Narrative:
At 09:32 local time (01:32 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore (SIN) on a scheduled passenger transport service to Perth (PER), Australia. On board flight QF72 were 303 passengers, nine cabin crew and three flight crew. At 12:40:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. That was accompanied by various aircraft system failure indications. At 12:42:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down, and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 12:45:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down, and descended about 400 ft during this second event.
At 12:49, the crew made a PAN emergency broadcast to air traffic control, and requested a clearance to divert to and track direct to Learmonth. At 12:54, after receiving advice from the cabin crew of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth Airport, WA (LEA) at 13:50.
At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment. Most of the injuries involved passengers who were seated without their seatbelts fastened.
CONTRIBUTING SAFETY FACTORS:
- There was a limitation in the algorithm used by the A330/A340 flight control primary computers for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple AOA spikes from only one of the three air data inertial reference units could result in a nose-down elevator command. [Significant safety issue]
- When developing the A330/A340 flight control primary computer software in the early 1990s, the aircraft manufacturers system safety assessment and other development processes did not fully consider the potential effects of frequent spikes in the data from an air data inertial reference unit. [Minor safety issue]
- One of the aircrafts three air data inertial reference units (ADIRU 1) exhibited a data-spike failure mode, during which it transmitted a significant amount of incorrect data on air data parameters to other aircraft systems, without flagging that this data was invalid. The invalid data included frequent spikes in angle of attack data. Including the 7 October 2008 occurrence, there have been three occurrences of the same failure mode on LTN-101 ADIRUs, all on A330 aircraft. [Minor safety issue]
- The LTN-101 air data inertial reference unit involved in the occurrence (serial number 4167) also had a previous instance of the data-spike failure mode, indicating that it probably contained a marginal weakness in its hardware, which reduced the resilience of the unit to some form of triggering event.
- For the data-spike failure mode, the built-in test equipment of the LTN-101 air data inertial reference unit was not effective, for air data parameters, in detecting the problem, communicating appropriate fault information, and flagging affected data as invalid. [Minor safety issue]
- The air data inertial reference unit manufacturers failure mode effects analysis and other development processes for the LTN-101 ADIRU did not identify the data-spike failure mode.
CONTRIBUTING SAFETY FACTORS:
- There was a limitation in the algorithm used by the A330/A340 flight control primary computers for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple AOA spikes from only one of the three air data inertial reference units could result in a nose-down elevator command. [Significant safety issue]
- When developing the A330/A340 flight control primary computer software in the early 1990s, the aircraft manufacturers system safety assessment and other development processes did not fully consider the potential effects of frequent spikes in the data from an air data inertial reference unit. [Minor safety issue]
- One of the aircrafts three air data inertial reference units (ADIRU 1) exhibited a data-spike failure mode, during which it transmitted a significant amount of incorrect data on air data parameters to other aircraft systems, without flagging that this data was invalid. The invalid data included frequent spikes in angle of attack data. Including the 7 October 2008 occurrence, there have been three occurrences of the same failure mode on LTN-101 ADIRUs, all on A330 aircraft. [Minor safety issue]
- The LTN-101 air data inertial reference unit involved in the occurrence (serial number 4167) also had a previous instance of the data-spike failure mode, indicating that it probably contained a marginal weakness in its hardware, which reduced the resilience of the unit to some form of triggering event.
- For the data-spike failure mode, the built-in test equipment of the LTN-101 air data inertial reference unit was not effective, for air data parameters, in detecting the problem, communicating appropriate fault information, and flagging affected data as invalid. [Minor safety issue]
- The air data inertial reference unit manufacturers failure mode effects analysis and other development processes for the LTN-101 ADIRU did not identify the data-spike failure mode.
accident date: 07-10-2008
type: Airbus A330-303
registration: VH-QPA
| Status: | Accident investigation report completed and information captured |
| Date: | Tuesday 7 October 2008 |
| Time: | 12:42 |
| Type: |  Airbus A330-303 |
| Operator: | Qantas |
| Registration: | VH-QPA |
| MSN: | 0553 |
| First flight: | 2003 |
| Total airframe hrs: | 20040 |
| Cycles: | 3740 |
| Engines: | 2 General Electric CF6-80E1A3 |
| Crew: | Fatalities: 0 / Occupants: 12 |
| Passengers: | Fatalities: 0 / Occupants: 303 |
| Total: | Fatalities: 0 / Occupants: 315 |
| Aircraft damage: | Minor |
| Aircraft fate: | Repaired |
| Location: | 154 km (96.3 mls) W of Learmonth, WA, Australia ( Indian Ocean)
|
| Phase: | En route (ENR) |
| Nature: | International Scheduled Passenger |
| Departure airport: | Singapore-Changi International Airport (SIN/WSSS), Singapore |
| Perth Airport, WA (PER/YPPH), Australia | |
| Flightnumber: | 72 |
At 09:32 local time (01:32 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore (SIN) on a scheduled passenger transport service to Perth (PER), Australia. On board flight QF72 were 303 passengers, nine cabin crew and three flight crew. At 12:40:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. That was accompanied by various aircraft system failure indications. At 12:42:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down, and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 12:45:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down, and descended about 400 ft during this second event.
At 12:49, the crew made a PAN emergency broadcast to air traffic control, and requested a clearance to divert to and track direct to Learmonth. At 12:54, after receiving advice from the cabin crew of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth Airport, WA (LEA) at 13:50.
At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment. Most of the injuries involved passengers who were seated without their seatbelts fastened.
Probable Cause:
CONTRIBUTING SAFETY FACTORS:
- There was a limitation in the algorithm used by the A330/A340 flight control primary computers for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple AOA spikes from only one of the three air data inertial reference units could result in a nose-down elevator command. [Significant safety issue]
- When developing the A330/A340 flight control primary computer software in the early 1990s, the aircraft manufacturers system safety assessment and other development processes did not fully consider the potential effects of frequent spikes in the data from an air data inertial reference unit. [Minor safety issue]
- One of the aircrafts three air data inertial reference units (ADIRU 1) exhibited a data-spike failure mode, during which it transmitted a significant amount of incorrect data on air data parameters to other aircraft systems, without flagging that this data was invalid. The invalid data included frequent spikes in angle of attack data. Including the 7 October 2008 occurrence, there have been three occurrences of the same failure mode on LTN-101 ADIRUs, all on A330 aircraft. [Minor safety issue]
- The LTN-101 air data inertial reference unit involved in the occurrence (serial number 4167) also had a previous instance of the data-spike failure mode, indicating that it probably contained a marginal weakness in its hardware, which reduced the resilience of the unit to some form of triggering event.
- For the data-spike failure mode, the built-in test equipment of the LTN-101 air data inertial reference unit was not effective, for air data parameters, in detecting the problem, communicating appropriate fault information, and flagging affected data as invalid. [Minor safety issue]
- The air data inertial reference unit manufacturers failure mode effects analysis and other development processes for the LTN-101 ADIRU did not identify the data-spike failure mode.
CONTRIBUTING SAFETY FACTORS:
- There was a limitation in the algorithm used by the A330/A340 flight control primary computers for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple AOA spikes from only one of the three air data inertial reference units could result in a nose-down elevator command. [Significant safety issue]
- When developing the A330/A340 flight control primary computer software in the early 1990s, the aircraft manufacturers system safety assessment and other development processes did not fully consider the potential effects of frequent spikes in the data from an air data inertial reference unit. [Minor safety issue]
- One of the aircrafts three air data inertial reference units (ADIRU 1) exhibited a data-spike failure mode, during which it transmitted a significant amount of incorrect data on air data parameters to other aircraft systems, without flagging that this data was invalid. The invalid data included frequent spikes in angle of attack data. Including the 7 October 2008 occurrence, there have been three occurrences of the same failure mode on LTN-101 ADIRUs, all on A330 aircraft. [Minor safety issue]
- The LTN-101 air data inertial reference unit involved in the occurrence (serial number 4167) also had a previous instance of the data-spike failure mode, indicating that it probably contained a marginal weakness in its hardware, which reduced the resilience of the unit to some form of triggering event.
- For the data-spike failure mode, the built-in test equipment of the LTN-101 air data inertial reference unit was not effective, for air data parameters, in detecting the problem, communicating appropriate fault information, and flagging affected data as invalid. [Minor safety issue]
- The air data inertial reference unit manufacturers failure mode effects analysis and other development processes for the LTN-101 ADIRU did not identify the data-spike failure mode.
Accident investigation:
 |
|
Classification:
Forced landing on runway
Sources:
» SKYbrary Follow-up / safety actions
A number of important safety actions have already been implemented arising from the investigation to date. These include:
1) Following a 14 October 2008 telex, Airbus issued an Operations Engineering Bulletin on 15 October, applicable to all A330 aircraft fitted with Northrop-Grumman ADIRUs which detailed a procedure for flight crew to follow in the event that specified fault indications were observed in order to reduce or eliminate the risk of a future similar in-flight upset event.
2) The aircraft operator has incorporated the material from Airbus in a Flight Standing Order for its A330 operations and has commenced a program of focussed training during simulator sessions and route checks to ensure that flight crew undertaking recurrent or endorsement training are aware of the contents of the Flight Standing Order.
3) On 27 October 2008, the Civil Aviation Safety Authority issued a media release to reinforce the ATSB's message that the occurrence was a timely reminder to 'remain buckled up when seated at all stages of the flight'. EASA issued 1 Airworthiness Directive
EASA issued 3 Emergency Airworthiness Directives
Show all...
1) Following a 14 October 2008 telex, Airbus issued an Operations Engineering Bulletin on 15 October, applicable to all A330 aircraft fitted with Northrop-Grumman ADIRUs which detailed a procedure for flight crew to follow in the event that specified fault indications were observed in order to reduce or eliminate the risk of a future similar in-flight upset event.
2) The aircraft operator has incorporated the material from Airbus in a Flight Standing Order for its A330 operations and has commenced a program of focussed training during simulator sessions and route checks to ensure that flight crew undertaking recurrent or endorsement training are aware of the contents of the Flight Standing Order.
3) On 27 October 2008, the Civil Aviation Safety Authority issued a media release to reinforce the ATSB's message that the occurrence was a timely reminder to 'remain buckled up when seated at all stages of the flight'. EASA issued 1 Airworthiness Directive
EASA issued 3 Emergency Airworthiness Directives
Show all...
Photos
accident date: 07-10-2008
type: Airbus A330-303
registration: VH-QPA
Video, social media
Map
This map shows the airport of departure and the intended destination of the flight. The line between the airports does not display the exact flight path.
Distance from Singapore-Changi International Airport to Perth Airport, WA as the crow flies is 3892 km (2432 miles).
Distance from Singapore-Changi International Airport to Perth Airport, WA as the crow flies is 3892 km (2432 miles).
This information is not presented as the Flight Safety Foundation or the Aviation Safety Network’s opinion as to the cause of the accident. It is preliminary and is based on the facts as they are known at this time.
The Aviation Safety Network is an exclusive service provided by:
Quick Links:
| ASN Home | Send Correction / Feedback |
| FSF Home | Disclaimer | Copyright |
| Contact Us | Privacy Policy |
| Press / Media |
CONNECT WITH US:
©2023 Flight Safety Foundation