The Airbus That Pitched Down Twice | Qantas Flight 72 True Story

Chapter 1The Second Plunge

It is 12:45:08 in the afternoon. Over Western Australia, at 37,000 feet, an Airbus suddenly pitches downward for the second time. There are 315 people on board. Those who are not wearing seat belts are thrown into the air and flung around the cabin. Luggage breaks through the overhead compartment doors and slams into people. In an instant, everything in the cabin changes.

In the cockpit, the pilots stabilise the aircraft and declare a state of alert. This is later upgraded to a mayday. The question is: why did a perfectly healthy aircraft dive without being commanded to? What, or who, was really controlling it?

This is the story of Qantas Flight 72, an Airbus A330 flying from Singapore to Perth, which suffered the incident on 7 October 2008. In this article we look at what happened inside the cockpit that day, what investigators found, and what the world learned from it.

The investigation by the Australian Transport Safety Bureau (ATSB) uncovered a software design limitation that nobody had known about before. It also found a fault in one of the aircraft's ADIRUs. So was the problem in the aircraft, or in the computers that do its thinking? Let's start from the beginning.

Chapter 2Singapore to Perth: A Routine Flight

It is the morning of 7 October 2008. At Singapore Changi Airport, Qantas Flight 72 stands ready for its trip to Perth Airport. By Singapore Standard Time, the flight departed at 09:32. The aircraft was an Airbus A330-303, registration VH-QPA, a twin-turbofan wide-body jet carrying 315 people. By 10:01 it had reached its cruising altitude of roughly 37,000 feet, flying at Mach 0.82, or 82 percent of the speed of sound. It was an ordinary journey, and nobody suspected what was about to happen.

There were three pilots in the cockpit. Captain Kevin Sullivan, 53, had been a US Navy pilot from 1977 to 1986 and later moved to Australia. He had 13,592 flight hours, of which 2,453 were on the Airbus A330. First Officer Peter Lipsett had 11,650 flight hours, including 1,870 on the A330, and was also an experienced pilot. Second Officer Ross Hales had 2,070 flight hours, with 480 of them on the A330.

Besides the three on the flight deck, there were 9 cabin crew and 303 passengers, which adds up to 315 people. Together, the three pilots had 27,312 flight hours, and their combined A330 experience was 4,803 hours. In other words, there was no shortage of experience in the cockpit, and they knew the type well.

This was a scheduled flight, planned in advance. On the route from Singapore to Perth, the aircraft was to head toward the coast of Western Australia, and during cruise the autopilot was flying the plane. Later, that same autopilot becomes the first turning point of the story.

About three hours had passed since takeoff. The departure was at 09:32, while the first fault began at 12:40:26 AWST. On the surface, everything looked fine. But inside the aircraft, three ADIRU units were doing their work, and one of them was about to go wrong. So what exactly is the Airbus A330, and what is the brain inside it that makes decisions? Let's find out.

Chapter 3The Airbus A330 and Its Fly-by-Wire Brain

The Airbus A330 is a wide-body twinjet airliner, meaning a large passenger aircraft with two engines and two aisles. It was developed and produced by Airbus. The A330 and A340 were launched in June 1987 with their first orders. The first variant, the A330-300, made its first flight in November 1992 and entered service with Air Inter in January 1994. The A330-300 is the model involved in this incident.

The A330's cockpit and fly-by-wire system are similar to those of the A320 and A340, so that pilots can move quickly from one type to another. There is no old-style control yoke. Instead there are side-stick controls, six main displays, and the ECAM, the Electronic Centralised Aircraft Monitor.

In fly-by-wire, the pilot's control movements become electronic signals, and computers decide how the actuators of each control surface should move. The pilot states a desired outcome, and the computer works out the right positions for the rudder, elevator and other controls. These computers also provide flight envelope protection, which keeps the aircraft from exceeding aerodynamic and structural limits, such as a stall. Airbus's approach is that in normal law the system keeps final authority over envelope control, whereas on the Boeing 777 pilots can override it.

But relying on computers means their input must be exactly right. If a computer receives wrong data, it can make a wrong decision. That is why redundancy exists. In triplex systems, three computers run together and continuously monitor each other's output. If one produces a strange result, the rest of the system is designed to ignore it. That sounds very safe, doesn't it?

Now to the ADIRU, the Air Data Inertial Reference Unit. It supplies airspeed, angle of attack and altitude data, as well as position and attitude information. This goes to the pilots' displays and also to other systems such as the engines, autopilot and flight control system. The A330 has three ADIRUs. Numbers 1 and 2 normally feed the captain's and co-pilot's displays, while number 3 is a redundant unit that can be selected in case of a fault. However, there is no cross-channel redundancy between numbers 1 and 2.

Another key parameter is angle of attack, or AOA. Full-authority flight control systems like those on the A330 and A340 need correct AOA data to work properly. So what would the rest of the system do when one ADIRU started sending wrong AOA? That test was about to begin at 12:40 on this day.

Chapter 412:40: The Warnings Begin

At 12:40:26 AWST, Australian Western Standard Time, the calm broke. ADIRU number 1 began sending incorrect data to the flight computer. In response to this wrong data, the autopilot disengaged by itself. The aircraft was flying at about 37,000 feet at Mach 0.82.

A few seconds later, the pilots received messages on the electronic centralised aircraft monitor, warning of problems with the autopilot and the inertial reference systems. Then something strange happened. Stall and overspeed warnings sounded in the cockpit, and the two were completely contradictory. During this time Captain Kevin Sullivan took manual control. Imagine trying to decide what to do when your own instruments are contradicting each other.

The autopilot was then re-engaged and the aircraft began returning to the previously selected flight level. About 15 seconds later, though, the crew disengaged the autopilot, and it stayed off for the rest of the flight. The initial effects were threefold: false and contradictory stall and overspeed warnings, the loss of altitude information from the captain's primary flight display, and numerous ECAM warnings.

Take a moment to sit in that cockpit: alarms on one side, responsibility for 315 people on the other, and a display in front of you that is not showing altitude. For such a situation the A330 has ADIRU number 3. The captain switched the inertial reference (IR) data source from ADIRU 1 to ADIRU 3. But there was a complication. ADIRU 1 had not stopped feeding ADR, or air data reference, data to the captain's primary flight display. So only the IR part of one unit had been changed, while its ADR part was still sending data to the display.

Then came the flight control computers. The master flight control computer, PRIM1, was switched to PRIM2 and then back from PRIM2 to PRIM1. As a result, the crew did not know which redundant systems they were relying on. It was a genuinely uncertain situation. Analysing such complex systems is so difficult that even certification can miss mistakes. When a failure occurs, the aircraft's behaviour can seem counter-intuitive to the crew. In fly-by-wire, the pilot does not always know what the computers are doing behind the scenes. He only sees how the aircraft reacts.

The ATSB's preliminary report later named the fault in the number-one ADIRU as the likely origin of the incident. This unit was feeding wrong data to other systems. Then, about two minutes after this first phase, ADIRU 1 began sending very high and false angle of attack readings. What happened next? To find out, we must go to 12:42:27, the moment that changed everything.

Chapter 5Two Dives in Three Minutes

At 12:42:27 came a moment no one expected. Without any pilot command, the aircraft suddenly pushed its nose down. This was an uncommanded pitch-down. Acceleration reached minus 0.8 g, the aircraft pitched down 8.4 degrees, and it quickly dropped 650 feet, about 200 metres. Why did this happen? The same false angle of attack reading had now reached the aircraft's flight control computers. On that reading, they started the high-AOA protection mode and sent the electrical flight control system a command to lower the nose. An FCPC pitch fault was also triggered.

In the cockpit, the pilots faced an aircraft descending against their will. Remember, the autopilot was off at this point. The crew was flying manually, yet the flight control computers still pushed the nose down. Airbus's fly-by-wire system includes flight envelope protection, and in normal law the computers do not let pilots exceed the aircraft's performance limits. About 20 seconds later, the pilots brought the aircraft back to its assigned cruise flight level, FL370. They had recovered.

The time from the first fault to the second dive was under five minutes: from 12:40:26 to 12:45:08, just 4 minutes 42 seconds. But it was not over. 2 minutes 41 seconds after the first dive, at 12:45:08, the aircraft made another uncommanded manoeuvre. This time the acceleration was positive 0.2 g, the nose went down 3.5 degrees, and the aircraft lost 400 feet, about 120 metres. The angle was smaller than before. The flight crew re-established level flight at the assigned level after only 16 seconds. The second manoeuvre was also similar in nature to the first and uncommanded. In both cases the pilots had not commanded a descent.

The situation in the cabin was very different. Passengers and crew who were not strapped in, and some who were, were thrown around the cabin. Items in the overhead compartments were thrown about so hard that they broke through the compartment doors. Many people were struck by this luggage. We are not just counting numbers here. Every injured person was a human being, and behind each one stood a whole family.

The pilots stabilised the aircraft and first declared a state of alert. When details of the injuries reached them from the cabin, it was upgraded to a mayday. So the question remains: with three ADIRUs on board, how did one unit's mistake become so serious? The answer comes later. Qantas Flight 72 was no longer an ordinary flight. There were 315 people on board, and the biggest question was where to land the aircraft.

Chapter 6Emergency Landing at Learmonth

After the mayday, the aircraft turned toward an airport in Western Australia: Learmonth Airport, near the town of Exmouth. In this remote part of Western Australia, Qantas Flight 72 made an emergency landing on 7 October 2008. According to the source, the aircraft landed without further injury. This final success by the flight crew was very important.

When the aircraft arrived, teams from the Royal Flying Doctor Service of Australia and CareFlight met it. Medical help was already waiting on the ground. On board were 3 flight-deck crew, 9 cabin crew and 303 passengers, 315 people in all, and caring for them was now the job of the teams on the ground.

According to one account, 14 people were airlifted to Perth, and another 39 also went to hospital. But another source speaks of 20 more injured people being taken to Perth. The sources differ in their figures, so we are giving both. Overall, 1 crew member and 11 passengers were seriously injured, while 8 crew and 99 passengers had minor injuries. Adding these up gives 119. Yet another source says the number of injured was as high as 74. Keep this discrepancy in mind.

Exmouth Hospital also treated many people. The town's and the state's emergency and health services responded. Qantas sent two planes from Perth to Exmouth carrying medical teams and customs officers. Their job was to help the injured and to bring the uninjured back to Perth. For passengers who did not want to fly again that night, accommodation was arranged in Exmouth.

So that night, many people did not reach Perth on this flight. Some went to hospital, some stayed in Exmouth, and those who were not injured were flown to Perth by Qantas planes. One thing is especially moving: Diana Casey, an off-duty Qantas customer-service manager who was herself injured, helped many others. We remember with respect everyone who was hurt that day, passengers and crew alike. Help on the ground continued, but the question remained: why had the aircraft done this without being commanded? Finding the answer fell to the ATSB.

Chapter 7Hunting the Fault

The Australian Transport Safety Bureau, the ATSB, began its investigation. The Civil Aviation Safety Authority, Qantas, France's BEA and Airbus were also involved. Copies of the aircraft's flight data recorder and cockpit voice recorder were sent to the BEA and Airbus, so experts from several organisations were looking at the same data. The aircraft had an air data inertial reference unit made by Northrop Grumman. Investigators sent it to the United States for further testing.

In its preliminary report, the ATSB said the fault in the number-one ADIRU was the likely origin of the incident. The unit had begun giving wrong data to other systems. The initial effects were contradictory stall and overspeed warnings, the loss of altitude information from the captain's primary flight display, and multiple ECAM warnings. About two minutes later, ADIRU 1 began giving very high and false angle of attack readings. This is where the real problem grew. As a result, the flight control computers ordered the nose down, and the aircraft pitched down by a maximum of about 8.5 degrees. An FCPC pitch fault was also triggered.

Then comes another complication. After the ADIRU 1 fault, the captain changed the inertial reference data source to ADIRU 3. But ADIRU 1 kept supplying air data to the captain's display in the meantime. So a single fault in one unit was muddying the whole picture. The master computer went from PRIM 1 to PRIM 2 and then back to PRIM 1. The crew did not know which redundant systems they were relying on. According to Airbus, it had no knowledge of any earlier incident like this. It then issued a Telex to A330 and A340 operators, including checklists.

Now let's go back in time. On 12 September 2006, a strange event happened on Qantas Flight 68, with the very same aircraft: A330 VH-QPA. The ECAM first showed NAV IR1 FAULT and about 30 minutes later NAV ADR 1 FAULT. According to the crew, the warnings were changing very rapidly. The crew turned off ADR 1 and the problem ended. There was no effect on the flight controls, and later system testing found no fault.

Then on 7 February 2008, a similar event occurred on a Jetstar A330, VH-EBC, on a flight from Sydney to Ho Chi Minh City. The ATSB did not confirm it as related. Another example is from 1 August 2005: Malaysia Airlines Flight 124, a Boeing 777, experienced uncommanded manoeuvres because of an ADIRU fault. According to the ATSB, its underlying cause was a latent software error that allowed the ADIRU to use data from a faulty accelerometer. No one was injured. So was this the same old problem? The ATSB had to understand how one wrong reading could push the aircraft down twice.

Chapter 8The Hidden Flaw in the Software

The most important question: how did one faulty unit take the aircraft down? The answer was hidden in the software of the flight control primary computer, the FCPC. Angle of attack, or AOA, is a vital flight parameter, and full-authority flight control systems like those on the A330 and A340 need correct AOA data to work properly. The aircraft had three ADIRUs, and the FCPCs compared their three AOA values. Normally the average of AOA 1 and AOA 2 was used. If AOA 1 or AOA 2 deviated greatly from the other two values, the FCPCs used a memorised value for 1.2 seconds.

This approach was very effective, but in one rare case the algorithm failed: when spikes in AOA 1 or AOA 2 came exactly 1.2 seconds apart. The memorised value would expire at the very moment another spike was occurring, and the algorithm could not handle the situation properly. The system had been developed in 1991 and 1992 and included many safeguards, such as peer reviews, system safety assessment, testing and simulations. Yet none of these stages caught this design limitation in the FCPC's AOA algorithm. The weakness stayed hidden for years.

This ADIRU failure mode had also never been seen before, and it had not been identified in the manufacturer's own safety assessment. According to the ATSB, the aircraft manufacturer's design, verification and validation processes had not fully considered the effects of repeated spikes from the ADIRU.

The final report then carried out a detailed forensic analysis of the FDR, the FCPC software and the ADIRU. It found that the ADIRU's CPU had corrupted the AOA data. The CPU wrongly relabelled a word of altitude data. At that moment the altitude was 37,012, and the same binary data was read as an angle of attack of 50.625 degrees. So the aircraft suddenly believed its nose was extremely high. The FCPC processed this wrong AOA, high-AOA protection mode kicked in, and the electrical flight control system was commanded to lower the nose.

Why did the CPU do this? The ATSB examined software bugs, software corruption, hardware faults, electromagnetic interference and bit flips caused by cosmic rays. No definitive conclusion could be reached. From multiple sources of information, however, it was concluded that most of the likely triggers were very improbable. It was more likely that the units had some marginal hardware weakness, which was pushed into the failure mode by some environmental factor. This is not definitive proof, but an assessment.

Some people suspected interference from the Naval Communication Station Harold E. Holt, but the ATSB called this "extremely unlikely". Interference from passengers' personal electronic devices was also raised, and the ATSB called that "extremely unlikely" too. So it comes down to this: a hidden design limitation and a rare hardware failure mode. Only when the two combined did the aircraft pitch down twice. But what changed afterward?

Chapter 9What Changed and What Remains Unknown

The ATSB's final report was released on 19 December 2011. Its conclusion was that the event resulted from two things coming together: a design limitation in the A330/A340 FCPC software, and a failure mode in one of the three ADIRUs. In a very rare situation, the aircraft could pitch down.

On 15 January 2009, EASA issued an emergency airworthiness directive. Its purpose was to make sure A330 and A340 aircraft with Northrop-Grumman ADIRUs did not react wrongly to a faulty inertial reference. On a NAV IR fault, the crew now turns the relevant IR and ADR OFF, and then also turns the IR rotary mode selector OFF. On 27 December 2008, Qantas Flight 71 received an ADIRU 1 alert. The crew followed Airbus's new procedure and returned safely to Perth.

Qantas offered compensation to all passengers: a travel refund, a voucher equal to a return trip to London, and medical expenses. Other claims were considered case by case. Fuzzy Maiava was offered NZ$35,000, but was advised not to accept the amount so that he could join a class-action lawsuit against Airbus and Northrop Grumman. That case, however, was dismissed on procedural grounds, and Maiava received no compensation. We respect all those affected.

VH-QPA had suffered minor damage. It was repaired and returned to Qantas service. In 2018 the story was shown in the Mayday episode "Free Fall", and in May 2019 a book by Captain Kevin Sullivan was published.

The biggest question today is still the same: what was the exact trigger? The ATSB could not reach a definitive conclusion on this. The lesson is that redundancy and software safety must be tested even for the rarest of circumstances. If you enjoyed this article, let us know which story you would like to read next. Thank you for reading.

Shorts