The ATSB investigation into a serious incident at Melbourne Airport, Victoria has demonstrated the requirements and complexities that come with the use of automatic flight systems. While modern automation can greatly reduce flight crew workload, crews still need to maintain a thorough understanding of those systems. 

The incident occurred on 24 July 2011 when, at 2019 EST, a Thai Airways Boeing 777-3D7 aircraft was conducting a runway approach to Melbourne Airport after a flight from Bangkok. The approach was being made using very high frequency omnidirectional radio range (VOR) — a ground-based navigation aid that emits a signal that can be received by appropriately‑equipped aircraft and represented as the aircraft’s bearing to or from that aid.  

The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’...

During the approach, the tower controller observed that the aircraft was lower than required and asked the flight crew to check their altitude. The tower controller subsequently instructed the crew to conduct a go-around. However, while the crew did arrest the aircraft’s descent, there was a delay of about 50 seconds before they initiated the go-around and commenced a climb to the required altitude.

The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’ when the aircraft pitched up to capture the VOR approach path. Automation surprise occurs when an automatic system changes its operation unexpectedly. 

As a result, the remainder of the approach was conducted using the autopilot’s flight level change mode. In that mode, the aircraft’s rate of descent is unrestricted and therefore may be significantly higher than that required for an instrument approach. In addition, the flight crew inadvertently selected a lower than stipulated descent altitude, which resulted in descent below the specified segment minimum safe altitude for that stage of the approach and the approach not being managed in accordance with the prescribed procedure.

In response to this occurrence, Thai Airways International issued a notice to flight crews that emphasized the importance of constant angle non-precision approaches and adherence to the segment minimum safe altitudes. Other actions included a review of crew training in support of non-precision approaches and the provision of additional information relating to the use of the aircraft’s autopilot flight director system.

This occurrence highlights the risks inherent in the conduct of non-precision approaches and reinforces the need for flight crews to closely monitor the aircraft’s flight path to ensure it complies with the prescribed procedure. 

Modern air transport aircraft are equipped with ever increasing levels of automation. While flight crews retain the option of flying the aircraft manually, the use of automation is generally preferred and often provides increased levels of safety and efficiency. Worldwide, errors associated with the use and management of automatic flight systems have been identified as causal factors in more than 20 per cent of approach and landing accidents.

Read the final report: Operational non-compliance involving Boeing 777, HS-TKD, 15 km south of Melbourne Airport, Victoria, on 24 July 2011, which provides more detail on the incident and the measures taken to remedy it.

An ATSB investigation has uncovered a 27 year-old omission that rendered an aircraft manufacturer’s safety bulletin ineffective. As a result of this discovery, the manufacturer issued a new bulletin to address the issue, which was then made mandatory by Transport Canada and the Civil Aviation Safety Authority of Australia.

On 30 December 2011, a Bombardier DHC-8-102 was being operated on a scheduled passenger service to Cairns, Queensland. During the landing, it seemed to the crew that the aircraft decelerated much more quickly than they expected, given that reverse thrust and landing gear brakes had not been selected.

An inspection of the aircraft found nothing to explain the perceived problem, and a review of the flight recorder data indicated that there had been no abnormal operation of the engines or propellers, and that reverse thrust had not been used. There was little if any risk associated with the event. However, a subsequent inspection of the aircraft discovered a design problem with the aircraft’s power lever controls. 

Once informed of the design problem,
the aircraft manufacturer took prompt action
to address the issue.

The problem related to the friction device within the aircraft’s power levers control quadrant and its interaction with the flight idle gate, which was itself designed to prevent the power levers from going into the ground range while in flight. Operation of the power levers in the ground range slows the aircraft after landing by changing the pitch of the propellers to create aerodynamic drag loads and providing a considerable amount of reverse thrust. The problem with the friction device meant that with power lever friction selected fully off, the flight idle gate could be rendered inoperative.

The design problem only applied to the first 39 DHC-8-100 aircraft that were manufactured; subsequent aircraft were manufactured with a modified design. In 1986, the aircraft manufacturer had introduced a service bulletin requirement to modify these 39 aircraft retrospectively, but the service bulletin omitted a requirement to modify or replace a specific part, which resulted in the bulletin being ineffective.

Once informed of the design problem, the aircraft manufacturer took prompt action to address the issue. They issued a service bulletin to modify the relevant part. 

The results of this investigation show how important it is that crews report occurrences and other perceived problems. Although in this case the actual event reported by the crew was not serious, and no problems relating to the aircraft or crew performance leading to the perceived event were identified, the subsequent investigation did identify a safety issue in the design of the aircraft.

More details of the investigation, along with the findings, can be found in the investigation report AO-2012-005

The ATSB’s Chief Commissioner, Martin Dolan, has just published his latest blog post on unsafe work practises.

In his post, Martin talks about a fatal accident involving a seaman who was knocked off a ladder by a wave while working over the side of a container ship. The lessons we’ve learnt from this and other accidents aren’t just limited to the maritime industry. They apply to all operations that deal with risk.

View the Chief Commissioner’s blog on unsafe work practises www.atsb.gov.au/infocus

Following a fatality at sea, the Australian Transport Safety Bureau is reminding mariners of the inherent dangers surrounding the routine task of rigging a pilot ladder.

• The seaman fell off the platform and hung from his harness while shouting for help.
• Rigging a pilot ladder while working over the side of a ship can be a hazardous task and it is imperative that all the precautions necessary to prevent a person falling overboard are taken.

On 17 November 2011, a seaman was rigging a combination pilot ladder for boarding a harbour pilot on the container ship MSC Siena near Rottnest Island off the port of Fremantle, Western Australia. (The harbour pilot has local knowledge and expertly pilots the ship safely into the port). The ship’s crew had done the task more than 30 times in the past two months. The procedure for this routine task involved the seaman, wearing a full body harness, securing the pilot ladder, which is made of rope and wood to the bottom platform of the accommodation ladder (a more rigid, staircase-type ladder with handrails and a horizontal lower platform).

The weather was rough and the boatswain was supervising the crew rigging the pilot ladder. He saw a large wave suddenly strike the underside of the accommodation ladder’s bottom platform on which the seaman was working. The seaman fell off the platform and hung from his harness while shouting for help and trying to hold on to the pilot ladder. His legs were submerged in the rough seas which were pounding his body against the ship’s side, the platform and the pilot ladder, and repeatedly breaking his hold on the ladder.

An immediate search initiated by Australian search and rescue agencies failed to find the seaman.

The boatswain and two other crew members on deck tried to pull the seaman up by heaving on the harness rope. However, he was caught under the accommodation ladder’s bottom platform. After about 4 minutes, the seaman slipped out of his harness. Submerged, and making no attempt to swim, he drifted past the ship and the crew lost sight of him.

An immediate search initiated by Australian search and rescue agencies failed to find the seaman. His boots and all the lifebuoys thrown overboard by the crew were located and recovered.

Occurrences where a person has fallen overboard are not unusual in the maritime industry. In many cases, the person is either not found or recovered alive. In 2010, a report published by the United Kingdom’s Marine Accident Investigation Branch documented a number of such occurrences. Inadequate risk assessments and/or deficiencies with ladders and associated equipment generally, were found to have contributed to those occurrences.

Since the accident, MSC Siena’s management company has taken a number of steps to improve safety during the rigging of pilot ladders. Amongst other initiatives, it has implemented a major revision to its work permit system for working over the side, which now specifically addresses the task of rigging a combination pilot ladder. On board training has been improved and a fleet wide safety campaign was carried out.

Read the final report: Man overboard fatality from the container ship MSC Siena, off Fremantle, Western Australia, on 17 November 2011, which provides a detailed description of the accident, and the measures aimed at improving the safety of mariners.

Report highlights the importance of good flight crew communication to ensure a shared understanding of an aircraft’s system status.

• The captain under training misunderstood the command from the training captain, which led to the early rotation.

On 6 February 2012 the flight crew of an Airbus A320-232, registered VH-JQX and operating as Jetstar Flight 745, commenced take-off from runway 16R at Sydney Airport, New South Wales. The flight crew consisted of a training captain and a captain under training. The captain under training was occupying the left seat and conducting the duties of captain.

During take-off, one of the thrust levers was inadvertently moved forward of the required detent, which resulted in a thrust setting reversion to manual mode. The training captain identified the issue and initially made the standard calls to the captain under training to indicate the issue with the thrust lever.

The captain under training was transitioning from another aircraft type to the A320 and the manual thrust mode on the A320 was consistent with his experience of a normal take-off on the previous aircraft type.

The training captain made a call to indicate that the take-off should continue with maximum thrust selected, and the captain under training began rotating the aircraft below the required rotation speed. At about that time the training captain increased the thrust levers to the maximum thrust setting. After noting the aircraft’s airspeed was below the required rotation speed, the captain under training discontinued the rotation until a suitable airspeed was achieved before commencing the climb.

The ATSB found that the captain under training misunderstood the command from the training captain, which led to the early rotation. The training captain recognised the thrust lever asymmetry situation, however, the captain under training did not, and this resulted in a miscommunication that was not resolved effectively between the crew.

In addition, the captain under training was transitioning from another aircraft type to the A320 and the manual thrust mode on the A320 was consistent with his experience of a normal take-off on the previous aircraft type. Following this incident, Jetstar have incorporated a module into their simulator training for all pilots, covering incorrect thrust settings at take-off. They have also released a communication to pilots on the responsibilities of the pilot in command in operational events.  

Read the final report: Inadvertent thrust lever asymmetry during the take-off roll involving an Airbus A320, VH-JQX, Sydney Airport, New South Wales, on 6 February 2012

The trailing bogie on the 47th wagon of a freight train derailed after traversing the Carlton Parade level crossing at Port Augusta, SA. The wagon travelled over a second level crossing and re-railed itself when it entered a third level crossing about 1,300 m later.

• Railway track operators must assess and manage track defects thoroughly to avoid derailments.

The derailment of the 47th wagon of a freight train at Port Augusta, South Australia highlights the importance of rail transport operators carrying out thorough assessments and management of track conditions. 

On 6 May 2011, the trailing bogie on the 47th wagon of freight train 4PM6 derailed after traversing the Carlton Parade level crossing at Port Augusta. The wagon travelled over a second level crossing and re-railed itself when it entered a third level crossing about 1,300 m later. 

The defects had not been adequately assessed and controlled in accordance with the ARTC Track and Civil Code of Practice.

The train continued towards Adelaide before it was stopped at Winninowie after the network controller had been alerted that the train was emitting sparks and that the half-boom barriers remained down with warning devices continuing to operate at the two level crossings. 

In investigation report RO-2011-008, the ATSB found that multiple geometric rail defects needing urgent attention had been detected by a track geometry car inspection three months before the derailment. As a result, there was a 30 km/h temporary speed restriction (TSR) in force at the time. The defects had not been adequately assessed and controlled in accordance with the Australian Rail Track Corporation (ARTC) Track and Civil Code of Practice and the 30 km/h TSR was probably inadequate to minimise the risk of derailment. The ATSB also found that the track geometry defect exceedance reports did not contain fields to record the date and time as confirmation that field inspections had been carried out in accordance with the Code of Practice. 

As a result of the accident, the ARTC has, through its Alliance Partner Transfield Services, undertaken additional training on the ARTC Track and Civil Code of Practice. This includes the necessary responses to situations where there are multiple localised geometric defects. The ARTC is also developing an improved reporting format for data from geometry car measurements.

Read the final report: Derailment of bogie on freight train 4PM6, at Port Augusta, South Australia, on 6 May 2011

Pilots and operators need to inspect and maintain fuel cap seals to prevent the ingress of water into fuel tanks.

• An inspection of the aircraft wreckage found evidence of water in the right tip tank and airframe fuel filter bowl.

On September 2012, a Piper PA-32 was being operated on a private scenic flight near Yea, Victoria. About 5 minutes after departing, at about 1,000 feet above ground level, the pilot changed the fuel selection from the left main tank to the right tip tank. About 3 minutes later, when at about 800 ft the engine failed. The pilot changed the fuel selector back to the left main tank and placed the fuel mixture and throttle control full forward, but the engine did not respond. As a result, the pilot elected to conduct a forced landing.

The deterioration of fuel cap seals can allow the ingress of water into fuel tanks.

The pilot moved the throttle to the idle position and prepared for landing. During the landing the pilot noted that the engine power had been restored. The aircraft subsequently impacted two fences and sustained substantial damage.

Subsequent inspections found water contamination in the fuel tanks. Prior to the flight, the aircraft had been sitting idle for several months, fully fuelled, in a hangar. The pilot reported that he had washed the aircraft several months earlier and speculated that water may have entered the tank through the fuel cap.

The deterioration of fuel cap seals can allow the ingress of water into fuel tanks. CASA Airworthiness Bulletin (AWB 28-008) Water contamination of fuel because of failure of fuel filler cap contains information on inspecting fuel filler and caps and conducting pre-flight inspections of fuel filler/caps and fuel samples.

Read the final report: Engine failure involving Piper PA-32, VH-FAJ, near Yea, Victoria, on 22 September 2012

Two aircraft proximity events on the same day have reinforced the point that it is critical for pilots to broadcast and actively listen to the CTAF and maintain a vigilant lookout at all times.

• Pilot should not hesitate to call and clarify another aircraft’s position and intentions.
• it is critical for pilots to broadcast and actively listen to the CTAF and maintain a vigilant lookout at all times.

Two aircraft proximity events at Ballarat Airport on the same day have reinforced the point that it is critical for pilots to broadcast and actively listen to the Common Traffic Advisory Frequency (CTAF) and maintain a vigilant lookout at all times to enhance traffic and situation awareness. This is particularly important in a high traffic density environment.

The two incidents on 4 August 2012 involved Cessna 172S aircraft on convergent headings arriving at the same time at the airport. Both incidents were sighted by observers on the ground. In both cases one of the two pilots involved had been unaware that the incident had occurred.

A pilot should not hesitate to call and clarify the other aircraft’s position and intentions if there is any uncertainty.

In the first instance the aircraft passed in close proximity with about .2 NM lateral separation and 300ft vertical separation. In the second case, the distance reduced to 0.1NM laterally and 100ft vertically.

The pilots reported making CTAF calls but some differences between the pilots’ and observers’ recollections of events that could not be reconciled. Any radio broadcasts made by the pilots could not be verified as transmissions at Ballarat are not recorded. Ballarat airport experienced a reasonable amount of airport activity on that day.

ATSB reminds pilots that in accordance with Civil Aviation Advisory Publication 166-1 ‘…radio broadcasts should be made as necessary to avoid the risk of a collision or an airprox event. A pilot should not hesitate to call and clarify the other aircraft’s position and intentions if there is any uncertainty.’

Read the final report: Two aircraft proximity events at Ballarat Airport, Victoria, on 4 August 2012

A hard landing of a Cessna P206B at Monduran in Queensland is a reminder for pilots to conduct a go-around as soon as landing conditions appear unfavourable.

• A go-around is a standard manoeuvre when a pilot is not completely satisfied that the requirements are in place for a safe landing.
• The sooner a condition that warrants a go-around is recognised, the safer the manoeuvre will be.

On 29 September 2012, the aircraft departed Gympie on a private flight to Monduran, carrying the pilot and four passengers. During the landing at Monduran, the pilot noted the windsock was indicating gusty wind conditions but still decided to land.

A go-around is a standard manoeuvre when a pilot is not completely satisfied that the requirements are in place for a safe landing.

During the landing, at about 10 feet above the runway, the Cessna was struck by a significant wind gust. The aircraft bounced and the pilot applied a small amount of power in an attempt to regain control. The aircraft was then struck by a second, more intense, wind gust before stalling and touching down hard on the nose landing gear. The pilot maintained control and the aircraft came to a stop.

Although no one was injured in the incident, the aircraft’s propeller, nose landing gear, and lower engine cowls were damaged.

The ATSB recommends pilots conduct a go-around as soon as landing conditions appear unfavourable. A go-around is a standard manoeuvre when a pilot is not completely satisfied that the requirements are in place for a safe landing.

The need for a go-around may occur at any stage during the approach and landing. However, the most critical go-around is one initiated very close to the ground. Consequently, the sooner a condition that warrants a go-around is recognised, the safer the manoeuvre will be.

Read the final report: Hard landing involving Cessna P206B, VH-EGG, Monduran, Queensland, on 29 September 2012

The inadvertent retraction of an Aero Commander’s landing gear on the runway shows the ease with which habitual piloting actions can result in an error.

• During a landing roll, pilot inadvertently retracted the landing gear of an Aero Commander 500S.
• Pilots should take the time to identify any control lever before they action it.

On 21 August 2012, at about 1430 Eastern Standard Time, an Aero Commander 500S registered VH-YJS (YJS) departed Charleville Airport, Queensland for Brisbane Airport via, Roma, Dalby and Toowoomba on a freight only charter flight under the IFR. The pilot was the only person on board.

This resulted in the main gear collapsing and the aircraft sliding for a short distance before coming to rest on the runway.

During the landing roll the landing gear was inadvertently retracted, and the lower fuselage contacted the runway. The pilot exited the aircraft without injury however the lower fuselage of the aircraft was damaged.

A manual safe pin was incorporated as a design feature to prevent inadvertent retraction of the landing gear. However, operation of the gear lever and safe pin together had become an automatic response by the pilot and the effectiveness of the safe pin as a countermeasure reduced. Pilots are reminded to positively identify any control lever before actioning.

The Aero Commander 500S departed Charleville Airport in Queensland bound for Brisbane airport via Toowoomba on a freight charter flight. About 300 m into the landing roll at Toowoomba airport, the pilot inadvertently retracted the landing gear while attempting to retract the aircraft’s wing flaps. This resulted in the main gear collapsing and the aircraft sliding for a short distance before coming to rest on the runway. The pilot, the only person on board, survived the accident without injury.

A manual ‘safe’ pin had been incorporated as a design feature to prevent inadvertent retraction of the landing gear. However, the pilot’s operation of the gear level and safe pin at the same time had become an automatic action, reducing the effectiveness of the safe pin as a countermeasure.

As a result of this accident, the operator has taken a number of safety actions, including modifying the landing gear control, and implementing random flight checks by check and training captains. In addition, the ATSB is encouraging pilots to take the time to identify any control lever positively before they action it.

Read the final report: Inadvertent landing gear retraction, Aero Commander, VH-YJS, Toowoomba Airport, Queensland, on 21 August 2012, which contains useful information on skill-based errors and muscle memory.