(/index.php/Main_Page)
(http://www.skybrary.aero/index.php/EUROCONTROL)
(http://www.skybrary.aero/index.php/ICAO)
(http://flightsafety.org/)
A320, vicinity Perth Australia, 2015
Summary
On 12 September 2015, an Airbus A320 autopilot and autothrust dropped out as it climbed out of
Perth and multiple ECAM system messages were presented with intermittent differences in
displayed airspeeds. During the subsequent turn back in Alternate Law, a stall warning was
disregarded with no actual consequence. The Investigation attributed the problems to
intermittently blocked pitot tubes but could not establish how this had occurred. It was also
found that the priority for ECAM message display during the flight had been inappropriate and
that the key procedure contained misleading information. These ECAM issues were subsequently
addressed by the aircraft manufacturer.
Event Details
When
Actual or Potential
Event Type
September 2015
Airworthiness (/index.php/AW), Human Factors
(/index.php/HF), Loss of Control
(/index.php/LOC)
Day/Night
Day
Flight Conditions
IMC
Flight Details
Aircra
AIRBUS A-320 (/index.php/A320)
Operator
Virgin Australia (/index.php/Virgin_Australia)
Domicile
Australia (/index.php/Australia)
/
Type of Flight
Public Transport (Passenger)
Origin
Perth International Airport (/index.php/YPPH)
Intended Destination
YBGD (/index.php?
title=YBGD&action=edit&redlink=1)
Actual Destination
Perth International Airport (/index.php/YPPH)
Take off Commenced
Yes
Flight Airborne
Yes
Flight Completed
Yes
Flight Phase
Climb
ICL (/index.php/ICL) / ENR (/index.php/ENR)
Location - Airport
Airport vicinity
Perth International Airport (/index.php/YPPH)
General
Tag(s)
Air Turnback
HF
Tag(s)
Procedural non compliance
LOC
Degraded flight instrument display,
Tag(s)
Uncommanded AP disconnect,
Non-normal FBW flight control status
EPR
Tag(s)
PAN declaration
AW
/
System(s)
Indicating / Recording Systems
Outcome
Damage or injury
No
Causal Factor Group(s)
Group(s)
Aircraft Operation,
Aircraft Technical
Safety Recommendation(s)
Group(s)
None Made
Investigation Type
Independent
Type
Contents
1 Description
2 Investigation
2.1 What Happened
2.2 Analysis
3 Related Articles
Description
On 12 September 2015, an Airbus A320 (/index.php/A320) (VH-FNP) being
operated by Virgin Australia Regional Airlines on a domestic passenger charter
flight from Perth to Boolgeeda, Western Australia experienced uncommanded
autopilot (/index.php/Autopilot) and autothrust disconnection and multiple
system alerts as the aircraft climbed on departure from Perth in day IMC
(/index.php/Instrument_Meteorological_Conditions_(IMC)). During the subsequent
/
return to Perth, a precautionary PAN (/index.php/Emergency_Communications)
was declared to ATC and a stall warning (/index.php/Stall_Warning_Systems)
which occurred whilst establishing on the ILS
(/index.php/Instrument_Landing_System_(ILS)) localiser was disregarded without
apparent consequence but subsequently was found to have been real.
Investigation
An Investigation was carried out by the Australian Transport Safety Bureau
(ATSB). Data from the aircraft FDR (/index.php/Flight_Data_Recorder_(FDR)) and 2
hour CVR (/index.php/Cockpit_Voice_Recorder_(CVR)) were successfully
downloaded. Information on the total and aircraft type experience of the pilots
involved was not recorded.
What Happened
It was established that on arriving at the aircraft prior to the departure of the
event flight, its first flight of the day, the crew found a ground engineer present
and that the APU (/index.php/Auxiliary_Power_Unit_(APU)) was running but that a
GPU (/index.php/Ground_Power_Unit_(GPU)) was also connected to the aircraft.
The engineer advised this was because the batteries had gone flat during
overnight maintenance whilst rectification of an avionics defect was being
performed. On entering the flight deck, the Captain reported having found it “still
untidy” after the overnight maintenance with “a number of controls and system
configurations not at their normal settings”. The battery charge
(/index.php/Aircraft_Batteries) was subsequently completed prior to engine start.
Takeoff from runway 21 with the Captain as PF
(/index.php/Pilot_Flying_(PF)_and_Pilot_Monitoring_(PM)) proceeded normally
until the aircraft was climbing through about 8,000 feet QNH about 4 minutes
after getting airborne when an un-commanded disconnection of the A/T was
followed 10 seconds later by an un-commanded disconnection of the AP with
Normal Law replaced by Alternate Law (/index.php/Flight_Control_Laws). The
first of several attempts to re-engage the AP was unsuccessful and the crew
reported that they had then identified an ECAM
(/index.php/Electronic_Centralized_Aircraft_Monitor_(ECAM)) alert ‘ENG 1 EPR
MODE FAULT’. At this point, it was considered likely that the ECAM display had
probably appeared as in the illustration below such that it was only displaying
/
the first lines of a multi-line generated message on the (presumed) basis that
the complete message had been generated with its lines in priority order so that
the necessary actions would be taken in that order.
(/index.php/File:A320_vic_Perth_2015_ECAM_msg.jpg)
The ECAM message as initially visible after the AP
disconnect. [Reproduced from the Official Report]
The Captain took manual control of the aircraft and continued the climb. The
airspeed control mode had automatically changed from ‘managed’ to ‘selected’
with the corresponding advice to set the target airspeed to the green dot speed
but as this was not visible, the Captain decided to fly at a 10° nose-up attitude
to ensure that the aircraft continued to climb. The Captain commented to the
First Officer in respect of the loss of the airspeed limit and other speed
information and at this time, FDR data showed that the Captain’s airspeed
display was around 290KIAS, 40 knots in excess of the applicable speed
restriction of 250 knots. A little over 2 minutes after the AP had disconnected,
the flight was re-cleared to continue climb to FL 350. Without first
acknowledging this, the Captain asked the First Officer to run the ECAM actions
related to the alerts received (referred to as ECAM actions). This action was
interrupted when the Captain decided instead to request stopping the climb at
FL 200 and advise that they were “trouble shooting”. The First Officer’s attempt
to run the ECAM actions was further interrupted when ATC gave a frequency
change from Perth Departures to Melbourne Centre, but after this had been
achieved, the ECAM actions for the ‘ENG 1 EPR MODE FAULT’ which involved
switching both engines to N1 mode and thereafter manually adjusting the thrust
(/index.php/Thrust) were completed. However, none of those actions was
followed by any change in the ECAM display, so this alert was cleared as was the
next message, the same alert for the number 2 engine, which did not require any
more actions than had already been completed for the no 1 engine so this alert
was cleared too.
/
This led to the ‘NAV ADR DISAGREE’ message (Navigation - Air Data Reference
disagree) first becoming visible on the ECAM almost 8½ minutes after the AP
disconnect had occurred. The required action for this alert was to crosscheck
the indicated airspeed (/index.php/Indicated_Airspeed_(IAS)) on the three
available displays which were confirmed as the same which meant the message
could be cleared. The next message displayed was the advisory ‘F/CTL ALTN
LAW’ which when cleared led to an ‘AUTO FLT A/THR OFF’ advisory which also
required no action and was cleared. Advisories for the lack of rudder limiter
above 160 knots followed.
The flight was continued en-route after communicating with their company and
the crew began consulting the FCOM for more information. They noted that the
‘NAV ADR DISAGREE’ procedure and the associated alternate law procedure both
stated that if no speed disagreement had been found then there was an angle of
attack (/index.php/Angle_of_Attack_(AOA)) discrepancy and an associated “risk of
undue stall warning”. It also noted that once the landing gear was lowered,
Alternate Law would change to Direct Law.
Approximately 30 minutes into the flight, and about 150 nm from Perth, the
Captain decided to return there. A further attempt to engage the Captain’s AP
was not successful but it did restore his FD (/index.php/Flight_Director) and
after rebooting the no 2 Flight Augmentation Computer (FAC2), the AP did
become available.
The descent progressed normally and the Captain transferred control to the First
Officer. Then, passing about 10,000 feet, the Captain noticed that his airspeed
was decreasing and informed the First Officer who subsequently “recalled
observing that the minimum speed warning area on the captain’s airspeed
indicator was increasing and announced that there was a disagreement between
the airspeed indicators”. The Captain disconnected the AP and a check of the
three airspeed indicators showed that the Captain’s was indicating a lower speed
than the other two so the Captain switched to ADR 3 which restored a correct
airspeed reading and he therefore re-engaged the AP and the crew continued
with their landing preparations.
About 3 minutes later, another un-commanded AP disconnect occurred with
similar airspeeds on both pilots displays. The AP disconnect warning was cleared
and the Rudder Limiter caution was observed. Radar vectors were requested
from ATC to increase track miles to ILS LLZ interception and an orbit was
/
performed at 5000 feet QNH. The Captain used the time to review their situation,
noting that they were in Alternate Law and that Direct Law with loss of all flight
envelope protections would follow once the gear was extended. He also
“reiterated that there was a risk of an undue stall warning” and decided that a
PAN would be declared to ATC advising that they had control system issues, were
manually flying the aircraft and were in Alternate Law. ATC responded by offering
attendance of the emergency services for the landing, which was accepted.
After a turn to intercept the runway 21 ILS LLZ had been commenced, the
Captain took over control and requested flaps (/index.php/Flaps) 1 and a target
speed of 200 knots. Then, with the aircraft at 2,550 feet QNH and still in the
turn, the stall system warning was activated. The Captain continued the turn and
was recorded as repeatedly announcing “disregard” and after 6 seconds, the
warning ceased. Once established on the ILS GS, with his airspeed indication
reading 170 knots, the Captain requested flap 3 but the First Officer, whose
indicated airspeed was 190 knots, responded that the flap 3 limit speed was 185
knots. The approach was continued and the Captain requested that the target
airspeed should be set to 145 knots, about 3 knots higher than the calculated
approach speed “to carry a little extra speed for the approach” .
The landing gear was extended at 2,400 feet and the remainder of the approach
and landing was completed without further incident after 70 minutes airborne
and the aircraft was taxied to its allocated parking position and shut down.
(/index.php/File:A320_vic_Perth_2015_gr_track.jpg)
An annotated diagram of the descent and approach to
Perth and the outbound ground track. [Reproduced
from the Official Report]
/
Analysis
During post flight maintenance action by the operator, it was found that all three
pitot systems (/index.php/Pitot_Static_System) were contaminated with water,
with one drain hole blocked in both the left and right systems and both drain
holes blocked in the standby system. Solid matter as well as water was found to
have been contaminating the standby pitot system. The system contaminants
were not collected or analysed and it proved impossible to establish their
source. It was confirmed that the recommended maintenance requirements for
the pitot systems had been followed and noted that there was no previous
history of system contamination in any of the aircraft types operated by the
company involved. Nevertheless, there had been an on-ground erroneous
airspeed event three days and three flights prior to the investigated flight and
evidence was found in the downloaded FDR data from that flight and the two
flights which separated it from the investigated flight that there had been
transient rejections of ADR 3 data by the aircraft flight data system in flight
without any corresponding in-flight airspeed anomalies. It was considered that
the on-ground event three days earlier had been “an opportunity for the operator
to have identified an unreliable airspeed indication
(/index.php/Unreliable_Airspeed_Indications) event and carried out the actions
recommended by the manufacturer”. However, it was noted that the aircraft had
been at an airport without resident maintenance support at the time and the
flight crew had cured the problem by following guidance from company
maintenance to recycle the aircraft electrics.
Airbus advised that “most airspeed discrepancy events during take-off or
approach were the result of water contamination of the pitot probes and the
pitot probe drainage holes being obstructed by external particles”. It was also
noted that the pitot probes fitted to the aircraft involved had an enhanced water
trap and relocated drain holes which together were likely to have provided
increased system reliability in the event of heavy rain. There was no recurrence
of contamination-related pitot system problems following the return of the
aircraft to service.
The Investigation was particularly concerned to review the way ECAM information
had been provided to the crew when the problems arose. It was noted that the
procedure for the amber NAV ADR DISAGREE alert, which had appeared once the
EPR mode faults for both engines had been cleared, required that the three
airspeed displays be cross checked. If they were not all the same, the crew were
/
directed to apply the ADR check procedure, but if at the time the procedure was
actioned there was no airspeed disagreement (which was the case during the
investigated flight) then the procedure referred the crew to the actions for an
AoA (/index.php/Angle_of_Attack_(AOA)) discrepancy which were confined to
noting the remark ‘RISK OF UNDUE STALL WARN’. It was found that although the
FCOM provided specific procedures for how to manage an airspeed discrepancy
by following the ‘Unreliable airspeed indication/ADR check procedure’, there was
no reference to this in the ECAM messages received. It was also noted that
whilst AoA values could be viewed on the MFD ‘alpha call up’ page, this option
was not mentioned in the procedure to be followed to confirm an angle of attack
disagreement. In summary, it was observed that if the system specifically
identified a fault in any of the angle of attack systems, an amber ECAM message
‘NAV (CAPT/FO/STBY) AOA FAULT’ would be displayed for which the FCOM
response was ‘crew awareness’.
No evidence was found that the amber ECAM alert ‘NAV IAS DISCREPANCY’
amber alert, which is activated when a discrepancy between the two primary
airspeed displays is detected - and which would require a cross check of all
three airspeeds and the use of air data switching as required - occurred during
the investigated flight. This indicated that ADR 3 (standby airspeed) was rejected
before ADR 1 and 2 so thereby triggering the ‘NAV ADR DISAGREE’ message.
Airbus advised that this message would have inhibited the ‘NAV IAS
DISCREPANCY’ alert which, as the ‘NAV ADR DISAGREE’ message was latched
until the end of the flight, would have prevented the ‘NAV IAS DISCREPANCY’
alert being triggered when a discrepancy between the Captain’s and First
Officer’s airspeed displays occurred at a later stage in the flight. In the light of
these findings, it was considered by the Investigation that “the number and
nature of the indications of unreliable airspeed indicate that the development of
a situation can be insidious and not necessarily obvious”.
It was concluded that the crew actions in response to the sequence of ECAM
messages which they were presented with had resulted in the ‘NAV ADR
DISAGREE’ alert not being actioned until after the airspeed fault had ceased
which led to an incorrect diagnosis of the origin of the alert. It was considered
that whilst an EPR (/index.php/Engine_Pressure_Ratio_(EPR)) mode fault would
not pose a short-term hazard to safe flight because the crew would still have
control of engine thrust, aircraft control depends on awareness of the reliability
of airspeed information which meant that the prevailing ECAM message relative
priority in this instance was questionable.
/
The overall assessment by the Investigation of the crew actions in response to
the problems they encountered prior to the stall warning on final approach was
as follows:
When the autothrust and autopilot first disconnected, the captain announced
that he had control and that he would fly the aircraft ‘ten degrees nose up’.
Although this was consistent with the unreliable speed indication procedure
when below FL 100, there was no indication from the recorded information or
interviews that the captain was aware of an airspeed discrepancy and
intentionally carried out that procedure. It was more likely an instinctive reaction
to the loss of automation to ensure that the aircraft was in a state that the
Captain knew was safe.
When the Captain’s airspeed deviated from the other indications during the
descent, the flight crew were provided with an opportunity to identify that they
were confronted with an unreliable airspeed indication event. However, their
actions following this do not appear to indicate that they had made this
connection.
The act of switching the air data source for the captain’s indicator from CAS 1 to
CAS 3 was consistent with the NAV IAS DISCREPANCY alert, but there was no
record of the alert having been triggered. Neither was it consistent with the
unreliable speed indication procedure, because the crew did not switch off any
of the ADRs, the aircraft was not levelled out for troubleshooting, there was no
discussion regarding unreliable airspeed, and they did not respond to the stall
warning that occurred after the air data source was switched to CAS 3.
An examination of the FDR data at the time of the stall warning confirmed that
the SBY system airspeed display (which by then was being fed to the Captain’s
position as a result of the crew noticing that the normal data source was
presenting an incorrect speed) was valid. It was noted that at the prevailing
Mach number (/index.php/Mach_Number), the AoA threshold to trigger a stall
warning would have been 8°. However, although the only valid AoA recorded at
this time was 7.4° from ADR 2, it was noted that stall warning logic only requires
one of the three angle of attack values to exceed the threshold. Since until the
Captain had been obliged to change over his data source to ADR 3, the primary
sources of AoA had been consistent, it was considered “most likely that the stall
warning was triggered by AoA 3, which was not recorded” on the FDR. It was
noted that when the stall warning was activated during the right turn onto final
/
approach, a small lateral acceleration which indicated a wind gust
(/index.php/Wind) from the right side was recorded. It was concluded that “the
placement of the angle of attack probe for ADR 3 is such that (such) a lateral
gust could produce a local increase in the angle of attack (which) in this case
was probably sufficient to go beyond the stall warning threshold, triggering the
warning”. The stall warning was thus genuine, albeit nominal.
The Investigation observed as follows in respect of the stall warning and the
response to it:
Stall warnings are designed to activate at an angle of attack that provides some
margin before the aircraft will actually stall. In this case, the angle of attack
measured by one sensor was sufficient to activate the stall warning, but there
was no indication that the aircraft had stalled.
In their analysis of the sequence of events, the manufacturer identified that the
captain made nose-down control inputs while the stall warning was activated.
However, the CVR captured the Captain clearly verbalising that he was
disregarding the stall warning. Although the nose-down inputs occurred during
the stall warning, there was no significant change in the airspeed and the bank
angle was increased during the time the warning was active. Thus, it is more
likely that the nose-down control inputs were required to control the desired
flight path and not related to the warning.
Six Contributing Factors were identified, two in respect of the indications of
unreliable airspeed and four more in respect of the diagnosis of the origin of the
NAV ADR DISAGREE Alert as follows:
The unreliable airspeed indications
Drains in all three pitot probes were blocked, preventing water
contamination from being effectively discharged
Before and during the flight, water temporarily obstructed all three of the
aircraft’s pitot probes, resulting in erroneous airspeed indications.
Differences in the airspeeds across the three air data reference systems
consequently affected the engine control, flight control and auto flight
systems, degrading their functionality and generating multiple system
alerts.
The determination of the origin of the NAV ADR DISAGREE Alert
/
The flight crew’s workload (/index.php/Pilot_Workload) following multiple
system failures was high, affecting their ability to process information
quickly. This, combined with maintaining safe flight, resulted in the flight
crew taking about 8 minutes to attend to the engine alerts and action the
NAV ADR DISAGREE procedure.
When the flight crew actioned the NAV ADR DISAGREE procedure, the
airspeeds were consistent on all indicators, leading them to incorrectly
diagnose that the system failure was the result of an angle of attack
discrepancy rather than erroneous airspeeds. The procedure informed them
that in this situation, there was a risk of undue stall warning.
Although the NAV ADR DISAGREE had more immediate safety implications
relating to unreliable airspeed, the ECAM alert priority logic placed this
alert below the engine related faults. As a result, the NAV ADR DISAGREE
alert was not immediately visible to the flight crew due to the limited
space available on the ECAM display. [Safety Issue]
A NAV ADR DISAGREE alert can be triggered by either an airspeed
discrepancy, or angle of a ack discrepancy. The alert does not indicate
which, and the associated procedure may lead flight crews to incorrectly
diagnosing the source of the alert when the airspeed is erroneous for a
short period and no airspeed discrepancy is present when the procedure is
carried out. [Safety Issue]
An Additional Factor that increased risk was also identified as “believing it to be
an erroneous (stall) warning due to an angle of attack discrepancy, the flight
crew disregarded a real stall warning during the approach”.
An Additional Finding was that “the source of the foreign material blocking the
pitot probe drain holes could not be identified”.
Safety Action taken by Airbus in response to the findings of the Investigation was
noted as having included the following:
the relative ECAM display priority of the ‘NAV ADR DISAGREE’ alert has been
increased so that it has a higher priority than ‘EPR MODE FAULT’ alerts. This
will significantly improve the detectability of a transient airspeed
discrepancy. It is noted that the FCTM presents this alert as one of the
typical situations which require the application of the ‘UNRELIABLE SPEED
INDICATION’ QRH procedure.
/
After review of AoA failure cases which lead to the triggering of the ‘NAV
ADR DISAGREE’ procedure, it has been decided to remove the information
line ‘RISK OF UNDUE STALL WARN’ from the ECAM message. The existence
of a Stall Warning System is deemed sufficient. This modification will be
introduced at the same time as the change in the ‘NAV ADR DISAGREE’ alert
priority.
The ability to detect unreliable airspeed situations will be further enhanced
by introduction of an ‘Unreliable Airspeed Mitigation Means’ (UAMM)
function. This will mean that in the event of a scenario such as the
investigated one, the ECAM should display the (red) ‘NAV ALL SPD
UNCERTAIN’ warning, which will require the ‘ADR CHECK PROC /
UNRELIABLE SPEED INDICATION’ procedure to be applied. This function is
planned for introduction on new-build aircraft during 2019 and will also be
available for retrofit to in-service aircraft subject to their having a minimum
computer configuration.
The Final Report (https://www.skybrary.aero/bookshelf/books/4642.pdf) was
released on 4 April 2019. No Safety Recommendations were made.
Related Articles
Unreliable Airspeed Indications (/index.php/Unreliable_Airspeed_Indications)
Air Speed Indicator (/index.php/Air_Speed_Indicator)
Stall (/index.php/Stall)
Electronic Centralized Aircraft Monitor (ECAM)
(/index.php/Electronic_Centralized_Aircraft_Monitor_(ECAM))
Engine Indicating and Crew Alerting System (EICAS)
(/index.php/Engine_Indicating_and_Crew_Alerting_System_(EICAS))
Stall Warning Systems (/index.php/Stall_Warning_Systems)
Pitot Static System (/index.php/Pitot_Static_System)
Retrieved from "https://www.skybrary.aero/index.php?
title=A320,_vicinity_Perth_Australia,_2015&oldid=137747
(https://www.skybrary.aero/index.php?
title=A320,_vicinity_Perth_Australia,_2015&oldid=137747)"
/