Mayday (2013) s18e07 Episode Script
Free Fall
Automation: Stall.
Stall.
Captain Sullivan: What the hell is going on? A Qantas A330 takes a sudden nosedive over the Indian Ocean.
Fuzzy Maiava: And then boom.
I must have hit the ceiling 'cause it knocked me out.
One hundred and nineteen passengers and crew are injured.
First Officer Lipsett: Mayday.
Mayday.
Mayday.
Qantas 72.
The pilots struggle to control their crippled aircraft.
Kevin Sullivan: We are in trouble.
I don't know why the plane is behaving as it is.
Automation: Stall.
Second Officer Hales: Auto brakes not working.
Spoilers not working.
Computer one is not working.
Kevin Sullivan: There are no procedures in our operating manuals for what we were dealing with.
We probably will not survive.
Qantas Airways flight 72 cruises above the Indian Ocean headed for Western Australia.
Fuzzy Maiava: Look at that.
Your sommelier in the sky.
How's everybody doing? You're good? In the rear of the cabin, flight attendant Fuzzy Maiava is just finishing meal service.
Fuzzy Maiava: I wanted to travel the world for free.
I wanted to see the sights and, you know, the great cities.
And then I thought well, the only way to do that, um, is to become a flight attendant.
Fuzzy Maiava: Now this is one of my favourites.
Fuzzy Maiava: I just sort of enjoyed doing it.
You know, I just wanted to get out and show my flair I guess, you know, and um yeah and just make people smile and be happy, you know? Fuzzy Maiava: Girls.
Today, Fuzzy's been asked to keep a close eye on two young sisters traveling without their parents.
Fuzzy Maiava: I got a call from my manager.
He said, okay Fuzzy, um, I'm gonna put these lovely girls into your care.
Could you take care of them 'cause, you know you're a father, you're a grandfather.
Fuzzy Maiava: And for my special guests, our finest juice.
Now don't forget, girls, keep those seatbelts on, all right? Fuzzy Maiava: I explained to them that, you know, uh you must be your seatbelts must be on at all times unless you want to go to the bathroom.
The plane is an Airbus A330, a twin jet with the latest in aviation technology onboard.
Kevin Sullivan: The A330 is a new generation fly-by-wire aircraft.
It's highly automated, and the advantages are easy to fly, easy to manage, and protected.
Flight 72 departed from Singapore.
The flight path covers almost 2500 miles across the southern Indian Ocean to Perth, Australia.
Captain Sullivan: All right, Ross, out of my way.
Second Officer Hales: The captain's back in action? Captain Kevin Sullivan is a former Top Gun fighter pilot with the U.
S.
Navy.
Kevin Sullivan: The flight was a long tour of duty day, so the three of us will take scheduled rest breaks.
Second Officer Hales: Can I make a quick lavatory run? Captain Sullivan: Go ahead.
Ross Hales is the Second Officer.
Kevin Sullivan: The Second Officer was from general aviation, had been in the company for 12 months, a very competent young pilot.
First Officer Peter Lipsett is the next pilot scheduled to go on break.
Captain Sullivan: So Peter, what's the update? First Officer Lipsett: We're 100 nautical miles from the coast.
Learmonth is to our left and still cruising at 37,000 feet.
Captain Sullivan: All right.
Have a good rest.
Kevin Sullivan: The First officer was a former Royal Australian Navy helicopter pilot, a very competent and experienced pilot.
There are 303 passengers and nine flight attendants onboard.
Fuzzy Maiava: Hi.
Perfect weather is making for a comfortable flight.
Kevin Sullivan: We were over the ocean and things were very smooth.
Second Officer Hales: Any changes? Captain Sullivan: Altitude and airspeed's the same.
Smooth sailing.
(alarm) Don't tell me I just jinxed us.
The captain notices his autopilot is no longer engaged.
Kevin Sullivan: Autopilot one disconnects and now I'm hand flying.
It's a bit annoying, but we have two systems.
Captain Sullivan: Engaging autopilot two.
Kevin Sullivan: I engaged autopilot two and no sooner had I done that then we started getting overspeed and stall warnings.
Automation: Stall.
Captain Sullivan: The ECAM is showing a lot of errors.
Automation: Stall.
Second Officer Hales: Overspeed warning.
Automation: Stall.
Second Officer Hales: How can we be in a stall and overspeed at the same time? Captain Sullivan: We can't.
Automation: Stall.
In the cabin, there is no sign of trouble at all.
But a growing list of errors and warnings is filling the pilots' cockpit display.
Second Officer Hales: NAV IR 1 fault.
Captain Sullivan: That's not right.
They don't understand why.
Captain Sullivan: Airspeed's unreliable.
Disconnecting autopilot.
Kevin Sullivan: That's the first phase of unreliable speed memory checklist: Autopilot off.
I'm hand flying now, manually flying.
Captain Sullivan: Better get Peter back in here.
Second Officer Hales: Can the FO return to the cockpit please? Kevin Sullivan: My thinking is all hands on deck.
This is going to be a complex scenario to work through, and I wanted the first officer back on the flight deck to assist us.
Flight attendant Fuzzy Maiava finally has a moment to grab a bite to eat.
Fuzzy Maiava: I went in the back and I put my meal in the oven to warm it up.
Diane: Hey, Fuzz, where's your wine? Peter: Ours seems to have evaporated.
Fuzzy Maiava: Come on, you should know where it is.
Help yourself.
Peter: Thanks, pal.
Diane and Peter are a couple who both work for Qantas.
Today they're off duty.
Fuzzy Maiava: They were celebrating because they were on holiday.
And I'm looking at my oven because I'm hungry.
I'm focused on the food, you know? And so I focused properly on the timer: 13 seconds.
Thirteen seconds was the actual time.
All I could see was the floor disappearing, like, away from my feet.
We were going up.
Sudden G forces pull passengers up from their seats.
Anyone not strapped in hits the cabin ceiling.
Fuzzy Maiava: And the next minute bang.
I must have hit the ceiling because it knocked me out.
And I'm not sure how long it was for maybe two, three seconds, ten.
I just wasn't sure.
Kevin Sullivan: The G force was enough even with our three-point harness to lift us both out of the seat and push us forward as well.
That's quite disorienting.
Flight 72 is suddenly in a dangerous nosedive.
Captain Sullivan grabs the side stick to try to level his plane.
It doesn't respond.
Kevin Sullivan: Once I pulled back on the stick and nothing happened, I'm thinking: Okay, I'm not in control of this plane.
I basically had to brace myself with my right hand as I pulled back with the left.
The captain releases the side stick with his plane still speeding downward.
Kevin Sullivan: I'm confused.
Why is it doing this? Because it's not me doing it.
It's the aircraft doing it.
Then, he tries it again.
This time, it responds.
The plane starts to level off.
Kevin Sullivan: I knew as soon as the positive G came on people would come down from the ceiling.
Fuzzy Maiava: And, you know, I landed on the floor on my knees.
I just felt this crunch, this just, and it's sort of like just being KO'd, you know, hit by a bus or something.
It was so hard.
Second Officer Hales: What the hell was that? Captain Sullivan: It's the PRIM.
Captain Sullivan knows his primary flight computer has gone haywire.
Kevin Sullivan: The primary flight control computer is the brains of the airplane.
It moves the controls for the pilot.
Second Officer Hales: Attention, passengers.
This is the flight deck.
All passengers and crew must be seated and fasten their seatbelts immediately.
Fuzzy is badly injured.
He fears his friends, Diane and Peter, may be in even worse shape.
Fuzzy Maiava: As I came to again, I saw Diane and Peter on the floor, and Peter, I couldn't help but see blood gushing out of his head.
The oxygen masks were, were dangling down, you know, were just swaying.
And I thought something's happened.
Something's wrong.
Something's really, really wrong.
Second Officer Hales: NAV IR 1 fault resolved.
Captain Sullivan: What's next? Second Officer Hales: PRIM 3 fault.
The pilots struggle to resolve the cascade of warnings on their screen.
Second Officer Hales: NAV IR 1 fault again.
Captain Sullivan: What the hell is going on? Automation: Stall.
Fuzzy Maiava: We couldn't get Peter up.
You know, he was still in and out of consciousness, you know? Then he managed to sort of, like, put his hand up on the rail and then the next minute it did it again.
Kevin Sullivan: I remember that big fat wing roaring through the air mass.
Again, my control input is locked out.
Automation: Stall.
Kevin Sullivan: Again, we have to brace ourselves against the force.
Automation: Stall.
Kevin Sullivan: And of course the view of the Indian Ocean, there was a flash in my consciousness to say: Are you gonna wind up there today? Automation: Stall.
Stall.
Fuzzy Maiava: Things are flying around again.
Our legs were dangling in the air but we managed to hold onto the rail.
Once again, the captain's controls are slow to respond.
Finally, he manages to return his plane to level flight.
Fuzzy Maiava: I looked back up and I could see the two sisters who were at the back, especially the one that was sitting on the aisle.
She was looking at me and screaming, and she was like more or less pointing to me or putting her hand out, you know, to reach out to me.
But I couldn't move.
I felt so useless because they were my responsibility.
So I took it to heart because I have children too.
Captain Sullivan: Attention passengers, this is the Captain speaking.
We are dealing with flight control problems.
Everyone is to remain seated with their seatbelts fastened.
Kevin Sullivan: After the second pitch down, I'm starting to get a bit cranky.
I don't know why the plane is behaving as it is.
My inputs aren't stopping this behaviour.
First Officer Lipsett: It's carnage out there.
I broke my nose.
Captain Sullivan: Congratulations.
Sit down.
Strap in.
We're in trouble.
Kevin Sullivan: I've never used those words in my whole flying career.
But that day we were in trouble.
Normally, pilots fly with just a three-point seatbelt around their laps.
But the unpredictable situation now calls for the full five-point seatbelt harness.
Fuzzy Maiava: I sort of turned to Diane, and Diane looked at me, and I thought we're finished.
I was more or less praying for it to happen quick.
First Officer Lipsett: Do we need to divert? Captain Sullivan: Probably our best option.
We might not make it to Perth.
We could pitch down again at any time.
Second Officer Hales: Learmonth is close.
Its runways can handle an A330.
Captain Sullivan: Let's get an injury report from the cabin.
Flight 72 is almost a thousand kilometres from its destination.
The captain wants to know how his passengers are faring after the sudden violent upsets.
Second Officer Hales: Okay.
Thanks.
We have broken bones, at least one broken leg, lacerations.
Captain Sullivan: Okay, good enough.
We're declaring a mayday.
First Officer Lipsett: Mayday, mayday, mayday, Qantas 72 diverting direct to Learmonth.
Air Traffic Controller: Qantas 72, roger, cleared to Learmonth.
Richard Lienert: The information we got was that it was an emergency and there was going to be an emergency landing.
Sergeant Richard Lienert of the Western Australian Police Force is among the first to learn about flight 72's emergency.
Richard Lienert: We had some distance to cover.
Um it was important we got there quick as possible.
Captain Sullivan: Pull out the charts on Learmonth and give us an approach briefing.
This is the captain speaking.
We are aware of the injuries and are diverting to Learmonth where medical assistance will be waiting.
Fuzzy Maiava: And I thought to myself: Okay, we've heard from the front.
We've got an action plan.
So we got time to secure ourselves.
But Diane, an amazing woman.
Strong.
Focused.
It's that extra strength that you don't know you have, you know, that was Diane.
Captain Sullivan: Ross, I need the approach for Learmonth.
Second Officer Hales: Uh I'm trying, but the computer is not letting me enter anything.
Kevin Sullivan: We tried to interact with our navigation, uh, computers.
They were not cooperating.
Captain Sullivan: Okay, fine.
We're doing a visual approach and a ten mile final.
As the pilots prepare for an uncertain approach into Learmonth, emergency personnel prepare for the potential disaster to come.
Richard Lienert: When I first arrived at the scene, some of the medical services already arrived.
Nurses from the hospitals were teaming up with ambulance volunteers.
So we knew it was going to be an urgent situation.
Second Officer Hales: Auto brakes not working.
Spoilers not working.
Computer one's not working.
With so many error messages, the pilots don't know which systems they can rely on during the landing attempt.
Kevin Sullivan: At that stage I'm thinking: Okay, what's working? I'm still flying.
We still had engines and that's good enough, at least for us to get over into Learmonth.
Captain Sullivan: So we don't have much, but we do have engines.
Any questions? It looks like I picked a bad day to give up sniffing glue.
Kevin Sullivan: I used a line from the Airplane movie.
It brings the stress level down.
Diane: Everything's gonna be okay.
Qantas flight 72 begins its final descent to Learmonth.
Sullivan can only hope his plane will respond properly and not drop again.
Kevin Sullivan: That is my biggest threat.
We're in a badly degraded airplane.
We're still getting stall and overspeed warnings.
Automation: Stall.
Kevin Sullivan: And now we start getting Master Caution chimes.
Automation: Stall.
Kevin Sullivan: There are no procedures in our operating manuals for what we are dealing with and we'll have to gather further information to see exactly what else is not working.
Captain Sullivan: Flaps two.
At eleven thousand feet, the captain does an early control check to determine if at least his flaps are working.
Kevin Sullivan: We extended the flaps to position two.
We slowed the speed down to that flap limit speed.
We'll do a few turns, see if it works.
Turn left.
Turn right.
It feels okay.
That's good enough for me.
Captain Sullivan: All right? Let's go.
Passengers can do nothing but pray they make it safely to the runway.
Automation: Stall.
For the pilots of Qantas flight 72, tensions rise as they bring their crippled A330 in for an emergency landing.
Kevin Sullivan: Altitude is decreasing.
Anticipation is increasing.
It's quite a tense period because we're approaching a point where any pilot response to a pitch down is not going to have any effect.
If something does happen close to the ground, we probably will not survive.
The former fighter pilot decides the situation calls for an extreme technique.
Captain Sullivan: Here we go.
Something he learned in the navy.
Kevin Sullivan: We have a manoeuvre called a precautionary emergency landing.
It's a high energy, high rate of descent approach.
The A330 no longer has enough altitude to recover from a dive at normal landing speed.
But at a higher speed, it may be able to generate enough lift to recover if trouble strikes again.
Kevin Sullivan: If I have energy in the form of speed, I have manoeuvring potential to bring the nose up above the horizon before the airplane does another pitch down.
The military manoeuvre quickly brings them to within striking distance of the runway.
Captain Sullivan: Gear down.
First Officer Lipsett: Gear down.
Captain Sullivan: Flaps three.
The runway is long enough for an A330 in perfect working order.
But with so many systems in doubt, will flight 72 be able to stop in time? Kevin Sullivan: The automation was our worst enemy on that day.
We're trying to manage that kind of distraction.
What's real? What's not real? As soon as the wheels touched down, everybody in the cabin was cheering.
The brakes work, and the pilots are able to slow the plane down.
Kevin Sullivan: But we're at Learmonth airport.
There's not much assistance, and this is gonna be a long day.
Fuzzy Maiava: The doors are flung wide open.
It was the first responders.
Richard Lienert: When I'd entered the plane at the rear, it was quite clear where the significant trauma occurred.
Kevin Sullivan: To see the panels dislodged, the bloodied bandages, my heart was breaking, and it was broken that day.
Fuzzy Maiava: The standout memory for me would have to be the two sisters.
I was really glad that they were okay, that no harm came to them.
I could take that and say to myself that Fuzzy, you did your job.
In the cockpit, the first officer gathers up page after page of the plane's post-flight report.
Kevin Sullivan: We all had a look.
The first thing was ten simultaneous failures at the same time marker.
Captain Sullivan: There's the problem.
Kevin Sullivan: I looked at the two other pilots and I said, I think we're pretty lucky to be here because it was a total systems failure.
Medical responders get injured passengers off the plane.
Amazingly, everyone survives.
But many are seriously injured, including Fuzzy.
Fuzzy Maiava: It's been a really rough time since the accident.
I've been in and out of hospitals.
Fuzzy sustained injuries to his head, knees, back and shoulder.
The physical pain and emotional scars from the accident linger.
Fuzzy Maiava: When the pain comes on it always triggers the flashbacks and nightmares.
The pain that I'm experiencing every day, I wouldn't wish that on anybody.
Investigators from the Australian Transport Safety Bureau arrive in Learmonth.
Michael Walker: In the cabin, there was quite a lot of damage, mainly to the ceiling panels and the ceiling fixtures.
You could see that people had actually hit the ceiling, and that would have resulted in severe injuries.
With almost 600 A330s in service around the globe, investigators face intense pressure to find the cause.
Could this happen to another A330? Michael Walker: It was quite important to understand as quickly as possible what triggered this or what were the factors involved in this so we could stop it from happening again.
Michael Walker: Let's power this thing up and see if we can download some data.
Investigators hope data from the plane's quick access recorder can shed light on what went wrong.
They focus on the fly-by-wire control system.
Graham Drummond: A fly-by-wire system takes a pilot's inputs and converts them into electrical signals that go out to the wings and the tail of the aircraft to, to control the flight control surfaces.
Graham Drummond: I'm seeing two abrupt changes in the elevators' position at cruise.
It looks like that's what caused the pitch downs.
Michael Walker: Were those commands coming from the pilots? Graham Drummond: No, they weren't.
Weird.
Second Officer Hales: NAV IR 1 fault.
Automation: Stall.
Captain Sullivan: That's not right.
It seems the plane's fly-by-wire system was sending rogue commands to the flight control surfaces.
Automation: Stall.
Captain Sullivan: What the hell is going on? Baffled by their discovery, investigators test the system.
Michael Walker: So we need to look at the elevators and the servo, uh, controls themselves.
Graham Drummond: All right.
Let's, uh, let's move the elevators and see how they respond.
Michael Walker: Copy that.
Moving elevators down.
Graham Drummond: We did functional tests on the elevators themselves and stood up and watched them move up and down.
Walker: Moving elevators up.
Graham Drummond: Okay, that's good.
Everything's working back here.
The test reveals no problems at all with the flight controls.
Whatever the malfunction was that imperiled flight 72, it seems to have mysteriously vanished.
Graham Drummond: Nice to meet you.
Captain Sullivan: Nice to meet you.
Investigators need to hear the pilots' story.
Michael Walker: That was some amazing flying.
Captain Sullivan: I appreciate the kudos, but to be frank I just wanna find out what happened.
Graham Drummond: We're working on that.
Michael Walker: We went through everything that they recalled, and any anything unusual in the period beforehand.
Michael Walker: Describe the flight leading up to the pitch downs, anything that could have caused these erratic movements.
Captain Sullivan: Everything was perfectly normal from Singapore to most of the way across the ocean.
We were totally blindsided.
Michael Walker: They had a pretty good recollection but had no explanations as to why this happened.
Michael Walker: And you were getting a lot of faults? Captain Sullivan: Oh yeah, there were a few.
Have a look for yourself.
It's like the plane had a mind of its own.
The A330's post-flight-report logs all of the cautions and warnings that were affecting the plane.
Michael Walker: On the post-flight report there was a large list of different warnings.
Michael Walker: Pull it up, please.
Michael Walker: Some of them seemed to be from completely unrelated systems.
It raised a lot more questions than answers initially.
They study the list, looking for anything that might connect the various warnings.
Graham Drummond: The first question you have is, what's the common element between all these? Graham Drummond: All these errors are connected to ADIRU 1.
The ADIRU, or Air Data Inertial Reference Unit, relays important information to the flight computers about the environment outside the plane.
There are three units onboard the aircraft.
Graham Drummond: This is the unit, ADIRU 1.
Investigators turn their attention to ADIRU 1.
Michael Walker: So that ADIRU obviously became an important part of the puzzle because it was associated with so many faults.
Michael Walker: Whatever caused that episode it has something to do with this box.
We need to collect every speck of data that ran through it.
Investigators need to find all the data they can on how flight 72 was performing during its sudden upset.
They turn to the flight data recorder, where hundreds of parameters are stored.
Michael Walker: Look at this.
I've never seen anything like it.
They spot something highly unusual.
Michael Walker: These are wild angle of attack fluctuations coming from AoA 1.
Angle of Attack, or AoA, is the angle of the plane's wing relative to airflow.
The higher the angle, the less smooth the airflow over the wing.
Neil Campbell: And if the aircraft angle of attack gets too high, then the aircraft can stall.
So it's a very important parameter.
Michael Walker: From over 50 degrees nose up, back to level, then negative 50 degrees.
Graham Drummond: That's not what the pilots described at all.
Captain Sullivan: Have a look for yourself.
It's like the plane had a mind of its own.
Drummond knows that the crew described their plane pitching nose down twice.
They never said it pitched up.
Graham Drummond: What do the elevator readings say? Michael Walker: Ten degrees nose down.
He checks other FDR readings that record the plane's pitch.
That data also confirms what the crew reported.
Michael Walker: Show me the angle of attack again.
Neil Campbell: From the flight data recorder information, we could see that the elevators moved in a nose down direction about ten degrees.
It was an abrupt rate of change.
Michael Walker: The plane did not pitch up.
There's no way this AoA data is correct.
Investigators are convinced the bizarre angle of attack data must be faulty.
It leads them to an intriguing question.
Graham Drummond: What would faulty data like this do to an A330? Michael Walker: I'm not sure.
But I bet it's not good.
Let's go ask Airbus.
Graham Drummond: Once we knew that the ADIRU was outputting spurious data, we had to actually drill down even deeper and really understand what's going on.
Graham Drummond: So if the plane thought it was in a dangerous stall condition, the protections would kick in.
Meeting with an Airbus engineer, investigators learn about the A330's built-in failsafe measures.
Known as protection modes, they prevent pilots from putting their plane into a dangerous attitude.
Kevin Sullivan: The protection modes are there to keep the aircraft in its flight envelope regardless of what the pilot tries to do to exceed that flight envelope.
Graham Drummond: And then the computer would take over and command these two pitch downs.
What would that look like if the plane wasn't pitched up? Investigators discover that on the flight from Singapore, two protections that weren't needed kicked in at the same time.
Second Officer Hales: NAV IR 1 fault.
Captain Sullivan: That's not right.
It seems the computer thought the plane was pitching way up and was dangerously close to stalling.
Captain Sullivan: What the hell is going on? When the stall protection activated, the A330's computer commanded the first protection push the nose down four degrees.
At the same time, an anti pitch-up protection commanded the nose down six degrees.
Graham Drummond: Together, that's ten degrees.
It's the same elevator movement as flight 72.
Graham Drummond: It was established that erroneous angle of attack data had gone into the aircraft flight control computers and triggered angle of attack protections that essentially caused the aircraft to pitch forward.
Establishing a link between faulty data and flight 72's sudden upset is a step forward.
But the mystery of what happened aboard Qantas flight 72 is far from solved.
The grim reality is that buried deep in the software of all A330s is an error that can trick the plane into making a sudden downward pitch.
And now identifying the cause of the glitch Michael Walker: Hello? has become even more urgent.
Michael Walker: Okay.
Thank you.
That was Qantas.
Another A330 just had the same ADIRU failure.
ATSB investigators gather information on another flight that suffered the same systems glitch as Qantas flight 72.
Michael Walker: Well that's a relief.
Thanks for letting us know.
The pilots had heard about flight 72.
When their ADIRU acted up they shut down their computers immediately.
No pitch downs.
Graham Drummond: Have a look at this.
When they search A330 flight records worldwide, they find yet another frightening incident.
Michael Walker: We identified another event with the same ADIRU a couple years beforehand, which was very similar with the ADIRU providing all that nuisance information, nuisance alerts to the flight crew.
Michael Walker: So this has happened three times already.
Michael Walker: Having three events on these ADIRUs was somewhat of a concern.
To what extent could there be more events? How vulnerable potentially was this system? Michael Walker: There's gotta be an explanation for this bad data.
Walker and his team are desperate to uncover the hidden flaw that's putting one of the world's most popular planes at risk.
They dig deep into the digital code sent from the air data unit.
They scan thousands of lines of code.
Graham Drummond: Wait a minute.
Finally, they spot something.
Graham Drummond: That label's not right.
That should be altitude.
Graham Drummond: When the ADIRU passes data to other systems it sends the data and attaches a label to each data message that's sent.
A key turning point in this case was we were seeing data that was sent out as altitude data but being labeled as angle of attack data.
By improperly swapping the two types of data, the ADIRU confused the plane's automated systems with catastrophic results.
Graham Drummond: Now you've got the ADIRU sending data to other systems saying the angle of attack is actually 50 degrees and not what it really was, and those receiving systems were treating it as thought it was valid data.
Investigators now understand why the plane's protection modes kicked in when they weren't needed.
But they still don't understand what caused the data error in the first place.
That's the big question now.
Graham Drummond: The ADIRU is run through a battery of tests.
We tested every input, every output, inspected every component, every sub-component right into the nitty-gritty of the data processing in order to figure out what was going on.
No problems were encountered.
In their search for the answer, they wonder if environmental conditions onboard the aircraft could have caused the unit to malfunction.
They put it through a component stress test.
Graham Drummond: That looks snug.
Let's boot it up.
Graham Drummond: All aircraft equipment is designed to withstand certain what's called environmental conditions, and they're things like temperature and vibration.
They boost the unit's internal temperature by wrapping it in a heat shroud.
Graham Drummond: We subjected the unit to a highly accelerated stress test where it was run under a high CPU load for a long period of time while under a heat shroud, and nothing happened.
The lab tests turn up nothing.
Graham Drummond: We can't find anything physically wrong with the unit that would explain what we saw.
And that was a little frustrating.
With no evidence of any internal malfunction, investigators now question whether factors outside the aircraft could have been at play.
Graham Drummond: So this will beam common frequencies like radio transmissions, wireless signals? Drummond and his team now consider the potential effects of electromagnetic radiation.
Graham Drummond: Electromagnetic radiation can come from a number of sources.
It can come from external sources like radars or radio transmitters, and we can eliminate all those together by doing the same kinds of testing.
We irradiated the units with electromagnetic radiation, and it passed with flying colors.
It's another dead-end.
Investigators are at a loss.
Captain Sullivan: What the hell is going on? They still can't explain the frightening malfunction.
Graham Drummond: All right, let's see where these instances occurred.
Investigators now wonder if some unknown factor on the ground could have caused the dangerous ADIRU failure.
Michael Walker: Isn't it weird that all three events occurred off the coast of Australia? Australian investigators continue their search for the cause of a mysterious and potentially deadly malfunction, one that injured 119 passengers and crew onboard Qantas Flight 72.
Michael Walker: The papers won't stop talking about this communications station.
Graham Drummond: What? This naval base outside Learmonth? Michael Walker: Yeah.
Maybe that's what interfered with the plane.
Graham Drummond: We should run a test.
Michael Walker: Yeah.
With news media speculating about a communications station near Learmonth, the team rolls out the biggest test yet a full-scale flight test of the same Qantas A330 that suffered a near fatal failure.
Graham Drummond: So we took that aircraft and we flew it in that area to see if there was any issues.
There was, um, equipment installed on that aircraft to measure the electromagnetic radiation environment in there.
Graham Drummond: Nothing yet.
Wait a minute.
Take out your cell phones.
Turn them on.
See if it has any effect.
Graham Drummond: And we turned all of our mobile phones on and we tried to make calls and all that sort of thing.
We just wanted to see if any of the equipment would pick up on anything.
And it didn't.
Graham Drummond: Nothing.
The coast is coming up.
The communications tower should be in range.
Graham Drummond: The aircraft took the same flight path as the event aircraft and not only did nothing happen but it wasn't even measurable on the equipment.
Graham Drummond: All right, let's go home.
Michael Walker: It was a little bit frustrating but we basically we came to the end of the road in all the things that we could practically do.
While investigators don't know the root cause of the underlying failure, they understand the chain of events that led to the violent mid-air upset.
Michael Walker: It all starts with bad data.
A mysterious malfunction in one of the plane's three air data units sends faulty data to other systems.
Second Officer Hales: PRIM 3 fault.
Automation: Stall.
Second Officer Hales: Resolved.
Automation: Stall.
Second Officer Hales: NAV IR 1 fault again.
Captain Sullivan: What the hell is going on? Automation: Stall.
The pilots are inundated with warnings when their flight computer gets altitude data that's been improperly labeled as angle of attack data.
The A330's automated protections kick in, commanding a ten-degree pitch down.
Anything not strapped down in the cabin is instantly airborne.
But thanks to the heroic flying of a former Top Gun pilot, the accident does not end in an all-out disaster.
Kevin Sullivan: The automation had failed us, had injured a third of the airplane, injured one of the pilots.
But it's the human factor that worked through it.
Captain Sullivan: Gear down.
Kevin Sullivan: And saved the day.
Captain Sullivan: Flaps three.
Fuzzy Maiava: Kevin deserves a Congressional Medal of Honour.
That guy is amazing.
Kevin is the reason why we're sitting here today to tell the story.
Michael Walker: This was a black swan event, something that had never been seen before, something that no one had ever really expected would happen.
And although we didn't actually find a full explanation, we found enough of an explanation to reduce the risk of this happening again.
The ATSB's investigation helped Airbus engineers make important software changes.
Now, if the same error ever strikes again, it will not result in a violent pitch down.
Neil Campbell: The key thing to remember is the scenario that happened on QF 72 can't happen again with flight control computer software changes.
Kevin Sullivan: As automation technology improves, we still can't guarantee that automation will be infallible.
I feel that the hierarchy still needs to be pilot number one, computer number two.
For Fuzzy Maiava, the biggest lesson is an important safety reminder.
Fuzzy Maiava: Buckle up.
You know, it's simple.
It's just common sense.
Stall.
Captain Sullivan: What the hell is going on? A Qantas A330 takes a sudden nosedive over the Indian Ocean.
Fuzzy Maiava: And then boom.
I must have hit the ceiling 'cause it knocked me out.
One hundred and nineteen passengers and crew are injured.
First Officer Lipsett: Mayday.
Mayday.
Mayday.
Qantas 72.
The pilots struggle to control their crippled aircraft.
Kevin Sullivan: We are in trouble.
I don't know why the plane is behaving as it is.
Automation: Stall.
Second Officer Hales: Auto brakes not working.
Spoilers not working.
Computer one is not working.
Kevin Sullivan: There are no procedures in our operating manuals for what we were dealing with.
We probably will not survive.
Qantas Airways flight 72 cruises above the Indian Ocean headed for Western Australia.
Fuzzy Maiava: Look at that.
Your sommelier in the sky.
How's everybody doing? You're good? In the rear of the cabin, flight attendant Fuzzy Maiava is just finishing meal service.
Fuzzy Maiava: I wanted to travel the world for free.
I wanted to see the sights and, you know, the great cities.
And then I thought well, the only way to do that, um, is to become a flight attendant.
Fuzzy Maiava: Now this is one of my favourites.
Fuzzy Maiava: I just sort of enjoyed doing it.
You know, I just wanted to get out and show my flair I guess, you know, and um yeah and just make people smile and be happy, you know? Fuzzy Maiava: Girls.
Today, Fuzzy's been asked to keep a close eye on two young sisters traveling without their parents.
Fuzzy Maiava: I got a call from my manager.
He said, okay Fuzzy, um, I'm gonna put these lovely girls into your care.
Could you take care of them 'cause, you know you're a father, you're a grandfather.
Fuzzy Maiava: And for my special guests, our finest juice.
Now don't forget, girls, keep those seatbelts on, all right? Fuzzy Maiava: I explained to them that, you know, uh you must be your seatbelts must be on at all times unless you want to go to the bathroom.
The plane is an Airbus A330, a twin jet with the latest in aviation technology onboard.
Kevin Sullivan: The A330 is a new generation fly-by-wire aircraft.
It's highly automated, and the advantages are easy to fly, easy to manage, and protected.
Flight 72 departed from Singapore.
The flight path covers almost 2500 miles across the southern Indian Ocean to Perth, Australia.
Captain Sullivan: All right, Ross, out of my way.
Second Officer Hales: The captain's back in action? Captain Kevin Sullivan is a former Top Gun fighter pilot with the U.
S.
Navy.
Kevin Sullivan: The flight was a long tour of duty day, so the three of us will take scheduled rest breaks.
Second Officer Hales: Can I make a quick lavatory run? Captain Sullivan: Go ahead.
Ross Hales is the Second Officer.
Kevin Sullivan: The Second Officer was from general aviation, had been in the company for 12 months, a very competent young pilot.
First Officer Peter Lipsett is the next pilot scheduled to go on break.
Captain Sullivan: So Peter, what's the update? First Officer Lipsett: We're 100 nautical miles from the coast.
Learmonth is to our left and still cruising at 37,000 feet.
Captain Sullivan: All right.
Have a good rest.
Kevin Sullivan: The First officer was a former Royal Australian Navy helicopter pilot, a very competent and experienced pilot.
There are 303 passengers and nine flight attendants onboard.
Fuzzy Maiava: Hi.
Perfect weather is making for a comfortable flight.
Kevin Sullivan: We were over the ocean and things were very smooth.
Second Officer Hales: Any changes? Captain Sullivan: Altitude and airspeed's the same.
Smooth sailing.
(alarm) Don't tell me I just jinxed us.
The captain notices his autopilot is no longer engaged.
Kevin Sullivan: Autopilot one disconnects and now I'm hand flying.
It's a bit annoying, but we have two systems.
Captain Sullivan: Engaging autopilot two.
Kevin Sullivan: I engaged autopilot two and no sooner had I done that then we started getting overspeed and stall warnings.
Automation: Stall.
Captain Sullivan: The ECAM is showing a lot of errors.
Automation: Stall.
Second Officer Hales: Overspeed warning.
Automation: Stall.
Second Officer Hales: How can we be in a stall and overspeed at the same time? Captain Sullivan: We can't.
Automation: Stall.
In the cabin, there is no sign of trouble at all.
But a growing list of errors and warnings is filling the pilots' cockpit display.
Second Officer Hales: NAV IR 1 fault.
Captain Sullivan: That's not right.
They don't understand why.
Captain Sullivan: Airspeed's unreliable.
Disconnecting autopilot.
Kevin Sullivan: That's the first phase of unreliable speed memory checklist: Autopilot off.
I'm hand flying now, manually flying.
Captain Sullivan: Better get Peter back in here.
Second Officer Hales: Can the FO return to the cockpit please? Kevin Sullivan: My thinking is all hands on deck.
This is going to be a complex scenario to work through, and I wanted the first officer back on the flight deck to assist us.
Flight attendant Fuzzy Maiava finally has a moment to grab a bite to eat.
Fuzzy Maiava: I went in the back and I put my meal in the oven to warm it up.
Diane: Hey, Fuzz, where's your wine? Peter: Ours seems to have evaporated.
Fuzzy Maiava: Come on, you should know where it is.
Help yourself.
Peter: Thanks, pal.
Diane and Peter are a couple who both work for Qantas.
Today they're off duty.
Fuzzy Maiava: They were celebrating because they were on holiday.
And I'm looking at my oven because I'm hungry.
I'm focused on the food, you know? And so I focused properly on the timer: 13 seconds.
Thirteen seconds was the actual time.
All I could see was the floor disappearing, like, away from my feet.
We were going up.
Sudden G forces pull passengers up from their seats.
Anyone not strapped in hits the cabin ceiling.
Fuzzy Maiava: And the next minute bang.
I must have hit the ceiling because it knocked me out.
And I'm not sure how long it was for maybe two, three seconds, ten.
I just wasn't sure.
Kevin Sullivan: The G force was enough even with our three-point harness to lift us both out of the seat and push us forward as well.
That's quite disorienting.
Flight 72 is suddenly in a dangerous nosedive.
Captain Sullivan grabs the side stick to try to level his plane.
It doesn't respond.
Kevin Sullivan: Once I pulled back on the stick and nothing happened, I'm thinking: Okay, I'm not in control of this plane.
I basically had to brace myself with my right hand as I pulled back with the left.
The captain releases the side stick with his plane still speeding downward.
Kevin Sullivan: I'm confused.
Why is it doing this? Because it's not me doing it.
It's the aircraft doing it.
Then, he tries it again.
This time, it responds.
The plane starts to level off.
Kevin Sullivan: I knew as soon as the positive G came on people would come down from the ceiling.
Fuzzy Maiava: And, you know, I landed on the floor on my knees.
I just felt this crunch, this just, and it's sort of like just being KO'd, you know, hit by a bus or something.
It was so hard.
Second Officer Hales: What the hell was that? Captain Sullivan: It's the PRIM.
Captain Sullivan knows his primary flight computer has gone haywire.
Kevin Sullivan: The primary flight control computer is the brains of the airplane.
It moves the controls for the pilot.
Second Officer Hales: Attention, passengers.
This is the flight deck.
All passengers and crew must be seated and fasten their seatbelts immediately.
Fuzzy is badly injured.
He fears his friends, Diane and Peter, may be in even worse shape.
Fuzzy Maiava: As I came to again, I saw Diane and Peter on the floor, and Peter, I couldn't help but see blood gushing out of his head.
The oxygen masks were, were dangling down, you know, were just swaying.
And I thought something's happened.
Something's wrong.
Something's really, really wrong.
Second Officer Hales: NAV IR 1 fault resolved.
Captain Sullivan: What's next? Second Officer Hales: PRIM 3 fault.
The pilots struggle to resolve the cascade of warnings on their screen.
Second Officer Hales: NAV IR 1 fault again.
Captain Sullivan: What the hell is going on? Automation: Stall.
Fuzzy Maiava: We couldn't get Peter up.
You know, he was still in and out of consciousness, you know? Then he managed to sort of, like, put his hand up on the rail and then the next minute it did it again.
Kevin Sullivan: I remember that big fat wing roaring through the air mass.
Again, my control input is locked out.
Automation: Stall.
Kevin Sullivan: Again, we have to brace ourselves against the force.
Automation: Stall.
Kevin Sullivan: And of course the view of the Indian Ocean, there was a flash in my consciousness to say: Are you gonna wind up there today? Automation: Stall.
Stall.
Fuzzy Maiava: Things are flying around again.
Our legs were dangling in the air but we managed to hold onto the rail.
Once again, the captain's controls are slow to respond.
Finally, he manages to return his plane to level flight.
Fuzzy Maiava: I looked back up and I could see the two sisters who were at the back, especially the one that was sitting on the aisle.
She was looking at me and screaming, and she was like more or less pointing to me or putting her hand out, you know, to reach out to me.
But I couldn't move.
I felt so useless because they were my responsibility.
So I took it to heart because I have children too.
Captain Sullivan: Attention passengers, this is the Captain speaking.
We are dealing with flight control problems.
Everyone is to remain seated with their seatbelts fastened.
Kevin Sullivan: After the second pitch down, I'm starting to get a bit cranky.
I don't know why the plane is behaving as it is.
My inputs aren't stopping this behaviour.
First Officer Lipsett: It's carnage out there.
I broke my nose.
Captain Sullivan: Congratulations.
Sit down.
Strap in.
We're in trouble.
Kevin Sullivan: I've never used those words in my whole flying career.
But that day we were in trouble.
Normally, pilots fly with just a three-point seatbelt around their laps.
But the unpredictable situation now calls for the full five-point seatbelt harness.
Fuzzy Maiava: I sort of turned to Diane, and Diane looked at me, and I thought we're finished.
I was more or less praying for it to happen quick.
First Officer Lipsett: Do we need to divert? Captain Sullivan: Probably our best option.
We might not make it to Perth.
We could pitch down again at any time.
Second Officer Hales: Learmonth is close.
Its runways can handle an A330.
Captain Sullivan: Let's get an injury report from the cabin.
Flight 72 is almost a thousand kilometres from its destination.
The captain wants to know how his passengers are faring after the sudden violent upsets.
Second Officer Hales: Okay.
Thanks.
We have broken bones, at least one broken leg, lacerations.
Captain Sullivan: Okay, good enough.
We're declaring a mayday.
First Officer Lipsett: Mayday, mayday, mayday, Qantas 72 diverting direct to Learmonth.
Air Traffic Controller: Qantas 72, roger, cleared to Learmonth.
Richard Lienert: The information we got was that it was an emergency and there was going to be an emergency landing.
Sergeant Richard Lienert of the Western Australian Police Force is among the first to learn about flight 72's emergency.
Richard Lienert: We had some distance to cover.
Um it was important we got there quick as possible.
Captain Sullivan: Pull out the charts on Learmonth and give us an approach briefing.
This is the captain speaking.
We are aware of the injuries and are diverting to Learmonth where medical assistance will be waiting.
Fuzzy Maiava: And I thought to myself: Okay, we've heard from the front.
We've got an action plan.
So we got time to secure ourselves.
But Diane, an amazing woman.
Strong.
Focused.
It's that extra strength that you don't know you have, you know, that was Diane.
Captain Sullivan: Ross, I need the approach for Learmonth.
Second Officer Hales: Uh I'm trying, but the computer is not letting me enter anything.
Kevin Sullivan: We tried to interact with our navigation, uh, computers.
They were not cooperating.
Captain Sullivan: Okay, fine.
We're doing a visual approach and a ten mile final.
As the pilots prepare for an uncertain approach into Learmonth, emergency personnel prepare for the potential disaster to come.
Richard Lienert: When I first arrived at the scene, some of the medical services already arrived.
Nurses from the hospitals were teaming up with ambulance volunteers.
So we knew it was going to be an urgent situation.
Second Officer Hales: Auto brakes not working.
Spoilers not working.
Computer one's not working.
With so many error messages, the pilots don't know which systems they can rely on during the landing attempt.
Kevin Sullivan: At that stage I'm thinking: Okay, what's working? I'm still flying.
We still had engines and that's good enough, at least for us to get over into Learmonth.
Captain Sullivan: So we don't have much, but we do have engines.
Any questions? It looks like I picked a bad day to give up sniffing glue.
Kevin Sullivan: I used a line from the Airplane movie.
It brings the stress level down.
Diane: Everything's gonna be okay.
Qantas flight 72 begins its final descent to Learmonth.
Sullivan can only hope his plane will respond properly and not drop again.
Kevin Sullivan: That is my biggest threat.
We're in a badly degraded airplane.
We're still getting stall and overspeed warnings.
Automation: Stall.
Kevin Sullivan: And now we start getting Master Caution chimes.
Automation: Stall.
Kevin Sullivan: There are no procedures in our operating manuals for what we are dealing with and we'll have to gather further information to see exactly what else is not working.
Captain Sullivan: Flaps two.
At eleven thousand feet, the captain does an early control check to determine if at least his flaps are working.
Kevin Sullivan: We extended the flaps to position two.
We slowed the speed down to that flap limit speed.
We'll do a few turns, see if it works.
Turn left.
Turn right.
It feels okay.
That's good enough for me.
Captain Sullivan: All right? Let's go.
Passengers can do nothing but pray they make it safely to the runway.
Automation: Stall.
For the pilots of Qantas flight 72, tensions rise as they bring their crippled A330 in for an emergency landing.
Kevin Sullivan: Altitude is decreasing.
Anticipation is increasing.
It's quite a tense period because we're approaching a point where any pilot response to a pitch down is not going to have any effect.
If something does happen close to the ground, we probably will not survive.
The former fighter pilot decides the situation calls for an extreme technique.
Captain Sullivan: Here we go.
Something he learned in the navy.
Kevin Sullivan: We have a manoeuvre called a precautionary emergency landing.
It's a high energy, high rate of descent approach.
The A330 no longer has enough altitude to recover from a dive at normal landing speed.
But at a higher speed, it may be able to generate enough lift to recover if trouble strikes again.
Kevin Sullivan: If I have energy in the form of speed, I have manoeuvring potential to bring the nose up above the horizon before the airplane does another pitch down.
The military manoeuvre quickly brings them to within striking distance of the runway.
Captain Sullivan: Gear down.
First Officer Lipsett: Gear down.
Captain Sullivan: Flaps three.
The runway is long enough for an A330 in perfect working order.
But with so many systems in doubt, will flight 72 be able to stop in time? Kevin Sullivan: The automation was our worst enemy on that day.
We're trying to manage that kind of distraction.
What's real? What's not real? As soon as the wheels touched down, everybody in the cabin was cheering.
The brakes work, and the pilots are able to slow the plane down.
Kevin Sullivan: But we're at Learmonth airport.
There's not much assistance, and this is gonna be a long day.
Fuzzy Maiava: The doors are flung wide open.
It was the first responders.
Richard Lienert: When I'd entered the plane at the rear, it was quite clear where the significant trauma occurred.
Kevin Sullivan: To see the panels dislodged, the bloodied bandages, my heart was breaking, and it was broken that day.
Fuzzy Maiava: The standout memory for me would have to be the two sisters.
I was really glad that they were okay, that no harm came to them.
I could take that and say to myself that Fuzzy, you did your job.
In the cockpit, the first officer gathers up page after page of the plane's post-flight report.
Kevin Sullivan: We all had a look.
The first thing was ten simultaneous failures at the same time marker.
Captain Sullivan: There's the problem.
Kevin Sullivan: I looked at the two other pilots and I said, I think we're pretty lucky to be here because it was a total systems failure.
Medical responders get injured passengers off the plane.
Amazingly, everyone survives.
But many are seriously injured, including Fuzzy.
Fuzzy Maiava: It's been a really rough time since the accident.
I've been in and out of hospitals.
Fuzzy sustained injuries to his head, knees, back and shoulder.
The physical pain and emotional scars from the accident linger.
Fuzzy Maiava: When the pain comes on it always triggers the flashbacks and nightmares.
The pain that I'm experiencing every day, I wouldn't wish that on anybody.
Investigators from the Australian Transport Safety Bureau arrive in Learmonth.
Michael Walker: In the cabin, there was quite a lot of damage, mainly to the ceiling panels and the ceiling fixtures.
You could see that people had actually hit the ceiling, and that would have resulted in severe injuries.
With almost 600 A330s in service around the globe, investigators face intense pressure to find the cause.
Could this happen to another A330? Michael Walker: It was quite important to understand as quickly as possible what triggered this or what were the factors involved in this so we could stop it from happening again.
Michael Walker: Let's power this thing up and see if we can download some data.
Investigators hope data from the plane's quick access recorder can shed light on what went wrong.
They focus on the fly-by-wire control system.
Graham Drummond: A fly-by-wire system takes a pilot's inputs and converts them into electrical signals that go out to the wings and the tail of the aircraft to, to control the flight control surfaces.
Graham Drummond: I'm seeing two abrupt changes in the elevators' position at cruise.
It looks like that's what caused the pitch downs.
Michael Walker: Were those commands coming from the pilots? Graham Drummond: No, they weren't.
Weird.
Second Officer Hales: NAV IR 1 fault.
Automation: Stall.
Captain Sullivan: That's not right.
It seems the plane's fly-by-wire system was sending rogue commands to the flight control surfaces.
Automation: Stall.
Captain Sullivan: What the hell is going on? Baffled by their discovery, investigators test the system.
Michael Walker: So we need to look at the elevators and the servo, uh, controls themselves.
Graham Drummond: All right.
Let's, uh, let's move the elevators and see how they respond.
Michael Walker: Copy that.
Moving elevators down.
Graham Drummond: We did functional tests on the elevators themselves and stood up and watched them move up and down.
Walker: Moving elevators up.
Graham Drummond: Okay, that's good.
Everything's working back here.
The test reveals no problems at all with the flight controls.
Whatever the malfunction was that imperiled flight 72, it seems to have mysteriously vanished.
Graham Drummond: Nice to meet you.
Captain Sullivan: Nice to meet you.
Investigators need to hear the pilots' story.
Michael Walker: That was some amazing flying.
Captain Sullivan: I appreciate the kudos, but to be frank I just wanna find out what happened.
Graham Drummond: We're working on that.
Michael Walker: We went through everything that they recalled, and any anything unusual in the period beforehand.
Michael Walker: Describe the flight leading up to the pitch downs, anything that could have caused these erratic movements.
Captain Sullivan: Everything was perfectly normal from Singapore to most of the way across the ocean.
We were totally blindsided.
Michael Walker: They had a pretty good recollection but had no explanations as to why this happened.
Michael Walker: And you were getting a lot of faults? Captain Sullivan: Oh yeah, there were a few.
Have a look for yourself.
It's like the plane had a mind of its own.
The A330's post-flight-report logs all of the cautions and warnings that were affecting the plane.
Michael Walker: On the post-flight report there was a large list of different warnings.
Michael Walker: Pull it up, please.
Michael Walker: Some of them seemed to be from completely unrelated systems.
It raised a lot more questions than answers initially.
They study the list, looking for anything that might connect the various warnings.
Graham Drummond: The first question you have is, what's the common element between all these? Graham Drummond: All these errors are connected to ADIRU 1.
The ADIRU, or Air Data Inertial Reference Unit, relays important information to the flight computers about the environment outside the plane.
There are three units onboard the aircraft.
Graham Drummond: This is the unit, ADIRU 1.
Investigators turn their attention to ADIRU 1.
Michael Walker: So that ADIRU obviously became an important part of the puzzle because it was associated with so many faults.
Michael Walker: Whatever caused that episode it has something to do with this box.
We need to collect every speck of data that ran through it.
Investigators need to find all the data they can on how flight 72 was performing during its sudden upset.
They turn to the flight data recorder, where hundreds of parameters are stored.
Michael Walker: Look at this.
I've never seen anything like it.
They spot something highly unusual.
Michael Walker: These are wild angle of attack fluctuations coming from AoA 1.
Angle of Attack, or AoA, is the angle of the plane's wing relative to airflow.
The higher the angle, the less smooth the airflow over the wing.
Neil Campbell: And if the aircraft angle of attack gets too high, then the aircraft can stall.
So it's a very important parameter.
Michael Walker: From over 50 degrees nose up, back to level, then negative 50 degrees.
Graham Drummond: That's not what the pilots described at all.
Captain Sullivan: Have a look for yourself.
It's like the plane had a mind of its own.
Drummond knows that the crew described their plane pitching nose down twice.
They never said it pitched up.
Graham Drummond: What do the elevator readings say? Michael Walker: Ten degrees nose down.
He checks other FDR readings that record the plane's pitch.
That data also confirms what the crew reported.
Michael Walker: Show me the angle of attack again.
Neil Campbell: From the flight data recorder information, we could see that the elevators moved in a nose down direction about ten degrees.
It was an abrupt rate of change.
Michael Walker: The plane did not pitch up.
There's no way this AoA data is correct.
Investigators are convinced the bizarre angle of attack data must be faulty.
It leads them to an intriguing question.
Graham Drummond: What would faulty data like this do to an A330? Michael Walker: I'm not sure.
But I bet it's not good.
Let's go ask Airbus.
Graham Drummond: Once we knew that the ADIRU was outputting spurious data, we had to actually drill down even deeper and really understand what's going on.
Graham Drummond: So if the plane thought it was in a dangerous stall condition, the protections would kick in.
Meeting with an Airbus engineer, investigators learn about the A330's built-in failsafe measures.
Known as protection modes, they prevent pilots from putting their plane into a dangerous attitude.
Kevin Sullivan: The protection modes are there to keep the aircraft in its flight envelope regardless of what the pilot tries to do to exceed that flight envelope.
Graham Drummond: And then the computer would take over and command these two pitch downs.
What would that look like if the plane wasn't pitched up? Investigators discover that on the flight from Singapore, two protections that weren't needed kicked in at the same time.
Second Officer Hales: NAV IR 1 fault.
Captain Sullivan: That's not right.
It seems the computer thought the plane was pitching way up and was dangerously close to stalling.
Captain Sullivan: What the hell is going on? When the stall protection activated, the A330's computer commanded the first protection push the nose down four degrees.
At the same time, an anti pitch-up protection commanded the nose down six degrees.
Graham Drummond: Together, that's ten degrees.
It's the same elevator movement as flight 72.
Graham Drummond: It was established that erroneous angle of attack data had gone into the aircraft flight control computers and triggered angle of attack protections that essentially caused the aircraft to pitch forward.
Establishing a link between faulty data and flight 72's sudden upset is a step forward.
But the mystery of what happened aboard Qantas flight 72 is far from solved.
The grim reality is that buried deep in the software of all A330s is an error that can trick the plane into making a sudden downward pitch.
And now identifying the cause of the glitch Michael Walker: Hello? has become even more urgent.
Michael Walker: Okay.
Thank you.
That was Qantas.
Another A330 just had the same ADIRU failure.
ATSB investigators gather information on another flight that suffered the same systems glitch as Qantas flight 72.
Michael Walker: Well that's a relief.
Thanks for letting us know.
The pilots had heard about flight 72.
When their ADIRU acted up they shut down their computers immediately.
No pitch downs.
Graham Drummond: Have a look at this.
When they search A330 flight records worldwide, they find yet another frightening incident.
Michael Walker: We identified another event with the same ADIRU a couple years beforehand, which was very similar with the ADIRU providing all that nuisance information, nuisance alerts to the flight crew.
Michael Walker: So this has happened three times already.
Michael Walker: Having three events on these ADIRUs was somewhat of a concern.
To what extent could there be more events? How vulnerable potentially was this system? Michael Walker: There's gotta be an explanation for this bad data.
Walker and his team are desperate to uncover the hidden flaw that's putting one of the world's most popular planes at risk.
They dig deep into the digital code sent from the air data unit.
They scan thousands of lines of code.
Graham Drummond: Wait a minute.
Finally, they spot something.
Graham Drummond: That label's not right.
That should be altitude.
Graham Drummond: When the ADIRU passes data to other systems it sends the data and attaches a label to each data message that's sent.
A key turning point in this case was we were seeing data that was sent out as altitude data but being labeled as angle of attack data.
By improperly swapping the two types of data, the ADIRU confused the plane's automated systems with catastrophic results.
Graham Drummond: Now you've got the ADIRU sending data to other systems saying the angle of attack is actually 50 degrees and not what it really was, and those receiving systems were treating it as thought it was valid data.
Investigators now understand why the plane's protection modes kicked in when they weren't needed.
But they still don't understand what caused the data error in the first place.
That's the big question now.
Graham Drummond: The ADIRU is run through a battery of tests.
We tested every input, every output, inspected every component, every sub-component right into the nitty-gritty of the data processing in order to figure out what was going on.
No problems were encountered.
In their search for the answer, they wonder if environmental conditions onboard the aircraft could have caused the unit to malfunction.
They put it through a component stress test.
Graham Drummond: That looks snug.
Let's boot it up.
Graham Drummond: All aircraft equipment is designed to withstand certain what's called environmental conditions, and they're things like temperature and vibration.
They boost the unit's internal temperature by wrapping it in a heat shroud.
Graham Drummond: We subjected the unit to a highly accelerated stress test where it was run under a high CPU load for a long period of time while under a heat shroud, and nothing happened.
The lab tests turn up nothing.
Graham Drummond: We can't find anything physically wrong with the unit that would explain what we saw.
And that was a little frustrating.
With no evidence of any internal malfunction, investigators now question whether factors outside the aircraft could have been at play.
Graham Drummond: So this will beam common frequencies like radio transmissions, wireless signals? Drummond and his team now consider the potential effects of electromagnetic radiation.
Graham Drummond: Electromagnetic radiation can come from a number of sources.
It can come from external sources like radars or radio transmitters, and we can eliminate all those together by doing the same kinds of testing.
We irradiated the units with electromagnetic radiation, and it passed with flying colors.
It's another dead-end.
Investigators are at a loss.
Captain Sullivan: What the hell is going on? They still can't explain the frightening malfunction.
Graham Drummond: All right, let's see where these instances occurred.
Investigators now wonder if some unknown factor on the ground could have caused the dangerous ADIRU failure.
Michael Walker: Isn't it weird that all three events occurred off the coast of Australia? Australian investigators continue their search for the cause of a mysterious and potentially deadly malfunction, one that injured 119 passengers and crew onboard Qantas Flight 72.
Michael Walker: The papers won't stop talking about this communications station.
Graham Drummond: What? This naval base outside Learmonth? Michael Walker: Yeah.
Maybe that's what interfered with the plane.
Graham Drummond: We should run a test.
Michael Walker: Yeah.
With news media speculating about a communications station near Learmonth, the team rolls out the biggest test yet a full-scale flight test of the same Qantas A330 that suffered a near fatal failure.
Graham Drummond: So we took that aircraft and we flew it in that area to see if there was any issues.
There was, um, equipment installed on that aircraft to measure the electromagnetic radiation environment in there.
Graham Drummond: Nothing yet.
Wait a minute.
Take out your cell phones.
Turn them on.
See if it has any effect.
Graham Drummond: And we turned all of our mobile phones on and we tried to make calls and all that sort of thing.
We just wanted to see if any of the equipment would pick up on anything.
And it didn't.
Graham Drummond: Nothing.
The coast is coming up.
The communications tower should be in range.
Graham Drummond: The aircraft took the same flight path as the event aircraft and not only did nothing happen but it wasn't even measurable on the equipment.
Graham Drummond: All right, let's go home.
Michael Walker: It was a little bit frustrating but we basically we came to the end of the road in all the things that we could practically do.
While investigators don't know the root cause of the underlying failure, they understand the chain of events that led to the violent mid-air upset.
Michael Walker: It all starts with bad data.
A mysterious malfunction in one of the plane's three air data units sends faulty data to other systems.
Second Officer Hales: PRIM 3 fault.
Automation: Stall.
Second Officer Hales: Resolved.
Automation: Stall.
Second Officer Hales: NAV IR 1 fault again.
Captain Sullivan: What the hell is going on? Automation: Stall.
The pilots are inundated with warnings when their flight computer gets altitude data that's been improperly labeled as angle of attack data.
The A330's automated protections kick in, commanding a ten-degree pitch down.
Anything not strapped down in the cabin is instantly airborne.
But thanks to the heroic flying of a former Top Gun pilot, the accident does not end in an all-out disaster.
Kevin Sullivan: The automation had failed us, had injured a third of the airplane, injured one of the pilots.
But it's the human factor that worked through it.
Captain Sullivan: Gear down.
Kevin Sullivan: And saved the day.
Captain Sullivan: Flaps three.
Fuzzy Maiava: Kevin deserves a Congressional Medal of Honour.
That guy is amazing.
Kevin is the reason why we're sitting here today to tell the story.
Michael Walker: This was a black swan event, something that had never been seen before, something that no one had ever really expected would happen.
And although we didn't actually find a full explanation, we found enough of an explanation to reduce the risk of this happening again.
The ATSB's investigation helped Airbus engineers make important software changes.
Now, if the same error ever strikes again, it will not result in a violent pitch down.
Neil Campbell: The key thing to remember is the scenario that happened on QF 72 can't happen again with flight control computer software changes.
Kevin Sullivan: As automation technology improves, we still can't guarantee that automation will be infallible.
I feel that the hierarchy still needs to be pilot number one, computer number two.
For Fuzzy Maiava, the biggest lesson is an important safety reminder.
Fuzzy Maiava: Buckle up.
You know, it's simple.
It's just common sense.