Review by the Chief Commissioner

The Australian Transport Safety Bureau (ATSB) became a separate statutory agency on 1 July 2009. This was the final step in the transition to independence from being an operational division of the Department of Infrastructure, Transport, Regional Development and Local Government. This Annual Report covers the first year of operations under those new arrangements.

Operational start‑up for the new organisation was smooth and well‑controlled, thanks in large part to the hard work of our corporate services staff and our colleagues in the Infrastructure Department. At the same time, the ATSB continued to deliver its core business of conducting transport safety investigations, some of which were complex and the subject of significant industry and public interest both in Australia and internationally. A number of those investigations led directly to significant initiatives to improve transport safety.

Legally, the ATSB consists of three Commissioners: Mr Noel Hart, Ms Carolyn Walsh and me. The three of us are generally referred to as 'the Commission'. As the Chief Commissioner, I am also Chief Executive Officer of the ATSB, with responsibility for the employment of staff and the management of financial and other resources.

One of the Commission's most important responsibilities is to ensure that a transport safety investigation is complete and that a final report can be published; this includes determining what important safety messages arise from an investigation and the best means to communicate those messages.

The Transport Safety Investigation Act 2003 reinforces this responsibility: it requires the Chief Commissioner to describe in the ATSB's annual report those investigations that have raised significant issues in transport safety. This review meets that requirement. Some of the investigations described below are not yet finished. It is the ATSB's policy, however, to bring critical safety issues to the immediate attention of those best placed to take prompt action.

Rail safety investigation

The rail investigation team completed 11 transport safety investigations in the past year. Two of those investigations were conducted on behalf of the Queensland Department of Transport and Main Roads, in accordance with provisions of Queensland's Transport Infrastructure Act 1994, with a senior ATSB rail safety investigator as the independent chair of the investigation team. These high‑profile investigations involving passenger trains at level crossings were conducted in a timely manner and resulted in wide‑ranging safety action by the Queensland Government.

They and other investigations highlight the continuing issues of road design, marking and road use that are the most significant influences on safety at level crossings, particularly where heavy road transport vehicles are involved.

In the course of a number of other investigations, the ATSB continues to observe a concerning pattern of safe‑working irregularities, including some resulting in fatalities, that are principally attributable to communications issues. We draw the attention of rail operators to the need for improved procedures and training in effective radio communication between train controllers and train crew and track workers.

Marine safety investigation

The marine investigation team completed 11 safety investigations, including one in assistance to the New Zealand Transport Accident Investigation Commission (TAIC). While all investigations are conducted by the ATSB with the aim of identifying and promulgating useful safety messages, there were two in particular that, from my perspective, raise significant issues in transport safety.

The first is the collision of the yacht Ella's Pink Lady and the bulk carrier Silver Yang. The investigation found that when the two vessels collided, neither the yacht's skipper nor the ship's watch keepers were keeping a proper lookout, nor were they appropriately using navigational aids to manage the risk of collision. The investigation also found that following the collision, the ship's watch keeper did not adequately offer to assist the yacht's skipper.

Failure to stop and render assistance is a problem that has also been highlighted by previous ATSB investigations and is a continuing problem around the world.

The investigation serves as a timely reminder that, under United Nations conventions, ship operators have an obligation to offer assistance immediately to other vessels following a collision.

The second significant investigation involved the container ship APL Sydney, which ruptured the submarine ethane gas pipeline in Port Phillip after dragging its anchor across the pipeline in strong gale force winds.

The ship's anchor had been let go too close to the pipeline in poor weather conditions and insufficient anchor cable was deployed. Inadequate action was taken on board the ship and at harbour control to prevent the anchor from snagging the pipeline. After snagging the pipeline, the anchor windlass failed. Instead of releasing the fouled anchor, an attempt was made to clear it and this led to the pipeline rupture.

After the rupture, APL Sydney was manoeuvred clear of the escaping gas and the pipeline. There were no injuries and the pipeline was isolated. The anchor cable was cut and left in the anchorage with the anchor. Repairs to the pipeline took several months.

The ATSB investigation identified 10 significant safety issues in relation to the port's risk management, with respect to the pipeline and anchorage boundaries and its shipping control procedures, the ship's safety management system, the pilotage company's safety management system, and the windlass failure. Safety action to address all of the safety issues identified was proactively taken by the relevant parties.

Of particular significance, given other investigations and occurrences internationally, are the ongoing issues of effective bridge resource management when a pilot is on board a vessel. The ATSB draws attention to the need for training of pilots and deck officers to give emphasis to issues of role clarity between pilots and officers, cross‑cultural issues and the need for clear communication protocols.

Aviation safety investigation

The aviation investigation teams completed 68 aviation accident and incident investigations in the past year, several of which attracted substantial national and international interest. Many of those investigations, both completed and ongoing, have helped to identify important safety issues.

The first is an occurrence involving an A320 aircraft that performed an incorrect go‑around in fog at Melbourne Airport. In the process, the crew was unaware of the aircraft's current flight mode. The aircraft descended to within 38 ft of the ground before climbing.

The investigation highlighted the risks of changing standard operating procedures, particularly without formal risk management processes. Even more significantly, it provided more evidence that issues remain about the adequacy of some elements of oversight and delivery of pilot training. These issues are also coming into prominence in a number of other aviation investigations.

The aircraft operator has commenced a review of its flight training requirements, and the Civil Aviation Safety Authority (CASA) is reviewing the regulations relating to the provision of flying training by third party training providers. The ATSB nevertheless draws attention to the safety significance of effective training oversight, whether delivered by third parties or in‑house. The ATSB will be directing further investigative efforts to this area of potential safety risk.

The second is an occurrence involving an Embraer 120 aircraft at Jundee Airstrip, Western Australia. On final approach to the airstrip, the aircraft unexpectedly drifted left of the runway centreline and the crew decided to initiate a go‑around, whereupon the aircraft violently rolled and yawed left. The crew had difficulty controlling the aircraft and narrowly avoided colliding with the ground.

The ATSB investigation established that the left engine had sustained a total power loss following fuel starvation. That had occurred because the left fuel tank was empty.

The ATSB identified multiple safety factors associated with the fuel quantity indicating system, the ability of the crew to recognise the left engine power loss, and their performance during the go‑around.

After the incident, the operator introduced revised procedures for measuring fuel quantity, and CASA initiated a project to amend the guidance to provide better clarity and emphasis. In March 2009, an EMB‑120 flight simulator came into operation in Melbourne, Victoria. CASA has advised that a Notice of Proposed Rule Making relating to simulator training requirements will be released by the end of July 2010 with a response period of six weeks. Final rule making is expected to be accomplished toward the end of the calendar year.

The occurrence does, however, also draw attention to several other significant safety issues that are also appearing in other investigations. These include a pattern of problems with stabilised approaches to landing, a number of instances of potential and actual accidents arising from inadequate fuel management, and some early indications of systemic problems with the handling of asymmetric engine conditions.

In each of these cases, the ATSB will be doing further work to establish the scope and scale of the problem. In the meantime, we encourage operators to make their own assessments in these areas to satisfy themselves that the risk is as low as reasonably practicable.

Finally, the ATSB draws attention to an aspect of its trend analysis of safety in general aviation. The fatality rate has not significantly varied over the last ten years, nor has the relative proportion of the major contributors to those fatalities: fuel management, controlled flight into terrain, wire strikes and visual flight in instrument conditions. Detailed investigation is adding little safety value. It is clear that a shift of emphasis to greater safety education is necessary.

This report tables rail safety occurrence data by state and territory between 1 January 2001 and 30 June 2010. Data is adjusted biannually to reflect new information that comes to light during the reporting period. There is a lag period of approximately 3 to 4 months between the end of the 6-monthly reporting period and publication of this data. The data is presented as counts, and normalised using kilometres travelled and number of track kilometres. Data presented in this report conforms to ON-S1: Occurrence Notification Standard 1 (2004) and OC-G1: Occurrence Classification Guideline 1 (2008). This report excludes tram, light rail and monorail operations.

Every pilot's worst nightmare is the thought of a collision with another aircraft. History shows that it can be just as catastrophic on the ground as in the air.

The industry's worst disaster remains the collision between two Boeing 747s on the runway at Tenerife in 1977, in which 583 people died.

According to the Federal Aviation Administration, the number one aviation safety issue in the United States is now runway incursions, which are occurring at a rate of about 230 a year.

In Australia the figures are a lot lower. The ATSB recorded a total of 89 runway incursions in 1996, 130 in 1998, and 113 in 1999.

Unlike the US, Australia has considerably fewer airports in controlled airspace and less daily traffic movement. But the numbers are significant enough to warrant closer inspection for trends and safety implications.

A runway incursion is an occurrence at an airport with an operating air traffic control tower that involves an aircraft, vehicle, person, animals or another object on the ground, and which creates a collision hazard or results in a loss of air traffic separation.

Using the Systemic Incident Analysis Model, [SIAM was described on page 33 in the last issue of Flight Safety Australia], an analysis of occurrence reports held by the ATSB reveals that the majority of runway incursions involve a failure to follow air traffic control instructions.

Approximately 85 per cent of runway incursions in the period 1997-1999 occurred after the failure of the defence of 'ATS procedures, facilities and standards'. Of the ATS failures, nearly 94 per cent are further classified as 'clearances and instructions' failures. In just over 90 per cent of the incursions, Air Traffic Services noticed the problem, and the situation did not become more serious.

The following example shows how a series of events can lead to a runway incursion, starting with a failure to follow instructions.

On Wednesday 22 July 1998 at Sydney airport a Boeing 737 and a Metro 111 narrowly avoided collision at the intersection of taxiway Juliet and runway 34L.

The Metro pilot was taxiing the aircraft on taxiway Juliet with instructions to taxi via taxiway Bravo and hold short of runway 25. The pilot read back the instructions correctly.

The pilot had experienced difficulties during a practice ILS approach under the supervision of a training captain and was distracted with thoughts of his performance. The training captain left it too late to warn the pilot that he had taxied the aircraft past the correct taxiway turn-off and only called for him to stop when he saw the aircraft landing on runway 34L.

The 737 was landing on runway 34L at the same time that the Metro overshot the runway holding point. The pilot could not stop the aircraft before the taxiway entry point and passed to the left of the runway centre line to keep clear of the Metro. It cleared it by about 25 metres while travelling at 80 knots.

The air traffic controller called for the Metro to stop about the same time as the check captain. The prompt action of the tower controllers was the final safety defence which stopped the aircraft from entering the runway.

Other examples show how incomplete communication and air traffic control actions can lead to a runway incursion.

On 14 May 1999 a Navajo Chieftain lined up on runway 34L at the intersection of taxiway B10 at Sydney at night. A Saab 340 had been cleared to depart prior to the Chieftain. Another Saab 340 was on final approach to land on the same runway.

When the departing Saab had been cleared to take off the arriving Saab was cleared to land. The pilot of the Chieftain was then given a conditional clearance to line-up on the runway behind the landing aircraft. In the same transmission, the pilot was also given instruction regarding the direction of turn and heading to adopt after becoming airborne.

The pilot of the Chieftain heard the line-up clearance and after take off instructions, but did not hear the condition that the aircraft should line up behind the landing aircraft. The pilot read back the instructions that he heard, but the controller did not notice that the condition on the line-up clearance was not read back.

The Chieftain lined up on the runway, sighted the aircraft on final approach to runway 34L, and expected an immediate take off clearance. The crew of the Saab noticed an aircraft on the runway and after contacting the tower commenced a go-round from a height of approximately 35 feet, overflying the Chieftain at a height of about 150 feet.

The controller had correctly issued the take off instruction, but did not detect the incomplete read back by the pilot. The controller did not notice with a normal visual scan or by referring to the surface movement radar that the Chieftain had already entered the runway contrary to its assigned clearance.

System defences

While system defences work by preventing a serious accident on many occasions, occurrence reports will often highlight the potential for a breach in the defences, leading to safety action to rectify a deficiency before it contributed to an accident.

At Perth airport on 9 October 1997 a B767 landed on runway 21 while a B737 was on final for runway 24. Visibility from the tower was poor due to low cloud and fog.

The controller reported that he was unable to see either runway clearly. As the B767 turned off runway 21 onto taxiway J the crew were instructed to hold short of runway 24. They were unable to comply with this instruction as their aircraft was already two to three metres past the holding point for runway 24. They reported their position to the controller who then instructed the crew of the B737 to go round. The B737 was 3 nm from the runway at the time.

The pilot in command of the B767 reported that he had not previously used taxiway J and that in the limited visibility the aircraft had reached runway 24 more quickly than expected. Although they had attempted to stop short of runway 24 the aircraft passed the holding point before all movement ceased.

Had the crew of the B767 not reported its situation immediately there were no other defences to prevent a possible collision between the aircraft.

Key safety messages

While the figures in the Bureau's database represent only those occurrences in an active control zone, they also highlight safety issues that apply to operations at non-controlled aerodromes.

The importance of pilot look-out, clear radio communications and go-round procedures feature regularly as one of the key safety messages, as the following catastrophic accident in the United States shows.

At Quincy Municipal Airport in November 1996 a number of passengers and crew were fatally injured when two aircraft collided at the intersection of two runways.

A Beech 1900C made a straight-in approach in visual conditions to Runway 13. At the same time, a Beech King Air began its take-off roll on Runway 04. Waiting behind the King Air was a Piper Cherokee (PA28).

The captain of the Beech 1900C reported his aircraft was on short final for Runway 13. He asked whether the aircraft in position on Runway 04 was holding or about to take off.

The King Air pilot did not respond, but the pilot of the PA28 did, and stated it was holding for departure on runway four. The US National Transportation Safety Board's (NTSB) report found the PA28 pilot's response to the Beech pilot's question was inappropriate since the PA28 was behind the King Air and not first in line for take-off.

Despite evasive action by the pilots of both aircraft, the Beech and the King Air collided on the ground at the intersection of the two runways. The weather was not a factor and all the pilots involved were properly rated, trained and qualified.

The NTSB determined the probable cause of the accident to be the failure of the King Air crew to effectively monitor the common traffic advisory frequency (CTAF.) Also implicated was their failure to scan for traffic. Contributing to the cause of the accident was the PA28 pilot's interruptive radio transmission. The crew of the Beech misunderstood his message.

In its discussion of the human factors involved in the accident, the NTSB concluded that the radio transmission by the PA28 pilot created some of the confusion that precipitated the accident. The pilot of the King Air was a retired airline captain and known to usually be in a hurry to get home. It is possible the crew in the King Air were not monitoring the CTAF.

Industry safety success

The key to the aviation industry's success in developing into a safe system is its defences. Many elements such as procedures, and hardware and software, play a part in providing a defence against the consequences of human error. When one or more of these system defences are breached, an incident can happen. If they fail, an accident may be the outcome.

The best defences against the hazards of runway incursions are by compliance with procedures, and for pilots to cross check and monitor their environment and actions to maintain situational awareness.

Put yourself in the position of the pilot in the occurrences described above. What would you have done? More importantly, what will you do from now on?*

One passenger was fatally injured when a helicopter crashed in bad weather near Cairns last year.

At 1130 on 12 March 1999 the Bell 206L-3 helicopter departed from Green Island on a routine passenger charter flight to Cairns airport. The helicopter took off in light drizzle and the pilot elected to track back to The Pier via the shipping channel.

The Bureau of Meteorology had issued an amended aerodrome forecast for Cairns at 0808 for the 24-hour period from 1000. It forecast an easterly wind at 15 knots, visibility of 9,000 metres and light rain. Some cloud patches were expected with a base of 800 feet a broken layer at 1,800 feet and overcast at 10,000 feet. Periods of up to one hour of heavy rain, scattered cloud at 800 feet and broken cloud at 1,500 feet were expected over the forecast period.

At 1139 the helicopter was cleared by Cairns Air Traffic Control to track to The Pier, not above 500 feet. The controller advised the pilot that within seven to nine kilometres from The Pier the cloud base was between 800 and 1,000 feet with some showers and visibility less than 10 kilometres.

As the helicopter continued along the shipping channel, the pilot noticed that the weather ahead was deteriorating. A short time later, he descended the helicopter to about 150 feet to keep the water surface in sight, and reduced speed.

The weather conditions continued to deteriorate, and eventually the pilot flew the helicopter at 50 feet or less above the water in light to moderate rain. By this time, he could no longer see any channel beacons.

The pilot turned on the windscreen demister as condensation had begun to form on the inside and he also armed the inflatable floats, which were fitted to the skid-type landing gear.

At about 1146 the pilot asked the controller for directions to The Pier. He was advised that The Pier was on a bearing of 205 degrees M, at a range of three kilometres (about 1.5 nautical miles). At about that time, visibility had deteriorated to the extent the pilot could not determine where the helicopter was.

Then, noticing that the helicopter had climbed to 100 feet altitude, the pilot placed it in a gentle descent to try and sight the water again. A short time later the helicopter contacted the water and rolled inverted.

The pilot and five passengers escaped from the fuselage, but one passenger was trapped inside the cabin and did not survive. One passenger sustained serious injuries, four experienced minor injuries and the pilot was uninjured.

Actual weather conditions

The air traffic controllers on duty in the tower said that the weather had been fluctuating significantly and rapidly throughout the morning. There were periods when the weather conditions met the criteria for VFR (Visual Flight Rules) flight and intervals of low cloud and very heavy rain, some of the worst conditions controllers said they had seen at Cairns airport.

Radar images and rainfall rates suggested that the visibility in the area of the accident would have been reduced to a few hundred metres or less. Personnel who were at The Pier at the time of the accident described the rainfall as torrential with visibility as low as one car length.

The weather information passed by the controller to the pilot was based on his visual assessment of the weather in Cairns Harbour as he saw it from the air traffic control tower.

Height speed and track

Air Traffic Services radar data confirmed that the helicopter was initially tracking via the Cairns Harbour shipping channel at about 100 knots and at an altitude of 200 feet above mean sea level.

At about seven kilometres from The Pier the speed gradually decreased to between 55 and 60 knots and then to below 40 knots. The last recorded speed was 31 knots. The altitude recorded during the last two minutes of the recording was 100 feet with one reading of 200 feet.

The pilot reported that during an earlier flight to The Pier the airspeed indicator was not functioning normally and did not indicate above 40 knots. He thought that the fault was probably due to water in the pitot-static system and expected it to clear during the flight to Green Island. However, the fault remained.

The airspeed indicator did not function during the flight when the accident occurred. The pilot said he relied on the ground speed display on the GPS (Global Positioning System) unit. The ATSB's occurrence brief stated that the GPS receiver records ground speed and not indicated airspeed.

Examination of the wreckage confirmed that the helicopter had struck the water in a slight left skid-low nose attitude, and at low forward and vertical speeds.

Circumstances and issues

A number of issues were highlighted as possible contributing factors to this accident.

There was an expectation from the helicopter company that the pilots would 'give it a go' if weather looked doubtful; to 'have a look before turning back.' However, there was no pressure to complete flights in unsuitable weather conditions.

The pilot held an ATPL (airline transport) licence with a total of 5,321 hours and 1,656.1 on the Bell 206L. His decision to track via the channel was based on his experience with mechanical turbulence on the alternative route, which was coastal via False Cape. The alternative route had proven uncomfortable for passengers in the lee of high terrain on the southern side of Trinity Inlet when the wind was a south or south easterly greater that 15 knots.

The pilot followed his usual practice during conditions of deteriorating visibility of descending to keep sight of the water and reduced airspeed. Although the visibility was poor, he continued with the flight because of his experience in similar conditions and the information from the controller which suggested that the weather would improve as he approached Cairns.

The pilot's night VFR rating was not current, and he disliked instrument flying since getting the rating in 1992. In any event, the helicopter was not Instrument Flight Rules (IFR) rated. In the prevailing conditions the pilot did not consider that turning at low altitude and flying back to better conditions was a safe option.

The pilot reported that the visibility during the return flight from Green Island was the worst that he had ever experienced. The sea surface had become completely flat and featureless and had blended entirely with the rain. By that time, it was too late to turn around.

He reflected that it might have been better to track coastal because the vegetation and other land features would have provided a higher level of visual contrast against the rain and cloud and may have enabled him to complete the flight safely. He would have been able to land the helicopter and await passage of the weather.

Investigation analysis

The formal analysis of this accident noted the following circumstance as valid contributors:

• The pilot continued the flight into adverse weather beyond the point of having a visual external reference.
• The risk of not being able to turn around onto a reciprocal track without visual clues was high as the pilot was not instrument rated and the helicopter was not IFR rated.
• The pilot's operating culture was conditioned from having 'got through' adverse weather on previous occasions.
• Having decided to track via the shipping channel because of turbulence consideration on the coastal route, the pilot overlooked the coastal route as an alternate course of action.
• The weather information passed by the tower controller probably placed an expectation in the pilot's mind that he could negotiate the weather successfully. *
• More details of this accident are contained in Occurrence Brief 199901009.

The ATSB receives around 15,000 notifications of aviation occurrences each year; 8,000 of which are accidents, serious incidents and incidents. It is from the information provided in these notifications that the ATSB makes a decision on whether or not to investigate. While further information is sought in some cases to assist in making those decisions, resource constraints dictate that a significant amount of professional judgement needs to be exercised.

There are times when more detailed information about the circumstances of the occurrence would have allowed the ATSB to make a more informed decision both about whether to investigate at all and, if so, what necessary resources were required (investigation level). In addition, further publicly available information on accidents and serious incidents would increase safety awareness in the industry and enable improved research activities and analysis of safety trends, leading to more targeted safety education.

To enable this, the Chief Commissioner has established a small team to manage and process these factual investigations, the Level 5 Investigation Team. The primary objective of the team is to undertake limited-scope fact-gathering investigations, which result in a short summary report. The summary report is a compilation of the information the ATSB has gathered, sourced from individuals or organisations involved in the occurrences, on the circumstances surrounding the occurrence and what safety action may have been taken or identified as a result of the occurrence.

The summary reports detailed herein were compiled from information provided to the ATSB by individuals or organisations involved in an accident or serious incident between the period 1 July 2010 and 30 September 2010.

One of the most dangerous situations a pilot operating under Visual Flight Rules (VFR) could be faced with is the complete loss of visual reference. In the last five years, 28 people have been fatally injured in such circumstances.

VFR flight into IMC

On 14 October last year, a VFR pilot with 220 hours flying experience set off from Lightning Ridge for Caloundra in a Cessna 182 in VFR weather. Although the weather forecasts looked reasonable when he took off, by the time he was overhead Goondiwindi the actual weather conditions were not looking good.

At about 1100 the radar controller noticed a secondary surveillance radar return (code 1200), operating in close proximity to the boundary of controlled airspace at about 5,600 feet above mean sea level.

By the time the controller was able to talk to the pilot at 1107:57, the aircraft was inside controlled airspace bearing 310 degrees M from Amberley at 30 NM. The pilot was immediately instructed to make a left orbit to maintain separation from an inbound F111 with an in-flight emergency.

During the orbit, the pilot advised the controller that he was caught in cloud and that he was in trouble. The controller tried to clarify what was happening and spoke to the pilot a number of times.

By the time the controller had established that the pilot wanted to track to Caloundra and while rated only for VFR flight was now non-visual, the pilot had commenced a second left orbit. Halfway through the orbit, passing a heading of approximately 240 degrees, the controller instructed the pilot to turn right and take up a northerly heading for Caloundra.

While in the right turn, the controller asked the pilot if he wanted to descend. The pilot replied yes and he was cleared to leave control area on descent.

The aircraft's altitude during the turn was erratic. It descended to 4,400 feet in less than a minute then climbed back to 4,800 feet. The pilot continued the right turn onto a heading of about 130 degrees then began a left turn to intercept the track from Toowoomba to Caloundra.

While the pilot was doing this, the controller told him that he could descend safely to 3,000 feet in the aircraft's current location. Once established on track to Caloundra, the aircraft maintained a steady heading with a rate of descent of about 300 feet per minute.

The controller then instructed the pilot to turn right heading 130 degrees, a turn of about 90 degrees, to avoid an area of higher terrain where the radars lowest safe altitude was 3,800 feet. The aircraft was passing through 3,700 feet when the turn began.

The aircraft continued to turn through the assigned heading and its ground speed and rate of descent increased. Its radar return disappeared from the radar display at about 1116 as it was passing through 3,200 feet on a heading of approximately 210 degrees.

The pilot's last broadcast was at about 1116 in response to a question from the controller.

The wreckage of the aircraft was located about 6.5km north of Esk on flat pastoral land. A nearby resident had called the emergency services at 1117:30 after he had observed a plume of fuel and debris.

The aircraft was in a left spiral dive when it impacted the ground. The weather was showery and cloud covered the tops of the hills. The aircraft was destroyed.

Some safety lessons

Air Traffic Services (ATS) emergency procedures are outlined in chapter 17 of the Manual of Air Traffic Services (MATS), which is a joint military/civil document. It covers the declaration of emergency phases and outlines procedures for handling in-flight emergencies, including situations involving flight confined to Visual Meteorological Conditions (VMC) but operating in Instrument Meteorological Conditions (IMC).

According to MATS, a pilot faced with this situation would have difficulty maintaining headings and altitude and perceiving aircraft attitude. ATS should try to reassure the pilot and limit communications to avoid diverting the pilot's attention from flying the aircraft.

Airservices Australia's In-flight Emergency Response (IFER) Training Manual gives more detailed guidance for handling a VFR in IMC situation. This manual advises Air Traffic Controllers to help an inexperienced pilot in distress with some reminders on aircraft handling such as concentrating on aircraft attitude (steady heading, wings level, constant speed); trusting what the instruments say; and when manoeuvring make gentle movements (climb, turns, descents) and to turn first then establish straight and level before climb or descent.

Controllers could also help a pilot by giving navigational information that would help to re-establish the aircraft in VMC. In communicating with the pilot, controllers should keep instructions simple and distractions to a minimum, while also instilling confidence and providing reassurance. It is also important to pass only one item at a time.

According to the IFER manual, communication style is important. It states that a VFR pilot in an IMC situation is under considerable stress and there is a need for ATS staff to convey empathy, patience and confidence. This would require staff to adopt a different technique to the customary delivery of information. It was vital that questions were not put in an interrogative manner.

The ATSB found that there was no record that the Australian Defence Force (ADF) had received copies of the IFER training manual from Airservices, and it, or an ADF equivalent, was not held at any ADF ATS unit. However, ADF units did hold copies of the Airservices IFER checklist, a document separate from the IFER training manual.

According to the ATSB's investigation the controller communicated with the pilot in an authoritative manner and questions were posed in an interrogative style. ATS staff referred to the IFER checklist but were unaware of the more detailed guidance contained in the training manual.

Outcomes

As a result of concerns regarding military air traffic control officers' awareness of in-flight emergency response practices and procedures for civil aircraft, the Bureau issued interim recommendation IR 19990190 to the Australian Defence Force on 16 December 1999. The ATSB recommended that the ADF review IFER training for air traffic services staff responsible for the provision of services to civil aircraft.

As a result, the ADF undertook a comprehensive review of IFER training, procedures and practices. The review concluded that Defence IFER management and training was capable of improvements and the Chief of Air Force directed that 11 recommendations arising from the review be implemented by 30 June 2000. The recommendations included enhancements to ab-initio and post-graduate IFER training, establishment of dedicated training officer positions within ATC flights and development of a formal Supervisors course, incorporating IFER and team/crew resource management instruction.

Despite the ATS issues that came to light after this tragic accident, the pilot flew on into IMC, a situation that was beyond his skills and experience. It is likely that he became spatially disoriented and lost control of the aircraft soon after descending through 3,200 feet.

The pilot of a Sikorsky S76 helicopter was left with only lateral cyclic control when a loose screw lodged at the base of the cyclic stick.

During transition from normal cruise flight to the approach to land the pilot found that the cyclic could not be moved aft. He also found that with any further forward movement of the cyclic stick it could not be moved aft of the new position.

The pilot froze the cyclic longitudinal position and the helicopter stabilised in a level pitch attitude at about 85 knots indicated airspeed. Using only lateral cyclic movements to manoeuvre the helicopter, the pilot conducted an 80-knot run-on landing on the runway at Barrow Island. A run-on landing utilises the aircraft's weathervane effect to streamline the fuselage until landing.

An inspection discovered that a panhead type screw was lodged at the base of the cyclic stick. The screw had lodged between the lower protrusion on the casting on the end of the cyclic stick torque tube and the lugs on a support bracket.

The cyclic stick base hardware is accommodated in a tub-like area formed by the cabin structure supports. A leather boot mounted at the base of the cyclic normally prevented foreign objects from entering the tub. Further inspection found the leather boot on this helicopter to be intact. With the boot in place, the only possible entry points for a screw is through a rigging pin hole in the aft mid-height position of the boot-halves joint, or vertically through an opening provided for the cyclic stick electrical wiring loom.

It was unlikely that the screw would have entered the tub area with the boot fitted. It was more probable that it was introduced during previous maintenance when the boot was removed.

After this incident and a similar incident experienced by another Australian S76 operator in 1995, an ATSB investigation was begun. The operator issued an alert message for its fleet of S76 helicopters to undergo an inspection of the subject area. A defect report was also submitted to the Civil Aviation Safety Authority.

The ATSB worked with the manufacturer to develop an acceptable solution that would eliminate the hazard.

The manufacturer conducted a design engineering review of the cyclic stick base hardware. It was agreed that an engineering design change, although extensive in nature, would more effectively reduce the effects of human factor maintenance error in this area.

The manufacturer advised that a field modification of the pilot's side bracket was being prepared to increase the gap between the torque tube rig boss and the bracket foot.

In October 1999, the manufacturer issued Alert Service Bulletin 76-64-44 outlining an inspection for foreign objects and procedures to modify both the composite controls cover and the cyclic stick support tube assembly. These modifications eliminate the foreign object interference problem.

Bob Kells and his investigation team had arrived at the accident site by helicopter. It had been at least a day since the Twin Otter had struck trees nine kilometres south west of Simbai in the Bismark Ranges, Papua New Guinea, when the crew had tried to fly it out of a steep valley.

It was an incredible sight. The fuselage was intact. The wings had been taken off by the trees. Ahead of it was a precipice -- a steep drop from which there may have been no survivors had the aircraft gone over.

It was a unique situation. Bob had been able to interview the crew in hospital, and they talked openly about what had happened. He had been on standby within hours of the crash as the civilian leader of a joint civil/military team of investigators. The army operated the aircraft but as it was a civil registered aircraft, the accident investigation fell under the jurisdiction of the PNG authorities. They had requested that the (then) Bureau of Air Safety Investigation conduct the investigation.

That was in November 1997. The final investigation report, number 9703719, was released to the public in June 1999. In that period, action had been taken on a series of recommendations that had highlighted significant deficiencies in the way the military had conducted tropical mountainous flying training in Papua New Guinea.

What types of lessons are learnt from investigations like this? What did this one teach the aviation industry?

According to Dr Rob Lee, Director, Human Factors, Systems Safety and Communications, if underlying organisational deficiencies are left unchanged, the same kinds of occurrences would continue to happen.

In the report, the crew of the Twin Otter was found to have been operating within an organisational environment that had a 'low level of experience and corporate knowledge regarding the operations of fixed-wing aircraft...in tropical mountainous areas'.

'Against this background, deficiencies were identified in the planning and preparation for the exercise, including risk assessment and the selection and briefing of the training pilot,' so the report states.

Aviation safety across the world relies on the thoroughness of accident and incident investigations and the timely reporting of the findings. Dr Assad Kotaite, President of the International Civil Aviation Organization (ICAO) said, 'Without this essential information the efforts of industry, aviation administrations and the ICAO cannot be effective in addressing hazards in the air transport system.'

Since the 1950's Australia has had one of the world's most comprehensive aviation occurrence reporting systems. By law, anything that affects the safety of flight must be reported.

Under Annex 13 of the ICAO Standards and Recommended Practices, Aircraft Accident and Incident Investigation, a mandatory reporting system must be in place and supported by a non-punitive voluntary system.

In 1988, Australia's mandatory open reporting system was complemented by the Confidential Aviation Incident Reporting system (CAIR), where the reporter's identity remains confidential. Through both systems, the ATSB receives thousands of reports annually.

Most of these reports are of a relatively minor nature. "In the mandatory reporting system, we get around about 5,000 incidents and about 3-400 incidents through the confidential system," Dr Lee said.

"One of the features of the Australian system, unlike say in the US where you only have to report certain categories of more serious incidents, is that the information from relatively minor occurrences can be analysed to see if there is an underlying reason that might be causing the occurrences," Dr Lee said.

In 1996 the Bureau reviewed the way it stored and collected air safety occurrence information. The Systemic Incident Analysis Model (SIAM) was developed and provided a better way of using occurrence data. It is based on the model developed by Professor James Reason of the University of Manchester, who developed a conceptual and theoretical approach to the safety of large, complex sociotechnical systems such as aviation.

Major investigations such as the PA-31 accident at Young (1993) the Boeing 747 accident at Sydney airport (1994) and the Class G airspace demonstration (1999) were undertaken and reported using the principles of the Reason model.

These investigations all had substantial impacts on rectifying major latent organisational deficiencies in the aviation system across government, corporate, regulatory and organisational areas.

According to Dr Lee, if these investigations had not been undertaken in accordance with the basic principles of the Reason model, the significant systemic safety outcomes would not have been achieved.

What safety lessons would be lost if there was no reporting culture?

A great many issues have been identified by the analysis of reports received through Australia's incident reporting systems. Numerous lessons have been learnt and actions taken as the following CAIR report from mid-1999 shows.

On taxi, we noted traffic of a C310 approaching the circuit and a C182 departing. Upon runway entry and TCAS switching to T/A R/A, we had indication of one aircraft only, which we identified as the C310. We then asked the C182 if it was transponder equipped and, if so, to switch it on. The reply was that they were equipped and that they would switch it on. It appeared to me that they hadn't forgotten to switch it on, but rather that they were unaware of the requirement to have it switched on. We subsequently got a return and used it to assist our separation procedures.

My view is that far too many aircraft are not using their transponders correctly. These are predominantly low hour or OCTA only pilots. I believe that having the relevant transponder operating procedures within the 'Radar Services and Procedures' section (both CASA and JEPPS) is misleading and results in this information being missed by pilots who never operate in a radar environment. I feel this information should be in the OCTA procedures section as well.

Response from Airservices

The use of transponders is clearly defined and adequately covered in AIP ENR 1.6 - Radar Services and Procedures - under Section 8. However, AIP Book A/L 26, effective 2 Dec 99, has a new section in ENR 1.1 which was submitted by CASA. The new section advice is as follows:

68.1

Pilots of aircraft fitted with a serviceable Mode 3A transponder must activate the transponder at all times during flight in non-controlled airspace, and if the transponder is Mode 3C capable, that mode must also be operated continuously.

68.2

For further information on the operation of transponders, including normal and emergency codes, see ENR 1.6 Section 8.

"Reporting systems serve as a vital early warning device, so it is important that people feel able to lodge a report on anything that they think is affecting safety (see table 2). New methods of analysing the information, such as the Systemic Incident Analysis Model (see Flight Safety March-April) demonstrate the operational value of a reporting culture. We have to know about problems before lives are lost," Dr Lee said.

A sound reporting culture is one of the best defences against that happening.

The ATSB has issued three safety recommendations arising from the ongoing investigation into the circumstances in which a Piper PA31-350 Chieftain ditched in Spencer Gulf SA with the loss of eight lives during a regular public transport (RPT) service from Adelaide to Whyalla on 31 May 2000 (Occurrence 200002157). The recommendations relate to mixture leaning procedures and the carriage and use of life saving equipment.

Immediately prior to the accident the pilot gave a MAYDAY report to Flight Service indicating that the aircraft had experienced two engine failures. The investigation found mechanical damage to both engines. The left engine had failed following a fatigue fracture of the crankshaft at the No. 6 connecting rod journal. Cracks of this type are created by the generation of thermal stresses in the journal surface.

The No. 6 connecting rod "big end" bearing had failed, and it was evident that engine operation had continued after the bearing shells had been broken down. The surface of the journal, and the journal radii, had been damaged extensively by the rotation of the journal against the connecting rod. Extensive thermal cracking was evident over the entire journal surface.

In the right engine a hole had developed near the top of the No. 6 piston, allowing combustion gases to bypass the piston rings. The hole had been created by an exposure to temperatures within the melting range of the piston material. There were no failures of any other structural components of the right engine.

The ATSB is examining a number of recent occurrences involving Textron Lycoming TIO-540 series turbo-charged engines, similar to those fitted to the PA31-350. Engineering analysis indicates that the engines had typically been operated at or near peak exhaust gas temperature (EGT).

The fuel mixture leaning practice adopted by the operators during cruise flight was based on EGT settings ranging between 50 degrees (F) rich of peak and 50 degrees lean of peak EGT. While this practice is in accordance with the PA31-350 pilot operating handbook, early results suggest that operations in that EGT range, in combination with other possible factors, may have contributed to induced engine damage due to detonation.

This is in contrast to other operators who have not experienced similar problems and use a more conservative leaning procedure by setting EGT at around 100 degrees rich of peak.

Induced damage may manifest itself through low compression, loss of power, erratic operation, metal contamination in filters or even complete engine stoppage. The underlying reasons for these symptoms can include burnt pistons, stretched or 'tuliped' valves, cracked spark plug ceramics or distressed bearings.

Operators can minimise the likelihood of such damage by eliminating the possibility of detonation. It can be insidious, and a pilot may not be aware that detonation is occurring.

Pending the outcome of its investigation of these issues, the ATSB suggests that, in addition to following the guidance provided in the pilot operating handbook, the operators of all turbo-charged engines avoid high cylinder temperatures through the adoption of a conservative approach to fuel mixture leaning practices.

Civil Aviation Orders 20.11 paragraph 5.1.2 details requirements for the carriage of life jackets for over-water flight. Multi-engine land aircraft authorised to carry nine passengers or less on RPT or passenger charter operations are not required to be equipped with life jackets or equivalent flotation devices unless the aircraft is operated over water and at a distance from land of greater than 50 NM. The Adelaide to Whyalla route was less than 50 NM from land.

Preliminary evidence indicates that the occupants of the Chieftain would have had sufficient time to don life jackets had they been provided. At least two of the occupants may have escaped from the aircraft after it ditched but subsequently drowned. Had life jackets or equivalent flotation devices been available it is possible that their chances of survival would have been greatly increased.

The Australian Transport Safety Bureau has recommended that:

• the Civil Aviation Safety Authority alert operators of aircraft equipped with turbo-charged engines to the potential risks of engine damage associated with detonation and encourage the adoption of conservative fuel mixture leaning practices. [R20000250].
• the Civil Aviation Safety Authority amend Civil Aviation Order section 20.11 paragraph 5.1.2 to remove the restriction that it only applies to aircraft authorised to carry more than nine passengers. [R20000248].
• the Civil Aviation Safety Authority ensures that Civil Aviation Orders provide for adequate emergency and lifesaving equipment for the protection of fare-paying passengers during over-water flights where an aircraft is operating beyond the distance from which it could reach the shore with all engines inoperative. [R20000249].