Qantas Flight 72
VH-QPG landing on 02L at Singapore Changi Airport
|Date||7 October 2008|
|Summary||In-flight upset, Software error|
|Site||80NM from Learmonth
|Aircraft type||Airbus A330-303|
|Flight origin||Singapore Changi Airport, Singapore|
|Destination||Perth Airport, Australia|
Qantas Flight 72 (QF72) was a scheduled flight from Singapore Changi Airport to Perth Airport on 7 October 2008 that made an emergency landing at Learmonth airport near the town of Exmouth, Western Australia following an inflight accident featuring a pair of sudden uncommanded pitch-down manoeuvres that resulted in serious injuries to many of the occupants. The injuries included fractures, lacerations and spinal injuries. At Learmonth, the plane was met by the Royal Flying Doctor Service and CareFlight, where 14 people were airlifted to Perth for hospitalisation, with 39 others also attending hospital. Two planes were sent by Qantas to Learmonth to collect the remaining passengers and crew. In all, 1 crew member and 11 passengers suffered serious injuries, while 8 crew and 95 passengers suffered minor injuries. The Australian Transport Safety Bureau investigation found fault with one of the aircraft's three Air Data Inertial Reference Units and a previously unknown software design limitation of the Airbus A330's fly by wire flight control primary computer (FCPC).
The accident began at 12:40:28 WST. The aircraft was travelling at around 37,000 feet (11,000 m) when pilots received an electronic message warning them of an irregularity with autopilot and inertial reference systems. The autopilot disengaged automatically, and the aircraft climbed 200 feet (60 m) under manual control. The autopilot was re-engaged when the aircraft returned to the prior selected flight level before the autopilot was disengaged for the remainder of the flight. At 12:42:27 the aircraft made a sudden uncommanded pitch down manoeuvre, recording -0.8 g, reaching 8.4 degrees pitch down and rapidly descending 650 feet (200 m) in about 20 seconds before the pilots were able to return the aircraft to the assigned cruise flight level. At 12:45:08 the aircraft then made a second uncommanded manoeuvre of similar nature, this time reaching +0.2 g, 3.5 degrees pitch down and descending 400 feet (120 m) in about 16 seconds before being returned to level flight. Unrestrained passengers and crew as well as some restrained passengers on board were flung around the cabin or crashed on overhead luggage compartments. The pilots stabilised the plane and declared a state of alert (pan-pan), which was later updated to mayday when the extent of injuries was relayed to the flight crew.
The ATSB investigation is supported by the Australian Civil Aviation Safety Authority (CASA), Qantas, the French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'Aviation Civile (BEA) and Airbus. Copies of data from the aircraft's flight data recorder and cockpit voice recorder were sent to the BEA and Airbus.
The aircraft was equipped with a Northrop Grumman made ADIRS, which investigators sent to the manufacturer in the US for further testing. On 15 January 2009 the EASA issued an Emergency Airworthiness Directive to address the above A330 and A340 Northrop-Grumman ADIRU problem of incorrectly responding to a defective inertial reference.
The Australian Transport Safety Bureau (ATSB) identified in a preliminary report that a fault occurred within the Number 1 Air Data Inertial Reference Unit (ADIRU) and is the "likely origin of the event". The ADIRU (one of three such devices on the aircraft) began to supply incorrect data to the other aircraft systems.
The initial effects of the fault were:
- false stall and overspeed warnings
- loss of attitude information on the Captain's primary flight display
- several Electronic Centralised Aircraft Monitor (ECAM) system warnings
About two minutes later, ADIRU No. 1, which was providing data to the captain's primary flight display, provided very high (and false) indications for the aircraft's angle of attack (AOA), leading to:
- the flight control computers commanding a nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees,
- the triggering of a Flight Control Primary Computer (FCPC) pitch fault.
FCPC design limitation
AOA is a critically important flight parameter, and full-authority flight control systems such as those equipping A330/A340 aircraft require accurate AOA data to function properly. The aircraft was fitted with three ADIRUs to provide redundancy and enable fault tolerance, and the FCPCs used the three independent AOA values to check their consistency. In the usual case, when all three AOA values were valid and consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs for their computations. If either AOA 1 or AOA 2 significantly deviated from the other two values, the FCPCs used a memorised value for 1.2 seconds. The FCPC algorithm was very effective, but it could not correctly manage a scenario where there were multiple spikes in either AOA 1 or AOA 2 that were 1.2 seconds apart.
As with other safety-critical systems, the development of the A330/A340 flight control system during 1991 and 1992 had many elements to minimise the risk of a design error. These included peer reviews, a system safety assessment (SSA), and testing and simulations to verify and validate the system requirements. None of these activities identified the design limitation in the FCPC’s AOA algorithm.
The ADIRU failure mode had not been previously encountered, or identified by the ADIRU manufacturer in its safety analysis activities. Overall, the design, verification and validation processes used by the aircraft manufacturer did not fully consider the potential effects of frequent spikes in data from an ADIRU.
Airbus has stated that they are not aware of a similar incident occurring previously on an Airbus aircraft. Airbus has released an Operators Information Telex to operators of Airbus A330 and A340 aircraft with procedural recommendations and checklists to minimise risk in the event of a similar incident.
The ATSB's continuing accident investigation will include assessment of speculation that possible interference from Naval Communication Station Harold E. Holt or passenger personal electronic devices could have been involved, although based on initial analysis, the Bureau believes these are unlikely to have been of any impact.
The ATSB's final report issued on 19 December 2011 concluded that the accident "occurred due to the combination of a design limitation in the flight control primary computer (FCPC) software of the Airbus A330/Airbus A340, and a failure mode affecting one of the aircraft's three air data inertial reference units (ADIRUs). The design limitation meant that, in a very rare and specific situation, multiple spikes in angle of attack (AOA) data from one of the ADIRUs could result in the FCPCs commanding the aircraft to pitch down."
Subsequent Qantas Flight 71 incident
On 27 December 2008, a Qantas A330-300 aircraft operating from Perth to Singapore was involved in an occurrence approximately 260 nautical miles (480 km) north-west of Perth and 350 nautical miles (650 km) south of Learmonth Airport at 1729 WST while flying at 36,000 feet. At this time, the autopilot disconnected and the crew received an alert indicating a problem with ADIRU Number 1. The crew actioned the revised procedure released by Airbus after the earlier accident and returned to Perth uneventfully. The ATSB will include the incident in their existing accident investigation. The incident again fuelled media speculation regarding the significance of the Harold E. Holt facility, with the Australian and International Pilots Association calling for commercial aircraft to be barred from the area as a precaution until the events are better understood, while the manager of the facility has claimed that it is "highly, highly unlikely" that any interference has been caused.
In the aftermath of the accident, Qantas offered compensation to all passengers. The airline announced it would refund the cost of all travel on their itineraries covering the accident flight, offer a voucher equivalent to a return trip to London applicable to their class of travel and pay for medical expenses arising from the accident. Further compensation claims would be considered on case by case basis, with several passengers from the flight pursuing legal action against Qantas. Some have asserted that they were wearing their seatbelts at the time of the incident and some have questioned Qantas' handling of their cases.
- "2008/40 – Qantas Airbus Incident Media Conference" (Press release). Australian Transport Safety Bureau. 8 October 2008. Retrieved 8 October 2008.
- "2008/40a – ATSB Airbus investigation update" (Press release). Australian Transport Safety Bureau. 9 October 2008. Retrieved 14 October 2008.
- "2008/40b – Qantas Airbus Accident Media Conference" (Press release). Australian Transport Safety Bureau. 10 October 2008. Retrieved 14 October 2008.
- "2008/43 – Qantas Airbus A330 accident Media Conference" (Press release). Australian Transport Safety Bureau. 14 October 2008. Retrieved 14 October 2008.
- Siddique, Haroon (7 October 2008). "Qantas flight makes emergency landing as dozens of passengers injured". The Guardian (London). Retrieved 7 October 2008.
- Knowles, Gabrielle; Strick, Ben; Torre, Giovanne (8 October 2008). "Mayday in WA: Dozens hurt as Qantas jet plunges 8000ft". The West Australian. Retrieved 7 March 2009.[dead link]
- Weber, David (8 October 2008). "Confusion surrounds Qantas emergency landing". AM (Australian Broadcasting Corporation). Retrieved 7 March 2009.
- "In-flight upset, 154 km west of Learmonth, WA, 7 October 2008, VH-QPA, Airbus A330-303 – Interim Factual" (PDF). Aviation Occurrence Investigation AO-2008-070. Australian Transport Safety Bureau. 6 March 2009. Retrieved 7 March 2009.
- Taylor, Rob (8 October 2008). "Computer glitch may have caused Qantas jet plunge". Reuters. Retrieved 8 October 2008.
- "Australian jet plunge injures 40". BBC News. 7 October 2008. Retrieved 8 October 2008.
- Simon Hradecky (7 October 2008). "Accident: Qantas A333 near Learmonth on 7 Oct 2008, sudden inflight upset injures 74 people on board". Aviation Herald.
- "AO-2008-070: In-flight upset, 154 km west of Learmonth, WA, 7 October 2008, VH-QPA, Airbus A330-303". Aviation Safety Investigation Report – Preliminary. Australian Transport Safety Bureau. 14 November 2008. Retrieved 15 November 2008.[dead link]
- "VH-QPA Qantas Airbus A330-303". planespotters.net. Retrieved 9 October 2008.
- "In-flight upset, 154 km west of Learmonth, WA, 7 October 2008, VH-QPA, Airbus A330-303" (PDF). AO-2008-070-Preliminary. Australian Transport Safety Bureau. 14 November 2008. Retrieved 15 November 2008.
- Nicholson, Brendan (9 October 2008). "Data shows Qantas jet in two sudden plunges". The Age (Melbourne). Retrieved 10 October 2008.
- Hannon, Kate (9 October 2008). "Qantas plunge probe 'may take months'". The Canberra Times. Retrieved 12 October 2008.
- "Computer error behind Qantas midair drama". Australian Broadcasting Corporation. 14 October 2008. Retrieved 15 October 2008.
- Steve Creedy (17 October 2008). "US tests on false data sent on Qantas jet over WA". The Australian.
- Emergency Airworthiness Directive No 2009-0012-E[dead link]
- "Computer glitch may be behind Qantas incident: ATSB". Australian Broadcasting Corporation. 8 October 2008. Retrieved 8 October 2008.
- "Qantas flight suffered computer 'irregularity'". The Australian. Australian Associated Press. 8 October 2008. Retrieved 8 October 2008.
- Easdown, Geoff, Bolling, Mary and Dowsley, Anthony and Stanley, Warwick from AAP (8 October 2008). "Qantas plunge jet had computer 'irregularity' say investigators". Herald Sun. Retrieved 8 October 2008.[dead link]
- Butterly, Nick (16 October 2008). "Exmouth base linked to Airbus incident". The West Australian. Retrieved 16 October 2008.[dead link]
- Johnson, Ed (16 October 2008). "Qantas Plunge Investigators to Examine Naval Base Transmissions". Bloomberg. Retrieved 16 October 2008.
- "Qantas Airbus A330 incident, 480km North West of Perth on 27 December 2008" (Press release). Melbourne: Australian Transport Safety Bureau. 2 January 2009. Retrieved 6 January 2009.
- Catanzaro, Joseph (2 January 2009). "Navigation failure again hits Qantas in north-west". The Age (Melbourne).
- "Call for no-go zone after another Qantas forced landing". The Age (Melbourne). 2 January 2009. Retrieved 2 January 2009.
- Hopkin, Michael (7 January 2009). "Exmouth interference 'unlikely'". The Sydney Morning Herald. Retrieved 7 January 2009.
- Bibby, Paul (9 October 2008). "Qantas compo depends on class of seat". The Sydney Morning Herald. Retrieved 9 October 2008.
- Roberts, Greg (6 November 2008). "Couple suing Qantas over plane plunge". The Sydney Morning Herald (AAP). Retrieved 6 November 2008.
- Bibby, Paul (8 November 2008). "Qantas tried to trick me: passenger". The Sydney Morning Herald. Retrieved 8 November 2008.
- Australian Transport Safety Bureau — final report and materials
- Perth Now – photographs of the cabin