An aircraft accident that resulted in the fatality of a child passenger is a shocking reminder to all pilots about the dangers of unauthorised and unnecessary low-level flying, according to the ATSB.

The accident occurred on 12 April 2014 when a Maule M-5 aircraft, with a pilot and two passengers on board, struck a powerline across the Clarence River in New South Wales. The aircraft then collided with water, coming to rest inverted with the cabin submerged.

The pilot and front-seat adult passenger escaped the cockpit through one of the forward doors and attempted to free the rear-seat child passenger from the flooded cabin. After repeated attempts by the pilot to open the rear-right cabin door, the rear-seat passenger was recovered through a cockpit door. Sustained attempts to resuscitate the rear-seat passenger were unsuccessful.

The ATSB found that the accident was an unintended consequence of the pilot’s spur-of-the-moment decision to fly at a very low level along the river, in an unfamiliar environment and below the minimum stipulated height for flights over unpopulated areas.

The pilot reported seeing the powerline just before the collision, but with insufficient time to avoid a wirestrike. The pilot was not approved to conduct low-flying operations and had not completed any training to identify the hazards associated with such operations.

ATSB general manager of strategic capability, Julian Walsh, said the accident is a very powerful and tragic reminder for pilots about the dangers of unauthorised and unnecessary low‑level flying.

“Flying at low heights—below 1,000ft above terrain for populous areas or 500ft for other areas—presents many obstacles and has very low margin for error,” Mr Walsh said. “Most private pilots generally have no reason to fly at these dangerous low levels and there are special training and endorsement to do so.”

“The tragic accident at Clarence River is just one of many accidents we’ve investigated that resulted from aircraft flying too low. This accident was completely avoidable. It should serve as a stark warning to other pilots who are ever tempted to fly lower than necessary.”

A copy of the investigation report (AO-2014-068) into this accident is available on the ATSB website. Low-level flying is one of the ATSB’s top safety concerns for general aviation pilots. More information can be found on the ATSB’s SafetyWatch page or via the ATSB’s avoidable accident publication Low-level flying.  

With the Holiday season upon us, the Australian Transport Safety Bureau (ATSB) has encouraged air travellers to keep their seat belts fastened at all possible times.

The call coincides with the release of the ATSB report into an in-flight upset that occurred on-board a Qantas A330 aircraft en-route from Singapore to Perth in October 2008. At least 110 of the 303 passengers and 9 of the 12 crew members were injured. Of these, 51 received hospital medical treatment.

The Chief Commissioner of the ATSB, Mr Martin Dolan, said that the accident provided a salient reminder about the importance of seat belts, and he urged passengers to keep their seat belts fastened during flight whenever they are seated.

'At least 60 of the passengers were seated without their seat belts fastened. Although some of those wearing a seat belt were also injured, most of the injuries occurred when unrestrained occupants were thrown into the aircraft's ceiling. The rate and severity of injuries was much greater for those who were not wearing a seat belt.'

'Although passengers are routinely reminded on each flight to wear their seat belts when seated during a flight, some passengers do not follow this advice,' Mr Dolan said.

The in-flight upset that occurred on-board a Qantas A330 aircraft was a unique event and extremely unlikely to happen again according to the ATSB. During the flight, approximately 154 kilometres west of Learmonth, WA, the aircraft suddenly pitched down, due to a combination of problems involving two aircraft systems; the flight control computers and one of the aircraft's three air data inertial reference units (ADIRUs).

Due to a limitation in software design, the flight control computers commanded the aircraft to pitch down in response to a very rare pattern of incorrect angle of attack data from one of the ADIRUs.

Mr Dolan said that Airbus had taken prompt action to reduce the likelihood of another similar accident.

'Very soon after the accident, the manufacturer issued new pilot procedures to manage the effects of any future cases of a similar ADIRU failure,' Mr Dolan said.

'The aircraft manufacturer then redesigned its software. Passengers, crew and operators can be confident that the same type of accident will not happen again.'

An extensive investigation into what triggered the ADIRU failure mode concluded that it was very unlikely to have been caused by electromagnetic interference from the Harold E. Holt Naval Communications station at Exmouth or from a personal electronic device such as a laptop or mobile phone. A range of other possible mechanisms were also discounted.

Mr Dolan stated that the ATSB investigation covered a range of complicated issues, including some that had rarely been considered in depth by previous accident investigations.

'Given the increasing complexity of aircraft systems, this comprehensive investigation has offered an insight into the types of issues that will become increasingly relevant for future investigations. It identified a number of specific lessons for the manufacturers of new, complex, safety-critical systems,' Mr Dolan says.

The Australian Transport Safety Bureau has released a second Interim Factual Report into the accident involving the Qantas Airbus A330-303 in-flight upset, 154 km west of Learmonth WA, on 7 October 2008. The report summarises new activities conducted since the first Interim Factual Report that was released on 6 March 2009, and it should be read in conjunction with that previous report.

The aircraft (registered VH-QPA) was being operated on a scheduled passenger service (QF72) from Singapore to Perth. At 1240, while cruising at 37,000 ft, the aircraft experienced two uncommanded pitch-down events. The flight crew were able to quickly return the aircraft to level flight on each occasion and diverted to Learmonth, WA for a safe landing.

One flight attendant and 11 passengers were seriously injured, and eight other crew members and at least 99 other passengers received minor injuries. The injury rate and severity of injuries was significantly greater for those passengers who were not seated or not wearing seatbelts at the time of the first in-flight upset.

At least 60 of the 303 passengers were seated without their seatbelts fastened. Although there are legitimate reasons for passengers leaving their seats during a flight when the seatbelt sign is not illuminated, passengers are reminded to wear their seatbelts at all times when seated during a flight.

In addition to the initial procedures-based safety action taken by the aircraft manufacturer in response to this accident, Airbus is modifying the flight control primary computer (FCPC or PRIM) software used in the A330/A340 fleets to prevent any future similar problems leading to an uncommanded pitch-down event. An interim modification to the FCPC software standard is being installed in the operator's fleet, and the installation is expected to be completed by the end of November 2009. A later FCPC software standard to improve the treatment of all ADIRU parameters will be certified in mid to late 2010, and will then be retrofitted to the world-wide fleet of A330/A340 aircraft.

There has been speculation of a potential link between the QF72 accident off Learmonth on 7 October 2008 with the AF447 accident that occurred on 1 June 2009 on a flight from Rio de Janeiro to Paris. Although each of the accidents involved the same basic aircraft type, there are several important differences between the two accidents:

• The ADIRUs on the two aircraft were different models, and constructed by different manufacturers.
• The cockpit-effect messages and maintenance fault messages from both flights showed a significantly different sequence and pattern of events. For example, a series of maintenance messages that were transmitted by AF447 prior to the accident showed inconsistencies between the measured airspeeds and the associated consequences on other aircraft systems. No such messages were recorded by QF72. The airspeed sensors (pitot probes) on the two aircraft were different models made by different manufacturers.
• The ATSB expects to release a final report into this accident in the second quarter of calendar year 2010. However, the ATSB will immediately bring any critical or significant safety issue(s)s to the attention of the relevant organisations best placed to address them, should any such issues arise. The ATSB will also publish details of any such issue(s).

The Australian Transport Safety Bureau has released an interim factual report into the accident involving the Qantas Airbus A330-303 in-flight upset, 154 km west of Learmonth WA, 7 October 2008.

The ATSB's preliminary report, released on 14 November 2008, provided details of the circumstances of the accident, in which the aircraft abruptly pitched nose-down twice while in normal cruise flight. The aircraft (registered VH-QPA) was being operated on a scheduled passenger service (QF72) from Singapore to Perth. At 1240, while cruising at 37,000 ft, the aircraft experienced two significant uncommanded pitch-down events while responding to various system failure indications. The crew made a PAN urgency broadcast to air traffic control and requested a clearance to divert to and track direct to Learmonth. After receiving advice from the cabin of several serious injuries, the crew declared a MAYDAY. The aircraft landed at Learmonth without further incident at 1350.

The interim factual report released today contains information on progress, and future direction, of the investigation. Analysis of the factual information and findings as to the factors that contributed to the accident are subject to ongoing work and will be included in the final report.

The investigation to date has identified two significant safety factors related to the pitch-down movements. Firstly, immediately prior to the autopilot disconnect, one of the air data inertial reference units (ADIRUs) started providing erroneous data (spikes) on many parameters to other aircraft systems. The maintenance post-flight report from the aircraft's central maintenance computer and built-in test equipment (BITE) data for several systems indicated a problem with ADIRU 1, but no data indicated a problem with ADIRU 2 or ADIRU 3. Testing of other relevant systems and components identified no problems with these systems or components which were related to the circumstances of the occurrence.

Secondly, some of the spikes in angle of attack were not filtered by the aircraft's flight control computers. The A330 used a variety of redundancy and error-checking mechanisms to minimise the probability of erroneous ADIRU data having a detrimental effect on the aircrafts flight controls. On the A330, angle of attack data was processed differently to other parameters and, in a very specific situation, the flight control computers could generate an undesired pitch-down elevator command. The aircraft manufacturer reported that it was not aware of any previous event where angle of attack spikes had resulted in an in-flight upset.

The three ADIRUs from the aircraft were despatched to the ADIRU manufacturer's facility in Los Angeles. After agreeing a detailed test plan, testing of the number-1 ADIRU has been ongoing since 17 November 2008.

Completed testing includes physical inspection, ground integrity test, software program verification, BITE data download, built-in test and manufacturing test procedures, bus tests, internal visual inspection and environmental tests. The environmental testing included subjecting ADIRU 1 to electromagnetic interference (EMI) tests in accordance with the frequencies and field strengths specified in international standards. In addition, it was subjected to specific conducted susceptibility tests at 19.8 kHz, the same frequency as the Harold E. Holt Naval Communication Station near Learmonth, and at a field strength of 100 Volts/metre (about 1,700 times the electromagnetic field strength to which the aircraft was exposed at the time of the in-flight upset when the aircraft was 170 km away from the transmitting station). None of the testing completed to date on ADIRU 1 has produced any faults that were related to the pitch-down events.

Testing of ADIRU 1 from VH-QPA is ongoing and will include further EMI testing, including frequencies associated with onboard transmitters and other onboard systems that have been nominated by the investigation team for particular attention. This testing will be completed before unit disassembly to prevent disturbance to the unit's hardware that could otherwise be detrimental to the EMI testing. After disassembly, individual modules will be tested separately.

Two other occurrences have been identified involving similar anomalous ADIRU behaviour to the 7 October 2008 occurrence, but in neither case was there an in-flight upset. The first occurred in September 2006 and involved the same aircraft and the same ADIRU as the 7 October 2008 occurrence. Maintenance records for this earlier event indicate that there were no faults found following systems testing and an ADIRU re-alignment.

The second event occurred on 27 December 2008, when another Qantas A330-303 aircraft (VH-QPG) was on a flight from Perth to Singapore. In response to a similar pattern of fault messages as occurred on the 7 October 2008 flight, the crew completed the relevant procedures (introduced since the 7 October 2008 occurrence) to select both parts of the ADIRU off and returned to Perth for a normal landing. A test plan for the ADIRU 1 of VH-QPG is being developed.

In addition to the ongoing testing of the ADIRU 1 from both VH-QPA and VH-QPG:

• the operator has initiated a detailed review as well as specific ongoing monitoring of ADIRU performance across its A330 fleet, the results of which will continue to be reported to the ATSB investigation team
• the ADIRU manufacturer is conducting a theoretical analysis of ADIRU software and hardware to identify possible fault origins
• the aircraft manufacturer is conducting a detailed analysis of differences in aircraft configuration between the operator's A330 aircraft and other operators' A330 aircraft with the same type of ADIRU
• a detailed analysis is being conducted of whether there were any commonalities in operational, environmental or maintenance aspects of the flights/aircraft that were involved in the occurrences
• the investigation is examining various aspects of the PRIM software development cycle, including design, hazard analysis, testing and certification
• the investigation is examining the performance of the electronic centralized aircraft monitor and its effectiveness in assisting crews to manage aircraft system problems.

One flight attendant and 11 passengers were seriously injured in the 7 October 2008 accident. Eight other crew members and at least 95 other passengers received minor injuries. The investigation has received responses to a questionnaire or other information from 47% of the passengers. Analysis of this information indicates that most of the injuries involved passengers who were seated without their seatbelts fastened or were standing. However, the investigation has identified a potential design problem which can lead to inadvertent release of a seatbelt if it is loosely fastened. The seatbelt manufacturer, aircraft manufacturer, aircraft operator, the Civil Aviation Safety Authority (CASA) and overseas investigation agencies have all reported that they were previously unaware of this potential problem. Further investigation will consider the scope of the problem across different types of aircraft, as well as relevant design requirements for seatbelts and seats.

The ATSB is also aware that a post-incident multi-agency debrief has been conducted. The debrief included representatives from all available private, government and non-government organisations involved in the emergency response to the accident and the Western Australia Airports Corporation is coordinating actions from that meeting. The ATSB will review those outcomes in relation to information obtained at interviews and from responses to the passenger questionnaire.

Safety action to minimise future risk associated with the issues identified by the investigation has been taken by the aircraft manufacturer through the issue of an Operations Engineering Bulletin (OEB) which provides procedures for crews of Airbus A330 and A340 aircraft to follow in the event of a similar anomalous ADIRU behaviour in the future. A revised version was issued following the 27 December 2008 event. The European Aviation Safety Agency (EASA) and CASA have subsequently issued these bulletins as Airworthiness Directives.

The aircraft operator issued a Flight Standing Order incorporating material from OEB. In addition, a program of focussed training during simulator sessions and route checks was initiated to ensure that flight crew undertaking recurrent or endorsement training were aware of the contents of the Flight Standing Order.

In its media statements providing updates on the investigation on 8 and 10 October 2008, the ATSB noted that this accident served as a reminder to all people who travel by air of the importance of keeping seatbelts fastened at all times when seated in an aircraft. Further, on 27 October 2008, the Australian Civil Aviation Safety Authority issued a media release that stated that the occurrence was a timely reminder to passengers to 'remain buckled up when seated at all stages of flight'. The media release also highlighted the importance of passengers following safety instructions issued by flight crew and cabin crew, including watching and actively listening to the safety briefing given by the cabin crew at the start of each flight.

The ATSB expects to release a final report into this accident towards the end of 2009. However, the ATSB will immediately bring any critical or significant safety issue(s) to the attention of the relevant organisations best placed to address them, should any such issue(s) arise. The ATSB will also publish details of any such issue(s).

The Australian Transport Safety Bureau's investigation into the accident involving an Airbus A330-300 aircraft operating as Qantas flight 72 on a flight from Singapore to Perth on 7 October 2008 is progressing well. The ATSB has scheduled the media conference this evening to coincide with the release of an Operators Information Telex/Flight Operations Telex, which is being sent by Airbus to operators of all Airbus aircraft. The aim of that telex is to:

• update operators on the factors identified to date that led to the accident involving QF72,
• provide operational recommendations to mitigate risk in the event of a reoccurrence of the situation which occurred on QF72.

To assist in understanding the following information, I would just like to refer you quickly to the diagrams projected on the screen specifically, the term angle of attack which refers to the difference in angle between the aircraft and its control surfaces, and the air stream as the aircraft moves through the air.

The next diagram is a simple representation of the aircraft and the components relevant to this explanation, which include the angle of attack sensors located on the outside of the aircraft, the Air Data Inertial Reference Units (ADIRUs), of which there are three, located in the avionics compartment inside the aircraft, the Flight Control Primary Computers of which there are also three located in the avionics compartment, and the elevators, located on the aircrafts horizontal stabiliser. In the context of this occurrence, the angle of attack sensors send raw data to the ADIRUs, which provide processed angle of attack information to the Flight Control Primary Computers, which in turn command the elevator position.

Returning to the circumstances of the 7 October flight, preliminary analysis of the Flight Data Recorder data, Post Flight Report data and Built-in Test Equipment data has enabled the investigation to establish a preliminary sequence of events this information is also contained in the Airbus telex.

The aircraft was flying at FL 370 or 37, 000 feet with Autopilot and Auto-thrust system engaged, when an Inertial Reference System fault occurred within the Number-1 Air Data Inertial Reference Unit (ADIRU 1), which resulted in the Autopilot automatically disconnecting. From this moment, the crew flew the aircraft manually to the end of the flight, except for a short duration of a few seconds, when the Autopilot was reengaged. However, it is important to note that in fly by wire aircraft such as the Airbus, even when being flown with the Autopilot off, in normal operation, the aircrafts flight control computers will still command control surfaces to protect the aircraft from unsafe conditions such as a stall.

The faulty Air Data Inertial Reference Unit continued to feed erroneous and spike values for various aircraft parameters to the aircrafts Flight Control Primary Computers which led to several consequences including:

• false stall and overspeed warnings
• loss of attitude information on the Captain's Primary Flight Display
• several Electronic Centralised Aircraft Monitoring system warnings.

About 2 minutes after the initial fault, ADIRU 1 generated very high, random and incorrect values for the aircrafts angle of attack.

These very high, random and incorrect values of the angle attack led to:

• the flight control computers commanding a nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees,
• the triggering of a Flight Control Primary Computer pitch fault.

The crew's timely response led to the recovery of the aircraft trajectory within seconds. During the recovery the maximum altitude loss was 650 ft.

The Digital Flight Data Recorder data show that ADIRU 1 continued to generate random spikes and a second nose-down aircraft movement was encountered later on, but with less significant values in terms of aircraft's trajectory.

At this stage of the investigation, the analysis of available data indicates that the ADIRU 1 abnormal behaviour is likely as the origin of the event.

The aircraft contains very sophisticated and highly reliable systems. As far as we can understand, this appears to be a unique event and Airbus has advised that it is not aware of any similar event over the many years of operation of the Airbus.

Airbus has this evening, Australian time, issued an Operators Information Telex reflecting the above information. The telex also foreshadows the issue of Operational Engineering Bulletins and provides information relating to operational recommendations to operators of A330 and A340 aircraft fitted with the type of ADIRU fitted to the accident aircraft. Those recommended practices are aimed at minimising risk in the unlikely event of a similar occurrence. That includes guidance and checklists for crew response in the event of an Inertial Reference System failure.

Meanwhile, the ATSB's investigation is ongoing and will include:

• Download of data from the aircraft's three ADIRUs and detailed examination and analysis of that data. Arrangements are currently being made for the units to be sent to the component manufacturer's facilities in the US as soon as possible and for ATSB investigators to attend and help with that testing, along with representatives from the US National Transportation Safety Board, The French Bureau dEnquêtes et dAnalyses (BEA) and Airbus.
• In addition, investigators have been conducting a detailed review of the aircraft's maintenance history, including checking on compliance with relevant Airworthiness Directives, although initial indications are that the aircraft met the relevant airworthiness requirements.
• Work is also ongoing to progress interviews, which will include with injured passengers to understand what occurred in the aircraft cabin. The ATSB plans to distribute a survey to all passengers.

There has been close and frequent communication between the ATSB, Qantas, Airbus, the BEA, and CASA. That close communication will continue as the investigation progresses to ensure that any additional safety action can be instigated as soon as possible should critical safety factors be identified. The ATSB expects to publish a Preliminary Factual report in about 30 days from the date of the accident.

The aircraft's Digital Flight Data Recorder (DFDR), Cockpit Voice Recorder (CVR) and Quick Access Recorder arrived in Canberra late on Wednesday evening. Downloading and preliminary analysis has revealed good data from both recorders. Data from the FDR has been provided to participants in the investigation which include Qantas, the French accident investigation authority - the Bureau d'Enqu'tes et d'Analyses (BEA), Airbus and the Australian Civil Aviation Safety Authority. The aircraft's operating crew acted responsibly and promptly after the aircraft was shut down by isolating the CVR to preserve information for the purpose of the investigation.

While the full interpretation and analysis of the recorded data will take some time, preliminary review of the data indicates that the aircraft was cruising at 37,000 feet, when the aircraft initiated a climb of about 200 feet, before returning back to 37,000 feet. About 1 minute later, the aircraft pitched nose-down, to a maximum pitch angle of about 8.4 degrees, and descended about 650 feet in about 20 seconds, before returning to the cruising level. About 70 seconds after returning to 37,000 feet there was a further nose-down pitch, to a maximum pitch angle of about 3.5 degrees, and the aircraft descended about 400 feet in about 16 seconds, before returning once again to the cruising level.

I turn your attention to the screen where there is a very basic animation, using data from the Digital Flight Data Recorder, of the first pitch-down event.

Basic animation using data from the Digital Flight Data Recorder

Detailed review and analysis of DFDR data is ongoing to assist in identifying the reasons for the events. At this point, the event appears very complex. The aircraft contains very sophisticated and highly reliable systems whose interaction is very complex. As far as we can understand, there seems to be issues with some on-board components. Further examination of the auto-pilot system, data sources used by flight control computers and the flight control computers themselves, along with the interaction of the flight crew with the aircraft's systems is necessary to achieve a better understanding of the event.

Meanwhile, the on-site team in Learmonth is working hard and has assessed and documented significant damage to some overhead panels, consistent with injuries that were sustained by the aircraft occupants. Ceiling panels were removed and wiring looms were visually inspected and no defects were found. In addition, visual inspection of the aircraft has been conducted and no structural defects have been found. Inspection of the cargo area found all cargo was loaded in the correct position and no load shift was evident. All of the cargo load was properly secured.

With all necessary precautions taken and completed to ensure no loss of evidence, the aircraft was then powered up and data pertaining to specific computers and systems was downloaded. This was done in a careful and methodical manner to ensure no data was lost. This data is essential to the investigation and includes additional information not recorded on the Digital Flight Data Recorder. This download occurred on the aircraft involving representatives of the ATSB, Qantas and Airbus. This data is currently being analysed. More data is to be downloaded today and further assessment will be carried out on the aircraft's systems. It is likely that a number of components will be removed for further downloading/testing, some of which will need to be done at the manufacturers facilities in France or relevant country of manufacture.

Ongoing activities include a detailed review of the aircraft's maintenance history, including checking on compliance with relevant Airworthiness Directives, although initial indications are that the aircraft met the relevant airworthiness requirements. Work is also ongoing to progress interviews, which will include with injured passengers to understand what occurred in the aircraft cabin. The ATSB plans to distribute a survey to all passengers. There is no evidence at this stage to indicate that the use of portable electronic devices by passengers contributed to the event, however, it would be expected that questions relating to such usage would be included in the passenger survey.

The nature of the initiating event has not yet been determined. The investigation will be examining the broad range of factors that influence the operation of the aircraft. There was been close, frequent, communications between the ATSB, Qantas, Airbus and CASA. That close communication will continue as the investigation progresses to ensure that any necessary safety action can be instigated as soon as possible should critical safety factors be identified.

The ATSB will release a Preliminary Factual report within about 30 days, however, should any critical safety issues emerge that require urgent attention, the ATSB will immediately bring such issues to the attention of the relevant authorities who are best placed to take prompt action to address those issues and will publish such information more broadly ahead of the Preliminary report.

As I noted in the media conference earlier this week, we cannot pre-empt the findings in relation to cabin safety issues and the wearing of seatbelts, but this accident does serve as a salient reminder to all people who travel by air of the importance of keeping seatbelts fastened at all times when seated in an aircraft.

The Australian Transport Safety Bureau investigation is progressing.

The aircraft's Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR) arrived in Canberra late on Wednesday evening. Downloading and preliminary analysis overnight has revealed good data from both recorders. Data from the FDR has been provided to Qantas, the French Bureau d'Enqu'tes et d'Analyses (BEA) and Airbus as parties to the investigation.

While the full interpretation and analysis of the recorded data will take some time, preliminary review of the data indicates that after the aircraft climbed about 200 feet from its cruising level of 37,000 feet, the aircraft then pitched nose-down and descended about 650 feet in about 20 seconds, before returning to the cruising level. This was closely followed by a further nose-down pitch where the aircraft descended about 400 feet in about 16 seconds before returning once again to the cruising level. Detailed review and analysis of FDR data is ongoing to assist in identifying the reasons for the events.

In addition, the on-site investigation activity is continuing and includes:

• recording and photographing cabin damage
• removing panels to examine wiring for damage prior to restoring power to the aircraft
• preparation for downloading data from the aircraft's on-board computerised systems
• arranging interviews with the pilots and cabin crew.

The ATSB plans to distribute a survey to all passengers and will conduct interviews with injured passengers to understand what occurred in the aircraft cabin. Passengers with information about the accident are encouraged to contact the ATSB at atsbinfo@atsb.gov.au.

The ATSB will provide further media releases when significant new factual information comes to light, ahead of a Preliminary Factual Report in 30 days time.