QF 72 Diverted to Learmonth

[Edward Terry]

The first Qantas crews to move to the A380 had to have been on the A330 beforehand, to become acquainted with the 'Airbus philosophy'.

[Jarrad Wadmore]

'Airbus philosophy'.

What's it doing next?

[Radi K]

Originally Posted by Jarrad Wadmore

What's it doing next?

No, what's it doing now?

[Kelvin R]

I just heard on the ABC News (breaking news at end of weather) that Airbus have reported that the dive was due to auto-pilot failure and a warning has now been sent to pilots world wide.

[Nigel C]

From www.news.com.au

b[]Computer fault caused Qantas plunge[/b]
October 14, 2008 07:47pm

A COMPUTER fault caused the autopilot system to be overridden, sending a Qantas plane into a mid-air plunge over Western Australia last week, authorities said tonight.

The air data computer - or inertial reference system - for the Airbus A330-300 sent erroneous information to the flight control computer causing the autopilot to disconnect, the Australian Transport Safety Bureau (ATSB) said.

More than 70 people on Qantas flight QF72 from Singapore to Perth were injured on Tuesday last week when the Airbus, carrying 303 passengers and 10 crew, suddenly dropped altitude.

People were hurled around the cabin and the pilot was forced to make an emergency landing in Western Australia's north.

[Robert S]

http://www.atsb.gov.au/newsroom/2008...e/2008_43.aspx

In the Q&A that exists in the audio recording, it was stated that the aircraft has returned to Sydney this evening. They also clarified that the initial gradual increase in altitude occured after the autopilot first disengaged (and therefore while the aircraft was being flown manually). The autopilot was re-engaged and the aircraft returned to the selected altitude. The autopilot was then turned off, before the first of the pitch down incidents.

From my reading of it, the dodgy data coming out of the Air Data Inertial Reference Unit and into Flight Control Primary Computers caused them to believe the aircraft was operating with an angle of attack well outside of its flight envelope (and in a stall) and hence, being a Fly-By-Wire aircraft, took swift "corrective" action to bring the nose down. Except of course this wasn't corrective at all and took the aircraft out of stable level flight.

[Philip Argy]

Here's an extract of the salient parts of the ATSB media release:

The aircraft was flying at FL 370 or 37, 000 feet with Autopilot and Auto-thrust system engaged, when an Inertial Reference System fault occurred within the Number-1 Air Data Inertial Reference Unit (ADIRU 1), which resulted in the Autopilot automatically disconnecting. From this moment, the crew flew the aircraft manually to the end of the flight, except for a short duration of a few seconds, when the Autopilot was reengaged. However, it is important to note that in fly by wire aircraft such as the Airbus, even when being flown with the Autopilot off, in normal operation, the aircrafts flight control computers will still command control surfaces to protect the aircraft from unsafe conditions such as a stall.
The faulty Air Data Inertial Reference Unit continued to feed erroneous and spike values for various aircraft parameters to the aircrafts Flight Control Primary Computers which led to several consequences including:

• false stall and overspeed warnings
• loss of attitude information on the Captain's Primary Flight Display
• several Electronic Centralised Aircraft Monitoring system warnings.

About 2 minutes after the initial fault, ADIRU 1 generated very high, random and incorrect values for the aircrafts angle of attack.
These very high, random and incorrect values of the angle attack led to:

• the flight control computers commanding a nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees,
• the triggering of a Flight Control Primary Computer pitch fault.

The crew's timely response led to the recovery of the aircraft trajectory within seconds. During the recovery the maximum altitude loss was 650 ft.
The Digital Flight Data Recorder data show that ADIRU 1 continued to generate random spikes and a second nose-down aircraft movement was encountered later on, but with less significant values in terms of aircraft's trajectory.
At this stage of the investigation, the analysis of available data indicates that the ADIRU 1 abnormal behaviour is likely as the origin of the event.
The aircraft contains very sophisticated and highly reliable systems. As far as we can understand, this appears to be a unique event and Airbus has advised that it is not aware of any similar event over the many years of operation of the Airbus.
Airbus has this evening, Australian time, issued an Operators Information Telex reflecting the above information. The telex also foreshadows the issue of Operational Engineering Bulletins and provides information relating to operational recommendations to operators of A330 and A340 aircraft fitted with the type of ADIRU fitted to the accident aircraft. Those recommended practices are aimed at minimising risk in the unlikely event of a similar occurrence. That includes guidance and checklists for crew response in the event of an Inertial Reference System failure.

The aspect that I find alarming is why ADIRU-1 input and output is not compared with ADIRU-2 and ADIRU-3 and any inconsistency treated as the bais for concluding that something is wrong with one of them, or at least alerting the crew to that possibility. What's the point of having redundant systems if they don't take over when one is faulty or don't detect when one is faulty. The rigour with which these avionics are stress tested is inadequate - we've seen too many examples of faults that, however rare, still reflect a permutation of conditions not tested. To me that must remain unacceptable.

I don't want to name any component manufacturer here but there is one whose name seems to crop up too frequently in my opinion.

[Robert S]

Originally Posted by Philip Argy

The aspect that I find alarming is why ADIRU-1 input and output is not compared with ADIRU-2 and ADIRU-3 and any inconsistency treated as the bais for concluding that something is wrong with one of them, or at least alerting the crew to that possibility.

This is apparently the cause of the autopilot disconnecting automatically, but it does raise those questions as to why the FBW still kicked in this way.

[Philip Argy]

If the system disconnects autopilot because it senses that it has a fault, why isn't that fault also the basis on which its ability to command the aircraft contrary to the manual commands of the crew also disabled - that is just a fundamental logic flaw in the programming which ought to have been picked up in avionics testing.

I hope the public (and media) realise that this vindicates Qantas and that the skilled actions of the crew in the face of the erroneous stall and overspeed warnings, etc they were getting from the faulty avionics was really first rate.

[Ash W]

Originally Posted by Philip Argy

...
The aspect that I find alarming is why ADIRU-1 input and output is not compared with ADIRU-2 and ADIRU-3 and any inconsistency treated as the bais for concluding that something is wrong with one of them, or at least alerting the crew to that possibility. What's the point of having redundant systems if they don't take over when one is faulty or don't detect when one is faulty. The rigour with which these avionics are stress tested is inadequate - we've seen too many examples of faults that, however rare, still reflect a permutation of conditions not tested. To me that must remain unacceptable.
...

It is not easy to test a piece of equipment or software for every possible permutation. Even simple things can have millions of combinations.

The main thing is there are back-ups or procedures to follow when things go wrong. Sure some people got hurt by what appears to be a first for this type, but the plane and it's passengers still made it to the ground in one piece.