Qantas A330 upset caused by inertial reference system fault

Australian investigators have come out with their initial findings on the in-flight upset of the Qantas A330 last week. The cause is so far narrowed down to a fault in inertial reference system in the number one air data inertial reference unit (ADIRU) which had predictably nasty results. Turbulence had nothing to do with it.

The end result was that the crew was trying to control a fly-by-wire aircraft which didn’t ‘understand’ what it was doing or what was happening to it (the aircraft I mean, not the crew). There were some slightly odd comments floating around the web last week to the effect that this was not really such a bad situation. I’d suggest that in fact the crew’s performance in the circumstances was absolutely outstanding.

There’s an unconfirmed suggestion that the aircraft was overstressed with negative g. I’m not surprised to hear that.

Below is the full text of the ATSB press release. And here is the audio of the press conference.


Qantas Airbus A330 accident Media Conference

14 October 2008

The Australian Transport Safety Bureau’s investigation into the accident involving an Airbus A330-300 aircraft operating as Qantas flight 72 on a flight from Singapore to Perth on 7 October 2008 is progressing well. The ATSB has scheduled the media conference this evening to coincide with the release of an Operators Information Telex/Flight Operations Telex, which is being sent by Airbus to operators of all Airbus aircraft. The aim of that telex is to:

  • update operators on the factors identified to date that led to the accident involving QF72,
  • provide operational recommendations to mitigate risk in the event of a reoccurrence of the situation which occurred on QF72.

To assist in understanding the following information, I would just like to refer you quickly to the diagrams projected on the screen specifically, the term angle of attack which refers to the difference in angle between the aircraft and its control surfaces, and the air stream as the aircraft moves through the air.

The next diagram is a simple representation of the aircraft and the components relevant to this explanation, which include the angle of attack sensors located on the outside of the aircraft, the Air Data Inertial Reference Units (ADIRUs), of which there are three, located in the avionics compartment inside the aircraft, the Flight Control Primary Computers of which there are also three located in the avionics compartment, and the elevators, located on the aircrafts horizontal stabiliser. In the context of this occurrence, the angle of attack sensors send raw data to the ADIRUs, which provide processed angle of attack information to the Flight Control Primary Computers, which in turn command the elevator position.

Returning to the circumstances of the 7 October flight, preliminary analysis of the Flight Data Recorder data, Post Flight Report data and Built-in Test Equipment data has enabled the investigation to establish a preliminary sequence of events this information is also contained in the Airbus telex.

The aircraft was flying at FL 370 or 37, 000 feet with Autopilot and Auto-thrust system engaged, when an Inertial Reference System fault occurred within the Number-1 Air Data Inertial Reference Unit (ADIRU 1), which resulted in the Autopilot automatically disconnecting. From this moment, the crew flew the aircraft manually to the end of the flight, except for a short duration of a few seconds, when the Autopilot was reengaged. However, it is important to note that in fly by wire aircraft such as the Airbus, even when being flown with the Autopilot off, in normal operation, the aircrafts flight control computers will still command control surfaces to protect the aircraft from unsafe conditions such as a stall.

The faulty Air Data Inertial Reference Unit continued to feed erroneous and spike values for various aircraft parameters to the aircrafts Flight Control Primary Computers which led to several consequences including:

  • false stall and overspeed warnings

  • loss of attitude information on the Captain’s Primary Flight Display

  • several Electronic Centralised Aircraft Monitoring system warnings.

About 2 minutes after the initial fault, ADIRU 1 generated very high, random and incorrect values for the aircrafts angle of attack.

These very high, random and incorrect values of the angle attack led to:

  • the flight control computers commanding a nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees,

  • the triggering of a Flight Control Primary Computer pitch fault.

The crew’s timely response led to the recovery of the aircraft trajectory within seconds. During the recovery the maximum altitude loss was 650 ft.

The Digital Flight Data Recorder data show that ADIRU 1 continued to generate random spikes and a second nose-down aircraft movement was encountered later on, but with less significant values in terms of aircraft’s trajectory.

At this stage of the investigation, the analysis of available data indicates that the ADIRU 1 abnormal behaviour is likely as the origin of the event.

The aircraft contains very sophisticated and highly reliable systems. As far as we can understand, this appears to be a unique event and Airbus has advised that it is not aware of any similar event over the many years of operation of the Airbus.

Airbus has this evening, Australian time, issued an Operators Information Telex reflecting the above information. The telex also foreshadows the issue of Operational Engineering Bulletins and provides information relating to operational recommendations to operators of A330 and A340 aircraft fitted with the type of ADIRU fitted to the accident aircraft. Those recommended practices are aimed at minimising risk in the unlikely event of a similar occurrence. That includes guidance and checklists for crew response in the event of an Inertial Reference System failure.

Meanwhile, the ATSB’s investigation is ongoing and will include:

  • Download of data from the aircraft’s three ADIRUs and detailed examination and analysis of that data. Arrangements are currently being made for the units to be sent to the component manufacturer’s facilities in the US as soon as possible and for ATSB investigators to attend and help with that testing, along with representatives from the US National Transportation Safety Board, The French Bureau dEnquêtes et dAnalyses (BEA) and Airbus.

  • In addition, investigators have been conducting a detailed review of the aircraft’s maintenance history, including checking on compliance with relevant Airworthiness Directives, although initial indications are that the aircraft met the relevant airworthiness requirements.

  • Work is also ongoing to progress interviews, which will include with injured passengers to understand what occurred in the aircraft cabin. The ATSB plans to distribute a survey to all passengers.

There has been close and frequent communication between the ATSB, Qantas, Airbus, the BEA, and CASA. That close communication will continue as the investigation progresses to ensure that any additional safety action can be instigated as soon as possible should critical safety factors be identified. The ATSB expects to publish a Preliminary Factual report in about 30 days from the date of the accident.

, , , ,

3 Responses to Qantas A330 upset caused by inertial reference system fault

  1. sean October 17, 2008 at 3:02 pm #

    What I don’t understand in this situation is, when there are triple redundant systems performing data processing in fly-by-wire componentry, the systems are usually set up to perform voting to filter out faults coming from a single box. I.e., Box #1 says AOA of 5 deg, Box #2 says AOA of 25 deg, and Box #3 says AOA of 5 deg. The three values of 5, 25, and 5 are compared, the outlier is noted, a fault condition is presented, and the flight control computer acts based on the values from Box #1 and #3 until the fault on Box #2 can be cleared.

    Perhaps Airbus averages the values instead of voting? I can’t understand how the faulty data in ADIRU 1 could have still created the mishap unless there is a corresponding design flaw in the flight control logic.

  2. Tom hadley January 8, 2009 at 1:27 pm #

    Qantas nose dive

    I am not an aeronautical person but I understand that he ADIRU operate independently once set to a datum. Does any one know if that is a non automatic procedure at the commencement of a flight or does it continually poll for updates to the datum ? The military base near these incidents is run by Boeing at the moment and is described as the most powerful radio transmitter in the Southern hemisphere. It seems to me that if my little laptop or mobile phone can interfere with navigation in an aircraft that “most powerful radio transmitter in the Southern hemisphere” might have some effect ?

    I quote from the local council’s boast about the base when it was run by the US Navy “The power plant is one of the largest presently operated by the US Navy. It is made up of six diesel engines with each possessing the capability to produce 3,000,000 watts of power. “

  3. DragonVale Hack September 4, 2013 at 7:03 am #

    Hello it’s me, I am also visiting this web page daily, this web site is truly pleasant and
    the visitors are really sharing pleasant thoughts.

Leave a Reply