The following information provides an awareness of problems that might be avoided in the future. The information is based on final reports by official investigative authorities on aircraft accidents and incidents.
Rare Computer Fault Cited
Airbus A330-300. Substantial damage. Twelve serious injuries, 107 minor injuries.
The A330 was en route with 303 passengers and 12 crewmembers from Singapore to Perth, Western Australia, when it suddenly pitched nose-down. “At least 110 of the 303 passengers and nine of the 12 crewmembers were injured; 12 of the occupants were seriously injured, and another 39 received hospital medical treatment,” said the report by the Australian Transport Safety Bureau (ATSB).
The accident occurred the morning of Oct. 7, 2008. The A330 was cruising at Flight Level (FL) 370 (approximately 37,000 ft) over the Indian Ocean, about 154 km (83 nm) west of Learmonth, on the coast of Western Australia, when “one of the aircraft’s three air data inertial reference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems,” said the report, issued last December.
The no. 1 autopilot disengaged, and numerous warning and caution messages were generated. Most of the messages, including stall warnings and overspeed warnings, were false. The captain hand flew the aircraft briefly, then engaged the no. 2 autopilot.
“Two minutes later, in response to spikes in angle-of-attack (AOA) data, the aircraft flight control primary computers (FCPCs) commanded the aircraft to pitch down,” the report said. “Although the pitch-down command lasted less than 2 seconds, the resulting forces were sufficient for almost all the unrestrained occupants to be thrown to the aircraft’s ceiling. … There was significant damage to overhead fittings in the cabin.”
A peak vertical acceleration of minus 0.80 g was recorded as the A330 descended 690 ft within 23 seconds. The captain applied sidestick control inputs to arrest the descent and return the aircraft to FL 370.
Less than three minutes later, the A330 again pitched nose-down. Apparently, no further injuries occurred during the second upset. “The flight crew described the event as being similar in nature to the first event but less severe,” the report said. “The captain promptly applied back pressure on his sidestick to arrest the pitch-down movement.” The aircraft descended 400 ft within 15 seconds before being returned to FL 370.
The malfunctioning ADIRU was identified and disengaged. “Due to the serious injuries and their assessment that there was potential for further pitch-downs, the [flight] crew diverted the flight to Learmonth … and declared a mayday to air traffic control,” the report said. “The aircraft was landed as soon as operationally practicable” about 45 minutes after the upset.
The failure mode that triggered the upset was rare and likely began when the Northrop Grumman LTN-101 ADIRU’s central processor “combined the data value from one parameter with the label for another parameter,” the report said. “The exact mechanism that produced this problem could not be determined.”
The resulting AOA spikes were 1.2 seconds apart, which coincidentally corresponded to the monitoring interval at which the FCPC temporarily retains, or memorizes, a previous value if a discrepancy is detected in the data generated by the ADIRUs. “The FCPC’s AOA algorithm could not effectively manage a scenario where there were multiple spikes such that one triggered a memorisation period and another was present 1.2 seconds later,” the report said. As a result, the second in each series of data spikes was accepted as valid, and the erroneously high AOA values prompted the pitch-down commands.
“There were only three known occasions of the failure mode in over 128 million hours of unit operation,” the report said. “At the aircraft manufacturer’s request, the ADIRU manufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmission failures.”
In addition, Airbus redesigned the FCPC software algorithms “to prevent the same type of accident from occurring again,” the report said. “The occurrence was the only known example where this design limitation led to a pitch-down in over 28 million flight hours on A330/A340 aircraft.”
Corrosion Causes AC Power Loss
Boeing 757-200. No damage. No injuries.
The 757 was nearly three hours into a flight from England to Cyprus the morning of Sept. 7, 2011, when the flight crew observed indications that the left AC (alternating current) electrical bus and the left generator were off line, “along with multiple failures of flight instruments,” said the U.K. Air Accident Investigation Branch (AAIB) report.
The crew completed the relevant quick reference handbook (QRH) procedure, which included resetting the left bus tie to bring the left generator back on line. This restored power to the left AC bus only momentarily, however. “The second power loss was associated with a thin haze of smoke and a strong smell of electrical burning in the flight deck,” the report said. “The crew responded by donning their oxygen masks and [smoke] goggles.”
The crew declared an emergency, initiated a descent from FL 390 and diverted the flight to Kavala, Greece, 38 nm (70 km) south.
The auxiliary power unit (APU) was started, but it provided power to the left AC bus for only 17 seconds. “No additional attempts to supply power to the left AC bus were made, and the aircraft [was] landed without further incident,” the report said. “During the final approach, it was apparent that the fumes had dissipated, and the  passengers were disembarked normally.”
The AAIB classified the event as a serious incident. Investigators found that a similar loss of power to the left AC bus had occurred 13 flights earlier. Troubleshooting after that incident was inconclusive. “The left integrated drive generator (IDG) was disconnected, and the defect was transferred to the list of deferred defects in the aircraft’s technical log,” the report said.
Maintenance personnel subsequently performed wiring-continuity checks and replaced the left generator control unit, the bus power control unit, the circuit breakers for the left generator and the left bus tie. “None of these actions were successful in resolving the defect,” the report said.
Troubleshooting on the morning of the serious incident revealed an open circuit between a connector at the left engine pylon and the left IDG. The wiring loom was replaced, an operational check was performed, and the left AC generating system was declared serviceable.
After the emergency landing in Greece, built-in test equipment indicated that the loads demanded by the left AC bus were not in balance with the left IDG’s current output. The left generator control unit and bus power control unit again were replaced. “The aircraft’s engines were ground-run for 45 minutes, during which the left and right AC power-generation systems operated correctly, and no electrical burning or smoke was apparent,” the report said.
About 2 1/2 hours into the subsequent ferry flight back to England, however, the left AC bus again lost power. This time, the bus received power from the APU for the remainder of the flight.
Troubleshooting again revealed indications of an open circuit between the pylon bulkhead connector and the left IDG. The connector’s backshell was found loose — a likely result of threads being stripped during previous over-tightening of the connector. “This defect allowed moisture to enter the connector, causing corrosion of the connector’s internal components” and intermittent contact between two crimp terminals and their associated wiring, the report said. The connector was replaced, and no further problems with the left AC generating system had occurred when the report was published in June 2012.
Broken Cable Blocks Elevator
Bombardier CRJ700. Minor damage. No injuries.
The CRJ was climbing to cruise altitude during a flight from Bilbao, Spain, to Paris on July 12, 2010, when the flight crew noticed that the autopilot was unable to maintain the selected vertical mode and that an “AP PITCH TRIM” caution message was being displayed.
“The crew applied the corresponding checklist, which, after another unsuccessful attempt at [autopilot] engagement, led the crew to resume manual control,” said the report by the French Bureau d’Enquêtes et d’Analyses.
The CRJ was landed without further incident at Charles de Gaulle Airport. “At the stopover, the maintenance service took a variety of steps relating to the problem encountered,” the report said. “No malfunctions were found. Specifically, the elevator servo operational test was performed three times, and free clearance of the controls was checked.”
The aircraft was released for service, and the crew began the return flight to Bilbao with 65 passengers and four crewmembers aboard. “During this leg, the same problem occurred: the [autopilot] could not hold the vertical modes and the ‘AP PITCH TRIM’ caution message triggered,” the report said. “The flight continued under manual control.”
The pilot flying noticed that flaring the CRJ to land at Bilbao Airport required greater effort than usual, but the touchdown was normal. “While taxiing, [the crew] noticed that the elevator control blocked at halfway pitch-up,” the report said. “The following flight was canceled.”
Maintenance technicians found that an elevator control cable had broken and jammed the autopilot servo. Recorded flight data indicated that the cable had snapped during a coupled approach to Bilbao Airport that was conducted by another flight crew before the incident flight to Paris. The other crew had completed the approach manually after a pitch excursion occurred at 1,200 ft. “This crew did not attach any great importance to this behaviour and did not make a note of it in the logbook or mention it to the [incident] crew,” the report said.
Investigators determined that the elevator control cable likely had been installed incorrectly when the vertical stabilizer was assembled by a subcontractor during the manufacture of the aircraft.
“The investigation was not able to determine with certainty the link between the appearance of the ‘AP PITCH TRIM’ message and the system condition during the flight,” the report said. “However, it is highly probable that the caution message was linked to the trim movement by the autopilot for a period that was longer than the threshold of the caution message trigger.”
Turbulence Tosses Cabin Crew
Boeing 737-600. No damage. One serious injury.
The 737 was in visual meteorological conditions (VMC) at 11,000 ft, but there were cumulonimbus clouds ahead on the approach to London Heathrow Airport the afternoon of Aug. 23, 2010. The flight crew activated the seat belt signs and performed a pre-landing public address (PA) system announcement, describing the weather and the possibility of turbulence.
“The cabin crew were securing the cabin for landing and were not restrained at the time,” the AAIB report said. “Three of the four cabin crewmembers, including the purser, were not aware of the weather-related comments in the PA announcement.”
The aircraft encountered light turbulence as the flight crew altered course to circumnavigate an area of precipitation displayed on the weather radar. The 737 appeared to be clear of the area when it briefly encountered severe turbulence.
“One of the cabin crew managed to sit in an empty seat but was not able to fasten the seat belt before being thrown into the air and hitting the cabin roof,” the report said. “Despite this, she was uninjured.
“Another cabin crewmember, seated on a crew seat in the rear galley and making a PA [announcement] to the passengers, was also thrown into the air. She landed back on the seat and badly injured her back. The other cabin crewmembers were uninjured and attended to their injured colleague, who was in considerable pain and had to remain on the galley floor for the rest of the flight.”
None of the 79 passengers was injured. After the aircraft was landed without further incident, the injured crewmember was taken by ambulance to a hospital, where she was treated for spinal injuries.
The airline required cabin crewmembers to be seated, with their seat belts fastened, when the seat belt signs are on, unless they are performing safety-related duties. “It was intended that the cabin crew should be made aware of expected en route turbulence by the pilots, although the method of doing so was not specified,” the report said.
The airline also required that seat belt signs be illuminated 10 minutes before the expected landing time in all conditions. “Illumination of the seat belt sign, during the approach but because of turbulence, might therefore be misunderstood by the cabin crew without clarification from the flight deck,” the report said.
An investigation by the airline’s safety department identified three similar accidents in which cabin crewmembers had suffered turbulence-related injuries. “In all cases, the cabin seat belt sign had been illuminated and the crew were unsecured, preparing the aircraft for landing.”
Among changes affected by the airline were a revision of communications between flight and cabin crewmembers to clarify when the cabin is secure and when both the cabin and the cabin crew are secured, and introduction of specific announcements to passengers, requesting that they help secure the cabin when cabin crewmembers are seated because of the possibility or presence of turbulence.
Loading Bridge Damages Fuselage
Boeing 757-200. Substantial damage. No injuries.
The airplane was being prepared for a flight from San Francisco International Airport the afternoon of June 11, 2011. After the 188 passengers were boarded and the cabin door was closed, the operator of the passenger loading bridge (jetway) retracted the canopy and awaited a hand signal from a ramp worker to retract the bridge itself.
“The ramp employee responsible for the airplane pushback reported that he heard the [loading bridge] bell ringing for about one minute, which he thought was enough time for the jetway to be cleared from the airplane,” the U.S. National Transportation Safety Board (NTSB) report said.
According to the report, however, the bridge operator had not begun to retract the bridge, and the ramp worker did not signal the bridge operator before beginning the pushback. The 757 struck the bridge, and a 38- by 8.5-in (97- by 21.6-cm) hole was torn in the fuselage. Frame assemblies and stringers also were damaged.
The report said that the probable cause of the accident was the ramp worker’s “failure to visually verify the position of the jetway before beginning the airplane pushback.”
Distracted Below Glideslope
Bombardier Q400. No damage. No injuries.
The flight crew was receiving radar vectors from air traffic control (ATC) for the instrument landing system (ILS) approach to Runway 26 at Exeter (England) Airport the afternoon of Sept. 11, 2010, when they observed a message on the engine and system integrated display (ED) that one of the aircraft’s two input-output processors (IOPs) had failed.
At the time, the Q400 was descending through 3,300 ft to an assigned altitude of 2,600 ft, the minimum safe altitude for the sector. The autopilot was maintaining the selected heading and a vertical speed of 500 fpm; the altitude-hold and approach modes were armed, and 2,600 ft had been entered in the altitude selector.
The IOPs are part of the flight data processing system, which acquires data from various aircraft systems and sensors, and routes the data to other systems. The failure of the no. 1 IOP caused the indicated designations, or “bugs,” for the approach speeds and minimum descent altitude on the commander’s primary flight display (PFD) to be replaced by white dashes. There was no change to the copilot’s PFD.
“There are no flight crew procedures for ED advisory messages relating to avionics failures such as an IOP failure, but maintenance action is required prior to dispatch of the next flight,” the AAIB report said.
Nevertheless, the commander attempted to restore the bugs on his PFD by selecting the no. 2 air data computer (ADC). This had no effect, so he switched back to the no. 1 ADC. “The commander realised that by changing ADC selection, the approach mode had become disarmed, so … he also re-armed the approach mode,” the report said. The altitude-select mode remained disarmed.
The commander then transferred control to the copilot. The report said that both pilots were distracted by continuing attempts to resolve the IOP failure when the aircraft’s enhanced ground-proximity warning system (EGPWS) generated a “CAUTION TERRAIN” warning. At the time, the aircraft was descending through 1,759 ft, or 1,066 ft above ground level (AGL), in VMC. Seconds later, the EGPWS generated a “TERRAIN, TERRAIN, PULL UP” warning.
The copilot disengaged the autopilot, increased power to about 80 percent and began a shallow climb. About the same time, ATC asked the crew to confirm that they were descending on the ILS glideslope. The commander replied that they had experienced an instrument failure and were climbing to capture the glideslope.
Recorded flight data showed that the Q400 had descended to 1,417 ft (700 ft AGL) before transitioning to a climb and that it captured the glideslope at 2,200 ft. The aircraft was landed without further incident, and none of the 49 passengers or four crewmembers was injured.
The aircraft operator told investigators that IOP failures were common in its Q400 fleet. “In the majority of cases, the operator’s experience is that resetting the relevant circuit breaker or reinstalling the unit appears to solve the problem, and the unit remains in service,” the report said. A number of IOPs found to be faulty and sent to the vendor for repair were returned with the notation “no fault found” but continued to cause problems when reinstalled in the aircraft.
The IOP that failed in the incident aircraft had failed several times previously, but the aircraft was returned to service each time after no faults were found during maintenance troubleshooting and testing showed normal operation. After the incident, the IOP was examined by the manufacturer under AAIB’s supervision. X-ray tests revealed that the intermittent failures had resulted from power supply disruptions caused by cracked solder on two pins in a transformer.
Based on the findings of the investigation, the AAIB recommended that Thales Aerospace, which manufactures the IOPs, review its test procedures to improve the detection of power-supply failures, and that Bombardier Aerospace publish information in the Q400 airplane flight manual and QRH about the effects of IOP failures on the operation of the aircraft.
Gear Retracts During RTO
Piaggio P-180 Avanti. Substantial damage. No injuries.
The flight crew was preparing for a post-maintenance functional check flight from St. Petersburg-Clearwater (Florida, U.S.) International Airport the afternoon of Sept. 12, 2010, following replacement of an elevator. Several other maintenance inspections had been performed, including an operational test of the Avanti’s landing gear.
“The pilot-in-command (PIC) later stated that he could not recall observing the position of the landing gear selector during his preflight inspection but reported that he would have checked it,” the NTSB report said.
As the PIC rotated the airplane for takeoff, he heard a sound similar to a tire bursting. At the same time, the cockpit voice recorder “recorded a sound consistent with the hydraulic power pack motor operating for 2 seconds, beginning gear retraction,” the report said.
The PIC decided to conduct a rejected takeoff (RTO). “He reported that, as he began to retard the throttles and set the nose landing gear on the runway, he realized that the airplane had descended below the normal wheels-on-ground sight line and that the belly of the aircraft had begun to scrape the runway,” the report said. “The airplane then slid for 1,000 ft [305 m] before coming to rest upright on the runway with each of the landing gear retracted.”
A person who helped recover the airplane told investigators that he saw the landing gear selector in the “UP” position. After the Avanti was raised and the landing gear extended, the airplane was towed to the ramp. “Postaccident testing revealed no preaccident mechanical failures or malfunctions of the landing gear or landing gear position and warning system,” the report said. “The investigation was not able to determine who placed the landing gear selector in the ‘UP’ position.”
Magneto Fault Forces Landing
Piper Navajo. Substantial damage. Two minor injuries.
As part of his preflight preparations, the pilot checked the engine magnetos and found no anomalies before departing with three passengers from Red Lake, Ontario, Canada, for a company flight to Kashechewan the morning of Sept. 10, 2010.
After an en route stop in Pickle Lake to refuel, the Navajo was at 9,500 ft and halfway to Kashechewan when the pilot heard a “brief rumble” from the left engine, said the report by the Transportation Safety Board of Canada (TSB). “This was accompanied by a drop in cylinder head and exhaust gas temperature indications on the no. 3 cylinder.”
The pilot decided to return to Pickle Lake and descended to 8,500 ft. When the flight encountered broken clouds, the pilot descended to 4,500 ft, or about 3,300 ft AGL, to remain in VMC. Turbulence was encountered at that altitude.
Shortly thereafter, the pilot heard a series of loud bangs and other noises emanating from the left engine. “In order to preclude catastrophic failure, the pilot shut the engine down … but [initially] did not increase power on the operating engine,” the report said.
Airspeed decreased to 100 kt, and the aircraft began to descend. The pilot increased power on the right engine from 30 in to 35 in manifold pressure and propeller speed from 2,200 to 2,300 rpm. He also decreased airspeed to 90 kt, the Navajo’s best single-engine rate of climb speed, to arrest the descent.
“Initially, the aircraft was able to maintain altitude, but the airspeed decreased to 83 kt, at which point the aircraft began to descend again,” the report said. “Power was increased to 38 in manifold pressure, but in the turbulent conditions, the airspeed fluctuated, directional control became increasingly difficult, and occasional stall buffeting was encountered.”
The pilot decided to conduct an emergency landing in a swampy area 30 nm (56 km) east of Pickle Lake. The Navajo was substantially damaged when it struck trees. The pilot and one passenger sustained minor injuries; the other passengers escaped injury.
The engine malfunction was traced to a loose distributor block bushing on the left magneto. The report noted that the operator of the Navajo had not complied with provisions of Teledyne Continental Service Bulletin 643B, which calls in part for checking the security of the bushing every 500 hours.
Disorientation Suspected in CFIT
Cessna 310R. Destroyed. One fatality.
About 10 minutes after deplaning five charter passengers at Bathurst Island, Northern Territory, Australia, the night of Feb. 5, 2011, the pilot departed from Runway 33 for the return flight to Darwin. “Shortly after takeoff, a number of witnesses reported hearing a loud noise or seeing a light from the direction of departure,” the ATSB report said. “[The aircraft] was found to have impacted terrain approximately 1 km [0.5 nm] from the upwind end of Runway 33.”
Noting that investigators found no technical deficiencies that might have contributed to the accident, the report concluded that the crash had involved controlled flight into terrain (CFIT), likely after the pilot experienced somatogravic illusion, a physiological phenomenon that can cause a pilot to mistake the sensation of acceleration as the aircraft pitching nose-up and then to react by lowering the nose. The resulting increase in acceleration compounds the spatial disorientation caused by the illusion.
“The location of the wreckage, together with the dark night conditions and the relatively light load of the aircraft suggested that it was likely that the pilot was influenced by the effects of somatogravic illusion following takeoff,” the report said.
The report said that the accident highlights the importance of being aware of the conditions in which somatogravic illusion can occur and of scanning the instruments, especially the attitude indicator, to verify the aircraft’s attitude and performance when flying in such conditions.
Rain Douses Visual References
Eurocopter AS350 B2. Substantial damage. Two serious injuries, two minor injuries.
The pilot delayed departure from a work site 85 nm (157 km) northwest of Chibougamau, Québec, Canada, until a line of thunderstorms passed through the area the afternoon of Sept. 1, 2010. “When the helicopter took off … the sky had cleared and the rain had stopped,” the TSB report said. “As weather conditions were VMC at the work site, the pilot did not think it necessary to call for a weather update. The return flight to Chibougamau was expected to take approximately 50 minutes.”
The helicopter was at 1,000 ft AGL when it encountered heavy rain and thunderstorms about 20 nm (37 km) from the destination. Shortly thereafter, visibility decreased to about 1 mi (1,600 m), and the pilot decided to conduct a precautionary landing on a gravel road.
“On final approach, while approximately 70 ft AGL at low airspeed over trees, the pilot lost all visual reference with the terrain due to heavy rain,” the report said. “While in a hover over the trees, the helicopter descended without the pilot realizing it and struck the trees, then the ground, coming to rest on its left side.” The pilot and the front-seat passenger were seriously injured; the other two passengers sustained minor injuries.
Carb Heat, Mixture Controls Confused
Robinson R22. Substantial damage. No injuries.
Two certificated rotorcraft pilots were conducting a ferry flight the morning of Aug. 11, 2011. The pilot flying held an airline transport pilot license and had 2,365 flight hours, including 1,177 hours in type. The other pilot held a private pilot license and had logged 54 of his 220 flight hours in R22s.
The helicopter was on approach for a refueling stop in Titusville, Florida, U.S., when the pilot flying asked the other pilot to apply carburetor heat. “The private pilot inadvertently pulled out the engine mixture control with the mixture control guard, which resulted in an immediate total loss of engine power,” the NTSB report said. “The helicopter was at an altitude between 300 and 400 ft when the [pilot flying] entered an autorotation while the private pilot attempted to restart the engine.”
The engine did not restart before the helicopter struck trees and a fence, and flipped over. The R22’s airframe and main rotor and tail rotor drive systems were damaged on impact, but both pilots escaped injury.