Description

On 12 September 2015, an Airbus A320 (VH-FNP) being operated by Virgin Australia Regional Airlines on a domestic passenger charter flight from Perth to Boolgeeda, Western Australia experienced uncommanded autopilot and autothrust disconnection and multiple system alerts as the aircraft climbed on departure from Perth in day IMC. During the subsequent return to Perth, a precautionary PAN was declared to ATC and a stall warning which occurred whilst establishing on the ILS localiser was disregarded without apparent consequence but subsequently was found to have been real.

Investigation

An Investigation was carried out by the Australian Transport Safety Bureau (ATSB). Data from the aircraft FDR and 2 hour CVR were successfully downloaded. Information on the total and aircraft type experience of the pilots involved was not recorded.

What Happened

It was established that on arriving at the aircraft prior to the departure of the event flight, its first flight of the day, the crew found a ground engineer present and that the APU was running but that a GPU was also connected to the aircraft. The engineer advised this was because the batteries had gone flat during overnight maintenance whilst rectification of an avionics defect was being performed. On entering the flight deck, the Captain reported having found it “still untidy” after the overnight maintenance with “a number of controls and system configurations not at their normal settings”. The battery charge was subsequently completed prior to engine start.

Takeoff from runway 21 with the Captain as PF proceeded normally until the aircraft was climbing through about 8,000 feet QNH about 4 minutes after getting airborne when an un-commanded disconnection of the A/T was followed 10 seconds later by an un-commanded disconnection of the AP with Normal Law replaced by Alternate Law. The first of several attempts to re-engage the AP was unsuccessful and the crew reported that they had then identified an ECAM alert ‘ENG 1 EPR MODE FAULT’. At this point, it was considered likely that the ECAM display had probably appeared as in the illustration below such that it was only displaying the first lines of a multi-line generated message on the (presumed) basis that the complete message had been generated with its lines in priority order so that the necessary actions would be taken in that order.

The Captain took manual control of the aircraft and continued the climb. The airspeed control mode had automatically changed from ‘managed’ to ‘selected’ with the corresponding advice to set the target airspeed to the green dot speed but as this was not visible, the Captain decided to fly at a 10° nose-up attitude to ensure that the aircraft continued to climb. The Captain commented to the First Officer in respect of the loss of the airspeed limit and other speed information and at this time, FDR data showed that the Captain’s airspeed display was around 290KIAS, 40 knots in excess of the applicable speed restriction of 250 knots. A little over 2 minutes after the AP had disconnected, the flight was re-cleared to continue climb to FL 350. Without first acknowledging this, the Captain asked the First Officer to run the ECAM actions related to the alerts received (referred to as ECAM actions). This action was interrupted when the Captain decided instead to request stopping the climb at FL 200 and advise that they were “trouble shooting”. The First Officer’s attempt to run the ECAM actions was further interrupted when ATC gave a frequency change from Perth Departures to Melbourne Centre, but after this had been achieved, the ECAM actions for the ‘ENG 1 EPR MODE FAULT’ which involved switching both engines to N1 mode and thereafter manually adjusting the thrust were completed. However, none of those actions was followed by any change in the ECAM display, so this alert was cleared as was the next message, the same alert for the number 2 engine, which did not require any more actions than had already been completed for the no 1 engine so this alert was cleared too.

This led to the ‘NAV ADR DISAGREE’ message (Navigation - Air Data Reference disagree) first becoming visible on the ECAM almost 8½ minutes after the AP disconnect had occurred. The required action for this alert was to crosscheck the indicated airspeed on the three available displays which were confirmed as the same which meant the message could be cleared. The next message displayed was the advisory ‘F/CTL ALTN LAW’ which when cleared led to an ‘AUTO FLT A/THR OFF’ advisory which also required no action and was cleared. Advisories for the lack of rudder limiter above 160 knots followed.

The flight was continued en-route after communicating with their company and the crew began consulting the FCOM for more information. They noted that the ‘NAV ADR DISAGREE’ procedure and the associated alternate law procedure both stated that if no speed disagreement had been found then there was an angle of attack discrepancy and an associated “risk of undue stall warning”. It also noted that once the landing gear was lowered, Alternate Law would change to Direct Law.

Approximately 30 minutes into the flight, and about 150 nm from Perth, the Captain decided to return there. A further attempt to engage the Captain’s AP was not successful but it did restore his FD and after rebooting the no 2 Flight Augmentation Computer (FAC2), the AP did become available.

The descent progressed normally and the Captain transferred control to the First Officer. Then, passing about 10,000 feet, the Captain noticed that his airspeed was decreasing and informed the First Officer who subsequently “recalled observing that the minimum speed warning area on the captain’s airspeed indicator was increasing and announced that there was a disagreement between the airspeed indicators”. The Captain disconnected the AP and a check of the three airspeed indicators showed that the Captain’s was indicating a lower speed than the other two so the Captain switched to ADR 3 which restored a correct airspeed reading and he therefore re-engaged the AP and the crew continued with their landing preparations.

About 3 minutes later, another un-commanded AP disconnect occurred with similar airspeeds on both pilots displays. The AP disconnect warning was cleared and the Rudder Limiter caution was observed. Radar vectors were requested from ATC to increase track miles to ILS LLZ interception and an orbit was performed at 5000 feet QNH. The Captain used the time to review their situation, noting that they were in Alternate Law and that Direct Law with loss of all flight envelope protections would follow once the gear was extended. He also “reiterated that there was a risk of an undue stall warning” and decided that a PAN would be declared to ATC advising that they had control system issues, were manually flying the aircraft and were in Alternate Law. ATC responded by offering attendance of the emergency services for the landing, which was accepted.

After a turn to intercept the runway 21 ILS LLZ had been commenced, the Captain took over control and requested flaps 1 and a target speed of 200 knots. Then, with the aircraft at 2,550 feet QNH and still in the turn, the stall system warning was activated. The Captain continued the turn and was recorded as repeatedly announcing “disregard” and after 6 seconds, the warning ceased. Once established on the ILS GS, with his airspeed indication reading 170 knots, the Captain requested flap 3 but the First Officer, whose indicated airspeed was 190 knots, responded that the flap 3 limit speed was 185 knots. The approach was continued and the Captain requested that the target airspeed should be set to 145 knots, about 3 knots higher than the calculated approach speed “to carry a little extra speed for the approach”.

The landing gear was extended at 2,400 feet and the remainder of the approach and landing was completed without further incident after 70 minutes airborne and the aircraft was taxied to its allocated parking position and shut down.

Analysis

During post flight maintenance action by the operator, it was found that all three pitot systems were contaminated with water, with one drain hole blocked in both the left and right systems and both drain holes blocked in the standby system. Solid matter as well as water was found to have been contaminating the standby pitot system. The system contaminants were not collected or analysed and it proved impossible to establish their source. It was confirmed that the recommended maintenance requirements for the pitot systems had been followed and noted that there was no previous history of system contamination in any of the aircraft types operated by the company involved. Nevertheless, there had been an on-ground erroneous airspeed event three days and three flights prior to the investigated flight and evidence was found in the downloaded FDR data from that flight and the two flights which separated it from the investigated flight that there had been transient rejections of ADR 3 data by the aircraft flight data system in flight without any corresponding in-flight airspeed anomalies. It was considered that the on-ground event three days earlier had been “an opportunity for the operator to have identified an unreliable airspeed indication event and carried out the actions recommended by the manufacturer”. However, it was noted that the aircraft had been at an airport without resident maintenance support at the time and the flight crew had cured the problem by following guidance from company maintenance to recycle the aircraft electrics.

Airbus advised that “most airspeed discrepancy events during take-off or approach were the result of water contamination of the pitot probes and the pitot probe drainage holes being obstructed by external particles”. It was also noted that the pitot probes fitted to the aircraft involved had an enhanced water trap and relocated drain holes which together were likely to have provided increased system reliability in the event of heavy rain. There was no recurrence of contamination-related pitot system problems following the return of the aircraft to service.

The Investigation was particularly concerned to review the way ECAM information had been provided to the crew when the problems arose. It was noted that the procedure for the amber NAV ADR DISAGREE alert, which had appeared once the EPR mode faults for both engines had been cleared, required that the three airspeed displays be cross checked. If they were not all the same, the crew were directed to apply the ADR check procedure, but if at the time the procedure was actioned there was no airspeed disagreement (which was the case during the investigated flight) then the procedure referred the crew to the actions for an AoA discrepancy which were confined to noting the remark ‘RISK OF UNDUE STALL WARN’. It was found that although the FCOM provided specific procedures for how to manage an airspeed discrepancy by following the ‘Unreliable airspeed indication/ADR check procedure’, there was no reference to this in the ECAM messages received. It was also noted that whilst AoA values could be viewed on the MFD ‘alpha call up’ page, this option was not mentioned in the procedure to be followed to confirm an angle of attack disagreement. In summary, it was observed that if the system specifically identified a fault in any of the angle of attack systems, an amber ECAM message ‘NAV (CAPT/FO/STBY) AOA FAULT’ would be displayed for which the FCOM response was ‘crew awareness’.

No evidence was found that the amber ECAM alert ‘NAV IAS DISCREPANCY’ amber alert, which is activated when a discrepancy between the two primary airspeed displays is detected - and which would require a cross check of all three airspeeds and the use of air data switching as required - occurred during the investigated flight. This indicated that ADR 3 (standby airspeed) was rejected before ADR 1 and 2 so thereby triggering the ‘NAV ADR DISAGREE’ message. Airbus advised that this message would have inhibited the ‘NAV IAS DISCREPANCY’ alert which, as the ‘NAV ADR DISAGREE’ message was latched until the end of the flight, would have prevented the ‘NAV IAS DISCREPANCY’ alert being triggered when a discrepancy between the Captain’s and First Officer’s airspeed displays occurred at a later stage in the flight. In the light of these findings, it was considered by the Investigation that “the number and nature of the indications of unreliable airspeed indicate that the development of a situation can be insidious and not necessarily obvious”.

It was concluded that the crew actions in response to the sequence of ECAM messages which they were presented with had resulted in the ‘NAV ADR DISAGREE’ alert not being actioned until after the airspeed fault had ceased which led to an incorrect diagnosis of the origin of the alert. It was considered that whilst an EPR mode fault would not pose a short-term hazard to safe flight because the crew would still have control of engine thrust, aircraft control depends on awareness of the reliability of airspeed information which meant that the prevailing ECAM message relative priority in this instance was questionable.

The overall assessment by the Investigation of the crew actions in response to the problems they encountered prior to the stall warning on final approach was as follows:

When the autothrust and autopilot first disconnected, the captain announced that he had control and that he would fly the aircraft ‘ten degrees nose up’. Although this was consistent with the unreliable speed indication procedure when below FL 100, there was no indication from the recorded information or interviews that the captain was aware of an airspeed discrepancy and intentionally carried out that procedure. It was more likely an instinctive reaction to the loss of automation to ensure that the aircraft was in a state that the Captain knew was safe.

When the Captain’s airspeed deviated from the other indications during the descent, the flight crew were provided with an opportunity to identify that they were confronted with an unreliable airspeed indication event. However, their actions following this do not appear to indicate that they had made this connection.

The act of switching the air data source for the captain’s indicator from CAS 1 to CAS 3 was consistent with the NAV IAS DISCREPANCY alert, but there was no record of the alert having been triggered. Neither was it consistent with the unreliable speed indication procedure, because the crew did not switch off any of the ADRs, the aircraft was not levelled out for troubleshooting, there was no discussion regarding unreliable airspeed, and they did not respond to the stall warning that occurred after the air data source was switched to CAS 3.

An examination of the FDR data at the time of the stall warning confirmed that the SBY system airspeed display (which by then was being fed to the Captain’s position as a result of the crew noticing that the normal data source was presenting an incorrect speed) was valid. It was noted that at the prevailing Mach number, the AoA threshold to trigger a stall warning would have been 8°. However, although the only valid AoA recorded at this time was 7.4° from ADR 2, it was noted that stall warning logic only requires one of the three angle of attack values to exceed the threshold. Since until the Captain had been obliged to change over his data source to ADR 3, the primary sources of AoA had been consistent, it was considered “most likely that the stall warning was triggered by AoA 3, which was not recorded” on the FDR. It was noted that when the stall warning was activated during the right turn onto final approach, a small lateral acceleration which indicated a wind gust from the right side was recorded. It was concluded that “the placement of the angle of attack probe for ADR 3 is such that (such) a lateral gust could produce a local increase in the angle of attack (which) in this case was probably sufficient to go beyond the stall warning threshold, triggering the warning”. The stall warning was thus genuine, albeit nominal.

The Investigation observed as follows in respect of the stall warning and the response to it:

Stall warnings are designed to activate at an angle of attack that provides some margin before the aircraft will actually stall. In this case, the angle of attack measured by one sensor was sufficient to activate the stall warning, but there was no indication that the aircraft had stalled.

In their analysis of the sequence of events, the manufacturer identified that the captain made nose-down control inputs while the stall warning was activated. However, the CVR captured the Captain clearly verbalising that he was disregarding the stall warning. Although the nose-down inputs occurred during the stall warning, there was no significant change in the airspeed and the bank angle was increased during the time the warning was active. Thus, it is more likely that the nose-down control inputs were required to control the desired flight path and not related to the warning.

Six Contributing Factors were identified, two in respect of the indications of unreliable airspeed and four more in respect of the diagnosis of the origin of the NAV ADR DISAGREE Alert as follows:

The unreliable airspeed indications

• Drains in all three pitot probes were blocked, preventing water contamination from being effectively discharged
• Before and during the flight, water temporarily obstructed all three of the aircraft’s pitot probes, resulting in erroneous airspeed indications. Differences in the airspeeds across the three air data reference systems consequently affected the engine control, flight control and auto flight systems, degrading their functionality and generating multiple system alerts.

The determination of the origin of the NAV ADR DISAGREE Alert

• The flight crew’s workload following multiple system failures was high, affecting their ability to process information quickly. This, combined with maintaining safe flight, resulted in the flight crew taking about 8 minutes to attend to the engine alerts and action the NAV ADR DISAGREE procedure.
• When the flight crew actioned the NAV ADR DISAGREE procedure, the airspeeds were consistent on all indicators, leading them to incorrectly diagnose that the system failure was the result of an angle of attack discrepancy rather than erroneous airspeeds. The procedure informed them that in this situation, there was a risk of undue stall warning.
• Although the NAV ADR DISAGREE had more immediate safety implications relating to unreliable airspeed, the ECAM alert priority logic placed this alert below the engine related faults. As a result, the NAV ADR DISAGREE alert was not immediately visible to the flight crew due to the limited space available on the ECAM display. [Safety Issue]
• A NAV ADR DISAGREE alert can be triggered by either an airspeed discrepancy, or angle of attack discrepancy. The alert does not indicate which, and the associated procedure may lead flight crews to incorrectly diagnosing the source of the alert when the airspeed is erroneous for a short period and no airspeed discrepancy is present when the procedure is carried out. [Safety Issue]

An Additional Factor that increased risk was also identified as “believing it to be an erroneous (stall) warning due to an angle of attack discrepancy, the flight crew disregarded a real stall warning during the approach”.

An Additional Finding was that “the source of the foreign material blocking the pitot probe drain holes could not be identified”.

Safety Action taken by Airbus in response to the findings of the Investigation was noted as having included the following:

• the relative ECAM display priority of the ‘NAV ADR DISAGREE’ alert has been increased so that it has a higher priority than ‘EPR MODE FAULT’ alerts. This will significantly improve the detectability of a transient airspeed discrepancy. It is noted that the FCTM presents this alert as one of the typical situations which require the application of the ‘UNRELIABLE SPEED INDICATION’ QRH procedure.
• After review of AoA failure cases which lead to the triggering of the ‘NAV ADR DISAGREE’ procedure, it has been decided to remove the information line ‘RISK OF UNDUE STALL WARN’ from the ECAM message. The existence of a Stall Warning System is deemed sufficient. This modification will be introduced at the same time as the change in the ‘NAV ADR DISAGREE’ alert priority.
• The ability to detect unreliable airspeed situations will be further enhanced by introduction of an ‘Unreliable Airspeed Mitigation Means’ (UAMM) function. This will mean that in the event of a scenario such as the investigated one, the ECAM should display the (red) ‘NAV ALL SPD UNCERTAIN’ warning, which will require the ‘ADR CHECK PROC / UNRELIABLE SPEED INDICATION’ procedure to be applied. This function is planned for introduction on new-build aircraft during 2019 and will also be available for retrofit to in-service aircraft subject to their having a minimum computer configuration.

The Final Report was released on 4 April 2019. No Safety Recommendations were made.

Related Articles

• Unreliable Airspeed Indications
• Air Speed Indicator
• Stall
• Electronic Centralized Aircraft Monitor (ECAM)
• Engine Indicating and Crew Alerting System (EICAS)
• Stall Warning Systems
• Pitot Static System