Investigation Summary
The incident began when ADIRU 1 started providing erroneous data, causing the autopilot to disengage and triggering contradictory stall and overspeed warnings. The captain, a former U.S. Navy fighter pilot, took manual control, but the aircraft soon executed a violent pitch-down, reaching 8.4 degrees nose-down and -0.8 g, descending 650 feet in seconds. A second pitch-down occurred three minutes later. Investigation revealed that the ADIRU's CPU had erroneously relabeled altitude data words as angle-of-attack data. Because the binary value for 37,012 feet was interpreted as a 50.625-degree angle of attack, the Flight Control Primary Computers (FCPCs) initiated an aggressive nose-down recovery. The software was designed to filter AOA spikes by using a 'memorized' value for 1.2 seconds when an anomaly was detected. However, the system was vulnerable to a specific timing sequence: if a second spike occurred exactly as the 1.2-second period ended, the FCPC would accept the second erroneous spike as a valid, rapid change in AOA rather than a continuation of the fault, thereby triggering the high-AOA protection.
Final Conclusions
The ATSB final report, issued on 19 December 2011, concluded the incident was caused by a combination of a failure mode in the Northrop Grumman ADIRU and a design limitation in the Airbus FCPC software. The software failed to effectively filter multiple, closely-spaced spikes of erroneous AOA data, which led the flight control system to command the pitch-down maneuvers. The report also noted that the ADIRU failure mode had not been identified during the original system safety assessments in the early 1990s.
Video Analysis
If playback is blocked, the owner has disabled embedding — use the link above.
Systems & Failure Modes
ADIRU (Air Data Inertial Reference Unit)
A component that provides air data (airspeed, altitude) and inertial reference (position, attitude) to the flight computers. A failure in unit 1 caused the initial data corruption.
FCPC (Flight Control Primary Computer)
The computer that processes pilot and sensor inputs to command flight control surfaces. A software limitation prevented it from filtering specific patterns of erroneous AOA data.
ECAM (Electronic Centralised Aircraft Monitor)
A system that monitors aircraft functions and displays failures to the pilots. It displayed multiple conflicting warnings during the event.
Interesting Facts
- 01The aircraft experienced a maximum negative acceleration of -0.8 g during the first pitch-down.
- 02119 people were injured, including 12 with serious injuries such as spinal fractures and lacerations.
- 03The ADIRU CPU erroneously relabeled altitude data (37,012 feet) as an angle of attack of 50.625 degrees.
- 04The aircraft involved, VH-QPA, was named 'Kununurra'; it was repaired and returned to service with Qantas.
- 05The captain, Kevin Sullivan, was a former U.S. Navy Top Gun pilot.
- 06The investigation identified a potential design flaw in seatbelts that could lead to inadvertent release if the belt was loosely fastened.
Safety Actions & Advisories
EASA Emergency Airworthiness Directive
Issued on 15 January 2009 to address A330/A340 aircraft equipped with Northrop-Grumman ADIRUs to ensure correct response to defective inertial reference data.
Airbus Software Update
Airbus modified the FCPC algorithm to better identify and ignore multiple spikes in AOA data from a single ADIRU.
Known Controversies & Unanswered Questions
Harold E. Holt Naval Communication Station Interference
Reference ↗Speculation arose that high-frequency transmissions from the nearby naval facility caused the ADIRU failure. The ATSB investigation found this highly unlikely and concluded the fault was internal to the ADIRU.