Professional Documents
Culture Documents
Unreliable airspeed indication 710 km south of Guam 28 October 2009 VH-EBA Airbus A330-202
Unreliable airspeed indication 710 km south of Guam 28 October 2009 VH-EBA Airbus A330-202
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
- i -
Australian Transport Safety Bureau PO Box 967, Civic Square ACT 2608 62 Northbourne Avenue Canberra, Australian Capital Territory 2601 1800 020 616, from overseas +61 2 6257 4150 Accident and incident notification: 1800 011 034 (24 hours) 02 6247 3117, from overseas +61 2 6247 3117 atsbinfo@atsb.gov.au www.atsb.gov.au
Commonwealth of Australia 2011 In the interests of enhancing the value of the information contained in this publication you may download, print, reproduce and distribute this material acknowledging the Australian Transport Safety Bureau as the source. However, copyright in the material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you want to use their material you will need to contact them directly. ISBN and formal report title: see Document retrieval information on page v
- ii -
CONTENTS
THE AUSTRALIAN TRANSPORT SAFETY BUREAU ................................. vi TERMINOLOGY USED IN THIS REPORT .................................................... vii FACTUAL INFORMATION ................................................................................ 1 History of the flight........................................................................................... 1 Aircraft information .......................................................................................... 3 Airspeed measurement ......................................................................... 3 Flight guidance system ......................................................................... 4 Flight control system ............................................................................ 5 Recorded information ....................................................................................... 6 Maintenance system messages .......................................................................... 8 Component examinations................................................................................ 10 Maintenance records ........................................................................... 10 Pitot probes ......................................................................................... 10 Air data modules................................................................................. 10 ADIRUs .............................................................................................. 11 Probe heat computers ......................................................................... 11 Meteorological information ............................................................................ 11 Flight crew procedures.................................................................................... 11 Flight crew training ......................................................................................... 13 Endorsement training.......................................................................... 13 Recurrent training ............................................................................... 14 Other Australian operators ................................................................. 15 Guidance material ............................................................................... 16 Personnel information ..................................................................................... 16 Previous unreliable airspeed occurrences ....................................................... 16 EBA, 15 March 2009 .......................................................................... 17 Other unreliable airspeed events on A330/A340 aircraft ................... 18 Unreliable airspeed events on A320 aircraft ...................................... 20 Design and certification issues........................................................................ 21 Pitot probe design specifications ........................................................ 21 Failure condition classifications ......................................................... 22 ANALYSIS ............................................................................................................ 25 Introduction ..................................................................................................... 25
- iii -
Reasons for the airspeed disagreements.......................................................... 25 Pitot probe design requirements...................................................................... 26 Flight crew procedures and training ............................................................... 26 FINDINGS............................................................................................................. 29 Context ............................................................................................................ 29 Contributing safety factors .............................................................................. 29 Other safety factors ......................................................................................... 29 Other key findings........................................................................................... 29 SAFETY ACTION ............................................................................................... 31 Certification requirements for icing conditions .............................................. 31 Training for unreliable airspeed situations...................................................... 31 A320 endorsement training program .............................................................. 32 APPENDIX A: A320 UNRELIABLE AIRSPEED EVENTS ........................... 35 VH-JQL, 5 February 2008 .............................................................................. 35 VH-JQG, 16 February 2010 ............................................................................ 35 VH-JQX, 20 September 2010 ......................................................................... 36 Additional information.................................................................................... 36 APPENDIX B: SOURCES AND SUBMISSIONS ............................................. 37
- iv -
Publication title Unreliable airspeed indication 710 km south of Guam 28 October 2009 VH-EBA, Airbus A330-202 Prepared By Australian Transport Safety Bureau PO Box 967, Civic Square ACT 2608 Australia www.atsb.gov.au Reference Number ATSB-Jan11/ATSB04
Acknowledgements Figure 1: Google Earth Figure 3: Japanese Meteorological Agency (obtained for the ATSB by the US National Transportation Safety Board) Figure 5: Adapted from the Bureau dEnqutes et dAnalyses pour la scurit de laviation civile Abstract On 28 October 2009, an Airbus A330-202 (A330) aircraft, registered VH-EBA (EBA), was being operated as Jetstar flight 12 on a scheduled passenger service from Narita, Japan to Coolangatta, Australia. Soon after entering cloud at 39,000 ft, there was a brief period of disagreement between the aircrafts three sources of airspeed information. The autopilot, autothrust and flight directors disconnected, a NAV ADR DISAGREE caution message occurred, and the flight control system reverted to alternate law, which meant that some flight envelope protections were no longer available. There was no effect on the aircrafts flight path, and the flight crew followed the operators documented procedures. The airspeed disagreement was due to a temporary obstruction of the captains and standby pitot probes, probably due to ice crystals. A similar event occurred on the same aircraft on 15 March 2009. The rate of unreliable airspeed events involving the make of pitot probes fitted to EBA (Goodrich 0851HL) was substantially lower than for other probes previously approved for fitment to A330/A340 aircraft. However, both of the events involving EBA occurred in environmental conditions outside those specified in the certification requirements for the pitot probes. The French Bureau dEnqutes et dAnalyses pour la scurit de laviation civile (BEA) has recommended the European Aviation Safety Agency (EASA) to review the certification criteria for pitot probes in icing environments. At the time of the occurrence, most of the operators A330 pilots had not received unreliable airspeed training. Most of these pilots had transferred from the operators A320 fleet, and the thirdparty training provider had not included the topic in its A320 endorsement training program, even though it was included in the aircraft manufacturers recommended program since 2003. The operator identified the problem and included unreliable airspeed in its recurrent training program for the A320 from May 2009 and the A330 from October 2009. The training provider included the topic in its endorsement program from July 2010. The operator, training provider and the Civil Aviation Safety Authority all initiated safety action to minimise the likelihood of similar problems in the future.
- v -
- vi -
Safety action: the steps taken or proposed to be taken by a person, organisation or agency in response to a safety issue.
- vii -
- viii -
FACTUAL INFORMATION
History of the flight
On 28 October 2009, an Airbus A330-202 (A330) aircraft, registered VH-EBA (EBA), departed Narita, Japan on a scheduled passenger transport service to Coolangatta, Australia. The flight, operating as Jetstar flight 12, departed at 1155 UTC (2055 local time). 1 There were 11 crew and 203 passengers on board. The aircraft was being operated at flight level (FL) 2 390. The first officer was the handling pilot, and autopilot 2 and autothrust were engaged. The flight crew reported that they had been manoeuvring around cloud build-ups that night for several minutes and had seen lightning in areas off to both sides of the aircraft. The last paint they could see ahead on the aircrafts weather radar was an area of light green 3 , viewed on the 40 NM (74 km) scale. They did not anticipate any turbulence, so they decided to fly through the cloud. However, they selected the seat belt sign ON as a precaution. Soon after entering the cloud, there was a large amount of St. Elmos fire 4 present on the aircrafts windscreen. The flight through the cloud was mostly smooth, and no turbulence was experienced. The crew reported that, about 1 minute after the St. Elmos fire commenced, they noticed a rapid and momentary drop in the airspeed indication on the captains primary flight display (PFD). They did not notice any changes in the first officers or standby airspeed indications. The flight data recorder (FDR) showed that the decrease in the captains airspeed indication occurred at 1537:17. The airspeed decreased to about 50 kts before returning to its previous value of about 250 kts within 5 seconds. Fault information recorded by various aircraft systems indicated that there was also a brief decrease in the standby airspeed indication at about this time. Immediately following the indicated airspeed decrease, the autopilot, autothrust and flight directors automatically disconnected. In addition, the flight control system reverted from normal law to alternate law (see subsequent discussion titled Flight control system), and there was a NAV ADR DISAGREE caution message displayed on the electronic centralized aircraft monitor (ECAM). 5 Other caution messages
1
The 24-hour clock is used in this report to describe the time of day, Coordinated Universal Time (UTC), as particular events occurred. Level of constant atmospheric pressure related to the datum of 1013.25 hPa, expressed in hundreds of feet. FL 390 equated to 39,000 ft above mean sea level (AMSL). The aircrafts weather radar detected precipitation droplets. In simple terms, black indicated minimal rainfall, light green indicated light precipitation, yellow indicated moderate rainfall, and red indicated heavy rainfall. The radar returns were dependent on many factors; for example, water droplets were more easily detected than ice particles. St Elmos fire is a luminous plasma, which results from a build up of electrostatic potential. It can be seen at the front of an aircraft during certain types of weather conditions, such as the convective activity associated with thunderstorms. The ECAM provides information on the status of the aircraft and its systems, including warning and caution messages and relevant actions required by the crew.
- 1 -
were also displayed to the crew during this period. However, the indicated airspeed fluctuations had no effect on the aircrafts flight path. Consistent with the operators procedures for responding to an unreliable airspeed indication and the ECAM messages they had received, the crew confirmed that the attitude and thrust settings were normal, and they again checked the captains, first officers and standby airspeed indicators; no disagreement was noted. They then responded to the THRUST LOCK ECAM message associated with the autothrust disconnection 6 , and re-engaged autopilot 2 and the autothrust. Shortly after, autopilot 2 and autothrust automatically disconnected a second time. The crew then engaged autopilot 1 and autothrust. After they were satisfied that all parameters were normal, the crew reviewed the ECAM messages. The only ECAM message requiring a crew response was the NAV ADR DISAGREE message. The first part of the associated procedure required the crew to check the airspeed information on the captains and first officers PFDs and on the standby airspeed indicator. As the three speeds were still in agreement, no further action was required. The crew reported that they closely monitored the airspeed indications for the remainder of the flight and noticed no discrepancies. They also conducted a detailed review of their situation and concluded that they did not need to take any other precautions. The aircraft landed at Coolangatta at 2017 (0617 local time). Subsequent analysis of recorded information showed that the incident occurred 710 km south of Guam at the position 7.63 north and 147.48 east. The location of this and a previous, similar event involving the same aircraft (see EBA, 15 March 2009) are shown at Figure 1.
Figure 1: Location of unreliable airspeed events involving EBA
Thrust levels are locked after an involuntary autothrust disconnection until the thrust levers are moved. The THRUST LOCK caution message will appear every 5 seconds until the thrust levers are moved.
- 2 -
Aircraft information
Type/model Registration Serial number Date of manufacture Date first registered in Australia Date first registered with operator Flight hours Airbus A330-202 VH-EBA 0508 2002 November 2002 February 2007 27,633
Airspeed measurement
The A330 had three independent systems for calculating and displaying airspeed information: (1) captain, (2) first officer, and (3) standby systems. Each system used its own pitot probe, static ports, air data modules (ADMs), air data inertial reference unit (ADIRU), and airspeed indicator. Airspeed is measured by comparing total air pressure (Pt) 7 and static air pressure (Ps). On the A330, Pt was measured using a pitot probe, and Ps was measured using two static ports. A separate ADM was connected to each pitot probe and each static port, and it converted the air pressure from the probe or port into digital electronic signals. Each pitot probe consisted of a tube that projected several centimetres out from the fuselage, with the opening of the tube pointed forward into the airflow. The tube had drain holes to remove moisture, and it was electrically heated to prevent ice accumulation during flight. In addition to the pitot probe and static ports, the aircraft also had two total air temperature (TAT) probes that were used for determining the static (or outside) air temperature (SAT) 8 , and three angle of attack sensors. The locations of the aircrafts pitot probes and TAT probes are shown in Figure 2. All of the probes, ports and sensors were electrically heated, and the heating was automatically activated whenever the aircraft was in flight. Three independent probe heat computers controlled the electrical heating of the captains, first officers, and standby systems. Each probe heat computer monitored the heating current and triggered a warning if predetermined thresholds were reached. The aircraft had three ADIRUs, and each ADIRU obtained data from a different set of sensors. For example, the captains pitot probe provided information to ADIRU 1, the first officers pitot probe provided information to ADIRU 2, and the standby pitot probe provided information to ADIRU 3.
7 8
Pt is the sum of static (or outside) air pressure and pressure due to relative airspeed. TAT is the sum of SAT and heating due to relative airspeed. TAT and Mach were used for calculating SAT and true airspeed (or the actual speed of the aircraft through the air mass in which it is flying).
- 3 -
Each ADIRU had two separate parts: the inertial reference (IR) part, and the air data reference (ADR) part. The ADR calculated parameters such as SAT, TAT, angle of attack, altitude and airspeed. Airspeed was calculated in terms of computed airspeed (CAS) and Mach, with calculations made eight times per second. 9 Computed airspeed was displayed on the captains PFD (from ADIRU 1), the first officers PFD (from ADIRU 2), and the standby airspeed indicator (from ADIRU 3). The ADIRUs sent the calculated parameters to other aircraft systems, including the flight management, guidance and envelope system (FMGES) and the electrical flight control system (EFCS). The operators A330 Flight Crew Training Manual, which was based on the aircraft manufacturers manual, included the following statement:
The most probable reason for erroneous airspeed and altitude information is obstructed pitot tubes or static sources. Depending on the level of obstruction, the symptoms visible to the flight crew will be different. However, in all cases, the data provided by the obstructed probe will be false. Since it is highly unlikely that [all of] the aircraft probes will be obstructed at the same time, to the same degree and in the same way, the first indication of erroneous airspeed/altitude data available to flight crews, will most probably be a discrepancy between the various sources.
Mach is the ratio of true airspeed to the speed of sound. It was derived solely from Pt and Ps. Computed airspeed (in kts) was based on Pt and a value of Ps which was corrected for static source error.
- 4 -
controlled the autopilot, autothrust and flight director (FD) functions. FMGEC 1 controlled autopilot 1 and FMGEC 2 controlled autopilot 2. Flight director 1 displayed control orders from FMGEC 1 on the captains PFD and flight director 2 displayed control orders from FMGEC 2 on the first officers PFD. Both FMGECs continuously monitored the altitude, computed airspeed and Mach outputs from all three ADRs. If the computers noted a difference between the outputs of one ADR and the other two ADRs that was above a predetermined threshold, then that ADR was rejected (and the auto flight functions remained engaged). If the FMGEC in command (for example, FMGEC 2 for autopilot 2) detected a difference above the threshold between the two remaining ADRs, the autopilot, autothrust and associated flight director were automatically disconnected. If the FMGEC not in command detected a difference, then the associated flight director was disconnected. Each flight director automatically re-engaged when its associated FMGEC detected that at least two ADR values were again valid and consistent. The autopilot and autothrust needed to be re-engaged by the flight crew.
- 5 -
Recorded information
Recorded data from the flight was obtained from the digital flight data recorder (FDR) and the digital ACMS 10 recorder (DAR). Figure 3 provides a summary of the key information obtained from the recorders. A summary of the key events from the recorders and other sources is presented in Table 1. The recorders only sampled airspeed information from ADIRU 1, with values sampled four times per second. The data showed that, at 1537:17, the captains computed airspeed started to rapidly drop. It reached a level of about 50 kts (Mach 0.17) for 4 seconds, and then returned to its previous level of about 250 kts (Mach 0.80) at 1537:22. No other anomalies were noted in the captains airspeed data. During the period of the drop in computed airspeed (1537:17 to 22), there were also changes in the values of altitude, TAT and SAT that were displayed to the crew and recorded by the FDR and DAR. The changes were consistent with the effects of the change in airspeed values and did not indicate any change in the actual value of the parameters. More specifically: Recorded altitude decreased from 39,000 ft to 38,700 ft. The ADIRU provided a correction to altitude, which was a function of airspeed. Recorded TAT 11 decreased from about -19 C to -24 C. At low airspeeds, the ADIRU applied a correction to TAT values. Recorded SAT increased from -48 C to -25 C. SAT was derived from TAT and Mach, and the SAT increase was due to the erroneous Mach values.
A temporary drop in airspeed, together with these minor changes in related variables, was consistent with the pitot probe being temporarily obstructed. The second disconnection of the flight guidance functions at 1538:15 indicated that there was a second period of disagreement between the airspeed values. Because autopilot 2 was in command during the first autopilot disconnection (1537:19), FMGEC 2 had latched 12 a rejection of an ADR (probably ADR 1). Later, when there was a disagreement between the two other ADRs, the autopilot, autothrust and flight director 2 were disconnected. The recovery of the flight director soon after indicated that the disagreement lasted about 2 seconds. 13 At about 1538:00 and 1539:16, the TAT values increased rapidly towards 0 C. This behaviour was consistent with the captains TAT probe being temporarily obstructed. There were no stall warnings or anomalies with angle of attack data during the flight.
10 11
ACMS: Aircraft Condition Monitoring System. The FDR did not record TAT, but the DAR did sample this parameter from the captains TAT probe. In this context, latched means that the fault condition remained set for the remainder of the flight. FMGEC 1 had not latched the initial rejection of an ADR because it was not in command at the time. Therefore, when the second disagreement occurred, it had two ADRs available and FD 1 was not disconnected.
12
13
- 6 -
- 7 -
A PFR only provided general information. To obtain more detailed information regarding the PFR messages, BITE data needed to be obtained from the relevant systems. Following the 28 October 2009 flight, BITE data was obtained from the aircrafts FMGES, EFCS and ADIRUs. The PFR for the flight contained several cockpit effect messages related to the unreliable airspeed event. Table 2 shows the cockpit effect messages associated with the FMGES and the EFCS. The order of the messages in the table is not necessarily the order that they occurred.
14
Times marked with a * indicate the event occurred at that time or within the next 6 seconds.
- 8 -
The BITE data from the EFCS included a message reporting that a speed decrease of more than 30 kts in 1 second was detected on at least two airspeeds. EFCS BITE messages were only recorded to the nearest minute, but it was very likely that this event occurred at the same time that the flight controls reverted to alternate law (1537:21). The BITE data from the FMGES and the ADIRUs recorded fault messages to the nearest tenth of a minute (6-second period). In addition to fault messages associated with the first disconnection of the flight guidance functions, the FMGES BITE included a fault message reporting that the FMGECs rejected ADR 3 at some time between 1538:12 and 1538:18. This message was consistent with the autopilot 2 disconnection at 1538:15. The PFR contained maintenance fault messages for ADIRU 1 and ADIRU 3, but the ADIRU BITE data reported no fault messages indicating problems with the ADIRUs themselves. However, there were fault messages consistent with problems in the airspeed information provided to ADIRU 1 (between 1537:18 and 1537:24) and ADIRU3 (between 1537:24 and 1537:30) by the pitot probes or associated ADMs. Another fault message associated with ADIRU 1 (but not ADIRU 3) indicated that, in between 1537:18 and 1537:24, Pt was lower than Ps. The FDR data showed that the flight control system reverted to alternate law at 1537:21 and remained in alternate law for the remainder of the flight. Based on the systems logic, this meant that the median airspeed value must have been at least 50 kts below the normal value at about 1537:31. Although the ADIRU BITE data indicated that there was probably a problem with the airspeed data from ADIRU 3,
15
Most of these messages were displayed on the ECAM. Flag messages were displayed on a pilots PFD. When a flag was displayed there was no associated ECAM message. The rudder travel limit unit restricted the maximum allowable rudder deflection as a function of airspeed. This message was consistent with the flight control system switching to and then maintaining alternate law.
16
- 9 -
it was not possible to determine which of the other two airspeed values was affected at that time. There were no PFR messages indicating any problems associated with the probe heating systems.
Component examinations
Maintenance records
A review of maintenance records identified that the aircraft had experienced another unreliable airspeed occurrence on 15 March 2009 (see the subsequent discussion titled EBA, 15 March 2009). Other than that occurrence, and the replacement of pitot probe 2 in July 2007 due to lightning damage, no other problems associated with the aircrafts airspeed measurement systems were noted.
Pitot probes
The aircraft was fitted with Goodrich model 0851HL pitot probes. Probes 1 (serial number 212943) and 3 (213284) were both manufactured in March 2002 and had been on the aircraft since its initial operations in 2002. Probe 2 (216654) had been on the aircraft since July 2007. Following the 28 October 2009 event, the operators engineering personnel completed maintenance tasks to flush the pitot and static pressure lines, and do a low range leak check of the pitot and static systems. No problems were identified. Probes 1 and 3 were removed from the aircraft by the operator and sent to the probe manufacturer for examination. The manufacturer reported that the probes were subject to its applicable acceptance test procedure, which focussed primarily on the de-icing heater properties. Both probes successfully passed all testing. In addition, the probe manufacturer conducted a detailed visual inspection of the probes, and no problems were noted internally. The pitot inlet and outside surface of the sensing head exhibited evidence of corrosion, which was typical for probes of the same age. The probes were also examined using real time X-Ray, and no anomalies were found.
- 10 -
ADIRUs
The aircraft was fitted with Northrop Grumman model LTN101 ADIRUs. ADIRU 1 had been on the aircraft since March 2009 and ADIRU 3 since 2002. The operator sent ADIRUs 1 and 3 to the manufacturer to download BITE data and conduct a standard manufacturers test procedure. No faults with ADIRUs 1 and 3, relevant to the occurrence, were found during the testing.
Meteorological information
The forecasted weather conditions for the flight included isolated, embedded cumulonimbus clouds in the tropical regions, up to FL 540. An image taken at 1530 on 28 October 2009 by the Japanese Meteorological Agencys multi-functional transport satellite (MTSAT) is shown in Figure 4. The aircrafts position at 1537 is shown by the red cross.
Figure 4: Satellite image at 1530 on 28 October 2009
As indicated in the image (and a subsequent image taken at 1557), the aircraft was located within or under a large defined cluster of cumulonimbus clouds at the time
- 11 -
of the event. The radiative cloud top temperature 17 at 1530 was -71.6 C, which corresponded to cloud tops of over 47,000 ft. As previously stated, the aircraft was operating at FL 390 (39,000 ft). Data from the FDR indicated that the SAT at the aircrafts location during the event was -48 C and that the TAT was -19 C. The FDR data also indicated that the aircraft did not encounter any significant turbulence during the event. The crew reported that they observed no icing on the aircraft in the period before or during the event. As previously stated, the crew reported that the aircrafts weather radar only indicated an area of light green. The aircrafts weather radar system detects moisture in a horizontal plane ahead of the aircraft. The satellite images are based on temperature and provide a plan view of a broad area. Due to the differences in technology and viewing angle, the nature of the information available to the crew would generally be different to that detected by the satellite.
The radiative cloud top temperature, derived from infrared satellite images, provides an indication of the height of the cloud tops. Flight crew procedures are generally classified as normal, abnormal, or emergency. Abnormal events are unpredicted events that affect the use of normal operating procedures by the crew. Memory items are actions to be completed without referring to a reference. Only a small number of the operators abnormal or emergency operations required memory items.
18
19
- 12 -
Flight using pitch and thrust reference. In situations where the faulty airspeed sources could not be identified, one ADR was to be left on to provide stall warning protection. The crew were then required to use tables to select pitch angles and thrust settings appropriate for the aircrafts altitude and configuration.
The operators NAV ADR DISAGREE and unreliable airspeed procedures were the same as the aircraft manufacturers procedures.
CASA advised that it would be impractical for it to have specific requirements for all types of unreliable events, and that there were other mechanisms in place to ensure such events were adequately addressed in training programs. The manufacturer-recommended training program for the cross crew qualification from the A320 to the A330 did not include unreliable airspeed training, as it was already included in the manufacturers recommended A320 endorsement training program. Alteon subsequently changed its name to Boeing Training and Flight Services.
21
22
- 13 -
CASA initially approved the third-party training providers A320 endorsement training program in July 2004, and it subsequently approved changes to the program. It advised that, when approving an initial endorsement training course, it assessed the course against the regulatory requirements. It also expected to see the aircraft manufacturers course used as a benchmark for the applicants course. When assessing amendments, the new proposed course would be compared to the previously-approved course. CASA also advised that, when approving a training course, it did consider whether the training organisation had access to the aircraft manufacturers training program and related materials. It noted that, in this case, the third-party training provider only provided services to contracting operators, and CASAs expectation was that the operator would provide the training provider with a current syllabus and related materials suitable for the operators needs. The operator reported that it was not aware of this expectation. It also stated that it could not provide the third-party training provider with the aircraft manufacturers documentation due to the manufacturers copyright restrictions. It also noted that the CASA approval to conduct the A320 endorsement training was held by the third-party training provider, not by the operator. The operator advised that it conducted yearly observations of the training providers instructors, and that it had asked the training provider to make changes to its training program over the years. 23 In July 2009, the operator received new versions of training materials from the aircraft manufacturer, and they subsequently conducted a comparison of the recommended program and the third-party training providers program. Other than the absence of unreliable airspeed training, no material differences were found. Previous ATSB investigations have noted that, under current regulatory arrangements, the relative responsibilities of operators and third-party training providers for training outcomes was unclear, and that CASA was developing legislative changes to address the situation. 24
Recurrent training
In addition to initial endorsement training, the operators flight crew received recurrent (cyclic) training sessions. The frequency that a topic was covered in the recurrent training program was based on regulatory requirements and the operators assessment of training needs across the fleet. The operator conducted recurrent training for its A330 and A320 flight crew in a simulator twice every year. Prior to 2009, the operator had not included unreliable airspeed training in its recurrent training program, although the training had included ADR faults. There
23
The operator advised that the major change had been to increase the duration of the endorsement training course in 2007 for students with little or no previous jet aircraft experience. The regulator also advised that it was involved in the decision to expand the duration of the course, following an investigation into a complaint by a student. For example, see ATSB aviation occurrence investigation AO-2007-044 (Go-around event, Melbourne Airport, Victoria, 21 July 2007, VH-VQT, Airbus Industrie A320-202) available at www.atsb.gov.au. This investigation involved the same operator and same third-party training provider.
24
- 14 -
was no Australian regulatory requirement to include unreliable airspeed training in recurrent training programs. Following the Air France flight AF447 A330-200 accident on 1 June 2009 (see the subsequent discussion titled Other unreliable airspeed events on A330/A340 aircraft), the European Aviation Safety Agency (EASA) issued Safety Information Bulletin 2009-17 (Unreliable airspeed indication) on 9 June 2009 recommending that operators ensure that flight crews have proper knowledge and proficiency to detect, identify and appropriately respond to unreliable airspeed situations. The bulletin also stated that familiarisation with unreliable airspeed indication procedures should be provided through adequate training and knowledge and proficiency should be checked on a regular basis. On 9 September 2009, the aircraft manufacturer issued a Flight Operations Telex (FOT) to all operators of A318/319/320/321 or A330/A340 aircraft. The FOT described a method by which pilots may practice aircraft handling in Alternate Law in a simulator and additionally perform an unreliable airspeed exercise at high altitude. The operators A330 recurrent training session for the period October 2009 to March 2010 (session 2C) included an introduction to unreliable airspeed situations. Further training was included in the following session (April to September 2010). The operator first included unreliable airspeed situations in its A320 recurrent training sessions for the period May to September 2009, prior to the manufacturers recommendation. The operator advised that unreliable airspeed training was included in its A330 and A320 recurrent training programs in response to the A330 in-flight upset event on 7 October 2008 involving an associated operator. 25 The operator also advised that its recurrent training programs were more extensive than the manufacturer-recommended programs, and included Australian regulatory requirements and internal training needs identified by a variety of mechanisms.
25
As discussed later in the report, the in-flight upset event on 7 October 2008 was not the same type of event as the unreliable airspeed event involving EBA.
- 15 -
Guidance material
The aircraft manufacturer provided an FCTM to supplement the FCOM and provide pilots with practical information on how to operate the aircraft. The operators A330 FCTM was based on the manufacturers manual and contained a section on the unreliable airspeed / ADR check procedure. The material reviewed different types of unreliable airspeed scenarios and their potential effects, and provided a detailed explanation of the procedure itself. The material was first introduced in the manufacturers FCTM in July 2004. The aircraft manufacturer has also regularly published articles on unreliable airspeed procedures in its flight safety magazine (Safety First).
Personnel information
The captain had 18,722 total hours experience, including 2,123 hours on the A330. He also had 1,183 hours experience on A320 aircraft and had flown other air transport aircraft types. Prior to the occurrence, he could not recall having experienced an unreliable airspeed event. He also could not recall receiving training for an unreliable airspeed event in the simulator. He had not completed the recurrent training session 2C at the time of the event. The first officer for the flight was also a qualified captain, but operating as a first officer on the flight due to a shortage of available first officers. He had 16,400 hours total experience, including 1,800 hours on the A330. He also had 2,400 hours experience on A320 aircraft and had flown other air transport aircraft types. Prior to the occurrence, he could not recall having experienced an unreliable airspeed event. He recalled that he received unreliable airspeed training as part of his A330 endorsement at the aircraft manufacturers facilities, but could not recall receiving any recurrent training on the topic. He had not completed the recurrent training session 2C at the time of the event. Both pilots had valid medical certificates, and flight and duty times in recent days were within acceptable levels.
26
For an example of pitot blockages by insect nests, see ATSB aviation occurrence report 200601453 (Rejected takeoff, Brisbane Airport, Qld, 19 March 2006, VH-QPB, Airbus A330-303) available at www.atsb.gov.au. Such events will become apparent during takeoff. For an example of a failure of probe heating systems, see ATSB aviation occurrence investigation 200605307 (Erratic Airspeed Indications, 241 km NNE Perth Airport, 7 September 2006, VH-NXI, Boeing 717-200) available at www.atsb.gov.au.
27
- 16 -
It is important to note that the A330 unreliable airspeed occurrence on 28 October 2009 involving EBA was not the same type of event as the A330 in-flight upset events near Learmonth, Western Australia on 7 October 2008 involving VH-QPA (QPA). The two occurrences involved very different sequences of events and fault messages and, in the case of the QPA occurrence, the in-flight upsets were associated with erroneous angle of attack information rather than airspeed information. 28
For further information, see the available reports on ATSB aviation occurrence investigation AO-2008-070 (In-flight upset, 154 km west of Learmonth, Western Australia, 7 October 2008, VH-QPA, Airbus A330-303). The operator of the other A330 in Australia advised that it had no reports of an unreliable airspeed indication event. The international standard atmosphere (ISA) temperature at 39,000 ft is -56.5 C.
29
30
- 17 -
Following the 28 October 2009 occurrence, the crew of the 15 March 2009 event were contacted to obtain additional information. They reported that, at the time of the event, the captain was on a rest break and the second officer was in the left seat. Tropical weather with thunderstorms was present at the time. The crew had been diverting around the worst of the weather, and were crossing between cells when the event occurred. St Elmos fire was present at a moderate to high level. The crew recalled that the captains airspeed quickly went to zero, the autopilot disconnected and various other messages were presented on the ECAM. The event was over very quickly and there was no ongoing disagreement between the three airspeeds. The crew re-engaged autopilot 1 and autothrust without any further problems. The ALTN LAW message did not remain on, indicating that the flight control system reverted back to normal law following the event. Analysis of recorded position reporting data indicated that the location of the 15 March 2009 event was 1,050 km north of Port Moresby (see Figure 1). An MTSAT image taken at 1630 that day showed that the aircrafts position was located within or under a large defined cluster of cumulonimbus clouds at that time. The radiative cloud top temperature at 1630 was -71.8 C, which corresponded to cloud tops of over 47,500 ft. The most intense section of the cluster was located south to south-west of the event location.
The Goodrich probes 0851HL were certified in November 1996. The probe manufacturer has stated that this model of probes had improved performance capabilities relative to the 0851GR model by increasing the power density in the tip region by 35% over the existing probe, and incorporating the high power density in the drain hole region to ensure proper drainage during severe icing conditions. On 1 June 2009, an Airbus 330-200, operated as flight AF447, impacted the Atlantic Ocean on a flight from Rio de Janeiro, Brazil to Paris, France. An investigation by the French Bureau dEnqutes et dAnalyses pour la scurit de laviation civile (BEA) is ongoing, and the reasons for the accident have not yet been determined. 32
31
The manufacturer of Rosemount and BF Goodrich probes later became known as Goodrich, and the manufacturer of Sextant probes later became known as Thales. The BEA has released two Interim Reports on the 1 June 2009 accident that are available at http://www.bea.aero/en/index.php.
32
- 18 -
A series of maintenance messages that were transmitted by AF447 prior to the accident showed inconsistencies between the aircrafts airspeeds and the associated consequences on other aircraft systems. These included the same PFR messages as occurred on the 28 October 2009 occurrence involving EBA (for example, AUTO FLT AP OFF, NAV ADR DISAGREE and F/CTL ALTN LAW), as well as additional messages (for example, flight control computer faults). The Air France aircraft was fitted with Thales probes model C16195AA. On 31 August 2009, EASA issued AD 2009-0195. 33 The AD required as a precautionary measure that, for A330/A340 aircraft equipped with pitot probes manufactured by Thales, these probes be replaced with units manufactured by Goodrich. The reason provided was:
Occurrences have been reported on A330/340 family aeroplanes of airspeed indication discrepancies while flying at high altitudes in inclement weather conditions. Investigation results indicate that A330/A340 aeroplanes equipped with Thales Avionics pitot probes appear to have a greater susceptibility to adverse environmental conditions than aeroplanes equipped with Goodrich pitot probes. A new Thales Pitot probe P/N C16195BA has been designed which improves A320 aeroplane airspeed indication behaviour in heavy rain conditions. This same pitot probe standard has been made available as optional installation on A330/A340 aeroplanes, and although this has shown an improvement over the previous P/N C16195AA standard, it has not yet demonstrated the same level of robustness to withstand high-altitude ice crystals as the Goodrich P/N 0851HL probe. At this time, no other pitot probes are approved for installation on the A330/A340 family of aeroplanes. Airspeed discrepancies may lead in particular to disconnection of the autopilot and/or auto-thrust functions, and reversion to Flight Control Alternate law. Depending on the prevailing aeroplane altitude and weather environment, this condition could result in increased difficulty for the crew to control the aeroplane.
As part of the investigation into the AF447 accident, the BEA and aircraft manufacturer reviewed previous occurrences involving airspeed disagreement on A330/A340 aircraft. Appendix 7 of BEAs second Interim Report contained details of 36 occurrences between the period 12 November 2003 and 7 August 2009 that the aircraft manufacturer concluded were attributable to the blocking of at least two pitot probes by ice. 34 Of those 36 events: 27 events involved aircraft fitted with Thales model C16195AA pitot probes (certified April 1998) and three events involved aircraft fitted with Thales model C16195BA pitot probes (certified April 2007) two events involved aircraft fitted with Goodrich 0851HL probes (including the EBA event on 15 March 2009) 35 the type of pitot probe was not known for the other four events.
33 34 35
On 2 September 2009, CASA issued a corresponding AD (AD/A330/108). In the list of 36 events, there were five aircraft associated with multiple events. Based on the available information, the aircraft manufacturer has also concluded that the most probable explanation for the occurrence involving EBA on 28 October 2009 was at least two pitot probes partially and temporarily blocked by ice crystals.
- 19 -
The aircraft manufacturer advised that the majority of the worldwide A330/A340 fleet as at 1 June 2009 had the Goodrich 0851HL probes fitted. All of the two associated Australian operators 22 A330s were fitted with Goodrich 0851HL pitot probes throughout their operational service history. 36 In its second Interim Report into the AF447 accident, the BEA also reviewed 13 of the unreliable airspeed occurrences where there were crew reports, flight recorder data and a PFR available. Some key aspects of these 13 flights were: All flights were between FL 340 and FL 390. The crews all reported not observing any significant radar echoes on the chosen flight path but that they identified active zones lower or nearby. All the events occurred in instrument meteorological conditions (IMC). Only three crews reported having heard or observed what they identified as ice or rain. Recordings of SAT or TAT generally showed increases of 10 to 20 C during the event. In all of the cases, turbulence was recorded and reported. The levels were reported to vary from slight to strong. In nine of the cases, a stall warning occurred. 37 The maximum continuous duration of invalid recorded speeds was 3 minutes 20 seconds. BEA and the aircraft manufacturer have advised the ATSB that the duration of the EBA event on 28 October 2009 was brief compared to most of the other events where recorded data was available.
The BEA advised that St Elmos fire was sometimes but not always reported by the crews of aircraft that experienced an unreliable airspeed indication event. The pitot probe manufacturer also advised that the occurrence of St Elmos fire would not affect the performance of an aircrafts pitot probes. In summary, the environmental circumstances encountered by EBA on 28 October 2009 were similar to those of previous occurrences. However, the 28 October 2009 occurrence appeared to be less significant than many others in terms of its duration, and it did not involve stall warnings.
The other A330 aircraft registered in Australia (June 2009) originally had Thales BA probes fitted. These were replaced in accordance with the relevant CASA airworthiness directive. Turbulence can cause brief angle of attack fluctuations that can generate spurious stall warnings. In normal law, spurious warnings are eliminated by setting a high angle of attack threshold to trigger a stall warning. In alternate law this high warning threshold is removed.
37
- 20 -
maintenance records and occurrence reports identified no additional events. Details of the three A320 events are at Appendix A.
- 21 -
Based on its review of the topic, the BEAs second Interim Factual report on the AF447 accident concluded (section 4.2):
In fact, the certification criteria are not representative of the conditions that are really encountered at high altitude, for example with regard to temperatures. In addition, it appears that some elements, such as the size of the ice crystals within cloud masses, are little known and that it is consequently difficult to evaluate the effect that they may have on some equipment, in particular the Pitot probes. In this context, the tests aimed at the validation of this equipment do not appear to be well-adapted to flights at high altitude.
Consequently, the BEA made recommendations for the European Aviation Safety Agency (EASA) to undertake further research into the composition of cloud masses at high altitude, as well as to review the certification criteria for pitot probes in icing environments (see the SAFETY ACTION).
- 22 -
inconsistencies in measured airspeeds as major. This classification was subsequently confirmed by the aircraft manufacturer and EASA in 2009. A major failure condition was defined in the ACJ as one that resulted in a significant reduction in safety margins, or a reduction in the ability of the flight crew to cope with adverse operating conditions as a result of increase in workload or as a result of conditions impairing their efficiency. In contrast, hazardous was defined as large reduction in safety margins and catastrophic as loss of the aircraft and/or fatalities. According to ACJ No. 1, failure conditions classified as major should not occur at a likelihood greater than remote. The term remote was defined as meaning it was unlikely to occur to each aircraft during its total life, but may occur several times when considering the total operational life of all aircraft of the same type. It was described as being equivalent to a likelihood of 10-5 to 10-7 per flight hour. The operator of EBA and the associated Australian operator had over 400,000 hours of A330 operation in the period 2003 to 2009. The rate of unreliable airspeed events during cruise was therefore less than 5x10-6 (and within the 10-5 to 10-7 per flight hour range). If the large number of other operators using the same pitot probes is considered, the rate of such events was substantially lower across the world fleet.
- 23 -
ANALYSIS
Introduction
At 1537 on 28 October 2009, there were disagreements in the three sources of airspeed information on Airbus A330-202 aircraft, registered VH-EBA (EBA). This was the second event of this type involving the same aircraft, and one of only three events known to have occurred on Airbus A330/A340 aircraft fitted with Goodrich 0851HL pitot probes. The consequences of the airspeed disagreement event in the 28 October 2009 occurrence were not hazardous. There was a brief loss of availability of the autopilot and a number of other flight guidance functions, and the flight control system reverted to alternate law for the remainder of the flight. There was no effect on the aircrafts flight path. Although this airspeed disagreement event was relatively benign in nature, airspeed is a critically important parameter for aircraft control. Accordingly, a safety investigation was initiated to examine the reasons for this event, consider why two events had occurred on the same aircraft, and consider the suitability of the risk controls in place to minimise the frequency, duration and adverse consequences of such events for Australian A330 operators. Relevant risk controls included the design and reliability of relevant aircraft systems, flight crew procedures, and associated flight crew training.
- 25 -
high altitudes was considered the most likely explanation. The observed conditions were also outside of the design specifications (temperature and altitude) of the certifying authority and the aircraft manufacturer for the pitot probes in icing environments. The same aircraft (EBA) had a similar occurrence on 15 March 2009, although the resulting maintenance messages suggested that event was less significant. The reported weather conditions for that event were also consistent with those of previous events. Although having two events on the same aircraft may suggest a specific problem associated with that aircraft or its components, tests and examinations identified no such problem. In summary, it is reasonable to conclude that the unreliable airspeed occurrences involving EBA on 28 October 2009 and 15 March 2009 resulted from at least two of the aircrafts pitot probes being temporarily obstructed by ice crystals.
- 26 -
unreliable airspeed / ADR (air data reference) check procedure. Had the airspeed disagreements persisted for a much longer duration, then the situation could have posed a more significant challenge for the crews to manage. Many of the operators A330 pilots had not received specific training in unreliable airspeed situations prior to the 28 October 2009 occurrence. Some of the operators pilots had received such training during their A330 endorsements (such as the first officer on the 28 October 2009 occurrence flight), but most of the pilots had transferred from the A320 and had not received such training either during their A320 endorsement or during the cross crew qualification training. The absence of unreliable airspeed training for many of the operators A330 pilots prior to October 2009 was not necessarily a significant safety issue given the low likelihood and apparently benign nature of such events for aircraft equipped with the Goodrich probes. In addition, the operator was actively addressing the situation, and had started including unreliable airspeed situations into its A330 recurrent training in October 2009 (and into its A320 recurrent training program in May 2009). Nevertheless, there was a residual safety issue associated with the third-party training providers A320 endorsement training program. The aircraft manufacturer is a critically important source of information about the content to include in a training program, based on its collection of information about in-service experience and occurrences from operators. However, the training provider did not have a current version of the aircraft manufacturers recommended training program and therefore could not utilise this important source of information when revising or maintaining its syllabus. Although the training provider could receive requests from operators to make changes to its training program, this process did not necessarily provide a high level of assurance that changes would be made in line with the manufacturers recommendations in a timely manner. The aircraft manufacturer had included unreliable airspeed training in its recommended training program since 2003, but the training provider was not aware of this change and had not included this topic in its training program prior to the 28 October 2009 occurrence. The Civil Aviation Safety Authority had an expectation that the operator would provide the training provider with updated materials from the aircraft manufacturer. However, the operator could not provide the training provider with the aircraft manufacturers materials due to copyright restrictions. This situation appeared to be another example of unclear responsibilities between operators and third-party training providers identified in previous Australian Transport Safety Bureau investigations, and one that required all the involved parties to take action to ensure that future endorsement training was consistent with the latest advice from the aircraft manufacturer.
- 27 -
FINDINGS
Context
On a flight from Narita, Japan to Coolangatta, Australia on 28 October 2009, an Airbus A330 aircraft (VH-EBA) experienced an unreliable airspeed indication event that resulted in the disconnection of the autopilot and other flight guidance functions, a NAV ADR DISAGREE caution message, and the flight control system reverting to alternate law. From the evidence available, the following findings are made with respect to the unreliable airspeed occurrence and should not be read as apportioning blame or liability to any particular organisation or individual.
- 29 -
SAFETY ACTION
The safety issues identified during this investigation are listed in the Findings and Safety Actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices. All of the responsible organisations for the safety issues identified during this investigation were given a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Although the pitot probes fitted to A330/A340 aircraft met relevant design specifications, those specifications were not sufficient to prevent the probes from being obstructed with ice during some types of environmental conditions that the aircraft could encounter.
Action taken by the French Bureau dEnqutes et dAnalyses pour la scurit de laviation civile
In its second Interim Report on the investigation into the Air France A330-200 accident on 1 June 2009, the French Bureau dEnqutes et dAnalyses pour la scurit de laviation civile (BEA) issued the following recommendations to the European Aviation Safety Agency (EASA):
1. undertake studies to determine with appropriate precision the composition of cloud masses at high altitude, and 2. in coordination with the other regulatory authorities, based on the results obtained, modify the certification criteria.
Given the comprehensive scope of the BEA investigation, there is no need for the ATSB to make any additional recommendations regarding this safety issue.
As of 28 October 2009, many of the operators A330 flight crew had not received unreliable airspeed training, either during endorsement training or recurrent
- 31 -
training. The operator started introducing such training in its recurrent training program in early October 2009.
Action taken by Jetstar
The operator included an introduction to unreliable airspeed situations in its A330 recurrent (cyclic) training session for the period October 2009 to March 2010. Further training is being included in the following cyclic session (April to September 2010).
Action taken by other Australian A330 operators
The associated Australian A330 operator (Qantas) advised that its A330 cyclic training session from 19 June 2009 to January 2010 included discussion items and a simulator exercise applying the unreliable airspeed / ADR check procedure. The operator of the only other A330 aircraft registered in Australia also advised that it had started including unreliable airspeed training in its training programs.
ATSB assessment of action by the operators
The ATSB is satisfied that that the action by the Australian operators adequately addresses this safety issue.
When revising or maintaining its A320 endorsement training program, the third-party training provider did not use or have access to current versions of the aircraft manufacturers recommended training program.
Action taken by various organisations
In July 2010, the training provider (Boeing Training and Flight Services) received approval from the Civil Aviation Safety Authority (CASA) for a revised A320 endorsement training program that included unreliable airspeed training. The operator (Jetstar) advised that it was conducting regular training gap analysis of third-party training programs versus aircraft manufacturer recommendations. The operator and the training provider also reported that they were examining options to enable the training provider to directly access the aircraft manufacturers recommended training program. CASA advised that new regulations applying to third-party training parties were expected to be introduced in 2011 with an effective date of 2012, and that these rules would more clearly specify the responsibilities of the training providers. It also advised that it was reviewing its processes for providing approvals for training providers training programs.
- 32 -
The ATSB is satisfied that that the action taken to date, and action proposed to be taken, by the various organisations will, when completed, adequately address this safety issue.
- 33 -
38
The EASA AD 2009-0195 for A330/A340 aircraft noted that the C16195BA improves A320 aeroplane airspeed indication behaviour in heavy rain conditions compared to C16195AA probes.
- 35 -
A PAN 39 was declared, the autopilot and autothrust were restored, and the landing at Brisbane was uneventful. There were no injuries reported. Analysis of flight data recorder and system built-in test equipment data showed that it was likely that the first officers pitot, the standby pitot and the captains total air temperature probes had been partially and temporarily obstructed. The airspeed discrepancies lasted over a period of about 2 minutes. Subsequent inspections identified no problems with any components, although one of the pitot probes made a different noise when air was passed through it when compared to the other probes. The aircraft was fitted with Thales C16195BA probes at the time of the event and these were replaced by Goodrich 0851HL probes. 40 The operator included unreliable airspeed situations in its cyclic training sessions on the A320 fleet in May to September 2009 and May to September 2010.
Additional information
The operator advised that, as of the end of November 2010, all of its A320 aircraft and most of its A321 aircraft were fitted with Goodrich 0851HL probes, and by the end of December 2010 the remainder of its A321 aircraft would be fitted with the Goodrich probes.
39
A PAN transmission is made in the case of an urgency condition which concerns the safety of an aircraft or its occupants, but where the flight crew does not require immediate assistance. Although EASA had issued an airworthiness directive on 31 August 2009 to replace Thales pitot probes on A330/A340 aircraft, there was no such requirement to replace probes on A320 aircraft.
40
- 36 -
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report. A draft of this report was provided to the flight crew of both A330 occurrences, the aircraft and associated aircraft operators, the aircraft and pitot probe manufacturers, the third-party training provider, Civil Aviation Safety Authority, the BEA and the US National Transportation Safety Board. Submissions were received from the flight crew, the operator and the aircraft manufacturer. Those submissions were reviewed and, where necessary, the text of the report was amended accordingly.
- 37 -
Unreliable airspeed indication 710 km south of Guam, 28 October 2009 VH-EBA, Airbus A330-202