Air France 447; faulty computer could have damaged aircraft before Crew could turn it off

Posted on 09. Jun, 2009 by in Featured

The European Aviation Safety Agency (EASA) issued two Emergency Airworthiness Directives (EAD) involving the ADIRU in December and January. An EAD is different from the bulletin that was issued on the pitot system; an EAD is an immediate requirement as opposed to a recommendation. The Air France pilots union has told its members to refuse aircraft that have not had the pitot systems replaced in accordance with the bulletin. However the critical link remains the ADIRU; the two EADs deal with erroneous information being sent by the ADIRU causing severe in flight upset in the case of QANTAS Flight 72.

After the QF 72 incident a Directive was issued (EAD 2008-225-E, December 18th 2008) requiring the crews to verify the off light illuminated after disengagement of the ADIRU. During the QF 72 event deselecting the faulty ADIRU did not stop the bad information from being sent to flight control computers.

Nine days after the issue QANTAS experienced a second event that was limited to the auto pilot deselecting. In the second event the ADIRU #1 continued to send faulty information even with illumination of the off light. This prompted the second Directive (EAD 2009-0012-E) requiring the ADIRU to be completely de-energized by selecting the rotary switch to IR off. Below is a section from the EAD:

NAV – IR 1+2 (2+3) (1+3) FAULT
Note: Flight controls are in alternate law. Refer to F/CTL – ALTN LAW
(chapter 4 of the AFM)
Turn off the affected IRs.
Turn off the corresponding ADRs.
Set the affected IR mode rotary selectors to OFF.
Use AIR DATA switching as appropriate.
Use ATT HDG switching as appropriate.
Do not use speed brakes
• If CG above 32%:
Manually perform a forward fuel transfer from the trim tank.
Note: If trim tank pump is not available, do not perform manual forward fuel
transfer while speed is at or below 270 kt or while in climb.
Note: This operational procedure is covered by the following Temporary
Revisions (TR) of the AFM:
A330 AFM TR 4.02.00/46 Issue 3 (OEB N°74/4)
A340 AFM TR 4.02.00/54 Issue 3 (OEB N°88/4 and OEB N°89/4)
2. Incorporation of the appropriate AFM TR or inserting the above operational
procedure or a copy of this AD into the AFM is acceptable to comply with the
requirements of § 1 of this AD.

This is likely the failure AF 447 experienced (note the reference to alternate law, an ACARS code verifying that was sent), complying with these procedures may not have been possible prior to the aircraft being catastrophically damaged. It also introduces another potential factor, center of gravity (CG).

In aircraft design the reason to have 3 units is for what is termed fail active systems. If one of the three units begins to give erroneous information it is locked out and the operation of the system continues normally. What this shows is that the ADIRU #1 was not deselecting (being locked out) even after being switched off. Another possibility (ICO AF 447) is that ADIRU #1 and ADIRU #2 both received bad info via the electronic pitot systems and then locked out ADIRU #3 which was receiving good info.

The Australians (ATSB) are still looking at EMI (Electro Magnetic Interference) as a possible cause to the upset of QF 72. With all three of the ADIRUs and both backup systems (ISIS) sending fault codes they may be going down the right path. The pitot system could be a distracter, in my opinion. The black boxes should help solve this tragic mystery.

Leave a Reply