Black Swan events – examples from Airbus history
Mr Stéphane Cote
Director of Flight Safety
Accident Investigator
T +33(0)562180231
M +33(0)627819069
stephane.cote@airbus.com
Airbus S.A.S.
1 rond-point Maurice Bellonte
31707 Blagnac Cedex
France
Stéphane Cote is an accident investigator within the Product Safety team of Airbus. As one of the
investigation team, he is an Airbus technical advisor to the Bureau d’Enquête et d’Analyse of
France (BEA) and to international agencies on a number of investigations. His scope of activities
involves any aircraft of the Airbus fleet whatever the nature of the investigation.
Prior to becoming an accident investigator, Stéphane was a senior design office engineer within
Airbus systems engineering, in charge of the development of the A350-XWB Handling Qualities
from the launch of this program up to its certification. Prior to the A350, Stéphane was involved in
the A330/A340 continued product development and A400M initial development. Since joining
Airbus in 2000, he has accumulated over 19 years of experience within flight physics, systems
engineering and product safety domains.
Stéphane was the Airbus technical advisor to the BEA in the investigation of an A319 which
experienced the loss of its right windshield whilst in cruise over China (Himalaya region) on 14th
of May 2018. Such an event is extremely rare in aviation (well outside the realm of usual design
and risks considerations), had severe consequences, and was not predictable, therefore it was
considered as a Black Swan case. Following this incident, Airbus has reviewed the Black Swan
events from its history throughout its fleets.
This technical paper provides a technical summary of these events. It will focus on the lessons
learnt (design, manufacturing, procedures and training) and the product safety enhancements
which were developed post-events.
Page 1 of 6
Black Swan Events
Introduction
What defines a Black Swan event?
Black swan events are characteristically :
- extremely hard-to-predict, or rare
- beyond the realm of normal expectations
In ancient Greece, it was assumed a black swan could not exist …
until it was unexpectedly discovered in the wild much later.
“Houston, we've had a problem...”
The Apollo XIII mission is a typical example of a Black Swan event in the aerospace industry. The
objective of this mission was to land on the Moon, but following an unexpected failure leading to
the loss of the primary oxygen in the Service Module, the mission had to be aborted. Direct return
to Earth was not possible, so the Lunar Module was used as a lifeboat while going around the
Moon. During the investigation into this event, the NASA highlighted the effectiveness of crew
training, especially in conjunction with ground personnel. Many lessons were learnt from this
accident and all Apollo spacecraft were modified to incorporate safety enhancements.
Airbus Black Swan events - some examples
We will now review the Black Swan events which occurred in the Airbus history. For each event,
we will detail the lessons learnt and the product safety enhancements which were developed
subsequently.
Crossed Roll Controls, A320 (2001)
The root cause of this event was that one flight
control computer (ELAC) input wires had been
inverted during maintenance. This resulted in the
Captain’s sidestick to be inverted in roll.
The issue remained undetected during
maintenance and the pre-flight control check.
At take-off the Captain (PF) applied a lateral
sidestick input to the right but the aircraft banked
to the left.
The F/O took over aircraft control promptly,
without the captain’s expressed demand.
Post-event, AMM improvements were introduced regarding flight control system maintenance and
the Flight Control Check procedure was modified.
The main lessons from this event are the importance of a flat cockpit hierarchy, F/O empowerment
and Crew Resource Management (CRM).
Page 2 of 6
Total loss of hydraulics, A300 (2003)
This event was caused by a terrorist act. The
left wing was hit by a missile during the initial
climb (around 8000ft).
This resulted in the loss of all 3 hydraulic
systems in ~20s. Subsequently all flight
controls were lost and slats & flaps were
frozen at their current position.
In addition, a significant amount of the left
wing surface was missing, a fire had started
and the associated fuel tank was emptying.
However, both engines were still running.
The crew managed to learn how to control
the aircraft pitch & roll using thrust only.
The main lessons learnt here are the remarkable airmanship and team working of this flight crew,
who demonstrated that flying with engines only was possible in the current aircraft configuration.
This also showed that on some occasions, you may have to learn as you go, as such situation is
unique and cannot be trained for in advance. Finally, this event highlighted the importance of
learning from previous events, as this crew had knowledge of the Sioux City accident where all
hydraulic systems had also been lost.
Rudder loss, A310 (2005)
During this event, the rudder was lost due
to weakening of its structure (composite
sandwich disbonding leading to reduced
torsional stiffness).
The flight was normal until the cruise,
when sudden vibrations and loud noise
were experienced and dutch-roll
oscillations started.
The dutch-roll decreased and stopped
when descending. On ground, a major
part of the rudder was found missing from
the aircraft.
The product enhancements which were developed following this event focused on reinforcing the
inspections, and enhancing the design of sandwich rudders. Technology and design evolution
(monolithic rudders) were introduced on new programs.
Two important lessons were learnt from this event :
- The importance of flight crew academic knowledge : in this occurrence, the crew knew
from their UPset and Recovery Training (UPRT) that they needed to “slow down and go
down” if faced with dutch-roll in flight
- Regarding the structural aspects : it was determined that rudders needs a health check
inspection program, even when they are designed to be damage tolerant
Page 3 of 6
Emergency water landing, A320 (2009)
This aircraft encountered a flock of birds
after take-off, resulting in multiple bird
strikes impacting both engines, with
subsequent significant loss of thrust on both
engines.
The APU was proactively started by the
crew, which allowed retention of the
NORMAL Law, and thus all the flight
envelope protections.
The landing strategy had to be determined
with limited or no time to prepare.
The flight crew focused on the essential task of flying the aircraft given the emergency. The aircraft
was flown occasionally within the alpha protection range, until an emergency water landing was
performed.
Following this event, a new QRH procedure “EMER LANDING - ALL ENG FAILURE” was
developed, new engine birdstrike certification requirements were issued and an APU auto-start
function was introduced on A350.
The lessons learnt from this event were the following :
- decision making may be time-critical - in this case, due to the proximity with the ground
- the importance (again) of appropriate task-sharing & CRM : the Captain flew the airplane
and the F/O managed the engines
- flight crew knowledge of the systems, as the decision to start the APU ensured that the
flight envelope protections remained available throughout the event
Fuel contamination, A330 (2010)
During descent, approach and landing this
aircraft encountered a loss of thrust control
affecting both engines.
The investigation determined that the root
cause was fuel contamination, which was
traced back to the refuel dispenser (truck).
As a result of the contamination, both
engines’ fuel metering valves were blocked.
The engine 1 remained at ~70% N1, the
engine 2 at sub-idle.
The fuel contaminants were composed of
Super Absorbent Polymer (SAP) combined
with salt and water.
An emergency landing was made (Ground Speed~240 kts, Flaps 1).
After the event, new operational guidance (QRH procedure) was developed to assist flight crews.
Page 4 of 6
At industry level, it confirmed that fuel uplift quality was critical as it may affect several or all
engines, therefore IATA Fuel Working Groups were formed. This resulted, as a lesson learnt, in
the decision to phase out SAP from fuel filters (deadline January 2020).
Uncontained engine disc failure, A380 (2010)
This A380 aircraft experienced an
Intermediate Pressure Turbine (IPT) disc
failure to engine #2 during climb.
The airframe was impacted by disc debris,
resulting in multiple structure and systems
damage.
An In-Flight Turn Back was performed,
during which numerous ECAM alerts had to
be processed.
A safe landing was performed, followed by a
controlled disembarkation.
Several product enhancements were developed following this event :
- IPTOS function : automatic engine shutdown in case of IPT overspeed
- Enhanced engine design and manufacturing process
- ECAM enhancement, equivalent to scroller introduced on A350
- Additional Fuel Shut Off Valves wiring routing precautions on new programs
- OIS optimized landing distance calculation based on actual aircraft capability
In terms of lessons learnt, the investigation confirmed that such event are best managed with
effective work-sharing consistent with the cockpit design, here 2 crew members. The aircraft
proved to be resilient to the uncontained engine failure. It maintained the autopilot and the flight
envelope protections due to the systems redundancies. In addition, the ECAM functioned, even
if operating beyond its design envelope : the Flight Warning System managed to process an
unforeseen high number of failures.
AoA probes blockage, A330 (2012)
This A330 experienced a blockage of all 3
Angle-of-Attack (AoA) probes. They were fitted
with a new configuration known as the conic
plates.
The 3 AoA became blocked during climb
(~FL100). When reaching FL310, the AP
disconnected and the high AoA protection was
unduly triggered, resulting in a commanded
pitch down.
The flight crew switched all 3 ADRs OFF and
stabilized the aircraft at FL300.
A diversion was then performed with the 3
ADRs switched back ON.
Page 5 of 6
As a result of the event, the conic plate configuration was removed. Enhanced AoA monitoring by
the flight control system was introduced and development of new AoA probes was initiated.
In terms of lessons learnt, this event shows the importance of flight crew :
- continuous system monitoring : they detected an unusual characteristic speeds display on
the PFD during the climb, which limited the startle effect at the AP disconnection
- aircraft systems knowledge : they were aware of the systems which use AoA information,
which allowed to take immediate and effective action
Loss of RH windshield in flight, A319 (2018)
40 min after take-off, while in cruise (FL321), the
RH windshield of this A319 separated. An
immediate descent towards a lower altitude was
conducted, followed by a diversion to the nearest
airport (Chengdu, China), where an uneventful
landing was performed.
The first officer and one cabin crew suffered minor
injuries.
An official ICAO Annex 13 investigation, led by the
Civil Aviation Administration of China (CAAC), is
currently on-going on this last event.
An update will be provided in coordination with the CAAC and the BEA.
Conclusion
Black Swan events are part of the aviation industry, and as unpredictable as they are, these
exceptional events will happen in the future.
Industry safety efforts (design precautions, SOPs, crew training, …) have allowed minimizing the
impacts of such events.
When relevant, Airbus will develop Product Enhancements (design, maintenance,
procedures, …) after such events.
To sum up, the main lessons learnt from these events are the following :
- Respecting the golden rules remains applicable
- All trained pilot competencies (education & training) are key and will be needed
- All available resources shall best be used
- Capability to think outside the box may be required, taking the best of the available
procedures
Page 6 of 6
