Altro che impatto!!!
Sembra similare all'incidente occorso ad un veivolo Iberia qualche mese fa o sbaglio?

un pitch down dovuto ad un comando errato non causa una discesa rapida come quella descritta....

potrebbero essere state delle forti correnti d'aria

Incident: Qantas A333 near Perth on Dec 27th 2008, navigation system problem

The Australian Transportation Safety Board have released their final report, combined with the investigation into Accident: Qantas A333 near Learmonth on Oct 7th 2008, sudden inflight upset injures 74 people on board, concluding:

Contributing safety factors

- There was a limitation in the algorithm used by the A330/A340 flight control primary computers for processing angle of attack (AOA) data. This limitation meant that, in a very specific situation, multiple AOA spikes from only one of the three air data inertial reference units could result in a nose-down elevator command. [Significant safety issue]

- When developing the A330/A340 flight control primary computer software in the early 1990s, the aircraft manufacturer’s system safety assessment and other development processes did not fully consider the potential effects of frequent spikes in the data from an air data inertial reference unit. [Minor safety issue]

- One of the aircraft’s three air data inertial reference units (ADIRU 1) exhibited a data-spike failure mode, during which it transmitted a significant amount of incorrect data on air data parameters to other aircraft systems, without flagging that this data was invalid. The invalid data included frequent spikes in angle of attack data. Including the 7 October 2008 occurrence, there have been three occurrences of the same failure mode on LTN-101 ADIRUs, all on A330 aircraft. [Minor safety issue]

- The LTN-101 air data inertial reference unit involved in the occurrence (serial number 4167) also had a previous instance of the data-spike failure mode, indicating that it probably contained a marginal weakness in its hardware, which reduced the resilience of the unit to some form of triggering event.

- For the data-spike failure mode, the built-in test equipment of the LTN-101 air data inertial reference unit was not effective, for air data parameters, in detecting the problem, communicating appropriate fault information, and flagging affected data as invalid. [Minor safety issue]

- The air data inertial reference unit manufacturer’s failure mode effects analysis and other development processes for the LTN-101 ADIRU did not identify the data-spike failure mode.

- Although passengers are routinely reminded to keep their seat belts fastened during flight whenever they are seated, a significant number of passengers have not followed this advice. At the time of the first in-flight upset, more than 60 of the 303 passengers were seated without their seat belts fastened. [Minor safety issue]

Other safety factors

- In recent years there have been developments in guidance materials for system development processes and research into new approaches for system safety assessments. However, there has been limited research that has systematically evaluated how design engineers and safety analysts conduct their evaluations of systems, and how the design of their tasks, tools, training and guidance material can be improved so that the likelihood of design errors is minimised. [Minor safety issue]

- The large number of spurious warnings and caution messages that resulted from the anomalous air data inertial reference unit behaviour created a significant amount of workload and distraction for the flight crew.

- Single event effects (SEE) have the potential to adversely affect avionics systems that have not been specifically designed to be resilient to this hazard. There were no specific certification requirements for SEE, and until recently there was no formal guidance material available for addressing SEE during the design process. [Minor safety issue]

- The LTN-101 air data inertial reference unit (ADIRU) model had a demonstrated susceptibility to single event effects (SEE). The consideration of SEE during the design process was consistent with industry practice at the time the unit was developed, and the overall fault rates of the ADIRU were within the relevant design objectives. [Minor safety issue]

- Industry practices for tracking faults or performance problems with line-replaceable units were limited, unless the units are removed for examination. Consequently, the manufacturers of aircraft equipment have incomplete information for identifying patterns or trends that can be used to improve the safety, availability or reliability of the units. [Minor safety issue]

- There has been very little research conducted into the factors influencing passengers’ use of seat belts when the seat-belt sign is not illuminated, and the effectiveness of different techniques to increase the use of seat belts. [Minor safety issue]

- Although passengers are routinely advised after takeoff to wear their seat belts when seated, this advice typically does not reinforce how the seat belts should be worn. [Minor safety issue]

Other key findings

- As of the end of 2009, A330/A340 aircraft had accumulated over 28 million flight hours. The occurrence on 7 October 2008 was the only occasion when incorrect data from an air data inertial reference unit had resulted in inadvertent elevator commands. This in-service performance was consistent with the relevant certification requirements.

- As of April 2010, the LTN-101 air data inertial reference unit (ADIRU) had accumulated over 128 million hours of operation. The data-spike failure mode had only been observed on three occasions. The ADIRU’s in-service performance met the aircraft manufacturer’s safety and reliability objectives.

- Air data inertial reference unit (ADIRU) 2 and ADIRU 3 operated normally throughout the flight.

- Although air data inertial reference unit 1 transmitted a significant amount of incorrect data on inertial reference parameters to other aircraft systems, almost all of this data was flagged as invalid.

- It is very likely that the air data inertial reference unit (ADIRU) data-spike failure mode involved a problem with the data packaging and queuing within the ADIRU’s central processing unit module. This fault resulted in numerous data anomalies, including air data reference parameters being intermittently transmitted with the data or label of another parameter. Despite extensive testing and analysis, the exact origins of the failure mode could not be determined.

- Tests and analyses showed that the air data inertial reference unit data-spike failure mode was probably not triggered by a software bug, software corruption, hardware fault, physical environment factors (such as temperature of vibration), or from electromagnetic interference.

- The three known occurrences of the air data inertial reference unit data-spike failure mode occurred on two A330 aircraft operated by the same operator; however, no factors related to the operator’s aircraft configuration, operating practices, or maintenance practices were identified that were associated with the failure mode.

- The flight crew’s responses to the warnings and cautions, the pitch-down events, and the consequences of the pitch-down events, demonstrated sound judgement and a professional approach.

- Wearing a seat belt during all phases of a flight, and having the seat belt fastened low and firm, will significantly minimise the risk of injury in the unlikely event of an in-flight upset.

The ATSB reported in addition to the information released so far, that there had been a good opportunity to catch the failure mode before the events of 2008, when VH-QPA (which got involved involved in the Learmonth accident 2 years later) had another encounter with the same ADIRU. Although the flight data of that flight were no longer available, testimony of the crew reporting a number of warnings received permitted the investigation to conclude that "the occurrence involved similar ADIRU data output anomalies as that which occurred on the 7 October 2008 flight." The crew switched ADIRU#1 off and the anomalies ceased, maintenance realigned the ADIRU, which subsequently passed tests.

The ATSB stated therefore: "In theory, the 12 September 2006 occurrence provided an opportunity for the ADIRU data-spike failure mode and the design limitation of the A330/A340 flight control system to be identified before the 7 October 2008 occurrence. In reality, based on the available information, there were good reasons for not conducting any further investigation at the time."

The ATSB analysed that the upset was caused by elevator pitch down movements, that were not initiated by turbulence, pilot input, autopilot input, problems with the aircraft mass and balance, technical faults with the elevator controls or other relevant faults of the electronic flight control system. The investigation showed that the elevator movement was in fact prompted by the eletronic flight control system's primary flight control computer, which were programmed to provide a pitch down command if too high of an angle of attack (AoA) was detected. This was part of the AoA protection and anti pitch-up compensation. In the particular flight a very specific and unintended scenario occurred, in which erroneous AoA data from one of the three ADIRUs could trigger a pitch down command. The scenario needed two spikes with the second arriving 1.2 seconds after the first. About two minutes prior to the upset the ADIRU#1 started to provide erroneous AoA data containing a number of spikes. Simulation of those spikes done by the aircraft manufacturer confirmed the sequence of spikes as present in the accident flight would trigger the elevator movements as occurred on the accident flight.