Etihad A6-EIF

A normal flight to the top of descent

Etihad Airways flight EY200 left Abu Dhabi for Karachi on 5 March 2018 with 76 passengers, two pilots and four cabin crew aboard Airbus A320-232 A6-EIF. The commander was the pilot flying. The aircraft entered runway 31R at 12:16:05 UTC and made a rolling takeoff. After the climb, it cruised at FL370. The flight proceeded normally until the descent towards Karachi.

The aircraft had two independent automatic cabin pressure controllers, CPC1 and CPC2. One controlled a single outflow valve while the other remained on standby. In normal operation, the active controller used flight-management data, including the destination elevation, to schedule cabin pressure. During descent, it was intended to bring cabin pressure towards the pressure at the landing airport. A manual mode gave the pilots control of the valve through a separate motor.

Before descending, the pilots completed their descent preparation and the commander told the passengers that descent would begin within about five minutes. At 13:27:08, the co-pilot requested descent clearance. ATC cleared the flight to FL150, and the aircraft began descending from FL370 at 13:27:27. The recorded data later showed that cabin altitude began rising as the aircraft passed about 34,200 ft pressure altitude.

The cabin keeps climbing

At 13:32:30, with the aircraft descending through about 28,350 ft, the co-pilot questioned whether the cabin vertical speed was normal. The crew selected the cabin-pressure page on the electronic centralized aircraft monitoring system, or ECAM. It showed the cabin altitude increasing when the crew expected it to decrease. The co-pilot reported a cabin altitude of about 7,900 ft. As the aircraft passed about 27,350 ft, he reported 8,000 ft.

The pilots requested a level-off at FL270 to assess the problem and watch for an improvement. The aircraft began levelling at 13:33:28 and remained at FL270 for about a minute. Cabin altitude kept rising. The commander then resumed descent in open-descent mode. The pilots discussed using their oxygen masks; the commander initially waited to observe the pressure trend.

At 13:35:11, with the aircraft at about 25,700 ft and cabin altitude approaching 9,000 ft, the commander decided to use oxygen. Both pilots had donned their masks by 13:35:14 and checked their communication through them. The commander progressively increased the aircraft descent rate from roughly 2,400 to nearly 5,900 ft per minute. He announced the emergency descent to the passengers. At 13:36:14, the co-pilot notified Karachi Approach of a cabin-pressure failure and declared PAN-PAN. ATC cleared the flight to FL110.

The warning and the passenger masks

The excessive cabin-altitude warning was recorded by the environmental control maintenance system at 13:37:03. Cabin altitude was then 9,536 ft, close to the designed 9,550 ft warning point. The alert appeared in the cockpit approximately two seconds later, with the indicated aircraft pressure altitude about 19,200 ft. The crew began the associated flight-crew operating manual procedure.

At 13:37:40, near the end of that procedure, the pilots manually deployed the passenger oxygen masks. The aircraft was passing about 16,400 ft pressure altitude, while cabin altitude was approximately 9,800 ft. The commander told the passengers to use the masks, and cabin crew checked that they did so. Autopilot and autothrust remained engaged during the emergency descent.

The pilots later said that they believed cabin altitude would soon reach 14,000 ft, the automatic passenger-mask deployment threshold. The recorded cabin climb rate was approximately 385 ft per minute. The GCAA calculated that reaching 14,000 ft at that rate would have taken another 10 minutes and 53 seconds after manual mask deployment. The aircraft descended from 16,400 ft to 10,000 ft in about one minute and 40 seconds.

Cabin altitude peaked at 10,576 ft as the aircraft passed about 9,500 ft, then decreased with the aircraft descent. The GCAA found that deploying the passenger masks had been an early precaution and was unnecessary. It found the crew had otherwise followed the applicable operating procedures and completed the required abnormal and emergency checklists.

Manual control and the landing

At 13:39:38, passing about 9,580 ft, the co-pilot told ATC that the emergency descent was complete and cancelled PAN-PAN. The excessive cabin-altitude warning ceased at 13:40:37 as the aircraft levelled at 8,000 ft. The cabin manager reported that the passengers were well. The commander advised that they could remove their oxygen masks.

The pilots selected manual cabin-pressure control at 13:42:01 while descending through about 7,800 ft. Later, at 3,000 ft aircraft pressure altitude, they requested extra time on downwind to lower the cabin altitude manually. An attempt to restore automatic pressure control made cabin altitude rise again, so they returned to manual control. At 13:49:28, cabin altitude had fallen through 2,600 ft while the aircraft remained at 3,000 ft.

ATC vectored EY200 for the ILS approach to runway 25L. Cabin altitude was passing 900 ft at 13:52:41. The aircraft captured the glideslope, completed the landing checklist and landed at 13:59:46. All 82 occupants were uninjured and disembarked normally. The aircraft remained intact, with no fire. The GCAA found that the pilots maintained good situational awareness throughout the event.

Six weeks of pressurization defects

Maintenance records showed repeated pressurization faults during the six weeks before the incident. A January fault in system 1 had been followed by a controller reset and a satisfactory test. February reports included an unexpected outflow-valve opening on landing, excessive cabin pressure during descent and a low differential-pressure warning. Troubleshooting and operational checks repeatedly produced satisfactory results.

On one flight on 26 February, maintenance found a cargo-hold thermal blanket covering the outflow exhaust port. The blanket was secured and the pressure system passed an operational test. On 4 March, the previous day, another flight experienced excessive cabin pressure during descent. A faulty avionics skin air outlet valve was replaced and its operational check was satisfactory. The GCAA found that the maintenance actions followed the prescribed manuals but had failed to identify the underlying pressurization problem.

After the incident, both controllers and the outflow valve were replaced at Karachi. The aircraft was ferried to Abu Dhabi without passengers after maintenance. Further work included replacing a safety valve, checking the outflow-valve area and repairing or replacing damaged or leaking air-conditioning components. The environmental control maintenance data showed normal pack flow during the incident flight.

Two controllers with different pressure targets

Investigators downloaded the flight data and cockpit voice recorders and also examined the quick-access recorder. The quick-access data supplied cabin altitude and differential pressure, parameters absent from the flight data recorder. The recorder times were synchronized so that crew actions, pressure changes and system messages could be compared. The two controllers, an outflow valve and a safety valve went to their manufacturer, Nord-Micro, for examination.

The recorded data showed CPC1 remained in control of cabin pressure. The outflow valve held a relatively steady opening of about eight to ten percent while cabin altitude climbed at 300 to 400 ft per minute. CPC1 generated no excessive-altitude warning and did not transfer control to CPC2, because it had not identified itself as faulty. CPC2, operating on standby, generated the warning when cabin altitude reached the threshold.

The landing elevation transmitted to the cockpit display remained 96 ft, approximately Karachi airport elevation. The engineering analysis concluded that CPC1 was using a different, corrupt value internally. Its behaviour matched pressure control for landing at a high-altitude airport: it steadily raised the cabin altitude and shifted its own warning threshold. The GCAA identified a corrupt landing field elevation of about 10,576 ft in its findings.

Component examinations found contamination and several maintenance defects, but the functional tests and recorded behaviour led investigators to exclude the outflow valve, safety valve and CPC2 as the cause. CPC2 had generated the expected warning in standby mode.

A memory error that could persist

The manufacturer examined the software used to calculate scheduled landing pressure. A moving average filter in that calculation was vulnerable to memory corruption. A change in a single stored bit could leave a lasting offset in the calculated pressure. The error would remain until the controller received a power reset and the filter was reinitialized.

The effects could first appear during descent even if the corruption had happened earlier. The analysis showed that a corrupt value could remain dormant during cruise. It could also arise while a controller was on standby during one flight and become visible on a later flight when that controller was active and entered descent mode.

A system test reproduced the pressure-control behaviour by deliberately changing a bit in the filter calculation. After the simulated fault, cabin altitude climbed steadily towards the software limit of 14,000 ft. The displayed landing elevation remained at the test value of 1,000 ft, while the controller suppressed its excessive cabin-altitude warning. A separate three-day test of CPC1 under simulated flight conditions produced no spontaneous bit change.

The GCAA attributed the corrupt value most probably to a memory bit error. It identified two possible origins: a single event upset in a memory cell, potentially produced by a high-energy particle, or erroneous data associated with fatigued solder joints on the controller main board. Previous experience with these controllers had shown that resoldering the relevant memory integrated circuits could resolve intermittent data faults.

Findings and safety recommendations

The GCAA AAIS issued its final report on 22 April 2019. Pakistan had delegated the investigation to the UAE authority as the state of registry and operator. The occurrence was initially classified as a serious incident and later changed to an incident after its severity was reviewed. The final cause finding was slow cabin depressurization during descent because CPC1 processed corrupt landing field elevation data.

Etihad already monitored the controllers through its reliability programme. After the incident, it issued an alert for more detailed monitoring of CPC units that had exceeded alert levels or showed high defect or delay rates. Airbus was informed. At the time of the final report, Airbus was developing a modified controller to prevent memory corruption or erroneous data, but had supplied no consolidated schedule.

Recommendation SR12/2019 asked Etihad to circulate the incident details to all its flight crews and include appropriate aspects in training, particularly the early manual deployment of passenger masks outside the prescribed procedure. Recommendation SR13/2019 asked Airbus to issue a technical publication explaining the controller problem to all A320 operators while the modified controller was being developed.