qantas fleet was checked for similar Cabin Pressure Controller (CPC) faults with no other aircraft identified with the same type of fault.
- Qantas established an enhanced CPC fault alert policy to manage suspected faulty CPCs.
- The Qantas A330 fleet was modified to incorporate the Airbus CPC software change and all CPC affected by the subject service bulletin have been modified.
A330 Airbus type A330 passenger aircraft
ATC Air traffic control
CAB PRESS An ECAM cabin pressurisation system page, which presents data on the current status and operation of the aircraft’s pressurisation system
CPC Cabin pressure controller. VH-EBK had two controllers, labelled CPC1 and CPC2.
CPCLD Controller-pilot data link communications, a system used by ATC for aircraft flight following
CVR Cockpit voice recorder
CSM Customer Service Manager
EWD Engine and warning display
ECAM Electronic centralized aircraft monitor
FAM Flight administration manual
FCOM Flight crew operations manual
FCTM Flight crew techniques manual
FDR Flight data recorder
FL Flight level
FO First officer
MAYDAY An internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
Nord-Micro Manufacturer of the A330 CPC
PAN PAN An internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
Preamble Text that preceded the FCOM’s CAB PR EXCESS CAB ALT procedure, which identified the need to execute the procedure irrespective of the data presented on the ECAM SD.
PF Pilot flying
PM Pilot monitoring
QAR Quick access recorder, a derivative of a digital flight data recorder
QRH Quick reference handbook
SD System display
Sources and submissions
Sources of information
The sources of information during the investigation included:
- the cockpit voice recorder of VH-EBK
- the flight data recorders of VH-EBK
- the flight crew of VH-EBK
- Qantas Airways
- Civil Aviation Safety Authority
AAIB UK (Air Accident Investigations Branch United Kingdom) (2007) AAIB Bulletin: 7/2007 G-MIDW EW/G2006/10/07, United Kingdom Government Publishing Service website, accessed 26 September 2022.
AAIB UK (2017) AAIB Bulletin: 9/2017 G-VGAS EW/G2017/02/08, United Kingdom Government Publishing Service website, accessed 26 September 2022.
AAIB Pak (Air Accident Investigations Board Pakistan) (2017) SIB-399: SERIOUS INCIDENT OF PIAC FLTGHT PK-369 (ISB TO KHI) A320-214 AIRCRAFT REG NO AP-BLV CABIN PRESSURE LOST FOLLOWED BY OXYGEN MASKS DROPPING DATED 18 OCTOBER 2017, Pakistan Civil Aviation Authority website, accessed 26 September 2022.
CAA UK (Civil Aviation Authority United Kingdom) (2017) CAP 708: Guidance on the design, presentation and use of electronic checklists, CAA UK website, accessed 26 September 2022.
Degani A, and Wiener E L (1997) ‘Philosophy, policies, procedures and practices: The four ‘P’s of flight deck operations’, in McDonald N, Fuller R and Johnston N (eds) Aviation psychology in practice, Routledge, London.
Federal Aviation Administration (1995) Human performance considerations in the use and design of aircraft checklists, US Department of Transportation.
SKYbrary a (n d) Hypoxia, SKYbrary website, accessed 26 September 2022.
SKYbrary b (n.d.) OGHFA – Hypoxia, SKYbrary website, accessed 26 September 2022.
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
- the flight crew of VH-EBK.
- Qantas Airways
- Civil Aviation Safety Authority
- Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile
Submissions were received from:
- the flight crew of VH-EBK
- Qantas Airways
- Civil Aviation Safety Authority
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Australian Transport Safety Bureau
About the ATSB
The ATSB is an independent Commonwealth Government statutory agency. It is governed by a Commission and is entirely separate from transport regulators, policy makers and service providers.
The ATSB’s purpose is to improve the safety of, and public confidence in, aviation, rail and marine transport through:
The ATSB is responsible for investigating accidents and other transport safety matters involving civil aviation, marine and rail operations in Australia, as well as participating in overseas investigations involving Australian-registered aircraft and ships. It prioritises investigations that have the potential to deliver the greatest public benefit through improvements to transport safety.
The ATSB performs its functions in accordance with the provisions of the Transport Safety Investigation Act 2003 and Regulations and, where applicable, international agreements.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
An explanation of terminology used in ATSB investigation reports is available on the ATSB website. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
 Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours
 Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances, such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
 Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 400 equates to 40,000 ft.
 A reporting point on airway route T134 at 37° 48.7’ S 135°00.0’ E.
 An emergency descent is a procedure designed to get the aircraft down to a target altitude as quickly and safety as possible. In contrast, a precautionary descent does not have the same urgency, nor does it use the specific procedural requirements of the emergency descent.
 All altitudes are reported as height above mean sea level.
 The process of air traffic control maintaining contact with the specified aircraft to determine en route progress and for the provision of air traffic services.
 The aircraft had established flight following with air traffic control through controller-pilot data link communications (CPCLD). This flight following included position reporting and other ATC related communications. Backup radio communications were available through VHF frequencies with Melbourne Control, however, just prior to the alert, the aircraft had moved out of range for VHF communications.
 PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
 MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
 Important policy and/or procedures yet to be incorporated into the operations manual suite were to be found in the Flight Standing Orders (FSO). The FSOs did not include any matters relevant to the investigation.
 Review of QAR data was not part of this monitoring process.
 The cabin pressurisation system was similar across the three aircraft types.
 Considered by the manufacturer to significantly improve the level of airworthiness compliance regarding identified system issues/failure modes.
The Australian Transport Safety Bureau recommends that Airbus takes safety action to address the effectiveness of the mitigations to the design limitation associated with the A330 cabin pressure control systems.