Good Weekend
  1. Home
  2. News
  3. Good Weekend
Save
Print
License article

The untold story of QF72: What happens when 'psycho' automation leaves pilots powerless?

For the first time, the captain of the imperilled Qantas Flight 72 reveals his horrific experience of automation's dark side: when one computer "went psycho" and put more than 300 passengers at risk.

Matt O'Sullivan
116 reading now

Returning from the toilet, second officer Ross Hales straps into the right-hand-side seat beside Captain Kevin Sullivan in the Qantas jet's cockpit. "No change," Sullivan tells him in his American accent. He is referring to the Airbus A330-300's autopilot and altitude as it cruises at 37,000 feet above the Indian Ocean on a blue-sky day. 

Within a minute, the plane's autopilot disconnects. It forces Sullivan to take manual control of Qantas Flight 72, carrying 303 passengers and 12 crew from Singapore to Perth. Five seconds later, stall and over-speed warnings begin blaring. St-aaa-ll, st-aaa-ll, they screech. The over-speed warnings are louder, sounding like a fire bell. Ding, ding, ding, ding. Caution messages light up the instrument panel.

Up Next

Police called to wedding brawl

null
Video duration
01:41

More NSW News Videos

null
Video duration
04:40

What happened on flight QF72?
null
Video duration
01:41

Police called to wedding brawl
null
Video duration
01:02

'Davos' of women comes to Sydney
null
Video duration
00:56

Naked, drugged and secluded
null
Video duration
01:56

Police murderer extended sentence bid ...
More videos

What happened on flight QF72?

For the first time, the captain of the imperilled Qantas Flight 72 reveals his horrific experience of automation's dark side.

"That's not right," Sullivan exclaims to Hales, who he met for the first time earlier in the day on a bus taking crew from a Singapore hotel to Changi Airport. His reasoning is simple: how can the plane stall and over-speed at the same time? The aircraft is telling him it is flying at both maximum and minimum speeds. Barely 30 seconds earlier, nothing was untoward. He can see the horizon through the cockpit windows and cross-check instruments to determine that the plane is flying as it should.

"You'd better get Peter back," Sullivan says, urgency in his voice. Minutes earlier, first officer Peter Lipsett, a former Navy Seahawk pilot, left for his scheduled break. Hales picks up the plane's interphone to call the customer service manager to track down the first officer.

In the rear galley, flight attendant Fuzzy Maiava slides his meal into an oven. He can relax slightly after collecting meal trays from passengers. Window blinds are drawn in the cabin, and calm has descended following lunch service. Some passengers queue for toilets. As Maiava closes the oven door, an off-duty Qantas captain and his wife, who have been on holiday, join him in the galley.

"Hey Fuzz, where's your wine?" they ask.

Advertisement

"Just help yourself – you know where it is," Maiava laughs. As they pour a glass, Maiava glances at the oven's timer. There are 13 seconds left.

Booooom. A crashing sound tears through the cabin. In a split second, the galley floor disappears beneath Maiava's feet, momentarily giving him a sense of floating in space. Blood rushes to his head as he, the off-duty captain and his wife are propelled into the ceiling, knocking them out.

In the cockpit, Sullivan instinctively grabs the control stick the moment he feels the plane's nose pitch down violently at 12.42pm (Western Australia time). The former US Navy fighter pilot pulls back on the stick to thwart the jet's rapid descent, bracing himself against an instrument panel shade. Nothing happens. So he lets go. Pulling back on the stick does not halt the plunge. If the plane suddenly returns control, pulling back might worsen their situation by pitching the nose up and causing a dangerous stall.

Within two seconds, the plane dives 150 feet. In a gut-wrenching moment, all the two pilots can see through the cockpit window is the blue of the Indian Ocean. "Is my life going to end here today?" Sullivan asks himself. His heart is thumping. Those on board QF72 are in dire trouble. There are no ejection seats like the combat jets Sullivan flew in the US Navy. He has no control over this plane. 

"It's the worst thing that can happen when you are in an aeroplane – when you are not in control," he recalls. "And you have a choice. You can either succumb to that or you fight it. I was fighting that outcome – and have been ever since."

Eight years after QF72 dived towards the ocean, the Top Gun pilot nicknamed "Sully" since his teens is breaking his silence. "We're in an out-of-control aeroplane, we're all juiced up by our own bodies because, we thought, we are in a near-death situation, and we've got to be rocket scientists to figure out how we can go in there and land the plane outside of any established procedures," he says. 

"We were never given any hint during our conversion course to fly this aeroplane that this could happen. And even, I think, the manufacturer felt this could never happen. It's not their intention to build an aeroplane that is going to go completely haywire and try and kill you."

The events of October 7, 2008, are not merely about how three Qantas pilots found themselves fighting to save a passenger plane from itself. It serves as a cautionary tale as society accelerates towards a world of automation and artificial intelligence. 

The days of driverless cars, trucks and trains becoming commonplace are fast approaching. South Australia ran the country's first on-road trial of driverless cars in 2015. In two years, Sydney will become the first city in Australia to run driverless passenger trains on a new $20 billion metro railway. Proponents tout the multiple benefits of autonomous vehicles, such as the removal of human error dramatically reducing crashes.

In the air, complex computer systems already oversee a new generation of planes, reducing the control of pilots who spend long periods of flights keeping watch. The technology has helped make the world's ever-more crowded skies safer. Yet paradoxically, it is technology that threatened the lives of those on QF72. And Sullivan still harbours fears about greater automation of flying after the computer system on the Airbus aircraft he was captaining wrenched control from its three pilots in 2008.

"Even though these planes are super-safe and they're so easy to fly, when they fail they are presenting pilots with situations that are confusing and potentially outside their realms to recover," he says. "For pilots – to me – it's leading you down the garden path to say, 'You don't need to know how to fly anymore.' You just sit there – until things go wrong."

Seconds after the A330 nosedives, Sullivan begins to receive responses to his control-stick movements. Slowly, it starts to give him control. As it does, he lets the plane continue to descend before gingerly levelling off and climbing back to 37,000 feet. Sullivan knows intuitively there will be serious injuries in the cabin. The plunge is of a magnitude he generated in fighter jets during his days flying from US aircraft carriers in the Persian Gulf and North Atlantic during the Cold War.

Yet this is a passenger plane. In less than a second, the gravitational force bearing on those on board switches from positive 1G to negative 0.8G. As the plane drops, it literally flings into orbit people not belted into their seats. A G-force of 1G allows you to keep your feet on the Earth's surface, while 0G creates weightlessness. Negative 1G will propel you at your body weight into freefall. In all, the Qantas aircraft drops 690 feet in 23 seconds. A saving grace is that Hales, the second officer, presses a button for the seatbelt sign to alert passengers the moment he feels the plane lurch.

The impact of the nosedives dislodged compartment doors, signage and ceiling panels.

The impact of the nosedives dislodged compartment doors, signage and ceiling panels. Photo: Supplied

It is too late for more than 60 passengers and crew, bouncing about like in a pinball machine. Malcolm Yeo is standing near the rear galley, talking with a flight attendant about buying a duty-free watch when he hears the engines reduce power. The then aviation lecturer at Perth's Edith Cowan University assumes the pilots are preparing for clear-air turbulence. It is common at high altitudes and occurs in cloudless skies when air masses collide, causing severe buffeting of planes. Seconds after gazing out a window, Yeo is propelled into the cabin ceiling. The sound of passengers screaming and glass breaking rips through the cabin. Seated in the middle of the cabin, Yeo's wife, Shirley, is worried sick about her husband. She was dozing when he left his seat.

A few metres from Yeo, Maiava lies on the rear-galley floor after hitting the ceiling. On the way down, he hit the galley bench and was thrown against the meal-cart storage. Regaining his senses, Maiava sees blood gushing from the off-duty Qantas captain's head. He lies unconscious on the floor. The captain's wife – also a senior Qantas flight attendant – begins to regain consciousness. 

Beyond the galley curtain, two unaccompanied sisters Maiava has been watching over scream. Fear in her eyes, the youngest reaches a hand out to Maiava. Barely conscious, he cannot do a thing to comfort her. Oxygen masks dangle from the ceiling, swaying from side to side. Baggage and broken bottles litter the cabin floor. 

Suddenly, a passenger from an Indian tour group rushes into the galley in a panic, pointing at an inflated life jacket around his neck. His face is turning blue.

"The guy's choking," Maiava shouts. Maiava knows how to deflate the jacket. But in a semi-conscious state his mind freezes. The off-duty captain's wife thrusts a pen at the passenger, pointing at a nozzle in the life jacket. Thrusting the pen into the nozzle, the passenger deflates his jacket and gasps for breath. Seconds later, he bows in gratitude. Maiava tells him bluntly to get back to his seat.

In the cockpit, over-speed and stall warnings keep ringing in the pilots' ears as the plane recovers to 37,000 feet above the Indian Ocean, about 150 kilometres west of the small Western Australian town of Exmouth. Sullivan and Hales have no idea what caused the plane to dive. The computer system does not tell them. Sullivan hand-flies as they begin responding to fault and warning messages. One of the aircraft's three flight control primary computers – which pilots refer to as PRIMs – is faulty. They begin to reset it by flicking the on-off switch.

Then without warning, the plane dives again. Sullivan pulls back on his control stick like he did in the first pitch down. Again, he lets go. It takes several seconds for the plane to respond to the commands. In little more than 15 seconds, the Qantas jet falls 400 feet.

In the rear galley, Maiava senses the aircraft is about to plunge the moment he hears a roar. It sounds like a speedboat running at full throttle as it is suddenly thrown into reverse. In absolute fear, he locks eyes with the wife of the off-duty Qantas captain. The second nosedive – less than three minutes after the first – propels them towards the ceiling. This time, they avoid hitting it by hanging onto a handrail. Lying on the floor seconds later, Maiava fears they are about to die. He prays death will come quickly and without pain.

"What the hell was that?" second officer Hales exclaims to Sullivan.

"It's the PRIM," the captain replies.

A realisation of their predicament has dawned on Sullivan. The flight control computers – the brains of the plane – are supposed to keep the plane within an "operating envelope": maximum altitude, maximum and minimum G-force, speed and so on. Yet against the pilots' will, the computers are making commands that are imperilling all on board.  

In a conventional aircraft without flight control computers, pilots are responsible for keeping it within the bounds of safe flying. In a passenger jet like the A330, the computers have unfettered control over the horizontal tail – 3000 pounds per square inch of pressure that can be moved at the speed of light. It enables the aircraft to descend or climb. For reasons unknown to the pilots, the computer system has switched on "protections". "The plane is not communicating with me. It's in meltdown. The systems are all vying for attention but they are not telling me anything," Sullivan recalls. "It's high-risk and I don't know what's going to happen."

For a six-year-old, San Diego's North Island is beyond imagination. Perched on a peninsula in San Diego Bay, the naval base is home to aircraft carriers and fighter jet squadrons. On a clear day in 1961, a mass of steel glistens in the sun and American flags flutter in the breeze. John Sullivan, a World War II submariner, has brought his eldest son to see the Blue Angels. The aerial acrobatics of the US Navy's precision flying team leaves a young Kevin Sullivan in awe. "One plane came out of nowhere – about 50 feet [15 metres] over the top of me – and scared the shit out of me," he recalls. "As soon as I saw that, and I saw the power and I heard the noise, what little boy wouldn't want to be in one of those?" 

Eighteen years later, the third-eldest of five children became a US Navy pilot. Within two years, he was flying F-14 jets for the Fighting Aardvarks from the USS America during the Iran hostage crisis. In 1982, his squadron selected him for Top Gun, the Navy's fighter weapon school, made famous by the film of the same name. (His flying "buddies" later featured as extras in the opening scenes of Top Gun filmed on the USS Enterprise). In a matter of a few years, he was living an adventure.

His life took another twist in 1983 when he became the first US Navy exchange pilot to the RAAF. His stay in Australia was meant to last three years. But after marrying an Australian and having a daughter, he decided against returning to the US. He joined Qantas. 

Three decades later, home is Seaforth in Sydney's northern suburbs and his flying career and marriage are behind him. Now in his early sixties, his silver hair has thinned. As much as he can, he wants to retain control over his life. He guards his privacy and that of those close to him. He prefers to meet at Good Weekend's office instead of his home. 

Despite intense interest in QF72 in its aftermath, the identity of Sullivan and the two other pilots has remained largely unknown outside Qantas. I contacted Sullivan almost three years ago to hear his account. He was still flying and declined due to sensitivities within Qantas about him talking. His silence ended last year when he left the airline and he got in touch. Over several months, we meet about five times to talk about the event that upended his life.

His former colleagues have noticed changes. "A lot of people mistake Kev for being Canadian because he is not in-your-face," one pilot says. "He has become much more reserved, and he is much more guarded about what he says. He was much more laid-back and laconic in the past."

In reliving QF72 during our meetings, Sullivan's face reddens and he breathes sharply. For a long time afterwards, he did not want to talk about it. Many passengers and crew still don't. It sits apart from other emergencies because it challenges the notion that technology is near fail-safe and superior to pilots' frailties. 

The fly-by-wire systems of modern airliners are a world away from earlier generations of planes flown using stick and rudder. In the Boeing 747 jumbo – the backbone of global aviation for almost five decades – pilots' control sticks are connected by wires and pulleys to parts of the plane such as the tail. In newer planes, pilots adjust a side-stick to make requests of the flight computer to move. The computer has command over "flight control surfaces" such as the tail or rudder. It sends an electronic signal to move those parts of the plane. A direct mechanical link between most pilots' controls and parts such as wing flaps has been removed.

The intent of the technology is to make flying safer – and it has. In the past decade, the number of commercial flights worldwide has surged by almost a quarter to about 40.5 million last year. Despite the surge in flying, fatalities in accidents involving planes carrying more than 14 passengers have fallen from 773 in 2007 to 258 last year, according to the Aviation Safety Network.

While flying is indeed safer, Sullivan's fear is that greater automation risks confusing pilots in an emergency. Eight months after QF72, an Air France A330 jet carrying 228 people on a flight from Rio de Janeiro to Paris crashed into the Atlantic Ocean, killing all of those on board. Investigators found incorrect speed data was sent to the plane's flight control systems after ice crystals formed on air-pressure probes mounted on the nose. The autopilot disconnected, surprising the pilots and causing them to react to the false information displayed. They incorrectly pulled up the plane's nose, and seconds later it stalled before plunging into the ocean.

After QF72's second dive, the number three flight control primary computer faults again. Sullivan tells second officer Hales they will not touch it. He knows from a previous check of faults that the plane plunged as soon as they reset PRIM three to operational status. A minute later, Sullivan tells the passengers over the PA system they are dealing with flight control problems, and to stay seated and fasten their seatbelts. 

The flight attendants call the pilots on the interphone to find out what is happening. Sullivan is too busy to talk. His priority is to get the first officer, Peter Lipsett, back to the flight deck. Following plane hijackings in the US on September 11, 2001, passengers are banned from entering cockpits in-flight. The crew of QF72 will need to go through a cockpit access procedure – an ordeal that takes several minutes when every second matters. Nursing a broken nose from hitting the cabin ceiling, Lipsett eventually rushes into the cockpit.

"It's carnage out there," he exclaims.

"Sit down, strap in, we're in trouble," Sullivan replies. In more than three decades of flying, Sullivan has never before uttered those words. The then 53-year-old has no idea whether they can safely land the plane. At any second, it could lurch into another dive. The systems are going haywire. Stall and over-speed warnings continue to blare. Most of the caution messages want the pilots to give them priority. The pilots face no end to the distractions as they begin intricate work. The button to silence aural warnings is not working.

Harnessed in his seat, Lipsett asks Sullivan whether he wants to declare a PAN, a warning one step from a mayday. "Yes," he responds. Shortly before the plane dived, they had flown past a RAAF base at Learmonth, near Exmouth on the North West Cape. Learmonth is the diversionary airport for north-west Australia, its runway long enough to handle an A330. 

Knowing passengers are likely to be badly injured, the second officer Hales asks for a damage report from the flight attendants. The response shocks: passengers and crew suffering moderate to severe injuries with broken bones and lacerations.

"That's it – declare a mayday," Sullivan says.

After the A330's first nosedive, items from unsecured meal and drinks trolleys were thrown about the galley.

After the A330's first nosedive, items from unsecured meal and drinks trolleys were thrown about the galley. Photo: Supplied

Lying on the ground near the rear galley, Malcolm Yeo feels his body for breakages. His hip, shoulder and head are sore. Anxious about his wife, he decides to make his way back. The scene that confronts him is distressing. Passengers groan and cry; ceiling panels lie everywhere. Yeo eventually makes it to his seat, where his wife meets him with relief. 

In the rear galley, the wife of the off-duty Qantas captain helps her husband and Maiava as best she can. She calls the flight deck, telling first officer Lipsett that both men are seriously injured. He warns her that the plane could dive again. Maiava is eager to get seated. "We have to move – we have to get to our seats," he says. Together, they shuffle to nearby jump seats.

Minutes later, they hear another announcement over the PA from the captain. Sullivan tells passengers he expects to land within 15 minutes at Learmonth where emergency services will be waiting. They need to stay seated with their seatbelts fastened.

As soon as air-traffic control in Melbourne responds to the mayday, alerts stream to authorities around the country. Planes in northern Western Australia on the same radio frequency hear the distress call, and controllers broadcast QF72's plight to the rest of the country's airspace. With QF72 diverting, Qantas' crisis centre in Sydney is activated while West Australian police and a small medical centre at Exmouth kick into gear. Because of the airfield's remoteness, emergency services need at least 30 minutes to prepare. The services in the area are basic: a fire truck and two ambulances.

Yet Sullivan still does not know whether they can land. The computer system is not telling them what data it is sampling and what it is doing. Thoughts race through the captain's mind: "What is my strategy? How will I stop a pitch down if it happens during landing?" In less than three minutes, the A330 has dived twice. Will it do it again? 

Yet their only real option is landing at Learmonth. Flying on to Perth could worsen matters. "I have nine crew injured out of 12 and mass casualties – that is serious," Sullivan recalls. "It means we're in deep shit." They punch "Learmonth Airport" into the computer used for navigation. The computer shows an error.

"After that second pitch down, I was really furious – I was being put in a position to question my mortality," Sullivan says. "I was cursing like a drunken sailor." As best they can, the pilots have to suppress their physiological reactions. These might help someone lift a car in a life-or-death situation, but they cloud thinking.

Circling Learmonth, the pilots run through a checklist. The plane's two engines are functioning. But they do not know if the landing gear can be lowered or wing flaps extended for landing. And if they can extend the flaps, they have no idea how the plane will react. As much as they can, the pilots try to assert control over the A330 while the computer system operates. It cannot be fully disengaged. Turning off the three flight control computers could trigger unintended consequences. They may fail or fault.

Pulling paper charts out for Learmonth, the pilots make more inputs into the system, to no avail. It means they will have to conduct a visual approach. The precariousness of their situation is laid bare in a lengthy summary of faults on their screens. They include the loss of automatic braking and spoilers to prevent lift once the plane is on the runway. The pilots do not know whether they can use the nose-wheel to steer the plane until it is on the ground.

Sullivan plans to rely on a strategy he practised in fighter jets. Flying at 10,000 feet above the airfield, he intends to reduce power and descend into a high-angle, high-energy spiral before lining up the runway and flying in fast in the hope of preventing another nosedive. 

But before they can land, they have to check whether their flight control system is working properly. Flying over Learmonth, the wing flaps are extended as the pilots conduct two S-turns to confirm they are OK, and the landing gear is lowered. It is enough for Sullivan. He is desperate to get the plane on the ground. The extent of injuries will not be known until emergency services are on board.

The first officer, Peter Lipsett, makes a final announcement, telling passengers to follow instructions. Minutes later, Sullivan lowers the A330's nose, and power to idle as he begins a final approach. Lipsett reminds him the speed is greater than it should be. "Noted," Sullivan replies. None of them know whether it will pitch down again. That is the risk they take. They have little choice.

Fifty minutes after the first dive, the A330's wheels scrape the runway at Learmonth. Passengers clap wildly as it glides along the tarmac. The pilots hear the cheering through the cockpit door, the sense of relief almost overwhelming. 

As the plane grinds to a halt, Sullivan turns to his pilots. "So, a little excitement in an otherwise dull day," he quips, imitating Arnold Schwarzenegger in True Lies. In the US Navy, Sullivan used humour to relax in highly stressed environments. It is to be a rare bit of levity on this day in 2008. Sullivan knows the satellite phone is about to ring incessantly. Before it does, he sends a text to his 20-something daughter travelling in Europe. I'm OK and I love you, it reads.

The pilots cannot allow themselves to relax. Passengers and crew suffering moderate to severe injuries have to be evacuated from an airfield in the middle of nowhere. Despite being parked on the ground, stall and over-speed warnings keep blaring in the cockpit. In a shocked state, the plane's customer service manager rushes in from the cabin.

"What was that?" she exclaims.

"I don't know. I don't know what happened," Sullivan replies.

He grabs her hand, assuring her they are safe. Co-ordinating with emergency services to help the injured now rests on her shoulders. The pilots will be tied up dealing with all manner of questions. The satellite phone is ringing. 

Lipsett begins to check a summary from the plane's maintenance computer. "Well, here's the problem," he says, pulling out a print out half a metre long. It shows 10 simultaneous failures at the same time-mark. Further down the page, they learn the flight control primary computers have failed or faulted. 

"It was basically a computer crash," Sullivan recalls. "It had stopped communicating with us and was distracting us. It started confusing us." After dealing with multiple calls over the satellite phone, Sullivan is finally able to enter the cabin more than an hour after landing. Before him ambulance officers nurse passengers; compartment doors ripped from hinges; smashed bottles, glasses and baggage strewn on the floor. The further along he walks, the greater the destruction and injuries. "It just looked like the Incredible Hulk had gone through there in a rage and ripped the place apart," he recalls. 

Parents hold bandaged children. They stare at Sullivan, some with accusing looks. He tells them he does not know what caused the nosedives, but he and his co-pilots tried to stop them. It's the only assurance he can give. The sight of injured children will stick with him for years.

Rescue and medical workers from the Western Australian town of Exmouth met the flight after its the emergency landing, 50 minutes after the first nosedive.

Rescue and medical workers from the Western Australian town of Exmouth met the flight after the emergency landing, 50 minutes after the first nosedive. Photo: Supplied

The events still haunt Sullivan and Maiava. They have been diagnosed with post-traumatic stress disorder and, with other crew members, remain part of a lawsuit in the US against Airbus and aerospace company Northrop Grumman. (About 100 passengers injured in the mishap have settled compensation claims.) Michael Hyland, an aviation lawyer at Sydney firm LHD who is advising Sullivan, says it has had a devastating impact. "The QF72 incident was a science-fiction nightmare that became a reality," he says. 

Sullivan knew his life and career would change forever. He took eight months off. When he returned, he was hyper-alert and concerned about another potential loss of control. He no longer enjoyed a job that had defined him. His professional attitude meant he would not continue his flying career beyond his ability to do so effectively. He reached that point last year after three decades at Qantas.

"The cards of life, in your poker hand of life, those cards have been taken off the table. I've got some pretty crappy cards now," Sullivan says. Instead of suppressing thoughts of QF72, he believes it better to admit it has affected him and seek help. "I can still play those cards, I have to. Otherwise, as we see with returning defence force personnel, police, first responders, there is the potential for depression, substance abuse or self-harm."

Maiava, a former policeman from Auckland, cherished his job as a flight attendant. It was glamorous; every trip different. "I was going to retire in that job until that happened, and my whole life just turned around," he says. He has not had paid work since and suffers chronic physical and psychological injuries. "I get spasms continuously, every day, non-stop. Those are what trigger the flashbacks, the memories, the nightmares – it just hasn't gone away," he says. He has endured six operations since 2008. "The pain is chronic; the medication I'm on is unreal. I hate it but I have to take it because it's helping me."

It has taken a toll on those closest to him. A father of five children and grandfather to eight, Maiava withdrew from family and friends, holed up in his bedroom staring out the window for hours on end. He reached a low in 2012 when he tried to take his life. He woke from a coma to find his family at his hospital bedside in tears. He now relies on strategies from psychiatrists and psychologists to improve his life, and believes telling his story will aid his recovery. "The QF72 incident has lived inside me every single day, 24/7," he says. "It controlled my life but I intend to get better."

Three years after the near-disaster, the Australian Transport Safety Bureau issues a final report. It finds incorrect data on measures such as airspeed and angle of attack (a critical parameter used to control an aircraft's pitch) was sent by one of the A330's three air-data computers – each of which has its own sensors on the fuselage – to other systems on the plane. One of the three flight control primary computers then reacted to the angle-of-attack data by commanding the plane to nosedive. While finding a "failure mode" affected the air-data unit, investigators cannot pinpoint the exact mechanism that triggered the stream of incorrect data. They reason that the failure mode was "probably initiated by a single, rare type of trigger event". The investigation pored over potential triggers such as a software bug or hardware fault but found them all unlikely.

The report also reveals that a "design limitation" in the flight control primary computer's algorithm failed to handle multiple spikes in the angle-of-attack data. Airbus later rede - signed the algorithm and Northrop Grumman, the manufacturer of the air-data units, made modifications to improve the detection of data transmission failures.

But it fails to bring closure for QF72's captain. The inability to pinpoint the trigger leaves a crucial question unanswered. The air-data unit was taking good information in and pumping out extreme data. "They don't know why it did that. And there is no result," Sullivan says. "Everything that I have done in my life was tested that day. A good pilot makes his own luck but in this case we got lucky."

The roof was damage caused to flight QF72 after a computer malfunction caused 2 uncontrolled nose dives.

Roof damage in the A330's cabin: 'It just looked like the Incredible Hulk had gone through there in a rage and ripped the place apart,' Kevin Sullivan recalls. Photo: Supplied

In the hierarchy on Airbus planes, the computer system sits higher than pilots. Until they printed out the maintenance log after landing, the pilots of QF72 did not know that the A330 had sustained 10 simultaneous failures at the same moment. Instead of alerting them to the failures, the computer system responded on its own to the faults. "That information was hidden from us," Sullivan says. "There was one air-data computer that went rogue. It didn't identify itself to say, 'I'm going psycho.' As a human, I should have a right to veto [the computer's commands]."

Mick Quinn, a former head of safety at Emirates and manager of air-safety investigation at Qantas, says automation has made flying safer but it needs to be remembered that humans lie behind its design. 

"The bottom line is that automation of the computer codes and the algorithms are designed by people, which is what they are actually being designed to protect against," says Quinn, now head of NSW's Office of Transport Safety Investigations. "People make mistakes and that is never going to change. There needs to be more understanding of who is designing these things and what processes are in place." With automation also reducing the time pilots spend hand-flying, "You are going to have less proficient flight crew unless you are addressing it in in-flight training and simulators." 

Qantas says its pilots are trained to fly in all manner of conditions and emergency scenarios, undergoing four recurrent training sessions annually. "Automation can be of assistance in some cases but it should not replace the flying skills, behaviours and role of the pilot," chief pilot Dick Tobiano says. "It's paramount that airlines, aircraft manufacturers and the industry work together to leverage the benefits of automation without becoming too reliant upon the technology."

Airbus says automation has improved safety significantly, giving pilots more support, alerting them to abnormal situations and enabling more precise flying. "Control of the aircraft remains and will remain at all times in the hands of the crew who are the last safety net," a spokesman says. "The Airbus design philosophy is that pilots should be able to take over at all times, as the crew did with QF72."

Yet the ability of the QF72 pilots to regain control was seriously compromised on that spring day in 2008. Automation became their enemy. "It is easy to blame the pilots. With all this automation now, 'Well, it can't be the aeroplane – it must be the pilot,' " Sullivan says. "And in a lot of times it is the pilot, because they're confused. I was certainly confused – we were all confused on that flight. It's a caution sign on the highway of automation to say, 'Hey, can you completely remove the human input?' "