A400M probe focuses on impact of accidental data wipe

PARIS - Reuters

A new Airbus A400M military aircraft rolls on the runway, in this picture taken September 30, 2013, after it landed at the Orleans air base. Reuters Photo

A tiny piece of data needed to run the West's largest turboprop engines is at the centre of a complex chain of events under scrutiny following an Airbus  A400M military plane crash last month, several people familiar with the matter said. 

The troop and cargo carrier crashed outside Seville, Spain, on May 9 after three of its huge turboprop engines froze just minutes into a routine, pre-delivery test flight, killing four of its six crew members. 

At the heart of the investigation are crucial computer files that tell Europe's new military carrier, developed at a cost of 20 billion euros ($22.50-billion), how to control its four engines, people familiar with the matter told Reuters. 

Computers operating each engine cannot work if this data, which is unique to each of the turboprops, is missing. 

Investigations are at an early stage but the key scenario being examined is that the data -- known as "torque calibration parameters" -- was accidentally wiped on three engines as the engine software was being installed at Airbus facilities. 

An Airbus spokeswoman said the investigation was continuing and it was too early draw conclusions. 

"Safety is our first priority and we will do all that is necessary to get the full picture of what could have led to this tragic accident and take the necessary action," she said, declining comment on any of the points in this article. 

European NATO buyers have now been instructed not to use the Airbus computer system that was used to conduct the software  installation on the A400M, people familiar with the order said. 

Investigators are poring over maintenance records to see how safety procedures failed to notice the erased parameters. 

But the combination of lost data and incomplete checks may also have exposed a vulnerability in the amount of information provided to the pilots as they prepared for the maiden flight of the plane, which had been sold to Turkey. 

Under the A400M's design, the first warning pilots would receive of the engine data problem would be when the plane was 400 feet (120 metres) in the air, according to a safety document seen by Reuters. On the ground, there is no cockpit alert. 

That system has been in place since the A400M first flew in 2009. It was reviewed last year as the latest engine software was being released, but regulators approved it on the basis that the chances of failure were small and the installation procedure included extra checks, people familiar with the matter said. 

The European Aviation Safety Agency, which is responsible for A400M certification, declined to comment. 

A spokesman for Europrop International, a consortium of Rolls-Royce, Safran, MTU Aero Engines  and ITP, which makes the engine and its control software, referred all questions to Airbus. 

It is not unusual for engineers, facing finite resources, to focus on known risks and manage remote ones by putting extra checks in place, like the ones that appeared to fail the A400M. 

Yet as the pilots took off, another safety feature came into play only to turn against the crew, industry experts said. 

Without the vital data parameters, information from the engines is effectively meaningless to the computers controlling them. The automatic response is to hunker down and prevent what would usually be a single engine problem causing more damage. 

This is what the computers apparently did on the doomed flight, just as they were designed to do. 

"Nobody imagined a problem like this could happen to three  engines," a person familiar with the 12-year-old project said. 

Europe's EASA has since issued an emergency warning of "reduced control of an aeroplane" if two or more engines are affected in this way, people familiar with the action said. 

A spokesman for EASA confirmed it had sent an unpublished directive to A400M buyers, but declined further comment.