AAIB Bulletin: G-DBCF AAIB-27579

SERIOUS INCIDENT

Aircraft Type and Registration: Airbus A319-131, G-DBCF

No & Type of Engines: 2 International Aero Engine V2522-A5 turbofan

engines

Year of Manufacture: 2005 (Serial no: 2466)

Date & Time (UTC): 6 August 2021 at 0935 hrs

Location: During climb from Edinburgh Airport

Type of Flight: Commercial Air Transport (Passenger)

Persons on Board: Crew - 5 Passengers - 101

Injuries: Crew - None Passengers - None

Nature of Damage: No damage

Commander’s Licence: Airline Transport Pilot’s Licence

Commander’s Age: 55 years

Commander’s Flying Experience: 16,651 hours (of which 4,476 were on type)
Last 90 days - 43 hours
Last 28 days - 26 hours

Information Source: AAIB Field Investigation

Synopsis

During a flight from Edinburgh Airport to London Heathrow the autopilot and autothrust
disconnected. After several minutes the flight crew were able to re-engage them but they
disconnected again during the approach. The aircraft landed safely.

The autopilot and autothrust disconnects were caused by severe drift of the aircraft’s Inertial
Reference System due to vertical shock loads transferred into the system during the takeoff
roll. The source of the shock loading was an uneven repair patch on the runway. The nose
landing gear shock absorber was found to be over extended, leading to transfer of vertical
shock forces into the airframe.

The aircraft manufacturer had investigated previous similar events and published guidance
to maintenance organisations but had not published information to flight crew.

History of the flight

The aircraft was scheduled to operate from Edinburgh Airport to London Heathrow Airport.
The aircraft departed Edinburgh at 0907 hrs and took off from Runway 06 at 0918 hrs with
the commander as pilot flying. The commander described the takeoff as “normal except
for a loud bang created by passing over, what felt like, a centreline light on the takeoff roll”.
During the initial climb, passing approximately 1,500 ft, the co-pilot saw a gps primary

© Crown copyright 2022 1 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

lost message on his MCDU1, but the message disappeared before the crew could take
any action.

The rest of the climb was normal until the aircraft reached FL340 when the co-pilot saw
a check irs 3/fm position message on his MCDU. Shortly after this the autopilot and
autothrust disconnected and the flight directors were no longer displayed. The Electronic
Centralized Aircraft Monitoring (ECAM) showed auto flt ap off, auto flt a thr off and
eng thrust lock messages, the Flight Mode Annunciator was blank and the status showed
cat 3 dual inop.

The commander manually levelled the aircraft at FL350. The crew were concerned they
could no longer comply with RVSM2 requirements as the autopilot had failed, so the co-pilot
made a PAN call to ATC. There were no other ECAM messages, warning lights or other
indications on the flight deck to explain what had happened. The co-pilot confirmed that
none of the flight deck circuit breakers had tripped. Initial attempts to restore the autopilot
and autothrust were unsuccessful but, after approximately 5 minutes of manual flight, they
were able to re-engage them.

The crew conducted a diagnosis, review, and decision-making process to decide how to
proceed. As they attempted to diagnose the problem, they noticed that the Inertial Reference
System (IRS) positions shown on the MCDU position monitor page were abnormal. At one
point the positions were showing as IRS 1 NAV ‘- -’, IRS 2 NAV ‘31.0’, IRS 3 NAV ‘31.0’,3
but they were all changing over time with all three showing either ‘- -’, greater than 30,
or something sensible at different times. Normally, the difference between the three IRS
readings would be less than 1 nm. Due to the uncertainty over their position the crew asked
ATC for radar vectors but decided they could safely continue to Heathrow. They considered
realigning the IRS in flight but, as there were no ECAM messages directing them to do this,
they decided not to4. They also considered that the aircraft was currently in a safe state and
thought that attempting a realign could make the situation worse.

The aircraft continued to Heathrow. The crew briefed for the approach and discussed the
expected indications at each stage so they would detect any further instrumentation failures.
They requested an extended final approach to make it easier to monitor the aircraft. The
approach proceeded normally with the autopilot engaged until approximately 4,000 ft when
the aircraft was on an intercept heading for the Runway 27R localiser. At this point the
autopilot and autothrust disconnected again and flight directors were no longer displayed.
The crew discontinued the approach and re-briefed for a manually flown raw data approach.
The subsequent manually flown approach was uneventful and the aircraft landed normally
with no further abnormal indications.
Footnote
1
MCDU (Multipurpose Control and Display Unit) is the keyboard and screen used by the flight crew to interact
with the flight management computer.
2
RVSM (Reduced Vertical Separation Minima) allows aircraft to operate with reduced vertical separation.
Among other requirements, the rules require a functional autopilot capable of holding altitude.
3
The numbers show the difference between each IRS position and the flight management systems calculated
position (in nautical miles).
4
The aircraft manufacturer commented that “IRS alignments are not allowed while the aircraft is in flight. In
case of realignment of more than one IR the A/P and A/THR will be lost and a reversion of the F/CTL law
to alternate or direct will occur. In the aircraft operational documentation (FCOM/FCTM/QRH), there is no
procedure that requests the flight crew to re-align, in flight, the IRS in NAV mode.”

© Crown copyright 2022 2 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

Recorded information

The operator provided flight data from the Quick Access Recorder (QAR) for the incident.
However, the CVR was overwritten as the aircraft remained in service for five days before
the AAIB was notified of the event.

The QAR data confirmed that, as the aircraft accelerated through 120 kt on the takeoff roll
and without any significant flying control inputs, the weight-on-wheels signal for the nose
landing gear (NLG) changed state three times within two seconds, indicative of having
encountered irregularities in the runway’s surface.

A post-flight report showed that, after encountering the runway surface irregularities, the
IRS positions began to drift resulting in the autoflight system rejecting the input from one of
the ADIRUs5 at 0928 hrs, as the aircraft climbed through FL265. This, and another minor
degradation caused by the increasing drift that affected the aircraft’s braking system, were
not annunciated to the crew. However, at 0932 hrs, as the aircraft neared the top of climb,
the autoflight system rejected all three IRS positions causing the autopilot and autothrust
to disconnect. The recorded data also confirmed that, although the IRS positions were
affected, the ADIRUs continued to provide valid attitude and air data parameters.

The manufacturer’s analysis of the data showed that at 0936 hrs, and again at 0941 hrs,
a nav fm/gps pos disagree ECAM message was displayed for approximately 7 seconds.
This indicated a disagreement in position information between the Flight Management
and Guidance Computer (FMGC) position and GPS position but the data then showed an
improvement in the FMGC positions. Position information from each ADIRU then remained
consistent until 1006 hrs when it once again deteriorated. At 1015 hrs, as the aircraft was
on approach to Heathrow descending through 5,100 ft amsl, the autoflight system rejected
data from more than one ADIRU, which resulted in the disconnection of the autopilot and
autothrust.

Previous history

The operator had experienced five previous similar incidents on their Airbus A320 fleet
(G-EUPY 6 August 2020, G-EUPN 1 July 2020, G-EUUV 4 October 2019, G-EUXD
11 August 2018 and G-EUUH 1 September 2017). The manufacturer reported that
another operator, operating elsewhere, had also reported several similar incidents. The
manufacturer’s investigation showed that all these incidents occurred on aircraft fitted with
Northrop Grumman Corporation (NGC) ADIRUs standard-0316/318. NGC ADIRUs have
not been fitted to new aircraft since 2015, and there were 1,459 aircraft in service fitted with
these units (approximately 14% of the A320 fleet).

To investigate the issues the manufacturer installed accelerometers on the NLG and the
ADIRU mounting rack on several aircraft to measure the vertical forces through the NLG
during taxi, takeoff, and landing. The ADIRU rejections and drift were found to be induced
by abnormal levels of vibration or shock loads transmitted through the NLG to the ADIRU
during the takeoff roll and rotation. The manufacturer concluded that the IRS drifts were
Footnote
5
ADIRU - Air Data and Inertial Reference Unit – the system is described in detail later in this report

© Crown copyright 2022 3 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

likely to have been caused by a combination of specific inputs: vertical loads from the
runway surface to the NLG, incorrect servicing of the NLG shock absorber and the ADIRUs,
suffering vertical shocks when operating outside their qualification envelope.

In April 2020 the manufacturer issued a Technical Follow Up (TFU) notice titled ‘In-flight
severe IR drift with ADIRU NGC PN 465020-030x-0316/318 inducing possible loss of AP/
FD and ATHR’ to inform operators’ maintenance teams of the potential for severe drift issues
and the procedure for investigating occurrences.

Aircraft examination

After landing, a maintenance team met the aircraft and conducted an inspection and
service of the NLG in accordance with Troubleshooting Manual (TSM) 32-20-00-810-802 -
‘Vibrations felt on the NLG during Takeoff and Lift-off Phases’ as recommended in the TFU.
The team focussed on the TSM subtasks related to the NLG shock absorber which was
found to be overextended by 0.6 inches.

Air data and inertial reference system (ADIRS)

System operation

The ADIRS provides anemometric, barometric, temperature and inertial parameters to the
flight deck instruments and other systems. The ADIRS includes three identical ADIRUs each
of which combines an Air Data Reference (ADR) and an IRS into a single unit. Although
combined within a single unit, both the ADR and IRS can operate independently in case
of failure of the other. The ADR uses the pitot-static, angle of attack and temperature
sensors to provide parameters such as barometric altitude, Mach number, airspeed, outside
air temperature, angle of attack and overspeed warning data to the aircraft systems.
The Inertial Reference (IR) consists of gyroscopes and accelerometers which provide
acceleration information along three axis, longitudinal, lateral, and vertical. During flight,
acceleration data along each axis is resolved to provide navigation information such as
aircraft track, acceleration, flight path vector, ground speed and aircraft position. The IR
gyroscopes provide angular rates, heading and aircraft attitude data. The three ADIRUs
fitted to G-DBCF each supplied data for the FMGC and the Flight Augmentation Computer
(FAC), (Figure 1).

Once the ADIRU data is processed by the FMGC, the calculated parameters are used by
the Flight Management (FM) and Flight Guidance (FG) systems. The FM system provides
navigation and management of navigation radios, management of flight planning, prediction
and optimisation of performance and display management. The FG system provides
autopilot, flight director and autothrust commands.

Information processed by the FAC controls the rudder, rudder trim and yaw damper inputs.
The FAC also computes flight envelope data and speed functions.

The processed outputs of each ADIRU are supplied to the commander, co-pilot and back-up
cockpit displays.

© Crown copyright 2022 4 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

Figure11
Figure
ADIRUdata
ADIRU dataoutputs,
outputs,and
andFMGC
FMGCand
andFAC
FACconnectivity
connectivity

IRS faults

The accuracy of the output parameters of the three IRs are compared and monitored by
the FMGC and FAC to detect errors. Should a parameter from one IR exceed a given error
threshold, it is rejected. Table 1 shows the result of IR rejections by the FMGC and FAC,
the subsequent error messages displayed and, if more than one IR rejected, the systems
which are lost6.

Table 1
Consequences of IR rejection by FMGC and FAC

Footnote
6
AP (Autopilot), FD (Flight Director), A/THR or ATHR (Autothrust), SPD LIM (Speed Limiter), YD (Yaw
Damper), RTL (Rudder Travel Limiter), AFS (Automatic Flight System).

© Crown copyright 2022 5 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

Severe IR drift
When an IR is affected by severe drift, the IR is rejected by the AFS and an alert message is
triggered. The level of positional drift experienced can be observed on the MCDU and gives
the pilot an indication of which IRs are drifting and how far. During these fault conditions,
aircraft position, ground speed (GS) and drift angle (DA), can go out of tolerance causing
a nav ir 1(2)(3) fault to be generated, usually during final approach and landing. If the DA
exceeds 90°, the IR will be classified as failed and an ECAM warning of nav irs 1(2)(3) fault
generated. During flight, the aircraft’s navigated position is compared with its GPS position
and will generate gps primary lost and nav fm/gps pos disagree messages under
severe drift conditions. When GS from the IRs exceeds threshold values, the aircraft’s
automatic braking system also reverts to manual braking.

ADIRU installation and transmitted shock loads

The aircraft’s three ADIRUs were fitted to an avionics rack located immediately aft and
above the NLG bay (Figure 2). There was no anti-vibration mounting for the rack or the
ADIRUs, so any vertical shock transmitted through the NLG would be transferred to the
airframe and avionics rack.

As the NLG incorporates a shock absorber, when operating within its normal operating
limits of travel a significant proportion of the vertical forces experienced by the NLG when
traversing along runways, landing and taking-off are absorbed and dissipated. Only a
fraction of this force is transferred to the airframe. When the NLG shock absorber is over
or under extended, less energy can be dissipated and the proportion of forces transferred
to the airframe is increased.

During takeoff from Edinburgh, the aircraft experienced a sharp vertical jolt and the NLG
weight-on-wheels proximity sensors toggled on and off as the wheels crossed an uneven
patch of the runway surface.

Avionics bay

NLG bay
ADIRUs

Figure 2
Figure 2
ADIRUs location
ADIRUs location
© Crown copyright 2022 6 All times are UTC
AAIB Bulletin: G-DBCF AAIB-27579

ADIRU environmental qualification

During aircraft development, the ADIRU was qualified in accordance with the
environmental qualification requirements detailed in the Radio Technical Commission for
Aeronautics (RTCA) DO-160C. This contains 23 environmental test procedures including
Section 7 – ‘Operational shocks and crash safety’7 which states:

‘The operational shock test verifies that the equipment will continue to function
within performance standards after exposure to shocks experienced during
normal aircraft operations.

These shocks may occur during taxiing, landing or when the aircraft encounters
sudden gusts in-flight. This test applies to all equipment installed on fixed-wing
aircraft and helicopters. Two operational shock test curves are provided: A
standard 11 ms pulse and a low frequency 20 ms pulse. The 20 ms pulse may
not be adequate to test against the effect of longer duration shocks on equipment
that have its lowest resonance frequency (as per section 8 – ‘Vibration’) below
100 Hz. For such equipment, a pulse of 100 ms duration should be considered.’

Section 7 was further divided into categories (Cat) A to D. Cat A contains tests for standard
operational shocks (using shock test curves) and Cat B adds crash safety8 to Cat A. Cat C
tests for resistance to low frequency shocks and Cat D added crash safety to Cat C. Shock
testing is performed by strapping a piece of equipment to a shock table and measuring
shock pulses using an accelerometer.

The aircraft manufacturer stated that it was exploring how to enhance ADIRU qualification
procedures to be more robust to abnormal conditions such as those encountered by
G-DBCF.

NLG shock absorber

Design of the NLG shock absorber

The NLG shock absorber is an oleo-pneumatic telescopic strut arrangement with no

separator piston, (Figure 3), that uses a chamber filled with compressed nitrogen gas to act
as a spring to absorb the shock of aircraft landing gear vertical forces.

It also has a second chamber filled with hydraulic oil that provides damping to reduce
the harmonic effect of the spring. The combination of the nitrogen spring and oil damper
provides efficient shock absorption and is a common feature in large aircraft landing
gears.

Footnote
7
https://do160.org/operational-shocks-and-crash-safety/ [accessed 28 January 2022].
8
Crash safety describes tests to determine that equipment does not detach from its mountings or pose a
hazard to occupants, fuel systems or emergency evacuation equipment during an emergency landing.

© Crown copyright 2022 7 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

Figure 3
Figure 3
NLG diagram showing shock absorber cylinder
NLG diagram showing shock absorber cylinder

Shock absorption efficiency relies upon the balance of oil and nitrogen to ensure the shock
absorber deflects within a specific range to maintain absorption efficiency. If the balance
of either substance is incorrect, the shock absorber will not be able to absorb and dissipate
vertical forces effectively. The result is an increase in vertical shock loads transferred to the
airframe.

Servicing the NLG shock absorber

Several instances of incorrect NLG servicing had previously been reported to the
manufacturer by more than one operator, indicating a potentially problematic maintenance
procedure. Consequently, in 2010, the aircraft manufacturer revised the servicing task
in the Aircraft Maintenance Manual and introduced a modified maintenance check of the
NLG shock absorber every 24 months or 5,000 flight cycles. Should an abnormal NLG
vibration event occur, a maintenance check of the assembly and possible servicing would
be required. It stated that a dedicated automatic Liquid and Nitrogen Charge Equipment
(LANCE) is being developed to avoid the need to jack-up the aircraft and to reduce the
potential for incorrect servicing of the landing gear.

© Crown copyright 2022 8 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

The aircraft manufacturer stated that, in the case of one of the operators who reported severe
IR drift issues, the introduction of the improved servicing task and revised maintenance
check of the NLG shock absorber had been effective in preventing the IR drift associated
with the NGC ADIRU Standard-0316/318.

Airfield information

This incident and several previous events occurred after takeoff from Edinburgh Airport.
The investigation therefore considered if there was anything unusual about the runway at
Edinburgh which may have triggered these events. The operator identified the region of the
runway where the abnormal vertical acceleration occurred and provided this to the airport
authority. Following a detailed inspection of the runway in this area, a slightly uneven patch
repair was found which was thought to be the cause. When the repair was driven over
at speed, it caused a distinct jolt. The airport authority replaced the repair patch during
scheduled runway maintenance in early 2022.

Information available to flight crew

At the time this incident occurred no specific information was published for flight crew
describing the previous events or how to manage this type of event. Depending how the IR
drift develops, some ECAM messages can be generated and the associated checklist can
give the flight crew helpful instruction. However, on many occasions no ECAM messages
are generated (other than those associated with the autopilot and autothrust disconnect).

During this event the data suggests that a nav fm/gps pos disagree ECAM message
was generated but was only displayed for a few seconds. The message is accompanied
by an aural alert (single chime) and a Master caution light, but the message does not
latch and when the conditions of FM/GPS position disagreement are no longer reached,
the ECAM message will be removed. The flight crew did not report seeing it, so it is
likely their attention was not drawn to the ECAM during the few seconds the message
was displayed.

The aircraft manufacturer commented that, as demonstrated by this crew, IR drifts can
be successful managed by the process it termed ‘fly, navigate, communicate’, and that
no specific additional actions are required. The manufacturer considered publishing
information to all flight crews about IR drift events, but was concerned that flight crews
might then associate any gps primary lost message or AP and A/THR loss with a drift
of the IRS. It therefore concluded that such communication would be detrimental.

Following this incident, the operator published an article in its company safety magazine
describing this and a previous similar incident.

Analysis

The aircraft suffered multiple severe IR drift events in flight which caused the autopilot and
autothrust to disconnect. The events were successfully managed by the flight crew and the
aircraft continued to its planned destination.

© Crown copyright 2022 9 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

The incident was caused by a chain of events, each of which was necessary to cause the
eventual outcome:

1. A slight irregularity in the runway surface induced sudden vertical shock

loads into the NLG.

2. An over extended NLG shock absorber reduced its absorption effectiveness,

creating an increase in the vertical forces transferred to the airframe and
avionics rack housing the ADIRUs.

3. The NGC ADIRUs fitted to this aircraft (fitted to approximately 14% of

the fleet) were sensitive to vertical acceleration forces outside their
environmental qualification envelope which induced severe drift.

Runway surface

Following these events, the airport authority found a slightly uneven runway surface patch
repair which they believe may have caused the problem. It has now replaced the repair
patch.

Nose landing gear leg servicing

Information provided by one of the operators indicated that the improved servicing task and
revised maintenance check introduced by the manufacturer was effective in preventing their
IR drift issues. However, further occurrences with other operators indicates that the issue
has not been completely resolved. The development of a dedicated LANCE to improve
the servicing of the NLG shock absorber is intended to reduce potential errors during
maintenance activity.

NGC ADIRU

All three of the ADIRUs were tested after the event and no faults were found. During
the occurrences, the air data information remained accurate throughout the flight, ruling
out ADR faults. The pilots reported that aircraft attitude displays also remained accurate
indicating that the IRS gyroscopes were functioning correctly. The severe positional drift
experienced was probably caused by IRS accelerometer anomalies from abnormal vertical
shock loads transferred to the airframe and avionics rack.

Whilst the NGC ADIRUs performed within their qualification envelope, the shock loads
encountered during operation occurred outside their Cat B qualification standard. The
aircraft manufacturer commented that in hindsight, the inclusion of Cat C environmental
qualification criteria during aircraft design may have avoided these severe position drift
issues.

Information to flight crew

When this event occurred, no specific information was available to flight crews describing
the possibility of multiple IR drifts, the possible indications or how to manage the situation.
The aircraft manufacturer decided that publishing such information would be detrimental.

© Crown copyright 2022 10 All times are UTC

AAIB Bulletin: G-DBCF AAIB-27579

Conclusion

The aircraft experienced severe navigation position drift in flight. The drift was caused
by abnormal vertical shock loads being transferred through the overextended NLG shock
absorber to the ADIRU. The abnormal shock loads were initiated by an uneven patch repair
on the runway. The NGC ADIRU is particularly sensitive to sudden vertical shock loading
outside its environmental qualification envelope.

Published: 16 June 2022.

© Crown copyright 2022 11 All times are UTC