Misplaced Pages

Qantas Flight 72

VH-QPA, the aircraft involved, pictured in 2017
Accident
Date	7 October 2008 (2008-10-07)
Summary	In-flight upset due to software error resulting in two pitch-downs
Site	Indian Ocean; 80NM from Learmonth 22°14′06″S 114°05′18″E / 22.23500°S 114.08833°E / -22.23500; 114.08833
Aircraft
Aircraft type	Airbus A330-303
Aircraft name	Kununurra
Operator	Qantas
IATA flight No.	QF72
ICAO flight No.	QFA72
Call sign	QANTAS 72
Registration	VH-QPA
Flight origin	Singapore Changi Airport, Singapore
Destination	Perth Airport, Australia
Occupants	315
Passengers	303
Crew	12
Fatalities	0
Injuries	119
Survivors	315

Qantas Flight 72 (QF72) was a scheduled flight from Singapore Changi Airport to Perth Airport by an Airbus A330. On 7 October 2008, the flight made an emergency landing at Learmonth Airport near the town of Exmouth, Western Australia, following an inflight accident that included a pair of sudden, uncommanded pitch-down manoeuvres that caused severe injuries—including fractures, lacerations and spinal injuries—to several of the passengers and crew. At Learmonth, the plane was met by the Royal Flying Doctor Service of Australia and CareFlight. Fourteen people were airlifted to Perth for hospitalisation, with thirty-nine others also attending hospital. In all, one crew member and eleven passengers suffered serious injuries, while eight crew and ninety-nine passengers suffered minor injuries. The Australian Transport Safety Bureau (ATSB) investigation found a fault with one of the aircraft's three air data inertial reference units (ADIRUs) and a previously unknown software design limitation of the Airbus A330's fly-by-wire flight control primary computer (FCPC).

Background

The aircraft involved was an Airbus A330-303 registered as VH-QPA.

The crew was led by Captain Kevin Sullivan (53), a former US Navy (1977–1986) pilot who had moved to Australia. The first officer was Peter Lipsett, and the second officer was Ross Hales. Captain Sullivan had 13,592 flight hours, including 2,453 hours on the Airbus A330. First Officer Lipsett had 11,650 flight hours, with 1,870 of them on the Airbus A330. Second Officer Hales had 2,070 flight hours, with 480 of them on the Airbus A330.

In addition to the three flight-deck crew members, there were nine cabin crew members and 303 passengers, for a total of 315 people on board.

Flight details

On 7 October 2008 at 09:32 SST, Qantas Flight 72, with 315 people on board, departed Singapore on a scheduled flight to Perth, Western Australia. By 10:01, the aircraft had reached its cruising altitude of around 37,000 feet (11,000 m) and was maintaining a cruising speed of Mach 0.82.

The incident started at 12:40:26 WST, when one of the aircraft's three air data inertial reference units (ADIRUs) started providing incorrect data to the flight computer. In response to the anomalous data, the autopilot disengaged automatically. A few seconds later, the pilots received electronic messages on the aircraft's electronic centralised aircraft monitor, warning them of an irregularity with the autopilot and inertial reference systems, and contradictory audible stall and overspeed warnings. During this time, the captain began to control the aircraft manually. The autopilot was then re-engaged and the aircraft started to return to the prior selected flight level. The autopilot was disengaged by the crew after about 15 seconds and remained disengaged for the remainder of the flight.

At 12:42:27, the aircraft made a sudden, uncommanded pitch-down manoeuvre, experiencing −0.8 g, reaching 8.4 degrees pitch down and rapidly descending 650 feet (200 m). Twenty seconds later, the pilots were able to return the aircraft to the assigned cruise flight level, FL370. At 12:45:08, the aircraft made a second uncommanded manoeuvre of a similar nature, this time causing an acceleration of +0.2 g, a 3.5 degree down angle, and a loss of altitude of 400 feet (120 m); the flight crew was able to re-establish the aircraft's assigned level flight 16 seconds later. Unrestrained (and even some restrained) passengers and crew were flung around the cabin or crushed by overhead luggage, as well as crashing with and through overhead-compartment doors. The pilots stabilised the plane and declared a state of alert, which was later updated to mayday when the extent of injuries was relayed to the flight crew.

Investigation

The Australian Transport Safety Bureau (ATSB) investigation was supported by the Australian Civil Aviation Safety Authority, Qantas, the French Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA) and Airbus. Copies of data from the aircraft's flight data recorder and cockpit voice recorder were sent to the BEA and Airbus.

The aircraft was equipped with an air data inertial reference unit (ADIRU) manufactured by Northrop Grumman; investigators sent the unit to Northrop Grumman in the United States for further testing. On 15 January 2009, the European Aviation Safety Agency (EASA) issued an emergency airworthiness directive to address the problem of A330 and A340 aircraft, equipped with the Northrop-Grumman ADIRUs, incorrectly responding to a defective inertial reference.

In a preliminary report, the ATSB identified a fault occurring within the number-one ADIRU as the "likely origin of the event"; the ADIRU, one of three such devices on the aircraft, began to supply incorrect data to the other aircraft systems.

The initial effects of the fault were:

• False (contradictory) stall and overspeed warnings
• Loss of altitude information on the captain's primary flight display
• Several electronic centralised aircraft monitor system warnings

About two minutes later, ADIRU no. 1, which was providing data to the captain's primary flight display, provided very high (and false) indications for the aircraft's angle of attack (AOA), leading to:

• The flight control computers commanding a nose-down aircraft movement, resulting in the aircraft pitching down to a maximum of about 8.5 degrees
• The triggering of a flight-control primary computer (FCPC) pitch fault.

FCPC faulty design

AOA is a critically important flight parameter, and full-authority flight control systems, such as those equipping A330/A340 aircraft, require accurate AOA data to function properly. The aircraft was fitted with three ADIRUs to provide redundancy for fault tolerance, and the FCPCs used the three independent AOA values to check their consistency. In the usual case, when all three AOA values were valid and consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs for their computations. If either AOA 1 or AOA 2 significantly deviated from the other two values, the FCPCs used a memorised value for 1.2 seconds. The FCPC algorithm was very effective, but it could not correctly manage a scenario where multiple spikes occurred in either AOA 1 or AOA 2 that were 1.2 seconds apart—that is, if the 1.2-second period of use of the memorised value happened to end while another spike was happening.

As with other safety-critical systems, the development of the A330/A340 flight-control system during 1991 and 1992 had many elements to minimise the risk of a design error, including peer reviews, a system safety assessment (SSA), and testing and simulations to verify and validate the system requirements. None of these activities identified the design limitation in the FCPC's AOA algorithm.

The ADIRU failure mode had not been previously encountered, or identified by the ADIRU manufacturer in its SSA activities. Overall, the design, verification and validation processes used by the aircraft manufacturer did not fully consider the potential effects of frequent spikes in data from an ADIRU.

Airbus stated that it was not aware of a similar incident occurring previously on an Airbus aircraft. It released an operators' information Telex to operators of A330 and A340 aircraft with procedural recommendations and checklists to minimise risk in the event of a similar incident.

Final report

Analysis

After detailed forensic analysis of the FDR, the FCPC software, and the ADIRU, the CPU of the ADIRU was found to have corrupted the AOA data. The exact nature of the corruption was that the ADIRU CPU erroneously relabelled the altitude data word so that the binary data that represented 37,012 (the altitude at the time of the incident) would represent an angle of attack of 50.625°. The FCPC then processed the erroneously high AOA data, triggering the high-AOA protection mode, which sent a command to the electrical flight control system to pitch the nose down.

Potential trigger types

A number of potential trigger types were investigated, including software bugs, software corruption, hardware faults, electromagnetic interference, and the secondary high-energy particles generated by cosmic rays that can cause a bit flip. Although a definitive conclusion could not be reached, sufficient information from multiple sources enabled the conclusion that most of the potential triggers were very unlikely to have been involved. A much more likely scenario was that a marginal hardware weakness of some form made the units susceptible to the effects of some type of environmental factor, which triggered the failure mode.

Although speculation arose that interference from Naval Communication Station Harold E. Holt or passenger personal electronic devices could have been involved in the incident, the ATSB assessed this possibility as "extremely unlikely".

Conclusion

The ATSB's final report, issued on 19 December 2011, concluded that the incident "occurred due to the combination of a design limitation in the FCPC software of the Airbus A330/A340, and a failure mode affecting one of the aircraft’s three ADIRUs. The design limitation meant that in a very rare and specific situation, multiple spikes in AOA data from one of the ADIRUs could result in the FCPCs commanding the aircraft to pitch down."

Subsequent Qantas Flight 71 incident

On 27 December 2008, a Qantas A330-300 aircraft operating from Perth to Singapore was involved in an occurrence about 260 nautical miles (480 km) north-west of Perth and 350 nautical miles (650 km) south of Learmonth Airport at 1729 WST, while flying at FL360. The autopilot disconnected and the crew received an alert indicating a problem with ADIRU no. 1. The crew performed the revised procedure released by Airbus after the earlier accident and returned to Perth uneventfully. The ATSB included the incident in their existing accident investigation of Flight 72. The incident again fuelled media speculation regarding the significance of the aforementioned Harold E. Holt facility, with the Australian and International Pilots Association calling for commercial aircraft to be barred from the area as a precaution until the events could be better understood, while the manager of the facility claimed that it was "highly, highly unlikely" that any interference had been caused.

Aftermath

The town and state emergency and health services responded. The Royal Flying Doctor Service and a CareFlight jet ambulance evacuated the 20 more seriously injured people to Perth. Others were treated at nearby Exmouth Hospital. Qantas sent two planes, with medical teams and customs officers, from Perth to Exmouth to help treat the injured people and fly those not hurt back to Perth. People who did not want to fly that night were provided with accommodations in Exmouth.

VH-QPA sustained minor damage; it was repaired and returned to service with Qantas.

Compensation

In the aftermath of the accident, Qantas offered compensation to all passengers. The airline announced it would refund the cost of all travel on their itineraries covering the accident flight, offer a voucher equivalent to a return trip to London applicable to their class of travel and pay for medical expenses arising from the accident. Further compensation claims would be considered on a case-by-case basis, with several passengers from the flight pursuing legal action against Qantas. One couple asserted that they were wearing their seatbelts at the time of the incident and questioned Qantas' handling of their cases. Permanently injured flight attendant Fuzzy Maiava was advised not to take an NZ$35,000 compensation payment from Qantas so that he could take part in a class-action lawsuit against Airbus and Northrop Grumman. The case was dismissed on procedural grounds, though, leaving Maiava without compensation. He remained unable to work or drive a vehicle.

Dramatisation and book

In 2018, the events of Qantas 72 were featured in "Free Fall" (season 18, episode 7) in the Canadian TV series Mayday. In May 2019, a book on the incident by Kevin Sullivan (captain of the flight) was published in Australia. In June 2019, Seven Network's Sunday Night featured the events of Qantas 72 through recollections of several passengers and crew who were on board the flight, including Sullivan and flight attendant Fuzzy Maiava, as well as comments from US Airways Flight 1549 captain Chesley "Sully" Sullenberger, but Qantas has banned any of its current employees from being interviewed about the incident, including Diana Casey, an off-duty customer-service manager who helped numerous others on board, despite being injured herself.

See also

• List of accidents and incidents involving commercial aircraft
• Malaysia Airlines Flight 124
• Lion Air Flight 610
• Ethiopian Airlines Flight 302
• Boeing 737 MAX groundings
• LATAM Airlines Flight 800
• Singapore Airlines Flight 321

Notes

1. "Normal" g-force (i.e. the force on an object due to the gravity of the Earth, if that object is on or near the surface of the Earth, and that object is not subject to other forces) is +1.0 g. As an aircraft is accelerated downward (for example, as in this case, by a sudden, uncommanded pitch-down), the g-force may decrease to 0 (zero), at which point weightlessness is experienced; if the downward acceleration is greater yet, the g-force becomes negative. In the case of Qantas Flight 72, a g-force of nearly one full negative g was experienced; from the in-cabin frame of reference, it can be thought of as if gravity had nearly completely "reversed", and anything not restrained "fell upwards".
2. In this second case, the downward acceleration produced by the uncommanded pitch-down was not enough to create zero or negative g forces, although it would have caused a sensation of near-weightlessness, somewhat similar to the first, highest drop on a roller coaster; +0.2 g would have made everything briefly near-weightless in the cabin, but would not have been enough to float people or objects substantially out of place or throw them around.

References

1. "2008/40 – Qantas Airbus Incident Media Conference" (Press release). Australian Transport Safety Bureau. 8 October 2008. Archived from the original on 17 June 2019. Retrieved 8 October 2008.
2. "2008/40a – ATSB Airbus investigation update" (Press release). Australian Transport Safety Bureau. 9 October 2008. Archived from the original on 17 June 2019. Retrieved 14 October 2008.
3. ^ "2008/40b – Qantas Airbus Accident Media Conference" (Press release). Australian Transport Safety Bureau. 10 October 2008. Archived from the original on 17 June 2019. Retrieved 14 October 2008.
4. ^ "2008/43 – Qantas Airbus A330 accident Media Conference" (Press release). Australian Transport Safety Bureau. 14 October 2008. Archived from the original on 17 June 2019. Retrieved 14 October 2008.
5. Siddique, Haroon (7 October 2008). "Qantas flight makes emergency landing as dozens of passengers injured". The Guardian. London. Retrieved 7 October 2008.
6. Knowles, Gabrielle; Strick, Ben; Torre, Giovanne (8 October 2008). "Mayday in WA: Dozens hurt as Qantas jet plunges 8000ft". The West Australian. Archived from the original on 11 December 2008. Retrieved 7 March 2009.{{cite news}}: CS1 maint: multiple names: authors list (link)
7. Weber, David (8 October 2008). "Confusion surrounds Qantas emergency landing". AM. Australian Broadcasting Corporation. Retrieved 7 March 2009.
8. ^ "In-flight upset, 154 km west of Learmonth, WA, 7 October 2008, VH-QPA, Airbus A330-303 – Interim Factual" (PDF). Aviation Occurrence Investigation AO-2008-070. Australian Transport Safety Bureau. 6 March 2009. Archived from the original (PDF) on 23 November 2018. Retrieved 7 March 2009.
9. Taylor, Rob (8 October 2008). "Computer glitch may have caused Qantas jet plunge". Reuters. Retrieved 8 October 2008.
10. "Australian jet plunge injures 40". BBC News. BBC. 7 October 2008. Retrieved 8 October 2008.
11. Hradecky, Simon (7 October 2008). "Accident: Qantas A333 near Learmonth on 7 Oct 2008, sudden inflight upset injures 74 people on board". The Aviation Herald.
12. "AO-2008-070: In-flight upset, 154 km west of Learmonth, WA, 7 October 2008, VH-QPA, Airbus A330-303". Aviation Safety Investigation Report – Preliminary. Australian Transport Safety Bureau. 14 November 2008. Archived from the original on 10 November 2008. Retrieved 15 November 2008.
13. "Accident Airbus A330-303 VH-QPA". Retrieved 16 June 2024.
14. ^ In-flight upset, 154 km west of Learmonth, Western Australia, 7 October 2008, VH-QPA, Airbus A330-303 (PDF) (Report). Australian Transport Safety Bureau. December 2011. ISBN 978-1-74251-231-0. AO-2008-070. Retrieved 12 August 2024.
15. "Sunday Night: How a routine Qantas flight became a nightmare". news.com.au. 2 June 2019. Retrieved 17 June 2019.
16. "In-flight upset, 154 km west of Learmonth, WA, 7 October 2008, VH-QPA, Airbus A330-303" (PDF). Australian Transport Safety Bureau. 14 November 2008. Archived from the original (PDF) on 22 October 2009. Retrieved 15 November 2008.
17. ^ Nicholson, B. (9 October 2008). "Data show Qantas jet in two sudden plunges". The Age. Retrieved 8 October 2008.
18. Hannon, K. (9 October 2008). "Qantas plunge probe 'may take months'". The Canberra Times. Archived from the original on 30 October 2008. Retrieved 12 October 2008.
19. "Computer error behind Qantas midair drama". Australian Broadcasting Corporation. 14 October 2008. Retrieved 15 October 2008.
20. Creedy, Steve (17 October 2008). "US tests on false data sent on Qantas jet over WA". The Australian. Archived from the original on 17 October 2008. Retrieved 16 October 2008.
21. "Emergency Airworthiness Directive No 2009-0012-E" (PDF). European Union Safety Agency. 15 January 2009. Archived from the original (PDF) on 5 February 2009.
22. "Computer glitch may be behind Qantas incident: ATSB". Australian Broadcasting Corporation. 8 October 2008. Retrieved 8 October 2008.
23. "Qantas flight suffered computer 'irregularity'". The Australian. Australian Associated Press. 8 October 2008. Archived from the original on 9 October 2008. Retrieved 8 October 2008.
24. "Qantas Airbus A330 incident, 480km North West of Perth on 27 December 2008" (Press release). Melbourne: Australian Transport Safety Bureau. 2 January 2009. Archived from the original on 10 January 2009. Retrieved 6 January 2009.
25. Catanzaro, Joseph (2 January 2009). "Navigation failure again hits Qantas in north-west". The Age. Melbourne.
26. "Call for no-go zone after another Qantas forced landing". The Age. Melbourne. 2 January 2009. Archived from the original on 6 January 2009. Retrieved 2 January 2009.
27. Hopkin, Michael (7 January 2009). "Exmouth interference 'unlikely'". The Sydney Morning Herald. Retrieved 7 January 2009.
28. Ranter, Harro. "ASN Aircraft accident Airbus A330-303 VH-QPA Learmonth, WA, Australia". aviation-safety.net. Aviation Safety Network. Retrieved 3 November 2019.
29. Bibby, Paul (9 October 2008). "Qantas compo depends on class of seat". The Sydney Morning Herald. Retrieved 9 October 2008.
30. Roberts, Greg (6 November 2008). "Couple suing Qantas over plane plunge". The Sydney Morning Herald. AAP. Retrieved 6 November 2008.
31. Bibby, Paul (8 November 2008). "Qantas tried to trick me: passenger". The Sydney Morning Herald. Retrieved 8 November 2008.
32. O'Sullivan, Matt (19 May 2019). "'11 years of hell': the badly injured Qantas steward who was forgotten". The Sydney Morning Herald. AAP. Retrieved 4 August 2020.
33. "Air Crash Investigation - National Geographic". nationalgeographic.com.au. Retrieved 21 June 2018.
34. Sullivan, Kevin (2019). No Man's Land: the Untold Story of Automation and QF72. ABC Books.
35. "QF72 | Hero pilot Kevin Sullivan's quick thinking saves 315 people | Sunday Night". Youtube. 3 June 2019. Retrieved 5 June 2019.

Further reading

• O'Sullivan, Matt (12 May 2017). "The untold story of QF72: What happens when 'psycho' automation leaves pilots powerless?". The Sydney Morning Herald. Retrieved 13 May 2017.
• Sullivan, Kevin: No Man’s Land: the Untold Story of Automation and QF72. ABC Books, 2019.
• "What Caused Flight 72 to Lose Control in 2008?". Smithsonian Channel. 15 March 2019.

External links

• Australian Transport Safety Bureau — final report and materials (Archived 27 February 2012 at the Wayback Machine)
• Perth Now — photographs of the cabin

• Qantas accidents and incidents
• Aviation accidents and incidents in 2008
• Aviation accidents and incidents in Western Australia
• 2008 in Australia
• Airliner accidents and incidents caused by instrument failure
• Accidents and incidents involving the Airbus A330
• October 2008 events in Australia
• 2000s in Perth, Western Australia
• 2008 disasters in Australia