ATSB issues recommendations for improved aircraft design tolerance to inadvertent dual control inputs.

The Australian Transport Safety Bureau has issued Safety Recommendations to the European Aviation Safety Agency (EASA) and aircraft manufacturer ATR seeking improved aircraft system design tolerance to inadvertent dual control inputs by pilots.

The Safety Recommendations are contained in the ATSB’s final investigation report into an inflight upset and inadvertent pitch disconnect experienced by an ATR 72 turboprop airliner on a flight from Canberra to Sydney in 2014.

During that flight, as a result of a sudden decrease in tailwind, the ATR’s pilots unintentionally applied opposing control inputs to their control columns while trying to ensure the aircraft remained below its maximum operating speed. These differential forces activated the aircraft’s pitch uncoupling mechanism. Intended for activation in the event of one of the aircraft elevators being jammed, the pitch uncoupling mechanism resulted in a pitch disconnect, where the elevators could operate independently of each other.

With the pilots applying opposing control inputs and built-up tension within the flight control system, the pitch disconnect resulted in transient asymmetric elevator deflections, generating aerodynamic loads that exceeded the strength of the horizontal stabiliser (tailplane), causing significant damage.

The aircraft landed safely and was inspected by maintenance engineers but the damage was not detected. The aircraft returned to service and operated a further 13 flights before a subsequent inspection after a suspected birdstrike found it had sustained serious structural damage to its horizontal stabiliser, which was subsequently replaced.

Discovery of that damage was the catalyst for one of the ATSB’s most complex, thorough and protracted safety investigations.

Through the release of two interim reports, the investigation has already seen the aircraft manufacturer, aircraft operator and aircraft maintenance provider address a number of safety issues identified by the ATSB.

However, as part of its final report, the ATSB has issued a Safety Recommendation to EASA, recommending taking “further action to review the current design standard (CS-25) in consideration of effect that dual control inputs may have on control of aircraft.”

In addition, the ATSB has issued two Safety Recommendations to aircraft manufacturer ATR, recommending that ATR:

• assess the operational risk associated with limited tactile feedback between left and right control columns in the context of no visual or auditory systems to indicate dual control inputs; and
• perform a detailed review of the effects of dual control inputs on the aircraft’s longitudinal handling qualities and control dynamics to determine if there are any detrimental effects that could lead to difficulty in controlling the aircraft throughout the approved flight envelope and operational range.

“What this report seeks to achieve is to influence further incremental safety improvements,” ATSB Chief Commissioner Greg Hood said.

Aircraft and aircraft systems need to be designed in anticipation of and tolerant to foreseeable inadvertent flight crew actions.

“This serious incident demonstrates aircraft and aircraft systems need to be designed in anticipation of and tolerant to foreseeable inadvertent pilot actions.

“Further, when identified, aviation safety regulators and aircraft manufacturers need to address previously unforeseen aircraft design consequences during the operational life of an aircraft type.”  

Mr Hood said the investigation also highlights the importance of a full and proper inspection to detect aircraft damage and the need for the inspection to be fit for purpose and for inspections to be coordinated and certified to avoid a single point failure.

“The ATSB looks forward to EASA’s and ATR’s responses to our Safety Recommendation from this investigation.”

Read the final report: In-flight upset, inadvertent pitch disconnect, and continued operation with serious damage involving ATR 72 aircraft, VH-FVR, 47 km west-south-west of Sydney Airport, New South Wales, on 20 February 2014

Investigation highlights the importance of strong and effective risk-controls.

A collision involving two trams operated by a tram museum highlights the importance of strong risk controls and ensuring that any changes to procedures do not reduce a risk-control’s effectiveness, a new ATSB investigation has found.

The accident occurred in Loftus in Sydney’s south when a ‘J’ class tram, operated by the Sydney Tramway Museum, was parked on a downhill gradient using its air brakes with a hardwood chock applied under its wheel. With no one on board, the tram suddenly rolled away, heading towards another of the museum’s trams – a ‘Nagasaki’ class that was travelling in the opposite direction on the same line.

Sighting the approaching ‘J’ class tram, the driver of the Nagasaki applied the emergency brake and instructed all 16 passengers to evacuate immediately. All passengers and crew had exited the Nagasaki safely before the trams collided, with both trams sustaining minor damage.

In line with the museum’s procedures, the runaway tram’s handbrake had not been applied when it was parked and when air released from its brake system, a single hardwood chock was left to restrain the tram’s movement. Previously a softwood chock, which would deform and create a tight wedge, would have been placed under the tram’s front wheel, but the tram was able to roll over the hardwood chock.

The investigation highlights the importance of ensuring that any changes to a risk-control process do not reduce that risk control’s effectiveness.  

The investigation, conducted by the Office of Transport Safety Investigation on behalf of the ATSB, found that the hardwood chock was newly adopted, and its use had not gone through a change management process.

As a result of the investigation, the museum has taken a number of proactive safety measures, including making the application of handbrakes mandatory, and taking steps to ensure that trams are parked securely on level track.

The investigation also highlights the importance of ensuring that any changes to a risk-control process do not reduce that risk-control’s effectiveness.

Read the final report: Runaway and collision between 'J' class and 'Nagasaki’ class trams, Sydney Tramway Museum, Loftus, New South Wales, on 15 May 2016

ATSB calls for a review of runway lighting standards following airliner runway excursion at Darwin.

A runway excursion involving a Boeing 737 at Darwin Airport on 6 December 2016 draws attention to the effectiveness of centreline lighting on wider than usual runways.

Landing on a wet runway at night, with visibility reduced by heavy rain, the Virgin Australia 737-800 touched down more than 20 m to the right of the runway centreline. The aircraft continued to the side of the runway, and its right landing gear ran just off the edge, destroying six runway lights along a 400 m path before returning to the runway.

There were no injuries and only minor damage to the aircraft.

The ATSB found that a relatively small increase in crosswind had occurred at a critical time a few seconds before touchdown, and the crew were not aware how far the aircraft had deviated.

The two rows of lights alongside runway 29 at Darwin are further apart than what a flight crew would normally encounter, due to the relatively wide runway. The ATSB found that, in the absence of centreline lighting, this characteristic affected the crew’s ability to detect and correct the aircraft’s deviation.

“A wide runway without centreline lighting, such as at Darwin, poses a particular challenge for aircraft making approaches in darkness and heavy rain,” said ATSB Executive Director Transport Safety Mr Nat Nagy.

“In these circumstances centreline lighting greatly helps flight crews align the aircraft with the runway.”

While studying past reports of runway side excursions in reduced visibility, ATSB investigators discovered that a disproportionate number of them occurred on wider runways.

In response to the ATSB investigation, both the aircraft operator and airport initiated a number of safety actions, including providing flight crews with information about the specific risks of approaches to Darwin Airport at night in conditions with reduced visibility.

“It is important for pilots and operators to be aware of any circumstances that are different to what they usually encounter and account for it in their planning so that they are more likely to avoid being ‘caught out’ at a critical time,” Mr Nagy said.

The International Civil Aviation Organization (ICAO) recommends, but does not mandate, the installation of centreline lighting on wider runways. Of the two runways wider than 50 m in Australia, Darwin’s runway is the only one without centerline lighting.

The ATSB previously recommended the installation of centreline lighting at Darwin Airport after a 2003 runway side excursion. Its concerns were renewed following a 2008 hard landing though no recommendation was issued.

Darwin Airport is a joint military and civilian facility – the Department of Defence owns much of the airport infrastructure, including the runways, while Darwin International Airport operates the civilian aspects of it. Both have advised the ATSB that the installation of centreline lighting will be considered during any future runway works.

While studying past reports of runway side excursions in reduced visibility, ATSB investigators discovered that a disproportionate number of them occurred on wider runways. None of the studied excursions occurred on runways that had centreline lighting.

As a result, the ATSB issued a safety recommendation to ICAO to review the runway lighting standards in light of the new evidence available. 

Read the final report: Runway excursion involving Boeing 737, VH-VUI, at Darwin Airport, Northern Territory, on 6 December 2016

ATSB preliminary report into an Airbus Helicopters AS350’s collision with terrain near Woomera, SA.

The ATSB has released a preliminary report into an AS350 helicopter’s collision with terrain 60 km east of Woomera, SA, during powerline stringing operations on 20 March 2019.

The report outlines the established circumstances of the accident, in which the helicopter collided with a transmission pole during stringing operations for a new powerline to the Carrapateena mine site. The helicopter impacted terrain and the pilot, who was the sole occupant, received fatal injuries.

The ATSB deployed a team of five transport safety investigators to the accident site to examine the wreckage, interview witnesses, and recover a number of components for further examination.

The investigation is continuing and will include consideration of the pilot’s qualifications, experience and medical history, the maintenance documentation, and operational documentation.

A final report, which will include the ATSB’s findings and any recommended safety actions, is anticipated to be released in the first quarter of 2020.

However, should any safety issues be identified during the course of the investigation, the ATSB will immediately notify relevant parties so appropriate safety action can be taken.

Read the preliminary report: Collision with terrain involving AS350, VH-SZS, 60 km east of Woomera, South Australia, on 20 March 2019

The ATSB has renewed its partnership with the Defence Flight Safety Bureau.

The ATSB renewed its Memorandum of Understanding with the Defence Flight Safety Bureau (DFSB) during a brief signing ceremony in Canberra on 5 April.

The MoU provides a continuing framework for the ATSB and DSFB to cooperate in the investigation of aviation accidents and incidents, to provide mutual assistance, and to share expertise, training and resources.

Both organisations are committed to investigating accidents and analysing occurrence data under the ‘no blame’ philosophy, with the sole aim of preventing recurrences.

Under the MoU the two organisations can conduct joint investigations into aviation accidents and incidents, and assist with and participate in each others’ investigations.

Further, the MoU provides a mechanism for the Department of Defence to request ATSB assistance in areas of expertise such as failure analysis, cockpit voice recorder and flight data recorder analysis, analysis of head-up display and maintenance data, and digital animations; while the ATSB can request of DFSB assistance in areas such as aviation medicine, flight safety, systems engineering, aircraft avionics, and logistical support.

Pictured is ATSB Chief Commissioner Greg Hood and DFSB Director Group Captain Nigel Ward signing the MoU, witnessed by DFSB Deputy Director Safety Investigations, Wing Commander Sam Barnes.

Airbus is updating software on its A320 aircraft to ensure pilots receive alerts in priority.

Airbus is proactively updating software on its A320 aircraft to ensure pilots receive alerts at an appropriate level of priority during periods of multiple alerts and high workload.

The update follows an ATSB investigation into an unreliable airspeed indication and stall warning involving a Virgin Australia Regional Airlines Airbus A320 near Perth Airport on 12 September 2015.

While passing through 8,500 ft, the aircraft’s autothrust and autopilot disconnected and multiple system alerts were generated. The captain took manual control of the aircraft and continued the climb to 20,000 ft, and levelled off to troubleshoot the issues and plan a return to Perth.

On approach to Perth Airport while aligning with the instrument landing system, the stall warning activated. The warning stopped after six seconds and the approach was continued for a successful landing.

The ATSB found the autothrust and autopilot disconnect was the result of erroneous airspeed indications during the take-off and climb due to blocked pitot tubes. The erroneous airspeeds were not detected by the pilots but had been detected by the aircraft’s systems, which had triggered the disconnect and generated multiple alerts including a ‘NAV ADR DISAGREE’ alert.

… it is important that alerts and procedures be designed to ensure that the pilots can correctly diagnose the source of the erroneous information…

This alert requires the pilots to crosscheck the three airspeed indications and assists them in determining if the source of the alert is an airspeed or angle of attack disagreement. However, limited space in the alert message area meant it was initially pushed off the screen for engine-related alerts programmed with a higher priority but in this case not requiring immediate action by the crew.  

The crew’s high workload meant the procedures for these alerts initially were not actioned and they were unable to address the ‘NAV ADR DISAGREE’ alert for about eight minutes, by which time the airspeed discrepancies had corrected themselves.  

The ATSB found this sequencing of alert priorities and the alert’s associated procedure may have led the pilots to incorrectly identify the source of the alert as an angle of attack discrepancy, which the NAV ADR DISAGREE procedure advised had a risk of triggering an undue stall warning.

Combined with the multiple system alerts, which to the flight crew appeared to be unrelated, the flight crew thought the stall warning that activated during the approach was spurious and as such did not apply the stall recovery procedure. Stall warnings are triggered by angle of attack, not airspeed, and there were no indications that the angle of attack system was not functioning correctly.

ATSB Executive Director, Transport Safety, Mr Nat Nagy, said modern aircraft with multiple interacting systems can have many layers between the source information and the pilots. 

“The ATSB’s safety message from this investigation is where there is erroneous information from an information source, it is important that alerts and procedures be designed to ensure that the pilots can correctly diagnose the source of the erroneous information,” Mr Nagy said.

“Further, unless it is absolutely clear that it is erroneous, pilots should appropriately respond to stall warning alerts.”  

Airbus is currently in the process of updating the A320’s software so that the NAV ADR DISAGREE alert has a higher priority than the associated engine alerts. In the case of multiple alerts generated by unreliable airspeed, it will take precedence over the other associated alerts and be immediately visible to the pilots.

In addition, the ‘risk of undue stall warning’ message will be removed from the aircraft status related to the NAV ADR DISAGREE alert.

Read the final report: Unreliable airspeed indication and stall warning involving an Airbus A320, VH‑FNP, near Perth, Western Australia, on 12 September 2015

The derailment of an empty coal train highlights how track defects can deteriorate faster than expected.

The derailment of an empty coal train despite temporary speed restrictions being in place highlights how track defects can deteriorate faster than expected, a new ATSB investigation notes.

The incident occurred at Denman, NSW, as an empty Pacific National coal train was travelling from Kooragang Coal Terminal at Newcastle to Wilpinjong Colliery, near Mudgee. The train consisted of three 90-class locomotives and 92 coal wagons, with a total mass of 2,099 tonnes (not including the locomotives), and a total length of 1,510 m. It had slowed to comply with a 20km/h temporary speed restriction (TSR) put in place a week earlier after a routine track inspection had identified track geometry defects, including a long twist defect

Despite the application of the 20km/h temporary speed restriction, the long twist defect deteriorated faster than anticipated to a point where the left-hand wheels of the lead bogie of the 64^th wagon behind the locomotives mounted the rail. The left hand wheels then tracked across the railhead for 10 m before dropping off the rail. The right hand wheels of the lead bogie also dropped off the rail into the four-foot (area between the rails). As the wheels ran in a derailed state, they impacted the track fastenings and the foot of the rail. A number of rail-welded joints, sleepers and fasteners were damaged by the derailed wheels, while the Up rail suffered a full cross-section break at a weld joint.

Track defects may deteriorate faster than expected.

The rail break also broke the track circuit, which triggered a signal failure.

All the wheels of the lead bogie ran in a derailed state for approximately 690 m before striking the steel road plate of a level crossing and re-railing.

The train crew were unaware of the incident until they were notified by a network controller after a signal electrician, sent to investigate the signal failure, advised of track damage at that location. The train stopped approximately 71 km away from the derailment site.

After the earlier routine hi-rail inspection had identified the track issues, repairs to the defects had been scheduled for the day after the incident occurred. While the temporary speed restrictions had been put in place, issues with drainage and existing formation defects may have caused the long twist defect to deteriorate more quickly than anticipated.

The ATSB’s safety message from this investigation is that track defects may deteriorate faster than expected. Factors that can contribute to rapid deterioration should be considered when developing maintenance responses.

Read the final report: Derailment of freight train WG713, at Denman, New South Wales, on 19 January 2016

Preliminary report released into runaway loaded ore train.

The ATSB has released its preliminary report into the runaway loaded ore train, M02712, 211 km south of Port Hedland, Western Australia, on 5 November 2018.

A loss of communication between the head end locomotive and the end of train monitor triggered an automated penalty brake application, stopping the train as it approached Garden South.

The driver alerted train control of the emergency, confirmed handbrake requirements, placed the reverser control to neutral, turned the generator field off and applied the independent brake before exiting the locomotive cab to begin manually applying handbrakes to the train’s 268 ore cars while awaiting assistance from a maintenance ground crew. During this time, an empty ore train, M02727, stopped on the adjacent track due to the blocking protections set up after train M02712 had stopped.

About 30 minutes later, the ground crew arrived and train control requested they start applying handbrakes from the rear of the train and proceed toward the driver who was working from the front.

Approximately 60 minutes after stopping, while still applying handbrakes, the driver of M02712 heard air venting from the brakes and noticed the train move forward slightly before commencing to roll away. Shortly after the driver alerted train control M02712 was a ‘runaway’. The Automatic Train Protection system triggered a number of penalty brake applications but these were ineffective.

The investigation is ongoing and the ATSB is constrained about what further information it can release publicly at this time.

Four minutes later, the driver of the empty ore train (M02727) advised train control the ground crew had mistakenly applied handbrakes to his train and not to M02712.

M02712 continued the runaway, reaching a speed of 162 km/h before slowing on a rise toward Woodstock.

Train control set a crossover to switch M02712 between adjacent tracks at Turner South and Turner North to derail the train. M02712 travelled through the Turner South crossover at 144 km/h and derailed. The lead locomotives travelling a further 1.6 km before coming to a stop.

The derailment destroyed two locomotives, 245 ore cars and 2 km of track infrastructure at Turner South.

The investigation is continuing and will look at a number of factors including the design of train braking systems used by the operator and procedures in the operator’s safety management system.

This preliminary report does not include any findings or recommendations – these will be provided in the final report, which we anticipate to be released in the fourth quarter of this year.

It is important to note that the investigation is ongoing and the ATSB is constrained about what further information can be released publicly at this time.

Read the preliminary report: Runaway and derailment of loaded ore train M02712, near the 211 km mark south of Port Hedland, Western Australia, on 5 November 2018

The latest figures on wildlife strikes shows the importance of reporting to the ATSB.

The latest breakdown of aviation wildlife strikes around Australia shows the importance of timely and thorough reporting to the ATSB, with 2017 showing the highest number on record.

Between 2008 and 2017, there were 16,626 confirmed birdstrikes reported to the ATSB. The number of reported birdstrikes has increased in recent years, with 2017 having the highest on record with 1,921.

Despite being a high frequency occurrence, birdstrikes rarely result in aircraft damage or injuries.

The number of birdstrikes involving a bird ingested into an engine in high-capacity air transport operations has risen in recent years with about one in ten birdstrikes for turbofan aircraft involving a bird ingested into an engine. Additionally, over the ten-year reporting period, there have been 11 occurrences involving one or more birds ingested into two engines of turbofan-powered aircraft.

The number of reported birdstrikes has increased in recent years…

Australian aviation wildlife strike statistics provide a reminder to aircraft and aerodrome operators to be aware of the hazards posed to aircraft by birds and non-flying animals. The growth of reporting to the ATSB over the last 10 years has helped to understand better the nature of birdstrikes, and what and where the major safety risks lie. The more detailed the information that is provided to the ATSB, the more accurate and useful reports like this one will be.

For the first time, Australian national wildlife strike data is available via an interactive web tool, allowing users to focus in, and get the information most important to their operations.

Read the research report, AR-2018-035: Australian aviation wildlife strike statistics 2008–2017

Prior to take-off, pilots should consider options and actions in the event of a partial power loss.

The ATSB is urging pilots to take time before they take off to consider their options and actions in the event of a partial power loss. Self-briefing on this subject before take-off can reduce the decision-making load if a power loss does occur.

The ATSB’s investigation into the fatal accident of a DH82A Tiger Moth aircraft reflects the challenging situation faced during a partial power loss shortly after take-off.

The accident occurred on 28 December 2015, when the Tiger Moth departed Pimpama Airfield, Queensland to conduct a 20-minute local adventure flight with the pilot and one passenger. About 27 seconds after take-off, the pilot observed a change in engine noise and a reduction in engine RPM. He reported that he retarded and then fully advanced the throttle, but the engine only returned to a similar lower power condition.

The pilot assessed that, as the aircraft still had partial power, he would make a left turn and return to the airfield to land. Following this decision, the aircraft’s performance deteriorated further so he attempted to perform a forced landing in a cleared area. Soon after he started the turn, however, the aircraft stalled and began to enter a left spin. The pilot recalled applying full right rudder in an attempt to stop the spin but the aircraft collided with the ground.

The passenger, who was in the Tiger Moth’s front seat, was fatally injured, while the pilot sustained serious injuries.

A partial power loss presents a more complex scenario than a complete power loss.

The ATSB investigation was unable to determine the reason for the partial power loss, but found that when the aircraft entered the spin, there was insufficient height to recover before ground contact.

A partial power loss presents a more complex scenario than a complete power loss, where a forced landing is inevitable. When faced with a partial power loss, pilots must evaluate whether or not they should try to return to the airfield.

Pilots also have to take into account the possibility that power may continue to deteriorate, may stay at the same reduced level, or may return to normal.”

When an emergency landing is required, flying the aircraft in a controlled manner, wings level and at the recommended glide speed has a better survivability outcome than when control of the aircraft is lost.

The dangers of partial power loss after take-off are the subject of the ATSB’s publication Avoidable Accidents No. 3 - Managing partial power loss after take-off in single-engine aircraft. The booklet provides information and advice regarding this complex scenario.

Read the final report: Loss of control and collision with terrain involving de Havilland DH82A Tiger Moth, VH-UZB, near Pimpama Airfield, Queensland, on 28 December 2015