B777, anomalous flight behavior and partial Loss of Control, off Perth, Western Australia, 3 August 2005

Synopsis Malaysian Airlines Flight 124 experienced control problems while climbing through 36,000 ft altitude en route to Kuala Lumpur from Perth. The aircraft returned to Perth and landed. The FAA has issued emergency Airworthiness Directive AD 2005-18-51, which required operators to replace software. The AD describes the motivation behind the FAA's action as follows:

.... we received a recent report of a significant nose-up pitch event on a Boeing Model 777-200 series airplane while climbing through 36,000 feet altitude. The flight crew disconnected the autopilot and stabilized the airplane, during which time the airplane climbed above 41,000 feet, decelerated to a minimum speed of 158 knots, and activated the stick shaker. A review of the flight data recorder shows there were abrupt and persistent errors in the outputs of the ADIRU. These errors were caused by the OPS using data from faulted (failed) sensors. This problem exists in all software versions after P/N 3470-HNC-100-03, beginning with P/N 3477-HNC-100-04 approved in 1998 and including the versions mandated by AD 2005-10-03. While these versions have been installed on many airplanes before we issued AD 2005-10-03, they had not caused an incident until recently, and the problem was therefore unknown until then. OPS using data from faulted sensors, if not corrected, could result in anomalies of the fly-by-wire primary flight control, autopilot, auto-throttle, pilot display, and auto-brake systems, which could result in high pilot workload, deviation from the intended flight path, and possible loss of control of the airplane.

The Preliminary Report of the Australian Transport Safety Bureau (ATSB) was issued on 16 September 2005. It includes the following description of the incident.

The crew reported that they observed a low airspeed warning on the Engine Indication and Crew Alerting System when climbing through flight level (FL) 380. At the same time, the slip/skid indication deflected to the full right position on the Primary Flight Display (PFD). The PFD speed tape then indicated that the aircraft was approaching the overspeed limit and the stall speed limit simultaneously. The aircraft pitched up and climbed to approximately FL410 and the indicated airspeed decreased from 270 kts to 158 kts. The stall warning and stick shaker devices also activated.

The pilot in command (PIC) disconnected the autopilot and lowered the nose of the aircraft. The autothrottle commanded an increase in thrust which the PIC countered by manually moving the thrust levers to the idle position. The aircraft pitched up again and climbed 2,000 ft. The PIC notified air traffic control (ATC) that they could not maintain altitude and requested a descent and radar assistance. The crew was able to verify with ATC the aircraft speed and altitude.

The PIC reported that the PFD indications appeared normal when descending through FL200. He selected the left autopilot on but the aircraft banked to the right and the nose pitched down so the autopilot was turned off. A similar situation occurred when the right autopilot was selected so the PIC manually flew the aircraft. There were no control difficulties experienced when the aircraft was flown manually, but the autothrottle `arm' switches remained in the `armed' position.

The crew was given radar vectors by ATC to position for an instrument landing system approach onto runway 03 at Perth. When the aircraft was at an altitude of 3,000 ft, and the crew was preparing for the approach, the PFD again indicated a low airspeed condition. The autothrottle system responded to the low airspeed condition by commanding an increase in thrust.

The wind at Perth was gusting from the north-west with moderate turbulence below 3,000 ft. During the approach, the aircraft warning system indicated a windshear condition but the crew continued the approach and landed the aircraft without further incident.

The flight data recorder (FDR), cockpit voice recorder and the air data inertial reference unit (ADIRU) were removed for examination and analysis. The ADIRU was sent to the component manufacturer for examination under the supervision of the United States National Transportation Safety Board.

The FDR data indicated that, at the time of the occurrence, unusual and instantaneous acceleration values were recorded in all three planes of movement. The acceleration values were provided by the ADIRU and were used by the primary flight computer (PFC) during manual and automatic flight. The PFC compared the information from the ADIRU with the information from the Standby Air Data and Attitude Reference Unit (SAARU). During the occurrence, this comparison function reduced the severity of the initial pitching motion of the aircraft.

As a result of the occurrence, the aircraft manufacturer issued a Multi Operators Message on 9 August 2005, recommending to all B777 operators that the aircraft should not be flown with an unserviceable SAARU.

The digital-electrical flight control system of the B777, whose Data Bus was standardised as ARINC 629, was described in the article Design Considerations in Boeing 777 Fly-By-Wire Computers, by Y. C. (Bob) Yeh of Boeing, in the proceedings of the Third IEEE International High-Assurance Systems Engineering Symposium in Washington, D.C., IEEE Press, 1998. A series of slides on the B777 flight control system, Boeing 777, is available from Axel Krings at the University of Idaho.

Thanks to John Sampson for drawing my attention to this incident. John noted it in the Accidents and Incidents Synopsis in Air Safety Week, 8 August 2005.