However, the investigation revealed the crew waited because a separate data display revealed its pressurisation system was operating normally, leading them to seek extra information from a manual.

“This, and other distractions, delayed the crew in actioning the required procedural response of donning their oxygen masks and conducting an emergency descent to 10,000 ft,” said ATSB director Stuart Macleod.

The full report reveals how the Qantas-operated A330-202 aircraft was conducting a scheduled passenger service from Sydney to Perth on 4 February 2021 when about 2 hours into the flight while cruising at flight level 400 (about 40,000 ft), the pilots were presented with an excess cabin altitude alert, due to the cabin altitude exceeding 9,550 ft.

“This alert, on the aircraft’s Electronic Centralised Aircraft Monitor (ECAM) flight deck display, required the crew to don their oxygen masks and initiate an emergency descent to 10,000 feet,” said Macleod.

“Donning their oxygen masks immediately in response to the alert would have allowed the crew time to continue to troubleshoot conflicting information while mitigating against any risk of being affected by hypoxia.”

Jet aircraft cabins are typically pressurised to a cabin altitude of less than 10,000ft due to the dangers of hypoxia. The effects of hypoxia are most critical at altitudes above about 20,000 ft, but exposure to altitudes within the 11,000 ft to 20,000 ft range can lead to cognitive impairment.

In this incident, despite the crew being presented with the excess cabin altitude alert, the aircraft’s pressurisation system data display indicated that the pressurisation system was operating normally, leading the flight crew to doubt the validity of the alert.

“As a result, the flight crew sought additional information, including guidance from the Flight Crew Techniques Manual (FCTM),” Macleod noted.

Macleod stated there was no immediate risk of hypoxia for the passengers on board. If the cabin’s pressure altitude exceeded about 14,000 ft, detected by a pressure sensor separate from that used for cabin pressure control, individual masks for each passenger would have deployed.

The A330 is fitted with dual Cabin Pressure Controllers (CPCs) that automatically control the aircraft’s pressurisation, with one CPC controlling pressurisation and the second serving as a backup.

During the incident flight, a fault occurred in the CPC controlling the aircraft’s pressurisation, resulting in the cabin slowly depressurising.

“This loss of pressure was detected by the standby CPC, which triggered the excess cabin altitude alert when the cabin altitude exceeded 9,550 ft.

“However, a known design limitation meant that the controlling CPC was unable to detect a fault with its pressure sensor, resulting in the loss of cabin pressure control and the subsequent increase in cabin altitude. This limitation also resulted in the systems display continuing to present pressurisation data from the CPC in control, which directly conflicted with the alert.”

In response to that known limitation, Airbus required flight crew to action the excess cabin altitude alert irrespective of whether there was confirmatory data.

“However, when faced with conflicting information, and in line with operating philosophies, the crew sought evidence to verify the failure, delaying the donning of oxygen masks and commencing an emergency descent to 10,000 ft.”

Their response was further compounded by uncertainty about the procedural guidance in the FCTM.

About 7 minutes after the alert triggered, the flight crew donned their oxygen masks and commenced a diversion to Adelaide with a precautionary descent to 10,000 ft, the report notes.

Shortly after the descent was initiated, the displayed pressurisation data indicated a sudden increase in the cabin altitude, to which the flight crew responded by immediately commencing an emergency descent.

The aircraft levelled at 10,000 ft and continued to Adelaide without further incident.

“Whenever there is a risk of hypoxia, the flight crew’s priority must be to immediately commence the use of oxygen,” Macleod said.

Airbus had issued a service bulletin that would have corrected the design limitations and prevented the loss of cabin pressure control from the pressure sensor fault. However, this service bulletin had not been incorporated on the incident aircraft and there has been very limited uptake of the service bulletin across the global fleets of affected Airbus aircraft.

“The ATSB encourages Airbus A320, A330 and A340 series aircraft operators to pro-actively incorporate the Airbus service bulletins intended to prevent similar cabin depressurisations from Cabin Pressure Controller pressure sensor faults,” Macleod said.

In addition, Airbus has advised the ATSB that it is evaluating the mitigations currently in place to address the cabin pressure control system design limitations. However, the ATSB has issued a formal safety recommendation to Airbus as its proposed safety action to address the design limitations and a timeline for their implementation have not yet been provided.

Macleod also noted that the investigation highlights the importance of checklists, which are an aid to memory and help ensure that critical items necessary for the safe operation of the aircraft are not overlooked or forgotten.

While the specific Airbus requirement for responding to the ECAM alert was contained within a preamble to the flight crew operations manual abnormal procedure; it was not part of the ‘read and do’ procedural steps in response to the alert, and was reliant on memory recall.

“All essential components of a procedure must be included within that procedure’s checklist.”