Airbus has begun updating the software on its A320s to ensure pilots receive alerts at an appropriate level of priority during periods of multiple alerts and high workload, the Australian Transport Safety Bureau reported Thursday. The update follows an ATSB investigation into an unreliable airspeed indication and stall warning involving a Virgin Australia Regional Airlines Airbus A320 near Perth Airport on September 12, 2015.
While passing through 8,500 feet, the aircraft’s autothrust and autopilot disconnected and multiple system faults presented. The captain took manual control of the aircraft and continued the climb to 20,000 feet, and leveled off to troubleshoot the issues and plan a return to Perth.
On approach to Perth Airport while aligning with the instrument landing system, the stall warning activated. The warning stopped after six seconds and the pilots continued the approach for a successful landing.
The ATSB found the autothrust and autopilot disconnect resulted from erroneous airspeed indications during the takeoff and climb due to blocked pitot tubes. The pilots did not detect the erroneous airspeeds but the aircraft’s systems did, triggering the disconnect and generating multiple alerts including a "NAV ADR DISAGREE" alert.
This alert requires the pilots to crosscheck the three airspeed indications and assists them in determining if the source of the alert involves an airspeed or angle of attack disagreement. However, limited space in the alert message area meant it was initially pushed off the screen for engine-related alerts programmed with a higher priority but in this case not requiring immediate action by the crew.
The crew’s high workload meant the pilots didn’t initially act on the procedures for the alerts and the could not address the "NAV ADR DISAGREE" alert for about eight minutes, by which time the airspeed discrepancies had corrected themselves.
The ATSB found the sequencing of alert priorities and the alert’s associated procedure might have led the pilots to incorrectly identify the source of the alert as an angle of attack discrepancy, which the NAV ADR DISAGREE procedure advised had a risk of triggering an undue stall warning.
Given the multiple system alerts, which to the flight crew appeared unrelated, the pilots thought the stall warning that activated during the approach was spurious and therefore did not apply the stall recovery procedure. Angle of attack—not airspeed—triggers stall warnings, and instruments gave no indication of a malfunctioning angle of attack system.
ATSB executive director for transport safety Nat Nagy said many layers between the source information and the pilots can exist in modern aircraft with multiple interacting systems.
“The ATSB’s safety message from this investigation is where there is erroneous information from an information source, it is important that alerts and procedures be designed to ensure that the pilots can correctly diagnose the source of the erroneous information,” said Nagy.
“Further, unless it is absolutely clear that it is erroneous, pilots should appropriately respond to stall warning alerts.”
Airbus is currently in the process of updating the A320’s software to give the NAV ADR DISAGREE alert priority over the associated engine alerts. In the case of multiple alerts generated by unreliable airspeed, it will take precedence over the other associated alerts and be immediately visible to the pilots.
In addition, engineers will remove the ‘risk of undue stall warning’ message from the aircraft status related to the NAV ADR DISAGREE alert.
Airbus has begun updating the software on its A320s to ensure pilots receive alerts at an appropriate level of priority during periods of multiple alerts and high workload, the Australian Transport Safety Bureau reported on April 4. The update follows an ATSB investigation into an unreliable airspeed indication and stall warning involving a Virgin Australia Regional Airlines Airbus A320 near Perth Airport on September 12, 2015.
While passing through 8,500 feet, the aircraft’s autothrust and autopilot disconnected and multiple system faults presented. The captain took manual control of the aircraft and continued the climb to 20,000 feet, and leveled off to troubleshoot the issues and plan a return to Perth.
On approach to Perth Airport while aligning with the instrument landing system, the stall warning activated. The warning stopped after six seconds and the pilots continued the approach for a successful landing.
The ATSB found the autothrust and autopilot disconnect resulted from erroneous airspeed indications during the takeoff and climb due to blocked pitot tubes. The pilots did not detect the erroneous airspeeds but the aircraft’s systems did, triggering the disconnect and generating multiple alerts including a "NAV ADR DISAGREE" alert.
This alert requires the pilots to crosscheck the three airspeed indications and assists them in determining if the source of the alert involves an airspeed or angle of attack disagreement. However, limited space in the alert message area meant it was initially pushed off the screen for engine-related alerts programmed with a higher priority but in this case not requiring immediate action by the crew.
The crew’s high workload meant the pilots didn’t initially act on the procedures for the alerts and the could not address the "NAV ADR DISAGREE" alert for about eight minutes, by which time the airspeed discrepancies had corrected themselves.
The ATSB found the sequencing of alert priorities and the alert’s associated procedure might have led the pilots to incorrectly identify the source of the alert as an angle of attack discrepancy, which the NAV ADR DISAGREE procedure advised had a risk of triggering an undue stall warning.
Given the multiple system alerts, which to the flight crew appeared unrelated, the pilots thought the stall warning that activated during the approach was spurious and therefore did not apply the stall recovery procedure. Angle of attack—not airspeed—triggers stall warnings, and instruments gave no indication of a malfunctioning angle of attack system.
ATSB executive director for transport safety Nat Nagy said many layers between the source information and the pilots can exist in modern aircraft with multiple interacting systems.
“The ATSB’s safety message from this investigation is where there is erroneous information from an information source, it is important that alerts and procedures be designed to ensure that the pilots can correctly diagnose the source of the erroneous information,” said Nagy.
“Further, unless it is absolutely clear that it is erroneous, pilots should appropriately respond to stall warning alerts.”
Airbus is currently in the process of updating the A320’s software to give the NAV ADR DISAGREE alert priority over the associated engine alerts. In the case of multiple alerts generated by unreliable airspeed, it will take precedence over the other associated alerts and be immediately visible to the pilots.
In addition, engineers will remove the ‘risk of undue stall warning’ message from the aircraft status related to the NAV ADR DISAGREE alert.