1. Aircraft

2. Flight details

3. Investigation
     FCPC design limitation  

4. Final report
    Analysis  Potential trigger types  Conclusion  Subsequent Qantas Flight 71 incident 

5. Compensation

6. Dramatization

7. See also

8. References

9. Further reading

10. External links

Qantas Flight 72 (QF72) was a scheduled flight from Singapore Changi Airport to Perth Airport on 7 October 2008 that made an emergency landing at Learmonth airport near the town of Exmouth, Western Australia following an inflight accident featuring a pair of sudden uncommanded pitch-down manoeuvres that severely injured many of the passengers and crew.^{[1][2][3][4][5]} The injuries included fractures, lacerations and spinal injuries. At Learmonth, the plane was met by the Royal Flying Doctor Service of Australia and CareFlight,^[6][7] where 14 people were airlifted to Perth for hospitalisation, with 39 others also attending hospital.^[8][9][10] Two planes were sent by Qantas to Learmonth to collect the remaining passengers and crew.^[11] In all, one crew member and 11 passengers suffered serious injuries, while eight crew and 99 passengers suffered minor injuries.^[12] The Australian Transport Safety Bureau investigation found a fault with one of the aircraft's three air data inertial reference units and a previously unknown software design limitation of the Airbus A330's fly-by-wire flight control primary computer (FCPC).

Aircraft

VH-QPA was delivered new to Qantas on 26 November 2003, initially as an A330-301. It later had a change in engine type fitted and was re-designated as an Airbus A330-303 in November 2004.^[13]

Flight details

At 09:32 SST on 7 October 2008, Qantas flight 72, with 303 passengers, three flight crew, and nine cabin crew, departed Singapore on a scheduled flight to Perth, Western Australia. By 10:01, the aircraft had reached its cruise altitude of around {{convert|37000|ft|m}} and was maintaining a cruising speed of Mach 0.82.

The incident started at 12:40:26 WST when one of the aircraft’s three air data inertial reference units (ADIRU) started providing incorrect data to the flight computer. In response to the anomalous data, the autopilot disengaged automatically, and a few seconds later, the pilots received electronic messages on the aircraft ECAM, warning them of an irregularity with the autopilot and inertial reference systems, and aural stall and overspeed warnings. During this time, the pilot took control of the aircraft, increasing the altitude to 37,180 ft. The autopilot was then re-engaged and the aircraft started to return to the prior selected flight level. The autopilot was disengaged by the crew after about 15 seconds and would remain disengaged for the remainder of the flight.

At 12:42:27 the aircraft made a sudden uncommanded pitch down manoeuvre, recording {{nowrap|−0.8 g}}, reaching 8.4 degrees pitch down and rapidly descending {{convert|650|ft|m}} in about 20 seconds before the pilots were able to return the aircraft to the assigned cruise flight level. At 12:45:08 the aircraft then made a second uncommanded manoeuvre of similar nature, this time reaching {{nowrap|+0.2 g}}, 3.5 degrees pitch down and descending {{convert|400|ft|m}} in about 16 seconds before being returned to level flight.^[14][15] Unrestrained passengers and crew as well as some restrained passengers were flung around the cabin or crushed by overhead luggage as well as crashing with overhead compartments. The pilots stabilised the plane and declared a state of alert (pan-pan), which was later updated to mayday when the extent of injuries was relayed to the flight crew.^[8][16]

Investigation

The ATSB investigation is supported by the Australian Civil Aviation Safety Authority (CASA), Qantas, the French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'Aviation Civile (BEA) and Airbus.^[3] Copies of data from the aircraft's flight data recorder and cockpit voice recorder were sent to the BEA and Airbus.^[15]

The aircraft was equipped with a Northrop Grumman made ADIRS, which investigators sent to the manufacturer in the United States for further testing.^[17][18]

On 15 January 2009 the EASA issued an emergency airworthiness directive^[19] to address the above A330 and A340 Northrop-Grumman ADIRU problem of incorrectly responding to a defective inertial reference.

The Australian Transport Safety Bureau (ATSB) identified in a preliminary report that a fault occurred within the Number 1 Air Data Inertial Reference Unit (ADIRU) and is the "likely origin of the event". The ADIRU (one of three such devices on the aircraft) began to supply incorrect data to the other aircraft systems.^[20][21][22]

The initial effects of the fault were:^[4]

• false stall and overspeed warnings
• loss of attitude information on the Captain's primary flight display
• several Electronic Centralised Aircraft Monitor (ECAM) system warnings

About two minutes later, ADIRU No. 1, which was providing data to the captain's primary flight display, provided very high (and false) indications for the aircraft's angle of attack (AOA), leading to:^[4]

• the flight control computers commanding a nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees,
• the triggering of a Flight Control Primary Computer (FCPC) pitch fault.

FCPC design limitation

AOA (Angle Of Attack) is a critically important flight parameter, and full-authority flight control systems such as those equipping A330/A340 aircraft require accurate AOA data to function properly. The aircraft was fitted with three ADIRUs to provide redundancy and enable fault tolerance, and the FCPCs used the three independent AOA values to check their consistency. In the usual case, when all three AOA values were valid and consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs for their computations. If either AOA 1 or AOA 2 significantly deviated from the other two values, the FCPCs used a memorised value for 1.2 seconds. The FCPC algorithm was very effective, but it could not correctly manage a scenario where there were multiple spikes in either AOA 1 or AOA 2 that were 1.2 seconds apart.

As with other safety-critical systems, the development of the A330/A340 flight control system during 1991 and 1992 had many elements to minimise the risk of a design error. These included peer reviews, a system safety assessment (SSA), and testing and simulations to verify and validate the system requirements. None of these activities identified the design limitation in the FCPC’s AOA algorithm.

The ADIRU failure mode had not been previously encountered, or identified by the ADIRU manufacturer in its safety analysis activities. Overall, the design, verification and validation processes used by the aircraft manufacturer did not fully consider the potential effects of frequent spikes in data from an ADIRU.

Airbus has stated that it is not aware of a similar incident occurring previously on an Airbus aircraft. Airbus has released an Operators Information Telex to operators of Airbus A330 and A340 aircraft with procedural recommendations and checklists to minimise risk in the event of a similar incident.^[4]

Final report

Analysis

After detailed forensic analysis of the FDR data, the flight control primary computer (FCPC) software and the air data inertial reference unit (ADIRU), it was determined that the CPU of the ADIRU corrupted the angle of attack (AOA) data. The exact nature was that the ADIRU CPU erroneously relabelled the altitude data word so that the binary data that represented 37,012 (the altitude at the time of the incident) would represent an angle of attack of 50.625 degrees. The FCPC then processed the erroneously high AOA data, triggering the high-AOA protection mode, which sent a command to the electrical flight control system (EFCS) to pitch the nose down.^[23]

Potential trigger types

A number of potential trigger types were investigated, including software bugs, software corruption, hardware faults, electromagnetic interference and the secondary high energy particles generated by cosmic rays. Although a definitive conclusion could not be reached, there was sufficient information from multiple sources to conclude that most of the potential triggers were very unlikely to have been involved. A much more likely scenario was that a marginal hardware weakness of some form made the units susceptible to the effects of some type of environmental factor, which triggered the failure mode.^[23]

The ATSB assessment of speculation that possible interference from Naval Communication Station Harold E. Holt or passenger personal electronic devices could have been involved was 'extremely unlikely'.^[23]

Conclusion

The ATSB's final report, issued on 19 December 2011, concluded that the incident "occurred due to the combination of a design limitation in the flight control primary computer (FCPC) software of the Airbus A330/Airbus A340, and a failure mode affecting one of the aircraft's three air data inertial reference units (ADIRUs). The design limitation meant that, in a very rare and specific situation, multiple spikes in angle of attack (AOA) data from one of the ADIRUs could result in the FCPCs commanding the aircraft to pitch down."^[23]

Subsequent Qantas Flight 71 incident

On 27 December 2008, a Qantas A330-300 aircraft operating from Perth to Singapore was involved in an occurrence approximately {{convert|260|NM|km}} north-west of Perth and {{convert|350|NM|km}} south of Learmonth Airport at 1729 WST while flying at 36,000 feet. The autopilot disconnected and the crew received an alert indicating a problem with ADIRU Number 1. The crew actioned the revised procedure released by Airbus after the earlier accident and returned to Perth uneventfully. The ATSB included the incident in their existing accident investigation of Flight 72.^[24]

The incident again fuelled media speculation regarding the significance of the Harold E. Holt facility, with the Australian and International Pilots Association calling for commercial aircraft to be barred from the area as a precaution until the events could be better understood,^[25][26] while the manager of the facility claimed that it was "highly, highly unlikely" that any interference had been caused.^[27]

Compensation

In the aftermath of the accident, Qantas offered compensation to all passengers. The airline announced it would refund the cost of all travel on their itineraries covering the accident flight, offer a voucher equivalent to a return trip to London applicable to their class of travel and pay for medical expenses arising from the accident. Further compensation claims would be considered on a case by case basis,^[28] with several passengers from the flight pursuing legal action against Qantas. One couple asserted that they were wearing their seatbelts at the time of the incident and questioned Qantas' handling of their cases.^[29][30]

Dramatization

The events of Qantas 72 were featured in "Free Fall", (Season 18, Episode 7) in the Canadian TV series Mayday.^[31]

See also

• List of accidents and incidents involving commercial aircraft
• Lion Air Flight 610, Ethiopian Airlines Flight 302 and the subsequent Boeing 737 MAX groundings

References

Further reading

• {{cite news|last1=O'Sullivan|first1=Matt|title=The untold story of QF72: What happens when 'psycho' automation leaves pilots powerless?|url=http://www.smh.com.au/good-weekend/the-untold-story-of-qf72-what-happens-when-psycho-automation-leaves-pilots-powerless-20170510-gw26ae.html|access-date=13 May 2017|work=The Sydney Morning Herald|date=12 May 2017}}

External links

• Australian Transport Safety Bureau — final report and materials
• Perth Now — photographs of the cabin

• Margit
• Margita (disambiguation)
• Margita Kristijan
• Margita (Plandiste)
• Margita Stefanovic
• Margita Stefanovic-Magi
• Margit Bara
• Margit brandt
• Margit Brandt
• Margit Carstensen
• Margit Dajka
• Margit Dany
• Margit Danÿ
• Margit Elek
• Margitesia
• Margit Gréczi
• Margit Hansen-Krone
• Margit hid
• Margit Hvammen
• Margit Kaffka
• Margit Knudsen
• Margit Korondi
• Margit Kovacs
• Margit kovacs
• Margit Kovács