Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the ATSB to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation. This statement is published as a report in accordance with section 25 of the TSI Act, capturing information from the investigation up to the time of discontinuance.
The occurrence
On 14 May 2020 at about 0030 Western Standard Time,[1] an Airbus A330-203 aircraft registered VH-EBL, was operating as Qantas flight QF044, a scheduled passenger service between Sydney, Australia and Denpasar, Indonesia. While in the cruise at flight level 390[2] and abeam the Royal Australian Air Force Curtin aerodrome near the West Australian coast, the first officer’s primary flight, navigation and multipurpose control displays lost power and went blank. Accompanying this, the autopilot disconnected, the cockpit Master Warning light illuminated with an aural alert and multiple electronic centralised aircraft monitor (ECAM) messages presented on the engine/warning display.
The flight crew assumed manual aircraft control and worked to complete the appropriate response checklists and to better understand the issue. At 0038, the crew made a PAN[3] call to air traffic control (ATC) advising of the electrical problem and the possible need to divert. That decision was made at 0044 and the crew advised ATC that they would be diverting the aircraft to Broome – approximately 170 km from their position.
The flight crew reported that while some inoperative systems were restored during the diversion, other systems remained unavailable. All flight, navigation and multipurpose controls on the captain’s side of the flight deck remained functional throughout the flight. The approach to and landing on runway 10 at Broome was uneventful and the aircraft touched down at 0150.
Overview of the investigation
Following notification of the occurrence, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003, for the purposes of examining the electrical systems event and the flight crew’s response. Information was obtained from the aircraft manufacturer and operator, including formal technical and operational investigation reports from both Airbus and Qantas. ATSB investigators interviewed both flight crew and the information thus provided was correlated against the technical and operational reports.
In summary, based on information gathered during the investigation, it was found that the electrical systems event had originated within the aircraft’s number-two integrated drive generator (IDG) and generator control unit (GCU) systems. The event produced abnormal behaviours in related electrical systems which were not immediately or definitively indicative of an IDG or GCU fault – making the task of fault diagnosis difficult. Indeed, engineering staff examining the aircraft after arrival in Broome and following relocation under special authority to Brisbane, were unable to replicate the systems behaviour reported by the flight crew.
Reasons for the discontinuation
Following a review of the investigation and the information gathered, the ATSB has discontinued its investigation of this occurrence as a result of the following principal considerations:
The flight crew, despite receiving unclear information from the monitoring systems, recognised that the aircraft’s systems were significantly degraded and appropriately managed the risks by diverting to the nearest suitable airport.
The aircraft flight crew’s responses to the system failures during the diversion effectively managed the risks presented by the degraded aircraft systems.
The approach and landing at the diversion airport was appropriately managed and uneventful.
The operator and manufacturer’s combined investigations into the technical origins of the electrical systems event, while unable to conclusively identify root cause, did isolate the areas of likely contribution.
Both manufacturer and aircraft operator have undertaken proactive safety action in response to the technical failure areas of concern.
The operator has similarly assessed the operational and logistical issues arising from the use of Broome as a diversionary destination.
As such, the ATSB considered it was unlikely that further independent investigation would identify any systemic safety issues or important safety lessons.
The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the ATSB to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation. The statement is published as a report in accordance with section 25 of the TSI Act, capturing information from the investigation up to the time of discontinuance.
Overview of the investigation
On 8 May 2019, the ATSB commenced an investigation into the descent below minimum safe altitude involving a Regional Express Saab 340B aircraft, registered VH-OLM which occurred 15 km south-west of Williamtown Aerodrome (Newcastle Airport), New South Wales, on the evening[1] of 28 March 2019, at about 1942 Eastern Daylight-saving Time.[2]
As part of the investigation, the ATSB interviewed the aircraft flight crew and Williamtown Aerodrome air traffic controllers. The operator’s Route Manual was examined for information relating to the conduct of visual approaches and specific information about the operation of flights into Williamtown. The ATSB also reviewed Airservices Australia’s requirements of the conduct of visual approaches[3] and the required segment minimum safe altitude at Williamtown Aerodrome.[4]
Air traffic control (ATC) cleared the flight crew to conduct a visual approach via a right base circuit leg to runway 12, and told the flight crew to report once they were ‘on base’. The aircraft had descended to 900 ft when the flight crew contacted ATC to report that they were on base. The controller then looked for the aircraft again and observed that the aircraft was further away than the expected position (about 4.7 NM south of the airport) and according to the radar display, below the segment minimum safe altitude. The controller then issued a safety alert and instructed the flight crew to climb. The flight crew complied with the instruction to climb. The aircraft landed without further incident.
The ATSB found the flight crew had misjudged the aircraft’s position relative to the aerodrome while conducting a night visual approach.
ATSB comment
Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will monitor for any similar occurrence that may indicate a need to undertake a further safety investigation.
On 14 April 2019, an Aeroprakt A22LS Foxbat collided with terrain while conducting mustering operations on Aldville Station approximately 120 km north-west of Cunnamulla, Queensland. The aircraft sustained substantial damage and the pilot was fatally injured.
Recreational Aviation Australia (RAAus) is investigating the accident and has requested assistance from the Australian Transport Safety Bureau (ATSB) in:
recovering data from an on-board GPS unit
conducting metallurgical and failure analysis on components of the aircrafts control system
conducting failure analysis on the aircraft’s damaged wing covering.
To facilitate this work the ATSB has initiated an external investigation under the Transport Safety Investigation Act 2003.
Any enquiries relating to the accident investigation should be directed to RAAus at: www.raa.asn.au.
Final Report
What happened
On 14 April 2019 an Aeroprakt A22LS Foxbat, registered 24-8140, collided with terrain while conducting mustering operations on Aldville Station, approximately 120 km north-west of Cunnamulla, Queensland. The pilot was fatally injured and the aircraft sustained substantial damage.
Recreational Aviation Australia (RAAus) commenced an investigation and requested assistance from the ATSB to:
conduct detailed examination of a control system component and a section of wing fabric
download data from a damaged GPS unit that was on board the aircraft at the time of the accident.
To facilitate this work, the ATSB initiated an external investigation under the Transport Safety Investigation Act 2003.
Results
The ATSB conducted visual inspections and microscopic analyses on an eyebolt from the control system (Figure 1) and a piece of damaged wing fabric. Analyses of the eyebolt determined that it had failed due to overstress with no indication of fatigue. The wing fabric analyses indicated that the damage was consistent with that expected as a result of the ground impact.
Figure 1: Failed eyebolt showing fracture surface
Source: ATSB
The ATSB undertook data recovery from an accident damaged Lowrance Airmap 2000c GPS unit. A raw binary data file was recovered through a direct download of non-volatile memory. The file was unable to be interpreted by the ATSB and was supplied to RAAus.
With the completion of the examinations and data recovery, the ATSB has concluded its involvement in the investigation of this accident. Any further enquiries in relation to the investigation should be directed to Recreational Aviation Australia.
___________ This report has been released in accordance with section 25 of the Transport Safety Investigation Act 2003.
On 23 April 2019, a De Havilland Aircraft of Canada DHC-8-315, registered VH-XKJ and operated by Skippers Aviation, was conducting a charter flight from Perth Airport to the Duketon Gold Mine, Western Australia.
Shortly after take-off, the flight crew heard a banging sound and detected a reduction in power from the left engine. At about the same time, the pilot flying experienced a yaw through the aircraft controls. The crew also noted a gradual reduction in right engine power. The flight crew elected to conduct a return to Perth Airport, where an uneventful landing was conducted.
What the ATSB found
Following the occurrence, both engines were inspected and erosion damage was noted to the high‑pressure turbines. While both engines displayed erosion damage, the damage to the left engine was more pronounced. The erosion damage to the turbine likely disrupted the airflow through the left engine, inducing the symptoms reported by the crew and recorded in the aircraft flight data.
The decision not to shut down the malfunctioning engine immediately allowed the flight crew to concentrate on continuing the climb, during a period of increased workload. The left engine responded to an increase in power. However, the crew elected to return to the departure airport.
The ATSB determined that the gradual reduction in power on the right engine was not likely the result of a mechanical issue in the engine.
Safety message
A partial power loss presents a more complex scenario to flight crew than a complete engine failure. The engine is still providing some power, however the power may be unreliable and the reliability may be difficult to assess. This occurrence highlights the benefits of timely and appropriate flight crew action in response to a power loss on take-off.
In this case, the affected engine appeared to return to normal operation, however the flight crew continued with the return. Abnormal engine operation, even if only transient, can be an indication of a developing fault and therefore the safest course of action is to discontinue the flight as soon as possible.
The occurrence
What happened
On the morning of 23 April 2019, a De Havilland Aircraft of Canada DHC-8-315, registered VH‑XKJ (XKJ) and operated by Skippers Aviation, was being prepared for a charter flight to Duketon Gold Airport, about 750 km north-east of Perth, Western Australia. At about 0615 Western Standard Time,[1] XKJ departed Perth Airport with two flight crew, two cabin crew and 51 passengers on board.
Shortly after take-off, as the aircraft was climbing through approximately 250 ft above ground level, the first officer (FO), who was the pilot monitoring,[2] retracted the landing gear. At about this time, both flight crew detected a popping or banging sound from the vicinity of the number one (left) engine. The captain (pilot flying) also noted a slight left yaw[3] through the flight controls. The FO observed a reduction in torque, to just below 60 per cent on the left engine. The FO reported a ‘failure’, but further advised ‘it’s not indicating a failure’, as there was no associated master warning.[4]
The captain reviewed the left engine instrumentation and noted that torque was 58 per cent. Other indications, such as fuel flow, appeared relatively normal. The captain then advised that, because the left engine was still producing some power, they would not shut it down, but would conduct a return to Perth. As the aircraft climbed through a height of approximately 800 ft, the flaps were retracted, and the FO transmitted a PAN PAN[5] call. Perth air traffic control acknowledged, and the captain elected to return via a right circuit.
At about this time, the captain noted that the torque on the right engine was indicating lower than expected for the phase of flight. The captain advised the FO that they might need to upgrade to a MAYDAY.[6] The throttles on both engines were then advanced to approximately 80-90 per cent, with both engines responding as expected. In addition, the banging sound in the left engine ceased.
In preparation for landing, and to reduce airspeed, the throttles on both engines were retarded to about 30 per cent. The flight crew noted that, with this reduction in power, the banging sound in the left engine returned. Following a normal landing, the aircraft was taxied to the terminal, under power from both engines.
Context
Recorded Data
The aircraft’s flight data recorder (FDR) was downloaded by the operator and a copy of the relevant data provided to the ATSB. The flight data showed a sharp reduction in left engine torque as the aircraft climbed through 250 ft (see Figure 1). This was followed by a period of torque fluctuations, which aligned with the time that the flight crew reported hearing the banging sound coming from the left engine. The torque fluctuation was also coincident with minor fluctuations in the left engine inter turbine temperature (ITT), fuel flow, compressor (NL) and turbine (NH) percentages.
A slow reduction in right engine torque and ITT also occurred for the duration of the left engine power fluctuations, and until the torque increase on both engines was observed.
Engine Information
The aircraft was fitted with two Pratt & Whitney Canada (PWC) PW123E turboprop engines. These engines, serial numbers AW0067 (left engine) and AW0065 (right engine), had accumulated 19,212 and 20,354 hours in service respectively at the time of the incident.
The operator utilised an engine condition trend monitoring (ECTM) system to track the health of the various engines throughout its fleet of aircraft. This system allowed them to track trends in engine parameters over time and respond to them as necessary. The system also provided alerts in the event that there was a deviation from the trend in any of these parameters.
The engine maintenance manual (EMM) required that borescope inspections (BSI) be conducted every 1,500 hours for monitored engines and every 1,000 hours for unmonitored engines. In this case, while monitoring their engines using the ECTM system, the operator elected to align the BSI with other maintenance items and carry out the inspections every 1,000 hours under normal conditions.
In late August 2018, the ECTM system detected a change in the trend for both engines. The status changed from ’Trend Normal’ to ‘Notification’, based on an increase in ITT and decrease in the NH. This trend shift prompted the operator to conduct an out-of-cycle BSI and perform a power assurance run (PAR). This inspection was carried out in early September and both engines were found to have leading edge and tip erosion damage to the high-pressure turbine (HPT) blades. The damage to the left engine was more pronounced and a defect was raised in the engine’s maintenance log. Based on the guidance in the EMM, the left engine erosion damage required an increased inspection frequency for the BSI and PAR to every 300 hours from the previous 1,000-hour interval. In December and within the 300-hour interval, the next BSI revealed increased damage. It was judged, however, to still be within the required limits for continued operation, with the increased inspection frequency. At the time of the occurrence, the engine had accumulated a further 211 hours in service.
Post-incident maintenance
Following the occurrence, both engines underwent inspection and ground runs to ascertain possible contributors to the engine issue, including bird strike and component malfunction. A detailed examination of the left engine was then conducted by an engine overhaul organisation in consultation with the engine manufacturer. The examination noted the erosion damage to the leading edges and tips of the HPT blades. It also noted heavy erosion damage to the HPT shroud. Further, the HPT tip clearances[7] were described as ‘excessive’, however it was noted that no tip clearance limits were prescribed in the EMM. Hot section repairs were carried out to rectify this issue.
While the erosion damage on the right engine was less than that of the left, it was deemed viable to carry out hot section repairs at the same time. Both engines were subsequently refitted, and the aircraft was returned to service, with no further issues noted.
Operational Information
A section of the operator’s flight operations manual, Abnormal and emergency procedures, detailed actions to be taken in a variety of abnormal situations, including engine failure after take‑off. In addition, the quick reference guide detailed procedures for ‘engine fail/fire/shutdown (in flight)’. There was no specific information dealing with a partial power loss or abnormality in one or both engines.
The flight crew commented that the partial loss of power on one engine presented a more complex scenario than an engine failure. In that event, the crew would have completed the engine failure drill, as per their training, and could refer to the operator’s flight manual or the quick reference guide, if required. As this was not the case, there was some discussion in the cockpit and the decisions were made following assessment of the available information.
The flight crew advised the ATSB that including unusual events of this type in the training program would be of benefit. However, they also noted that it would involve addition to an already extensive training and check program.
The operator advised the ATSB that they considered the flight crew’s actions, in returning to the departure airport as soon as the problem was detected, was appropriate.
Safety analysis
Post-flight internal inspection of the engines revealed erosion damage to the high-pressure turbine blades of both engines. Given the high operating temperature/speed and low clearances that exist within turbine engines, erosion degradation over time is expected. However, this deterioration affects the optimum airflow through the engine and reduces the overall engine efficiency. In this case, the erosion to the left engine high‑pressure turbine is likely to have contributed to the power loss and banging sound experienced by the crew and the engine parameter variation recorded in the FDR data.
Skippers Aviation conducted engine condition trend monitoring on their fleet of aircraft. A change in the trend for the left engine triggered an alert, which prompted an internal borescope inspection and power assurance run to be conducted. Erosion to the high‑pressure turbine was noted and an enhanced maintenance program to monitor the damage had been initiated. Technical documentation available to Skippers Aviation assisted with the detection and monitoring of the damage. However, there was no specific tip clearance limit given in the engine maintenance manual. The ATSB noted that, while this occurrence happened when the engines were under close monitoring, the enhanced maintenance program was in accordance with the engine manufacturer’s requirements.
The crew also reported a reduction in right engine power. It was determined that, while a possible exacerbating factor, it did not affect the crew’s decision to conduct the return, as the PAN call and return to Perth had been initiated before the right engine low power was noted. The subsequent engine inspection identified erosion to the high-pressure turbine. However, it was less than that of the left engine. Additionally, the flight crew reported that the right engine responded normally to the power lever increase and operated as expected for the remainder of the flight. Based on that evidence, the ATSB concluded that the decrease in right engine power was unlikely due to a mechanical issue with the engine.
Possible causes for this reduction included, a transient engine issue, technical failure of the throttle mechanism, flight crew deliberate action or flight crew distraction. However, because the FDR did not record throttle position data the reason for this reduction could not be determined.
Findings
These findings relating to the engine malfunction and return of the Skippers Aviation DHC-8-315 registered VH-XKJ should not be read as apportioning blame or liability to any particular organisation or individual.
Excessive erosion to the left engine’s high-pressure turbine blades likely resulted in the power loss.
At the time of the occurrence, the maintenance program for the detected erosion was in accordance with the manufacturer's maintenance manual requirements.
The aircraft experienced an uncommanded gradual reduction of torque in the right engine, a mechanical issue with the engine as the cause was considered unlikely.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 23 March 2019, the cruise vessel Viking Sky experienced a blackout, causing loss of propulsion and steering, during a storm in Norway. The Norwegian Safety Investigation Authority (NSIA) initiated an investigation into the accident.
At the NSIA's request, the ATSB assisted with the collection of relevant information. To protect any information supplied by the NSIA to the ATSB, and the ATSB's investigative work to assist the NSIA, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003.
As there were Australian passengers on board the Viking Sky at the time of the accident, Australia was a Substantially Interested State in the NSIA's investigation, and reviewed its final report into the accident. On 19 March 2024, the NSIA published the report, which is summarised and linked below.
In the afternoon of 23 March 2019, the cruise vessel Viking Sky experienced a blackout, causing loss of propulsion and steering, during a storm in the Hustadvika area of the Norwegian coast. The vessel is estimated to have come within a ship’s length of running aground with 1,374 persons on board, and the accident had the potential to develop into one of the worst disasters at sea in modern times.
The accident was caused by insufficient lubricating oil in all of the operating diesel generators’ lubricating oil sump tanks, in combination with pitching and rolling in rough seas. The investigation has identified operational, technical, and organisational safety issues that in different ways contributed to the blackout.
The blackout recovery was time consuming, and it took 39 minutes from the blackout until both propulsion motors were operational and the ship had sufficient power available to maintain between 1 to 5 knots ahead. Blackout drills had been carried out, but recovery from a full blackout without a standby generator had never been drilled on board. The engineers were therefore faced with a situation they were not practised in managing. The situation was stressful, the control system was complex, and a specific sequence of actions was needed. Insufficient training likely contributed to why the blackout recovery was time consuming.
When Viking Sky left Tromsø 21 March 2019, with one out of four diesel generators unavailable, both crew and passengers were unknowingly exposed to an increased risk as the vessel did not have the redundancy required under the Safe Return to Port (SRtP) regulations. As Viking Sky did not comply with the applicable safety standards, it should not have departed Tromsø under the prevailing circumstances.
The investigation has also found that the lube oil sump tank design was non-compliant with applicable regulations.
The NSIA issues a total of 14 safety recommendations to relevant parties with the aim of promoting maritime safety.
On 8 April 2019, at 0650 Eastern Standard Time, a Cessna Aircraft Company 182 aircraft, registered VH-DJN, departed Cloncurry Airport on a private flight to Mount Garnet aerodrome, Queensland (Qld), under visual flight rules (VFR). On board were the pilot and one passenger. The aircraft landed in Mount Garnet at 0920, where the passenger disembarked and left the aerodrome. The passenger planned to return to the aerodrome at about 1500 for an onward flight (in VH-DJN) to Charters Towers, Qld.
At 0934, the aircraft departed Mount Garnet for a 62 km VFR flight to Atherton Airport, where the pilot intended to refuel the aeroplane before returning to collect the passenger from Mount Garnet. However, 15 minutes after departing Mount Garnet and about 14 km from Atherton, the aircraft impacted trees and terrain on the Herberton Range. The impact fatally injured the pilot and the aircraft was destroyed.
What the ATSB found
The ATSB found that the pilot, who was qualified only to operate in visual meteorological conditions, flew toward and entered an area of low cloud and reduced visibility, which obscured rising terrain. This almost certainly resulted in the pilot losing visual reference with the ground and a controlled flight into terrain.
While it could not be determined whether it influenced the accident, the pilot had taken medication that had the potential to affect performance and was therefore required to be disclosed to the Civil Aviation Safety Authority (CASA). This medication had not been disclosed to the pilot's Designated Aviation Medical Examiner or recorded on the pilot's CASA medical file.
Safety message
The ATSB is concerned about the frequency of accidents, many fatal, which involve pilots flying with reduced visual cues. The risks associated with operating under the visual flight rules in adverse weather appear to be under-estimated. The ability to understand weather-related hazards and how to assess and mitigate them, are vital skills for pilots, particularly those who fly in challenging environments like mountainous terrain.
Weather conditions must be considered during pre-flight planning, assessed and reassessed during flight and pilots should have a rehearsed plan in case weather deteriorates.
VFR pilots should use a ‘personal minimums’ checklist to help control and manage flight risks through identifying risk factors that include marginal weather conditions and only fly in environments that do not exceed their capabilities.
During flight, pilots must continuously assess the weather for conditions that may adversely affect the safety of the flight and be prepared to use an alternative course of action if conditions deteriorate. They should make timely decisions to turn back, divert or hold in an area of good weather.
Pressing on into instrument meteorological conditions without a current instrument rating and a suitably-equipped aircraft, carries a significant risk of disorientation and a loss of spatial awareness from reduced visual cues. This can easily affect any pilot, no matter what their level of experience.
The occurrence
Accident day
On 8 April 2019, at 0652 Eastern Standard Time,[1] a Cessna 182G aircraft, registered VH-DJN, departed Cloncurry aerodrome on a private flight to Mount Garnet, Queensland, under the visual flight rules (Figure 1).[2] On board were the pilot and one passenger, who was the aircraft owner.
Figure 1: Map of Queensland locations relevant to the occurrence showing the approximate track of VH-DJN on the accident day
Source: Google Earth and aircraft GPS, annotated by ATSB
The aircraft landed at Mount Garnet aerodrome at 0920, where the passenger disembarked. The passenger left the aerodrome, intending to return at about 1500 for an onward flight to Charters Towers. In the interim, the pilot planned to fly to Atherton Airport to refuel and then return to Mount Garnet. Atherton Airport, elevation 2,460 ft above mean sea level (AMSL), was 63 km north-east of Mount Garnet aerodrome, elevation 2,156 ft AMSL. Between these locations lay the Herberton Range, where the highest peaks in the vicinity of the direct track reached about 4,000 ft AMSL.
The aircraft took off from Mount Garnet at 0934:31, with the pilot as the sole occupant. Based on the aircraft’s GPS data, it initially tracked directly towards Atherton Airport for about 4 minutes, before diverging east of the direct route (Figure 2).
Figure 2: Recorded flightpath of VH-DJN (red) and direct track (yellow)
Source: Google Earth overlaid with aircraft’s recorded GPS track, annotated by ATSB
The aircraft made small deviations right and left as it tracked north-east and passed overhead Wondecla at 0947:13 climbing through 4,144 ft. Over the next 30 seconds, the aircraft climbed to about 4,400 ft, which was the maximum height reached, before starting to descend. As the aircraft descended about 500 ft over the next 76 seconds, small changes in direction and two short climbs were made (Figure 3).
The aircraft’s last recorded GPS position was at 0949:02 at an altitude of 3,916 ft and heading north-north-east. The terrain elevation at that position was 3,774 ft[3] and the terrain and GPS altitudes were each correct to within about 100 ft.
The aircraft impacted the tree canopy and subsequently terrain, fatally injuring the pilot. The 130-metre-long wreckage trail was consistent with significant forward speed at impact (about 240 km/h ground speed based on GPS data) and the aircraft was destroyed. No radio transmissions by the pilot were recorded on any available frequency.
Figure 3: Terrain elevation (green) and VH-DJN GPS altitude (blue) for the accident flight
Source: Geoscience Australia and aircraft GPS recorded data
Previous day
The flights conducted on the day prior to the accident flight, 7 April, are depicted in Figure 4. The pilot operated VH-DJN alone from Townsville Airport, departing at 0557 and arriving at Charters Towers aerodrome at 0624. The (same) passenger joined the pilot at Charters Towers and after refuelling the aircraft, the pilot and passenger flew to Elrose Station, arriving at 0849. Later that day, the aircraft departed Elrose Station for a 27-minute flight to Cloncurry, where the pilot and passenger stayed overnight.
Figure 4: Map of Queensland locations relevant to the occurrence and previous day’s flights including the aircraft track
Source: Google Earth and aircraft GPS, annotated by ATSB
The pilot held a private pilot (aeroplane) licence that was issued under Civil Aviation Safety Regulations Part 61 in November 2014. The Civil Aviation Safety Authority (CASA) reported that the pilot’s original licence was issued in 1975. The ATSB was unable to obtain the pilot’s logbook after the accident. However, as at 8 July 2017, the pilot’s logbook had recorded 6,532 hours total aeronautical experience, at which time the pilot had recorded 3,967 hours on the Cessna 182 aircraft type.
The pilot’s last review was a night visual flight rules (VFR)[4] and single-engine aeroplane class rating fight review, conducted in April 2018 and valid until April 2020. Night VFR operations are based on visual procedures in visual meteorological conditions (VMC).[5] Additionally, the CASA advisory circular (AC) 61-05 Night VFR rating stated:
4.3.2 Night operations require proficiency in instrument flight (IF)…
4.3.3 Instrument flying skills are intrinsic to night flying; therefore, it is also desirable that IF proficiency be demonstrated before commencing actual night flying.
4.3.4 While NVFR flight must be conducted in VMC, a visual horizon is often not available and a sudden loss of visual reference is also possible (i.e. when turning away from a well-lit area, reduced visibility or even following inadvertent entry into cloud). Night flying training should therefore emphasise the importance of flying the aircraft by reference to the flight instruments integrated with visual flying, even in conditions where external lighting provides adequate visual reference.
The pilot had previously held a multi-engine aeroplane instrument flight rules (IFR) [6] rating, with the last renewal recorded in the logbook conducted in October 2010.
Medical and pathological information
The 73-year-old pilot held a Class 2 Medical Certificate, valid until September 2020. The certificate required the pilot to wear distance vision correction and a headset while flying and have vision correction available for reading.
The autopsy report identified that the pilot had coronary artery atheroma of a severity that could have led to a cardiac event. This was consistent with the general practitioner’s assessment that the pilot had a history of moderately high cardiovascular risk. However, it could not be determined whether this had occurred or had any influence on the pilot’s actions.
Post-mortem toxicological examination of the pilot’s blood revealed the presence of a benzodiazepine, a hypnotic sedative medication, consistent with a therapeutic dosage and a blood alcohol concentration (BAC) of 0.03 per cent. The pilot’s BAC reading may have been due at least in part to post-mortem alcohol production and no alcohol was detected in the urine. The pilot was reported to have consumed two alcoholic drinks with dinner the previous evening. This was not in accordance with patient guidelines for the sedative medication. Additionally, in some people, alcohol intake could increase the effects of the medication and make it harder for the body to break it down, but it was not known whether this was the case for the pilot.
The medication, which had been prescribed for the pilot, was listed by CASA as being ‘hazardous in aviation’ as it had effects and side-effects that could impair pilot performance. It was therefore not to be used without clearance by CASA or the pilot’s designated aviation medical examiner (DAME). Under the clinical practice guidelines for DAMEs, risk assessment protocols allowed consideration of a pilot’s need for medication use. That assessment involved reviewing the condition, symptoms, compliance with medications and treatments, and any relevant side effects.
The prescribed medication had not been disclosed by the pilot in the self-declaration required for medical certification or at any time subsequent to the pilot’s last CASA medical. The DAME was unaware of the pilot’s use of the medication and had therefore not conducted an aeromedical risk assessment.
Aircraft information
The Cessna 182G is an all-metal, four-seat, externally braced high-wing single-engine aircraft equipped with tricycle landing gear and designed for utility purposes. VH-DJN was manufactured in the United States and registered in Australia in 1964.
The aircraft was powered by a six-cylinder, normally aspirated, horizontally opposed and air-cooled engine. In such engines, fuel and air are mixed via a carburettor before flowing to the cylinders for ignition. Auxiliary fuel tanks were installed in the wing tips in 1991, in accordance with a Supplemental Type Certificate, which increased the usable fuel capacity from 270 to 358 L.
The pilot had owned and operated the aircraft from about 1985, until the registration was changed to the current owner (at the time of the accident) in March 2018. Following the change of registration, the pilot had continued to operate the aircraft for the owner and organise its maintenance.
The last maintenance release was issued following a periodic aircraft inspection conducted on 5 December 2018 at 9,392.1 aircraft hours. The last recorded engine maintenance was on 8 March 2019 at 9,422.7 aircraft hours, when the time-expired carburettor was replaced, and ground runs, idle adjustment and a test flight were conducted. While inconsistent recording of aircraft hours had previously been identified by CASA, there was no evidence of current issues with the maintenance of the aircraft.
The aircraft had previously been operated in the IFR category but was no longer approved for operations under IFR. This ceased when the pilot advised the maintainer that it was no longer required and the necessary maintenance for IFR approval had been discontinued. As such, it was still equipped with vacuum-driven instrumentation to allow a suitably qualified and experienced pilot to control the aircraft with reference to these instruments, such as in the case of inadvertent entry into instrument meteorological conditions (IMC).[7] The calibration and accurate functioning of these instruments, however, could not be assured by pre-accident maintenance or confirmed by post-accident inspection. The aircraft was also fitted with an autopilot.
Accident site and aircraft wreckage information
The accident site was located at an elevation of approximately 3,800 ft above mean sea level (AMSL) in the Herberton Range National Park. This was about 200 ft below the highest peak in the vicinity.
The aircraft wreckage was distributed in a linear pattern 130 m long, on a heading of 030 degrees. The debris trail started with the wheel faring then the lower section of the right wing; consistent with the aircraft being upright on first impact with the tree canopy. As the aircraft passed through the trees, the wings and fuselage had progressively disintegrated.
The distribution of the wreckage indicated that there was no pre-impact damage or in-flight breakup prior to the initial collision with the tree canopy. The wreckage trail and aircraft damage were consistent with significant forward inertia at the time of impact. Additionally, damage to the propeller was indicative of the engine delivering power when the aircraft entered the trees. Disruption to the aircraft limited complete flight control continuity checks, however, continuity was established where access was possible. Further, there was no evidence of the aircraft being in a stall condition, nor was there evidence of pre- or post-impact fire or a major oil leak.
The accident site and wreckage was consistent with a controlled flight into terrain. That is, the aircraft was under the control of the pilot when it impacted terrain, with no defect or unserviceability that would have otherwise prevented the normal operation of the aircraft.
Meteorological information
Graphical area forecast
The Bureau of Meteorology (BoM) provides aviation weather forecasts for ten graphical forecast areas in Australia. Weather areas and sub areas are used to highlight differing conditions within a graphical forecast area. Cloud heights in area forecasts are AMSL.
The flight from Cloncurry to Mount Garnet and the accident flight from Mount Garnet were in the Queensland – North (QLD-N) area. The BoM provided ATSB with area forecasts valid from 0300 to 0900 and from 0900 to 1500 EST. The flight from Cloncurry to Mount Garnet spanned the two validity periods, and the accident flight was in the later period.
Within the QLD-N area, for both validity periods, there were weather areas A and B and sub areas A1 and A2 within area A. About the first half of the flight from Cloncurry to Mount Garnet was in area B, the aircraft then entered area A and the final segment to Mount Garnet was in sub area A2 (Figure 5). The entire accident flight from Mount Garnet was within sub area A2.
Figure 5: Image from the graphical area forecast for area QLD-N issued at 0831 and valid from 0900 to 1500 EST
Source: Bureau of Meteorology, annotated by ATSB
Areas B and A (but not sub area A1 or A2)
The forecast weather was similar for areas B and A (but not sub area A1 or A2), with visibility greater than 10 km and scattered[8] cumulus/stratocumulus cloud with bases between 5,000 and 6,000 ft (AMSL), and tops at 9,000 ft. In the earlier forecast period only (valid until 0900), area A (but not sub area A1 or A2) additionally had scattered stratus clouds forecast, with bases at 1,500 ft and tops at 3,000 ft.
Sub area A2
The forecast for sub area A2, valid for, and relevant to the vicinity of the accident flight, included:
scattered to broken stratus clouds, with bases at 1,500 ft and tops at 3,000 ft
scattered to broken cumulus and stratocumulus clouds, with bases at 2,000-2,500 ft and tops at 8,000-9,000 ft.
The forecast visibility was greater than 10 km, reducing to 2,000-3,000 m in isolated[9] to scattered[10] moderate showers of rain. Moderate turbulence below 6,000 ft was also forecast for the sub area.
Grid-point wind and temperature forecast
Grid-point wind and temperature forecasts were obtained for the relevant period. Due to the terrain elevation in the area of the accident flight, the lowest grid-point wind and temperature data was for 5,000 ft AMSL. The forecast valid from 0700 to 1000 included wind from 090° True (easterly) at 26 kt and temperature 14 °C.
Aerodrome forecasts
The aerodrome forecast (TAF) for Cloncurry Airport valid for the morning’s departure, was south-easterly winds at 10 kt, CAVOK,[11] temperature 22 °C and the QNH[12] 1016.
There was no TAF for Mount Garnet or Atherton airports. Cairns and Innisfail are coastal airports close to sea level and located about 60 km north-east and south-east respectively, from the accident site. Those airports were also located in the graphical forecast sub area A2.
The TAF for Cairns Airport included 10 kt south-easterly winds, visibility greater than 10 km, light showers of rain, scattered cloud at 2,500 ft above aerodrome elevation (AAE) and broken cloud at 3,500 ft.
Innisfail TAF included 8 kt south-easterly winds, visibility greater than 10 km, scattered cloud at 2,000 ft AAE, broken cloud at 4,000 ft AAE. Between 0600 and 1200 for intermittent periods of up to 30 minutes, visibility was forecast to reduce to 3,000 m in showers of rain, with few cloud at 1,000 ft AAE and broken cloud at 1,800 ft AAE.
Bureau of Meteorology observations
Weather observations nearest the accident site were recorded at Mareeba Airport, about 35 km to the north-east. At 0900, the temperature at Mareeba Airport was 23.1 °C, the dew point temperature was 18.4 °C, wind south-easterly at 10 kt and the QNH was 1018.4 hPa.
Aerodrome weather observation reports for Innisfail and Cairns airports at 0930 and 1000 were consistent with the forecast, with two to three layers of cloud.
Weather radar images from Cairns (Saddle Mountain) radar between 0934 and 0957 showed light rain in Atherton (Figure 6).
Figure 6: Weather radar image from Cairns at 0951 showing light rain in Atherton
Source: Bureau of Meteorology, annotated by ATSB
Satellite imagery
Satellite imagery showed scattered to broken cloud coverage at the time of the accident flight, moving from the south-east. Based on the cloud top infrared satellite temperatures, the cloud base was likely at ground level in the vicinity of the accident site. Figure 7 depicts the aircraft track overlaid on colour satellite images taken at 0940 and 0950. Within the limitations of the depicted cloud positions, these images show that the aircraft tracked along areas of more broken cloud until the top of descent. Between the top of descent and the accident site at 0950, the cloud appears as an unbroken cell.
Figure 7: Aircraft track overlaid on satellite imagery at 0940 and 0950 EST
Source: Bureau of Meteorology, annotated by ATSB
Witness observations
The passenger reported that on the approach to Mount Garnet from Cloncurry, the pilot made minor deviations around and under scattered cloud.
Several pilots operating near Atherton Airport on the morning of 8 April 2019 reported low cloud and drizzle over the range. A flight instructor on a training flight tracking south-east towards Atherton around the time of the accident observed thick cloud to the ground on the range and assessed that there was no way to maintain VMC, so changed course to remain to the north, clear of the weather.
Another training aircraft approached Atherton Airport from Mareeba Airport at the time of the accident and the flight instructor on board reported low cloud and rain with reduced visibility moving in from the south. Shortly after landing, they experienced a very heavy rain downpour, which lasted for about 15 minutes.
Carburettor icing
The atmospheric conditions recorded at the Bureau of Meteorology Mareeba station (the closest station) at the time of the accident were applied to the Civil Aviation Safety Authority Carburettor icing probability chart. Based on this chart, the likelihood of carburettor icing[13] was ‘moderate icing for cruise or serious icing for descent’. A reduction in power that could result from carburettor icing was inconsistent with the aircraft damage sustained at impact. Therefore, it was concluded that carburettor icing was not a factor.
Pre-flight planning
Visual flight rules
VFR flights are required to be conducted in visual meteorological conditions (VMC) that ensure sufficient visibility to fly the aircraft while maintaining visual separation from terrain and other aircraft. Additionally, when operating at or below 2,000 ft above the ground (or water), the pilot was required to be able to navigate by visual reference to the ground (or water).
The VMC criteria, including minimum flight visibility and distance from cloud, were specified in the Airservices Australia Aeronautical Information Publication (AIP). Relevant to this flight, the AIP En Route 1.2 Section 2.5 Non-Controlled Airspace – Class G stipulated that, for aeroplanes operating at or below 3,000 ft AMSL or 1,000 ft above ground level (whichever is higher), a minimum flight visibility of 5,000 m must be maintained, including a requirement to remain clear of cloud and in sight of the ground or water.
No flight plan or search and rescue time[14] were lodged with air traffic services for the accident flight, nor were they required to be for VFR flights.
Weather planning
The pilot had a National Aeronautical Information Processing System (NAIPS) user identification to allow access to the NAIPS briefing and flight notification functions including access to weather information. NAIPS was able to be remotely accessed, including from electronic flight planning software OzRunways,[15] which was installed on the pilot’s iPad. Information provided by Airservices indicated that the pilot’s last logon to NAIPS was on 2 April 2019 (six days before the accident). However, although the pilot did not use NAIPS for weather planning close to the accident flight, this does not preclude the pilot having accessed weather forecast information through another means.
Fuel planning
On the morning of the accident flight, as neither the pilot nor the passenger had a fuel account self-service card, they were unable to refuel the aircraft in Cloncurry. Therefore, the pilot planned to fly from Mount Garnet to Atherton Airport, refuel the aeroplane and then return, while the passenger conducted business in Mount Garnet. The pilot had flown to Atherton to refuel on previous occasions, including from Mount Garnet.
Fuel records for the time the aircraft was on the ground in Charters Towers on April 7, show that 165 L of fuel was pumped from the bowser. The passenger reported that this had filled the main and auxiliary tanks to their 358 L capacity. Since refuelling, the aircraft had been airborne for 4 hours and 58 minutes and travelled 1,209 km (653 NM) before landing at Mount Garnet.
The passenger estimated there would have been 60 to 90 minutes of fuel remaining after landing in Mount Garnet; sufficient for the return flight to Atherton. Due to disruption of the fuel tanks and cockpit instruments, the amount of fuel on board at the time of the accident could not be determined. Fuel exhaustion was not considered probable given the aircraft’s forward speed at impact and propeller damage.
Visual flight into instrument meteorological conditions
Adverse weather conditions and reduced visual cues
By definition and legislation, flight under the VFR requires sufficient visual reference for a pilot maintain geographical, situational and spatial orientation. In less than VMC, pilots must be qualified, proficient and well-prepared to operate by reference to the aircraft instruments and under the instrument flight rules and the aircraft must be equipped and maintained to the required standard. Significant risks face VFR pilots flying into IMC. Research for the ATSB Avoidable Accidents publication Accidents involving Visual Flight Rules pilots in Instrument Meteorological Conditions found that about 10 per cent of VFR into IMC occurrences reported to the ATSB between 2009 and 2019 resulted in a fatal outcome. The resulting collision with terrain following VFR into IMC events have occurred in both controlled and uncontrolled flight.
Controlled flight into terrain
The ATSB (2007) has defined a controlled flight into terrain (CFIT) as one in which:
the aircraft is under the control of the pilot(s) and collides with terrain, water or obstacles
there is no defect or unserviceability that would prevent the otherwise normal operation of the aircraft
the pilot(s) have little or no awareness of the impending collision.
The aviation community has invested considerable time and resources in an attempt to reduce the risk of CFIT, particularly in the commercial sector. Measures such as terrain awareness warning systems have substantially reduced these types of accidents.
In the 10-year period up to the accident flight, 32 CFIT occurrences involving VH-registered aircraft were recorded in the ATSB database. Seventeen of those were classified as accidents, six of which involved fatal injuries to occupants. The fatal accidents occurred during general aviation operations, five of which were private flights, and one was a passenger-carrying charter operation.
The ATSB Aviation Research and Analysis Report CFIT: Australia in context 1996 to 2005 found that CFIT accidents occur most often in conditions of reduced visibility and mountainous terrain. Loss of situational awareness has been identified as a key contributing factor, particularly a loss of vertical situational awareness or ‘altitude error’.
Spatial disorientation and loss of control
Although not consistent with the accident site and wreckage or flight profile in this accident, the other risk associated with VFR into IMC is a loss of control due to spatial disorientation. Spatial disorientation occurs when the brain receives conflicting or ambiguous information from the body’s sensory systems. It is likely to happen in conditions in which visual cues are poor or absent, such as in cloud. Gibb and others (2010) explain that seeing the horizon is ‘crucial for orientation of the pilot’s sense of pitch and bank of the aircraft.’ In conditions of low visibility, the horizon may not be visible to the pilot, which can lead rapidly to disorientation.
Spatial disorientation presents a danger to pilots, as the resulting confusion can often lead to incorrect control inputs resulting in a loss of aircraft control. Gibb and others (2010) stated that ‘spatial disorientation accidents have fatality rates of 90–91 percent, which indicates how compelling the misperceptions can be.’
Factors contributing to VFR into IMC
A study by Wiegmann and Goh (2000) identified factors that may contribute to instances of VFR flight into adverse weather conditions. These included:
situation assessment – an inaccurate assessment by a pilot of the conditions
risk perception – a pilot may not appreciate the risks involved with continuing the flight
motivational factors – ‘get-home-itis’ or personal/social pressures to complete the flight.
In particular, the study found that, during the conduct of a simulated cross-country flight, a significant proportion of participants overestimated the visibility and cloud base. That is, they perceived the conditions to be better than what they actually were and continued into IMC rather than turning back.
Related occurrences
The ATSB has investigated numerous fatal accidents resulting from VFR into IMC occurrences that resulted in either spatial disorientation and associated loss of control, or controlled flight into terrain. Three of these are summarised here.
ATSB investigation AO-2015-131: Collision with terrain involving Airbus Helicopters EC135 T1, VH-GKK, 10 km NNW of Cooranbong, New South Wales, 7 November 2015
On 7 November 2015, the owner-pilot of an Airbus Helicopters EC135 T1, departed on a private flight from Breeza Terrey Hills, New South Wales. The flight was conducted under the visual flight rules and there were two passengers on board. About 40 km south-west of the Liddell mine in the Hunter Valley, the pilot diverted towards the coast, probably after encountering adverse weather conditions. Witnesses observed the helicopter overfly the Watagan Creek valley in the direction of higher terrain, then return and land in a cleared area in the valley. After 40 minutes on the ground, the pilot departed to the east towards rising terrain in marginal weather conditions. About 7 minutes later and approximately 9 km east of the interim landing site, the helicopter collided with terrain. The pilot and two passengers were fatally injured. The pilot likely encountered reduced visibility conditions leading to loss of visual reference leading to the collision with terrain.
ATSB investigation AO-2013-186: Collision with terrain involving Cessna 182, VH-KKM, 19 km WSW of Mount Hotham Airport, Victoria, 23 October 2013
On 23 October 2013, the pilot of a Cessna 182Q aircraft, operating under the visual flight rules, departed Moruya Airport, New South Wales on a private flight to Mangalore Airport, Victoria. The pilot was qualified for visual flight rules and had minimal total and recent flying experience. The flight route encompassed the Alpine National Park, where the forecast and actual weather included extensive thick cloud and severe turbulence. It was very likely that these conditions were encountered while flying over the Alpine National Park, shortly after passing Mount Hotham Airport. The pilot likely experienced reduced visibility to the extent that terrain avoidance could not be assured, resulting in the aircraft colliding with terrain in controlled flight. The pilot sustained fatal injuries and the aircraft was destroyed.
ATSB investigation AO-2012-130: VFR flight into IMC involving de Havilland DH-84 Dragon VH-UXG, 36 km SW of Gympie, Qld, 1 October 2012
On 1 October 2012, a de Havilland DH-84 Dragon Mk 2 aircraft took off on a private flight from Monto to Caboolture, Queensland. The pilot was not qualified for, and the aircraft was not equipped for instrument flight. About 2 hours after departure, the pilot contacted ATC and advised that the aircraft was in cloud. Over the next 50 minutes ATC provided assistance to the pilot but it was apparent that he was unable to navigate clear of the cloud. The aircraft wreckage was located on 3 October in high terrain; there were no survivors. The ATSB found that:
With no or limited visual references available in and near cloud, it would have been very difficult for the pilot to maintain control of the aircraft. After maintaining control in such conditions for about an hour and being unable to navigate away from the mountain range, the pilot most likely became spatially disoriented and lost control of the aircraft before it impacted the ground.
Loss of visual reference and controlled flight into terrain
The pilot held current qualifications to operate in day and night visual meteorological conditions and neither the pilot nor the aircraft were authorised to operate in instrument meteorological conditions (IMC). No flight plan or search and rescue time were lodged for the accident flight, and no radio calls were broadcast by the pilot. This was consistent with the pilot intending to operate the flight under the visual flight rules (VFR).
The forecast weather for the accident flight included low cloud extending to the ground in areas of higher terrain, and low visibility in cloud and showers of rain. The planned 20-minute flight was contained within a sub area of weather considerably worse than the previous flight the pilot conducted that day (from Cloncurry to Mount Garnet). Although the pilot did not access aeronautical weather forecasts via the NAIPS system, it could not be determined if the pilot accessed any weather forecast before departing Mount Garnet for Atherton. However, observed conditions were consistent with those forecast. In any event, it was likely apparent to the pilot shortly after take-off that there was a risk of encountering cloud, as several deviations were made from the direct route—consistent with tracking to avoid cloud.
The pilot had experience flying locally, had flown from Mount Garnet to Atherton previously and the aircraft was fitted with a GPS, but the cloud and low visibility almost certainly precluded the pilot from navigating by ground reference. The subsequent changes in aircraft direction and altitude were indicative of the pilot manually flying the aeroplane rather than having the autopilot engaged. These changes in track were also consistent with what would be expected if attempting to avoid weather, as the aircraft’s four previous recorded flights tracked direct to Atherton, except for one deviation due to cloud approaching Mount Garnet.
As the aircraft approached the Herberton Range it climbed to an altitude about 400 feet higher than the highest terrain in the area, but this was very likely not above the cloud tops. It could not be known whether the pilot then descended in an attempt to get under the cloud (having lost visual reference with the ground), or due to geographical disorientation, had assessed the aircraft was beyond the range and closer to Atherton. Either way, low cloud and reduced visibility obscured rising terrain, and this almost certainly resulted in the pilot losing visual reference with the ground and the aircraft colliding with terrain in level flight, under power and pilot control.
Undisclosed medication
The pilot was taking medication that had the potential to affect flying performance. There is a documented pathway for the Civil Aviation Safety Authority (CASA) and a Designated Aviation Medical Examiner (DAME) to manage certain medical conditions and medications, including the one being taken. The pathway requires an assessment of the associated risk and does not necessarily preclude a pilot from maintaining a medical certificate. However, the CASA medical process requires pilots to disclose medications and conditions so they can be assessed and managed.
The medication and associated condition had not been disclosed to the pilot's DAME or recorded on the pilot's CASA medical file. Although the medication had also not been taken in accordance with the patient guidelines, there was no evidence as to whether it influenced the pilot’s spatial awareness and decision-making performance on the accident flight.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the collision with terrain involving Cessna 182, VH-DJN, 14 km south-south-west of Atherton Airport, Queensland, on 8 April 2019.
Contributing factors
The pilot, who was qualified only to operate in visual meteorological conditions, flew toward, and entered an area of low cloud and reduced visibility, which obscured rising terrain. This almost certainly resulted in the pilot losing visual reference with the ground and a controlled flight into terrain.
Other factors that increased risk
The pilot was taking medication that had the potential to affect performance, and as such, was required to be disclosed to the Civil Aviation Safety Authority (CASA). This medication had not been disclosed to the pilot's Designated Aviation Medical Examiner or recorded on the pilot's CASA medical file.
Other findings
The pilot had an elevated risk of incapacitation due to heart disease.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
passenger
Bureau of Meteorology
Civil Aviation Safety Authority
Queensland Police Service
maintenance organisation for VH-DJN
Airservices Australia
recorded data from the GPS unit on the aircraft
Queensland Health Forensic and Scientific Services
Medicare and Pharmaceutical Benefits Scheme
General Practitioner
Designated Aviation Medical Examiner.
References
ATSB, 2007, CFIT: Australia in context 1996–2005, Aviation Research and Analysis Report B2006/0352. Available from www.atsb.gov.au
ATSB, 2011, Accidents involving visual flight rules pilots in instrument meteorological conditions, Aviation Research an Analysis Report AR-2011-050. Available from www.atsb.gov.au
Gibb, R, Gray, R and Scharff, L, 2010, Aviation Visual Perception: Research, Misperceptions and Mishaps, Ashgate Publishing Limited, Surrey, United Kingdom.
Wiegmann D & Goh J 2000, Visual flight rules (VFR) flight into adverse weather: An empirical investigation of factors affecting pilot decision making, Technical report ARL-00-15/FAA-00-8, Aviation Research Lab Institute of Aviation, Illinois.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the passenger
the aircraft maintainer
the Bureau of Meteorology
the Civil Aviation Safety Authority
Queensland Health Forensic and Scientific Services
General Practitioner
Designated Aviation Medical Examiner.
Submissions were received from the:
Bureau of Meteorology
aircraft maintainer
forensic pathologist.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 29 March 2019, the catamaran ferry Fitzroy Flyer was on a scheduled trip between Cairns and Fitzroy Island, Queensland, with four crewmembers and 37 passengers on board. At about 1410, the port main engine overheated, and shortly after, a fire alarm activated in the port engine room. A crewmember and passenger investigated and reported smoke and fire. Initial attempts were made to extinguish the fire using portable extinguishers, but the success of these actions could not be confirmed. At about 1450, the master activated the port engine room fire suppression system.
All passengers were mustered and evacuated to two nearby vessels. At 1615 the master started the starboard engine and Fitzroy Flyer returned to Cairns at slow speed. By 1710, the ferry had been safely berthed without further incident.
What the ATSB found
No evidence of a fire or any fire damage was found in the engine room during inspections carried out after the incident. The signs seen by personnel were likely from smoke due to a loose and slipping fan drive belt and steam from the overheated cooling system.
The ATSB found that the on-board response did not follow company procedures as had been practised by crewmembers during emergency drills. More specifically:
the crew did not promptly deploy the vessel’s fire suppression system or apply boundary cooling to the area.
multiple entries were made into the contaminated port main engine room without suitable control measures in place.
passengers were transferred to other vessels while in open waters and without lifejackets (the engine room situation appeared to be under control at the time and the transfer unnecessarily exposed the passengers to increased risk).
an urgency message, informing and requesting assistance, was not sent.
What has been done as a result
Fitzroy Island Investments (Fitzroy Flyer’s owner-operator) reported that it has conducted a comprehensive evaluation and updating of the safety management system with emphasis on emergency procedures and drills. Schedules of regular shipboard staff training in procedures use and implementation, along with more frequent and targeted fire training and drills, have been implemented. In addition, a closed-circuit television camera surveillance system, with extended recording capability, has been fitted throughout the vessel.
Safety message
This occurrence highlights the importance of vessel operators having robust procedures and training for responding to fires and other emergencies on board, and for crewmembers to follow procedures and training in such situations. In particular, if a fire is suspected in an engine room, and further assessment is not possible, then crews should deploy the available suppression systems and transmit an urgency message.
The investigation
The occurrence
Departure from Cairns
Each day, the catamaran ferry Fitzroy Flyer (Figure 1) operated three return transfers between Cairns and Fitzroy Island, Queensland, with each leg taking about 50 minutes.
At about 0700 Eastern Standard Time[1] on 29 March 2019, the master boarded the vessel to conduct pre-start up routines. Shortly after, three crewmembers boarded and prepared the passenger cabin for the daily operations. The first transfer of the day departed Cairns at 0800 and, at 1350, Fitzroy Flyer departed Cairns on its third transfer with 37 passengers on board.
At about 1410, about halfway to Fitzroy Island (Figure 2), the master noticed that the port main engine cooling water temperature reading was high and he reduced both engines to neutral. A crewmember, deckhand 1 (DH1), in the main cabin, noticed the reduction in speed and went aft to investigate. Shortly after, a fire alarm activated on the bridge console for the port engine room. Not all crewmembers carried radios and the master radioed the galley and instructed a crewmember to investigate. DH1 acknowledged and proceeded to the port engine room.
A passenger, who was a staff member on Fitzroy Island, overheard that a fire alarm had been activated and went to assist. He informed DH1 that he was a former firefighter and DH1 accepted his offer of assistance.
Figure 2: Position of Fitzroy Flyer in Mission Bay when the fire alarm activated
Source: Google Earth, annotated by ATSB
As DH1 and the passenger approached the engine room hatch lid, they could feel heat coming from it (Figure 3). As a precaution before opening the hatch lid, the passenger had collected a portable carbon dioxide (CO2) fire extinguisher. When the hatch lid was opened, they sighted light-coloured smoke. They then climbed down the ladder, which was ‘hot to touch’, into the engine room to investigate further. They saw smoke, tinged blue, near the fuel filters,[2] and the passenger released the CO2 extinguisher. They both then left the engine room and closed the lid.
Figure 3: Port engine room and entrance
Source: Fitzroy Investments, annotated by ATSB
Subsequent response actions
At about 1415, DH1 reported to the master that there was a fire in the port engine room. The ferry slowed to a stop and the master shut down the port main engine. He asked another crewmember, deckhand 2 (DH2), to remain in the wheelhouse while he went to investigate.
Shortly after, at about 1420, DH1 and the passenger met the master by the port engine room. DH1 advised there was a smell of electrical burning and smoke with a blue tinge was coming from near the fuel filters. They confirmed to the master that they believed there was a fire and that a CO2 extinguisher had been released into the space. The master stated that, as CO2 had just been released, he could not make an entry for several minutes, so he returned to the wheelhouse. Once there, he instructed DH2 to move the passengers to the muster stations at the bow of the vessel and then he tried to call the shore management company via mobile phone. No other external communications, such as an urgency message (PAN PAN), were made at this time. The third crewmember, deckhand 3 (DH3), assisted DH2.
At about 1425, the master radioed for DH1 to come to the wheelhouse and keep lookout. After DH1 arrived, the master went back down to the engine room entrance, where the passenger met him. The master then isolated the fuel and emergency fire flaps for the engine room.
At about 1435, the master opened the engine room hatch lid and went into the engine room—he held his breath, due to the earlier release of the CO2 extinguisher. He did not see any signs of ‘flames or fire’ but could feel heat in the space and saw either ‘smoke or steam’. He released a dry powder extinguisher into the engine room and closed the hatch lid on exit.
At about 1440, the master returned to the wheelhouse and contacted the Cairns Vessel Traffic Services (VTS) to advise of the situation. Shortly after, the master saw a passing vessel, Scuba Pro, and contacted the crew for assistance, telling them they may need to evacuate passengers from Fitzroy Flyer. Scuba Pro’s skipper advised they could take 13 passengers. The master told DH2 to find 13 volunteers to evacuate. DH2 made an announcement to the passengers about the situation.
By 1445, the master had established contact with shore management and advised them of the situation and that he had not activated the port main engine fire suppression system. The master was instructed to activate the suppression system and was informed that management would come out to the vessel to assist with logistics.
By 1450, on the master’s orders, DH1 had activated the port main engine fire suppression system. The master then contacted VTS to advise that 13 passengers would be evacuated to Scuba Pro and the fire suppression system had been activated.
Passenger evacuation
At 1500, Scuba Pro was alongside Fitzroy Flyer and passenger transfer started. This was not a straightforward process as there was a freeboard difference, requiring a large step down to the other vessel. Also, several passengers had reduced mobility and others had expressed reluctance to transfer to the other vessels in open waters. In addition, the passengers did not wear flotation devices (lifejackets) during the transfer.
By 1510, the master contacted another vessel, Millennium Spirit, and asked if they could accommodate the remaining 24 passengers.
At about 1520, Scuba Pro pulled away from Fitzroy Flyer and the master reported to VTS they had taken 13 passengers and that Millennium Spirit would take those remaining. Millennium Spirit was alongside Fitzroy Flyer at about 1530 and passenger evacuation started.
Shortly after, at about 1540, the shore management vessel came alongside Fitzroy Flyer and the marine operations manager (MOP) and designated person ashore (DPA) boarded. The MOP went to the upper deck and started off-loading baggage, while the DPA went to the port engine room. Once at the engine room hatch, he opened the hatch lid and went inside to inspect; DH1 maintained watch at the top of the ladder.
Return to Cairns
At 1600, the master radioed VTS and reported that all remaining passengers had been safely offloaded to Millennium Spirit, and Fitzroy Flyer was making way to Cairns on the starboard engine. At about 1710, Fitzroy Flyer was safely alongside in Cairns.
Shortly after, the engine room was ventilated and inspected. The engine was found to be low on coolant and the water pump drive belt showed signs of burning due to a loss of tension.
There were no signs of fire anywhere in the engine room.
Context
Vessel information
Fitzroy Flyer is a catamaran ferry built in 1988. It is 22 m long with 8.7 m beam and draught of 2.69 m and was owned by Fitzroy Island Investments Pty Ltd at the time of the incident. The ferry is a Class 1 (13 or more passengers) registered Australian domestic commercial vessel for operational areas C (restricted offshore, to 30 NM) and D (partially smooth waters). It was certified to carry 186 passengers and four crewmembers in sheltered waters.
The vessel has a service speed of 23 knots and is powered by two MTU 12V 183 TE72, 495 kW main engines, one in each hull. Electrical power is supplied by a single 75 kW Isuzu BB-4BG1TRD-01 four-cylinder turbocharged diesel engine, located in the generator room in the port hull.
The port and starboard engine rooms are each protected by a Novec 1230[3] fixed fire-suppression system. The systems were designed to flood the space and extinguish a fire by rapidly removing heat. The engine room needed to be isolated and secured, the system activated and then the space and conditions monitored.
Safety induction, training and emergency drills
The company’s safety management system (SMS) documented guidance for crewmember induction, training and emergency plans and drills. The designated person ashore (DPA) and the master were to check the effectiveness of the training. The master was responsible for conducting on-board training and emergency scenario drills.
All crewmembers had to complete a vessel safety induction before they commenced work on board. Training and competency were required in vessel safe operation, emergency equipment, the vessel layout/safety and administration. This included familiarisation with emergency procedures and duties, the engine room fire suppression systems, firefighting appliances, entry into void spaces/engine room, crew-only areas and the procedural manuals.
The emergency plans detailed the preparation, training and emergency procedures that the crewmembers should know. Specifically for a fire emergency, the crewmembers needed to know, amongst other things:
the muster stations for their shift
the location and use of firefighting equipment
the location of fuel and fan shut-offs and how to use the emergency fire flaps
correct emergency signals and to maintain proper and effective communication.
The SMS required that on-board emergency drills be conducted on a regular basis. The crewmembers practised the emergency procedures for seven different scenarios, including fire and ‘abandon ship’. The drill records showed that the crewmembers on board at the time of the incident had each completed one fire drill in the previous 4 months, and all but DH2 had completed an ‘abandon ship’ drill in the previous 4 months.
Emergency procedures
The procedures detailed the individual crewmembers’ duties in case of a fire emergency. For example, the master was to attend the wheelhouse, maintain radio communications and direct crewmembers. This was supported by a specific fire emergency checklist on board that detailed the actions to be taken in the event of a fire. This checklist included:
sound fire alarm—muster and account for all persons on board
identify and assess the type of fire and its location
shut all ventilation to affected areas and fight the fire if safe to do so
prepare lifesaving equipment and portable flotation devices
broadcast an urgency message to request assistance.
In addition to this were instructions for operating the main engine room fixed fire-suppression systems: secure the engine room access hatch, isolate the space and then activate the suppression system. The hatch lid was to remain closed for a sufficient period before entry was made. A warning sign on the hatch lid stated that the space should not be entered until it had been thoroughly ventilated.
Risk management
The SMS contained a register of 57 risk assessments for activities and operations involving the vessel. In particular, one risk assessment dealt with a ‘Fire on vessel’ (including engine room fire) and two others detailed controls for engine room and confined space entry.
The risk control measures required that only trained crew may access confined spaces, that the atmosphere should be tested, and that personal protective equipment and breathing apparatus should be worn. However, the vessel did not carry either self-contained breathing apparatus or suitable atmosphere testing equipment, nor was it required to do so. Further, the procedures required the master to be advised which crewmembers were entering the engine room.
Vessel management
The company designated person ashore (DPA) was responsible for monitoring the safe operation of the vessel. The DPA had direct access to the owner of the vessel and had duties which included monitoring the SMS and the on-board training.
The vessel’s master had complete authority on board and was responsible for taking all necessary actions in the interest of safety. The master could deviate from the documented procedures if human life was at risk, and could ask the company for help when deemed necessary.
Safety analysis
Source of smoke
During the leg from Cairns to Fitzroy Island, a fire alarm activated in the port engine room. After inspecting the room, the crew believed there was a fire on board and subsequently the passengers were evacuated. However, no evidence of a fire or any fire damage was found in the engine room during inspections carried out after the incident. The signs seen by personnel were likely from smoke due to a loose and slipping fan drive belt and steam from the overheated cooling system.
The remainder of this analysis will examine the procedures and actions regarding the response to the suspected fire.
Immediate response actions
All crewmembers on board the vessel had completed the mandatory safety induction and participated in emergency drills. The vessel’s masters had conducted emergency scenario training for on-board fires six times in the 4 months before the incident. The training involved using fire hoses, extinguishers, boundary cooling and activating the fire suppression system. The master and deckhand 1 (DH1) were familiar with the emergency procedures and had been involved in three and four drills respectively. With potentially 190 persons on board the vessel, any response to an emergency needed to be effective.
However, in this case the crew suspected there was a fire in the port engine room but did not follow their training and procedures. In particular, they did not promptly lock down the engine room, deploy the fire suppression system and apply boundary cooling to the area.
Prior to flooding the engine room with the fixed fire suppression agent, the master attempted to determine whether a fire was actually present. His assessment of the situation included obtaining advice from DH1 and the passenger, along with a personal inspection of the port engine room. He was unable to confirm that there was a fire and remained hopeful that the situation could be contained without the need to release the fire suppression system. However, after seeking shore management advice, the system was activated, about 30 minutes after DH1 first advised that there was a fire present.
When doubt exists and it is unsafe to confirm whether a fire is present, prudent action would be to use the systems in place early in the response to contain and limit escalation of the situation.
In addition, a number of other aspects of the emergency response were problematic, including the involvement of a passenger, uncontrolled entries into a dangerous space and limited communications.
Passenger involvement
A passenger on board Fitzroy Flyer offered assistance and became actively involved in the incident response, including making an entry into the engine room. The passenger reported seeing blue colouration and smoke, and released a CO2 extinguisher into the space. The passenger believed that the blue-coloured smoke indicated there was a fire present. His experience and observations, when relayed to the master, likely influenced the master’s decisions and the incident response.
However, only trained crewmembers were assigned emergency duties on board the vessel, and the passenger was not trained in the use of the vessel’s equipment or procedures. The emergency procedures and risk assessments did not refer to the involvement of any other persons, regardless of their (unverified) experience or willingness to assist. Although using other available resources during emergencies can be a useful strategy if insufficient resources are available or the situation is unusual and complex, in this case the situation should have been well within the capabilities of the crew on board to manage.
Entry into dangerous spaces
Risk controls were in place to protect crewmembers entering into dangerous spaces. However, the vessel did not carry the necessary equipment to allow entry as per the procedures. Consequently, several entries were made into the contaminated engine room without these precautions being followed. More specifically, the passenger and DH1 were in the engine room when the CO2 extinguisher was released, the master entered not long after the CO2 extinguisher was released (without any ventilation being applied), and the designated person ashore (DPA) entered about 50 minutes after the fire suppression system had been deployed (without any ventilation being applied).
As there was, as a minimum, smoke, and there had been a suspected fire as well as the release of firefighting media into the engine room, the atmosphere was contaminated. Therefore, entry into the space should have been carefully controlled with consideration given to the conditions existing and the extent to which these risk controls could have been in place before any entry.
Evacuation of passengers
During the incident, the master directed the passengers to muster and then decided to evacuate them to passing vessels. Due to the difficulties in transferring persons of varying capability between moving vessels in a seaway, and without lifejackets, the transfer of passengers off Fitzroy Flyer was problematic. The transfers did not follow the vessel’s evacuation procedure.
Furthermore, at this stage, the engine room situation appeared to be contained and the need to evacuate was not clearly apparent. With one operational engine, Fitzroy Flyer could have made its way to Fitzroy Island or Cairns. The passengers would not, then, have been exposed to further risk during the transfer. In such circumstances, it would have been prudent to keep the passengers on board Fitzroy Flyer, as the vessel was in fact the best lifeboat at the time. As a precaution, the other vessels could have remained close by for immediate access if the situation deteriorated or until they were no longer needed.
Internal and external communications
Fitzroy Flyer did not carry sufficient radios for the four crewmembers. This resulted in some of the crewmembers’ conversations having to be communicated face-to-face during the emergency and the passenger evacuation. Therefore not all of the crew were kept aware of the full situation.
Further, the emergency procedures required an urgency message to be broadcast to request assistance. Despite the initial reports of smoke and then the decision to evacuate the passengers, a message was not broadcast.
As with any emergency situation, communications are key, and early notice to nearby vessels and authorities is advised. These parties are then in a position to prepare and provide timely assistance, regardless of whether the situation escalates or not.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Although the crew believed that there was a fire in the port engine room, no evidence of a fire was subsequently found.
Although the crew had received regular emergency response training for a fire, they did not follow some key elements of this training during the response to the suspected fire. In particular, the crew did not promptly deploy the engine room fire suppression system and apply boundary cooling to the area.
A passenger (a former firefighter) actively sought involvement in the response to the fire alarm. His actions and advice likely influenced the master’s decision making.
Several people made entries into the port engine room, even though it had not been adequately ventilated or the atmosphere tested.
Passengers were unnecessarily exposed to increased risk when they were evacuated, without lifejackets, to two vessels with varying freeboards, in open waters.
Communications throughout the incident were limited. On board there was not a sufficient quantity of UHF radios for all crewmembers and, externally, an urgency message was not broadcast.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Fitzroy Island Investments Pty Ltd (vessel manager)
As a result of this incident, Fitzroy Island Investments advised the ATSB that the following safety actions have been taken:
conducted a comprehensive assessment and update of the safety management system emergency procedures and drills documentation and procedures
introduced a system of regular (at least monthly) on-site training for masters and crew in the implementation of procedures
purchased additional radios and implemented procedures for radio use (including all crewmembers being required to carry a radio at all times while on board)
installed an eight zone closed-circuit television cameras (CCTV) system (with 1 month recording capability) throughout the vessel, covering engine rooms, wheelhouse, passenger areas and main muster points
clarified procedures to ensure all crewmembers are aware that passengers must not be involved in firefighting operations, even if they claim to be experienced
implemented a schedule for more frequent and specific fire training and drills.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 29 March 2019 at about 1857 JST (Japan Standard Time),[1] a Boeing 787-8 aircraft, registered VH‑VKJ, was operating by Jetstar as scheduled flight JQ15 from Cairns Airport, Queensland, to Kansai International Airport, Japan. During descent into Kansai, the aircraft experienced engine speed oscillations and temporary loss of thrust on the right and then the left engine. The aircraft landed safely at Kansai at 1919.
Investigation
The Japan Transport Safety Board (JTSB) was responsible for the investigation of this occurrence. As part of this investigation, the JTSB notified the ATSB as the State of the Operator of the aircraft. In accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation, the ATSB appointed an accredited representative to assist the JTSB with the investigation. In order to facilitate that assistance, an investigation under the Transport Safety Investigation Act 2003 was commenced.
Findings
The JTSB investigation is now complete and identified the probable cause of the engine oscillations and temporary loss of thrust as being residue from a previous biocide fuel system treatment interfering with the fuel metering of both engines. That biocide treatment, Kathon FP1.5, was loaded into the aircraft’s fuel system two days before the occurrence. The JTSB identified a number of safety actions regarding the use Kathon FP1.5 as a biocide treatment.
The JTSB have released the final report into this investigation, which is available at www.mlit.go.jp/jtsb/airrep.
Any enquires relating to the investigation should be directed to the JTSB: www.mlit.go.jp/jtsb.
With the completion of the JTSB investigation, the ATSB’s assistance activities are also complete and the investigation closed.
_____________
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the JTSB final investigation of the occurrence.
On 14 April 2019, the pilot of a Pilatus PC-12/47E aircraft, registered VH-OWJ and operated by Royal Flying Doctor Service - Western Operations (RFDS), was conducting a medical transport flight under instrument flight rules from Merredin to Jandakot within Western Australia. A RFDS aeromedical crew consisting of a flight nurse and doctor were on board with a non-critical patient who was being transferred to a hospital in Perth. For the midnight departure, there were almost clear skies with minimal ambient and celestial lighting.
About 1.5 minutes after take-off, ‘Pitch Trim Runaway’ warnings activated and the pitch trim continued to move nose-down without any pilot or autopilot inputs. The pilot initiated the applicable emergency procedure but inadvertently selected the Flap Interrupt switch rather than the Trim Interrupt switch. Consequently (before the next checklist item was actioned), the pitch trim continued to runaway until it reached full nose-down with associated serious control difficulties.
The pilot did not identify the mis-selection and continued to address the emergency procedure without resolving the full out-of-trim condition. With the assistance of the doctor seated in row 2, the pilot managed to return to Merredin for a flapless landing. The aircraft was undamaged and the occupants uninjured.
What the ATSB found
The ATSB found that the pitch trim runaway occurred because of a malfunctioning relay in the manual (main pilot-engaged) stabiliser trim system.
As the (uninterrupted) pitch trim runaway progressed, the reinforcing cycle of increasing control loads, forced descent, and increasing airspeed was initially exacerbated by high engine torque. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.
After the pilot addressed items 2 and 3 of the emergency procedure, the malfunction was neutralised and the alternate stabiliser trim system was available to adjust the trim. However, the pilot did not identify those positive conditions and continued with items 4 to 8 of the procedure, which disabled the alternate stabiliser trim system, prevented pitch trim adjustment and prolonged the serious control difficulties.
The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches, unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.
The ATSB found that the emergency procedures and systems information in the PC-12 Pilot Operating Handbook/Airplane Flight Manual and Quick Reference Handbook did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this incident, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.
As a factor that increased risk, the effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems knowledge and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).
What's been done as a result
Pilatus advised that a design change, to reduce the likelihood of a trim runaway, was developed before the occurrence to replace the mechanical pitch trim relays with solid-state relays but was not fully implemented due to limited parts availability. Both applicable service bulletins have now been published.
Pilatus also advised that the probability of erroneous activation of the Flap Interrupt switch instead of the Trim Interrupt switch has been reduced by the publication and active distribution of a Safety Information Letter (SIL-003) to all customers, operators and service centres. This includes a reminder of procedures when encountering a trim runaway condition.
The ATSB acknowledge these positive safety actions but notes that the Trim interrupt and Flap Interrupt switches on the PC-12 do remain identical and co-located, and there is potential for engineering controls to eliminate the mis-selection of the interrupt switches.
RFDS investigated the occurrence and implemented safety action such as increasing pilot awareness about the pitch trim systems and enhancements to their related training and checking processes.
Safety message
The ATSB advises operators of PC-12 aircraft to review their training/checking processes related to the pitch trim system to ensure that pilots are adequately prepared to manage a runaway emergency. More generally, operators and pilots are advised to enhance awareness of expected system behaviour from switch and other control selections.
For flight control emergencies such as out-of-trim conditions, there is an imperative to maintain control while resolving the technical problem. A critical factor for pilots to consider is control of airspeed and associated engine power.
Operators are encouraged to submit reports of PC-12 pitch trim defects to the Defect Reporting Service to facilitate the Civil Aviation Safety Authority’s monitoring of continuing airworthiness data.
The occurrence
Background
On 13 April 2019, a pilot employed by Royal Flying Doctor Service - Western Operations (RFDS) based at Kalgoorlie, Western Australia was rostered for a night standby duty between 1800 and 0600 Western Standard Time (WST). Soon after starting duty, the pilot and rostered medical crew was tasked to transfer a patient from Kalgoorlie and a patient from Albany to Jandakot within Western Australia. After consideration of the weather forecasts and medical status of the respective patients, the decision was made to proceed direct to Jandakot then conduct a flight to Albany and return, followed by a positioning flight to Kalgoorlie.
For this series of flights, the pilot was operating a Pilatus Aircraft Ltd. PC-12/47E aircraft, registered VH-OWJ, as a medical transport flight in the aerial work category under the instrument flight rules. At 2032, the pilot departed Kalgoorlie with a patient, flight nurse and doctor on board.
During the flight to Jandakot, the RFDS operations centre advised the pilot and medical crew of a patient at Merredin that required transfer to Jandakot as a higher medical priority than the Albany patient. For on-board patient care reasons, the flight continued as planned to Jandakot, landing at 2213. The pilot and medical crew were then re-tasked to conduct a flight to Merredin for the previously advised patient transfer.
The pilot departed Jandakot at 2253 and landed at Merredin aeroplane landing area (ALA) at 2341. This flight was described as normal except for diversions around storm cells that added 15 minutes to the planned flight time. The weather observed at Merredin was almost clear skies with a few scattered clouds to the south of the aerodrome and light winds.
Just after midnight, the pilot taxied the aircraft for runway 28 at Merredin ALA with the patient, flight nurse, and doctor on board. The pilot was seated in the front left control seat and the doctor was seated in the second row on the right, facing backwards.
The pilot conducted a normal take-off and was airborne at 0008:34. For the departure, the pilot was manually flying with the intention to engage the autopilot when the aircraft was established in the climb. As was typical for the phase of flight, the pilot was intermittently engaging the trim switches on the control wheel to make pitch trim adjustments. There was minimal ambient and celestial lighting for the departure.
Emergency condition and initial pilot response
At 0010:05 (about 1.5 minutes after becoming airborne), as the aircraft was on climb through 2,700 ft AMSL (1,400 ft above ground level)[1] at a (calibrated) airspeed[2] of 140 kt, the following occurred without any apparent precursors:
master warning light illumination
‘pitch trim runaway’ voice annunciation
‘pitch trim runaway’ warning message in red on the multi-function display
continued pitch trim movement in a nose down direction without pilot or autopilot input at the time (uncommanded).
The pilot recalled hearing and seeing those warnings and that the aircraft pitched nose-down violently shortly afterwards. With both hands pulling on the control column to raise the nose, the pilot found that the force required to move the control column was extremely high and required maximum effort. The pilot was unable to counteract the nose-down force and the aircraft developed a high rate of descent at approximately 2,000 ft/min.
In response to the warnings, the pilot initiated the Pitch Trim Runaway emergency procedure from memory. The pilot recalled that:
The first action was to select the Trim Interrupt switch on the centre console from NORM (normal) to INTR (interrupt). At the time, the pilot believed that this was carried out and that it was difficult to reach because of the high control column loads. (A ‘Flaps Caution’ was recorded at 0010:11, 6 seconds after the initial trim warning. This caution is consistent with operation of the Flap Interrupt switch instead of the Trim Interrupt and was not noticed by the pilot at the time.)
After a short interval to focus on raising the nose, the pilot pulled the Pitch Trim circuit breaker on the essential bus to the OPEN position. (An Autopilot Fail Advisory was recorded at 0010:39, 34 seconds after the initial trim warning. This was coincident with cancellation of Pitch Trim Runaway warning and consistent with opening of circuit breaker)
The Trim Interrupt switch was selected back to NORM. (Based on the first action, this was probably the Flap Interrupt switch.)
Following those actions, the pilot was concerned that there was no change to the condition of the aircraft. This was contrary to the pilot’s expectations from training, which was that the Trim Interrupt switch should have stopped the dive and the opened circuit breaker should have relieved the situation. (Either or both actions would stop the manual trim motor from further operation but would not relieve the control loads existing at the time this action was taken.)
According to the recorded data, the pitch trim continued to operate in the runaway condition until it reached full nose down position 16 seconds after the warnings were issued. During that 16‑second period, the following data was recorded (see the indicative flight data plot in Figure 1):
engine torque remained at the take-off and initial climb setting of 42 lb (black trace)
pitch attitude went from +9.5 degrees (nose-up) down to -7.5 degrees (purple trace)
airspeed increased from 135 kt to 182 kt (red trace)
altitude initially continued to climb until 3,000 ft then reduced to 2,600 ft (green trace).
Over the next 6 seconds, the situation continued to deteriorate until the pilot reduced engine torque. At about that point, the airspeed had reached 210 kt and the altitude was down to 2,400 ft. The pilot recalled that the control forces eased somewhat following reduction of engine torque.
During the next 2 minutes, the pilot managed initially to raise the pitch attitude to 12 degrees, arrest the descent at 2,000 ft and climb to 2,700 ft, while reducing the airspeed to 125 kt. However, this was momentary as the pitch attitude cycled down to -3 degrees then back to 12 degrees with corresponding descent/climb and airspeed increase/decrease.
Figure 1: Indicative data plot showing key aircraft parameters before, during, and in the 2 minutes after the active phase (yellow band) of the pitch trim runaway.
Parameter scales not shown but are available in Figure 3.
Source: ATSB
Continuation of emergency condition and return to Merredin
By the end of that 2-minute sequence, the pilot was making a slow left turn to return to Merredin ALA and the master caution and pitch trim runaway warning activated for a short period (coincident with cancellation of the autopilot fail advisory). It is not clear from the pilot’s recollection why that occurred but it is consistent with the closing and reopening the pitch trim circuit breaker.
The pilot continued to experience severe control difficulties with another sequence of pitch attitude down to -7.5 degrees and back up to 8 degrees. The aircraft descended to a minimum altitude of 1,700 ft (400 ft above ground level) and reached a maximum airspeed of 180 kt (Figure 3).
After this sequence, the pilot decided that it was not possible to overpower the elevator force alone and requested the assistance of the doctor seated in the adjacent row. The doctor turned in the seat, reached into the cockpit, and pulled on the right control column. This had a positive effect on the variation of pitch attitude and associated airspeed and altitude parameters, although full control was not established.
At this point, the pilot continued with the Pitch Trim Runaway procedure from memory and sought to select the Trim Interrupt switch to INTR again and pulled the Alternate Trim circuit breaker. The pilot then pushed the Alternate Stab Trim switch intermittently, which appeared to have no effect in relieving elevator pressure. (At about this time the master caution and pitch trim runaway warning activated again for a short period, coincident with cancellation of the autopilot fail advisory and consistent with the closing then reopening the Pitch Trim circuit breaker).
As the aircraft was now in the Merredin circuit area, the pilot’s attention was on preparation for landing. When the flaps were selected to 15 degrees, the pilot noticed the ‘Flap’ caution on the crew alerting system (CAS) and realised the flaps were not available.
On the downwind circuit leg for runway 28, the pilot extended the landing gear. This was followed by a rapid descent from 2,150 ft to 1,650 ft (350 ft AGL) with a ground proximity warning system (GPWS) alert (Figure 2). In response, the pilot (with the doctor’s continuing assistance) pulled on the control column to raise the nose, and increased engine torque. Altitude was recovered to a maximum of 2,200 ft.
The pilot turned onto the base circuit leg and allowed the aircraft to descend. As the pilot turned onto the final approach, the aircraft overshot the runway centreline and required adjustment. On short final, the aircraft was high and the pilot was coordinating with the doctor to adjust the pitch attitude for landing. At one point, the pitch attitude was too high and activated the aural stall warning.
At about 30 ft above the runway, the pilot asked the doctor to let go of the control column and reduced engine torque to idle. The aircraft touched down firmly at 0017:15 and the pilot applied full reverse thrust and normal braking to bring the aircraft to a stop about 200 m from the end of the runway. The pilot taxied the aircraft to the parking area and shut down.
The RFDS operations centre dispatched an aircraft to Merredin to transfer the patient and RFDS personnel to Jandakot.
Figure 2: Aircraft track and vertical profile
Source: Google earth, annotated by ATSB
Post-occurrence examination and rectification
RFDS maintenance engineers travelled to Merredin to inspect the aircraft, download data, and remove the lightweight data recorder (LDR) for the ATSB. The engineers reported that the:
pitch trim was in the full nose-down position (leading edge of adjustable stabiliser fully up)
Trim Interrupt switch was selected to NORM
Flap Interrupt switch was selected to NORM
Pitch Trim circuit breaker was closed (pushed in)
Pitch Trim Alternate circuit breaker was open (pulled out)
other switches and circuit breakers were in normal positions.
The engineers secured a copy of the aircraft condition monitoring system (ACMS) and fault history database (FHDB) files for analysis by system technical specialists and provision to the ATSB. The LDR was removed and dispatched to the ATSB laboratory in Canberra where cockpit voice and flight data was recovered and analysed. A flight data plot for the complete flight follows as Figure 3.
When the aircraft was powered up, the Pitch Trim Runaway warning was immediately active. When the Trim Interrupt switch was selected to INTR, it cleared the warning and stopped the trim from operating. Based on the FHDB fault codes and continuing Pitch Trim Runaway warning, the technical specialists advised that the troubleshooting focused on the relays in the left relay panel.
RFDS maintenance engineers found that the manual pitch trim DOWN relay (identification number K161E2) had malfunctioned in a mode consistent with contacts that were stuck closed rather than being open (as would be expected with the coil de-energised). This relay was replaced and applicable operational and functional tests carried out with no further defects identified. The aircraft was certified as serviceable and flown back to Jandakot Airport without incident.
The ATSB notes that based on recorded data, for the last part of the occurrence flight, both the Pitch Trim circuit breaker and Pitch Trim Alternate circuit breaker remained open. Based on correlated parameters in the recorded data, the Pitch Trim circuit breaker was then closed when the aircraft was subsequently powered up on the ground by the pilot.
From other correlated parameters in the recorded data, the Trim Interrupt switch was not selected to INTR at any time during the flight.
Figure 3: Recorded data plot for complete flight showing the key parameters and active phase (yellow band) of the pitch trim runaway with start of doctor assistance (blue line).
The pilot held a commercial pilot licence with aeroplane category rating, an instrument rating with multi-engine aeroplane endorsement, and a Flight Instructor Rating. On application to RFDS in May 2018, the pilot’s total aeronautical experience was 1,587 hours. This included 1,370 hours as pilot in command, 384 hours multi-engine (Piper PA-31 Navajo and PA-34 Seneca), and 154 hours instrument flight time.
After joining RFDS in July 2018, the pilot received the specified training and assessment for a new pilot without prior PC-12 or similar aircraft type operating experience. This included:
Pilot induction training – including use of flight check system
Ground school - PC-12/47E (NG) Engineering Course
Human Factors and Non-Technical Skills Refresher Course
Flight training with flight review in PC-12/47E aircraft
Line Oriented Flight Training (medical transport flights with supervisory pilot)
Instrument Proficiency Check
Check-to-line assessment – passed in September 2018.
Training and check records indicate that the pilot progressed without any significant difficulties. The training/check pilot who approved the pilot for line operations recommended that, due to the pilot’s relatively low experience level, a follow-up check be conducted earlier than the required 6 months.
During the first three months of PC-12 operation as a line pilot, the pilot inadvertently exceeded an engine limit on take-off, and extended the landing gear above the maximum landing gear operating airspeed. RFDS investigated the landing gear exceedance and found that the pilot accepted an amended route, was then high on approach, and checked the airspeed, but did not recognise the high speed before extending the gear. As recommended, the pilot was debriefed/counselled with plans to simulate a similar scenario at the next check.
In February 2019, the RFDS Head of Training and Checking (HOTAC) conducted a Progress Check with the pilot during daylight in visual meteorological conditions. This included a pitch trim runaway scenario after take-off that required the pilot to carry out the emergency procedure. The HOTAC advised that the pilot’s response was in accordance with the Pilatus PC-12 Quick Reference Handbook (QRH). There was no record of a specific scenario similar to the landing gear exceedance. The overall assessment was satisfactory/competent and the pilot continued as a PC‑12 line pilot for the next two months until the occurrence.
At the time of the occurrence, the pilot’s total aeronautical experience was 2,108 hours including 521 hours on the PC-12/47E aircraft type. The pilot held a Class 1 medical certificate valid until February 2020.
Aircraft information
The PC-12/47E is a large single-engine turboprop pressurised aircraft designed and built by Pilatus Aircraft Ltd in Switzerland. This aircraft was manufactured as serial number 1411 in July 2013 and registered VH-OWJ in October 2013. At the time of the occurrence, the total time in service was recorded as 7,377 hours.
The aircraft was maintained by the CASA-approved RFDS maintenance organisation in accordance with an authorised system of maintenance based on the Pilatus Progressive Inspection Phases. At the time of the occurrence, a maintenance release[3] was in effect for the aircraft.
The most recent scheduled maintenance was a Progressive Mini Inspection completed on 28 March 2019 at 7,311 hours’ total time in service. This included a functional check of the Trim Interrupt switch, Alternate Stabiliser Trim switch and runaway aural warning system. No defects were recorded.
There were no significant deferred defects or line maintenance recorded before the occurrence. The pilot who operated the aircraft on the previous shift earlier that day did not record any issues with the aircraft.
PC-12 flight control systems
Pitch trim system
The primary flight controls—aileron, elevator and rudder—are actuated through a conventional system of push-pull rods and carbon steel cables. Each primary control is equipped with an electrically operated (DC) trim system to alleviate the variable aerodynamic loads transmitted by the control system. A visual indication of trim position is displayed to the pilot on the multi-function display (see Pitch trim runaway warnings).
For pitch trim (nose up/down, related to elevator control loads), the leading edge of the ‘T-tail’ horizontal stabiliser is moved up and down through a defined range by an actuator. This actuator contains two separate electric motors that operate independently according to three different control inputs. The ATSB developed a schematic diagram of the three pitch trim power circuits (Appendix A). Refer to Figure 4 for trim system features.
One of those trim motors—manual stabiliser trim motor—provides the primary means for the pilot or copilot to adjust the pitch trim. When the pilot selects the pilot trim engage switch and trim up/down switch on the control wheel simultaneously, the trim control circuit energises the up or down pitch trim relay.[4] That connects power from the Essential Bus and Pitch Trim circuit breaker through the applicable relay contacts to the manual stabiliser trim motor then circuit to earth via the de-energised relay.
In normal operation, trim movement will cease once the pilot releases the switches. However, in this occurrence, the pitch trim down relay stuck closed and continued to provide power to the manual stabiliser trim motor until the pitch trim circuit breaker was opened.
The other trim motor—alternate stabiliser trim motor—is utilised by either the autopilot or the alternate stabiliser trim switch (labelled as ‘Alternate Stab Trim’). When the autopilot is controlling the pitch trim, the auto drive circuit (from the Modular Avionics Unit) energises the up or down auto pitch trim relay in the Trim Adapter. That connects power from the Essential Bus and Pitch Trim circuit breaker through the respective relay contacts (and auto pitch trim engage relay) to the alternate stabiliser trim motor then circuit to earth via the relays.
The Alternate Stab Trim switch is located on the front centre console. When the autopilot is disengaged, selection of the switch to the nose up or down position provided power from the Main Bus and Pitch Trim Alternate circuit breaker (through the de‑energised auto pitch trim engage relay in the Trim Adapter) to the alternate stabiliser trim motor.
All of the trim power circuits (including rudder and aileron trim) were routed through a ‘Trim Interrupt’ switch located on the front centre console. When this switch was in the default position of NORM (normal), it closed the circuit between the various circuit breakers and related components in each system to allow normal operation. If this switch was selected to INTR (interrupt), it opened every trim power circuit simultaneously and prevented all trim operation until the switch was returned to NORM. (This switch was guarded with a clear perspex cover. All switch labels were backlit).
The ATSB highlights that although the autopilot trim system utilises the alternate stabiliser trim motor, it is powered from the same source as the manual trim system (Pitch Trim circuit breaker) rather than the power source for alternate stabiliser trim (Pitch Trim Alternate circuit breaker). This detail was not explicitly covered in the PC-12 Pilot’s Operating Handbook and Airplane Flight Manual (POH/AFM) and RFDS pilots advised they were not aware of that design characteristic. As discussed in Safety analysis, this had a subtle effect on training/checking practices and interpretation of the pitch trim runaway emergency procedure.
A representative of Honeywell Aerospace, the designer and provider of in-service support for the pitch trim system, advised the ATSB that there was no documented instance of a runaway attributed to the alternate stabiliser trim circuit (Appendix A – blue lines).
Figure 4: Pilatus PC-12/47E trim system features
Source: Pilatus and ATSB
Pitch trim runaway warnings
The pitch trim system monitored the power and control circuits for both trim motors and detected when there was power applied but no corresponding manual trim engagement, autopilot trim drive signals, or alternate stabiliser trim command. In any of those cases, the crew alerting system (CAS) produced the following effects:
master warning or caution light illuminated
‘Trim Runaway’ aural alert
‘Pitch Trim Runaway’ message displayed in the CAS window of the systems multi-function display (Figure 5).
Once the master warning or caution is acknowledged, the aural alert is cancelled but the message continues to display while the out-of-limit condition such as a trim runaway is operative. In the case of a malfunctioning relay in the manual trim system (such as this occurrence), the message will disappear if any of the following actions are carried out:
Manual trim engage switch on control wheel is activated
Trim Interrupt switch is selected to INTR
Pitch Trim circuit breaker is pulled open.
The ATSB notes that conditions 2 and 3 will cancel the message and stop a related runaway but condition 1 will only cancel the message without any effect on a runaway condition. The recorded data showed that the pitch trim runaway warning was cancelled and reactivated three times in the 32-second period after the initial warning. This was consistent with the pilot attempting to use the manual trim, which was ineffective in resolving the runaway.
Figure 5: Sample multi-function display showing acknowledged CAS messages
Source: Pilatus
Wing flaps
The wing flap system is electrically actuated and controlled by a selector handle on the centre console to the right of the engine control quadrant. Located forward of the flap selector handle is a Flap Interrupt switch (Figure 4) that disables normal operation of the flap system and generates a ‘Flap’ caution message on the CAS if the switch is selected to INTR. Irrespective of subsequent switch selections, the flaps will not operate until reset on the ground.
In this occurrence, there was evidence from flight data of power being removed from the flap system at the beginning of the initial 16-second trim runaway event, consistent with the operation of the Flap Interrupt switch (see Figure 3 - dark blue trace coded as Flap Controller Fail).
Pilatus advised the ATSB that the Flap Interrupt switch was utilised in the original PC-12 wing flap design as part of the alternate flap switch circuit that allowed the pilot to correct a flap asymmetry. In the PC‑12/47E model, there is no pilot access to the alternate flap switch and no requirement for the pilot to operate the remaining Flap Interrupt switch.
The ATSB notes that, as can be seen in Figure 4 (bottom right), the Flap Interrupt switch and Trim Interrupt switch appear to be the same type of switch and are located on the same panel, either side of the Alternate Stab Trim switch (refer to the following Safety analysis section).
Aircraft operating procedures – Pilatus
Pilot’s Operating Handbook and Quick Reference Handbook
The primary reference for operation of the PC-12/47E is the Pilot’s Operating Handbook and EASA Approved Airplane Flight Manual (POH/AFM) produced by Pilatus. In Section 3 Emergency Procedures, the general comments include the following guidance:
Some situations require rapid action, leaving little time to consult the emergency procedures. Prior knowledge of these procedures and a good understanding of the aircraft system is a prerequisite for safe aircraft handling.
The emergency procedures included a sequential list of action items in case of a pitch trim runaway. These procedures were also presented in the Quick Reference Handbook Emergency Procedures (QRH) booklet produced by Pilatus and available in the cockpit for the pilot to consult as required and as circumstances permitted (Figure 6).
Pilots could also select this procedure as one of the electronic emergency checklists on the multi-function display. This operation required a number of button pushes to select the checklist and scroll through the items. RFDS did not advocate use of this feature and that practice was not a factor in this occurrence.
Pilatus advised that if item 1 of the procedure was carried out immediately following a pitch trim runway warning, the control forces would be acceptable and the pilot would be able to perform the subsequent actions without acute stress.
The ATSB noted that in the scenario where items 1-3 would neutralise a pitch trim runaway condition, the subsequent control forces experienced by the pilot could be uncomfortably high due to timing of the trim interrupt or changes to phase of flight and/or aircraft configuration. If that occurs, the pilot can only adjust pitch trim using the alternate stabiliser trim. The procedure, however, did not communicate that clearly and specified alternate stabiliser trim as item 8.
It should also be noted that item 8 will not be effective if the complete procedure is actioned in numerical sequence. In that case, action in accordance with item 5 to open the Pitch Trim Alternate circuit breaker disconnects power from the alternate stabiliser pitch trim circuit. As the pilot in this occurrence found, any subsequent attempts to use the alternate stabiliser trim switch in accordance with item 8 will be futile.
Supplementary information
In February 2017, Pilatus issued Safety Information Letter (SIL) 003 to all customers, operators and service centres as an ‘Important reminder of procedures and operations of PC-12 (all models) when encountering a trim runaway condition.’ For reference, a copy of this letter is at Appendix B.
Some points from the letter that are relevant to this occurrence:
In the case of a trim runaway condition, as an immediate action, activate the guarded “Trim Interrupt” switch (refer to POH Section 3).
Hands-on training reduces the activation time and minimizes the risk of erroneously activating the “Flaps Interrupt” system switch (which cannot be reset in-flight).
By pulling its associated Circuit Breaker (CB), the affected trim motor will be isolated before the pilot can attempt to regain control of the unaffected systems (refer to POH Section 3).
To regain control of the unaffected systems, simply reposition the “Trim Interrupt” switch to NORM (refer to POH Section 3).
A reduction in airspeed will significantly reduce the existing out-of-trim forces and will help the pilot regain full control of the aircraft (refer to POH Section 3).
The PC-12 trim system is designed to assure that the pilot does not have to counteract continuous or excessive control forces after encountering a trim runaway. In case of a runaway on one of the pitch trim motors, the remaining one can be used to regain normal control forces.
Pilatus advised the ATSB that RFDS confirmed receipt of the transmittal notice for SIL-003 on 7 March 2017. Since then, the SIL has been listed as one of the additional technical information items on the Pilatus document portal accessible to RFDS. Pilatus noted that the SIL is also publically available on their website.
The ATSB notes that RFDS did not have a record of having received or formally considered the operational implications of this letter. One of the training/check pilots recalled the letter and advised that RFDS incorporated the pitch trim runaway response from the QRH into check flights. The content of the letter and potential effect in this occurrence is considered in the following Safety analysis section.
Normal procedures
As part of the POH/AFM Normal Procedures section, the daily Pre Flight checklist included items to confirm that the Trim Interrupt and Flap Interrupt switches were in the NORM/GUARDED positions. These were visual checks that did not involve operation of the switches. RFDS normal procedures were consistent with the POH/AFM.
For PC-12 aircraft operated under Transport Canada airworthiness approval, Pilatus specified a daily check of the pitch trim interrupt system in the ‘Before Starting Engine Procedure’. This originated in 1997 as part of the aircraft certification review process by Transport Canada. Transport Canada considered that the trim interrupt system was the sole means of disconnection for an uncommanded runaway and the system failure analysis did not take into account all of the factors. Pilatus responded by including a periodic check of the trim interrupt function in airworthiness limitations and integrating the daily check into the Canadian-specific POH/AFM.
Aircraft operating procedures – RFDS
The RFDS Operations Manual specified general aircraft operating procedures and PC-12 operating procedures. As a general principle, RFDS required pilots to comply with all requirements, instructions, procedures, or limitations in the applicable POH/AFM and QRH.
In an emergency, pilots were required to action the defined recall items from memory and then refer to the appropriate written procedures for confirmation. The subsequent actions were then to be actioned/confirmed as necessary and any notes/warnings reviewed. It was acknowledged that in some circumstances, pilots might need to continue subsequent actions from memory.
The pilot advised that the physical demands of counteracting the serious out-of-trim condition did not allow for review of the procedure in the QRH booklet. In context, this was an unavoidable constraint of single-pilot operation and was not considered to be a factor in the occurrence.
From March 2019 onwards, the RFDS PC-12 operating procedures nominated the first four items of the Pitch Trim Runaway procedure as recall items. These items were recorded in the operations manual and were the same as the POH/AFM and QRH except for item 3 which incorporated a conditional phrase:
3. TRIM INTERRUPT switch if trim runaway continues … NORM
In the POH/AFM and QRH, this conditional followed item 3 and applied to item 4 onwards rather than item 3.
Item 3, as presented by RFDS, could be interpreted to mean that the power to the trim systems was only to be reinstated if the trim runaway continued. However, the trim runaway could not continue without the reinstatement of power through the Trim Interrupt switch (and almost certainly the Pitch Trim circuit breaker), so the phrasing was nonsensical. In the context that the trim interrupt remained in NORM, and the POH/AFM/QRH procedures were primary references, it is unlikely that the procedural inconsistency had any effect on this occurrence.
RFDS advised that the recall items for emergency procedures had recently been added to their PC-12 operating procedures as an update to reflect current practices. They were aware that the RFDS pitch trim runaway procedures varied from the POH/AFM and QRH as a result of inaccurate transcription but this had not been communicated to pilots. This was corrected after the occurrence.
Pilot training and checking – RFDS
Training and checking framework
RFDS held a Civil Aviation Safety Regulation (CASR) Part 141 certificate and operated a CASA‑approved Training and Checking organisation under Civil Aviation Regulation (CAR) 217. The Part 141 certificate authorised RFDS to conduct the required class rating flight training and flight review to qualify pilots for the PC-12 aircraft type. (RFDS referred to this as conversion training.) The CAR 217 approval authorised RFDS to conduct recurrent training and checking including regular operator proficiency checks (OPCs).
The first stage of the RFDS PC-12/47E ‘conversion training’ was a 6-day ground school facilitated by an experienced PC-12 instructor in accordance with a Facilitators Guide. Reference material included the POH/AFM, QRH, engineering training manual, PowerPoint presentations, videos, cockpit mock-up, components, and an aircraft. Information about the pitch trim system was available from the POH/AFM and a guided inspection of an aircraft. Learning assessments were carried out during and at the end of the course.
The second stage of PC-12/47E conversion training was flight training in the aircraft in accordance with a flight training syllabus. This was usually carried out over 5 flights and approximately 12 flight hours. The syllabus included review of CAS warnings/cautions such as Pitch Trim Runaway and use of the QRH. A flight review was incorporated into this training.
Following conversion training, pilots completed 50-100 hours of line oriented flight training (LOFT) with a training/check pilot or supervisory pilot in the aircraft. RFDS specified a number of competency items and discussion topics to be covered during LOFT. These did not specifically include Pitch Trim Runaway.
When pilots had completed all of the LOFT elements and were considered ready, a check pilot conducted a check-to-line assessment consisting of at least two sectors, one night sector, and a minimum of two instrument approaches. RFDS specified a number of elements to be assessed during normal operation and some emergency/abnormal scenarios. These did not include Pitch Trim Runaway.
Once a pilot was checked to line, recurrent checking consisted of two checks in any 365-day period. One of those checks was an instrument proficiency checks (IPC) to satisfy the regulatory requirements of CASR Part 61. The alternate check was an OPC that consisted of a technical quiz and flight sequences to assess pilot response to at least four emergency scenarios. In addition, an annual line check was carried out to allow assessment of a medical flight sector.
Training and checking practices – pitch trim runaway
In the RFDS training and checking framework, it was a requirement that the emergency procedures in the QRH were addressed during PC-12 conversion training, check-to-line, OPC, and as required for IPC. RFDS identified six critical manoeuvres with an increased level of threat (such as emergency descent and engine failure after take-off) that required specific assessment during OPCs. Other emergencies, such as Pitch Trim Runaway, could be addressed in an OPC at the discretion of the check pilot.
Pilatus did not recommend a method for in-flight practice of Pitch Trim Runaway, other than the guidance provided in Safety Information Letter SIL-003 that there was a benefit to hands-on training for correct operation of the Trim Interrupt switch. Although RFDS specified techniques for their training/check pilots to use in simulating some emergencies such as engine failures, there was no documented method for pitch trim runaways. The ATSB derived information about practices from interviews with RFDS training/check pilots including those involved in the pilot’s training and checking.
It was not possible to replicate a pitch trim runaway in a serviceable aircraft nor would that be desirable in-flight. As such, it was common practice for RFDS training/check pilots to introduce a pitch trim runaway scenario by annunciating the warning callout ‘Trim Runaway’ and advising of the associated CAS warning message. The physical effects might be described by the training/check pilot, or represented either by using the alternate stab/manual trim to provide trim input or by application of a progressive force to the control column.
Training/check pilots expected pilots to respond by recalling and following the Pitch Trim Runaway procedure, starting with item 1 - identification of the Trim Interrupt switch. There was variation as to whether the switch was actually selected to INTR or whether this action was indicated in accordance with the touch drill principle. At this point, the training/check pilot would generally stop trim inputs or release force on the control column, as the case might be. The ATSB notes that trim interruption will stop trim inputs but will not alleviate control forces developed to that point.
If the training/check pilot initiated the pitch trim runaway on final approach, the likely outcome was a landing without a requirement for further actions from the emergency procedure. In all other situations, training/check pilots would expect that the pilot would proceed with further items of the procedure. For actions involving circuit breakers (items 2, 5, 6), it was a general principle that these were not pulled opened during practice of emergencies to prevent inducing problems in electrical systems. As such, the circuit breaker action items would be effected through touch drills or referenced by the pilot in discussion with the check pilot.
Although the end-point of a pitch trim runaway scenario was not defined and could vary according to the operational context, it was common for check pilots to facilitate the exercise so the complete procedure was addressed. This was consistent with a general misunderstanding in RFDS that the autopilot trim was powered through the Pitch Trim Alternate circuit breaker (rather than Pitch Trim circuit breaker). Consequently, it was perceived that items 4 onwards of the emergency procedure (Figure 6) may be required to address a malfunction in the autopilot trim system. On completion of the procedure, the check pilot could restore normal trim operation or might advise the pilot to use the alternate stab trim for trim operation during the next phase of flight.
In assessing pilot response to a pitch trim runaway scenario, training/check pilots were focussed on pilot recall of the QRH emergency procedure items and correct identification/confirmation of the applicable switches and circuit breakers. The representation of pitch trim runaway and effects of indicative actions did not consistently reflect actual behaviour of an aircraft during such an emergency.
The pilot of this occurrence expected that the control problems would be rectified when the Trim Interrupt switch was selected to INTR. If the pilot had promptly made that selection as intended, the control loads would have been manageable but the loads would not have been alleviated.
Following the occurrence, RFDS training/check pilots noted that the power control lever could obscure the Trim Interrupt switch when the lever was in the maximum position (used for take-off and initial climb). The ATSB confirmed that this was the case if the pilot’s seat was adjusted to provide a standardised field of vision with reference to the visual alignment device.
Pitch trim runaway occurrences
RFDS Western Operations
RFDS advised of seven pitch trim runaway events involving their PC-12 aircraft, including this occurrence. The ATSB requested data about these events and compiled the following table. For context, please note that all of the aircraft were PC-12/47E NG models and each of the events involved different registrations.
Table 1: RFDS Western Operations Pilatus PC-12/47E pitch trim runaway events
Ref
Occurrence date
Aircraft hours
Occurrence description
Fault
1.
10 June 2013
N/A
Single pilot operation – Day.
On approach at 500 ft, pitch trim runaway nose-up.
QRH recall items including Trim Interrupt carried out.
Nil use of Alternate Stab Trim. Reported use of manual trim.
Missed approach, normal landing.
Manual trim relay.
2.
5 May 2015
7,631
Two pilot (LOFT) operation - Day.
On approach at 300 ft, pitch trim runaway nose-up.
QRH first recall item – Trim Interrupt only carried out (due context).
Nil use of Alternate Stab Trim – not applicable.
Normal landing.
Manual trim relay.
3.
17 February 2017
3,821
Single pilot operation - Day.
On final approach, pitch trim runaway nose-down.
QRH recall items including Trim Interrupt carried out.
Alternate Stab Trim switch used to adjust trim.
Normal landing.
Manual trim relay.
4.
22 August 2018
11,912
Two pilot (LOFT) operation - Day.
On downwind approach, pitch trim runaway nose-up.
QRH recall items including Trim Interrupt carried out.
Nil use of Alternate Stab Trim.
Normal landing.
Trim adaptor (autopilot related).
5.
19 January 2019
3,431
Single pilot – Day.
On descent with autopilot on, pitch trim runaway.
QRH recall items including Trim Interrupt carried out plus Pitch Trim – Alternate circuit breaker pulled.
Nil use of Alternate Stab Trim.
Diversion and normal landing.
Trim adaptor (autopilot related).
6.
14 April 2019
(occurrence)
7,377
Single pilot – Night.
After take-off, pitch trim runaway nose-down.
QRH recall items carried out but Trim Interrupt mis-selected. Control difficulties. Further items.
Nil use of Alternate Stab Trim.
Return for flapless landing with control difficulties.
Manual trim relay.
7.
3 August 2019
(post occurrence)
12,272
Two pilot (LOFT) operation - Day
After take-off, pitch trim runaway nose-down.
Recall items including Trim Interrupt carried out.
Alternate Stab Trim switch used to adjust trim.
Return for normal landing.
Manual trim relay.
The ATSB reviewed the occurrence descriptions and maintenance records for the five pitch runaway events recorded before the occurrence, and interviewed the pilots involved except for one trainee pilot who was no longer with RFDS.
In one of those events (Ref. 2), the aircraft was on short final and the pilot operating under supervision carried out item 1 of the procedure then landed the aircraft. The training/check pilot advised the ATSB that the aircraft was controllable and there was no requirement or time to action further items of the procedure before landing.
In another event (Ref. 3), the pilot was on approach and the pilot actioned the recall items followed by appropriate use of the Alternate Stab Trim switch. The pilot advised the ATSB that knowledge of the system was gained from RFDS training/checking and from self-study.
In the other three events (Ref. 1, 4, 5), the same pilot was involved as pilot in command including one event under supervision of a training pilot. The pilot involved in the three events had joined RFDS in 2012. Prior to that, the pilot was employed as a corporate jet pilot for 3 years. In 2019, the pilot’s total experience was 11,900 hours including 3,000 hours on the PC-12. These three events are noteworthy in that the Alternate Stab Trim switch was the only means available to adjust trim but was not utilised following the recall items, and there were anomalies in the pilot in command’s technical understanding of the events and pitch trim system.
The pilot response to the first pitch trim runaway was consistent with the recall items of the procedure but the pilot did not realise that manual trim was consequently inoperative and was not aware that the Alternate Stab Trim could be used for trimming. In response to the two other events, the pilot continued the emergency procedure beyond the recall items and in at least one case pulled the Pitch Trim Alternate circuit breaker. That was not consistent with the recorded fault and it is not clear if and how the pilot trimmed the aircraft as reported.
RFDS Central Operations
The ATSB requested pitch trim runaway occurrence data from RFDS Central Operations (RFDSCO), as another operator of similar PC-12 aircraft. RFDSCO advised that there was no record of any verified pitch trim runaway events involving their PC-12 aircraft in the 9 years prior to the occurrence that such data had been recorded. For context, RFDSCO operate a mix of PC-12/47E NG aircraft and earlier series aircraft.
ATSB database
The ATSB conducted a search of the occurrence database for pitch trim runaway events involving the PC-12 aircraft type and a comparative aircraft type, the Beechcraft/Raytheon/Textron King Air. Apart from this occurrence, no pitch runaway events for either type were recorded in the ATSB database.
As reported in a previous section, RFDS identified six other pitch trim runaways involving their PC‑12 aircraft. These were not reported to the ATSB.
In response to a query from the ATSB, RFDS advised that the other pitch trim runaways were considered to be routine defects and handled via the incident reporting and/or maintenance reporting systems. Each of the events recorded in the incident reporting system were reviewed by the Head of Flying Operations and considered to have been handled appropriately.
The Transport Safety Regulations 2003 stipulate reporting of certain events to the ATSB. For a non-air transport operation such as RFDS, the use of any procedure for overcoming an emergency was prescribed as a routine reportable matter. The ATSB considered that a pitch trim runaway required a pilot to action the applicable emergency procedure and was therefore a routine reportable matter.
Pilatus records
At the request of the ATSB, Pilatus provided pitch trim runaway occurrence data for the PC-12 aircraft type. Pilatus recorded 56 pitch trim runaway events world-wide between 1999 and 2019. These occurred in all phases of flight and included at least 45 events involving the PC-12/47E model.
In 47 of the pitch trim runaway events, the recorded maintenance action was replacement of one or both of the manual trim relays or the (autopilot-related) trim adapter unit. None of the recorded maintenance actions were applicable to the alternate stabiliser trim circuit.
The amount of detail in the event descriptions varied and some did not provide information about pilot actions. For 10 events, there was recorded alternate stab trim use by the pilot and for three events, the pilot reported having insufficient time to action the emergency procedure before landing. In one event, the pilot tried to use the alternate stab trim but it did not operate.
Where pilot action was reported, it was common for the Trim Interrupt switch to be selected with associated stopping of the pitch trim runaway. There were no reports of pilot mis-selecting the Flap Interrupt switch instead of the Trim Interrupt switch.
Instructions for Continuing Airworthiness – Pilatus
As the aircraft manufacturer and type certificate holder, Pilatus produced specifications and instructions for continued airworthiness of the PC-12 aircraft type. Those instructions included periodic functional checks of the pitch trim system and procedures for troubleshooting and component replacement. Up to the month before the occurrence, there were no specific maintenance requirements for the manual trim system relays or trim adapter unit. As such, the relays remained in service ‘on‑condition’ until a defect was detected.
In March 2019, Pilatus issued Service Bulletin SB 27-024 to provide for replacement of the trim adapter unit that used electro-mechanical relays (auto pitch trim) with a unit that uses solid-state relays. At the time of the occurrence, Pilatus had prepared Service Bulletin SB 27-023 to provide for replacement of the two electro-mechanical relays in the manual pitch trim system with one solid-state relay. This was not issued until March 2020 due to limited parts availability.
Pilatus advised that the two Service Bulletins were developed to address a known reliability issue with the electro-mechanical relays. Due to frequent switching at their load limits, the relay contacts had a decreased operational life of approximately 25,000 cycles.
Examination of PC-12 pitch trim system relays
The electro-mechanical relays used in the PC-12 pitch trim system were a two-pole, double-throw design. Each pole consisted of a common terminal that was switched between a normally open contact and a normally closed contact. For this installation, only one pole was utilised.
Defective relay removed from VH-OWJ
The ATSB examined the manual pitch trim DOWN relay (identification number K161E2) removed from VH-OWJ to characterise the failure mode and assess the implications for continuing airworthiness. A visual inspection of the relay did not identify any anomalies (Figure 7). The markings were consistent with the specifications.
To record the internal configuration of the relay, the ATSB arranged for an x-ray before the relay was altered (Figure 8). This showed that for both poles of the relay, the normally open contacts were closed and the normally closed contacts were open. Electrical continuity checks of the pins were consistent with that anomalous configuration.
The ATSB detached the casing from the base of the relay to examine the internal mechanism (Figure 9). A visual inspection of the mechanism confirmed the anomalous configuration of the contacts and revealed the failure type for the normally open contacts.
For the relay pole connected to the pitch trim circuit (active), the normally open contact was melted and fused close. There was sooting on surfaces near the contacts and black contaminant from the black caps that covered the contacts. Beads of gold-coloured metallic material was observed on surfaces near the contacts. As a result of the fused contact, the other contacts were fixed in anomalous positions.
The relay manufacturer advised the ATSB that the condition of the contacts was consistent with a significant high-energy event that occurred while the relay was energised. The melting and welding of the contacts without circuit breaker activation is indicative of a short-duration high-current event such as a lightning strike. It was not possible for the manufacturer to determine the root cause of the relay failure.
Figure 7: External condition of defective relay
Source: ATSB
Figure 8: X-ray of defective relay showing anomalous configuration of the contacts (circled).
Source: ATSB
Figure 9: Opposite end views of relay mechanism showing the two sets of anomalous contact conditions
Source: ATSB
Other relay removed from VH-OWJ
The ATSB obtained and examined the manual pitch trim UP relay (identification number K161D2) from VH-OWJ. This relay was installed in the aircraft at the time of the occurrence and was functioning normally at the time of removal.
A visual inspection of the relay did not identify any anomalies and the markings were consistent with the specifications. The ATSB detached the casing from the base of the relay to examine the internal mechanism.
The active normally-closed contacts showed a localised build-up of metallic material on one contact surface (pimple-shaped) with corresponding loss of material from the other surface. This was consistent with electrical arcing.
Defective relay from other PC-12
The ATSB obtained and examined the manual pitch trim DOWN relay (identification number K161E2) from the RFDS aircraft that sustained a trim runaway on 3 August 2019 (Table 1, item 7).
A visual inspection of the relays did not identify any anomalies and the markings were consistent with the specifications. The ATSB detached the casing from the base of the relay to examine the internal mechanism.
The internal condition of the relay was similar to the defective relay from VH-OWJ. The active normally-open contact was melted and fused close. There was sooting on surfaces near the contacts and beads of gold-coloured metallic material was observed on surfaces near the contacts. As a result of the fused contact, the other contacts were fixed in anomalous positions.
The active normally-closed contacts showed localised material transfer that was similar to that observed to contacts in the manual pitch trim UP relay from VH-OWJ.
PC-12 Pitch trim defect reports
The ATSB provided details of the relay examination and analysis to CASA. They conducted a search of the CASA Defect Reporting Service (DRS) database for reports of defects in the PC-12 autopilot and flight control systems. This identified a number of reports including one report of a faulty pitch trim adapter (to a non-RFDS aircraft). No reports of manual pitch trim relay defects were identified.
For aircraft maintained under the Civil Aviation Regulations, it was a requirement that major defects be reported to CASA immediately. This included defects that caused, or that could cause, a control system failure. The list of examples published by CASA included serious malfunction of flight controls without specifying any types.
CASA uses defect reports as a means of identifying trends in design and maintenance reliability for the benefit of aviation safety. Reports are collected by CASA and maintained in a database. It is of benefit to both CASA and the aviation industry that the database contains accurate and relevant information. From this database, information may be:
obtained to provide reliability statistics and trend monitoring of aircraft, engines, propellers, systems and components - CASA shares this information with other regulatory authorities
used as a basis for development or review of an Airworthiness Directive (AD)
used for the development of other advisory publications, such as Airworthiness Bulletins
used for other appropriate regulatory purposes.
RFDS advised that no defect reports were submitted to CASA in relation to the malfunctions that resulted in pitch trim runaway events. This practice was based on the definition of a major defect as that which affects the safety of an aircraft or cause the aircraft to become a danger to persons or property. As there were secondary systems to manage a pitch trim runaway, RFDS did not consider the associated malfunctions to be major defects.
The ATSB was unable to establish if relay malfunction with pitch trim runaway was classified as a major defect as described in the Civil Aviation Regulations. Nevertheless, operators are encouraged to submit reports of PC-12 pitch trim defects to the DRS to facilitate CASA monitoring of continuing airworthiness data. __________
In the early stages of a medical transport flight, the pilot was confronted with a pitch trim runaway emergency condition. Despite pilot actions intended to stop the runaway, the runaway was not interrupted and the pilot struggled to control the aircraft for the rest of the flight. The pilot made a good decision to enlist the assistance of the doctor and managed to coordinate their inputs to land the aircraft.
The pilot was qualified to conduct the flight and had about 7 months experience of similar operations in the PC-12 type. This patient transfer from Merredin was not a high priority flight and the aircraft was serviceable for the departure. Although the pilot was on a night shift and the take-off from Merredin was just after midnight, there were no indications of fatigue.
The safety analysis following seeks to explain how the event developed and identify the important safety considerations.
Technical failure and warnings
During normal operation of the PC-12 aircraft with the autopilot off, the pilot seeks to minimise control wheel forces by intermittently selecting the engagement switch in conjunction with the up/down switch on the control wheel. These actions energise the applicable relay and power the trim motor to move the horizontal stabiliser as directed. When the pilot releases the switches, the control circuit de‑energises the applicable relay with the usual effect of opening the power circuit to the manual trim motor and stopping trim movement.
Soon after take-off from Merredin, the pitch trim system continued to operate in a nose-down direction without pilot input or autopilot commands because of a malfunctioning relay in the manual (main pilot‑engaged) stabiliser trim system. The trim system immediately detected a pitch trim runaway and triggered the applicable Crew Alerting System (CAS) warnings.
The Master Warning, ‘Trim Runaway’ callout, and the Pitch Trim Runaway message on the Multi-function Display (MFD) provided an effective alert as to the nature of the emergency and correlated with the anomalous control forces experienced by the pilot. In this fully electric trim system (no trim wheel), the other indication available to the pilot was the trim indicator on the MFD.
As was typical for aircraft such as the PC-12, the CAS warnings did not specify the malfunctioning circuit/components or the required actions. In such cases, the pilot is required to action the applicable emergency procedure to stop the runaway, identify the affected circuit, disable the affected circuit, and utilise the unaffected circuit to make any required trim adjustments.
Initial pilot response
In response to the CAS warnings, the pilot sought to carry out the first recall item of the Pitch Trim Runaway emergency procedure by selecting the Trim Interrupt switch to INTR (interrupt). The pilot managed to action this item about 6 seconds after the warnings activated. However, recorded flight data shows that the pilot inadvertently selected the Flap Interrupt switch to INTR rather than the Trim Interrupt switch and did not identify the mis-selection.
Common aviation operational practice, also advocated by RFDS, involves an ‘identify-confirm-action’ process to minimise the inadvertent selection of wrong switches and buttons. In that context, the ATSB considered the following factors that might have influenced the pilot to mis‑select the interrupt switch:
emergency flight control condition at low altitude on dark night
visibility of the Trim Interrupt switch and label
similar location and appearance of the two interrupt switches
lack of familiarity with operating the Trim Interrupt switch during training/checking.
In the situation where there is sudden onset of an emergency condition affecting control forces at low altitude on a dark night, it is natural for the pilot to feel a sense of concern and urgency. This might have been heightened by unfamiliarity with the scenario that could not be realistically simulated in the aircraft. As such, it would be expected that the pilot would be experiencing some level of stress.
As the trim runaway progressed, the pilot’s attention was primarily focussed on controlling the aircraft and counteracting the developing pitch-down forces with both hands on the control wheel. Given the pilot reported that any hand movements from the control wheel were quick, it is likely that the pilot allocated a low level of attention to identifying and confirming the appropriate interrupt switch.
During take-off and initial climb the power lever was in a forward position. In a pilot’s normal field of view, the power lever obscured the Trim Interrupt switch but not the Flap Interrupt switch. This rendered the Flap Interrupt switch as relatively more accessible and in the circumstances, at higher risk of being mis-selected. At the same time, the cockpit lighting was dimmed for the dark‑night take-off in accordance with standard practice and that unavoidably reduced the readability of the backlit switch labels.
The Trim Interrupt switch and Flap Interrupt switches were both located in the centre console and appeared to be the same type of switch with a similar function (Figure 4 bottom right). Although the switches were differentiated by being located either side of the Alternate Stab Trim switch, and the Flap Interrupt switch was located forward of the Flap Selector Handle, the similarities increased the risk of mis‑selection.
Training and checking practices were generally oriented towards touch drills and it was unlikely that the pilot was familiar with physical operation of the Trim Interrupt switch. Given the Pilatus advice that hands-on training minimises the risk of erroneously activating the Flap Interrupt switch, it is likely that a higher level of familiarity would have assisted the pilot.
The ATSB considered the contextual factors to identify those that increased risk and might have contributed to the occurrence. Although the operating environment and visibility of the trim interrupt switch increased the degree of difficulty for the pilot, those elements are generally unavoidable and were not considered to be safety factors. The risk associated with the other two factors —interrupt switch similarities and RFDS training/checking practices—is discussed in the following section.
Following inadvertent selection of the Flap Interrupt switch, there were indications that the results were contrary to the pilot’s intention—the pitch trim continued to operate and the runaway warning message remained on the CAS display. Later, the pilot also noticed the ‘Flap’ caution message in association with attempted flap extension. However, the pilot did not associate those indications with the mis-selection.
One of the reasons for this was the surprise and confusion resulting from non-alleviation of the control forces in response to the attempted trim interrupt. That was a natural response that was probably influenced by the inconsistent representation of trim interrupt effects in training/checking. The pilot experienced a high level of stress that adversely affected the pilot’s ability to carry out the next item immediately (which would have stopped the runway) and to problem-solve.
Research has confirmed common-sense understanding that situations involving acute stress, such as an out-of-control aircraft, are particularly harmful to higher order cognitive processes, such as decision-making (Dismukes, Goldsmith and Kochan, 2015). Acute stress impairs decision-making, leading to the consideration of fewer options and an increased tendency to make biased decisions. Attention becomes difficult to control, and tends to be easily distracted by alarms and other threatening signals. Anxious thoughts interfere with the resources needed to understand and resolve the emergency situation.
A potentially complicating factor in the pilot’s response was the momentary cancellation and recycling of the CAS warnings from pilot use of the manual trim switches. This characteristic was only evident because of the unsuccessful trim interrupt and was a subtle indication that manual trim was the affected circuit that had not been de-powered. The pilot was not expected to have that level of implicit systems knowledge and did not consider the possibility of switch mis-selection. In that case, the unexpected aircraft behaviour was confusing and treated as a symptom of the underlying technical problem.
As a consequence of the Trim Interrupt remaining in NORM (normal) due to the inadvertent selection of the Flap Interrupt switch, and the Pitch Trim circuit breaker initially remaining closed, power continued to be supplied through the malfunctioning relay to the manual stabiliser trim motor. The pitch trim reached the full nose down position 16 seconds after the runaway started. This created serious control difficulty for the pilot, which was exacerbated by the increasing airspeed.
Airspeed management
From the start of the pitch trim runaway, as the manual trim motor moved the horizontal stabiliser to a higher angle, the stabiliser produced progressively more lift that translated to nose-down force. The pilot was physically unable to fully counteract that force with the control wheel and the aircraft nose lowered. In the consequent descent, the airspeed increased with an associated increase in stabiliser lift and nose-down force. The pilot found this harder to counteract and the aircraft nose lowered further. This was a reinforcing cycle that reoccurred during the sequence relative to the counteracting effort applied to the controls.
In addition, when the pitch trim runaway began, the power lever was in the maximum engine torque position specified for take-off and initial climb. It remained in that position for the next 22 seconds and was a significant contributor to the initial airspeed increase. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.
The Pitch Trim Runaway procedure included a note after item 7 advising pilots to reduce speed if the control forces are high. In the circumstances, the most effective means to reduce airspeed was to reduce engine torque.
The ATSB considered that the time taken by the pilot to reduce engine torque after the pitch trim runaway warning was associated with the pilot’s cognitive and physical workload as discussed in the previous section. It is likely that the pilot was prioritising aircraft control and conduct of emergency procedures, and did not perceive an immediate need to reduce engine torque. In addition, as the trim runaway developed, it became more difficult to remove a hand from the control wheel to adjust the power lever.
For flight control emergencies such as out-of-trim conditions, there is an imperative to maintain control while resolving the technical problem. A critical factor for pilots to consider is control of airspeed and associated engine power.
Continuation of emergency procedure
As control loads allowed, the pilot managed to carry out item 2 of the emergency procedure by opening the Pitch Trim circuit breaker. This de-powered the circuit with the malfunctioning relay and manual actuator motor so that the fault condition was effectively neutralised. As the trim had already run to full nose down (due to not stopping when the pilot selected the wrong interrupt switch), the only indication that this action had been successful was removal of the CAS message from the MFD.
The pilot then sought to carry out item 3 of the procedure to return the Trim Interrupt switch to NORM. It is assumed that the pilot returned the Flap Interrupt switch to NORM instead of the Trim Interrupt, consistent with earlier mis-selection of the Flap Interrupt switch. This did not have any further effect as the Trim Interrupt switch remained in NORM throughout the flight and the wing flaps remained inoperative irrespective of subsequent switch selections.
At this point, the pilot was required to make a decision according to the status of the trim runaway. With the fault condition neutralised and power available to the operable trim circuits, the pilot could have adjusted the pitch trim using the Alternate Stab Trim switch and regained full control of the aircraft. That would have been consistent with the intent of the procedure, although it was listed as item 8 in the procedure. However, the pilot did not use the alternate stab trim and decided to proceed with further items of the procedure, consistent with the condition ‘If trim runaway continues’.
The pilot opened the Pitch Trim Alternate circuit breaker as per item 5 and closed the Pitch Trim circuit breaker as per item 6. This had dual adverse effects. First, power was removed from the operative alternate trim system and second, power was restored to the malfunctioning relay and manual trim motor for a short period. (This reactivated the warnings and prompted re-opening of the Pitch Trim circuit breaker.) As a consequence of opening the Pitch Trim Alternate circuit breaker (item 5), when the pilot tried to use the Alternate Stab Trim as per item 8 of the procedure, the circuit was inoperative and this did not have any effect.
While maintaining partial control of the aircraft in difficult circumstances, the pilot managed to neutralise the malfunctioning relay in the early stages of the sequence. However, the pilot missed a critical opportunity to use the Alternate Stab Trim switch to recover control of the aircraft. By continuing the emergency procedure from item 4 onwards, the pilot disabled the operative trim system and prolonged the serious control difficulties.
The ATSB acknowledges that the serious difficulties experienced by the pilot in this phase of the emergency resulted from non-selection of the Trim Interrupt switch and consequent full nose-down pitch trim before the Pitch Trim circuit breaker was pulled. In addition to the extreme flight loads and deleterious effects of acute stress on decision-making, another consequence was absence of trim operation as an indication of runaway status. As such, when the pilot was required to assess the effect of recovery actions, the only effective indicator was activation/cancellation of the Pitch Trim Runway CAS message.
Irrespective of the ineffective actioning of item 1 of the emergency procedure, the subsequent actions required for recovery of control—items 2, 3 and 8—were unchanged. The pilot, however, did not have capability to resolve the out-of-trim condition, which relied in part on resources provided by Pilatus and training/checking provided by RFDS. These aspects are discussed in following sections.
The ATSB notes that pilot capability in this aircraft-specific context should not rely on certain levels of total aeronautical experience levels or operational experience on comparative aircraft types.
Trim Interrupt and Flap Interrupt switches
The pilot’s mis-selection of the Flap Interrupt switch in place of the Trim Interrupt switch contributed to the development of severe control forces. One of the factors identified by the ATSB was the similar location, appearance, and function of the Trim Interrupt and Flap Interrupt switches.
To manage the risk of switch mis-selection generally, RFDS training/check pilots advocated the practice of identify–confirm–action. In relation to the Trim Interrupt switch, pilots were required to identify the switch when pitch trim runaways were addressed during training/checking. RFDS pilots were also familiar with the location of both switches from the pre-flight inspection conducted on a pilot’s the first flight of the day in a particular aircraft.
Pilatus inferred there was a risk of erroneously activating the Flap Interrupt switch and that hands‑on training would reduce that risk. In the RFDS context, mis-identification of the Trim Interrupt switch was not evident during training and checking and, in the previous pitch trim runaway occurrences, the pilots had correctly identified and actioned the Trim Interrupt switch. However, the artificiality of the training/checking environment and the relatively benign conditions experienced by most pilots during the previous pitch trim runaways occurrences (daylight and phases of flight other than take-off/initial climb) were very different from conditions of this occurrence.
In the 57 pitch trim runaway events recorded by Pilatus, there were no reports of mis-selection of the Flap Interrupt instead of the Trim Interrupt switch. Although this indicates that the risk is generally not high, it may be sensitive to phase of flight and environmental conditions. There was insufficient information in the Pilatus data to make an assessment of that risk.
The risk of mis-identification could be reduced by pilots manipulating the switch during training/checking and by increased awareness of the effects of inadvertent selection of the Flap Interrupt switch. Consideration could also be given to daily pre-flight operation of the Trim Interrupt switch as implemented for Canadian PC-12 aircraft. Although these procedural controls reduce the risk, it would be preferable to implement an engineering control to remove the hazard.
The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection. While visually distinguishing close proximity switches and controls has long been shown to be an effective strategy (for example, landing gear and flap retraction levers are typically designed to resemble the lever’s function), given pilots are not required to access the Flap Interrupt switch, consideration could also be given to preventing access to it altogether.
Pilatus emergency procedure and systems information
Pilatus advised pilots in the POH/AFM that the prerequisites for safe aircraft handling in an emergency is prior knowledge of the applicable procedure and a good understanding of the aircraft systems. The ATSB used this statement as a reference point to assess the related factors in pilot capability.
Prior knowledge is taken to be familiarity with the content and application of the Pitch Trim Runaway procedure. In this case, RFDS required the pilot to memorise at least the first four items of the Pitch Trim Runaway procedure and addressed this in PC-12 flight training and the recent OPC. Despite mis‑selection of the Trim/Flap Interrupt in this occurrence, the pilot demonstrated familiarity with all of the items of the procedure by addressing each in turn.
Pilatus did not nominate any recall items (also known as memory, phase-1 or bold-faced checks) for PC-12 emergency procedures. In the case of the Pitch Trim Runaway procedure, Pilatus advised the ATSB that their preference would be designation of item 1 as the only recall item to place the focus on the crucial item and positively arrest any trim runaway from any cause. Although the ATSB recognises there are benefits to minimising recall items, there is nothing to indicate that the number of nominated recall items in RFDS procedures were a factor in this occurrence.
The degree of knowledge required for a good understanding of aircraft systems is dependent in part on the complexity of the aircraft and the nature of the pilot-systems interface. Given the relative complexity of the aircraft and regulatory requirements, RFDS provided a PC-12 ground school to the pilot that covered the pitch trim system with reference to the POH/AFM. It would be natural for this theoretical knowledge to be consolidated and/or extended by the PC-12 flying training and operator proficiency checks (OPCs).
Given the pilot was able to recall the emergency procedure and was trained with reference to the Pilot Operating Handbook/Airplane Flight Manual (POH/AFM), the ATSB considered the content and format of the emergency procedure and systems information provided by Pilatus. The associated training/checking aspects are addressed in the following section.
Pitch Trim Runaway emergency procedure
The copy of the Pitch Trim Runaway emergency procedure from Figure 6 is repeated here for ease of reference.
After item 3 of the emergency procedure, the pilot was required to make an assessment and decision about the status of the runaway and act accordingly. This assessment/decision point was defined in the procedure by the condition—‘If trim runaway continues’. Correctly understood, the implication is that the fault is not in the manual trim system and autopilot trim system but in the alternate stabiliser trim circuit.
The alternate stabiliser trim circuit is not used during normal operations and does not require any relays to be energised for operation. As such, the risk that this circuit would fail in an unsafe runaway condition is very low relative to a manual trim or autopilot circuit failure. This was consistent with advice from Honeywell that there was no record of any such failure.
The alternative condition at the assessment/decision point—if trim runaway does not continue—was implied but not specified in the procedure. In this more likely scenario, the fault in the manual or autopilot trim systems has been neutralised by item 2 (opening of Pitch Trim circuit breaker). Then, without any guidance from the procedure, pilots needed to understand that the procedure from item 4 to item 7 should not be continued and alternate stab trim was the only means available to trim the aircraft for the rest of the flight.
Significantly, alternate stabiliser trim was not specified in the procedure until item 8. This had two related adverse effects. First, pilots are not guided to use the alternate stabiliser trim at the point where it almost certainly would be effective at recovering from an out-of-trim condition (after item 3). Second, if the procedure is carried out in a sequential manner, item 5 (Pitch Trim Alternate circuit breaker open) will render item 8 (alternate stabiliser trim) inoperable.
Another consequence of lack of guidance and continuation of the procedure is that item 6 (Pitch Trim circuit breaker—Close) will reactivate the pitch trim runaway in almost all cases.
One of the notes near the end of the Pitch Trim Runaway procedure advised pilots to ‘Reduce speed if control forces are high’. The pilot response to the abnormal control forces was consistent with this advice but the airspeed reached high-risk figures before the pilot took effective action. In this case, the pilot was probably not prompted by the note in the procedure. However, if the note was positioned earlier in the procedure, it is possible that pilot would have acted earlier to reduce the airspeed and risk of loss of loss of control.
Pilatus advised the ATSB that instead of reliance on descriptions within the emergency procedure, the objective of the emergency procedures must be understood and ingrained during training for the procedure to be effectively executed. This was more applicable when the pilot is managing the emergency and unintended consequences. Pilots were directed to SIL-003 for a clear description of the requirements. A copy of SIL-003 is at Appendix B and ATSB assessment of the SIL is in the next section.
The ATSB considered that the PC-12 Pitch Trim Runaway emergency procedure did not clearly define the two conditions for pilot consideration after item 3. In addition, the specified action in response to the most likely condition—pitch trim runaway discontinues (as indicated by no active warnings)—was out of sequence. Given the confounding situation and complexity of the PC-12 pitch trim system, it is likely that a clearly defined and logically sequenced procedure would have assisted the pilot to regain control.
Pitch trim systems information
From an operational perspective, the primary reference for systems information was the POH/AFM. This included the following information relevant to this occurrence:
The alternate stabilizer trim motor could be used as a backup through actuation of the Alternate Stab Trim switch.
In the case of uncommanded trim operation, all trim operation could be stopped by lifting the switch guard and pressing the Trim Interrupt switch.
If a stabiliser trim runaway of the main system is sensed a CAS ‘Pitch Trim Runaway’ warning will be displayed and a ‘Trim Runaway’ will be heard.
The ATSB notes that although this information is helpful to a pilot contending with a pitch trim runaway, it does not provide guidance as to when the Alternate Stab Trim switch should be used or the significance of the CAS warning as an ongoing indicator of system status.
Additional information about pitch trim runaway was available in Pilatus Safety Information Letter SIL‑003. However, RFDS did not incorporate the SIL into their operational reference material and the pilot was not aware of it.
The additional information would have been generally helpful to the pilot and would have emphasised the importance of reduced airspeed in managing the out-of-trim loads. Nevertheless, the ATSB identified missed opportunities in SIL-003 to explain and clarify aspects of pitch trim runaway:
Hands-on training was advised to reduce the risk of erroneously activating the Flap Interrupt switch but pilots were not informed of the associated risk factors, symptoms or corrective action if that occurred.
Information was provided about the purpose of pulling a circuit breaker, without further guidance as to how the affected trim motor would be identified.
Pilots were advised that control of the unaffected systems could be regained by simply repositioning the Trim Interrupt switch to NORM, without guiding pilots to use the Alternate Stab Trim switch.
Neither SIL-003 nor POH/AFM informed pilots/operators that both the manual pitch trim and autopilot pitch trim were powered from the Pitch Trim circuit breaker. In the absence of that information, there is a risk of misapprehension that the autopilot pitch trim was powered from the Pitch Trim Alternate circuit breaker on the (correct) basis that the autopilot pitch trim utilised the alternate trim motor.
A consequence of this misapprehension is that pilots/operators may not realise that the first 3 items (and item 8 as required) of the pitch trim runaway procedure will almost certainly be sufficient to address a runaway condition. There is a risk that pilots will unnecessarily address all of the items in the procedure and not resolve a pitch trim runaway, as happened in this occurrence. The effect of this misapprehension on RFDS training/checking is discussed in the next section.
Another characteristic not covered in the information for pilots applies when the manual trim circuit is the active cause of a pitch trim runway. If the pilot engages manual trim, perhaps instinctively, the CAS warnings are cancelled for the duration of the engagement then reactivate on manual trim disengagement. Pilot awareness of this characteristic might be of assistance in an ill-defined emergency such as this occurrence.
In the context of this occurrence, the ATSB considered that the systems information in the PC-12 POH/AFM did not provide a detailed description of the pitch trim system or effective guidance in the management of a pitch trim runaway. Although SIL-003 presented additional information, it did not effectively compensate for the lack of detailed systems description and guidance in the POH/AFM.
Summary and finding
The PC-12 pitch trim system is complex and the CAS warnings for pitch trim runaway do not specify the malfunctioning circuit or the required actions. As a result, pilots are required to recall and action emergency procedures, interpret system indications, and act accordingly to resolve a pitch trim runaway.
This occurrence demonstrates that the consequences of a pitch trim runaway can be critical if the trim is not interrupted early in the emergency. In the context of this occurrence, the applicable risk controls such as the emergency procedure and systems information did not provide effective assistance to the pilot. The other RFDS pitch trim runaway occurrences did not have critical consequences but indicate variability in the effectiveness of these risk controls.
The relatively experienced pilot involved in three of the previous pitch trim runaway events was familiar with the emergency procedure and POH/AFM but did not interpret the system indications appropriately or act according to the intent of the procedure. During post-occurrence RFDS training/checking, it was apparent that there was variability in pilot understanding of the pitch trim system and associated emergency procedures. Given that variability, the ATSB considered that the occurrence pilot’s relative inexperience was not an important factor in the occurrence.
Pilatus recorded 47 pitch trim runaway events that were associated with defective relays in the manual trim system or the trim adaptor. In those events, the only method available to adjust the trim was use of the Alternate Stab Trim switch, which was reported in 11 of the events (one was unsuccessful). Taking into account those 11 events and the 3 events where the emergency procedure was not fully actioned due to the operational context, there were 33 pitch trim runaways where pilot use or non-use of Alternate Stab Trim is unknown. As such, there is insufficient information to derive a conclusion from the Pilatus data regarding pilot understanding of the pitch trim system and emergency procedure.
Given the pilot in this occurrence was familiar with the emergency procedure and trained by qualified personnel with reference to the POH/AFM, the ATSB considered the content and format of the emergency procedure and systems information in the POH/AFM in the context of RFDS and Pilatus occurrence data.
The ATSB found that the emergency procedures and systems information in the PC-12 POH/AFM and Quick Reference Handbook (QRH) did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this case, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.
RFDS training and checking
The pilot’s capability to implement the Pitch Trim Runaway emergency procedure with a good understanding of the aircraft systems relied to a large extent on the training and checking provided by RFDS. Their training and checking organisation conducted the required ground school and flight training to qualify the pilot to operate the PC-12 aircraft type. This was supplemented by supervised line flying (LOFT) and operator proficiency checks (OPC) as specified by RFDS.
The PC-12 ground school was the primary means for RFDS to equip the pilot with the requisite knowledge of a wide range of aircraft systems. This included the pitch trim system, which was addressed with reference to the POH/AFM and as part of a guided inspection of an aircraft. Given the POH/AFM did not provide a detailed description of the pitch trim system and RFDS training/checking pilots were unaware of some characteristics, the information provided to the pilot accordingly had some limitations.
By the time the pilot was trained in 2018, Pilatus had issued SIL-003 (in 2017) as a reminder of the trim runaway procedures in the POH/AFM and to highlight decision-making considerations after the trim runaway condition is stopped. RFDS had not formally considered this document and it was not a supplementary reference in the ground school. Although this document would have been generally helpful to the ground school facilitator and this pilot, the focus of the SIL was operational and it did not provide any further significant detail about the pitch trim system. As such, the absence of the SIL from the ground school references was not considered to be a factor in the occurrence.
Although systems knowledge is not the prime focus of flying training, supervised line flying or operator proficiency checks, these processes generally help to consolidate the pilot’s understanding of aircraft systems and might show if there were any critical knowledge deficiencies. There was no indication of any such deficiencies.
The PC-12 flying training and operator proficiency checks were the primary means for RFDS to develop and verify the pilot’s capability to manage in-flight emergencies such as pitch trim runaway. These training/checking activities were oriented to the recall and practice of the applicable emergency procedures in the QRH. As a result, it could be expected that the pilot was familiar with the content of the procedures and location of the applicable switches and circuit breakers.
Although the pilot was able to recall the items in the emergency procedure, the initial switch selection was incorrect and the pilot actioned further items of the procedure without resolving the severely out-of-trim condition. The ATSB considered two aspects of the training/checking processes that might have played a role.
First, the practice exercises for pitch trim runaway were not consistent with the likely failure modes and recovery actions. Prior to this occurrence, RFDS operated on the basis that the manual trim was powered from Pitch Trim circuit breaker and the autopilot trim (utilising the alternate trim motor) was powered from the Pitch Trim Alternate circuit breaker. As a result, in response to a practice pitch trim runaway, pilots were expected to complete the first stage (items 1-3) at a minimum and it was common to continue the procedure (items 4-8) to represent an autopilot-related runaway scenario.
Actually, both manual and autopilot systems are powered from the Pitch Trim circuit breaker so the first stage (items 1-3) and item 8 (as required) of the emergency procedure are sufficient to manage a pitch trim runaway in all recorded cases to date. In the absence of a clear definition of failure modes, the pilot was conditioned to continue the emergency procedure beyond the first stage without use of the Alternate Stab Trim.
RFDS misunderstanding of the pitch trim system can be attributed in part to the lack of specific detail in the POH/AFM and unclear definition of the likely fault conditions in the emergency procedure. Although there was a report of some consideration of SIL-003 and consequent inclusion of pitch trim runaway scenarios in checks, RFDS did not formally consider the implications for their training/checking practices.
The key piece of additional information provided by the SIL was the advice:
Hands-on training reduces the activation time and minimizes the risk of erroneously activating the “Flaps Interrupt” system switch (which cannot be reset in-flight).
In the pre-occurrence context, with no instances of mis-selections in occurrences or training/checking, it is unclear if RFDS would have adopted that practice as an exception to the touch-drill principle. Nevertheless, Pilatus consider SIL-003 to be effective additional guidance for the management of a pitch trim runaway.
Second, the RFDS training/checking was carried out in-aircraft and this has inherent and unavoidable constraints for the practice of some emergencies. It is not technically feasible or necessarily safe to initiate a pitch trim runaway in the aircraft so the training/checking pilot described a scenario and/or discreetly made a flight control input. Accordingly, the trainee did not experience the realistic effects of a pitch trim runaway with the applicable CAS indications. Then, the pilot generally responded with a touch-drill and did not fully experience the physical action and system feedback.
As a consequence of both aspects, the occurrence pilot had developed an expectation that selection of the Trim Interrupt to INTR should have stopped the dive and the opened circuit breaker should have relieved the situation. In reality, the trim interrupt function simply stops the trim where it is and the opened circuit breaker does not provide any further relief at that point.
The ATSB found that the effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems information and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).
Relay failure
The ATSB examined the defective manual pitch trim DOWN relays removed from VH-OWJ and another PC-12 that sustained a pitch trim runaway. In both relays, one set of the normally open contacts were fused together in a similar way. According to the relay manufacturer, this type of damage was consistent with a short-duration high-current event such as a lightning strike.
The transfer of material between contacts in the manual pitch trim UP relay removed from VH-OWJ and the manual pitch DOWN relay from the other PC-12 showed that the related circuits had been subjected to regular arcing.
Based on examination of the three manual pitch trim relays from two different aircraft, the ATSB considered that the risk of surge voltage and over current in the PC-12 pitch trim system was probably not limited to a particular aircraft. The relay failures recorded by RFDS and Pilatus in connection with pitch trim runaway events are indicative of the same failure mode. Considering the near identical failure mode within the same pitch trim relay of varying aircraft, it is less likely that the cause would be a random event such as a lightning strike. The ATSB considers that the failure is more likely due to a characteristic associated with the pitch trim circuit, such as potential surge currents cause by switching the inductive load of the pitch trim actuator.
At the time of the occurrence Pilatus had identified a reliability issue concerning the mechanical relays in the PC-12 pitch trim system. This is consistent with the ATSB’s concern that a characteristic of the pitch trim circuit may have contributed to the relay failure.
Pilatus have developed service bulletins to introduce solid-state relays into the pitch trim power circuits. The ATSB notes that solid-state relays are also susceptible to failure from surge voltages. A typical failure mode for solid-state relays is short-circuit, in which case the load would not be turned off and a pitch trim runaway would occur.
Although Pilatus service bulletins SB 27-023 and SB 27-024 address the reliability of relays in the pitch trim system, the ATSB considers that the risk of pitch trim runaway may not be significantly reduced. As such, Pilatus may need to conduct further research into the electrical loads present in the PC-12 pitch trim system to identify and address the source of the high energy events that damage relays.
Findings
From the evidence available, the following findings are made with respect to the pitch trim runaway and partial loss of control involving a Pilatus PC-12/47E, registered VH-OWJ that occurred near Merredin, Western Australia on 14 April 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
Soon after take-off in dark-night conditions, the pitch trim system continued to operate in a nose-down direction without pilot input or autopilot commands (pitch trim runaway) because of a malfunctioning relay in the manual (main pilot-engaged) stabiliser trim system.
In response to the Crew Alerting System warnings, the pilot initiated the Pitch Trim Runaway emergency procedure but inadvertently selected the Flap Interrupt switch rather than the Trim Interrupt switch (item 1). Consequently (before the next checklist item was actioned), the pitch trim continued to runaway until it reached full nose-down with associated serious control difficulties.
After the pilot addressed items 2 and 3 of the emergency procedure, the malfunction was neutralised and the alternate stabiliser trim system was available to adjust the trim. However, the pilot did not identify those positive conditions and continued with items 4 to 8 of the procedure, which disabled the alternate stabiliser trim system, prevented pitch trim adjustment and prolonged the serious control difficulties.
The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.
The emergency procedures and systems information in the PC-12 Pilot’s Operating Handbook/Airplane Flight Manual and Quick Reference Handbook did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this case, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.
Other factors that increased risk
As the (uninterrupted) pitch trim runaway progressed, the reinforcing cycle of increasing control loads, forced descent, and increasing airspeed was initially exacerbated by high engine torque. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.
The effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems knowledge and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).
Other findings
The PC-12 Crew Alerting System (CAS) provided clear and salient warnings of the pitch trim runaway and indications of the ongoing status of the pitch trim system. As was typical for aircraft such as the PC-12, the CAS was not designed to specify the malfunctioning circuit.
In difficult operational circumstances, the pilot enlisted the assistance of non-flying crew to counter the very high control loads and managed to coordinate the dual control inputs to return and land without wing flap at Merredin.
At the time of the occurrence, the aircraft manufacturer was developing and implementing replacement components for the pitch trim system to improve reliability. Further research into the electrical loads present in the PC-12 pitch trim system may be required to find and address the source of high energy events that damage the relays.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
RFDS Western Operations
RFDS safety, quality and risk personnel carried out an investigation of the occurrence with a focus on the cause of the pitch trim runaway and the actions of the pilot and crew in response to the event. This resulted in six recommendations and the following safety action by RFDS:
Pilatus was asked to investigate more reliable relays for the pitch trim system.
Feedback was provided to Pilatus regarding the Pitch Trim Runaway emergency procedure and the potential to change it to reduce confusion.
RFDS considered that the timing of the initial engine torque reduction (when the airspeed reached 210 kt) led directly to a situation where the aircraft and crew were placed at catastrophic risk. With reference to the RFDS Just Culture process, this was considered to be negligent and, taking into account the pilot’s other incidents, the pilot’s employment was terminated.
RFDS amended the PC-12 operating procedures in their Operations Manual to present the first phase of the pitch trim runaway emergency procedure in accordance with the Pilatus PC-12 POH/AFM and QRH.
The RFDS Head of Training and Checking convened a review of the adequacy of processes in regard to pitch trim runaway. This led to the following activities:
Briefing on revised pitch trim system information to all PC-12 pilots
Development of a training presentation to describe operation of the pitch trim system
For PC-12 conversion, addition of training between ground school and flight training to provide opportunity for pilots to review and if possible physically action emergency procedures in an aircraft on the ground
Refresher training for pitch trim runaway for all PC-12 pilots on next scheduled checks
For a practice pitch trim runaway, pilots were now expected to physically action the Alternate Stab Trim switch
Provision of the RFDS investigation report (with redactions for privacy) to all PC-12 pilots.
Following the occurrence, senior training and checking personnel had the opportunity to participate in a modified PC-12/47E ground school and simulator flight refresher course provided in the US by Flight Safety International. This included a pitch trim runaway scenario with similar complications to the occurrence.
A number of recommendations were proposed including:
Enhancement to the PC-12 ground school with more emphasis on emergency procedures and their impact on aircraft systems
Consideration of practice to retard the engine power lever as initial response to pitch trim runaway for better access to Trim Interrupt switch and enhance control of airspeed and control forces.
Where possible, allow pilots to physically action controls such as Alternate Stab Trim that are specified in a drill
Opportunities for training pilots and all PC-12 pilots to practice emergency scenarios in a full motion simulator.
The sources of information during the investigation included the:
Pilatus Aircraft Ltd.
Honeywell Aerospace
Royal Flying Doctor Service – Western Operations
Pilot and medical crew of VH-OWJ
RFDS pilots involved in other pitch trim runaway occurrences
Royal Flying Doctor Service – Central Operations
Transport Canada.
References
Dismukes, R., Goldsmith, T. E., & Kochan, J. A. (2015). Effects of acute stress on aircrew performance: literature review and analysis of operational aspects.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, Transport Canada, Swiss Transport Safety Board, Pilatus Aircraft Ltd, Honeywell Aerospace, Royal Flying Doctor Service – Western Operations, the pilot and medical crew of VH-OWJ, and Royal Flying Doctor Service – Central Operations.
Submissions were received from the Civil Aviation Safety Authority, Swiss Transport Safety Board, Royal Flying Doctor Service – Western Operations, and Pilatus Aircraft Ltd. Those submissions were reviewed and where considered appropriate, the text of the draft report was amended.
Appendices
Appendix A – PC-12/47E Pitch trim system wiring diagram
The ATSB adapted this circuit diagram from the maintenance data produced by Pilatus to show the status of key components of the system at the time of the pitch trim runaway. The red lines trace the active power circuit through the malfunctioning relay. That circuit can be de-energised by the Trim Interrupt switch and/or Pitch Trim circuit breaker. The blue lines trace the power circuit that can be activated by the Alternate Stab Trim switch provided the Pitch Trim Altn circuit breaker is closed and the Trim Interrupt switch is NORM.
Note, both pilot and autopilot controlled pitch trim circuits are powered via the Ess Bus and Pitch Trim circuit breaker. The Main Bus and Pitch Trim Altn circuit breaker only powers the Alternate Stab Trim circuit.
Figure A1: PC-12/47E Pitch trim system wiring diagram
Source: Adapted from Pilatus PC-12 maintenance data by the ATSB
Appendix B – Pilatus PC-12 Safety Information Letter SIL-003
Source: Pilatus Aircraft Ltd.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
AO-2019-019
Occurrence date
14/04/2019
Location
4 km west of Merredin
State
Western Australia
Report release date
13/05/2020
Report status
Final
Investigation level
Defined
Investigation type
Occurrence Investigation
Investigation status
Completed
Mode of transport
Aviation
Aviation occurrence category
Loss of control
Occurrence class
Serious Incident
Highest injury level
None
Aircraft details
Manufacturer
Pilatus Aircraft Ltd
Model
PC-12/47E
Registration
VH-OWJ
Serial number
1411
Aircraft operator
Royal Flying Doctor Service of Australia (Western Operations)
On 31 March 2019, freight train 7MB9, operated by Specialised Container Transport (SCT), derailed while exiting the refuge at Goulburn, New South Wales. A total of five wagons derailed, with wagons coming to a rest foul of both the Up and Down main lines. Prior to the derailment, the driver of train 7MB9 was authorised to pass signal G38 at Stop. This signal could not be cleared due to a track circuit fault. The track circuit fault occurred the evening before, after train 2343 passed through the refuge. At that time, the network controller contacted the on-call signal electrician and it was agreed that trains could continue by passing the signal at Stop.
What the ATSB found
The ATSB found that train 7MB9 derailed due to a broken rail. A crack likely initiated from a lack of weld fusion at the foot of the rail in an aluminothermic junction weld. This defect area was located in a portion of rail not easily detectible through continuous ultrasonic testing, and was not detected during routine maintenance. Train 7MB9 was authorised to pass signal G38 at Stop as the signal could not be cleared. The signal was likely at Stop as a result of the Up rail breaking under the previous train, 2343, that passed through the section. The track failure went undetected.
Following the derailment, a number of other factors were identified that increased the risk of a derailment in the refuge and on the main line. These were communicated with the rail infrastructure manager while the ATSB was on site.
What's been done as a result
The Australian Rail Track Corporation repaired the section of track at Goulburn damaged by the derailment immediately following the occurrence. Additionally, a process is currently being trialled to provide assistance to network controllers when responding to track circuit faults.
Safety message
Network rules that permit degraded operations must be assessed to ensure that the application of these rules do not increase risk to an unacceptable level. Personnel responsible for implementing these rules should have sufficient guidance to assess when it is safe to continue operating trains, or under what conditions operations can continue.
It is critical that areas of the rail that cannot be easily tested during scheduled continuous ultrasonic testing are tested thoroughly at the time of welding to ensure that the weld is free from defects.
The occurrence
What happened
At 2300,[1] on 30 March 2019, a track circuit fault occurred after train 2343 entered the Goulburn refuge loop in the Down[2] direction. The Main South A Network Controller (NC), located at Junee, contacted the driver of train 2343 to confirm that the train was complete after entering the loop. The driver confirmed that the train was complete and they had not parted (causing the track circuit to show as occupied).
At 2320, the NC contacted the on-call Signal Electrician (SE) as the track circuit continued to fail intermittently. The NC reported that there was a track failure over 115 points after a train passed into the refuge. The NC reported that the points had failed, but they could work around the fault by authorising trains to pass signals at Stop. The SE reported that there had been some rain and that the fault could possibly be related to the ingress of water. The NC and SE agreed that the fault could remain and an inspection would be undertaken in daylight hours.
At 0403, on the 31 March 2019, train 7MB9 operated by Specialised Container Transport (SCT Logistics) was contacted by the NC while approaching Goulburn in the Up direction (Figure 1). The NC advised there was a track circuit fault and that the train would divert via the refuge loop before returning to the Up main. The driver was advised that the points were set and they were authorised to pass signal G38 at Stop.
Figure 1: Location map
Source: Geoscience Australia with annotations by OTSI
Train 7MB9 was travelling at 17 km/h as it traversed over points 115B and 115A when, at 0416, the driver noticed a loss of brake pipe (BP) pressure and brought the train to a stand. The NC received a track circuit fault indicator and contacted the driver of 7MB9. The driver advised the NC that 7MB9 may have parted and that he would check the status of the train. Shortly afterwards, the driver confirmed 7MB9 had derailed while passing through the turnout and the NC implemented safeworking protection (Figure 2).
A total of five wagons derailed due to a broken Up rail at 225.413 km[3] with the wagons coming to a rest across the Up and Down main lines (Figure 3 to Figure 5).
The Bureau of Meteorology (BOM) automatic weather station at Goulburn airport[4] recorded 30.8 mm of rainfall on 30 March 2019 and 4.8 mm on 31 March 2019. There was no other significant rainfall in the week prior. The temperature was between 4.6 °C to 14.1 °C on 31 March 2019.
Train information
2343
Southern Shorthaul Railroad (SSR) train 2343 was the previous train to pass over the track. It was travelling from Picton to Milvale, New South Wales. This train consisted of three locomotives and a rake of 43 wagons. The train manifest indicated that the wagons were unloaded at the time of passing through the refuge loop.
7MB9
Train 7MB9 was operating between Melbourne and Brisbane at the time of the derailment. This train consisted of three locomotives and a rake of 42 wagons.
The contents of a number of derailed wagons leaked onto the track. The train manifest showed there were no dangerous goods on board. The highest recorded axle load listed in the manifest was 22.88 t, which was within the maximum allowable loading limits for operating on this section of track. Inspection of the derailed wagons did not identify any defects believed to have contributed to the derailment.
Track infrastructure
The section of track at Goulburn was standard gauge (1435 mm) and managed by the Australian Rail Track Corporation (ARTC).
The refuge loop consisted of 47 kg/m welded rail, fastened to timber sleepers. The Up and Down main lines consisted of 53 kg/m welded rail, fastened to concrete sleepers.
Joining rail track
Joining of rail track can be completed by a number of methods, these include mechanical (bolted) or welded joints. The method used varies depending on the location and type of track being joined or repaired. Aluminothermic (thermit)[5] and flashbutt[6] welding processes are approved for use when joining sections of rail within ARTC managed track.
ARTC’s engineering standards permit the joining of dissimilar rail sizes through the use of a junction rail or junction weld.[7]
Junction rail, is a section of rail specifically designed and forged rail with two different sizes. This is then welded through standard aluminothermic welding processes for the appropriate rail size.
Junction weld, is a specialised type of aluminothermic welding designed to directly join dissimilar rail sizes. Specific moulds are used to match the dissimilar rail sizes that are being joined.
ARTC advised that rails of dissimilar sizes are typically joined via junction welds and not through the use of junction rails.
Following rail welding, visual and ultrasonic post-weld testing is carried out to check the weld complies with ARTC standards and manuals.[8][9]
Manual ultrasonic weld testing is completed using hand-held equipment with a number of testing probes to allow for the rail head, web and foot of the rail to be inspected (Figure 6). Hand-held ultrasonic testing is only carried out directly after welding or in response to defects detected through other methods such as continuous ultrasonic testing.[10] The foot of the rail is not typically ultrasonically tested after the weld has been certified.
Source: ARTC, Manual for Non-Destructive Testing of Rail ETN-01-04, modified by OTSI
Track maintenance
Routine track inspection and testing is conducted to identify defects and maintain safe operation. The requirements for these inspections are set out in ARTC Civil Technical Maintenance ETE-00-03.
Track patrol
This section of track was inspected weekly as part of a track patrol, this is completed on foot or from a hi-rail[11] or rail vehicle. The inspection scope is a general visual inspection, including the condition of the rail and joints, sleepers and fasteners, points and crossings, ballast, track geometry and stability and drainage. This inspection provides a level of assurance but is limited to detection of large or obvious defects.
Ultrasonic rail testing
Ultrasonic rail testing provides a non-destructive testing (NDT) method to detect internal and surface defects. The frequency of testing is based on the maximum allowable track speed and gross tonnes of rail traffic over the section of track. Refuges with a track speed of 25 km/h or less, are tested at twice the time period of the adjacent mainline. The track speed in the Goulburn refuge is 20 km/h and required continuous ultrasonic rail testing or manual hand-held testing to be conducted every 244 days.
Ultrasonic testing provides a level of assurance but does not and cannot detect all defects. The ability of this method to detect rail defects (Figure 7) will vary depending on the method of ultrasonic testing utilised, but also on the calibration of the equipment. Calibration of testing equipment is performed on a rolled steel test piece to represent a section of rail, however, may not be representative of a rail weld to the same degree. Continuous ultrasonic rail testing is capable of detecting defects in the rail head and through the web of the rail to the foot. Defects in the rail foot either side of the web are outside the detectable area unless hand-held testing equipment is used (Figure 8).
Figure 7: Rail defect types
Source: ARTC. Non-Destructive Testing of Rail (for Internal and Surface Defects) ETE-01-03
Figure 8: Continuous ultrasonic rail flaw detectable area
Regions detectable through continuous ultrasonic rail flaw inspection is shown in grey.Source: Transport for NSW, modified and annotated by OTSI
Network rules
The network rules utilised by ARTC in New South Wales permit signals to be passed at Stop under certain conditions, these are detailed in ANSG 608 Passing Signals at STOP. This rule is used when a NC cannot clear a signal for an intended movement. Prior to authorising a train to pass a signal at Stop, the NC must assess the condition of the block[12] ahead for the section of track (Figure 9).
There are a number of potential reasons why a signal may not be able to be cleared, these can include, but are not limited to:
the track circuit is still occupied
an electrical fault (damaged bonding, insulated joint, water ingress, loose or faulty electrical connection)
a broken rail.
Figure 9: Passing signals at Stop
Source: ARTC, Extract from ANSG 608 Passing Signals at STOP
In addition to ANSG 608, network controllers have general rule ANGE 220 Unreliable Track-Circuit Operation to assist when responding to track circuit faults. This rule details the required response when a track circuit fails to detect track occupancy or provides false detection of rail traffic (Figure 10). In this incident, the track circuit at Goulburn provided a false detection of rail traffic after the passage of train 2343.
Figure 10: Unreliable track-circuit operation
Source: ARTC, Extract from ANGE 220 Unreliable Track-Circuit Operation
Post-derailment inspection completed on 31 March 2019 determined that the Up rail broke at an aluminothermic junction weld joining 47 kg/m and 53 kg/m rail. The fracture face exhibited signs of oxidation across the foot and web of the rail, with two small sections in the rail head without oxidation indicating a fresh fracture surface (Figure 11). The rail head at the break also displayed some signs of end batter.[13]
The Down rail was also found to be broken at approximately 225.426 km. The rail displayed no pre-existing defects or oxidation, although the brittle fracture was indicative of overload. The Down rail appeared to have broken secondary to the Up rail, this was likely as a consequence of the derailment.
Figure 11: Broken Up rail
Source: OTSI
The primary function of track circuits is to detect track occupancy and allow for the operation of signalling equipment and separation of trains. Discontinuities in the track circuit can indicate a fault such as a broken rail, although may not detect all instances of a broken rail. The track circuit before the derailment indicated that the section of track was still occupied after train 2343 passed through the refuge. When considering the possible causes of the track circuit fault, coupled with the end batter on the rail, it is likely the Up rail was broken prior to the derailment of train 7MB9.
The leading locomotives and two wagons of 7MB9 traversed points 115B and 115A before the 6th position wagon derailed when the broken Up rail skewed to the left (in the direction of travel), resulting in the uncoupling of the 5th and 6th position wagons. The derailed wagons were pushed by the momentum of the trailing wagons and concertinaed across the Up and Down main lines. The 6th wagon came to rest on its side approximately 80 m from the point of derailment.
Maintenance records indicated that the track was subjected to continuous ultrasonic testing on 5 November 2018, with no discontinuities identified. Review of available ultrasonic test recordings indicated that no abnormalities were detected over this section of track dating back to 2013.
Further analysis of the broken Up rail undertaken by an independent metallurgist on behalf of ARTC identified a lack of weld fusion on the foot of the rail between the two rail types. The lack of weld fusion most likely went undetected at the time of welding. This weld fault likely created a stress raiser leading to the initial fracture at the foot of the rail. ARTC were unable to provide welding or maintenance records for the junction weld, however they assessed the weld as having had a long service life.
It is likely the fracture progressed from the foot of the rail and through the rail cross-section after the date of the last ultrasonic inspection. The crack was most likely detectable once the defect propagated into the web of the rail, however, testing was not due until July 2019, as per ARTC maintenance standards. This defect would have been unlikely to be detected during a routine track patrol inspection, in particular, a track patrol completed from a hi-rail vehicle.
Passing signals at Stop
Network rule ANGE 220 Unreliable Track-Circuit Operation required the NC to contact the on-call SE when they became aware of the false detection of rail traffic. This rule permitted trains to block work[14] or pass signals at Stop until the track circuit could be certified as working correctly. In response to the track circuit fault, the NC contacted the SE and advised they could continue to operate by passing signals at Stop. The SE agreed and suggested that the fault could have been the result of wet weather in the area.
Review of the audio recordings indicated that the NC advised the driver of train 7MB9 there was a track failure on the other end of the refuge (in the direction of travel), the points were set for the train to return to the Up main, and that the driver was authorised to pass signal G38 at Stop. This information was repeated back by the driver. During this communication the driver sought confirmation that the points were set to return to the Up main which was confirmed by the NC.
The driver was authorised to pass signal G38 at stop while on approach to Goulburn at 0403. On arriving at the signal, the driver did not stop at the signal before passing, as required by network rule ANSG 608. Authorising trains to pass a signal at Stop before arriving at the signal is permissible. This could, however, lead to a train passing the incorrect signal as positive confirmation between the driver and network controller is lost.
The driver was not advised that the condition of the track was unknown and had not been inspected prior to the train traversing points 115B and 115A. The driver operated train 7MB9 at approximately 17 km/h through the turnout, which was within the track speed limit. If the 7MB9 first stopped at signal G38, the train would initially have travelled at a slower speed until either reaching track speed or derailing. Had the NC advised the driver that the condition of the track was unknown, the driver may have operated the train at a slower speed through the turnout, which may have reduced the consequences of this occurrence.
At the time of the occurrence, ARTC’s network rules permitted continued operation of trains until the track circuit could be certified as working. These rules did not provide guidance for the NC to continue to assess, the changing conditions and ensure safe operation. Additionally, the rules did not restrict the track speed of trains authorised to pass signals at Stop.
While passing signals at Stop is permissible under ANSG 608 Passing Signals at STOP, the potential causes or conditions for passing the signal must be fully assessed. Track circuit faults following a recent train movement could indicate a broken rail and should be considered as the source of the fault prior to authorising trains to pass signals at Stop.
The Rail Industry Safety and Standards Board (RISSB) network rule for passing signals at Stop[15] recommends trains operate at restricted speed when the signal is at Stop for an unknown reason. This rule is not mandatory for rail infrastructure managers, but provides industry recommended practice.
Site examination
During the post-derailment inspection there were a number of factors identified that could have increased the risk of a derailment.
During the derailment, the sleepers in the turnout shifted laterally with pooled water present under the sleepers. There was rain during the previous day and night, however the track and ballast was raised above ground level with the ballast retaining water (Figure 12). To satisfactorily meet the design requirements, ballast must be free-draining (not clogged by dirt and mud) so that it allows water to run through it and off into the drainage system.[16]
The ballast and sleepers at the site of the broken Up rail were destroyed, preventing a detailed inspection. The broken sleepers in this area fractured into small pieces and appeared to indicate some degree of decaying and the ballast appeared fouled with mud and dirt. It is likely that the track condition at the point of derailment was similar to that of the area in the turnout. It is possible the fouled ballast reduced the track stability and may have allowed greater track movement in this area.
Under the 10th wagon, there were also six sleepers in a row where the fastener was either displaced and not securing the rail foot, or was secured to the sleeper but not in contact with the foot of the rail (Figure 13). It did not appear that these fasteners had displaced as part of the derailment sequence and appeared to be a pre-existing defect.
ARTC advised that in 2017, they identified decayed sleepers in the refuge. In May 2017, ARTC replaced 70 sleepers with concrete sleepers between the 225.440 km and 225.590 km. A further 200 sleepers had been identified as requiring replacement and were being monitored annually. There were no concrete sleepers near the point of derailment.
Figure 12: Refuge track condition near point of derailment
Source: OTSI
Figure 13: Ineffective rail fasteners
Source: OTSI
While walking the derailment site, the ATSB also identified points 114A on the Down main with ineffective heel block[17] fastening. One heel block bolt was found in the four-foot[18] and the second bolt securing the point switch was loose (Figure 14). The ATSB raised the defect with the ARTC representative on the day of the derailment.
Maintenance records indicated that the most recent track patrol was performed on 28 March 2019, with no reported defects at this location. It was not possible to determine when the bolt dislodged, however the derailment is not believed to have contributed to these defects found on the adjacent track.
From the evidence available, the following findings are made with respect to the derailment of freight train 7MB9 that occurred at Goulburn, New South Wales on 31 March 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
A crack propagated from the foot of the Up rail at a junction weld and was not detected by ARTC maintenance activities. It is likely that after the date of the last continuous ultrasonic testing, a crack progressed through the foot and into the web of the rail.
Other factors that increased risk
ARTC's network rules did not provide suitable guidance to assess continued safe operation when responding to track circuit faults. Additionally, the network rules permitting signals to be passed at Stop did not require a reduction in speed when the condition of the track was unknown. [Safety issue]
Post-incident inspection of the derailment site identified a number of factors that increased the risk of a derailment in the refuge and main line. ARTC’s maintenance activities had identified some but not all of these factors prior to the derailment. [Safety issue]
Other findings
The Up rail broke at an aluminothermic junction weld, joining 47 kg/m and 53 kg/m rail at 225.413 km.
The track circuit fault was likely the result of the Up rail breaking as train 2343 passed through the turnout, which went undetected prior to train 7MB9 derailing.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: ARTC's network rules did not provide suitable guidance to assess continued safe operation when responding to track circuit faults. Additionally, the network rules permitting signals to be passed at Stop did not require a reduction in speed when the condition of the track was unknown.
Safety issue description: Post-incident inspection of the derailment site identified a number of factors that increased the risk of a derailment in the refuge and main line. ARTC’s maintenance activities had identified some but not all of these factors prior to the derailment.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Australian Rail Track Corporation (ARTC)
Office of National Rail Safety Regulator (ONRSR)
Specialised Container Transport (SCT).
References
Australian Rail Track Corporation (2009). Manual for Non-Destructive Testing of Rail ETN-01-04, September 2009.
Australian Rail Track Corporation (2011). Used Rail and Welding Policy ETF-01-01, April 2011.
Australian Rail Track Corporation (2015). Passing Signals at STOP ANSG-608, October 2015.
Australian Rail Track Corporation (2015). Unreliable Track-Circuit OperationANGE-220, October 2015.
Australian Rail Track Corporation (2016). Code of Practice - Section 1 Rail, July 2016.
Australian Rail Track Corporation (2018). Non-Destructive Testing of Rail (for Internal and Surface Defects) ETE-01-03, July 2018.
Australian Rail Track Corporation (2019). Civil Technical Maintenance ETE-00-03, March 2019.
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Australian Rail Track Corporation, Office of National Rail Safety Regulator, Specialised Container Transport and Transport for NSW.
Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.
Submissions were received from Australian Rail Track Corporation and Office of National Rail Safety Regulator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
