Airbus is proactively updating software on its A320 aircraft to ensure pilots receive alerts at an appropriate level of priority during periods of multiple alerts and high workload.

The update follows an ATSB investigation into an unreliable airspeed indication and stall warning involving a Virgin Australia Regional Airlines Airbus A320 near Perth Airport on 12 September 2015.

While passing through 8,500 ft, the aircraft’s autothrust and autopilot disconnected and multiple system alerts were generated. The captain took manual control of the aircraft and continued the climb to 20,000 ft, and levelled off to troubleshoot the issues and plan a return to Perth.

On approach to Perth Airport while aligning with the instrument landing system, the stall warning activated. The warning stopped after six seconds and the approach was continued for a successful landing.

The ATSB found the autothrust and autopilot disconnect was the result of erroneous airspeed indications during the take-off and climb due to blocked pitot tubes. The erroneous airspeeds were not detected by the pilots but had been detected by the aircraft’s systems, which had triggered the disconnect and generated multiple alerts including a ‘NAV ADR DISAGREE’ alert.

… it is important that alerts and procedures be designed to ensure that the pilots can correctly diagnose the source of the erroneous information…

This alert requires the pilots to crosscheck the three airspeed indications and assists them in determining if the source of the alert is an airspeed or angle of attack disagreement. However, limited space in the alert message area meant it was initially pushed off the screen for engine-related alerts programmed with a higher priority but in this case not requiring immediate action by the crew.  

The crew’s high workload meant the procedures for these alerts initially were not actioned and they were unable to address the ‘NAV ADR DISAGREE’ alert for about eight minutes, by which time the airspeed discrepancies had corrected themselves.  

The ATSB found this sequencing of alert priorities and the alert’s associated procedure may have led the pilots to incorrectly identify the source of the alert as an angle of attack discrepancy, which the NAV ADR DISAGREE procedure advised had a risk of triggering an undue stall warning.

Combined with the multiple system alerts, which to the flight crew appeared to be unrelated, the flight crew thought the stall warning that activated during the approach was spurious and as such did not apply the stall recovery procedure. Stall warnings are triggered by angle of attack, not airspeed, and there were no indications that the angle of attack system was not functioning correctly.

ATSB Executive Director, Transport Safety, Mr Nat Nagy, said modern aircraft with multiple interacting systems can have many layers between the source information and the pilots. 

“The ATSB’s safety message from this investigation is where there is erroneous information from an information source, it is important that alerts and procedures be designed to ensure that the pilots can correctly diagnose the source of the erroneous information,” Mr Nagy said.

“Further, unless it is absolutely clear that it is erroneous, pilots should appropriately respond to stall warning alerts.”  

Airbus is currently in the process of updating the A320’s software so that the NAV ADR DISAGREE alert has a higher priority than the associated engine alerts. In the case of multiple alerts generated by unreliable airspeed, it will take precedence over the other associated alerts and be immediately visible to the pilots.

In addition, the ‘risk of undue stall warning’ message will be removed from the aircraft status related to the NAV ADR DISAGREE alert.

Read the final report: Unreliable airspeed indication and stall warning involving Airbus A320, VH‑FNP, near Perth, Western Australia, on 12 September 2015

Qantas has incorporated more complex stall warning recovery events in recurrent lesson plans for its Boeing 747 flight crews.

The improvements follow an ATSB investigation into an in-flight upset involving a Boeing 747-438 110 km south-east of Hong Kong International Airport on 7 April 2017.

While descending toward Hong Kong, air traffic control instructed the flight crew to hold at a waypoint. When entering the holding pattern, the aircraft’s aerodynamic stall warning stick shaker activated a number of times and the aircraft experienced multiple oscillations of pitch angle and vertical acceleration.

During the upset, some passengers and cabin crewmembers struck the cabin ceiling and furnishings, sustaining minor injuries.

The ATSB found that while planning for the descent, the flight crew overwrote the flight management computer-provided hold speed. After receiving a higher than expected hold level, the flight crew did not identify the need to re-evaluate the hold speed. This was likely because they were not aware of a need to do so, nor were they aware that there was a higher hold speed requirement above flight level 200.

Prior to entering the hold, the speed reduced below both the selected and minimum manoeuvring speeds. The crew did not identify the low speed as their focus was on other operational matters. The ATSB also found that due to a desire to remain within the holding pattern, and a concern regarding the pitch-up moment of a large engine power increase, the pilot flying attempted to arrest the rate of descent prior to completing the approach to stall actions.

In addition, the pilot monitoring did not identify and call out the incomplete actions. This led to further stall warning stick shaker activations and pilot induced oscillations, which resulted in minor injuries to four cabin crewmembers and two passengers.

The ATSB found the flight crew had limited training and guidance for stall warning recovery techniques at high altitude or with engine power above idle. Inconsistencies were also found in flight crew training of the awareness of the need to re-evaluate holding speed when there are changes in altitude, especially above flight level 200.

“Balancing competing attention or decision demands can interrupt trained flight crew responses leading to procedures not being completed in full, particularly so if flight crews are not receiving comprehensive and regular training in the application of these skills,” ATSB Executive Director Transport Safety Mr Nat Nagy said.

“Comprehensive theory and practical training can ensure that flight crews have a complete understanding of aircraft systems and maintain effective manual handling skills. This training should provide the knowledge to correctly configure the aircraft’s automatic flight systems and manual handling skills to respond adequately to in-flight upsets.”

Subsequent to the incident, Qantas provided retraining for all Boeing 747 flight crews in stall warning recovery scenarios and amended ground school lesson plans to ensure flight crews were adequately prepared to recover from stall warning activations at high altitudes or with engine power above idle.

Qantas also amended flight crew training manuals relating to hold speed selection and updated ground school lesson plans and information to ensure standardised training and holding pattern training.

In addition, Qantas proactively applied these measures across its Boeing 737 and 787 fleets.

Read the final report: In-flight upset involving Boeing 747-438, VH-OJU, 110 km south-east of Hong Kong Airport, on 7 April 2017

The derailment of an empty coal train despite temporary speed restrictions being in place highlights how track defects can deteriorate faster than expected, a new ATSB investigation notes.

The incident occurred at Denman, NSW, as an empty Pacific National coal train was travelling from Kooragang Coal Terminal at Newcastle to Wilpinjong Colliery, near Mudgee. The train consisted of three 90-class locomotives and 92 coal wagons, with a total mass of 2,099 tonnes (not including the locomotives), and a total length of 1,510 m. It had slowed to comply with a 20km/h temporary speed restriction (TSR) put in place a week earlier after a routine track inspection had identified track geometry defects, including a long twist defect

Despite the application of the 20km/h temporary speed restriction, the long twist defect deteriorated faster than anticipated to a point where the left-hand wheels of the lead bogie of the 64^th wagon behind the locomotives mounted the rail. The left hand wheels then tracked across the railhead for 10 m before dropping off the rail. The right hand wheels of the lead bogie also dropped off the rail into the four-foot (area between the rails). As the wheels ran in a derailed state, they impacted the track fastenings and the foot of the rail. A number of rail-welded joints, sleepers and fasteners were damaged by the derailed wheels, while the Up rail suffered a full cross-section break at a weld joint.

Track defects may deteriorate faster than expected.

The rail break also broke the track circuit, which triggered a signal failure.

All the wheels of the lead bogie ran in a derailed state for approximately 690 m before striking the steel road plate of a level crossing and re-railing.

The train crew were unaware of the incident until they were notified by a network controller after a signal electrician, sent to investigate the signal failure, advised of track damage at that location. The train stopped approximately 71 km away from the derailment site.

After the earlier routine hi-rail inspection had identified the track issues, repairs to the defects had been scheduled for the day after the incident occurred. While the temporary speed restrictions had been put in place, issues with drainage and existing formation defects may have caused the long twist defect to deteriorate more quickly than anticipated.

The ATSB’s safety message from this investigation is that track defects may deteriorate faster than expected. Factors that can contribute to rapid deterioration should be considered when developing maintenance responses.

Read the final report: Derailment of freight train WG713, Denman, New South Wales, on 19 January 2016

A reminder that a failure to follow procedure, such as functional checks, can result in unintended consequences.

A lock-out pin not removed after maintenance meant the crew of an Airbus A320 landed at Sydney with reverse thrust inadvertently deactivated. An ATSB investigation found a maintenance team had deviated from procedures, probably due to operational pressure.

Prior to the incident, the aircraft had undergone a three-day maintenance check at a facility in Brisbane. Two days in, the engineers identified that the horizontal stabiliser actuator required replacement, which added a half day of work to the schedule. To recover the lost time, the team was organised to begin work at 0400 the following day. Then the aircraft departure time was brought forward, and the engineers were instructed to complete the maintenance by the end of first shift. Many of the engineers worked through their lunch breaks to ensure they could complete the maintenance on time.

While working under the compressed schedule, engineers deviated from the written procedures, and the incorrect lockout pin was installed and then not removed later. As a result, the aircraft was returned to service with the thrust reverser system inadvertently deactivated.

There was no damage to the aircraft, or injuries as result of the incident.

The safety message from this investigation is that functional checks are the last line of defence in maintenance work. Failure to follow procedures, such as functional checks, can result in unintended consequences. Additionally, it is imperative that aircraft maintenance engineers feel empowered to stop a process when they observe procedural violations or foresee that an error is likely to occur.

Read the final report: Engine thrust reverser malfunction involving Airbus A320, VH-VGZ, Sydney Airport, New South Wales, on 20 September 2018

A livestock carrier's contact with a wharf shows the importance of sharing knowledge. In this case, the harbour master and the pilot were unaware of limitations with fender heights.

The ATSB’s investigation into the contact with wharf by livestock carrier Angus Express at the port of Broome, Western Australia, highlights the challenging situations that marine pilots may encounter, and why it is important that local knowledge is captured and shared.

On 20 April 2018, the Angus Express had just completed a voyage from Singapore, and was expected to load cattle. As the vessel came into berth, the weight of the ship against the forward Yokohama fender forced it to pass under the fender posts, which resulted in the ship’s bow moving towards the wharf. Shortly after, an overhanging scupper protrusion made contact with the fender post.

The pilot thought that the ship had pivoted on the Yokohama fender and instructed the tug to push forward again, resulting in the forward Yokohama fender once again passing underneath the fender posts. The ship’s bow again moved towards the wharf, and the scupper protrusion again made contact with the fender post. The harbour master subsequently attended and found minor damage to the ship’s superstructure.

Marine pilots, in particular, may encounter operational parameters outside normal limits.

The ATSB investigation found that those fender posts were shorter than others in the port, and at certain tide heights, could be forced down by a ship. A former pilot at the port advised that they had been aware of this, but that knowledge had never been documented or shared. 

As a result of this occurrence, the Kimberley Ports Authority has implemented guidelines for berthing and being alongside when using Yokohama-style fenders at times of limiting low water levels. Also, harbour masters and pilots are to conduct risk assessments for circumstances such as tug shortages, vessel manoeuvring issues and tidal levels.

The safety message from the accident is the importance of capturing and sharing lessons learned from experience. Marine pilots, in particular, may encounter operational parameters outside normal limits. Capturing the lessons through proper reporting process and sharing information through training and awareness can help to reduce risk and avoid future occurrences.

The challenges surrounding marine pilotage is one of the ATSB’s SafetyWatch priorities. Visit our website for important safety messages and advice.

Read the final report: Contact with wharf by livestock carrier Angus Express, at Broome, Western Australia, on 20 April 2018

The forced landing of a Cessna 172 into scrubland south-west of Kalgoorlie Airport, Western Australia, following fuel exhaustion again highlights the need for continued pilot education on the risks and controls associated with fuel management.

The Cessna 172M, registration VH-TUX, had been tasked to conduct fire-spotting operations in the Lake Johnstone area near Kalgoorlie on 5 January 2018. During the flight, the engine speed began to steadily reduce toward idle. The pilot switched between fuel tanks and adjusted the mixture and throttle settings. This resulted in the engine speed momentarily increasing before returning to idle.

Preparing for a forced landing on a dirt road, the pilot realised the aircraft’s glide range would be insufficient and identified an area of less dense scrub and landed the aircraft with minimal damage.

The pilot’s flying instructor experience instructing student pilots on the procedures for an engine restart and practice forced landings likely aided in managing workload during the emergency and led to the successful forced landing.

The investigation found the pilot’s in-flight fuel management resulted in insufficient endurance to safely conduct the planned flight and the aircraft exhausting its useable fuel supply.

Fuel starvation and exhaustion events continue to be reported to the ATSB

The aircraft had recently been refitted with wings sourced from another Cessna 172M. The replacement wings were fitted with smaller capacity tanks of 144 litres, compared to the previous 182 litres. Despite a number of opportunities to identify the change to the aircraft’s endurance, the pilot, who had flown VH-TUX on numerous occasions prior to its fitment of new wings, did not detect the reduced fuel capacity. 

During the accident fight, the pilot observed a steady decrease in the indications on the fuel gauge, but the pilot discounted the accuracy of the indications. The pilot’s in-flight fuel management was likely based on the expectation of the aircraft’s endurance, rather than crosschecking the expected fuel burn against the fuel burn achieved during flight at the 30-minute intervals required under the operator’s standard operating procedures.

Further, the pilot’s pre-flight planning was inconsistent with both the regulatory requirements for flight planning and preparation, and the operator’s own electronic flight bag administration and in-flight fuel management procedures.

Fuel starvation and exhaustion events continue to be reported to the ATSB. The ATSB’s safety message from this investigation the importance for pilots to continue to educate themselves on the risks and controls associated with fuel management.

Methods for cross-checking fuel on board before flight are published by the Civil Aviation Safety Authority in Civil Aviation Advisory Publication 234-1(2): Guidelines for aircraft fuel requirements(Opens in a new tab/window).

Case studies for pilots to learn about fuel management related accidents have been published by the ATSB in Avoidable Accidents No. 5 – Starved and exhausted: Fuel management aviation accidents.

Read the final report: Fuel exhaustion involving Cessna 172M, VH-TUX, 72 km south of Kalgoorlie-Boulder Airport, Western Australia, on 5 January 2018

A Cessna 172 was flying from Queensland to New South Wales when it entered an area of reduced visibility, including low cloud, fog and drizzle. The aircraft diverted off the initial track and was last seen disappearing into cloud heading inland. A short time later, the aircraft collided with terrain and the pilot was fatally injured.

The ATSB found that the decision to depart on the flight had placed the pilot at risk of encountering conditions of reduced visibility. On entering those conditions, the pilot likely became spatially disoriented, resulting in a loss of control and a collision with terrain. The ATSB also found that the pilot was likely under some degree of self-imposed pressure to continue with the flight, despite the inclement weather conditions.

Weather-related accidents remain one of the most significant causes of fatal accidents in general aviation.

“The ATSB’s safety messages from this investigation are clear: visual flight rules pilots should conduct thorough pre-flight planning to avoid the possibility of flying into bad weather. They should also make alternate plans in case weather deteriorates, and make timely decisions about diverting or turning back,” said ATSB Executive Director Transport Safety Mr Nat Nagy.

“If visual flight rules pilots do find themselves in deteriorating weather and become disoriented or lost, they should seek whatever help is available including contacting air traffic control. This simple action has averted potential disaster in many instances.”

Weather-related accidents remain one of the most significant causes of fatal accidents in general aviation. Inflight decision-making is one of the ATSB’s SafetyWatch priorities, particularly regarding pilots flying with reduced visual reference.

Among the advice that SafetyWatch provides, the use of ‘personal minimums’ checklists is key. VFR pilots should use a checklist to help control and manage flight risks by identifying risk factors that include marginal weather conditions and only fly in environments that do not exceed their capabilities.

This report highlights an ongoing safety issue in aviation. Check out our SafetyWatch page, Inflight decision making, for more information on this important subject.

Read the final report: VFR into IMC and loss of control involving Cessna 172, VH-FYN, 13 km north-north-west of Ballina, New South Wales, on 16 June 2017

Multiple factors combined to result in an incident in which a container on a freight train collided with station infrastructure.

The ATSB’s investigation into the incident yielded important safety messages for rail infrastructure managers and maintainers, rail operators, and rail safety workers involved in the loading and examination of train services.

The incident occurred on 16 January 2018, as freight train 2BM9 passed through Maitland Railway Station at approximately 0748. The trailing edge of one of the containers on the train collided with the verandah gutter mounting brackets on Platform 1. Two lengths of the verandah gutter dropped to the surface of the platform. Although there were some people on the platform at the time, no one was in the immediate area of the collision, and no injuries were reported. 

The ATSB investigation found that, while the track owner had scheduled and undertaken clearance inspections at Maitland, these inspections had not detected that the increase in track height over time had reduced the available clearance and infringed on both the design measurements and track owner’s clearance specifications.

In addition to the increase in track height and clearance reduction, a loading irregularity on the train also existed at the time of the collision, where the container was not correctly secured to its wagon.

Ensure that processes and requirements are documented, understood, and adhered to.

The investigation found that the train operator had not documented its process for loading checks expected from the loading operations staff when securing containers to wagons.

The ATSB found these two elements combined to result in the collision between the freight train container and the verandah guttering at the Station.

This incident shows the importance of ensuring that processes and requirements are documented, understood, and adhered to.

Both the train operator and the rail infrastructure manager have taken proactive safety action to address the issues and reduce the likelihood of a recurrence.

Read the final report: Loading irregularity on train 2BM9, Maitland, New South Wales, on 16 January 2018