Qantas Flight 72

A normal cruise becomes an instrument problem

Qantas flight 72 departed Singapore on 7 October 2008 on a scheduled passenger service to Perth. Its Airbus A330-303, registration VH-QPA, carried 303 passengers and twelve crew members, including three pilots. The departure and climb were normal. The aircraft settled into cruise at 37,000 ft with the autopilot and autothrust engaged. The crew reported fine, clear weather and no turbulence. By 02:01 UTC, autopilot 1 was maintaining the cruise altitude and autothrust was maintaining Mach 0.82. The captain returned from a scheduled rest break at 04:33 UTC. The first officer left for his break at 04:39 UTC.

At 04:40:26 UTC, one of the aircraft's three air data inertial reference units, ADIRU 1, began sending incorrect information to other systems. Two seconds later the autopilot disconnected automatically and the captain took manual control. The aircraft displayed multiple caution messages and issued brief stall and overspeed warnings. The captain's airspeed and altitude indications fluctuated, while the other primary display and standby instruments did not show the same problem. He used the standby instruments and the first officer's primary flight display to fly the aircraft.

The second officer was occupying the right control seat while the first officer was on a rest break. The crew briefly engaged the other autopilot but disconnected it again. The messages did not initially call for urgent action or warn that an unwanted flight-control command was about to occur. The captain asked for the first officer to return and help diagnose the situation. The recorder showed that autopilot 2 remained engaged for fifteen seconds. Between the first autopilot disconnection and the engagement of autopilot 2, the aircraft climbed to 37,180 ft. During the brief engagement it began returning to the assigned altitude.

Two commands that drove the nose down

At 04:42:27 UTC the aircraft abruptly pitched down. The flight data recorder showed a sudden elevator movement and a maximum pitch of 8.4 degrees nose down. The captain immediately pulled back on his sidestick, but the flight-control system did not initially respond to that input. After about two seconds it responded normally, allowing recovery to the assigned altitude. The aircraft descended 690 ft over twenty-three seconds. The movement threw unrestrained occupants toward the ceiling.

The recorded peak vertical acceleration near the aircraft's centre of gravity was minus 0.80 g. Occupants were thrown around and overhead fittings were damaged. The second officer turned on the seat-belt sign and made an announcement for passengers and crew to sit down and secure their belts. The first upset occurred over the Indian Ocean, 154 km west of Learmonth. That location later mattered because Learmonth was the nearest airport suitable for the aircraft, offering a place to end the flight and obtain medical assistance.

The pilots dealt with fault messages after recovering, including actions concerning inertial reference information and a flight-control primary computer. At 04:45:08 UTC another pitch-down occurred. It was less severe, reaching about 3.5 degrees nose down, and the aircraft descended 400 ft over fifteen seconds before returning to its level. Again, back pressure initially had no effect and then normal response returned. The second event reinforced the concern that an unresolved system problem might produce further abrupt movements, even while the aircraft could otherwise be flown.

Ending the flight at Learmonth

After the second upset, the crew faced recurring warnings and caution messages that scrolled too rapidly for effective interaction. The captain found that automatic pitch trim was unavailable and used manual trim. He disconnected the autothrust and flew using standby instruments for the remainder of the flight. Although the crew thought the loss of automatic trim might mean direct law, the investigation established that the flight-control system had reverted to alternate law.

The first officer returned to the flight deck and the crew decided to land as soon as practicable. They considered Learmonth suitable and close, while information from the cabin showed that people had been injured. The first officer made an urgency call and requested diversion clearance. After receiving more detail about serious injuries, he declared a MAYDAY at 04:54:25 UTC. The crew also consulted the airline's maintenance watch team. Switching a flight-control computer off later in the descent did not stop the recurring warnings.

Several systems required additional attention during the approach preparation. The pilots could not load the intended satellite-navigation approach because of fault messages, cabin pressure required manual control, and manual braking would be needed. The captain descended cautiously in wide orbits, then positioned for a straight-in visual approach to runway 36. The aircraft landed at 05:32 UTC, or 13:32 local time. No one died. The final injury table recorded twelve serious and 107 minor injuries, with 196 occupants listed as uninjured or unknown. Medical assistance followed the landing.

The crew completed the approach checklist and checked the flight controls above 10,000 ft. They positioned the aircraft about 15 nautical miles from the airport for the visual approach and sighted the precision approach path indicator at about 10 nautical miles. During the descent they coordinated with air traffic control about emergency services and dangerous goods, and kept the cabin services manager informed.

Why three data sources did not prevent the upset

The A330's flight-control computers received angle-of-attack information from three independent reference units. Angle of attack describes the relationship between the wing and the oncoming airflow and is important to the control system's protections. The computers normally checked the three values for consistency. When one of the normally used values diverged significantly from the other two, the processing algorithm temporarily used a memorised value. This was intended to reject transient bad information while maintaining useful control inputs.

The limitation concerned a particular pattern of data spikes. Multiple spikes from one unit, spaced 1.2 seconds apart, could defeat the algorithm's handling and result in a nose-down elevator command. ADIRU 1 produced that kind of incorrect angle-of-attack information. The other two units operated normally, but the way the computers processed the data still allowed the faulty unit to affect aircraft motion. The accident therefore required the combination of a unit failure and a processing limitation.

The ATSB found that the aircraft manufacturer's development and safety assessment processes had not fully considered frequent data spikes of this kind. The reference unit's own built-in tests did not effectively detect the air-data problem or mark the affected values invalid. Some inertial data were flagged, while air-data values continued to reach other systems as if they were valid. The unit manufacturer's failure mode effects analysis and other development processes had also failed to identify the data-spike failure mode.

The failure that testing could not fully explain

Extensive analysis indicated that the reference unit probably combined a data value from one parameter with the label belonging to another. The final findings describe a likely problem with data packaging and queuing in the central processing module, but the exact origin could not be determined. The affected unit had experienced a previous instance of the data-spike failure mode. That history supported the possibility of a marginal hardware susceptibility exposed by a rare triggering event.

The investigation considered software problems, hardware faults, temperature, vibration and electromagnetic interference from onboard or external sources. Multiple lines of evidence made those proposed triggers unlikely. A high-energy atmospheric particle affecting an integrated circuit remained a possibility, but there was insufficient evidence to establish such a single event effect in this accident. The ATSB could not determine why the unit produced the spikes.

The ATSB also placed the event in its certification context. It considered a more adverse outcome from this design limitation very unlikely and classified the effect as hazardous rather than catastrophic. The failure and flight-control effect were extremely rare in the service experience described by the report. By April 2010, LTN-101 reference units had accumulated over 128 million operating hours, with this failure mode observed on three occasions. Those occurrences involved two A330 aircraft operated by the same airline. Investigators identified no associated factor in the operator's aircraft configuration, operating practices or maintenance practices.

Corrections and the restraint lesson

Airbus issued procedures to isolate the affected reference information after the accident, and regulators subsequently mandated relevant procedural changes. The flight-control algorithms were redesigned, removing the 1.2-second memorisation feature and adding checks for inconsistent or oscillating angle-of-attack information. The final report records that an interim software standard had been fitted across Qantas's A330 fleet by November 2009. The redesigned monitoring checked the consistency and oscillation of each angle-of-attack value. If it detected a problem, the associated air data reference source was rejected for the remainder of the flight. The warning system then suppressed spurious stall warnings associated with that source. Airbus also reviewed the amplitude, duration and frequency of spikes affecting other parameters, and modified several processing algorithms.

The accident also supplied direct evidence about occupant protection. At least sixty passengers were seated without fastening their belts at the first upset. Injury rate and severity were substantially greater among people who were not seated or not belted. The final findings emphasise wearing a belt low and firm whenever seated, even when the seat-belt sign is off. The crew recovered the aircraft and ended the flight at a suitable airport, while the investigation identified changes needed to stop a rare combination of failures from producing the same control response.