December 19, 2011
The Australian Transport Safety Bureau (ATSB) issued the final report of their investigation into an in-flight upset accident involving an Airbus A330 in 2008.
On 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. While the aircraft was in cruise at 37,000 ft, one of the aircraft’s three air data inertial reference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Two minutes later, in response to spikes in angle of attack (AOA) data, the aircraft’s flight control primary computers (FCPCs) commanded the aircraft to pitch down. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment.
Although the FCPC algorithm for processing AOA data was generally very effective, it could not manage a scenario where there were multiple spikes in AOA from one ADIRU that were 1.2 seconds apart. The occurrence was the only known example where this design limitation led to a pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraft manufacturer subsequently redesigned the AOA algorithm to prevent the same type of accident from occurring again.
Each of the intermittent data spikes was probably generated when the ADIRU’s central processor unit (CPU) module combined the data value from one parameter with the label for another parameter. The failure mode was probably initiated by a single, rare type of internal or external trigger event combined with a marginal susceptibility to that type of event within a hardware component. There were only three known occasions of the failure mode in over 128 million hours of unit operation. At the aircraft manufacturer’s request, the ADIRU manufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmission failures.
At least 60 of the aircraft’s passengers were seated without their seat belts fastened at the time of the first pitch-down. The injury rate and injury severity was substantially greater for those who were not seated or seated without their seat belts fastened.
The investigation identified several lessons or reminders for the manufacturers of complex, safety‑critical systems.
March 15, 2010
The European Aviation Safety Agency (EASA) issued an emergency airworthiness directive EAD 2010-0042-E regarding the main fuel pump system and water scavenge system on certain Airbus A330 aircraft.
During a recent in-service event the flight crew of a Trent 700 powered A330 aircraft reported a temporary Engine Pressure Ratio (EPR) shortfall on engine 2 during the take-off phase of the flight. The ENG STALL warning was set. The flight crew followed the standard procedures which included reducing throttle to idle. The engine recovered and provided the demanded thrust level for the remainder of the flight.
Data analysis confirmed a temporary fuel flow restriction and subsequent recovery, and indicated that also engine 1 experienced a temporary fuel flow restriction shortly after the initial event on engine 2, again followed by a full recovery. The engine 1 EPR shortfall was insufficient to trigger any associated warning and was only noted through analysis of the flight data.
No flight crew action was necessary to recover normal performance on this engine. The remainder of the flight was uneventful.
Based on previous industry-wide experience, the investigation of the event has focused on the possibility for ice to temporarily restrict the fuel flow.
While no direct fuel system fault has been identified, the operation of the water scavenge system at Rib 3 cannot be excluded as being a contributory factor.
Testing and analysis are continuing to identify the root cause of the event.
The scenario of ice being shed and causing a temporary blockage in the engine fuel system may lead to a temporary fuel flow restriction to the engine. This may result in a possible engine surge or stall condition, and in the engine not being able to provide the commanded thrust.
Therefore, as a precautionary measure to reduce the possibility of ingesting ice into the engine fuel feed system, this AD requires to:
– deactivate the automatic Standby Fuel Pump Scavenge System, which operates during Taxi and Take-off by removing relays
Functional Item Numbers (FIN) 80QA1 and 80QA2 (this will not affect normal standby pump operation) for aeroplanes identified in the applicability section of this AD and on which this deactivation has not been performed in production through the modification 200801, and
– Prohibit the dispatch with one MAIN Fuel Pump inoperative on all aeroplanes identified in the applicability section of this AD.