Safety summary

What happened

On the afternoon of 8 August 2019, a De Havilland Aircraft of Canada DHC-8-315 was being operated by QantasLink on a flight from Adelaide to Whyalla, South Australia.

The flight proceeded normally until just after top of descent when a loud repetitive banging noise started in the cabin. The cabin crew decided to break the protocols for the sterile cockpit environment to inform the flight crew, via the interphone, of the abnormal noise. The flight crew could not hear the noise in the cabin and were unaware of the situation.

Further investigation by the cabin crew identified that the noise was coming from the vicinity of the right rear emergency exit at seat row 10. They then identified a yellow object flapping on the outside of the aircraft, just below the exit. The flight crew concluded that the right ditching dam had likely deployed. The decision was made to continue to Whyalla, where an uneventful landing was conducted.

After landing, it was confirmed that the right rear emergency exit ditching dam had opened in flight, and had been destroyed by aerodynamic forces.

What the ATSB found

The operator subsequently determined that the ditching dam had not inflated but rather, for reasons that could not be determined, the ditching dam cover had opened in flight, allowing the uninflated dam to unfurl into the slipstream. The opening of the ditching dam did not affect the safety of other aircraft systems or the continued flight.

The cabin crew informing the flight crew of the issue while the aircraft was on descent had the potential to be a distraction. However, the cabin crew’s decision to break the sterile cockpit environment and alert the flight crew to the situation was appropriate.

Safety message

Not every system in an aircraft is controllable or monitored by the flight crew. Cabin crew should not hesitate to inform flight crew of abnormal conditions within or external to the cabin, as flight crew may be unaware of the situation.

The occurrence

What happened

On the afternoon of 8 August 2019, a De Havilland Aircraft of Canada DHC-8-315 was being operated by QantasLink on a flight from Adelaide to Whyalla, South Australia. For both the flight crew and cabin crew, it was the first of four scheduled passenger flights for the day. The captain was the pilot flying and the first officer was the pilot monitoring.^[1] The planned flight time to Whyalla was approximately 35 minutes.

Conditions for the flight were as forecast, with severe turbulence and icing conditions at lower levels. Once the aircraft reached the cruise altitude of 16,000 ft, it was clear of cloud and the crew described the conditions as calm.

At top of descent, the first officer made a public address to the cabin informing the cabin crew to ‘Prepare the cabin for landing’. This was acknowledged by the first flight attendant over the aircraft interphone. At this point, a loud repetitive banging noise started in the cabin.

The cabin crew initially suspected the sound was ice coming off the propellers and hitting the fuselage, which they had been briefed on before the flight. However, both cabin crew were confused by the volume and intensity of the noise, which did not align with their previous experience of flying in icing conditions. The cabin crew decided to break the sterile cockpit environment (see the section titled Sterile cockpit procedures) to inform the flight crew, via the interphone, of the abnormal noise in the cabin.

Up until that time, the flight crew were unaware of the issue and their only indication of a problem was being able to hear the noise when talking to the cabin crew over the interphone. There were no cockpit warnings. The captain transferred flying duties to the first officer so he could coordinate the cabin crew investigation, radio communication and decision-making tasks. The descent was halted and the aircraft held at the Whyalla RNAV holding point.

Upon further investigation by the cabin crew, they identified the sound was coming from the vicinity of the right rear emergency exit at seat row 10. Shortly after, they identified through the window a yellow object flapping on the outside of the aircraft, just below the exit. Based on this information, the flight crew concluded that the right ditching dam had possibly deployed (see the section titled Ditching dam).

The flight crew contacted their maintenance organisation and a decision was made to continue to Whyalla. The captain resumed pilot flying duties and the aircraft landed without further incident.

After landing, it was confirmed that the ditching dam at the right-hand rear emergency exit had opened in flight and been destroyed by aerodynamic forces (Figure 1).

Post-flight maintenance

It was subsequently determined that the ditching dam had not inflated but rather, for unknown reasons, the ditching dam cover had opened in flight, allowing the uninflated dam to unfurl into the slipstream. When the replacement ditching dam assembly cover was installed, it did not initially meet the required engagement tolerance into the airframe channel that retains it. The flight crew member who conducted the pre-flight inspection reported that the ditching dam cover was securely engaged before the flight.

Figure 1: The ditching dam as found upon landing

Source: Qantaslink. Annotated by ATSB.

Context

Ditching dam

The ditching dam on the rear Type III emergency exits of a DHC-8-315 is an inflatable device that activates on operation of the exit hatch to minimise water ingress into the cabin after a ditching or landing on water. The device is only required for high-weight operations when the aircraft would sit lowest in the water. For the occurrence flight, the aircraft would not have required the ditching dam to be available. The inflation is automated and there are no controls or indications in the cockpit of its deployment.

Previous occurrences

A review of reports on inflatable ditching dams for De Havilland Aircraft of Canada DHC-8-300 series aircraft was conducted using the following sources:

• Australian Transport Safety Bureau’s Aviation Occurrence Database
• Civil Aviation Safety Authority’s Defect Report Service (DRS)
• Federal Aviation Administration’s Service Difficulty Reporting (SDR)
• Transport Canada’s Continuing Airworthiness Web Information System (CAWIS).

Since 1982, there were a total of 22 reports, of which 13 were in-flight deployments. Most in‑flight deployments were due to leaking fuselage adaptor burst discs or discs that had burst for unidentified reasons. When this occurs, leaky inflation bottle valves or fuselage pressurisation can lead to the ditching dam bag inflating.

However, five in-flight deployments were not the result of inadvertent inflation of the bag, with no reason for the deployment identified. Three of the reports stated that the deployment occurred during either cruise or descent.

None of the reports indicated any subsequent damage or interference with other aircraft systems.

Sterile cockpit procedures

A sterile cockpit environment incorporates procedures throughout safety critical phases of flight, such as take‑off and landing, during which non-essential activities and communications are not permitted. For approach and landing, many operators start the sterile cockpit environment following acknowledgement of the ‘Prepare the cabin for landing’ call. While it is primarily focused on communication between flight crew members, it also applies to cabin crew contact with the cockpit.

With the introduction of reinforced cockpit doors, it has been recognised that this has had the effect of introducing an additional psychological barrier between flight crew and cabin crew. There has been a history of misunderstanding and hesitancy by cabin crew of informing flight crew of critical and sometimes life-threatening situations occurring in or external to the cabin of the aircraft^[2].

Safety analysis

The specific reason for the ditching dam cover opening could not be determined.

While the aircraft had operated in both severe icing and turbulence during the initial part of the flight, conditions were benign when the device opened. However, it is possible that earlier exposure to these severe weather conditions may have affected the security of the cover.

It was reported that the cover was secure prior to the flight, but post‑occurrence replacement of the ditching dam identified that it did not initially meet the required engagement tolerance into the airframe retaining channel. That raised the possibility that the occurrence cover may have appeared to be visually secure during the pre‑flight inspection while also not being properly engaged.

Once the cover partially opened, aerodynamic forces drove the cover fully open and permitted the dam bag to unfurl into the airstream. The bag, cover and inflation hose then hit the fuselage repeatedly, which was the loud noise heard by the occupants of the aircraft. As a result of the deployment and given its location on the aircraft, if the device or part thereof had come loose, it was unlikely to have resulted in further damage to the aircraft.

The ditching dam opened when flight crew had initiated the sterile cockpit procedures for approach to Whyalla Airport. The cabin crew chose to break the sterile cockpit environment to inform flight crew of the issue. This had the potential to distract the flight crew from other flying-related tasks. However, this was appropriately balanced by the need to inform the flight crew of an abnormal situation of unknown severity. The ATSB considered that the cabin crew acted appropriately in informing the flight crew of the abnormal noise in the cabin. Management of the unexpected deployment was controlled through the use of non‑normal checklists and effective resource management.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The ditching dam cover opened in‑flight, possibly due to exposure to severe icing and turbulence and/or improper engagement of the cover with the airframe.
• The deployment of the ditching dam did not increase the risk of damage to other aircraft systems or to continued safe flight.
• The ditching dam deployment occurred when flight crew had started sterile cockpit procedures but before cabin crew were required to be seated. It was appropriate that the cabin crew chose to break the sterile cockpit environment to inform flight crew of the issue.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. FAA AC 120-48A ‘Communication and Coordination Between Flight Crewmembers and Flight Attendants’, dated 27 January 2020.

Safety summary

What happened

On 12 August 2019, a Piper Aircraft Inc. PA-36-300, registered VH-TVU (TVU), departed Latrobe Regional Airport, Victoria, at 0830 Eastern Standard Time, on a ferry flight to Coffs Harbour, New South Wales. The aircraft had recently been sold and the new owner had arranged for the aircraft to be ferried to New Zealand. Shortly after take-off, the engine power reduced to below idle. Faced with limited options, the pilot conducted a forced landing into a paddock. During the approach, the aircraft struck power lines and subsequently contacted a fence and tree stumps during the landing. The pilot suffered minor injuries and the aircraft was substantially damaged.

What the ATSB found

The ATSB found that the engine power loss was probably the result of water‑contaminated fuel, and that the methods used to detect and remove the water before the flight were unreliable. An inspection of the fuel control unit also detected additional contamination that may have hindered fuel flow to the engine.

Finally, the aircraft was utilising the chemical hopper as a ferry fuel tank, contrary to the recommendation of the aircraft manufacturer, and no approved technical data could be provided on the installed fuel system.

Safety message

This accident highlights the danger of water‑contaminated fuel, a topic discussed in CASA Airworthiness Bulletin AWB 28-008. While this bulletin is related to aircraft using AVGAS or MOGAS, it is also relevant to the use of turbine fuel. It discusses the issue of water entering the fuel system through poor fitting, unapproved, incorrectly adjusted, or failed seals on the fuel caps or damaged/distorted tank filler necks.

When conducting fuel contamination checks, it is important that the check is positive and does not rely on sensory perceptions of colour and smell, as these can be deceptive. There are a number of ways this can be done:

• place a small quantity of known fuel in container before taking the fuel sample
• use a water-detecting paper or paste
• check for cloudiness or other evidence of suspended water droplets, particularly in turbine fuel.

The accident also illustrates the importance of being mentally prepared for an emergency. In this case, the pilot had secured the seatbelts over their flying suit prior to take-off. The pilot had also conducted a pre-take-off brief, so was prepared to take immediate action when an engine power loss occurred. An article in Flight Safety Australia ‘Your one and only: mitigating the risk of engine failure in singles’ advises that:

Rather than passively waiting for power loss and falling back on trained responses, pilots must actively defend their aircraft against the consequences of engine failure. Know your aircraft and procedures. Fly as high as practical, keep your options open and have a clear plan rehearsed for engine failure during every sequence of flight.

The investigation

The occurrence

On 12 August 2019, at around 0820 Eastern Standard Time,^[1] a Piper Aircraft Inc. PA-36-300, registered VH-TVU (TVU), departed Latrobe Regional Airport, Victoria, on a flight to Coffs Harbour, New South Wales, the first leg of a ferry flight to New Zealand.

On the day before the accident, the pilot detected water in the fuel within the chemical hopper (hopper), which was being used as a fuel tank, and consequently fully drained approximately 40 L of fuel from the hopper by opening the bottom cam lock. The aircraft was then refuelled to full, including the hopper, and the pilot reported that they^[2] conducted a fuel drain to check for water contamination. The fuel was drained from each aircraft fuel tank into two opaque 3-litre containers. Fuel from one container was ignited to confirm it was fuel. The second container was examined a significant time after the accident, and a small amount of water was identified. The pilot advised it was not raining when the aircraft was refuelled, but it had been raining in the days prior.

The pilot arrived at the aircraft on the morning of the accident, and conducted a pre-flight inspection, including another fuel drain. The fuel was checked by sight and smell and the pilot did not detect any water.

The plan was to fly to Coffs Harbour where the aircraft would be refuelled and then flown to Lord Howe Island, for the first section of the over-water flight to New Zealand. The pilot was prepared for a long, cold flight that day and wore a thick neoprene flying suit with Nomex flying gloves. They were not wearing a helmet, because the flight was not an agricultural operation. After entering the cockpit, the pilot adjusted the four-point harness to fit tightly over their flying suit.

The pre-take off checklist was actioned, and the main fuel tanks were selected for the take-off, with the hopper fuel tank selected OFF. The pilot conducted a pre-take-off safety brief and lined up on runway 21 with a crosswind, as this runway provided more landing options if the engine failed after take-off. After the departure, a left turn on to the crosswind leg of the circuit was conducted followed by a turn to the north, staying below the overcast cloud at around 500 ft above ground level. The pilot planned to track east of the airport over a semi-rural area (Figure 1), continuing in a northerly direction before joining the departure track to avoid a township further to the east.

As the take‑off flap was raised and the departure course set, the engine power reduced to below idle, and the aircraft could not maintain height. The pilot immediately selected the electric fuel pump to ON and set the igniters to continuously ON. A paddock was selected, which the pilot later advised was not ideal as it had a downwind component but was the best landing site option among the properties in the area.

Figure 1: Latrobe Valley Airport and the accident site

Source: Google Earth annotated by ATSB

During the approach to the paddock, the pilot detected power lines directly ahead and elected to descend below them. While flying under these, the propeller struck and cut a smaller power line running beneath the main lines on the same poles, which the pilot had not seen.

The selected paddock had a fence running down the middle. To ensure this was not struck while the aircraft was airborne, the pilot intentionally landed the aircraft hard before reaching the fence. The right wing struck one of the fence posts resulting in separation of the outboard wing section. A number of tree stumps in the paddock were also struck, removing the undercarriage legs (Figure 2).

As the aircraft came to a stop, the pilot undid the harness and moved away from the aircraft in case it caught fire. When this did not occur, they returned and, as the engine was still running, pulled the condition lever back to idle and selected the master switch to OFF.

The pilot did not dump the fuel in the hopper during the forced landing sequence, to avoid contaminating the houses in the area.

Figure 2: VH-TVU after the accident with undercarriage and right-wing section missing.

Source: Pilot

Context

Aircraft

The aircraft was a Piper Aircraft Inc. PA-36-300 single engine, low-wing, agricultural aircraft, which had been fitted with a Pratt & Whitney Canada PT6A-20 turboprop engine. The aircraft had recently been refurbished and a hot section inspection had been completed on the engine. It had received an export certificate of airworthiness, indicating that all required maintenance had been completed.

Weather

Weather observations at Latrobe Valley Airport showed that there had been significant rainfall in the days before the accident (Table 1).

Table 1: Rainfall at Latrobe Valley

Source: Bureau of Meteorology

The pilot advised the aircraft had been flown to Latrobe Valley Airport the week before the accident and had been parked on the apron since.

Main fuel system

Each wing had a bladder-type fuel tank filled with reticulated polyurethane foam to prevent fuel sloshing in the tank. The tanks were filled separately through a cap on each wing. They each fed into a small header tank, with a single on/off valve. An electric fuel pump acted as a primer and as a back-up fuel pump if the engine driven fuel pump failed. Fuel drains were located on the underside of both wings, on the fuel filter and on the underside of the fuselage, which was the drain for the header tank.

An inspection of the fuel caps following the accident found that the seals were in good condition. It also showed that the necks on the fuel tanks were raised to avoid water running into the tanks.

According to the United States Federal Aviation Administration Advisory Circular AC 20-125:

Water can enter the aircraft fuel system through leaks in the vents, seals, or poorly fitting fuel caps on filler openings during rain … by condensation and precipitation (especially when an aircraft has partially filled tanks) …

and that:

Water occurs in aviation fuel in two forms: dissolved and free:

Dissolved water: all aviation fuels dissolve water in varying amounts depending upon the fuel composition and temperature. Dissolved water in fuel is similar to humidity in air. Lowering the fuel temperature will cause dissolved water to come out of solution as free water.

Free water: Any water in excess of that which will dissolve is called free water. Free water can appear either as water slugs or as entrained water (suspended tiny droplets of water in fuel).

Aircraft engines can tolerate a small amount of free water (30 parts per million is usually considered maximum) if it is in a fine and uniformly dispersed state.

Smaller amounts of entrained water can be detected by testing with a clean and dry clear glass bottle. If fuel is acceptably dry it will appear bright with fluorescent appearance and will not be cloudy or hazy.

Chemical hopper

The aircraft had been configured to use the hopper as a ferry fuel tank. The door for the hopper hinged at the rear and sat over a raised rim that pressed into a seal (Figure 3).

Figure 3: Chemical hopper

Source: Supplied

The hopper fuel tank was selected ON using an ON/OFF tap in the cockpit. This connected to the main fuel system before the main fuel filter, ensuring the fuel passed through two filters before it entered the fuel system. No approved technical data could be provided to show how the system was installed in the aircraft.

Additionally, the pilot’s operating handbook stated that:

The chemical hopper is not designed for the storage of fuel; therefore, the use of the hopper as a spare fuel tank is not recommended.

Aircraft fuel checks

Civil Aviation Order 20.2 Air service operations – Safety precautions before flight part 5 ‘Fuel system inspection’ advised:

It is important that checks for water contamination of fuel drainage samples be positive in nature and do not rely solely on sensory perceptions of colour and smell, both of which can be highly deceptive. The following methods are acceptable:

1.   Place a small quantity of fuel into the container before taking samples from tank or filter drain points. The presence of water will then be revealed by a visible surface of demarcation between the two fluids in the container.

2.   Check the drainage samples by chemical means such as water detecting paper or paste, where a change in colour of the detecting medium will give clear indication of the presence of water.

3.   In the case of turbine fuel samples, tests should also include inspection for persistent cloudiness or other evidence of the presence of suspended water droplets, which will not necessarily be detected by methods mentioned in notes 1 and 2. Should any doubt exist of the suitability of the fuel, the checks specified in the aircraft Operators Maintenance Manual should be followed. It is advisable to allow turbine fuel a reasonable period of stagnation before drawing test samples from fuel drain points; this allows settling of suspended water which is a slower process in turbine fuel than in aviation gasoline.

This order also stated:

If, at any time, a significant quantity of water is found to be present in an aircraft fuel system, the operator and pilot in command must ensure that all traces of it are removed from the fuel system, including the fuel filters, before further flight.

Note:  In eliminating water from an aircraft fuel system, it is important that consideration be given to the possibility of water lying in portions of the tanks or fuel lines where, because of the design of the system or the existing attitude of the aircraft, it is not immediately accessible to a drain point.

Pilot experience

The pilot had around 24,500 hours of flying experience with about 400 hours on the aircraft type. They had flown TVU extensively a number of years previously and had recently ferried it to Latrobe Valley Airport. The pilot had about 6,000 hours flying in aircraft with PT6 engines.

Engine inspection

An inspection of the engine, conducted 7 weeks after the accident, did not find any defect or degradation that would have contributed to the engine power loss. However, the inspection identified a significant quantity of water in the fuel system, including in the airframe fuel bowl, fuel pump, and the fuel control unit (drained at the flow divider) (Figure 4).

Figure 4: Photographs of water detected in the fuel system

Source: Provided by aircraft insurer, annotated by ATSB

Based on engine data (Figure 5), there was no indication of an engine surge that caused the power reduction. Unexplained variation of fuel flow was recorded prior the power reduction. Pratt and Whitney Canada reviewed the data and consider the fuel flow recording is inaccurate.

Figure 5: Engine data

Legend: ITT - Interstage turbine temperature: WF - Fuel flow; NG - Gas generator rotation speed indication

Source: Provided by the aircraft insurer

Fuel control unit

The fuel control unit (FCU) was sent to a specialist PT6 engine accessory overhaul facility for detailed technical examination. That investigation determined that there was contamination (an off-white jelly substance that could be the result of incorrectly mixed anti‑icing additive) in the fuel section of the FCU, which may have hindered or resulted in abnormal fuel flow (Figure 6). The pilot advised that they did not use anti-ice additives. Evidence of blue grease was present at the drive shaft bearing retaining plate. This was indicative of a previous fuel or oil leak with the potential to damage the FCU bearing due to insufficient lubrication. No further detail was available at the time of writing.

Figure 6: Contamination within the fuel control unit

Source: Provided by the aircraft insurer, annotated by ATSB

Safety analysis

During the departure, when the aircraft was operating at about 500 ft to avoid low-level cloud, the power level reduced below idle. The low altitude left the pilot with little choice in the selection of the area to conduct the forced landing. Consequently, the landing was conducted with a downwind component, in a paddock with obstacles, resulting in substantial aircraft damage.

Based on the significant quantity of water identified in the aircraft fuel system components after the accident, and the absence of any other engine defect, the ATSB concluded that the engine power loss was probably the result of water contamination. The water detected in the hopper during the aircraft inspection on the day before the accident indicated that, despite the seal and lip, water could enter the chemical hopper. Therefore, it was considered a possible source of water contamination to the fuel system. However, as the ferry fuel system was reportedly not used during the accident flight, there was no obvious mechanism for such contamination to enter the aircraft’s fuel system. It is also possible that the water entered the wing tanks while the aircraft was exposed to rain in the days leading up to the accident, as the fuel tanks were only partially filled.

The methods used to check for water in the fuel—opaque sampling containers/fuel sight and smell were not in accordance with the Civil Aviation Safety Authority and United States Federal Aviation Authority guidance for pre-flight fuel testing and did not assure that there was no suspended water droplets—a particular risk with turbine fuel. Nor did they ensure that the fuel drain conducted on the morning of the flight, was free of water.

Given the elapsed time between refuelling and the accident flight, it is possible that any suspended water separated out overnight as the fuel cooled. In that case, the change in aircraft attitude associated with the departure and level off may have permitted water to move to the fuel pick up in the fuel tanks, resulting in the power loss.

However, the engine data showed that the engine did not surge when the power loss occurred. This could indicate that the water droplets had stayed in suspension and resulted in the engine not producing enough power to maintain flight. The time between the accident and the engine inspection would have allowed any water droplets to separate out of suspension from the fuel, as found during the examination.

In addition to the water found in the fuel, the examination of the fuel control unit showed additional contamination and grease washout, which may have also hindered the fuel flow to the engine. However, there was insufficient available information to determine if that occurred.

Finally, the use of the chemical hopper as a ferry tank was contrary the manufacturer’s advice and no approved technical data was available for the modification. Using approved and documented engineering processes to make changes to a safety-critical aircraft system is important, as it ensures the design complies with applicable airworthiness standards or an equivalent level of safety.

Findings

From the evidence available, the following findings are made with respect to the power loss and forced landing involving a Piper Aircraft Inc. PA-36-300, registered VH-TVU that occurred near Latrobe Valley Airport, Victoria on the 12 August 2019.

Contributing safety factors

• Due to a layer of low cloud, the aircraft was operating at low level over a semi-rural area when the engine power reduced to a level below that required to maintain altitude.
• The engine power loss was probably due to undetected water contamination in the fuel and possibly additional contamination/mechanical issues with the fuel control unit.

Other factors that increased risk

• The chemical hopper was being used as a ferry tank contrary to the recommendation of the aircraft manufacturer and no approved technical data could be provided on the installed fuel system.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot’s recollection of the accident flight
• photographs taken on the day of the accident
• Bureau of Meteorology
• maintenance organisation for VH-TVU
• aircraft and engine manufacturers
• Civil Aviation Safety Authority.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• pilot of the accident flight
• aircraft owner
• previous aircraft owner
• Civil Aviation Safety Authority
• aircraft maintainer
• Pratt & Whitney Canada
• the Transportation Safety Board of Canada
• the National Transport Safety Board
• Piper Aircraft Incorporated.

Submissions were received from:

• pilot of the accident flight
• Pratt & Whitney Canada.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Gender-neutral plural pronouns are used throughout the report to refer to an individual (i.e. they, them and their).

Safety summary

What happened

On 6 August 2019, at 1103 Eastern Standard Time, a Liberty XL-2, registered VH-XLK, departed Moruya Airport, New South Wales, for a rural property near Braidwood. The pilot was the sole occupant and had been flying in company with another pilot.

The accompanying pilot landed their aircraft on a private landing area at the Braidwood property about 15 minutes prior to the arrival of VH-XLK. That pilot advised the pilot of VH-XLK by phone that the landing area was undulating and not suitable for the Liberty XL-2 aircraft type. At about 1126, witnesses on the ground observed VH-XLK circling the landing area with a slowing airspeed.

On the second orbit, at about 400 ft above ground level, and after crossing the marked end of the landing area, witnesses observed the left wing drop and the aircraft entered a steep rotating descent. The pilot was unable to recover control of the aircraft before it impacted terrain. The pilot sustained fatal injuries and the aircraft was destroyed.

What the ATSB found

Recorded data showed that the pilot was circling the landing area at a height of 200–400 ft. The ATSB also found that the aircraft departed controlled flight after slowing and turning downwind with no flap selected. The left wing stalled, and this resulted in the aircraft entering into an upright spin, at an altitude that limited an effective recovery.

An airworthiness directive requiring an inspection of the engine exhaust muffler had not been completed, however this did not contribute to the accident.

Safety message

The accident highlights the need for pilots to minimise the risk of aerodynamic stall, particularly when in proximity to the ground, such as during take-off and landing. Turning manoeuvres at or close to the aircraft’s critical angle of attack, if mishandled, can lead to a stall that may result in the aircraft entering a spin. Pilots can limit their risk of losing control in flight by maintaining situational awareness of the aircraft state while conducting turns, maintaining adequate airspeed through appropriate power application during increased bank angles, and by selecting altitudes to operate at that provide sufficient height to recognise and recover from a stall.

In addition, aircraft owners should ensure that required maintenance and airworthiness directives are completed and recorded as they become due, to avoid invalidating the aircraft maintenance release and potentially increasing risk to flight safety.

The occurrence

Events prior to the accident flight

On 4 August 2019, the pilot of a Liberty XL-2, registered VH-XLK, departed Camden Airport, New South Wales, on a private flight to Adaminaby Airstrip to attend a social function. The pilot met a friend, who was flying a recreational aircraft, at the airstrip. That night, both pilots stayed at Adaminaby before departing the next day to fly around the local area before heading to Merimbula.

On arrival at Merimbula Airport on 5 August, the pilot refuelled VH-XLK with about 73 L of aviation gasoline and then continued in company with the other aircraft to Moruya Airport, where both pilots stayed the night. They met some aviation friends for dinner before retiring back to their accommodation early in the evening.

On 6 August 2019, both pilots planned to fly to a property located 9 km to the north-east of Braidwood to meet friends that owned the property (Figure 1). This was the first time an aircraft would use the freshly prepared landing area on the property. The pilot of VH-XLK then intended to continue on to Camden Airport later that day.

Figure 1: Aircraft’s flight path and accident site location

Source: Google Earth, modified by the ATSB

Accident flight

Due to the performance differences between the two aircraft, the pilot of the slower recreational aircraft departed Moruya first at about 1030 Eastern Standard Time^[1] and arrived in the vicinity of the Braidwood landing area at about 1110. After surveying the landing area, the recreational pilot made a landing to the east. The slower aircraft was designed for landing on unprepared areas, having a different landing gear configuration and high propeller clearance from the ground.

The landing area was oriented in an east-west direction, and the recreational pilot reported that they landed with a left quartering tailwind, uphill to the east. After landing there, the recreational pilot believed that the runway was not suitable for the Liberty XL-2 (VH-XLK).

VH-XLK departed Moruya at about 1103 and had sufficient fuel to either land at Braidwood, or to continue to Camden Airport. The recreational pilot recalled that, prior to VH-XLK’s arrival overhead the Braidwood landing area, they called the pilot of VH-XLK by mobile phone to advise that the runway was not suitable for the Liberty XL-2.

Recorded data showed that VH-XLK approached the landing area (Figure 2) from the south-east and overflew the property homestead at about 1123, before turning left to circle around the landing area. A witness reported that the aircraft appeared to be slowing and descending and that the engine noise was a lot less noticeable overhead the landing area than when it first approached the property. The witness also stated that the aircraft appeared to be ‘hanging off the prop’, describing VH-XLK having a slowing speed and nose-high attitude. The recorded data indicated an inconsistent airspeed and height during the first orbit overhead the Braidwood landing area (Figure 5).

Figure 2 : VH-XLK flight path approaching the Braidwood landing area

Flight data overlay of Braidwood aircraft landing area, with final 15 seconds recreated from witness accounts and highlighted for reference.

Source: Google Earth, modified by the ATSB

As VH-XLK approached the western end of the landing area, it began a left turn to track close to the western threshold of the runway on a slow descent, at about 400 ft above ground level. At about 1127, after passing over the western threshold and travelling in a southerly direction, a further left turn was initiated.

Witnesses described that, during this left turn, the left wing of VH-XLK dropped and the aircraft pitched nose-down while rotating to the left. The aircraft then entered a steep, rotating, counterclockwise descent around the longitudinal axis for one rotation before impacting the flat, open farmland adjacent to the landing area.

Witnesses to the accident arrived promptly to assist, however the pilot was fatally injured.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) +10 hours

Context

Pilot information

General information

The pilot obtained a recreational pilot certificate in March 2008 and achieved a cross country endorsement in May 2008. In July 2010, the pilot purchased VH-XLK and in December 2010 obtained a Private Pilot Licence (Aeroplane).

The pilot completed their last aeroplane flight review on 8 December 2018. They had about 654 hours total flying experience, with about 548 hours in VH-XLK. This included 22 hours flight time in the 2 weeks prior to the accident, and 4.1 hours during the 2 days prior to 6 August.

Stall and spin recovery training

The pilot had previously been taught theoretical and practical stall recovery techniques, including recovery from an entry into a spin, during their initial flying training. A part of the pilot’s last aeroplane flight review required the pilot to demonstrate competency in the recognition of stall signs and symptoms, and the recovery from incipient stalls and spins.

Medical and recent history information

The pilot’s last medical examination was on 10 August 2018 for a class 2 medical certificate. This medical certificate placed restrictions on the exercise of the pilot’s licence and required that distance vision and reading correction was to be worn whilst exercising the privileges of the licence.

Post-mortem examination identified that there was no evidence of pre-existing natural disease and that the pilot most likely succumbed to impact-related injuries. Toxicological testing identified low levels of a cough suppressant, however no other drugs or medications were detected. Further specific testing for carbon monoxide did not indicate elevated levels.

The recreational pilot reported that the pilot of the accident flight had significant sleep opportunity on the nights of 4 August and 5 August, but did not know how much sleep the pilot actually obtained. On the morning of 6 August both pilots had breakfast before heading to Moruya Airport.

Weather information

The aerodrome forecast (TAF)^[2] for Goulburn Airport (62 km north of the Braidwood landing area) for the period from 0900 included clear conditions with a wind of 12 kt from 290°. The TAF for Canberra Airport (58 km west of the landing area) for the period from 1000 indicated conditions of broken cloud at 500 ft above ground level with clear visibility and wind of 4 kt from 040°, improving to clear conditions with a wind of 12 kt from 330° by 1200.

The weather observation (METAR) ^[3] for Goulburn at 1200 indicated a wind of 13 kt from 270° with clear visibility and no cloud. One-minute weather observations for Braidwood racecourse, about 8 km from the accident site, for the period from 1122 to 1132 indicated an average wind of 2.3 kt with a maximum gust of 5.4 kt (recorded at 1126). The recorded winds during this period varied from 330° to 030°.

Witness reports identified the wind direction as being from the north-west, and the recreational pilot reported that the wind direction and strength produced a quartering tailwind from the left when approaching to land towards the east at the landing area. They estimated the wind at the landing area to be about 5–7 kt, and they also noted that they had experienced no turbulence during their flight.

The ATSB considered that the recreational pilot’s weather observations provided a reasonable and timely local representation of the weather below 1,000 ft above ground level. These observations were broadly consistent with the Bureau of Meteorology (BoM) forecasts and the observations at ground level. All the weather sources confirmed that the conditions and visibility were conducive to flight under visual flight rules.^[4]

Aircraft information

General

The Liberty XL-2 aircraft is a single engine, two seat, low wing aircraft mostly used as a private touring aircraft, or as a primary flight trainer. The fuselage is made from composite fibreglass and carbon, with metal wings. The limited propeller ground clearance and relatively small tyres make it less suited to rough field operations and more suited to prepared runway surfaces.

The aircraft is powered by a Continental IOF-240-B engine with a full authority digital engine control (FADEC), fuel injection control system, which produces 125 hp and a cruise speed of about 125 kt. The FADEC system is a solid state, computer controlled electronic ignition and fuel injection system, allowing the electronic control unit (ECU) to adjust the fuel to air ratio, and other engine parameters, to adapt to the operating conditions and obtain peak engine performance, and to promote reduced pilot workload and better fuel economy.

Airworthiness and maintenance

The aircraft involved in the accident, serial number 0106, was manufactured in 2008. In February 2009, the aircraft had 19.6 hours total time and was issued with an Australian certificate of airworthiness in the normal category^[5] and was registered as VH-XLK.

The aircraft’s last maintenance release^[6] (MR) was issued by a maintenance provider at Bankstown on 30 November 2018, at which time the aircraft had 766.5 hours total time in service.

At the time of the accident (6 August 2019), the last entry on the MR was recorded on 5 August 2019 and showed an aircraft total time in service of 822.6 hours. VH-XLK was operated for an additional three additional flights, totalling 1.1 hours, until the time of the accident.

The MR was issued in the instrument flight rules^[7] category, however an entry by the issuing maintenance organisation advised that VH-XLK was restricted to night visual flight rules as the electrical, instrument and radio periodic inspection had not been completed at the time of MR issue.

The MR indicated a requirement for an oil and filter change to be conducted every 50 flight hours; that is by 816.5 hours with tolerance of +/- 5 hours. There was no certification on the MR to indicate that this had occurred before the accident flight.

Airworthiness Directive (AD) FAA AD 2009-08-05R1 was required to be completed every 50 hours of service or every 12 calendar months, whichever came first. The AD required a check for cracking in the exhaust muffler system, and was due on 30 November 2019 or at 816.5 flight hours (whichever came first), as annotated on VH-XLK’s MR. The AD stated, that should cracking be identified, then it must be replaced as it had potential to allow carbon monoxide to enter the aircraft cabin through the cockpit heating system.

On 19 July 2019, while returning from another journey, the AD became due on VH-XLK (50-hour requirement). The aircraft continued to operate for another 6.1 hours and 10 flights, until the time of the accident. There was no certification on the MR to indicate that the AD inspection was conducted.

Stall warning system and stall speed

VH-XLK was equipped with a stall warning system. The stall warning capability was provided through a lift switch (stall sensor) mounted in the left-wing leading edge, and electrically connected to an aural warning device located behind the instrument panel. The stall warning system was designed to produce an audible tone about 5–10 kt above the airplane stalling speed to warn the pilot of an impending stall, and to enable them to take avoiding action.

The stall speeds listed in the XL-2 Flight Manual varied according to aircraft configuration and the bank angle, as shown in Table 1.

Table 1: Liberty XL-2 stall speeds

Source: Liberty XL-2 Flight Manual, Section 5 Performance

Site and wreckage information

Accident site

The accident site was located about 150 m to the south of the western threshold of the landing area in relatively flat and open farmland, about 9 km north-east of Braidwood (Figure 1).

Witnesses reported that the aircraft was travelling in an easterly direction when it impacted the ground. Ground scars indicated that the aircraft impacted terrain in an upright, nose‑down, left wing low attitude, consistent with counter‑clockwise rotation around the longitudinal axis.

Wreckage examination

The wreckage was distributed over a relatively small area, with all of the major aircraft components accounted for at the site (Figure 3).

Examination of the wreckage identified:

• the flight control system was assessed for control continuity with no pre-existing defects identified
• fragments of the wood propeller blades, and propeller slash marks, were located at the point of impact
• the propeller blades showed evidence of rotation damage consistent with engine operation at impact
• the engine, empennage and right wing were located about 20 m from the initial impact point
• the left wing had separated from the fuselage and was located a short distance from the initial impact point
• the flaps were in the retracted position, consistent with the observed position of the electric flap actuator.

Figure 3: Accident site

Source: ATSB

Impact signatures were consistent with witness reports, indicating that the left wing struck the ground first, followed by the propeller, engine and then the fuselage. The wing ground strike resulted in compression damage to the left lower fuselage below the gull door at the wing root location, and subsequent separation of the left wing from the fuselage.

Creases and tears in the carbon fibre panels behind the cabin area were also as a result of the ground impact (Figure 4).

No pre-impact defects were identified with the engine or aircraft structure. The internal cabin fuel tank had ruptured and a quantity of fuel had leaked into the ground. Fuel was observed in the fuel filter bowl, free of contamination. There was no post impact fire.

Figure 4: VH-XLK rear fuselage section showing compression damage to composite structure and creasing at empennage junction

Source: ATSB

Component examinations

Several components were taken from site for further examination by the ATSB, including:

• airframe fuel filter
• static system alternate air valve
• stall warning vane and annunciator unit
• horizontal stabiliser actuator.

Fuel supply to the engine is from the fuel tank located in the pilot and passenger seat back, via a ‘gascolator’ or airframe fuel filter assembly. The filter contained residual fuel with no blockages or inhibiting obstructions to prevent normal operation.

The alternate static air selector valve was found on the accident site to be in the ‘OFF’ or normal position and its function and sealing was checked for serviceability. Physical examination showed that the unit was intact, although had sustained some impact-related damage to the associated tubing. The unit was tested, and no faults were identified with its correct operation.

The stall sensor assembly was externally damaged with the mounting flange showing signs of significant distortion. However, the internal micro-switch operated correctly with a loud, audible response from the annunciator unit, indicating that the annunciator likely would have provided warning to the pilot if the lift switch was appropriately positioned.

It was not possible to confirm whether the lift switch was appropriately positioned, and this is not usually checked or required to be checked during periodic maintenance. However, pilots are required to confirm that the stall warning is working (will make a noise) prior to flight.

The stabilator trim actuator was identified on-site in the fully extended position (pitch-up trim), and free of external defects. However, due to the impact forces, continued electrical power post-accident, and the compressed cockpit area, it was not possible to confirm the pre-impact trim actuator position.

Recorded information

Engine data

An engine data storage card was retrieved from the aircraft’s engine control unit for examination. The memory card was designed to store all engine data between overhauls, and the data was ordinarily extracted with a card reader. The data recovered from the card installed in VH-XLK did not contain any valid date or time data, and it stored insufficient detail to identify the accident flight.

Electronic flight data

A damaged iPad was recovered from the accident site. The pilot utilised the iPad to run an electronic navigation program, but the damage to the device precluded any on-device data download. However, the software provider was able to supply remotely stored data. The recorded data included time, latitude, longitude and altitude, recorded at 5-second intervals.

The ATSB used the recorded data to derive a groundspeed, and then calculated the true airspeed (KTAS) using an estimated wind of 310° at 6 kt as witnessed by the previous landing pilot. Calibrated airspeed (KCAS) was then calculated by correcting true airspeed for pressure changes in altitude. The indicated airspeed (KIAS) was then calculated by applying the flight manual calibration differences at certain speeds for the Liberty XL-2, taking into consideration the position errors associated with installation. KIAS is the speed that would be indicated to the pilot in the aircraft.

The height above ground was calculated by comparing the recorded altitude at each position with the landing area elevation of 2,132 ft.

Figure 5 shows the derived airspeed and height above ground level for the last 3 minutes of the flight. However, constraints on the buffering of the in-flight data meant that the last 15 seconds of flight Figure 5 (data after 1126:51) were considered less reliable.

Figure 5: VH-XLK flight profile

Analysis of 5-second flight data with ground speed corrected for observed wind (6 kt). True airspeed corrected for elevation and indicated airspeed corrected for installation. Altitude was recorded to the nearest 100 ft, and this figure was subtracted from the elevation of the landing area (2,132 ft).

Source: ATSB

VH-XLK descended to fly overhead the landing area, and at 1125:21 the altitude stabilised at about 2,300 ft, which was about 170 ft above ground level. From 1125:21 to 1126:41 the altitude increased to about 2,400 ft, which was about 270 ft above ground level.

During the descent, at 1124:41, airspeed reduced below 80 KTAS (about 73 KIAS). After levelling out about 1125:21, the estimated speed was about 65 KTAS (about 58 KIAS), and it then increased up to 72 KTAS (65 KIAS) before decreasing to about 59 KTAS (51 KIAS) at 1126:21. It then increased to about 78 KTAS (70 KIAS) at 1126:46, but was decreasing again by the time of the last reliable data point (1126:51).

At 1126:21, VH-XLK commenced a left turn over the eastern end of the landing area. Based on the recorded and estimated parameters, this turn had an estimated bank angle of about 15–20°, which continued up until the last reliable data point (1126:51). At this point the recorded altitude was 2,500 ft (about 400 ft height above ground) and the estimated airspeed was 74 KTAS (66 KIAS). Based on witness reports, the aircraft continued the left turn after this point, which meant it would have been turning towards a downwind direction, with decreasing airspeed, when the loss of control occurred.

Survival aspects

Examination of the aircraft confirmed the correct function of the pilot’s safety harness. Although the harness was cut by emergency services, the belt tongues were secure in the belt buckle. The passenger seatbelt was found securely fastened.

The upward opening, gull doors on each side of the aircraft were open (gas strut operated), however the door locks were in the closed/locked position. The open doors were most likely due to airframe distortion during the accident sequence. The windscreen was broken with little remaining, the left gull door transparency was substantially damaged, and the right gull door transparency was intact.

The accident impact forces imparted on the aircraft cockpit was considered by the ATSB to be not survivable.

Weight and balance information

The standard empty weight of the XL-2 is about 1174 lbs (438.2 kg), however VH-XLK was fitted with a ‘factory rework kit’ which enabled the aircraft to be flown at the increased weight of 1750 lbs (793.8 kg) maximum take-off weight. Aircraft manuals, navigation equipment, travel bags and other personal items were located in the wreckage.

An assessment of the aircraft’s weight and balance during the flight was made based upon the aircraft’s basic weight, estimated fuel, the weight of the pilot and an estimate of the baggage carried. The weight of the aircraft was calculated to have been within weight and balance limits throughout the flight.

Aircraft landing area information

The landing area is located to the south-west of the homestead, in open undulating farmland running almost east-west in orientation. The landing area was freshly marked with painted tyres and had not previously been used by any aircraft prior to the day of the accident.

The landing area ran uphill to the east, with a southerly transverse (side) slope from left to right and was about 540 m long. It was unevenly sloped in the initial sections with a number of undulating steps. The landing area had an elevation of 2,132 ft, and the surrounding area varied by about 100 ft in altitude.

The surface contained depressions, grass tufts and rocks, and was not suited to smaller aircraft tyres, such as those fitted to the VH-XLK.

The landing area met the requirements of Civil Aviation Advisory Publication (CAAP) 92-1 (Guidelines for aeroplane landing areas) for the conduct of the operations of the Liberty XL-2 and was suitable in terms of runway distance required and landing area width.

Additional information

The aerodynamic stall

A wing generates lift when the airflow around the upper and lower surfaces results in a pressure difference between those surfaces. At a certain angle of attack,^[8] which is a characteristic of the wing design, the flow over the upper surface of the wing separates from the surface (Figure 6). This condition is known as an aerodynamic stall (or simply a stall) and results in a rapid reduction in the lift generated.

Figure 6: Angle of attack increase to stall

Source: United States Federal Aviation Authority publication FAA-H-8083-3A – Critical angle of attack and stall, annotated by the ATSB

A wing drop occurs when an aircraft approaches the stall and one wing stalls before the other. This signals a loss of symmetrical lift across both wing surfaces, and can be exacerbated by unbalanced flight. The loss of lift on one wing will induce a rolling and pitching moment, that if not immediately addressed by the application of the appropriate recovery actions, will likely result in entry to a spin.

The US Federal Aviation Administration (FAA) Airplane Flying Handbook^[9] provides guidance on basic pilot skills and knowledge essential for piloting aeroplanes. The handbook contains a section on stalls that states:

If an uncoordinated turn^[10] is made, one wing may tend to drop suddenly, causing the airplane to roll in that direction.

The handbook also described aircraft behaviour during a cross-control stall, when aileron and rudder inputs are applied in opposite directions during a turn, as follows:

In a cross-control stall, the airplane often stalls with little warning. The nose may pitch down, the inside wing may suddenly drop, and the airplane may continue to roll to an inverted position. This is usually the beginning of a spin… It is imperative that this type of stall not occur during an actual approach to a landing, since recovery may be impossible prior to ground contact due to the low altitude.

Depending on timely action and pilot input, the aircraft may require several hundred feet of altitude to effect a safe recovery.

Spins and spin recovery

An aerodynamic spin is a sustained spiral descent, in which one or both aircraft’s wings are in a stalled condition.^[11]

A spinning aircraft (Figure 7) will descend more slowly than one in a vertical or spiral dive and it will have a lower airspeed. The pitch angle can also vary considerably from significant pitch down, to a relatively flat attitude, depending on the aircraft type.

Spinning ceases only when opposing forces and moments overcome the rotation. The pilot must recover by applying the recommended spin recovery technique. Due to rotational inertia, spin recovery is not instantaneous. It may take several turns of the applied technique before the recovery technique is effective.

Spins are recoverable when correct recovery technique is taken and there is enough altitude and therefore time to recover.

Figure 7: Spin entry and recovery

Source: United States Federal Aviation Authority publication FAA-H-8083-3A– Spin entry and recovery

Aircraft flight manual procedures about spins

The Liberty XL-2 flight manual, section 3, described the recovery from unintentional spins as follows:

If an inadvertent spin occurs, use the following recovery procedure:

• Throttle - idle
• Ailerons neutral
• Rudder pedals – Apply and hold full opposite rudder
• Control stick – forward to break stall
• Neutralize rudder – make smooth pull-up from the resulting dive
• Throttle – Adjust for straight and level flight

In addition to the inadvertent spin guidance, section 2 of the Liberty XL-2 flight manual (limitations) stated:

No aerobatic manoeuvres, including spins, are authorized.

Additional guidance material about spins and stalls

A large amount of guidance material has been published for pilots regarding the nature of spins and stalls, such as the guidance material provided by the US FAA mentioned above, a 2008 Civil Aviation Authority (NZ) publication titled Spin Avoidance and Recovery stated:

The majority of unintentional spins occur at altitudes too low for recovery.

The publication discussed how aircraft enter unintentional spins and how in a low-speed descending turn, the aircraft is vulnerable by being at low speed with a higher angle of attack and therefore closer to the stall. This coupled with a reducing or low airspeed can provide the conditions to start a spin.

In the event of a spin, pilots must immediately recognise the spin, its direction, know what to do in the correct order and correctly execute the procedure the first time. In most cases, there is only about 3 seconds to do all this. The minimum altitude loss for a text-book recovery will be about 1,000 to 1,500 ft. At low heights above ground level, there will be little opportunity to recover.

The criticality of immediate and correct pilot input will reduce recovery time and minimise the required altitude to recover, thereby reducing the risk of collision with terrain.

At the time of the accident, CASA had published some guidance material about stalls and spins in its Flight instructor’s manual, as well as educational articles in its Flight Safety magazine. However, it had not published an advisory circular or similar document on stalls and spins. It published an advisory circular on spin avoidance and stall recovery training in April 2020 (see Safety action).

Low flying

Flight below 500 ft above ground level is subject to different sets of visual cues and references, and therefore different techniques. Often slow flight can be involved in low level flight and, as a result, attitude, trim settings, control loads and aerodynamic control effectiveness, and power settings, may all be quite different to what the pilot is familiar with or has experienced before. Accordingly, sustained operational flight at low level requires specific training and testing for competence.

Related occurrences

The recent CASA advisory circular on spin avoidance and stall recovery training stated:

Stall - spin related accidents continue to account for approximately one-quarter of all fatal general aviation accidents worldwide, including many during dual flight training. Most unintentional spins other than during dual instruction, occur at altitudes too low for recovery, generally on climb after take-off and turns onto final approach.

The ATSB has investigated a number of accidents where light general aviation aircraft have stalled and impacted terrain. Each of these investigations identified that the stall condition is exacerbated through mishandling of the aircraft during the stall, which can result in entry into a spin. The stall/spin will result in a steep pitch down and rotation towards the stalled wing. Recovery from this condition will take a considerable amount of height, the magnitude of which is dependent on the reaction time of the pilot, and the use of appropriate recovery technique.

A summary of eight of these investigations, that have similar characteristics to the accident near Braidwood on 6 August 2019, is located in Appendix A.

__________

2. Aerodrome Forecasts (TAF): are a statement of meteorological conditions expected for a specific period of time in the airspace within a radius of 5 NM (9 km) of the aerodrome reference point.
3. METAR: a routine aerodrome weather report issued at routine times, hourly or half-hourly.
4. A set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
5. An airworthiness categorisation that applies to aircraft which are intended for non-acrobatic operation, having a seating configuration (excluding pilot seats) of nine seats or less, and a maximum take-off weight (MTOW) of 5700 kg or less, or 2,750 kg or less for rotorcraft.
6. An official document, issued by an authorised person as described in Regulations, which is required to be carried on an aircraft as an ongoing record of its time in service (TIS) and airworthiness status. Subject to conditions, a maintenance release is valid for a set period, nominally 100 hours TIS or 12 months from issue.
7. A set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
8. Angle between the wings cord line and the relative airflow.
9. US Department of Transportation Federal Aviation Administration 2004, Airplane Flying Handbook.
10. An uncoordinated (or unbalanced) turn is one where a sidewards acceleration (force) is felt during the turn due to a sideslip.
11. Aerodynamic stall: occurs when the airflow separates from the wings upper surface and becomes turbulent. It occurs at high angles of attack, typically 16–18° and results in reduced lift and increased drag.

Safety analysis

Introduction

Evidence from witnesses and the available flight data indicated that control of the aircraft was lost while the pilot was executing a slow speed turn downwind. The witnesses then observed the aircraft’s left wing drop and the aircraft enter an upright spin. The examination of the wreckage confirmed that the aircraft impacted terrain in a nose-down, left wing low attitude, consistent with the aircraft being in the early stages of a spin.

The local meteorological conditions around the time of the accident suggested that a meteorological event, such as a sudden and large wind gust that might contribute to a loss of control, was unlikely to have occurred. In addition, the available evidence indicated that the engine was operating at impact and there was no evidence to suggest any impediment to normal engine operation. There was also no evidence to indicate a problem with the aircraft’s flight controls or weight and balance leading to the loss of control.

This analysis will consider the circumstances that preceded the event, including navigation data and witness reports. It also considers some maintenance aspects associated with the aircraft.

Flight over the landing area

Aircraft handling

Flight profile data provided by the navigation software manufacturer indicated the aircraft’s height to be ranging from 200–400 ft above ground level (AGL) as the pilot circled the area prior to the loss of control. The aircraft’s speed and altitude fluctuated, commensurate with holding a reduced power setting and interchanging speed for altitude.

In slow speed situations, the selection of partial flap would allow the pilot to fly the aircraft at a lower airspeed, while maintaining a greater margin above the stall.^[12] However, the flaps were confirmed to be in the retracted position at the accident site.

The stall handling characteristics of most light, general aviation aircraft suggest that a significant wing drop, as reported by the witnesses, may be due to an unbalanced turn at slow speed, leading to entry to a spin. In this case, the left wing most likely aerodynamically stalled, rolling the aircraft left and pitching the aircraft nose down. The aircraft then entered a left spin with a near vertical attitude and completed one rotation before impacting terrain.

Enabling a recovery from the stall

It has been highlighted in other accident investigation reports and guidance material that the height required to recover most light general aviation aircraft from a stall/spin condition is in the order of at least 400 ft. By operating the aircraft below 500 ft while circling the landing area, the pilot reduced an important safety margin.

It is also important that a pilot monitors and maintains an appropriate margin above the stall speed during a turn, is cautious with manoeuvring, and remains balanced with control inputs when flying at lower altitudes.

Pilot intentions

It is unclear what the pilot’s intentions were after arriving overhead the landing area. The pilot of the accompanying aircraft reported that they had advised the pilot of VH-XLK that the surface of the landing area was not suitable for VH-XLK to land. It is possible that the pilot of VH‑XLK was assessing the landing area to make up their own mind or was potentially just conducting an overflight of the property. In either case, flight below 500 ft above ground level, unless they were conducting a precautionary search and landing or were in the process of landing (after conducting a suitable circuit or approach), reduced the available time and altitude to recover from an emergency situation, such as a stall or spin.^[13]

In addition, regardless of their intention, it is likely that the pilot’s focus of attention was looking outside the aircraft at the landing area. Accordingly, they may well have not been allocating sufficient attention to monitoring the aircraft’s airspeed and/or energy state and controlling the aircraft. A substantial body of research has shown the significant effects that distraction can have on pilot performance (ATSB 2005).

Effectiveness of the stall warning

A stall warning should provide adequate warning to the pilot prior to the onset of stall symptoms during flight. The stall warning system fitted to the XL-2 was designed to provide aural warning of impending stall conditions about 5 kt above the expected stall speed.

Analysis of the stall warning system components identified that it was most likely functional at the time of the accident. However, it is unknown if and for how long this warning may have sounded. Likewise, the pilot’s reaction to the warning before the aircraft stalled is also unknown.

Stall speed can be reduced by the application of flap and is recommended while conducting sustained slow speed flight. Although it is possible the pilot may have been using some flap during the early part of the circling, it is very unlikely any flap was selected prior to commencing the final turn (downwind), given that the flaps were retracted at impact.

Summary

The introduction of bank and/or unbalanced control inputs decreases the margin between slow flight and the stall. Maintaining adequate airspeed through appropriate power application during increased bank angles is essential to maintain a controllable airspeed and margin above the stall, especially in slow speed flight, without height loss.

If the pilot was evaluating the suitability of the landing area for their aircraft, the conduct of a precautionary search and landing by overflying the landing area at progressively lower heights, and then climbing back to circuit height each time, would have reduced the risk of a loss of control.

Taking into consideration the time required to recognise and react to a stall/spin event, and recovery height requirements, VH-XLK was most likely at an altitude that would have precluded a safe spin recovery prior to impacting terrain.

Maintenance overrun

VH-XLK departed Moruya with maintenance requirements that were due prior to the flight. This included an airworthiness directive (AD) specifying a muffler inspection, and an engine oil and filter change. The aircraft had been flown on 10 previous occasions with the muffler AD pending completion.

The operation of the aircraft beyond the maintenance requirements resulted in the maintenance release ceasing to be valid; this should have prevented further flight in the aircraft until the actions were completed (or an exemption obtained).

The overdue maintenance did not contribute to the accident. There was no indication of an engine problem. In addition, although the overdue muffler inspection increased the potential of carbon monoxide gas entering the cockpit, there was no indication that the pilot was affected by carbon monoxide.

__________

12. The use of flap would also lower the nose attitude and increase forward visibility.
13. In addition, flying a normal circuit pattern, oriented with reference to the intended landing area, assists in the conduct of normal procedures and minimises the potential for omissions or distractions.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving Liberty Aerospace XL-2, VH-XLK, 9 km north-east of Braidwood, New South Wales, on 6 August 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• After arriving at the landing area, the pilot circled the landing area at a height of 200–400 ft above ground level.
• Soon after the pilot turned downwind at low airspeed with no flap selected, the aircraft’s left wing aerodynamically stalled. This resulted in the aircraft entering into an upright spin, at an altitude that limited an effective recovery.

Other factors that increased risk

• An airworthiness directive requiring an inspection of the engine exhaust muffler had not been completed and the aircraft was overdue for an oil change. These overdue maintenance items rendered the maintenance release invalid, which should have prevented further flight until rectified.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk.

CASA guidance on spin avoidance

Due to an increase in spin type accidents across a broad range of light aircraft types in the training environment, CASA released guidance material in the form of advisory circular (AC) 61-16 v1.0 (Spin avoidance and stall recovery training) in April 2020.

The AC provided detailed guidance for pilots, flight instructors, flight examiners and flight training organisations. Several of the key points for the safe conduct of advanced stalling and spinning exercises from the AC stated that all pilots should be aware of:

• Training in spin avoidance must include the recognition of symptoms associated with slow flight and approach to the stall through to recovery from stall with a wing drop
• Recognise and manage changes in aircraft energy state
• Spin avoidance training where a wing may drop at the stall should be undertaken through scenario-based in-flight manoeuvres:
  • Approach configuration descending turns (base to final turn) …
  • Turns in slow flight.

Appendices

Appendix A – Related occurrences

The following ATSB accident investigations are drawn from investigation reports published between 2010–2019. The common theme from these fatal accidents is the loss of control of the aircraft following an aerodynamic stall, with a resultant steep pitch attitude and insufficient altitude to enable recovery before impacting terrain.

ATSB investigation AO-2010-079^[14]

On 18 October 2010, a Cessna 172S aircraft, registered VH-VSK, was operating at low level near Durham Downs Homestead, Queensland. A pilot and one passenger were on board. The pilot was assisting a ground party locate two horses. The aircraft was seen manoeuvring at low level before radio and visual contact was lost. A search later found that the aircraft had impacted terrain near a dry creek bed. Both occupants received fatal injuries and the aircraft was seriously damaged.

The aircraft's impact attitude was consistent with a loss of control following aerodynamic stall. The operating status of the aircraft’s stall warning system could not be determined.

ATSB investigation AO-2012-059^[15]

On the morning of 29 April 2012, the owner-pilot of a Cessna 150 aircraft, registered VH- UWR was aerial stock mustering on a cattle station about 55 km north-east of Bourke, New South Wales. The aircraft was observed circling over an area (where cattle were not moving) then in a steep descent followed by the sound of an impact. The aircraft was seriously damaged, and the pilot sustained fatal injuries.

The ATSB found that, while manoeuvring at low level, the pilot inadvertently allowed the aircraft to aerodynamically stall, resulting in a high rate of descent and collision with terrain. There was insufficient information about pilot control inputs to establish the factors that precipitated the stall.

ATSB investigation AO-2012-149^[16]

On 9 November 2012, a student and instructor departed Gold Coast Airport, Queensland for a training flight in a SOCATA TB 20, registered VH-HBB, to Lismore Airport, New South Wales. On their fifth circuit, and while making a left turn from downwind to base, the left wing dropped steeply. A recovery was commenced, but the aircraft collided with terrain. Both occupants received fatal injuries.

The ATSB found that while making the left turn, an aerodynamic stall occurred, resulting in a significant left-wing low and nose-down attitude in close proximity to the terrain. The instructor was unable to prevent the stall from occurring due to either insufficient warning or available time to react. Although it appeared that a stall recovery was commenced, the aircraft stalled at an altitude from which they were unable to fully recover to controlled flight before the aircraft collided with the terrain.

ATSB investigation AO-2013-051^[17]

On 17 March 2013, the owner-pilot of an amateur-built scale-replica Spitfire aircraft (VH-VSF) was participating in an air display at Parafield Airport, South Australia. The pilot completed the display with a slow speed pass at 400 ft with the landing gear and some wing flap extended. Towards the end of this pass the pilot radioed the tower to coordinate a landing and accepted runway 21 Left with an 11 kt crosswind.

By now the pilot had turned right and the Spitfire was near the extended runway centreline and 1 km from the runway threshold at a slow speed. A left turn was then observed and, soon after, a wing dropped, and the aircraft entered a steep descent. The aircraft crashed in a factory car park, fatally injuring the pilot and substantially damaging the aircraft.

The ATSB found that while coordinating a landing clearance with air traffic control and flying a low-level circuit with a close downwind and base in turbulent conditions, the pilot inadvertently allowed the airspeed to decay. In the subsequent turn (downwind) to adjust the circuit the aircraft aerodynamically stalled, descended steeply, and impacted the ground.

ATSB investigation AO-2014-192^[18]

On 29 December 2014, a Cessna 172S aircraft, registered VH-PFT, departed Cambridge Airport, Tasmania to photograph yachts participating in the 2014 Sydney Hobart race. On board the aircraft were the pilot and a photographer.

At about 1815 the aircraft commenced low-level photographic runs on yachts to the east of Cape Raoul. Shortly after completing a run on one yacht at a height of about 50 ft, the aircraft entered a steep climbing turn. The aircraft had almost completed a 180° turn when the upper (right) wing dropped sharply while the aircraft’s nose pitched down to almost vertical. The aircraft impacted the water’s surface in an almost vertical nose down attitude with wings about level. Both aircraft occupants were fatally injured, and the aircraft was seriously damaged.

As a result of the steep climbing turn, the aircraft’s upper wing aerodynamically stalled, resulting in a rapid rotation out of the turn. The steep pitch attitude indicated that, because of the stalled upper wing, the aircraft entered a spin. There was insufficient height for the pilot to recover the aircraft.

ATSB investigation AO-2016-074^[19]

On 12 July 2016, the pilot of a Cessna 150 aircraft, registered VH-RXU, was conducting cattle spotting operations at New Crown Station, about 270 km south-east of Alice Springs, Northern Territory. The aircraft was observed conducting turning manoeuvres over the cattle at a reported altitude of about 500 ft.

While conducting a right turn at low altitude, the pilot lost control of the aircraft and was unable to recover before impacting terrain. The pilot was the sole occupant on-board the aircraft and was fatally injured. 

While the actual events preceding the loss of control could not be concluded, the aircraft was likely operated at a slow airspeed with reduced stall margins. In the absence of other physical evidence, it was possible that control inputs made by the pilot induced a stall and incipient spin at an altitude that was not recoverable.

__________

14. ATSB Investigation report AO-2010-079, Collision with terrain – Cessna 172S, 2 km NNE Durham Downs, Queensland, 18 October 2010.
15. ATSB Investigation report AO-2012-059, Collision with terrain involving Cessna 150, VH-UWR, 55 km NE of Bourke, NSW, 29 April 2012.
16. ATSB Investigation report AO-2012-149, Loss of control involving SOCATA TB 20, VH-HBB, 3 km south of Lismore Airport, NSW on 9 November 2012.
17. ATSB Investigation report AO-2013-051, Loss of control involving scale replica Spitfire, VH-VSF, near Parafield Airport, South Australia on 17 March 2013.
18. ATSB Investigation report 2014-192, Collision with terrain Cessna 172 VH-PET, Maingon Bay (9 km south of Port Arthur), Tasmania, 29 December 2014.
19. ATSB Investigation report AO-2016-074 Loss of control and collision with terrain, Cessna 150, VH-RXU 270 km SE Alice Springs, Northern Territory, on 12 July 2016.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Civil Aviation Safety Authority
• New South Wales Police Service
• aircraft manufacturer
• maintenance organisation for VH-XLK
• Bureau of Meteorology
• witnesses to the accident (including pilot of the accompanying recreational aircraft)
• recorded data from an electronic flight bag on the aircraft.

References

Australian Transport Safety Bureau 2005. Dangerous Distraction: An examination of accidents and incidents involving pilot distraction in Australia between 1997 and 2004. Aviation Research Investigation B2004/0324.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the:

• Civil Aviation Safety Authority
• Bureau of Meteorology
• US National Transportation Safety Board (NTSB)
• maintenance provider
• the pilot of the accompanying recreational aircraft.

Submissions from those parties were reviewed and, where considered appropriate, the draft report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the morning of 1 August 2019, an Airbus A320, registered VH-VFN, was being operated as a regular public transport flight by Jetstar Airways from Sydney, New South Wales to Gold Coast, Queensland. On departure the flight crew received multiple warnings of the undercarriage not retracting completely. Despite extending and retracting the undercarriage again, the issue remained.

Meanwhile, another aircraft identified an object on the ground while taxiing at Sydney Airport and reported the sighting to the Air Traffic Control (ATC) Ground controller. The controller arranged for the debris to be collected by an airport ground car. Upon retrieval, the object was determined to be an aircraft part that was subsequently identified as an A320 main landing gear component.

ATC notified the flight crew that an aircraft part had been found. In addition, Jetstar communicated to the flight crew that the part had not yet been positively identified and advised the crew to follow their procedures. When all appropriate checks were completed, the flight crew elected to return to land at Sydney.

When it was determined the part was an apex pin of a main landing gear torque link, Jetstar Line Maintenance was concerned about the aircraft landing with the defect and attempted to contact the aircraft via radio. However, by this time the aircraft was on final approach to land and therefore not monitoring the company radio frequency. While the landing was uneventful, further damage to the left main landing gear occurred including the loss of brakes and severing of electrical sensors.

What the ATSB found

The ATSB identified that the head of the apex pin on the left main landing gear torque link failed due to cyclic fatigue. This then allowed the shank portion of the apex pin to slide out of the torque link, permitting the main landing gear axle to rotate out of alignment. The misalignment stopped the undercarriage from retracting completely and caused further damage to main landing gear components and systems during the taxi, take-off, and landing. Despite this, the aircraft landed safely.

The fatigue failure of the apex pin was the result of a crack that initiated during the quench step of the heat treatment process at manufacture. The crack was not detected during the manufacturing inspections for reasons that could not be determined. It also remained undetected during subsequent maintenance, although cracking was not specifically inspected for.

The ATSB also identified that, despite the failed part and aircraft being positively identified by elements within Jetstar, a message was unable to be conveyed to the flight crew before they returned for landing. As such, they were unaware of the true nature of the undercarriage defect and the associated risks. The additional information would have improved crew decision making.

The investigation also found that the breakdown in communication was the result of localised factors specific to this occurrence and that Jetstar has procedures in place to ensure that accurate and timely information is passed to airborne flight crew.

Finally, to enable the aircraft to be moved on the ground after the occurrence, the failed apex pin was reinstalled and temporarily held in place. This had the potential to damage the material evidence and prevent identification of the failure mode.

What has been done as a result

Airbus issued an Alert Operator Transmission (AOT) requiring recall or inspection of 1,988 apex pins. As a result of these inspections, 19 pins were removed from service due to cracking. Additionally, EASA issued Airworthiness Directive 2020-0130 mandating AOT A32N018-20 Rev 1.

Safran Landing Systems revised the manufacturing process for the apex pin prior to this failure as a result of subsequent parts being found cracked. Furthermore, they generated a design guidance document related to undercuts in heat treated parts.

Jetstar clarified non-normal operational communication guidance for ground crews in the Airport Operations Manual. This included dedicated phraseology for gaining priority on airband frequencies to relay high priority messages.

Safety messages

In this incident, the flight crew made the decision to return and land after seeking and assessing information from ground personnel relating to the landing gear malfunction. However, additional information was still being gathered. This highlights the importance of ensuring that operational processes permit coordinated, accurate and timely flow of information between ground personnel and flight crew to assist airborne decision making.

For safety investigations, preservation of evidence is vital in determining the circumstances of the occurrence and identifying safety issues that may present a hazard to continued operations. Any person involved in aircraft operations are encouraged not to put evidence at risk of further damage.

The occurrence

On the morning of 1 August 2019, an Airbus A320, registered VH-VFN, was being operated as a regular public transport flight by Jetstar Airways (Jetstar) from Sydney, New South Wales to Gold Coast, Queensland. It was the first flight of the day for the flight crew and the third for the aircraft and cabin crew. The aircraft had previously been flown on a return flight between Sydney and the Gold Coast, landing in Sydney on runway 34R.^[1]

At 1020 Eastern Standard Time,^[2] the aircraft was pushed back and commenced taxiing to runway 34R (Figure 1). While the aircraft was taxied to the runway, the crew of a following aircraft reported to the Sydney East Ground Controller (Ground) that they had sighted an item on the ground at the intersection of taxiways B4 and C.^[3] Ground then sent an airport ground car to investigate the item, who reported 3 minutes later that the foreign object debris (FOD)^[4] had been retrieved. The FOD was a metallic component, later identified to be an apex pin of a main landing gear torque link (see the section titled Main landing gear strut and Figure 2).

Figure 1: Airport map – Sydney Kingsford Smith

Source: Airservices Australia, modified and annotated by the ATSB

At 1038, VH-VFN took off, and after retraction of the undercarriage, the flight crew received numerous messages on the electronic centralised aircraft monitoring (ECAM) system,^[5] two of which were ‘L/G DOORS NOT CLOSED’ and ‘L/G GEAR NOT UPLOCKED’. The captain elected to continue the climb out over the sea. The flight crew informed air traffic control and requested vectors to an area where they could troubleshoot the problem. They then cycled the undercarriage to the extended and then retracted positions however, the issue remained.

At 1042, Ground simultaneously contacted two Jetstar aircraft taxiing for take-off. They were instructed to contact their engineering department as ‘one of the safety officers has found a large piece of metal at the juncture of Bravo 4 and Charlie and it is believed to be from a Jetstar 320…’.

Figure 2: Apex pin as recovered from taxiway

Source: Jetstar Safety Department, annotated by the ATSB

At the same time, the Sydney Departures controller (Departures) informed the flight crew of VH‑VFN of a ‘large piece of metal’ found on a taxiway. The flight crew then told Departures they required a return to the airfield. In a follow up discussion a minute later, Departures informed the flight crew ‘they believe it might be a part of the landing gear’ to which the captain responded, ‘that would make sense’. Shortly after the aircraft entered a holding pattern off the coast.

At around 1048, a ‘hard stop’^[6] order was placed on departing Jetstar aircraft by the company as a result of the discovery of the apex pin on the taxiway.

At 1054, Departures advised VH-VFN to expect an approach to runway 25 when they were ready, but the first officer (FO) requested runway 34L because they were unsure about the serviceability of the brakes.^[7]  At this point, the FO confirmed that they had approximately 80 minutes of endurance.

In addition to the communication with Departures, the flight crew also contacted Jetstar’s Sydney line maintenance (Line Maintenance) via radio several times to discuss the landing gear issue. Around 1055, an engineer communicated to the flight crew that a part had been found but it had not been positively identified. They advised the crew to follow their standard operating procedures.

At 1059, believing there would be no further details from Line Maintenance, the aircraft left the holding pattern and was given vectors for an approach to land. The flight crew requested the airport’s emergency services be put on a local standby.^[8]

Around this time, Line Maintenance concluded the part was an A320 main landing gear (MLG) torque link apex pin and the Line Maintenance Supervisor (LMS) raised their concern with the Maintenance Operations Centre (MOC) ^[9] about the aircraft landing with such a fault. The MOC sought more information from the LMS. However, by the time MOC agreed with the LMS’s concerns, the aircraft had safely landed.

At 1110, the aircraft landed and stopped on taxiway B9 (Figure 1) where it was inspected by the airport’s Aircraft Rescue and Fire Fighting service fire commander. During the radio conversation between the fire commander and the FO, the FO discussed having a landing gear issue and that the aircraft was pulling to the left. The fire commander indicated that from their position in the vehicle, there were no visible issues with the aircraft.

The aircraft was then taxied on taxiway B to just short of taxiway B4 where Line Maintenance personnel inspected the MLG. The inspection found the left MLG^[10] torque link apex pin was missing along with two bolts from the associated damper unit (Figure 3). A brake hydraulic hose was also frayed to the point of allowing fluid to escape. The aircraft was then slowly towed to the gate.

Figure 3: Main landing gear torque link assembly upon landing

Source: Jetstar Safety Department, annotated by the ATSB

After passenger disembarkation, the aircraft was to be towed to a hangar for inspection and repair. To reduce the potential for further damage, and as no spare apex pin was available, the failed pin was reinstalled and temporarily secured in place to ensure the landing gear stayed correctly aligned.

The following afternoon, the missing head of the apex pin and one damper bolt (Figure 4) were found by airport staff adjacent to the T3 intersection of runway 34R. Fifteen days later the second missing damper bolt was found during a routine FOD inspection of runway 34R.

Figure 4: A damper bolt and head of apex pin retrieved from runway 34R

Source: Jetstar Safety Department, annotated by the ATSB

__________

1. Runway number: the number represents the approximate magnetic heading of the runway in tens of degrees. The runway identification may include L, R or C as required for left, right or centre.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) +10 hours.
3. Taxiway intersection B4 and C is approximately 250 metres south of Gate 55.
4. Foreign object damage or foreign object debris (FOD) is any article or substance, alien to an aircraft or system, which could potentially cause damage. The term FOD is used to describe both the foreign objects themselves and any damage attributed to them.
5. Electronic Centralised Aircraft Monitoring (ECAM) is a system that monitors aircraft functions and relays their status to flight crew. It also produces messages detailing failures.
6. A hard stop call is a term for stopping an aircraft departing due to operational or engineering issues associated with the flight, e.g. incomplete maintenance or paperwork.
7. Runway 16R/34L is the longest runway available at Sydney airport. "> Runway 16R/34L is the longest runway available at Sydney airport."> Runway 16R/34L is the longest runway available at Sydney airport. a>
8. Local standby and emergency standby are the two levels of readiness by Aircraft Rescue and Fire Fighting service for an aircraft that has indicated a problem prior to landing at an airport. Local standby is the lower of the two levels and indicates the landing should be uneventful but the aircraft has some form of defect. Rescue services attend with a lower level of equipment based on the airport emergency plan.
9. The Maintenance Operations Centre (MOC) is Jetstar’s Continuing Airworthiness Management Organisation (CAMO) and covers Maintenance Watch and other engineering resources such as airport maintenance facilities.
10. All further references in this report to ‘MLG’ are associated with the left main landing gear unless otherwise noted.

Context

Recorded data

Quick Access Recorder data

Quick Access Recorder (QAR) data (Figure 5) was retrieved from VH-VFN for the incident and prior flights. A review of the data from the previous two flights did not identify any anomalies.

Figure 5: Recorded data for the complete flight

During the initial climb on the incident flight, the aircraft did not successfully complete a full undercarriage retraction sequence, with the aircraft failing to sense the MLG up locks engaging and the gear doors closing. Approximately 90 seconds later the undercarriage extension/retraction was cycled with the landing gear being selected down successfully and then reselected up. Again, the aircraft failed to record a complete retraction of the MLG.

QAR data also showed that, on the taxi to the departure runway, left and right wheel brake applications were matched by temperature rises in the corresponding brakes. This was indicative of the brakes working correctly. On landing, despite application of both brakes, only the right wheel brake temperatures rose while the left brake temperatures continued to cool, implying the left wheel brakes were not functioning.

The aircraft manufacturer advised that an aircraft would remain directionally controllable at high speed due to the effectiveness of the fin and rudder, and at low speed with the nose wheel steering. With medium autobrake and the brakes of one wheelset failed, the calculated aircraft braking distance required increased from 1,360 m to 1,540 m. Sydney Kingsford Smith Airport runway 25 is 2,530 m and runway 34L is 3,962 m.

Electronic Centralised Aircraft Monitoring System data

The Electronic Centralised Aircraft Monitoring (ECAM) system displays messages to the crew via a dedicated interface and also sends the messages via the Aircraft Communications Addressing and Reporting System (ACARS)^[11]to the operator’s Maintenance Watch.^[12] The following ECAM messages related to the undercarriage were presented on the incident flight.

Table 1: ECAM Messages

Source: Jetstar Safety Department. Only messages relevant to the undercarriage and wheel brake systems are listed here. Other messages that are not of a consequence to this incident were removed for clarity.

‘L/G DOORS NOT CLOSED’ is a high priority message whereas ‘L/G GEAR NOT UPLOCKED’ is a low priority message. Higher priority messages are listed and actioned first. The order of messages may have reinforced to the flight crew that the landing gear door was at fault. Instead, the landing gear door fault was most likely a consequence of the MLG failing to uplock due to the wheels not being in proper alignment.

While not providing specific information about the nature of the fault to the flight crew, the ‘BRAKES ALTN BRK FAULT’ message reflected the system sensing the damage to the left wheel brakes.

Aircraft information

The Airbus A320 is a twin-engine, narrow body transport category aircraft that seats up to 186 passengers (depending on configuration). VH-VFN was manufactured in 2013 and had completed 21,256 flight hours and 11,687 flight cycles.

Main landing gear strut

The aircraft has a conventional tricycle undercarriage arrangement. Each retractable main landing gear (MLG) consists of two wheels and brake assemblies, on a common axle centreline, one each side of the landing gear strut (Figure 6). Rotation of the oleo-pneumatic strut is constrained by a torque link on the forward side between the two wheels.

The apex pin of the torque link connects the upper and lower torque link. This allows rotational torque loads to be transmitted between the landing gear strut and axle, while allowing free vertical movement of the shock absorber contained within the strut.

Figure 6: MLG assembly and exploded torque link assembly

Source: Airbus S.A.S. A320 series IPC Figure 32-11-11-52G (Sheet 1), modified by the ATSB

The apex pin also passes through a damper unit that attaches to the upper torque link. The head of the pin is protected from the environment by a rubber dust cap. The tail of the pin, nut, washer and locking pin assembly are protected by a coating of polysulfide sealant.

The upper and lower torque links also act as carriers for hydraulic brake hoses and an electrical harness connecting to equipment on the axles. Another link, known as the slave link, is fitted to the aft side of the strut and supports more hydraulic hoses and electrical wiring but is not designed to perform any anti-rotation function.

Aircraft damage

Detailed inspection of the aircraft MLG after the flight determined that, in addition to the failed apex pin, other items on the MLG were missing or damaged. These included:

• three hydraulic hoses damaged or frayed by contact with the wheel rim, with one hose leaking
• scoring damage to the apex damper unit following contact with the wheel rim and tyre, and two missing through bolts
• scoring damage to wheels, tyres and brakes from contact with the upper torque link and damper unit
• a cut wiring harness
• bending of the slave link.

The tyre treads had evidence of diagonal scoring which indicated that the MLG had not remained aligned with the aircraft during the landing.

Apex pin

Manufacturing process

The apex pin was manufactured from high strength steel in 2012. During its manufacture, the pin was initially roughly machined to oversize, heat treated to improve mechanical properties, and then machined to final size. The final machining included providing an undercut relief radius between the shank and the head, and formation of the head shape. Subsequently, parts of the pin underwent plating and corrosion protection processes. The part was subject to various manufacturing inspections, including a magnetic particle inspection (MPI),^[13]> which it passed (Manufacturer’s investigation).

Maintenance inspections

The MLG on the aircraft was last inspected in November 2017 as part of the aircraft’s maintenance program (AMP) 2C heavy maintenance inspection. During that assessment, the torque link was dissembled. The relevant inspection task required a check for excessive play in the hinge joints of the assembly, which it passed. The task did not require a visual or other non‑destructive inspection (NDI) of the apex pin. With Jetstar utilisation of VH-VFN, the 2C heavy maintenance inspections occurred approximately every 2.5 years and the pin had undergone this maintenance task twice.

The maintenance program also required the undercarriage to be overhauled every 10 years or 20,000 flight cycles (FC), whichever occurred first. The overhaul included disassembly of the undercarriage, with the apex pin inspected in detail and subject to an MPI if repaired. VH-VFN had yet to reach this overhaul requirement.

The apex pin had a life limit of 60,000 FC.

Pre-flight inspection

The first officer (FO) conducted the required pre-flight walkaround inspection for the incident flight which included the MLG wheels, tyres and strut. The FO did not report any anomalies with the inspection.

Licenced Aircraft Maintenance Engineers (LAME) were responsible for inspections of the aircraft on the first flight of every third day. The occurrence flight was the third flight of the day, so no formal inspection of the aircraft was carried out by a LAME.

Rectification action

Approximately two months prior to this occurrence, a European-operated A320 had an apex pin failure. Upon notification of both events, the landing gear manufacturer was advised, and an investigation launched. The pin was identified as being from the same manufacturing batch as the one installed on VH-VFN. This pin had accumulated 12,340 flight cycles. Due to the two pin failures, Airbus recalled the remaining 10 pins from this batch via individual contact with operators. Cracking was subsequently identified in five of those pins.

As a result, Airbus issued Alert Operators Transmission (AOT)^[14] A32N018-20 to operators worldwide on 23 January 2020, which recalled two batches either side of the initial batch (48 pins). The affected pins were requested to be removed at the earliest opportunity. As a result of this action, 15 pins were found cracked.

On 27 April 2020, AOT A32N018-20 Rev 01 was issued to add inspections for a further 1,940 pins. Apex pins serial numbers added in this revision were requested to undergo an MPI at the operator’s maintenance facilities. This action was reviewed by the European Union Aviation Safety Agency (EASA), and on 8 June 2020 EASA issued Airworthiness Directive (AD) 2020‑0130, which mandated compliance with Airbus AOT A32N018-20 Rev 01.

In August 2020, as part of inspections required by EASA AD 2020-0130, Jetstar identified a total of 12 aircraft with apex pins, and one spare part, listed in the Airworthiness Directive that required inspection. Jetstar found one additional cracked apex pin during the conduct of these inspections. That pin had acquired 13,402 flight cycles and was listed in Appendix 4 of AOT A32N018-20 Rev 01. The serial number indicated it was manufactured prior to the other identified fractured pins.

The ATSB identified three other occurrences overseas where pins in service listed in Appendix 4 of AOT A32N018-20 Rev 01 had been found cracked and reported.

Manufacturer’s investigation

The failed apex pin shank and head from VH‑VFN, which had accumulated 11,687 flight cycles, were sent to the MLG manufacturer, Safran Landing Systems (Safran) for inspection and analysis.

Safran conducted an investigation that included a detailed examination of the fractured parts. It concluded the cracks were initiated during manufacture of the parts and the parts failed due to cyclic fatigue. The investigation reviewed both the manufacturing processes and inspections.

Manufacturing process

Safran determined that the small radius under the head of the initial machining introduced a stress concentration during a subsequent heat treatment quench hardening process,^[15] that in some pins, resulted in the formation of a crack. The crack plane was found to align with the initial machined undercut (Figure 7). Despite a final machining process removing more material and providing a large relief radius under the head, some cracks were large enough so as not to be eliminated. Temper discolouration on the crack surface of some returned pins was indicative of the crack being initiated either during the quench process, or between the quench and temper steps of the heat treatment activities.^[16]

In summary, Safran concluded the cracks were initiated during the manufacturing process and were not caused by environmental effects in service.

The vast majority of apex pins in service were inspected as part of the AD and found not cracked (Rectification action). Safran determined that this disparity was likely associated with manufacturing variations including tool sharpness, surface finish and quench bath temperature, even though those variations were within allowable limits.

In 2014, some apex pins were found cracked during a manufacturing inspection. With no evidence of prior inspection failures nor cracks being found in-service, no action was taken against parts already produced. However, in response to the defective batch, the initial radius under the head of the machined pin was increased.

Additionally, in 2018 the company generated a design guidance document for radii in high strength steel parts prior to heat treatment in response to inspection failures in different parts.

Figure 7: Crack location

Source: Airbus S.A.S. modified by the ATSB

Manufacturing inspection

In accordance with Safran manufacturing procedures, apex pins underwent inspections during, and after, manufacture but before being released to service to ensure the part conformed to design specifications. Because the component was heat-treated to improve mechanical properties, the pin underwent an MPI. All pins in the occurrence batch passed the MPI inspection. That batch contained both pins that failed in service and five others subsequently found cracked.

The manufacturer’s investigation found that the inspector who conducted the MPI inspection on the batch of parts met qualifications, performance reviews, audits, eyesight requirements and had demonstrated their ability via MPI rejection of other parts. No personal circumstances were identified that may have influenced the ability of the inspector to detect cracked components and the organisation’s on time performance, capacity and production changes were also assessed with no unfavourable results. Part‑specific NDT technique and MPI process controls were also checked and found to conform to specification requirements.

Communications during the flight

Jetstar Operations Control Centre (JOCC) was responsible for the coordination and day‑to‑day running of the aircraft fleet. The JOCC used company HF frequencies and satellite communications to pass updated weather and operational changes to aircraft in flight. These means of communication were also used by flight crew to seek engineering support from the Maintenance Operations Centre (MOC) who had a Duty Technical Manager (DTM) at the JOCC.

Jetstar also utilised company VHF airband frequencies at major airports to pass operational information to crews of aircraft on the ground as well as those airborne in the local vicinity. Flight crew could also use this local VHF frequency to advise engineers at the airport of maintenance issues with their aircraft. Jetstar policy was that for any abnormal operations or delays, the JOCC would coordinate communications and be responsible for the company response. Thus, the JOCC was the primary point of contact in the event of any abnormal operations.

Flight crew could use company frequencies at certain times of the flight, however, during take-off and approach to land, sterile flight deck procedures^[17] were in place and flight crew did not monitor company radio frequencies, nor use ACARS.

Communication timeline

The following timeline of the occurrence and the communications during the incident was developed from multiple sources, mainly telephone calls and ATC VHF radio call records. As the Jetstar company VHF radio calls were not recorded, the times are approximate.

Table 2: Timeline

* estimated

Sydney Airports Corporation Limited (SACL) Car 4 retrieved the FOD and took the part to Qantas Engineering, as the majority of aircraft using taxiway C were Qantas operated. Qantas Engineering identified the part as from an A320. As Qantas did not operate that aircraft type, they redirected SACL to Jetstar Engineering. The part subsequently arrived at Engineering about 23 minutes before VH-VFN landed.

Linking the two events

The ATC centre in Sydney linked the FOD to VH-VFN as they received information directly on both events, albeit through different controllers. This meant the crew of VH-VFN was informed an unidentified aircraft part had been found on the taxiway less than 5 minutes after the aircraft took off and only 3.5 minutes after the FOD was reported to ATC.

Information related to the discovery of the apex pin on the taxiway and VH-VFN’s MLG retraction issues were received by separate parts of Jetstar. The organisation only had a limited time to link the two events given VH-VFN would turn off direct communication channels with the company during the approach which commenced 11 minutes before the landing.

Four Jetstar personnel (Jetstar Operations, Safety, Maintenance Watch and the Duty Captain) had a group call to brief and troubleshoot the reasons for VH-VFN returning to the airport. From the ECAM messages automatically relayed from the aircraft to Maintenance Watch, they correctly identified that the failure of the MLG leg to uplock was the primary issue and that the gear door not closing was a consequence.

Given it was the third flight of the day, they ruled out gear pins^[18]still being installed as a cause. They concluded, at 1100, no action was required until the aircraft landed. At that stage, this key group was unaware that the apex pin remnant had been found and been with Jetstar Line Maintenance for 13 minutes.

Shortly after the group call ended, Jetstar representatives made multiple attempts to contact VH‑VFN via company frequency which was indicative of the organisation successfully linking the two separate events.

Communication with aircraft

While airborne, the flight crew contacted Line Maintenance on the company VHF frequency at least twice. Line Maintenance informed the flight crew that a part had been found but it had not been positively identified. They further advised the flight crew to follow their procedures to manage the situation, which was in line with multiple Jetstar procedures manuals. The captain reported to the ATSB that they were frustrated that the part could not be identified.

The flight crew, having completed all checks, thinking that no further information from Line Maintenance would be forthcoming and believing it was only a gear door issue, initiated an approach for a return landing at Sydney Airport.

It was reported that contact with VH-VFN on the company VHF frequency was delayed in part due to reluctance to broadcast details over an open radio frequency. This was due the media and external persons often monitoring exchanges. It was mentioned in the company’s administration manual for personnel to be mindful of this fact.

Direct radio contact with VH-VFN was additionally complicated when the company frequency became congested due to the ‘hard stop’ call by Line Maintenance going out to taxiing aircraft. Multiple taxiing aircraft were using the frequency to determine the reason for the call back and requesting gates to return to.

By the time the JOCC, MOC and Duty Captain contacted the flight crew via Line Maintenance on the company VHF frequency regarding the criticality of the now identified part, the aircraft was on approach to land. Due to sterile flight deck procedures, the flight crew was no longer monitoring the company radio frequencies or ACARS messages. As a result, the only effective means of contacting the aircraft at that time was via ATC. ATC procedures permitted the passing of messages from the operator to the aircraft during times of an emergency however, an emergency had not been declared by the flight crew. JOCC personnel twice phoned the Sydney ATC, but no requests were made by JOCC to pass on safety critical information to the aircraft.

In response to this event, the operator advised it had clarified non-normal operational communication guidance for ground crews in the Airport Operations Manual. This included dedicated phraseology for gaining priority on airband frequencies to relay high priority messages.

__________

11. Aircraft Communications Addressing and Reporting System is a digital datalink system for transmission of short messages between aircraft and ground stations via airband radio or satellite.
12. Maintenance Watch – Most airlines have a group called Maintenance Watch. This is an engineering part of the organisation that actively monitors the airworthiness status of the company’s fleet, particularly aircraft flying. They monitor real-time aircraft data, including system warning messages, received by ACARS and arrange for aircraft swaps when aircraft become unserviceable. They also provide engineering expertise to the organisation and flight crew regarding the aircraft and its systems
13. Magnetic Particle Inspection: is a non-destructive inspection (NDI) process for detecting surface and shallow subsurface discontinuities in ferromagnetic materials. The process puts a magnetic field into the part which is distorted by the discontinuity. The change in magnetic field is highlighted by ferrous particles applied to the surface either dry or in a wet suspension.
14. An Alert Operators Transmission is Airbus service documentation that requires immediate, urgent or timely action to be taken by an operator to ensure the ongoing safe operation of affected aircraft. It is broadly equivalent to a Service Bulletin and is usually issued in response to a newly discovered service fault that may affect other operators.
15. Quench hardening is a mechanical process in which steel and cast-iron alloys are strengthened and hardened. The part is heat soaked at an elevated temperature (800-900ºC), then rapidly cooled in water, oil or air to set certain crystalline structures, locking in favourable mechanical properties.
16. Quenched parts are often tempered to reduce brittleness and increase low fracture toughness that may result from the quench hardening process. It involves reheating the part to a temperature lower than the quench step (200-700ºC) and slowly cooling to relieve internal stresses and permit some crystalline restructuring.
17. A sterile flight deck environment incorporates procedures throughout safety critical phases of flight, such as take-off and approaches to landing, during which non-essential activities and communications by flight crew are not permitted.
18. Gear pins – are pin inserted into key locations in the MLG retraction mechanism to ensure the undercarriage cannot be inadvertently retracted on the ground. Pins will be installed while the aircraft is on the ground overnight or in maintenance but not during a turnaround.

Safety analysis

Introduction

On departure from Sydney the Airbus A320 landing gear failed to completely retract. Faced with limited specific information on the nature of the malfunction, the flight crew made the decision to return to Sydney, landing safely. The ATSB found that the failure of the left main landing gear (MLG) torque link apex pin, which was found on a taxiway, allowed the wheels to rotate out of proper alignment. This stopped that landing gear from retracting and caused damage to other systems on the MLG.

This analysis will examine the reason for the apex pin failure along with the associated inspections and maintenance programs for identifying defects. In addition, it reviews the actions taken by the flight crew and ground-based support infrastructure during the incident.

The ATSB found the flight crew response to the incomplete undercarriage retraction and subsequent landing was conducted in a proficient manner.

Apex pin manufacturing

The apex pins were manufactured by initially machining an oversize profile, which was then heat treated and finally machined to size including a large relief radius under the pin head. The identification of temper scale on the crack face from the heat treatment was conclusive evidence that the crack found on the occurrence pin (and several others) was induced as part of the quenching process. The initiated cracks were large enough they were not completely removed by the subsequent machining process.

While it was established that the radius of the initial machining under the head was too small to prevent heat‑related cracking, most pins did not crack. It was concluded that another factor, or factors, were required, in combination with the size of the radius, to initiate a flaw. These factors included variations in cutting tool sharpness, undercut surface roughness and/or the quenching bath temperature, even though these features may have been within prescribed tolerances.

Manufacturing inspection

The manufacturer’s investigation of the post‑manufacturing inspections focused only on the initial batch of 12 pins, two of which had failed in service and five pins were subsequently found cracked. The review of the human factors and organisational elements of the company at the time could not determine why these cracks were not found in this batch during the routine non‑destructive testing (NDT) magnetic particle inspection (MPI).

Before the manufacturer’s investigation was completed, and as a result of the airworthiness directive, 15 pins were found cracked from adjacent batches and four pins found cracked from other batches. These additional pins indicate it was unlikely cracking in pins at manufacture was a one-off event. The identification of cracks in 2014 that resulted in a manufacturing change also indicates that it was possible for cracks to be identified at manufacture.

Torque link disconnect

Following initiation of a crack during manufacture, the head of the apex pin fractured from the shank due to cyclic fatigue. The exact time of this event could not be determined. This left the apex pin shank free to migrate from the MLG upper and lower torque links thereby allowing them to disconnect just after pushback from the gate. The apex pin shank was shed onto the taxiway approximately 250 m from the pushback position.

The consequence of the torque link disconnection during the taxi and take-off was the misalignment of the MLG. During the flight the MLG was retracted twice. In both cases, either the MLG failed to lock in the retracted position or the MLG did retract successfully but the aircraft failed to sense this, i.e. sensor failure. Given the potential for misalignment without the apex pin, incomplete retraction of the MLG was considered the most likely reason. That conclusion is reinforced by the Captain’s comment regarding the unusual airflow noise. Damage to other systems including the brake lines on the MLG was further evidence the wheel set rotated out of alignment, contacting the upper torque link and adjacent equipment.

Risk analysis conducted after the incident regarding the loss of brakes on one wheel set concluded that an aircraft would remain directionally controllable at high speed due to the effectiveness of the fin and rudder, and at low speed with the nose wheel steering. The braking distances were determined to have increased by approximately 10-15 per cent.

While the disconnected torque link reduced the directional stability and braking performance due to the misaligned axle and failed left brake set, the degradation was manageable, and the aircraft landed safely. The use of runway 25 would have been acceptable, however the crew’s choice to request and use the longer runway 34L was prudent.

Flight crew decision making

The failed apex pin was collected from the taxiway approximately 40 minutes prior to VH-VFN landing. Within 15 minutes of the part being collected from the taxiway, the crew were advised by ATC that the object was likely associated with an aircraft’s landing gear. At about this time, the pin was delivered to Jetstar Line Maintenance. While Line Maintenance were identifying the part, Jetstar Operations Control Centre (JOCC) was troubleshooting the reported landing gear ‘failure to uplock‘ issue with VH-VFN. Being unaware of the failed pin and based on information available to them, the JOCC determined the aircraft could be examined after landing.

After completing troubleshooting procedures, with no additional issues identified, the flight crew elected to return to Sydney Airport. During this time, the captain requested additional information on the part found on the taxiway from ATC and Jetstar however, at the time of those requests it had yet to be positively identified. While the flight crew perceived the issue to be associated with the landing gear door, they mitigated their limited information by requesting the longer runway and for emergency services to be on standby. In this instance, these measures were not required however, they were effective in enhancing safety for a landing with an unknown problem.

Communication

For airborne Jetstar aircraft, communication with the company was primarily received and coordinated by the JOCC through HF, ACARS or Satellite communication methods. For operational reasons, the company had a local company VHF frequency at many airports that flight crew could use to communicate with local ground and engineering staff for efficient running of the business.

While this was a valid and efficient secondary line of communication, the JOCC had no visibility of these communications. For this reason, Jetstar procedures required all entities of the company to inform the JOCC of diversions, delays, or defects. Any communications with airborne aircraft beyond normal routine operational messages were required to go through the JOCC/Duty Captain to ensure consistent and appropriate messages were passed to flying aircraft.

Messages to the flight crew before the formal identification of the part followed the operator’s procedures/policy of only passing factual information to the aircraft crew. Having considered the provided information, the crew elected to return to Sydney Airport. While that decision was reasonable in the context of what the crew knew, the aircraft had 80 minutes of fuel remaining and there was no immediate urgency to return to the airport. It also meant that JOCC and Line Maintenance had a significantly reduced timeframe to identify and determine the severity of the fault. As such, an opportunity was lost for the organisation to gain a more complete picture of the situation while the aircraft was still airborne.

The company procedures prevented troubleshooting advice and non-factual information being passed to the aircraft. The policy was based on prior experiences of non-standard technical advice and workarounds being passed to aircraft, sometimes with detrimental effect.^[19] However, advice to the flight crew that people on the ground were working to identify the part and a suggestion that the aircraft continue to hold until that time, if able, would have been valuable to the crew on this occasion. The captain stated in an interview that had they known the identity of the part, they would have changed their approach to the landing preparations, including preparing the cabin for an emergency landing and enacting airport emergency procedures.

Jetstar policy and procedures required Line Maintenance to notify the JOCC when it was realised the part may be from an airborne aircraft despite Line Maintenance being in contact with the flight crew. As the aircraft was airborne, it was the JOCC’s responsibility to coordinate communication with VH-VFN. While that process was essential for ensuring accurate and coordinated information was passed to aircraft’s flight crew, on this occasion, a potential message to the aircraft was delayed while the part’s identity was clarified and confirmed by the JOCC.

Following positive identification that the detached pin created a potentially hazardous situation, ground personnel endeavoured to get a message to the flight crew. However, they were unable to contact them because the flight crew had started the approach to landing and, as per procedures, stopped monitoring the company frequency. Expeditious messaging to aircraft needs to be balanced with coordinated and accurate communication.

Failed apex pin temporarily reinstalled

Due to unavailability of spares, Jetstar temporarily reinstalled the failed apex pin shank into the torque link. This action was to enable safe towing of the aircraft to the maintenance hangar however, it had the potential to damage evidence on the fracture surface. At that time, the apex pin shank was the only piece of evidence available. Ultimately, the apex pin head was located, and analysis of both fracture surfaces determined the failure mechanism.

Notwithstanding unavoidable situations, where possible, preservation of evidence is vital in determining the circumstances of an occurrence and identifying safety issues that may present a hazard to continued operations.

__________

19. ATSB AO-2018-056 Depressurisation and crew incapacitation, Boeing 737-376SF, VH-XMO

Findings

From the evidence available, the following findings are made with respect to the landing gear malfunction involving Airbus A320, VH-VFN that occurred on departure from Sydney Airport on 1 August 2019.

Contributing factors

• During the manufacture of the apex pin, the initial machined profile led to unintended stress concentrations at the quench stage of the material heat treatment process that resulted in the part cracking. The crack was not removed by the final machining process. (Safety issue)
• Despite apex pins being subject to magnetic particle non-destructive inspections during manufacture, for reasons that could not be identified, this inspection did not detect the crack that was present in the occurrence pin.
• The head of the apex pin failed due to cyclic structural fatigue, which led to disconnection of the left main landing gear (MLG) torque link. This left the MLG strut free to rotate out of fore/aft alignment.

Other factors that increased risk

• The MLG brakes failed due to the strut rotating and a wheel contacting and fraying a hydraulic hose. This most likely occurred during take-off.
• Despite the failed part and aircraft being positively identified by elements within Jetstar, a message was unable to be conveyed to the flight crew who returned for landing unaware of the true nature of the undercarriage defect and the associated risks. The additional information would have improved crew decision making.

Other findings

• The undercarriage failed to fully retract by not engaging the gear uplocks and not permitting the gear doors to fully close. This was likely due to the wheels and axle being out of alignment.
• The torque link disconnect, the consequential landing gear misalignment and brake failure had the potential to reduce directional control and braking performance on touchdown. However, the degradation was manageable, and the aircraft landed safely.
• The failed apex pin was temporarily reinstalled by engineers to enable the towing of the aircraft off the taxiway and back to a gate for disembarkation. This had the potential to damage evidence on the fracture surface. At that time, the pin shank was the only piece of evidence available to understand the failure mechanism as the pin head had not yet been located.

Safety issues and actions

Crack initiated during manufacture

Safety issue number: AO-2019-039-SI-01

Safety issue description: During the manufacture of the apex pin, the initial machined profile led to unintended stress concentrations at the quench stage of the material heat treatment process that resulted in the part cracking. The crack was not removed by the final machining process.

Safety action not associated with an identified safety issue

Additional safety action Jetstar Airways

In response to this event, the operator advised it clarified non-normal operational communication guidance for ground crews in the Airport Operations Manual. This included dedicated phraseology for gaining priority on airband frequencies to relay high priority messages.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the captain of the incident flight
• Jetstar Airways Pty Ltd
• Airbus
• Safran Landing Systems
• Bureau d’Enquêtes et d’Analyses (France)
• Airservices Australia
• Sydney Airport Corporation Limited
• recorded data from the Quick Access Recorder on the aircraft.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew
• Jetstar Airways Pty Ltd
• Airbus
• Safran Landing Systems
• Bureau d’Enquêtes et d’Analyses (France)
• Civil Aviation Safety Authority

Submissions were received from:

• a flight crew member
• Jetstar Airways Pty Ltd
• Airbus
• Safran Landing Systems
• Bureau d’Enquêtes et d’Analyses (France)

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.

The ATSB commenced an investigation into a train runaway operated by Genesee & Wyoming Australia (GWA), which occurred on 31 July 2019. The train was operating within the Liberty Primary Steel complex at Whyalla, South Australia.

Within the steelworks, GWA operated trains using a single driver. The driver controlled the locomotive through a combination of cab controls and remote control equipment depending on the task (transiting, loading, unloading).

At about 0815 (Central Standard Time) on 31 July 2019, a driver was connecting a pair of locomotives to an empty rake of wagons using the remote control equipment. The driver was in the process of transferring control from the remote control to the locomotive cab. At about 0824, while in the locomotive cab, the driver noticed that the train was beginning to move backwards, towards the steelworks. At that time, the removable locomotive control handles were not in their normal location, so the driver was unable to operate the train’s airbrakes. The driver attempted to stop the train by applying the mechanical handbrake outside the locomotive cab, but this had no effect. With the train accelerating, the driver chose to jump off while the train was moving at low speed, and alert train control.

For about 11 minutes, the empty train rolled through the steelworks yard, reaching a maximum speed of 51 km/h over track with a permitted speed of 15 km/h. The train passed over eight level crossings and crossed a railway track used to move rail wagons carrying molten iron. As the track levelled out, the train slowed by itself and stopped on the steelworks balloon loop. The train travelled about 6 km without a driver in control.

Initial information from GWA suggests that while transferring control from the remote equipment to the locomotive cab, a pneumatic connection was closed before the brake pipe had been exhausted. This condition, combined with an undetected fault on one locomotive, resulted in all brakes releasing and the subsequent train runaway.

The Government of South Australia funds the ATSB, through a charging agreement, to undertake safety investigations for incidents that occur on intra-state rail networks in South Australia. At the time of this incident, the funding agreement had expired, although the Government of South Australia is committed to working with the ATSB to draft the terms for a future agreement. While the ATSB initiated a safety investigation under the TSI Act, the Government of South Australia informed the ATSB that they considered additional investigatory effort would not provide any increased understanding of the root cause of the incident, and had decided not to fund any ongoing activities. Consequently, the ATSB has discontinued this investigation.

_____________

The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence.

Safety summary

What happened

On 28 July 2019, the pilot of a Van’s RV-6A aircraft, registered VH-ANU, conducted a private flight from Coober Pedy to William Creek aircraft landing area, South Australia. After touching down with the main gear first, the nose gear touched the runway momentarily. The pilot noted that although the nose gear lifted off after touchdown, the main gear stayed on the runway.

When the nose wheel made contact with the runway surface for the second time, the nose gear bent under the aircraft. The propeller struck the runway and the aircraft skidded on its nose, then flipped over and came to rest inverted.

The pilot sustained serious injuries and the passenger minor injuries. The aircraft was substantially damaged.

What the ATSB found

The ATSB found that during the landing sequence, the ground clearance of the nose gear fork or strut was reduced sufficiently to allow them to contact the runway surface. This initiated the damage to the nose gear and resulted in the aircraft becoming inverted.

Safety message

A reduction in the nose gear ground clearance during landing can result in the nose gear strut or fork impacting the runway and affect the structural integrity of the nose gear. In the tricycle variants of Van’s aircraft, the factors that can affect nose gear ground clearance include the dynamics of the landing, tyre pressure, weight over the nose gear, and runway condition and characteristics.

After-market devices fitted to this aircraft aimed at reducing the risk of a nose-gear collapse and aircraft inversion, did not prevent the accident.

The occurrence

What happened

On 28 July 2019, the pilot of a Van’s RV-6A aircraft, registered VH-ANU, conducted a private flight from Coober Pedy to William Creek aircraft landing area, South Australia. Due to the prevailing northerly winds of around 20 knots, the pilot elected to land on runway 03. That runway was unsealed, with a sand and gravel surface and was dry and in good condition on the day, with no significant imperfections.

At 1525 Central Standard Time (CST), the aircraft commenced its final approach. Based on the recorded data, the aircraft crossed the threshold at the recommended approach speed of 70 knots indicated airspeed (IAS) and slowed to 60^[1] knots just before touching down with a rate of descent of about 140 feet per minute. This was consistent with the pilot’s recollection of the event.

The pilot reported and the recorded data confirmed that the main gear touched down first. Shortly afterwards, the nose gear touched the runway momentarily. The pilot noted that although the nose gear lifted off the runway, the main gear stayed down.

When the nose gear made contact with the runway surface for the second time, it bent under the aircraft. The propeller struck the runway and the aircraft skidded on its nose, then flipped over and came to rest inverted (Figure 1).

The pilot sustained serious injuries and the passenger minor injuries. The aircraft was substantially damaged.

During the accident sequence, no fractures were sustained by the nose gear strut or the fork. The principal deformation was the bending in the aft direction at the top of the strut, near the engine mount (Figure 2).

Figure 1: Accident site of VH-ANU

Source: South Australia Police

Figure 2: Damage sustained by the nose gear

Source: South Australia Police

Nose gear information

On 12 August 2005 in Alaska USA, a Van’s RV-9A aircraft nosed over during the landing roll and sustained substantial damage. In response, the US National Transportation Safety Board (NTSB) conducted an examination of the nose gear strut and fork from the Van’s Aircraft series RV-6A, -7A, -8A and -9A. The study examined data from 18 previous accidents and one incident, in which Van’s aircraft became inverted during landing. Several involved hard landings such as hard touchdowns, bounced landings (six), or landing in a slip. Several others involved off-field landings in rough terrain, hitting a ditch, or going down an embankment.

The study examined the strength of the nose gear and the possible effects of tyre pressure, engine weight, runway condition and some dynamic considerations that could affect nose gear clearance. The conclusions of the study were:

• The nose gear strut had sufficient strength to perform its intended function.
• In all cases examined, the landing gear struts and forks made contact with the runway surface, initiating the damage sequence.
• Tyre pressure, engine weight over the nose gear, runway condition and the dynamics of the landing (including washboarding^[2]) can affect the ground clearance and therefore the likelihood of the strut or fork contacting the runway surface.

In 2007, prior to the release of the NTSB Study, Van’s issued a mandatory Service Bulletin with a redesigned nose gear that provided greater ground clearance. VH-ANU was compliant with the Van’s Service Bulletin.

VH-ANU was also fitted with two after-market devices to the nose gear. One device was intended to increase the rigidity of the strut and transfer landing forces to the top of the strut near the engine mount. The second was a device intended to minimise the chances of the gear digging into the runway surface in the event that the strut came in contact with the runway.

Previous Australian Occurrences

A review of the ATSB occurrence database identified 49 nose gear collapses in Australian-registered, single-engine, piston-powered, fixed-wing aircraft between 2009 and 2018. Four of these occurrences involved Van’s Aircraft. Of the four, one resulted in serious injuries and was investigated by the ATSB (AO-2017-001). Due to the date range used, the current occurrence was not included.

Safety analysis

The ATSB reviewed the damage to the aircraft and found that the nose gear did not sustain a fracture through any of the major structural components (i.e. the nose gear strut or fork), but had deformed rearwards, under the aircraft. For this to have occurred, the ground clearance must have been sufficiently reduced so that the nose gear strut or fork made contact with the runway, imparting significant forces on the gear assembly and initiating the damage sequence.

The factors that affect the ground clearance during landing include the tyre pressure, engine weight, runway condition and dynamics of the landing. In this accident, the exact mechanism by which the gear made contact with the runway was not determined.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During the landing sequence the nose gear fork or strut made contact with the runway surface and bent underneath the aircraft, causing it to become inverted.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The stall speed of the aircraft with flaps extended was 42 knots.
2. Washboarding or corrugation is the formation of periodic, transverse ripples in the surface of gravel and dirt roads.

Safety summary

What happened

On 30 July 2019, a British Aerospace BAe146-RJ85 aircraft, registered VH-NJW and operated by National Jet Express (Cobham), was being prepared for a charter flight from Perth Airport to Granny Smith, Western Australia. During the pre-flight checks, the flight crew did not identify that there was no pressure in the braking system and did not pressurise this system prior to engine start.

Around the time of the start of the final engine in the starting sequence, the aircraft began to roll forward.

The dispatcher noticed the aircraft rolling and alerted the crew. The crew attempted to use their foot brakes and the park-brake, however, there was no brake pressure. Around 18 seconds after the aircraft started to roll, it collided with objects at the edge of the apron.

What the ATSB found

The ATSB found that the flight crew did not effectively check the brake pressure during pre-flight checks. Procedures required that the captain check brake pressure during two separate checklists, which provided two opportunities to pressurise the hydraulic system before engine start. There was also a shared responsibility for the first officer to monitor and cross-check. These checks were not done effectively and as a result, the crew did not identify that there was no available pressure prior to engine start.

The operator's dispatch practices did not involve placing chocks on the nose-wheel once the main wheel chocks were removed for engine start. At engine start, there was no brake pressure restraining the aircraft, nor was there any chock to prevent an inadvertent roll forward. The combined thrust of the four aircraft engines at idle and the slight apron slope caused the aircraft to inadvertently roll forward.

The absence of braking pressure also meant that the crew were not able to stop the aircraft with the aircraft brakes. The crew had a very limited opportunity to take corrective action before the aircraft collided with infrastructure. It is likely that the short distance to the terminal and the influence of surprise combined to reduce the pilots' ability to respond.

What's been done as a result

Cobham have sent a notice to check and training captains reminding them of the importance of vigilance during checklists.

Cobham have also reported that they plan to revise procedures to include the requirement to use nose-wheel chocks when dispatching from stand-off bays and to align all applicable procedures to capture this requirement.

Safety message

This investigation highlights the importance of ensuring all checklist items are addressed.

As highlighted in this accident, individuals can be vulnerable to omit checklist items and this can lead to accidents. Aviation safety relies on a resilient safety system involving multiple defences. In the context of multi-crew operations, one of the key defences against this type of accident is the other pilot. Monitoring and cross-checking can provide a last line of defence to trap individual errors.

Although safety systems should seek to reduce the development of errors, where possible engineering defences should also be used to reduce error consequences. Simple mechanical barriers, such as chocks, can be an effective defence.

The occurrence

What happened

Aircraft preparation

On 30 July 2019, a British Aerospace AVRO 146-RJ85, registration VH-NJW (NJW), operated by National Jet Express (Cobham) was being prepared on Cobham bay NJ1, Perth Airport, for a charter flight to Granny Smith, Western Australia. The flight crew comprised the captain and the first officer (FO). In addition, there were 62 passengers and two cabin crew on board.

The flight crew signed on for duty at around 1330^[1] for a scheduled departure time of 1430. The captain and the FO arrived at the aircraft and commenced pre-flight duties at around 1345.

While the captain and the FO completed the pre-flight checks, they remarked that the apron and the hangar were busy. A new aircraft was arriving later that afternoon and there were many people positioned around the apron to observe its arrival.

At around 1415, the dispatching engineer took position at the right side of the aircraft to operate the aircraft headset. He contacted the flight crew and requested clearance to remove chocks, which were at that stage installed on the outboard wheels of the left and right main landing gear.

After the captain gave the engineer clearance to remove the chocks, the engineer proceeded to walk around the outside of the aircraft, removing the left and right main wheel chocks. At around 1416, the engineer dragged both chocks away from the aircraft, off to an equipment bin at the edge of the apron.

Around this time, as part of the pre-start preparations, the flight crew conducted the originating checklist.

Engine start

At 1419, the engineer returned to the headset position on the side of NJW. The captain called the engineer, who confirmed that the chocks had been removed and the doors and panels had been secured, and that the crew were clear to start all engines. The engineer remained plugged in to the headset while he observed the engine starts.

After receiving the clearance from the engineer, the crew conducted the starting checklist.

After completing the starting checklist, the captain commenced starting the aircraft’s four engines, in the normal 4-3-2-1 sequence, from right outboard engine to left outboard engine. The captain and the FO monitored engine indications to confirm the stable start of each engine. The FO monitored the engine light for each engine to confirm when the starter motor had disengaged and called ‘starter cut-out’ for each of engines four, three and two, as each completed a stable start.

NJW rolls forward

At about 1424, NJW started moving forward. The engineer, who was still connected to the aircraft via the headset, noticed that NJW was moving and alerted the crew. The engineer alerted the crew at about the time the FO called ‘starter cut-out’ for the stable start of engine one.

The crew said that they were confused and alarmed when they heard the engineer and took a moment to confirm that they were in fact moving forward. The crew recalled that their actions following this were:

• The captain’s first action was to apply his foot brakes, only to observe that they had no brake-line pressure. The FO tried his foot brakes at around this time, which was also ineffective.
• The captain also recalled that he tried using the park-brake, which was ineffective.

The FO heard a loud bang, which he said was consistent with the sound of the park-brake releasing upon application of the foot brakes. The FO recalled this was shortly after he tried using the foot brakes.

With the aircraft rolling towards objects at the edge of the apron, the captain reached up to the overhead panel where the hydraulic pump switches are located. The captain said he could not recall what his intention was for this action, but said that he did not complete whatever that action was supposed to be.

About 18 seconds after the start of the roll-forward, NJW collided with movable aircraft stairs, which were in front of the Cobham terminal. The stairs struck the front of the aircraft, beneath the right pilot seat. Shortly after, NJW collided with a bollard in front of a light pole, then with the light pole itself. The roll-forward and collision with airport infrastructure was captured on Cobham CCTV (images shown in Figure 1).

Figure 1: CCTV showing start of roll-forward (top) and collision with infrastructure (bottom)

Source: Cobham, Original image cropped and annotated by ATSB

The aircraft was substantially damaged by the accident (see Figure 2). One cabin crew member was thrown from a standing position into a door handle during the collision with the light pole, but was not injured. There were no injuries to the other crew or the passengers.

Figure 2: VH-NJW following collision with airport infrastructure

Source: Cobham

__________

1. Western Standard Time (WST).

Context

Accident location

The accident occurred on the Cobham apron at Perth Airport. VH-NJW was parked at bay NJ1, which is directly in front of the Cobham terminal buildings in the north-west corner of that apron.

Bay NJ1 is close to the edge of the apron with a slight slope from the parking position towards the terminal. Documentation supplied by Perth Airport indicated that the apron and aircraft parking positions were designed and approved in accordance with the Civil Aviation Safety Authority (CASA) Manual of Standards (MOS) part 139, Aerodromes.

Aircraft information

The BAe 146 is a four-engine turbofan aircraft, manufactured by British Aerospace (BAe). NJW was an Avro RJ85, a variant of the BAe 146. Because NJW routinely operated on gravel runways, metal deflectors (gravel kits) had been fitted to the aft of the nose landing gear.

A detailed mechanical inspection was conducted of the aircraft’s braking systems after the accident. There was no indication that any defects or anomalies were contributory to the collision.

BAe 146/ RJ85 braking system

The braking system consists of the foot brakes and a park-brake. The brakes are powered by the aircraft hydraulic system which has two subsystems: yellow and green. Only the yellow system powers the parking brake while both systems power the foot brakes. A selector switch on the centre console controls which system (yellow or green) supplies power to the wheel brakes.

Two reservoirs store fluid, one for each system. Pumps draw fluid from the reservoirs, pressurise that fluid and in doing so provide power to operate the brakes. Accumulators store fluid under pressure and provide reserves of hydraulic power. A schematic diagram of the hydraulic system is provided in Figure 3 below.

Figure 3: BAe 146/RJ85 hydraulic system schematic

Source: BAe

Systems for supplying brake pressure

The main pumps for providing hydraulic power are the engine driven pumps (EDPs). These pumps require engine power to operate. Without engine power, the yellow system can be pressurised by an AC electrical pump. When the AC pump is activated, it supplies pressure to the brake system almost instantaneously.

During a normal pre-flight sequence, the yellow system would only be pressurised using the AC pump. This would be done on an as-needs basis following the check of the park-brake during the originating checklist and of the brake pressure during the before start checklist. The EDPs will only supply pressure after they are selected on during the After start checks.

Power for the green system is primarily supplied by the number 3 engine EDP. Without engine power, the green system is pressurised by Power Transfer Unit, which is mechanically powered by the yellow system. Therefore, prior to engine start, without accumulated pressure or yellow system power, the green system will not be pressurised.

Yellow system brake accumulator

The brake accumulator is a secondary reservoir in the yellow system that supplies emergency and park-brake pressure. No pump is needed to supply pressure to the yellow system if the brake accumulator has been charged. The brake accumulator can be charged through the AC pump or using the emergency DC pump.

The accumulator, once charged, stores pressure. The pressure stored in the accumulator decays, however, the decay rate is normally low enough to ensure adequate park-brake pressure for around 150 minutes. The rate of decay increases if the park-brake valves are in poor condition.

A specific inspection was conducted on the pressure decay rate of the brake accumulator from NJW, which complied within the manufacturer’s specification of 150 minutes. Prior to the scheduled flight to Granny Smith, the aircraft had returned at 0847. Therefore, it had been well over 150 minutes since the aircraft was powered.

Controls and Instruments

Gauges on the captain’s instrument panel indicate the pressure available in the yellow and green hydraulic systems (hydraulic pressure). Gauges in front of the left-side (captain’s) control column indicate the level of pressure being supplied by the yellow and green systems (brake pressure).

The foot brakes are located in front of each pilot, as they sit in their flight seats.

The park-brake handle is located on the centre console. The park-brake can be released by depressing the right-hand seat brake pedal or by moving the handle. Disengagement of the park-brake on the RJ85 tends to produce a ‘bang’ sound, unless the park-brake handle is guided down to the un-activated position.

Low accumulator pressure warnings

When the brake accumulator pressure is less than 2500 psi, a BRK ACC LO PRESS annunciator light illuminates on the hydraulics panel, overhead the left-hand seat. The activation of the warning on the hydraulics panel triggers the illumination of the HYD↑ caption on the Master Warning Panel (MWP), which will cause amber attention-getting lamps on the glare-shield to flash and a single chime sound.

By pressing the attention-getting lamps on the glare-shield, pilots can acknowledge the warning light on the hydraulics panel, which will have the effect of dimming the light. Acknowledging warnings means that existing warnings are no longer displayed at full brightness, however, if triggered, new warnings will be displayed at full brightness.

The MWP also has a Test and Ground Operation switch. The BAe 146 Aircraft Maintenance Manual describes the function of this switch, when pulled into the ground operation (mute) position:

the light intensity on the MWP is set to a level sufficient to have seen under average daylight conditions, the bright-up function, the triple and single-chime inputs to the audible warning system and the red warning and amber caution lamp flasher circuits are inhibited. The switch has an integral red warning light to indicate that the mute system is in operation.

The pilots reported that they did not recall seeing or hearing any alerts or warnings during the accident sequence. The FO stated that the Test and Ground Operation switch had been pulled (to ground operation) prior to power on. This switch had been pushed in (to the normal position) prior to engine start, as per the operator’s Power-on Checklist procedures. The FO also stated that it was normal practice to see the hydraulic caption on the MWP activated prior to engine start.

Pre-flight procedures

The ATSB examined the pre-flight procedures used by Cobham crews, particularly as they relate to setting and pressurising the aircraft brake system. The primary document for these procedures was the Cobham manual OM-B2-146, BAe146 Aircraft Operating Manual (The operating manual). The other source was the British Aerospace Flight Crew Operating Manual (FCOM) for the BAe146/RJ series aircraft. The operating manual states that it takes precedence over the FCOM.

In terms of the use of checklists, the operating manual states:

The Checklists allow the development of ‘scans’ which can be accomplished before the checklist is read… The checklist then becomes the means to verify that items have not been forgotten…

The ‘Challenge and Response’ method shall be used, which requires the pilot reading the checklist to call the ‘Challenge’, after which both pilots shall, if physically possible, visually verify that the required action has been completed, and then the pilot nominated on the checklist as the respondent (usually the pilot who completed the action) shall reply with the required response.

Regarding the guidance for both pilots to visually verify each response item, the FO said that he found this difficult. The FO reported that he found it challenging to provide an additional verification of the captain’s checks since he was focussed on performing the duties allocated to him as the first officer. The FO said he thought verifying all of the captain’s actions would result in delays to getting the aircraft away on time.

Originating checklist

The flight crew conduct the Originating checklist (or the equivalent Transiting checklist) prior to engine start for all flights. The originating checklist contained the following checks:

Park-brake. Captain’s responsibility. Select the park brake on and check that the pressure is not less than 1,500 psi.

This checklist item provided an opportunity to check that there was sufficient brake pressure being applied, and to charge the brake accumulators, if required. The captain reported that it was normal to charge the hydraulics using the AC pump during the originating checklist.

The flight crew performed the originating checklist during the pre-flight sequence. The first officer called the item ‘park-brake’ and the captain responded ‘on, pressure checked’.

The captain reported to the ATSB that he recalled performing the originating checklist, but did not have a recollection of performing the check of the park-brake or the pressure gauge. The FO said he could not recall if he looked at the pressure gauge during the originating checklist, to cross-check the captain’s responses.

Starting checklist

The flight crew conduct the Starting checklist after receiving clearance to start the engines from the dispatcher. The first checklist item is ‘Brake Pressure’. The operating manual described this check as ‘ensure the brake pressure is at least 2500 psi immediately before push back or start.’

The crew conducted the starting checklist. For the brake pressure item, the first officer called ‘brake pressure’ and the captain responded ‘check’.

The captain stated he could not recall checking the brake pressure gauge during the starting checklist. The FO reported he could not recall whether he looked at the pressure gauge during the starting checklist.

After start scan

During the start of each engine, the FO monitors the starter operating light and calls ‘starter cut-out’ when the light extinguishes, to indicate stable start. The after-start scans are performed after stable start is confirmed for the final engine in the starting sequence (engine 1). Item 2 of the after-start scan is completed by the captain and included the following:

Select ENG 2 PUMP and ENG 3 PUMP ON and observe YELLOW and GREEN system pressures increase to normal (3100 +/- 50psi). Select PTU on only after GREEN system pressure has been checked.

The crew did not perform the after-start scans because of the development of the accident. This is described in the analysis section following.

Cobham procedures for chocking aircraft

Chocks are routinely fitted fore and aft of aircraft wheels to reduce the risk of the aircraft inadvertently rolling forwards or backwards. The following summarises Cobham procedures for chocking 146/RJ85 aircraft.

Cobham Ground Operations manual, OM-A6

Manual OM-A6 contained higher-level procedures for Cobham ground operations personnel, not specific to aircraft type. These procedures stated that prior to dispatch, ground handling personnel were to remove all chocks from the main landing gear and ensure that a chock was repositioned 150 mm ahead of the nose-wheel. The procedure did not specify any specific requirement, related to nose-wheel chocks, for gravel-kitted aircraft.

Cobham BAe 146 Ground Operations manual, OM-B6

Manual OM-B6 provided type-specific instructions for ground operations on BAe 146/RJ85 aircraft. The manual stated that chocks should be placed fore and aft all wheels, including nose-wheels. The procedures further stated that nose-wheel chocks should be used in windy conditions, or when the parking area was on a slope.

The manual provided limited instructions for the removal and repositioning of chocks in the section describing dispatch duties for aircraft on standoff bays using the intercom. The manual described the sequence of communications that should be made between the captain and the ground, being:

Captain: ‘Brakes parked, clear to remove chocks’

Ground: ‘Chocks removed’

This procedure indicated ground personnel removed all chocks at this stage. It did not specify the requirement to reposition chocks ahead of the nose-wheel, as stated in manual OM-A6.

Cobham BAe 146/RJ85 dispatch training

Cobham dispatch training materials described the steps involved in preparing a 146/RJ85 aircraft for dispatch as including the following:

Remove chocks from the main outboard wheels.

There was no step relating to repositioning chocks to the nose-wheel.

Procedures ‘as done’

The ATSB sought to determine the ‘as-done’ and ‘as-taught’ procedures for using chocks by Cobham dispatchers, to see if there was any variance from the ‘as-written’ procedures. A senior ground handler at Cobham, who was responsible for training dispatchers, advised that normal practice was for dispatchers to remove chocks during dispatch and not reposition chocks to the nose-wheel of any aircraft. Dispatchers were taught to remove chocks in a manner consistent with the dispatch training materials.

The dispatching engineer for NJW indicated he understood the procedures to be that chocks were not fitted to the nose-wheels of gravel-kitted aircraft.

Recorded data

Personnel from Cobham secured a copy of the quick access recorder (QAR) data for analysis and provision to the ATSB. The flight data recorder (FDR) and cockpit voice recorder (CVR) were also removed and dispatched to the ATSB laboratory in Canberra for analysis.

The QAR file provided a record of the entire pre-flight sequence. It shows the engines powering up in sequence (4-3-2-1). Soon after engine 1 began to power-up, the QAR shows an increase in longitudinal acceleration, consistent with the aircraft beginning to move forward. About 18 seconds later, a spike in longitudinal acceleration likely indicates the collision with objects at the end of the apron. All four engines are then shut-down. The QAR shows that there was insufficient hydraulic pressure available in the brake system to provide effective braking throughout the entire pre-flight sequence.

The FDR started recording about 7 seconds before the collision, after which it then stops recording. An examination of FDR data from a previous NJW flight indicated the FDR began recording after all engines had been started and the park-brake was released for taxiing. This would suggest that for this accident, the start of FDR data coincided with the release of the park-brake handle. This is consistent with the FO’s recollection of hearing the park-brake handle release (loud bang) during the rolling sequence.

The ATSB concluded that the park-brake was likely set to ON prior to engine start. However, without sufficient hydraulic pressure, the brakes were not effective.

Ground-cockpit communications

The ATSB considered what each crew member and the dispatcher recalled about what they heard and what they said during the time the aircraft was rolling towards the terminal. The following summarises these recollections:

• The dispatcher recalled that when he saw the aircraft was moving, he said words to the effect of ‘brakes parked’ into his headset. He repeated this several times, with an increasingly urgent tone. The dispatcher said the flight crew did not acknowledge any of these messages.
• The captain recalled hearing the dispatcher say the aircraft was moving via intercom. The captain reported hearing one such alert from the dispatcher and that the dispatcher’s tone was urgent.
• The FO recalled he heard the dispatcher say ‘brakes, brakes’ on his headset, at around the time he (the FO) called ‘starter cut-out’ for engine one. The FO recalled then saying ‘brakes’ himself.

The CVR captured audio relating to the communications between the cockpit and the dispatching engineer. The following table summarises relevant communication:

The recorded audio is generally consistent with the dispatcher’s recollection. The combined evidence suggests that the crew may not have heard the dispatcher’s initial warning about the aircraft rolling. It also indicates that the flight crew were not aware that the aircraft was rolling until four seconds after the initial warning and around ten seconds prior to the eventual impact.

__________

2. Automated Terminal Information Service.

Safety analysis

Hydraulic systems not pressurised

The flight crew did not effectively check the brake system pressure during the originating checklist or the starting checklist. The captain did not identify that the pressure was less than required and consequently, did not pressurise the system prior to engine start. This was contrary to the checking requirements during these checklists.

Due to the low pressure, it is very likely that the BRK ACC LO PRES warning was current throughout the pre-flight sequence. However, the flight crew reported they had pulled the test and Ground Operation into the ground operation (mute) position, which would mean no attention-getting glare-shield lamps would flash and no aural chime would sound.

Furthermore, it is likely that this warning was generated at an early stage of the pre-flight. It would be common for flight crews to receive a low accumulator pressure warning at aircraft power-on since accumulator pressure would likely have decayed and pumps not yet activated. Consequently, flight crew would likely acknowledge the warning with the expectation that normal procedures would subsequently pressurise the accumulator. In such circumstances, the warning would not be effective at alerting the crew that the hydraulic system was not pressurised prior to engine start. The implication is that the safety system is reliant on effective checking by the operating crew.

Research has found that checklist deviations occur relatively frequently, compared to other forms of procedural deviation. Common forms of checklist deviation include responding without checking and performing flow-check procedures as read-do (Dismukes and Berman, 2010).

Flight crews are particularly vulnerable to checklist errors during the pre-flight sequence. During pre-flight, flight crews are faced with many competing requirements and can experience perceived or explicit pressure to make on-time departure requirements. Line observation research has found that the pre-flight stage of flight presented many and varied events that distracted and interrupted flight crews (Loukopoulos, Dismukes and Barshi, 2001).

None of the factors identified in the research were particularly prevalent in the development of this accident. The flight crew were not experiencing significant time pressure and there were no identifiable disruptions during the pre-flight checklists. Although the busyness of the airport due to the impending arrival of a new aircraft was consistent with there being a distraction for the crew, there was no evidence that the crew were distracted in a way that affected their performance of the checklists. On board recorders showed that the crew did not have any non-pertinent conversations while completing the checklists.

Overall, the missed pre-flight checks in this accident are indicative of the general vulnerability to omissions during checklists, particularly in the pre-flight sequence. Checklist performance is imperfect, and as such, resilient systems utilise redundant defences in order to reduce the likelihood of error and to minimise error consequence. The ATSB notes that the development of this accident required two separate omissions from checklist procedures. The safety system therefore did have some redundant controls, but these relied on vigilant checklist performance.

In multi-crew flight operations, one defence against individual checklist failures is the role of the other pilot. Monitoring and cross-checking is a key recovery defence in the multi-crew safety system and deficiencies in cross-checking has been implicated in the development of major accidents (Sumwalt, Thomas and Dismukes, 2002). Dismukes and Berman (2010) suggest that captains should explicitly brief the FO that they (the captain) will make mistakes and it is the job of the FO to detect mistakes and point them out.

While it may be challenging to monitor the other pilot for the entirety of flight preparation and into the flight, it is critical that this monitoring does occur during checklists. The design of checklist procedures reflects the criticality of the checklist items for ensuring safe flight. Checklists are limited to only those items that are critical and checklist procedures are designed so that flight crews have no other tasks to perform while doing the checklist.

In the development of this accident, the initial and primary missed checks related to the captain not performing the checklist items as required to identify no brake pressure. However, there was also a shared responsibility for the FO to monitor and cross-check. The FO did not monitor the checking actions of the captain and did not independently check the pressure systems. Because neither crew member effectively checked the pressure system, there was no braking pressure available during engine start.

Chocking procedures

The dispatcher’s decision to not reposition chocks to the nose-wheel of NJW was consistent with the training provided to ground handling personnel and the normative practice at Cobham. The training provided to dispatchers did not mention a requirement to reposition chocks to the nose-wheel. Prior to the accident, Cobham personnel were not repositioning chocks to the nose-wheel of departing aircraft.

Cobham procedures and training materials did not provide clear instructions regarding the use of nose-wheel chocks during dispatch. One of the manuals did state that dispatchers should reposition a chock to the nose-wheel, while another manual did not specify this requirement.

The absence of a clear requirement to reposition a chock to the nose-wheel of departing aircraft prior to engine start reduced the available defences against uncontrolled roll-forward.

Roll-forward and response

The combined forces of idle thrust from the four engines, and the slight slope of the apron, acted to overcome the inertia of the parked VH-NJW. In the absence of chocks, NJW rolled forward from its parking position. While it is likely that the park-brake was set prior to the start-up sequence, the lack of brake pressure would have made braking ineffective. Similarly, the crew’s attempt to use the foot brakes and the park-brake after the aircraft was rolling had no effect since there was no brake pressure.

After the confirmed stable start of the final engine (engine one), the next step in the normal pre-flight sequence included activating the engine driven pumps as part of the after-start scans. However, the ground handler alerting the crew, and the observation that the aircraft was rolling, meant that the pilots’ attention was diverted away from the normal pre-flight sequence, and toward responding to the perceived emergency situation. As such, the development of the accident meant that the pilots did not conduct the after-start scans.

The parking position NJ1 was close to the edge of the apron. It took around 18 seconds from when the aircraft started to roll to when it struck objects at the edge of the apron. Consequently, there was limited time to identify the problem and take action to recover from the unintended roll-forward.

The dispatcher attempted to alert the crew that the aircraft was rolling shortly after the roll commenced. However, the crew did not hear the initial alert and did not identify that the aircraft was rolling until around four seconds after that alert. It is possible that this delayed alert was associated with the crew listening to the ATIS. The delay in the crew identifying that the aircraft was rolling may have reduced the likelihood of them taking effective recovery actions to pressurise the hydraulic system.

In this case, the crew had around 10 seconds from the time they were alerted that the aircraft was rolling, to when the aircraft struck objects at the edge of apron. In that time, the crew had to confirm that the aircraft was rolling, attempt to use the braking system, identify that there was no pressure, pressurise and then apply the brakes. Time would also be required for the brakes to arrest the movement of the aircraft. The ATSB concluded that there was a very limited opportunity for the crew to take action to avoid the collision.

The crew were surprised when they heard that the aircraft was rolling, which further reduced their ability to respond. Research has shown that responses to unexpected and surprising situations are slower and more variable. For example, simulator research with experienced pilots has shown that upset recovery performance is much worse when pilots are surprised by the onset of the upset (Landman, 2017).

The nature of the crew’s response to the rolling aircraft is consistent with the effects of surprise. The crew reported that they were shocked and confused when they heard the aircraft was rolling and took steps to confirm that themselves. The psychological effects of surprise can include freezing, a loss of situational awareness and not remembering appropriate operating procedures (Rivera, Talone, Jentsch and Yeh, 2014; Burki-Cohen, 2010); the captain’s action of reaching to the overhead panel, then not completing this action, is also consistent with him being surprised by the unfolding accident.

As the crew did not take the necessary steps to pressurise the hydraulic system, they were not able to stop the aircraft rolling forward. As a result of the roll-forward, the aircraft collided with the objects at the edge of the apron.

Findings

From the evidence available, the following findings are made with respect to the Ground collision with airport infrastructure involving British Aerospace AVRO 146-RJ85, VH-NJW at Perth Airport, Western Australia on 30 July 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The crew did not effectively check the brake system pressure during either the originating checklist or the starting checklist. As a result, the crew did not identify that there was no brake pressure prior to engine start.
• After engine start, the aircraft inadvertently rolled forward and collided with objects at the edge of the apron. The absence of brake pressure, the slope of the apron and the absence of a nose-wheel chock were contributory to the aircraft rolling forward.
• The operator's dispatch practices did not involve placing chocks on the nose-wheel for engine start. Although some ground handling procedures indicated nose-wheel chocks should be used, the operator’s training did not involve a step to place chocks on aircraft nose-wheels. The absence of a nose-wheel chock fore of the aircraft reduced the defences against the aircraft rolling forward.
• The crew had a very limited opportunity to take corrective action before the aircraft collided with objects at the edge of the apron. It is likely that the short distance to the edge of the apron and the influence of surprise combined to reduce the crew’s ability to respond.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Cobham reported that following this accident, the internal safety team reminded Check and Training captains that there is a responsibility to observe and verify responses to checklist items, that it is not acceptable to take a checklist response as given. The head of training and checking also sent a notice to check and training pilots which highlighted the requirement of vigilance during checklists. This notice also directed check and training pilots to threat and error management guidelines. As additional actions, Cobham reported that the occurrence will be incorporated into the Cobham Human Factors Training, and that there has been an enhanced focus placed on Line Operations and Safety Auditors to monitor checklist performance.

Cobham reported that they are undertaking several actions related to chocking procedures. This includes updating the procedures OM-A6 and OM-B6 to include the use of nose-wheel chocks for dispatches from stand-off bays. Cobham reported that they are reviewing other procedures relating to chocking and will align all procedures to include the use of nose-wheel chocks. Cobham also reported they have commenced spot checks of chocking during aircraft start, and that these spot checks are ongoing.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, the engineer, Cobham Aviation Services, BAe Systems via the accredited representative the UK Air Accidents Investigation Branch, the Civil Aviation Safety Authority,

Submissions were received from Cobham Aviation Services, BAe Systems, and the first officer. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 13 June 2019, a BRM Aero Bristell NG5, registered G-OJCS, departed Kilrush Airfield, County Kildare, Ireland, for a local flight. Subsequently, recovered data showed that, after a series turns, the engine power was reduced as the aircraft maintained about 3,200 ft, with a reducing airspeed. The aircraft rapidly lost height, and impacted terrain about 30 seconds later. Both occupants were fatally injured and the aircraft was destroyed. There was no fire.

To assist with evidence collection, the Air Accident Investigation Unit (AAIU) Ireland requested an Accredited Representative from the Australian Transport Safety Bureau (ATSB) be appointed. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

The AAIU has completed its investigation and the final report is available on its website.

Any enquires relating to the investigation should be directed to the Air Accident Investigation Unit Ireland.

_____________

The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the AAIU’s investigation of the occurrence.

Safety summary

What happened

In the early hours of 28 June 2019, a fully loaded coal train TM94, travelling in New South Wales from Tahmoor colliery to Port Kembla, derailed one wheelset near Moss Vale. The train crew, initially unaware of the derailment, were notified by train control to stop and inspect the train. A member of the public, who had witnessed a problem with the train, had phoned train control to alert them of an issue. Once the train was stopped, a train crew member discovered that one wheelset on the trailing bogie of the 14th wagon had derailed. The derailed wheelset had travelled approximately 2.6 km past the point of derailment at 150.067 km. This caused damage to the track infrastructure, including approximately 4,350 concrete sleepers.

What the ATSB found

The ATSB investigation found that the derailment was caused by a through-axle failure, on a 7E5S-type axle. The axle failure occurred at the start of a radius transition, approximately 250 mm from the left-hand end of the axle. The fracture of the axle in the No. 1 wheelset led the No. 2 wheelset on the same bogie to derail.

A metallurgical analysis conducted after the derailment found that the axle had corrosion pitting on the axle surface adjacent to the likely fracture initiation point. The fracture surface featured a discoloured area of corrosion, which extended 16 mm into the axle cross section. This was evidence of a crack which existed prior to the final complete brittle failure of the remaining axle section.

An examination of maintenance records found that non-destructive testing had not been carried out on this wheelset during the last two maintenance activities in January and November 2016. Testing, if conducted, would likely have detected the initiation of the axle crack, which probably existed at that time.

What's been done as a result

As a result of this derailment, Pacific National commenced and completed a program of non-destructive testing of axles, in-situ, to ensure that no axles pose an immediate risk of failure. This included all 7E5S axles and involved ultrasonic testing.

A Rolling Stock Notice was also issued, to reinforce to Pacific National’s wheel set overhaul contractors of the requirement to inspect and test the fillet radius for all axles where bearing removal is mandated.

Safety message

Rolling stock operators and maintainers should ensure that axle maintenance and inspection procedures include non-destructive testing of known defect areas as part of the regular maintenance program. Records of these inspections should be kept for the life of the asset within their asset management system.

The occurrence

What happened

On 27 June 2019, at 1730,^[1] a Pacific National train crew signed on at the Illawarra Bulk Terminal, Port Kembla, New South Wales to operate an empty coal train, TM93, to the Tahmoor colliery. The train arrived at the colliery at 2133 without incident, and the 45 wagons were loaded with coal.

At 2258, the train (now designated as TM94), operated by the same four-person train crew, departed Tahmoor colliery to return to the Illawarra Bulk Terminal at Port Kembla (Figure 1).

Figure 1: Location map

Source: Geoscience Australia, annotated by OTSI

TM94 operated normally as it travelled in the Down^[2] direction on the Main South line towards Moss Vale.

The following morning, on 28 June 2019, at 0025, there was an emergency brake application caused by a vigilance penalty^[3] in the rear locomotive. TM94 stopped for a short time in the Mittagong to Burradoo section while a reset occurred. The train resumed the journey, passing through Berrima at 0036. At 0041, TM94 was travelling at 21 km/h, and accelerating gradually as it crossed onto the North Fork. The track speed for this section of track is 60 km/h. There were no additional speed restrictions in place at the time. The driver sounded the locomotive’s horn as the train approached the Suttor Rd active level crossing at Moss Vale (Figure 2).

Figure 2: Track configuration at derailment location

Source: ARTC, annotated by OTSI

At 0041, the 14th wagon in the train’s consist (NHSH 42774Q) passed the 128A catchpoints, and the L1 axle journal separated from the rest of the axle. This created unloading of the R2 wheel, which resulted in the R2 wheel climbing the Down rail and the L2 wheel moving into the four foot^[4] and derailing. The train continued with the broken axle and the No. 2 wheelset derailed, there was no loss of brake pipe pressure. Approximately 80 m past the point of derailment, at 150.067 km, the axle box and suspension elements were found later on the Up side of the track (Figure 3).

Figure 3: Parts found on Up side of track near derailment location

Source: OTSI

At 0042, the front of train TM94 passed the Suttor Road crossing. A member of the public, a railway enthusiast, was at the level crossing filming the passing coal train. The member of public identified that there was a problem with the train from the sound and sparks coming from a wheelset, and phoned Network Control Centre South at Junee to inform them of the problem.

At 0044, the area controller at Junee called the train crew of TM94 and said that an issue had been reported. They requested that the train crew stop and check the train.

At 0046, the front driver brought TM94 to a stand at 147.550 km. The second driver from the front locomotive then left the cabin and inspected the train. They found the train had derailed one wheelset (R2/L2) of the 14th wagon in the consist (Figure 4 and 5). A short time later, the driver reported to Junee network control details of the derailment. The train crew were instructed to wait on site and at 0309, they were tested for drugs and alcohol. The results of these tests were negative.

Following the derailment, investigators from ARTC, OTSI and Pacific National attended the site. On-site evidence identified the location of the derailment at 150.152 km. The likely point of drop-off was identified from a mark on the Up Rail gauge face and the start of sleeper damage. The track sustained damage beyond this point for approximately 2.6 km. Following the incident, 4,350 concrete sleepers were replaced. The 128B turnout had damage to multiple areas, which required repair and replacement. There was also damage to the concrete pad at the Suttor Road level crossing (Figure 6). The significant damage to the concrete pad at the level crossing was almost entirely on the Down side, having been caused by the L2 wheel. The R2 wheel caused minimal damage to the concrete pad.

Figure 4: NHSH wagon diagram

Source: Pacific National, annotated by OTSI

Figure 5: DCA bogie on TM94

Source: OTSI

Figure 6: Level crossing damage

Source: OTSI

__________

1. The 24-hour clock is used in this report. Local time was Australian Eastern Standard Time (AEST): Coordinated Universal Time (UTC) + 10 hours.
2. Up lines typically carry train movements towards Sydney, Down lines away from Sydney. (Note: TM94 was travelling in the Down direction on the Main South from Tahmoor to Moss Vale. After the train diverted off the Main South and entered the North Fork at Moss Vale the designated direction changed to the Up direction towards Unanderra.)
3. A vigilance penalty occurs when there is a lack of input by the train crew into the locomotive’s vigilance device for a pre-determined period.
4. The four foot is the area between the rails of a standard gauge railway.

Context

Track information

The derailment occurred on the North Fork, which is a short section of curved track, approximately 336 m long. It joins the Main South line with the Moss Vale to Unanderra branch line. TM94 was travelling in the Down direction on the Down Main before it crossed to the North Fork, through the Suttor Road level crossing, and onto the single track bi-directional Moss Vale to Unanderra line.

This standard gauge railway line provides a direct route linking Wollongong and Port Kembla to the Main South line. It carries freight services (intermodal, coal and grain) and occasionally passenger services. The route includes a long steep descent when travelling in the Down direction.

The track at the derailment location was maintained by the Australian Rail Track Corporation (ARTC) and consisted of 53 kg/m rail. The sleepers on the approach to the derailment site were mostly concrete sleepers fastened with resilient clips. There were wooden sleepers with sleeper plates and dog fastenings supporting the points in the immediate area around the 128A catchpoints and stockrail.

Post-accident inspection of the track recorded the following track information:

• Sleepers were mostly concrete and with timber sleepers through the points.
• The rail profile was worn but within limits.
• Ballast was in good condition.
• Drainage was fair.
• Track gauge measured 1435 mm to 1457 mm.
• The 1457 mm-wide gauge was measured at the switch tip with 5-10 mm rail play.
• Track twist at the point of derailment did not exceed 19 mm as measured over 14 m.
• A left-hand curve existed from the main line onto the North Fork.^[5]

All track at the site was within ARTC maintenance standards and met the requirements of ARTC class 1 track.

Train control information

Train movements on the Main South line from Goulburn to Moss Vale, and then between Moss Vale and Unanderra, at 91.080 km, are controlled from the ARTC Network Control Centre South at Junee. This is done under network rule ANSY 500 Rail Vehicle Detection System.

Train crew information

The four-person crew had two crew members located in the leading locomotive and two crew members in the trailing locomotive. Radio communication was maintained between the crew to coordinate actions. The train crew were appropriately qualified and held the required route qualifications. All members of the train crew said the train was operating as expected until Network Control Centre South at Junee notified them of the derailment.

Train information

Train TM94 was a coal service operated by Pacific National. This push/pull train was powered by three 82-class locomotives, consisting of one leading locomotive (8238) and two propelling locomotives (8209 and 8225) (Figure 7).

The train was 822 m in length and the gross mass was 4896 t. There were 45 loaded coal wagons in the consist, 36 were NHSH-type wagons and remaining nine were NHJF-type wagons (Figure 8). The train complied with all applicable operating standards regarding rolling stock and marshalling of wagons.

Figure 7: Two locomotives at rear of train TM94

Source: OTSI

Figure 8: Wagon (NHSH42774Q) with derailed wheelset

Source: OTSI

The wagon, which had the broken axle, was an NHSH-type wagon. Built by EPT Pty Ltd in 1983, these stainless steel-bodied coal hoppers have three large longitudinal bottom discharge doors. These wagons have a length of 16.7 m, a tare mass of 23.8 t and a gross mass of 100 t. The wagon was approved to operate at this mass as confirmed by the track owner’s documentation. Initially single wagons, they were converted to operate as 3-pack sets with a permanent solid drawbar between wagons and an automatic coupler at both ends of the set. This wagon, NHSH42774Q, was the middle wagon in the 3-pack.

This wagon class was fitted from new with DCA-type rigid-framed bogies located at each end of the NHSH wagon. These bogies were formed by welded box sections and have a variably damped primary suspension. Each bogie has two wheelsets. The wheelset was made up of a solid axle, a wheel disc (920 mm diameter) pressed onto the axle, and an E-class package unit bearing at each end of the axle.

The failed axle was identified as 831444, it was a 7E5S-type axle. This axle was manufactured in 1983 and since 2002, has only been fitted to NHSH coal wagons. It was fitted to wagon NHSH42774Q in April 2018. The wheels were changed on this axle in November 2010 during a wheelset maintenance activity.

Environmental information

The overnight minimum temperature at Moss Vale on 28 June 2019 was 7.2°C, as recorded at a nearby weather station. The maximum temperature recorded that day was 15°C. There was a trace amount of rainfall recorded (0.2 mm) on the day of the incident. It was still dark when the incident occurred at 0042, sunrise was at 0706. There was localised fog reported at the derailment site. It was determined environmental conditions did not contribute to the incident.

Related incidents

According to records kept by Pacific National, including this failure, there have been three failures on this type of axle in the past 20 years. The other two failures have occurred near the centre of the axle barrel. One of these failures was the subject of an OTSI investigation and is outlined below.

On 23 November 2011, Pacific National coal service MC92 derailed eight wagons at Clifton, New South Wales. MC92, a 45-wagon train, was fully loaded with coal and was travelling south from Helensburgh to Inner Harbour at Port Kembla where it was to be unloaded. The investigation revealed that the barrel of the No. 3 axle of the eighth position wagon (NHFF 42702K) had broken and parted, causing both wheels to derail. The failure occurred approximately mid-way along the axle barrel. The investigation established that the break in the axle was attributable to the propagation of metal fatigue at the site of the fracture. The axle was the same type of axle as occurred at Moss Vale.

__________

5. Lycopodium (2019) Derailment data capture Moss Vale 28 June 2019.

Safety analysis

Introduction

The analysis section of the report explores the likely reasons for the fracture, axle maintenance and inspection measures.

The following areas were excluded from further analysis as there was no evidence to show that they contributed to the axle failure:

• train’s braking and control system
• signalling and train control issues
• track and infrastructure
• the actions of the train crew.

Metallurgical aspects of the axle failure

All parts of the derailed bogie, wheelset, and the available associated parts recovered from site were examined and photographed by technical analysts at a Pacific National workshop at Port Waratah. This included investigators from OTSI and the Office of the National Rail Safety Regulator (ONRSR). Testing requirements were discussed with personnel from OTSI, Bureau Veritas, the ONRSR and Pacific National. Pacific National engaged the technical services of Bureau Veritas to conduct a metallurgical analysis of the axle.^[6]

The scope and steps for the metallurgical investigation was agreed upon by these specialists before the axle was taken to the Bureau Veritas testing facility in Newcastle.

The evidence from the metallurgical inspection has identified the following:

• the axle complied with industry specification requirements
• the composition of the axle met the chemical requirements of the standard
• the mechanical testing conducted on the axle showed it met the mechanical requirements of the standard.

The metallurgical report concluded that the position of the fracture face was approximately 250 mm from the end of the axle. This was at the start of a radius transition where the axle diameter increased from the 144.5 mm to 177.8 mm (Figure 9).

After examination of the fracture face, Bureau Veritas metallurgists concluded that the axle failure was the result of the propagation of a fatigue crack that extended over 60% of the axle cross section. Although no clear initiation point was visible, a discoloured area, which extended 16 mm into the section, likely represented the position of the initiation of the fatigue crack (Figure 10). There was a line of surface corrosion pits next to the fracture face that was likely to have provided the stress concentration for fatigue initiation (Figure 11).

At the other end of the axle, no cracking or pitting was evident; however, there was a line of grease around the same location at the start of the radius transition. Due to post-incident events, it was not possible to determine if the broken end of the axle had the same treatment with grease.

Analysis conducted on the crack propagation found it likely that the axle was defect-free in November 2010, when the wheel change maintenance activity took place. The period between this event and the fracture was 8.5 years. It is likely that the fatigue crack was present at the January and November 2016 wheel maintenance events where wheel bearings were replaced, but was undetected.

Figure 9: Cross section of fracture area

Source: Pacific National, annotated by OTSI

Figure 10: Fracture surface face of axle remaining within bogie

Source: OTSI

Figure 11: Corrosion pitting on axle surface next to fracture ignition point

Source: Bureau Veritas

Axle inspection and maintenance

Pacific National has in place a number of measures to monitor and manage the condition of its rolling stock. Train inspection standards and procedures are described in the Pacific National Train Inspection Manual. Wagon maintenance standards and procedures are described in the Pacific National Wagon Maintenance Manual. A number of visual and audible examinations are carried out regularly. These include but are not limited to the following:

• Terminal departure and arrival examinations. These are conducted at a low speed, usually about 10km/h. A terminal operator stands near the track and looks and listens for any abnormalities as the train passes.
• Roll-by examinations. These are conducted by train crew on one train as another train passes by. One train might be stationary or both might be operating at track speed. After the roll-by inspection, radio communication occurs between crews to verify that no defect was present. Roll-by examinations were also carried out by staff standing trackside at unloading points. There was no requirement to undertake these inspections at loading locations. Therefore, no roll-by inspection had been conducted at Tahmoor before the train departed for Port Kembla.
• Full examination (FX). These full inspections are conducted while the train is stationary at a maintenance facility or terminal by examining staff at regular intervals (for coal trains operating in the south-west area, these are at 7-day intervals). Note that the previous inspection for this train was on 21 June 2019, 7 days before the derailment.
• Unit Train Maintenance (UTM). A more structured static full examination is conducted during UTM at a maintenance facility at regular intervals (for coal trains operating on the south-west area, these are at 42-day intervals). This train had its last UTM on 30 May 2019, within the 42-day requirement.
• Scheduled Maintenance. During scheduled maintenance, wagons are lifted off their bogie. This allows for a visual inspection of the wheelset and barrel of an axle to take place. The required period for scheduled maintenance on coal wagons is three years. Bogie NDCA 295 had a scheduled maintenance completed on 19 April 2018. An inspection of the bogie following the derailment found it in a good operating condition with low wheel wear. There was no defects found with any other part of the journal bearing, suspension, adjacent wheelset or bogie frame.
• Although used to detect wheel defects not axle defects, a review of ARTC trackside Wheel Impact Load Detector (WILD) data was undertaken by Pacific National. A review of the data from February 2016 revealed that this wheelset had no recorded wheel impacts during its operation. In addition, there was no record of wayside alarms for high wheelset temperature for the wagon or wheelset during TM94’s journey from Tahmoor to Moss Vale.

Axles are designed to be highly reliable with an infinite service life if manufactured, operated and maintained within their prescribed design conditions. For this axle, the peak in-service stress loadings were below the endurance limit of the axle material. In the absence of a crack initiation event, which may increase the localised stress level, such as damage or corrosion, fatigue cracking should not occur.

Identifying an axle defect can be difficult, especially in the early stages of crack propagation and in locations obscured by other items. ‘The axle inspection process relies on human performance for preparation, inspection and re-installation. The non-destructive testing of axles relies to a great extent on the professional judgement of the inspection staff in interpreting equipment readings.’^[7]

The three most recent wheelset maintenance events for axle 7E5S 831444 are shown in Figure 12.

Figure 12: Maintenance history for axle 7E5S 831444

Source: Pacific National

The Wagon Maintenance Manual applicable in November 2010 required that:

2.2.1 All wheels and axles that enter the workshop shall be inspected for defects in compliance with the procedures and limits below. Axles shall be inspected and tested in accordance with the standards whenever bearings are removed during reconditioning of the wheelset.

2.4.2.1 Axles shall be tested for the presence of flaws and failures as specified hereafter by using ultrasonic and/or magnetic particle (wet or dry) procedures. Workshops undertaking the rework of axles and wheelsets shall develop and implement accredited procedures for the performance of these tests.^[8]

Evidence shows that the requirements of the Wagon Maintenance Manual were not followed by the maintenance contractor, and this was not detected in subsequent audits conducted by Pacific National. Not conducting non-destructive testing on the axle when the wheels were changed during wheel shop maintenance in 2010 was a deviation proven industry practice and the specified requirements by Pacific National.

No specific documentation was available for the wheelset maintenance activity in November 2010. The Wagon Maintenance Manual states that electronic records should be kept for a minimum of 12 years.

2.4.4.1 An electronic record is to be kept by the service provider of axle inspection and testing including axle number, date of inspection, type of tests carried out and the results of each axle for a minimum period of 12 years. Axle records shall incorporate previous test results. ^[9]

The maintenance records also indicate that non-destructive testing was not carried out during wheelset maintenance activities in January and November 2016 as ‘no crack inspection was mandated’. The Pacific National Wagon Maintenance Manual 09-03_08 Axles specifies that non-destructive testing should have been carried out.

In 2012, the NSW Independent Transport Safety Regulator (ITSR),^[10] conducted compliance inspections on a number of wagons in service. This was following a derailment at Clifton, NSW which was also caused by a broken 7E5S axle on a Pacific National NHFF-type coal wagon. Approximately 80 axles were inspected for evidence of defects. Three of these axles, which had all been recently inspected at a major overhaul maintenance centre, were found to have significant defects. These axles were removed from service. As a result of these inspections, ITSR issued a transport safety alert on 12 April 2012.^[11] The alert requested owners of rolling stock, maintainers, overhaulers and transporters of bogies and wheelsets to reassess:

• ‘the coverage of this matter (includes both surface and sub-surface defects) in their standards, operating practices, risk registers, asset management systems and other relevant documentation,
• the maintenance and inspection procedures that manage the possibility of defective (includes manufacturing defects), abused or poorly maintained axles and/or other risk control measures, such as ultrasonic testing and dye penetrant inspection, to verify that axle barrels are fit for the defined purpose. This should also include an appropriate final visual inspection process (of the axle barrel area) just prior to fitment to a wagon,
• the training, competency and assessment of personnel who inspect, handle, transport and assemble wheelsets or bogies, and
• the adequacy of processes for monitoring compliance with the relevant in-field and preventative maintenance instructions and procedures.’^[12]

Remedial actions

Since the axle failure at Moss Vale, Pacific National have engaged a number of independent entities to undertake investigations assessing the failure mode of this 7E5S axle failure and the fatigue life of both 7E5S and 7E3S axle types.

Pacific National commenced and completed a program of non-destructive testing of axles in-situ to ensure that no axles pose an immediate risk of failure. This included all 7E5S axles and involved ultrasonic testing. During wheel shop maintenance activities, Pacific National requires the removal of bearings from axles at workshops to allow magnetic particle testing, with the exception of K and G Class which do not necessarily require removal. This allows more accurate detection of initial indications of cracking in the radius transition area of the axle.

A Rolling Stock Notice (RSN) was also issued, to reinforce to Pacific National’s wheel set overhaul contractors of the requirement. Pacific National have included a new check to the wheel shop audit checklist, requiring confirmation that the specified corrosion inhibition is being applied to the axle.^[13]

Pacific National have implemented a process with some wheel shops to machine the fillet radius of axles in order to restore the fillet radius to a defect-free state. Pacific National have also purchased a quantity of new axles to replace any found to have cracking or corrosion pitting.

__________

6. Bureau Veritas 2019, Examination of a rail wagon bogie axle failure, 19-2888483-2.
7. UK Rail Safety and Standards Board (2012) Research into the effects of human factors in axle inspection T774.
8. Pacific National Wagon Maintenance Manual Axles WMM 09-03 08. Version 29 September 2009.
9. Pacific National Wagon Maintenance Manual Axles WMM 09-03 08. Version 29 September 2009.
10. The functions of NSW ITSR were incorporated into the Office of National Rail Safety Regulator on 20 January 2013. ONRSR is an independent body corporate established in 2012.
11. ITSR Transport Safety Alert, Catastrophic failure of freight axles in the barrel area, TSA no. 40, issued 12 April 2012.
12. Ibid.
13. Pacific National Rolling Stock Notice RSN E 19-065v4 Axle Inspection Requirements issued 1 June 2020.

Findings

From the evidence available, the following findings are made with respect to the derailment of train TM94 near Moss Vale, New South Wales, on 28 June 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The derailment occurred due to an axle fracturing inboard of the L1 bearing journal on the 14th wagon in the consist (NHSH 42774Q). The fracture occurred on wheelset number 7E5S 831444, approximately 250 mm from end of the axle.
• The axle failed due to the initiation and propagation of a crack at the beginning of a radius transition curve at the end of the bearing journal. There were a series of surface corrosion pits next to the fracture face that may have provided the stress concentration for fatigue initiation. A discoloured area which extended 16 mm into the section likely represented the position of the initiation of the fatigue crack; this had progressed approximately across 60% of the axle cross-section before brittle failure occurred.
• Axle testing on wheelset number 7E5S 831444 was not carried out during the two most recent wheelset maintenance events in January 2016 and November 2016. It is likely the axle crack existed at the time of these maintenance activities. [Safety issue]

Other factors that increased risk

• Inspection records for the December 2010 wheelset maintenance activity and wheel change on wheelset number 7E5S 831444 were not available. It is a requirement specified in Pacific National's Wagon Maintenance Manual that records be retained for a period of 12 years. [Safety issue]

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Axle testing

Safety issue number: RO-2019-013-SI-01

Safety issue description: Axle testing on wheelset number 7E5S 831444 was not carried out during the two most recent wheelset maintenance events in January 2016 and November 2016. It is likely the axle crack existed at the time of these maintenance activities.

Maintenance records

Safety issue number: RO-2019-013-SI-02

Safety issue description: Inspection records for the December 2010 wheelset maintenance activity and wheel change on wheelset number 7E5S 831444 were not available. It is a requirement specified in Pacific National's Wagon Maintenance Manual that records be retained for a period of 12 years.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• The Office of National Rail Safety Regulator
• Pacific National.

References

Independent Transport Safety Regulator 2012, Transport Safety Alert – Catastrophic failure of freight axles in the barrel area, TSA no. 40, issued 12 April 2012.

Pacific National 2009, Wagon Maintenance Manual Axles WMM 09-03 08, Version 29 September 2009.

Pacific National 2020, Rolling Stock Notice Axle Inspection Requirements, RSN E 19-065v4 issued 1 June 2020.

UK Rail Safety and Standards Board 2012, Research into the effects of human factors in axle inspection T774.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties: Australian Rail Track Corporation, Office of National Rail Safety Regulator, Pacific National and Transport for NSW.

Submissions were received from:

• Office of National Rail Safety Regulator
• Pacific National.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.