Airbus is updating the flight warning system on its A320 platform in response to a 2015 Virgin Australia Regional Airlines flight where pilots had to deal with multiple system failure messages, the Australian Transport Safety Bureau (ATSB) says.
The incident occurred on September 12 2015, when VH-FNP was operating a charter flight from Perth to Boolgeeda with seven crew members and 139 passengers on board.
A sequence of system failure messages on the electronic aircraft monitoring (ECAM) system shortly after take off led to a high workload for the Captain and First Officer that affected their ability to process information quickly and attend to multiple tasks, the ATSB final report published on Thursday said.
Specifically, the ATSB final report said the pilots received an ECAM message relating to the engine, followed by a NAV ADR DISAGREE, or navigation – air data reference disagree, alert that could be triggered by either an airspeed or angle of attack discrepancy.
In this case, the ECAM message for an engine pressure ratio fault – EPR MODE FAULT – was prioritised higher and therefore appeared at the top of the page, pushing the NAV ADR DISAGREE alert further down the list.
As a result, it took the flight crew about eight minutes to address the NAV ADR DISAGREE alert.
“A NAV ADR DISAGREE alert can be triggered by either an airspeed discrepancy, or angle of attack discrepancy,” the ATSB final report said.
“The alert does not indicate which, and the associated procedure may lead flight crews to incorrectly diagnosing the source of the alert when the airspeed is erroneous for a short period and no airspeed discrepancy is present when the procedure is carried out.”
The ATSB report noted ECAM messages were prioritised into three alert levels, with Level 3 (red) messages presented ahead of Level 2 (amber) messages and Level 1 (amber) messages.
And for alerts of the same level, Airbus assigned a priority based upon factors decided during design.
At the time of the incident, amber alerts for engine-related failures had a higher priority than amber alerts for navigation and air data failures.
However, the ATSB said that after a review of the incident, Airbus had decided to increase the priority of the NAV ADR DISAGREE alert.
“The NAV ADR DISAGREE alert will now have a higher priority than the EPR MODE FAULT alerts,” Airbus told the ATSB, according to the final report.
“This will insure that in the event scenario, this alert would be directly visible to the crew.
“This modification will be introduced in the next FWS (flight warning system) standard for SA family, the version F12, which currently planned for Q1-2019. A worldwide retrofit is anticipated.”
Further, the ATSB said the “risk of undue stall warning” message will be removed from the aircraft status related to the NAV ADR DISAGREE alert.
“The ATSB’s safety message from this investigation is where there is erroneous information from an information source, it is important that alerts and procedures be designed to ensure that the pilots can correctly diagnose the source of the erroneous information,” ATSB executive director for transport safety Nat Nagy said in a statement.
“Further, unless it is absolutely clear that it is erroneous, pilots should appropriately respond to stall warning alerts.”
Blocked pitot probes led to unreliable airspeed indications and stall warning
The report said the A320 was climbing through 8,000ft when there was an alert of the ECAM system for an engine pressure ratio (EPR) fault.
However, when dealing with this matter, the ATSB final report said the flight crew “were not aware of and did not action the NAV ADR DISAGREE procedure until about eight minutes had passed since the alert was generated”.
“By this time, the airspeed discrepancy that had generated the alert was no longer present,” the ATSB final report said.
“Therefore, when the flight crew crosschecked the airspeeds, the airspeeds were consistent and they diagnosed the issue as an angle of attack discrepancy.”
The ATSB said the flight crew’s high workload, the priority of alerts programmed into the ECAM and the “suitability of the NAV ADR DISAGREE procedure for short duration airspeed disagreements” led to the incorrect diagnosis the source of the problem.
The ECAM system also altered the flight crew that the aircraft was operating under F/CTL ALTN LAW, which stood for flight control alternate law and meant the level of flight envelop protection was reduced.
The flight crew also received a series of ECAM alerts that were more advisory in nature – AUTO FLT A/THR OFF (auto flight authothrust off), AUTO FLT RUD TRV LIM SYS (autoflight rudder travel limiter system), AUTO FLT RUD TRIM1 FAULT (autoflight rudder trim 1 fault) and AUTO FLT RUD TRV LIM 2 (autoflight rudder travel limiter 2).
After requesting a return to Perth, the aircraft was descending through 10,000ft when the First Officer “recalled observing that the minimum speed warning area on the captain’s airspeed indicator was increasing and announced that there was a disagreement between the airspeed indicators”, the ATSB report said.
“At the same time, the Captain disconnected the autopilot and both crew checked the airspeeds on all three indicators,” the ATSB report said.
“They identified that the Captain’s was indicating lower than the other two, so the Captain switched his air data source to ADR 3.
“This resulted in the captain’s indicated airspeed increasing to a speed consistent with the first officer’s indicator. The captain then re-engaged the autopilot and continued with their landing preparations.”
About three minutes later, the autopilot disconnected, with the First Officer’s airspeed indicator showing 220kt with a target of 230kt. Meanwhile, the recorded data from the flight indicated that the Captain’s airspeed indicator was about 230 kt.
The Captain also saw an RUD TRV LIM SYS alert had appeared on the ECAM. As this had appeared previously, the message was cleared.
The flight crew also requested, and received, radar vectors from air traffic control to “get a few more track miles before turning back to intercept the localiser” after assessing the aircraft was slightly high on the descent to set up for the approach.
As the aircraft was heading back towards the approach path, the Captain declared a PAN – defined as a radio call that indicated an urgent condition concerning the safety of an aircraft or its occupants, but where the flight crew does not require immediate assistance – telling air traffic control they were having “control system issues, were manually flying the aircraft and were in alternate law”.
Later in the approach, there was another noticed discrepancy between the airspeed indicators of the two pilots, with the Captain’s showing 175kt and the First Officer’s showing 190kt.
There was also a stall warning during the approach, when flight crew was aligning the aircraft with the instrument landing system, the ATSB report said.
“The warning stopped after six seconds and the approach continued for a successful landing,” the ATSB report said.
The aircraft touched down without further incident, emergency services were present but not required.
After the flight, the three pitot probes of the aircraft, which measure the airspeed of the aircraft, were cleaned. It found the the Captain and First Officer pitot probes had one drain hole blocked, while the standby pitot probe had both drain holes blocked, including one with a foreign object.
“All three pitot systems were affected by water contamination during the flight,” the ATSB report said.
And about seven weeks after the incident, the pitot probes were sent to manufacturer Thales for a detailed examination.
It found the Captain’s pitot probe “failed the acceptance tests due to one drain hole being blocked by an unidentified black substance and internal contamination by a red clay substance”.
The standby pitot probe also failed the acceptance test because of internal contamination by a red clay substance.
The First Officer’s pitot probe passed the acceptance test and was found to be in acceptable condition.
The ATSB noted that the pitot probes had been cleaned and experienced one month of normal operational service prior to the detailed examination.
“Thus, the findings of the examinations do not necessarily represent the condition of the tubes at the time of the occurrence,” the ATSB said.
“The aircraft regularly operated into airports associated with iron ore mining operations in north-western Australia, where red mineral rich soils are common. However, the means or timing of ingress could not be determined.”
The ATSB report said Airbus “concluded that the fault messages and flight control system reconfigurations experienced during the flight were the result of discrepancies in the computed airspeeds”.
The ATSB report said a review of previous flights on the flight data recorder (FDR) found previous incidents of airspeed recordings at odds with the actual situation.
This included the recorded airspeed reaching about 250 kt while the aircraft was stationary on the ground at Boolgeeda Airport on September 9, three days prior to the incident flight.
The ATSB report there had also been other three other indications of airspeed anomalies in the days leading up to the September 12 incident.
The full report can be read on the ATSB website.
