Qantas Flight 72

Qantas Flight 72 was a scheduled flight from Singapore Changi Airport to Perth Airport. On 7 October 2008, the Flight 72 made an emergency landing at Learmonth Airport near the town of Exmouth, Western Australia following an inflight accident that included two sudden, uncommanded pitch-down maneuvers that caused severe injuries -- including fractures, lacerations and spinal injuries -- to several of the passengers and crew. At Learmonth, the plane was met by the Royal Flying Doctor Service of Australia and CareFlight. Fourteen people were airlifted to Perth for hospitalization, with 39 others also attending hospital. In all, one crew member and 11 passengers suffered serious injuries, while eight crew and 99 passengers suffered minor injuries. The Australian Transport Safety Bureau (ATSB) investigation found a fault with one of the aircraft's three air data inertial reference units (ADIRUs) and a previously unknown software design limitation of the Airbus A330's fly-by-wire flight control primary computer (FCPC).

Aircraft
The aircraft operating Flight 72, VH-QPA, serial number 0553, made its first flight on 11 October 2003 was delivered new to Qantas on 26 November 2003, initially as an A330-301. In November 2004, it was re-fitted with two General Electric CF6-80E1A3 engines, and was re-designated as an Airbus A330-303. At the time of the accident the airframe had accumulated a total of 20040 hours and 3740 cycles (takeoffs and landings).

Crew
The crew was led by Captain Kevin Sullivan (53), a former US Navy (1977-1986) pilot. The first officer was Peter Lipsett, and the second officer was Ross Hales. In addition to the three flight-deck crew members, there were nine cabin crew members and 303 passengers, for a total of 315 people on board. Captain Sullivan had 13,592 flight hours, including 2,453 hours on the Airbus A330. First Officer Lipsett had 11,650 flight hours, with 1,870 of them on the Airbus A330. Second Officer Hales had 2,070 flight hours, with 480 of them on the Airbus A330.

Flight details
On 7 October 2008 at 09:32 SST, Qantas Flight 72, with 315 people on board, departed Singapore on a scheduled flight to Perth, Western Australia. By 10:01 WST, the aircraft had reached its cruising altitude of around 37,000 feet (11,000 m) and was maintaining a cruising speed of Mach 0.82.

At 12:39, Captain Sullivan returns to the flight deck for his shift; FO Lipsett leaves the flight deck and begins his rest break with a visit to the forward galley for coffee and a chat with the customer service manager. In the rear galley were four deadheading crew members (including Fuzzy Maiava) employed by Jetconnect, a wholly owned subsidiary of Qantas based in Auckland, New Zealand. They are joined by two off-duty Qantas employees, Peter and Diana Casey returning from their holiday.

The incident started at 12:40:26, when one of the aircraft's three air data inertial reference units (ADIRUs) started providing incorrect data to the flight computer. In response to the anomalous data, the autopilot disengaged automatically. A few seconds later, the pilots received electronic messages on the aircraft's ECAM, warning them of an irregularity with the autopilot. During this time, the captain began to control the aircraft manually. A second autopilot was engaged and the aircraft started to return to the prior selected flight level. Before the flight crew was able to find the cause of the irregularity, contradicting audible stall and overspeed warnings sounded in the flight deck. The altitude, airspeed and navigation displays on the captains side became unusable. The autopilot was disengaged by the crew after about 15 seconds and would remain disengaged for the remainder of the flight. The flight crew made a call to the forward galley and requested that FO Lipsett return to the flight deck to help manage the situation.

At 12:42:27, the flight crew noticed a slight change of the aircraft's nose attitude. In the rear galley, Maiava and the Caseys notice a change in engine pitch which normally signaled the commencement of a descent. They were confused; there were still two hours of flight time before Flight 72 would reach it's destination. Almost immediately after, the aircraft made a sudden, uncommanded pitch down maneuver, experiencing –0.8 g, reaching 8.4 degrees pitch down and rapidly descending 650 feet (200 m). The captain's sidestick inputs were blocked for 1.8 seconds during this maneuver. In the flight deck, the first officer's flight manuals were slammed into the ceiling by the negative g-forces and were thrown to the rear of the cockpit, where they exploded on impact, scattering their contents on the floor. Passengers and crew who were not strapped in were propelled into the ceiling, causing multiple injuries. In the back galley where the highest g-forces were generated, Maiava and the Caseys were slammed into the ceiling with a much greater force, knocking them unconscious. Twenty seconds later, the pilots were able to return the aircraft to the assigned cruise flight level, FL370. Although the flight crew tried their best to be gentle, passengers pinned to the ceiling came crashing down as positive g-force was restored by the aircraft's recovery maneuver.

At 12:45:08, the aircraft made a second uncommanded maneuver of a similar nature (during which the captain's sidestick inputs were blocked for 2.8 seconds), this time causing an acceleration of +0.2 g, a 3.5 degree down angle, and a loss of altitude of 400 feet (120 m); the flight crew was able to re-establish the aircraft's assigned level flight 16 seconds later. Unrestrained (and even some restrained) passengers and crew were flung around the cabin or crushed by overhead luggage, as well as crashing with and through overhead compartment doors. The pilots stabilized the plane and declared a state of alert, which was later updated to mayday when the extent of injuries was relayed to the flight crew.

Investigation
The ATSB investigation was supported by the Australian Civil Aviation Safety Authority (CASA), Qantas, the French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'Aviation Civile (BEA) and Airbus. Copies of data from the aircraft's flight data recorder and cockpit voice recorder were sent to the BEA and Airbus.

The aircraft was equipped with an ADIRU manufactured by Northrop Grumman; investigators sent the unit to Northrop Grumman in the United States for further testing. On 15 January 2009, the European Aviation Safety Agency (EASA) issued an emergency airworthiness directive to address the problem of A330 and A340 aircraft, equipped with the Northrop-Grumman ADIRUs, incorrectly responding to a defective inertial reference.

In a preliminary report, the Australian Transport Safety Bureau (ATSB) identified a fault occurring within the Number 1 ADIRU as the "likely origin of the event"; the ADIRU, one of three such devices on the aircraft, began to supply incorrect data to the other aircraft systems.

The initial effects of the fault were:


 * false (contradictory) stall and overspeed warnings
 * loss of altitude information on the captain's primary flight display
 * several Electronic Centralized Aircraft Monitor (ECAM) system warnings

About two minutes later, ADIRU No. 1, which was providing data to the captain's primary flight display, provided very high (and false) indications for the aircraft's angle of attack (AOA), leading to:


 * the flight control computers commanding a nose-down aircraft movement, resulting in the aircraft pitching down to a maximum of about 8.5 degrees, and
 * the triggering of a Flight Control Primary Computer (FCPC) pitch fault.

FCPC faulty design
Angle of attack (AOA) is a critically important flight parameter, and full-authority flight control systems, such as those equipping A330/A340 aircraft, require accurate AOA data to function properly. The aircraft was fitted with three ADIRUs to provide redundancy for fault tolerance, and the FCPCs used the three independent AOA values to check their consistency. In the usual case, when all three AOA values were valid and consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs for their computations. If either AOA 1 or AOA 2 significantly deviated from the other two values, the FCPCs used a memorized value for 1.2 seconds. The FCPC algorithm was very effective, but it could not correctly manage a scenario where there were multiple spikes in either AOA 1 or AOA 2 that were 1.2 seconds apart.

As with other safety-critical systems, the development of the A330/A340 flight control system during 1991 and 1992 had many elements to minimise the risk of a design error. These included peer reviews, a system safety assessment (SSA), and testing and simulations to verify and validate the system requirements. None of these activities identified the design limitation in the FCPC's AOA algorithm.

The ADIRU failure mode had not been previously encountered, or identified by the ADIRU manufacturer in its safety analysis activities. Overall, the design, verification and validation processes used by the aircraft manufacturer did not fully consider the potential effects of frequent spikes in data from an ADIRU.

Airbus stated that it was not aware of a similar incident occurring previously on an Airbus aircraft. It released an Operators Information Telex to operators of A330 and A340 aircraft with procedural recommendations and checklists to minimise risk in the event of a similar incident.

Analysis
After detailed forensic analysis of the FDR, the FCPC software, and the ADIRU, it was determined that the CPU of the ADIRU corrupted the angle of attack (AOA) data. The exact nature of the corruption was that the ADIRU CPU erroneously re-labelled the altitude data word so that the binary data that represented 37,012 (the altitude at the time of the incident) would represent an angle of attack of 50.625 degrees. The FCPC then processed the erroneously high AOA data, triggering the high-AOA protection mode, which sent a command to the electrical flight control system (EFCS) to pitch the nose down.

Potential trigger types
A number of potential trigger types were investigated, including software bugs, software corruption, hardware faults, electromagnetic interference and the secondary high-energy particles generated by cosmic rays. Although a definitive conclusion could not be reached, there was sufficient information from multiple sources to conclude that most of the potential triggers were very unlikely to have been involved. A much more likely scenario was that a marginal hardware weakness of some form made the units susceptible to the effects of some type of environmental factor, which triggered the failure mode.

The ATSB assessment of speculation that possible interference from Naval Communication Station Harold E. Holt or passenger personal electronic devices could have been involved was 'extremely unlikely'.

Conclusion
The ATSB's final report, issued on 19 December 2011, concluded that the incident "occurred due to the combination of a design limitation in the flight control primary computer (FCPC) software of the Airbus A330/A340, and a failure mode affecting one of the aircraft’s three air data inertial reference units (ADIRUs). The design limitation meant that, in a very rare and specific situation, multiple spikes in angle of attack (AOA) data from one of the ADIRUs could result in the FCPCs commanding the aircraft to pitch down."

Subsequent Qantas Flight 71 incident
On 27 December 2008, a Qantas A330-300 aircraft operating from Perth to Singapore was involved in an occurrence approximately 260 nautical miles (480 km) north-west of Perth and 350 nautical miles (650 km) south of Learmonth Airport at 1729 WST, while flying at FL360. The autopilot disconnected and the crew received an alert indicating a problem with ADIRU #1. The crew performed the revised procedure released by Airbus after the earlier accident and returned to Perth uneventfully. The ATSB included the incident in their existing accident investigation of Flight 72. The incident again fueled media speculation regarding the significance of the aforementioned Harold E. Holt facility, with the Australian and International Pilots Association calling for commercial aircraft to be barred from the area as a precaution until the events could be better understood, while the manager of the facility claimed that it was "highly, highly unlikely" that any interference had been caused.

Aftermath
VH-QPA sustained minor damage; it was repaired and later returned to service with Qantas.

Compensation
In the aftermath of the accident, Qantas offered compensation to all passengers. The airline announced it would refund the cost of all travel on their itineraries covering the accident flight, offer a voucher equivalent to a return trip to London applicable to their class of travel and pay for medical expenses arising from the accident. Further compensation claims would be considered on a case-by-case basis, with several passengers from the flight pursuing legal action against Qantas. One couple asserted that they were wearing their seatbelts at the time of the incident and questioned Qantas' handling of their cases. Permanently injured flight attendant Fuzzy Maiava was advised not to take an NZ$35,000 compensation payment from Qantas so that he could take part in a class action lawsuit against Airbus and Northrop Grumman. However, the case was dismissed on procedural grounds, leaving Maiava without compensation. He remains unable to work or drive a vehicle.