Safety summary

What happened

On the night of 18 July 2018, a Malaysia Airlines Airbus A330, registered 9M-MTK, took off on a regular public transport flight from Brisbane, Queensland to Kuala Lumpur, Malaysia. There were 14 crew and 215 passengers on board. Covers had been left on the aircraft’s three pitot probes (airspeed sensors). The instruments showed a red speed flag in place of the airspeed indication from early in the take‑off, and unrealistically low airspeeds afterwards.

The flight crew did not respond to the speed flags until the aircraft’s speed was too high for a safe rejection of the take-off, and the take‑off was continued. The flight crew’s initial radio announcement of an urgency situation was not heard by the air traffic controller.

The flight crew climbed to 11,000 ft and circled while performing troubleshooting and other procedures, which led to the shutting down the aircraft’s air data systems. Doing so activated the back up speed scale (BUSS), a safety function that displayed safe flight envelope information to the flight crew in lieu of airspeed. Using this system, airspeed management procedures, and assistance from air traffic control, the flight crew conducted an approach and landing at Brisbane.

For technical reasons, the main landing gear doors did not retract and were slightly damaged on landing. Also, nose wheel steering was not available and the aircraft remained on the runway for a short period before being towed to the gate.

What the ATSB found

The ATSB identified safety factors across a range of subjects including flight deck and ground operations, aircraft warning systems, air traffic control, aerodrome charts, and risk and change management.

Ground operations and pre-flight walk-arounds

In accordance with a local informal procedure and recommended practice, a support engineer placed covers on the aircraft’s three pitot probes (airspeed sensors) to prevent them from becoming blocked by wasp nests (a particular hazard at Brisbane Airport). The operator’s certifying engineer, who was primarily responsible for the aircraft’s airworthiness, did not initially know about the covers due to a miscommunication with the support engineer who had fitted them.

The flight crew, engineers, and dispatch coordinator were required to conduct various pre‑departure checks, meant to identify aircraft damage or other unsafe conditions such as the fitment of pitot probe covers. However, these checks were omitted entirely or only partially completed, for a variety of reasons including inadequate communication and reduced diligence. On other turnarounds from the same operator, some flight crew, engineering, and dispatch walk-around checks were also omitted or incomplete.

The certifying engineer saw the covers early in the turnaround but later forgot about them, and there was ambiguity around the division of responsibilities with regard to the final walk-around portion of the transit check.

The support engineer who had fitted the pitot covers left to work on another aircraft and was unable to return before the occurrence aircraft was dispatched. There was no reliable method to ensure the return of tools and equipment before an aircraft departed.

The ATSB identified that the pitot probe covers used, which were different to those approved by the aircraft manufacturer, had streamers that were not prominent enough to be noticed by ground crews during incidental activities, including pushback, and so increased risk during turnarounds if other methods of ensuring their removal were not effective.

Flight operations

Surprise, uncertainty, time pressure, and ineffective communication between the two pilots during the take-off probably led to stress and high cognitive workload. The captain, as pilot monitoring, did not assertively announce the presence of a problem or clearly specify its nature when it was detected, delaying the first officer’s response. Then, although the captain and first officer attempted to convey information about the airspeed issues, there was limited coordination between them which reduced their capacity to interpret the situation and make a decision early enough to safely reject the take-off.

Pilots are trained to monitor airspeed on take-off, and Airbus recommends that pilots reject a take‑off if unreliable airspeed is identified early enough for this to be a safe action. However, take‑offs have sometimes been continued, or rejected at high speed, even with multiple airspeed anomalies. This suggests that the flight crews involved were not detecting unreliable airspeed early enough in the take-off, or if they did, other factors prevented or delayed a decision to reject the take-off.

Although the ATSB only examined Airbus occurrence statistics, these concerns are very likely to be relevant to other aircraft types. This is particularly important when aircraft and flight crews resume operations after a period of inactivity, due to increased likelihood of airspeed malfunction and limited flight crew recency.

The ATSB found that aircraft alerts related to unreliable airspeed were either not available during take-off, or were not prominent enough to gain both the flight crew’s attention in a manner that the presence and importance of the problem were both immediately apparent.

In addition, there was limited guidance provided to flight crews to aid in the detection and decision-making processes in response to unreliable airspeed indications. For example, there was no clear guidance to flight crews whether the failure of a single airspeed display should result in a rejected take-off when below a nominal speed, which can leave the flight crew in a difficult position when identifying such a problem when approaching the decision speed.

During and after the take-off, the flight crew attempted to troubleshoot the airspeed problem without first completing the required memory items, and they did not complete the After take-off/Climb procedure. However, their coordination and management throughout the rest of the flight was effective.

Once activated, the aircraft’s back-up speed scale (available on some Airbus aircraft) was highly effective in reducing flight crew workload.

Risk and change management

The operator had recently reintroduced flights to Brisbane, and although relevant risks were identified, risk controls were not implemented, including some that might have prevented the occurrence through a more controlled use of pitot probe covers. This was likely due to a combination of factors, including:

• errors in the risk assessment itself
• incomplete and unclear processes and guidance, which probably resulted in erroneous risk information not being reviewed, and
• the organisation’s risk and action monitoring processes not being applied in this instance.

The operator’s change and risk management processes had insufficient information to assure their effective application, which enabled the review and oversight processes to be inadvertently circumvented. The change management process also omitted many elements of established practices.

What has been done as a result

Shortly after the occurrence, the ATSB issued a safety advisory notice (SAN) advising all operators that conduct flights to Brisbane Airport to consider the use of pitot probe covers and, if covers are used, ensure there are rigorous processes for confirming that covers are removed before flight.

Alongside the publication of this final investigation report, the ATSB issued a SAN encouraging all manufacturers and operators of larger air transport aeroplanes to consider what types of unreliable airspeed events can occur, how the information is presented to flight crews, and what responses are the safest in different phases of the take-off and in a range of potential situations. Aircraft alerting systems, flight crew procedures, and flight crew training should be designed to provide sufficient assurance that flight crews become aware of and understand how to appropriately respond to unreliable airspeed on take-off in a timely manner.

All organisations directly involved in the occurrence implemented safety action to address safety issues identified by the ATSB:

• Malaysia Airlines:
  • added procedures requiring the placement of a placard on the flight deck as a visual alert for flight crews when pitot probe covers are fitted
  • made changes to engineering arrangements at Brisbane, reducing the likelihood of error
  • published a flight safety bulletin to flight crew about vigilance during walk-arounds
  • made numerous changes to the change and risk management processes.
• Airbus:
  • implemented additional flight crew training standards about unreliable airspeed on take-off, including walk-arounds, airspeed monitoring, systems knowledge, and non-technical skills
  • added guidance to the flight crew techniques manual on the importance of airspeed monitoring on take-off
  • commenced a review of airspeed indications in A330 and other aircraft types.
• Heston MRO implemented procedures to improve the consistency of pitot probe cover use and tool control measures.
• Menzies Aviation implemented improvements to its internal auditing programme.

Safety message

There are several key safety messages that arise from this occurrence.

Despite the efforts of Brisbane Airport to manage wasp populations and reduce the incidence of nest-building in aircraft, it is unlikely that these wasps, and the hazard that they bring, will be eliminated. The population of mud wasps in the Brisbane area has probably already spread beyond the limits of practical control.

The loss of airspeed data due to mud wasp ingress can occur even after brief periods, and the use of pitot probe covers for aircraft turnarounds at Brisbane is largely an effective defence. However, it introduces another risk, which is the potential for aircraft to commence a take-off with pitot probe covers still fitted.

In locations where pitot probe contamination is possible, operators need to consider the use of pitot probe covers, while addressing the potential unintended consequences of using them. Mud wasps generally affect only one pitot probe, which can be detected early in a take-off if the flight crew are vigilant. Risk is increased considerably if the flight crew does not detect the problem in time to safely reject the take-off, or if they continue the take-off.

It is rare to see multiple pitot probe contamination on the same aircraft due to mud wasps, but when pitot probe covers are left on all probes are likely to be affected. It is important to have preventative processes and equipment to alleviate the introduced risk when using covers for pitot probes or other sensors, and to recognise that their use does not completely eliminate the risk of mud wasp infestation.

At first glance, an observer might be puzzled as to how multiple checks can fail to detect the fitment of pitot probe covers before flight, or how a flight crew can complete a take-off without any valid airspeed being displayed. This occurrence illustrates how a range of individually straightforward factors can combine to nullify multiple critical safety barriers.

For all individuals working in the aviation industry, the occurrence shows that coordination and diligence can make a difference. Several individuals on the night—as well as their counterparts on other occasions—all acted as though the conduct of various external aircraft inspections was someone else’s responsibility; in fact, all had separate, key roles in detecting problems with the aircraft before departure. Had all such inspections been conducted diligently it is very likely that the pitot probe covers would have been seen and subsequently removed.

Most of these problems could have been resolved with better communication. Nevertheless, the working environment allowed errors and miscommunications to occur and propagate because individual responsibilities and work processes were not well-defined.

For flight crew, the occurrence also highlights the importance of vigilance, communications, and decision-making in adverse circumstances. Had the flight crew reacted more quickly, the take-off could have been rejected at low speed. Flight crews need to bear in mind the typical symptoms associated with unreliable airspeed on take-off in order to detect this situation as early as possible and reject the take-off if still safe. If uncertain of the aircraft’s proximity to the decision speed when an anomaly is detected, Airbus flight crews should immediately apply full take-off thrust and attain 15° pitch attitude when they feel that the aircraft is close to the rotation speed to maximise aircraft performance.

However, the flight crew’s delayed response vividly illustrates the falsity of the assumption that flight crews will always act as expected. Accordingly, the contribution of aircraft warning and indication systems design, combined with flight crew training and guidance, must be considered. Flight crews need to have information presented in a way that the importance of an adverse event, and possibly the right decision, is immediately apparent.

From an organisational perspective, the occurrence shows how inconsistent approaches between multiple interacting organisations can have safety implications that are hard to predict. As the ATSB has stated before, it is important to ensure that procedures are harmonised to increase the likelihood that potential problems or mistakes are detected before causing harm. Local variations to procedures should be formalised to reduce the risk of the inconsistent completion of tasks, and to improve the organisation’s ability to identify and address potential safety concerns. In addition, with operators increasingly relying on external engineering and ground handling support, the ATSB encourages anyone in the aviation industry to identify procedural problems for review and enhancement.

 

The occurrence

Overview

On the night of 18 July 2018, a Malaysia Airlines Airbus A330-300, registered 9M-MTK, was being prepared for a regular public transport flight from Brisbane Airport, Queensland to Kuala Lumpur, Malaysia with callsign MH134. The preparation for flight, and the flight itself, were conducted at night in clear weather with light winds.

After the aircraft had arrived at the gate following its flight to Brisbane, an engineer placed covers on the aircraft’s three pitot probes^[1] to prevent them from becoming blocked by wasp nests (a particular hazard at Brisbane Airport—information on this topic is provided in Appendix A). The pitot covers were not removed during the subsequent inspections and other activity throughout the turnaround (Figure 1).

Figure 1: Aircraft on bay during turnaround about to be pushed back with pitot probe covers in place

Source: Brisbane Airport Corporation, annotated by the ATSB

During take-off (commencing at 2331 Eastern Standard Time^[2]) and the subsequent flight, the aircraft systems could not calculate and display airspeed correctly due to the pitot probes being covered.

The aircraft systems detected invalid airspeed when the aircraft reached 50 kt, and displayed a speed flag on the two primary flight displays (PFD).^[3] The flight crew did not respond to the speed flags until the aircraft’s speed was too high for a safe rejection of the take-off, and the take‑off was completed at close to the pre-planned speed.

The flight crew made a PAN PAN^[4] call to the tower air traffic controller, who did not hear it and asked the flight crew to change to the departures frequency. The flight crew then did so and made a PAN PAN call to the departures controller, who responded to it.

The flight crew climbed to 11,000 ft and circled while performing several procedures. These procedures resulted in the flight crew shutting down the aircraft’s air data systems, which activated a safety function called the back-up speed scale (BUSS) that displayed safe flight envelope information to the flight crew in lieu of airspeed. Using this system and airspeed management procedures, the flight crew conducted an approach and landing at Brisbane at 0033. There were no injuries reported among the 14 crew and 215 passengers.

The inoperative air data systems meant that normal landing gear extension was not available, so the flight crew had carried out a gravity landing gear extension. Because of this, the main landing gear doors did not retract and were slightly damaged on landing. Also, nose wheel steering was not available and the aircraft remained on the runway for a short period before being towed to the gate.

Personnel and required checks

To manage the turnaround operation at Brisbane between each flight, Malaysia Airlines had arranged for:

• a travelling licensed aircraft engineer (LAE)^[5] from Malaysia Airlines to carry out, manage, and certify technical handling (engineering) tasks including a transit check, maintenance, and refuelling
• a support engineer, who was an aircraft maintenance engineer provided by Aircraft Maintenance Services Australia (AMSA)^[6] to assist the LAE with non-certifying technical tasks as directed as well as act as security escort for the LAE^[7] (another AMSA engineer was present for a brief period, but was minimally involved)
• ground handlers provided by Menzies Aviation Services (Menzies) to carry out ground handling tasks such as dispatch coordination^[8] and pushback^[9] using a tug, as well as baggage and passenger handling services.

Formally, the engineers were operating primarily under Malaysia Airlines procedures and the ground handlers under Menzies procedures. Further information on the operator’s engineering and ground handling arrangements in Brisbane are provided in Activities and duties in preparation for flight.

Personnel information is provided in Appendix C.^[10]

The following checks and inspections were required by applicable procedures, in approximate chronological order:

• arrival walk-around (to be conducted by ground handlers)
• engineering maintenance walk-around inspection (part of the engineering transit check)
• engineering pre-departure walk-around inspection (part of the engineering transit check)
• flight crew walk-around
• dispatch walk-around (to be conducted by the dispatch coordinator).

The purpose of each walk-around and the responsible personnel are described in Activities and duties in preparation for flight.

Aircraft arrival and initial ground activities

Airport closed-circuit television (CCTV) recordings showed that the aircraft arrived at the bay at 2020. It was scheduled to depart (push back) at 2320. Artificial lighting around the bay provided good visual conditions, particularly around the forward part of the aircraft.

At the time of the aircraft arrival, the ground handlers:

• aided with aircraft guidance to the bay
• chocked the nose and main wheels
• communicated with the pilots and ensured the aircraft was safe to work around
• moved the airbridge into position for passenger disembarkation
• began unloading baggage and freight.

The CCTV recording showed that a required arrival walk-around was not conducted by ground handlers.

The operator’s LAE arrived at the airport at about 2000. The LAE was based in Kuala Lumpur, Malaysia, and had been flown to Brisbane 2 days before to carry out maintenance tasks on two consecutive turnarounds. 9M-MTK was the second of these, and the LAE was required to return to Kuala Lumpur on the same flight.

After passing through airport security, the LAE was taken to the aircraft by a Menzies staff member. The LAE entered the flight deck at 2030 to commence the required transit check, which included a review of the aircraft’s technical documentation.

At 2045 the AMSA support engineer arrived at the aircraft carrying a set of pitot probe covers, which are commonly used in Brisbane to prevent mud wasp infestation.^[11]The support engineer moved an access stand (moveable ladder/platform) to the nose of the aircraft and fitted the pitot probe covers. Ribbons attached to each of the pitot probe covers were visible on the CCTV recording. The support engineer then moved the access stand away and proceeded to the flight deck.

At 2047 the support engineer arrived on the flight deck. According to interviews with the LAE and support engineer, their discussion was brief. The support engineer reported telling the LAE (who was checking aircraft records at the time) that pitot probe covers were fitted to the aircraft. According to the support engineer, the LAE did not acknowledge what had been said, or make an entry in the technical log for the fitment of pitot probe covers (which the support engineer normally expected). The support engineer did not question this.

The LAE had not been aware of the common and recommend practice for the use of pitot probe covers at Brisbane Airport. The LAE stated that it was not normal practice to fit them during transits and later did not recall the support engineer advising of their fitment during the turnaround. The LAE also stated that, had they known pitot probe covers were fitted at that point, they would have either made an entry in the aircraft’s technical log that the pitot probe covers were fitted, or told the support engineer to remove them.

Engineering activities

The support engineer facilitated LAE access to the apron. The LAE instructed the support engineer to add oil to the engines and hydraulic system and the support engineer left the area to obtain the necessary supplies.

The LAE then conducted the external inspection component of the walk-around transit check beginning at 2054 (this component will be referred to as the ‘engineering maintenance walk-around inspection’). The CCTV recording showed that the LAE shone a torch on the area of the two left pitot probes for about 4 seconds while walking towards the nose (Figure 2). The LAE then appeared to look at the area of the right pitot probe.

Figure 2: LAE shining torch on left pitot probes with covers fitted

Part of this image is overexposed due to the brightness of the torch.

Source: Brisbane Airport Corporation, annotated by the ATSB

The LAE reported noticing the pitot probe covers fitted to the aircraft at the time the nose area was inspected and intended to talk to the support engineer about them. As the support engineer was still absent from the aircraft retrieving supplies, the LAE decided to continue with the engineering maintenance walk-around inspection. The next interaction between the LAE and support engineer was ten minutes later. The LAE, busy with continuing the engineering maintenance walk-around inspection through that period, forgot about the pitot probe covers.

At about 2155, refuelling of the aircraft commenced under the supervision of the LAE, and was completed at about 2234. At 2237 the LAE and support engineer returned to the flight deck, where the LAE delivered the fuel receipt to the flight crew and certified that the transit check was complete.

The support engineer asked the LAE if there were any further tasks required. The LAE stated that the support engineer was no longer required. Both engineers left the flight deck at 2246. The LAE then sat in their assigned cabin seat for the return flight to Kuala Lumpur. The LAE reported being mindful of the need to board at a reasonable time before the international departure.

There was no formal or informal arrangement for the support engineer to remain with the aircraft. After leaving the vicinity of the aircraft at 2248, the support engineer took paperwork to the office, then went to assist other AMSA engineers on another aircraft. The support engineer reported having the intention to return to 9M-MTK but was assigned a rectification task on the other aircraft.

The support engineer was delayed further when leaving that aircraft while boarding was taking place. By the time the support engineer was able to return (about 2320), 9M-MTK had departed.

The Malaysia Airlines transit check requirements included another inspection, an engineering pre‑departure walk-around inspection, to check (among other things) that pitot probe covers were removed, and all doors and hatches were secured just prior to departure.

The support engineer reported that they understood their tasking was as directed by the LAE. The support engineer expected a pre-departure walk-around would be done by the ground handlers as the dispatch was conducted by them.

The LAE assumed the support engineer was responsible for the dispatch coordination and would subsequently conduct a final walk-around. Both engineers reported that the LAE did not instruct the support engineer to perform a final walk-around and did not ask about it.

Flight crew pre-flight activities

The flight crew arrived at the aircraft flight deck at about 2210, shortly before refuelling began, and commenced a series of pre-flight checks. As part of these checks the flight crew were required to review the aircraft’s technical log for outstanding defects. No defects relevant to the occurrence were recorded.

For this flight, the first officer (FO) was assigned the pilot flying (PF) role, and the captain was the pilot monitoring (PM).^[12]The aircraft manuals assigned responsibility for various tasks to each crewmember. The Preliminary cockpit preparation procedure had a requirement for the PM to check that the gear pins and covers (pitot probe covers) were stowed and to conduct an exterior walk-around (termed ‘flight crew walk-around’ in this report). The cockpit voice recorder (CVR) did not record this part of the pre-flight preparation.

The ‘gear pins and covers’ check, assigned to the PM, involved checking a compartment located behind the left pilot seat (Figure 3) for the presence of landing gear pins and pitot probe covers. Pitot probe covers were not routinely carried with the operator’s aircraft and were not carried on this occasion. Both flight crew later reported that they had not seen pitot probe covers in use in normal flight operations, and they were not informed of their use in Brisbane.

As the PM, the captain was responsible for the exterior flight crew walk-around. The captain commenced the walk-around at 2254, during which the captain briefly shone a torch over one of the left side pitot probes (Figure 4); the captain did not inspect the right side of the nose. In interview with the ATSB, the captain did not recall seeing pitot probe covers. Based on the captain’s walk-around path, torch use (particularly dwell time on check items), and total time taken, the ATSB assessed the captain’s walk-around as having omitted many of the required check items and was conducted without due attention (see Flight crew pre-flight walk-around for the occurrence flight).

Figure 3: Stowage compartment for landing gear pins and pitot probe covers (if carried)

Source: Airbus, annotated by the ATSB

Figure 4: Captain briefly shining torch on left side pitot probe area

Source: Brisbane Airport Corporation

After the captain returned to the flight deck, the flight crew compared their separate calculations of the aircraft’s V speeds, which denote different phases of the take-off based on airspeed. The flight crew calculated:

• the decision speed V₁ (the maximum airspeed at which a rejected take-off can safely be initiated in the event of an emergency) as 153 kt^[13]
• the rotation speed V_R (the airspeed at which rotation should be initiated) as 160 kt.

At 2312 the FO called for the Before start procedure. The captain (as PM) commenced the check by stating a phrase captured on the cockpit voice recorder (CVR) that sounded like ‘gear pitot covers’ but could also have been ‘gear pins and covers’. The FO immediately responded with ‘removed’.

Dispatch and taxi

At 2311 the towbar was connected to the aircraft, the main passenger entry door was closed and the airbridge retracted.

Menzies had assigned a team of ground handling personnel to the turnaround of 9M-MTK. A leading hand was in charge of all aspects of the non-engineering ground handling duties and held the responsibility for coordinating the dispatch.^[14]

The leading hand had not received operator-specific training and believed that they were not qualified to perform coordination of this dispatch. For that reason, just before the aircraft was to depart, the leading hand arranged for a ground handler from another Menzies team to coordinate the dispatch. According to the recollection of both individuals, the leading hand asked, ‘Are you good to do the headset?’ and the person taking on the role of dispatch coordinator gave a ‘thumbs up’ signal.

A dispatch coordinator was required to conduct a final walk-around before departure. The leading hand stated that they (the individual) would normally do a complete walk-around of the aircraft just after arrival to inspect it for obvious damage. They would also do a dispatch walk-around as part of the dispatch duty, which meant a check around the entire aircraft to ensure that all the baggage doors and hatches were secured and other similar ‘last-minute’ checks.

The leading hand did not advise the dispatch coordinator that a dispatch walk-around of the aircraft had not been conducted. The dispatch coordinator stated that the aircraft appeared to be ‘ready to go’ at the time of this handover: the airbridge was retracted, the tug was connected, and the driver was in position. The dispatch coordinator assumed that the leading hand had already conducted a dispatch walk‑around and did not ask about it.

The CCTV recording showed that neither of the Menzies personnel conducted a dispatch walk‑around. The dispatch coordinator donned the headset to communicate with the cockpit at 2315 and both Menzies personnel waited near the nose gear for pushback.

The CVR recorded the FO stating to the dispatch coordinator ‘confirm ground checks complete’. The dispatch coordinator responded by stating ‘correct, that is affirmative’.

Pushback commenced at 2318, 2 minutes ahead of schedule. The tug driver could not see the pitot probes from within the tug cabin. The leading hand remained near where the nose gear had been and appeared to look in the general direction of the aircraft for about 18 seconds before turning to take equipment away from the bay (Figure 5).

Figure 5: Aircraft about to be pushed back with pitot probe covers in place (two of three visible)

Source: Brisbane Airport Corporation, annotated by the ATSB

The dispatch coordinator walked alongside the nose gear until the tug driver stopped pushing the aircraft back. During this period, the dispatch coordinator was likely checking for sufficient obstacle clearance behind and to the sides of the aircraft and would not have had a need to look behind and above towards the area of the pitot probes.

The towbar and dispatch coordinator’s headset were then detached from the aircraft. CCTV footage from an adjacent bay showed the dispatch coordinator standing back from the left side nose of the aircraft showing the aircraft’s nose gear steering pin to the flight crew, in accordance with procedure, as confirmation that it had been removed (Figure 6). The pitot probe cover streamers would have been visible from this position.

After pushback and engine start the flight crew requested clearance to taxi. At 2324, the flight crew commenced taxi for a full-length take-off on runway 01. During the short duration of taxi, they were mostly engaged in conversation that was not pertinent to the flight. This conversation ended about 3 minutes before the take-off commenced.

Figure 6: Dispatch coordinator in position after pushback

Source: Brisbane Airport Corporation, annotated by the ATSB

Take-off

At the time of the take-off, there was no cloud and surface winds were variable at 3 kt. Winds aloft varied up to about 10 kt from the north or north-north-east, providing a slight headwind on take-off and landing. Due to the low winds in the area, groundspeed (which was recorded) was likely to have been very similar to airspeed, particularly up to 1,000 ft, so groundspeed is provided as an approximation to airspeed throughout this report.

Events throughout the take-off, based on recorded information and flight crew interviews, are listed and illustrated in Figure 7. Unclear utterances are marked in parentheses; some of these were recorded on multiple CVR channels and sounded different on each channel. In these cases, alternative interpretations are provided with the ATSB’s assessment of the most likely interpretation provided first.^[15] Further details and analysis of the data recordings and interpretation of the CVR is provided in Appendix C. Further information about the faults, warnings, and displays associated with the erroneous airspeed data is provided in Aircraft information.

Figure 7: Sequence of events on take-off

Source: ATSB. Runway image: Google Earth

Audio analysis of the captain’s ‘speed’ statement at 2331:18 found that it was significantly quieter than both crewmembers’ other statements made throughout the take-off (see Appendix C). Later, both flight crew did not recall seeing a speed anomaly until the aircraft reached 100 kt, and the captain did not recall making the 100 kt call.

The captain’s breathing rate and intensity increased as the aircraft passed about 60 kt. The captain later recalled that the take-off seemed to happen ‘in a split second’. The FO’s breathing rate and intensity increased at about the same time as the captain said ‘borders are red’ or ‘both also don’t have’.

The captain later did not recall hearing the FO suggest a rejected take-off and reported seeing the airspeed display ‘flickering’. The FO recalled seeing a red speed flag during the 100 kt speed check.

ATSB observation The captain’s ‘speed’ statement, 2 seconds after the likely point at which the speed flag was first displayed, indicated that the captain identified the presence of an airspeed problem almost immediately. This was about 10 seconds before the point at which the flight crew are advised to be ‘go-minded’ (that is, when they should only reject a take-off for serious problems). Apparently not checking airspeed until the 100 kt call, the FO was likely unaware of the presence of a problem until after that point.

According to analysis of the recorded data, both PFDs showed the red speed flag until about 2331:40, or about when the aircraft’s nose began to lift. At this point one or both PFDs displayed the airspeed tape with an erroneous airspeed close to the minimum displayable speed (30 kt). The displays probably intermittently transitioned between unrealistically low airspeeds and the red speed flag for a period. It is possible that multiple transitions occurred between recorded data points (1 second apart), which may have appeared as ‘flickering’ to the flight crew.

The FO reported that they commenced rotation by judging the aircraft’s position on the runway (and possibly also referencing the groundspeed display). Later analysis indicated that rotation was commenced at almost exactly V_R. The FO rotated to about 13° nose up pitch attitude and maintained FLEX^[19] thrust. Passing about 120 ft, following confirmation of a positive rate of climb, the landing gear selector lever was selected to the UP position.

At rotation, the PF normally increases pitch towards 15° until lift-off. Memory items of the Unreliable speed indication procedure^[20]require the PF to attain 15° nose-up pitch and apply TOGA^[21] thrust. At this time, the flight crew did not call out ‘unreliable speed’ (as required when initiating the procedure), and the FO did not announce an intention to maintain a certain thrust setting or pitch angle. The FO later reported maintaining maximum continuous thrust (the same detent as FLEX and one setting below TOGA) and 12.5° pitch to limit the risk of a tail strike. The captain, acting as PM, did not confirm or announce deviations from the pitch attitude and thrust settings listed in the memory items of the procedure.

Initial climb

After take-off, the PFDs probably both displayed mostly a speed flag and sometimes an erroneously very low airspeed. The integrated standby instrument system (ISIS) displayed speed at or near the bottom of the speed scale (30 kt) throughout the take‑off and less than 60 kt for the remainder of the flight.

At about 300 ft, the FO again asked ‘ADR 3 to put to ADR 3?’, and receiving no immediate response, said ‘you put to ADR 3?’; the captain said something indistinct but similar to ‘autof...’ at the same time as this second question. The air data source was switched to F/O ON 3 at 2332:10, with the aircraft climbing through 600 ft.

At about 700 ft the FO reduced the pitch attitude and maintained about 9° nose up pitch and maximum continuous thrust. Although the aircraft was below the minimum safe altitude at night (2,500 ft), the flight crew did not discuss whether the safe conduct of flight was assured. However, there were no notable ground hazards in the vicinity and no other aircraft that were likely to present a collision threat.

The FO called for the autothrust ECAM^[22]actions in response to an alert advising autothrust disengagement at 2332:22, when passing 1,000 ft. The captain immediately responded and the flight crew commenced the ECAM actions.

At 1,500 ft, a master caution alert occurred, associated with a chime and the message FCTL ALTN LAW (flight control alternate law). Alternate law is a degraded flight control mode that was entered as the result of invalid air data. The aircraft had actually entered alternate law just after lift-off, however, the message is inhibited until the aircraft reaches 1,500 ft. This mode was also displayed as four small amber crosses on each PFD.

The flight crew continued the ECAM actions, which were interrupted at 2332:45 by the tower controller asking them to contact departures. The captain requested the departures frequency, which the controller provided and was read back by the captain. At this time the aircraft was passing 2,500 ft.

Urgency radio call

At 2333:04, immediately after the captain’s read back, the FO suggested they call PAN PAN and the FO then immediately transmitted over the tower frequency ‘PAN PAN, PAN PAN, PAN PAN, Malaysian one thirty four, we have unreliable airspeed and request maintain runway track and request climb to six thousand [ft] initially’.^[23]The tower controller did not later recall hearing this call and did not respond to it.

Recorded air traffic control (ATC) data shows that the call was received by the ATC radio on the tower frequency. Other recorded data showed that there were no other transmissions or calls around this time. The PAN PAN call came about 40 seconds after the end of a coordination telephone call between the tower and departures controllers, in which they also briefly discussed equipment upgrades that were being conducted at the time (the tower controller later reported that the upgrades had no adverse effect on their workload or performance).

About 28 seconds after the end of the PAN PAN call, the flight crew of another aircraft requested take-off clearance from the tower controller. The tower controller responded with the clearance.

Immediately after that clearance was provided, the tower controller received a coordination call from the departures controller, who asked if the Malaysia Airlines aircraft could be transferred to the departures frequency, which is normally done shortly after take-off. The tower controller advised that it had already been done, and that they would ask again.

During that call, as the tower controller was speaking, the flight crew of the aircraft taking off asked over the tower frequency if the controller heard the PAN PAN call. The tower controller thought that this transmission came through the telephone connection from the speakers at the departures controller’s terminal and accordingly did not respond.

The tower controller then asked the flight crew a second time to change frequency, which the FO read back.

Continued climb and stabilisation

Through the above period the aircraft was passing about 3,800 ft. The FO called for the Unreliable speed indication procedure. No memory items were called by either flight crew, and the captain proceeded to locate the procedure in the quick reference handbook (QRH).

After changing to the departures frequency, the FO made a second PAN PAN call at 2334:21 (passing 5,800 ft), asking to climb to 10,000 ft and maintain runway track. The departures controller acknowledged the PAN PAN and provided the requested clearances.

The captain then asked the FO if the autopilot could be selected on, and the FO replied that it could not.

The After take-off/Climb procedure was not actioned.^[24] At about 2335, when the aircraft was climbing through about 7,000 ft, the flight crew commenced the Unreliable speed indication procedure, including pitch and thrust settings, confirming the maximum permitted altitude with the current flap extension. The thrust levers remained in the maximum continuous thrust detent and the FO maintained 9–12° pitch until the aircraft was levelled off.

As the aircraft approached 10,000 ft, the FO requested further climb to flight level (FL) 1502^[25] which was cleared by ATC. The flight crew resumed the procedure discussing the required pitch and thrust settings to level the aircraft. The FO advised the captain to pause the procedure, citing the FO’s need to focus on flying the aircraft.

The FO stabilised the aircraft in level flight at about FL110. A short time later the FO obtained an ATC clearance to remain at this altitude and to manoeuvre the aircraft to the east of Brisbane Airport (Figure 8).

At this time, the FO retained control.^[26] The flight crew resumed the Unreliable speed indication procedure. During the troubleshooting, the air data switch was changed to NORM, and remained at that setting for about 48 s. The flight crew then changed it to CAPT ON 3 for about 4 s, to F/O ON 3 for about 2 s, then to NORM where it remained for the rest of the flight. During the switching the FO cross checked and described to the captain which ADR system was providing data to which PFD and what indications were observed on the PFD.

After the switch was returned to NORM the FO stated that all three ADR systems appeared inoperable. The captain revised the actions for identifying the affected ADR, cross-checked the PFD indications and said that either the affected ADR(s) could not be identified, or all ADRs were affected.

Figure 8: Flight path of 9M-MTK during take-off, turn-back and landing

Source: Google Earth, annotated by the ATSB

After further discussion and revision of the required actions the flight crew determined that all ADRs should be selected off, which is a procedurally irreversible action in-flight (that is, there is no procedure to enable the crew to turn them back on until after landing).^[27] As a way of cross-checking the correct action before taking it, they decided to exchange duties so that the captain would fly and the FO would perform the procedural actions. The FO announced the current pitch and thrust settings to maintain level flight, and the assigned heading before handing control of the aircraft to the captain. The FO revised the required actions for the Unreliable speed indication procedure and reconfirmed the required action with the captain before switching all ADRs off. Once completed, the flight crew confirmed the amount of fuel remaining and requested a block level altitude between 10,000 ft and FL 120 which was approved by ATC.

The FO pre-read the All ADR off procedure in preparation for the next step, which was to turn all ADRs off. At 2343, with the aircraft at about 11,000 ft, the flight crew turned all three ADRs off. This activated the back up speed scale (BUSS), an alternate display mode which permits pilots to keep the aircraft in a safe performance envelope when airspeed data is unreliable or unavailable (Figure 9). Further information on the BUSS is provided in Back up speed scale. The airspeed tape on the ISIS is retained, and in this case would have stayed at the bottom of the speed scale (30 kt).

Figure 9: Example of the BUSS, showing the colour-coded scale (left) that indicates derived speed, and a GPS altitude scale (right)

This image does not reproduce the exact PFD display during the occurrence.

Source: Airbus

In addition to activating the BUSS, turning off all ADRs resulted in the following notable effects:

• the ECAM warning message NAV ADR 1 + 2 + 3 FAULT (fault with all 3 ADRs)
• pressure altitude was replaced with GPS altitude
• spoilers and speed brake are not to be used
• normal hydraulic extension of the landing gear was not possible, and the main landing gear doors could not be retracted after a gravity extension
• cabin pressure needed to be manually controlled by the flight crew
• nose wheel steering was not available on

ATSB analysis of flight data indicated that the aircraft did not approach an aerodynamic stall condition at any point during the flight^[28]

ATSB observation Initially, the absence of airspeed indication required increased flight crew vigilance and coordination to maintain a safe flight envelope. After the crew followed the required procedures, the BUSS presented a clear primary indication of the aircraft’s safe flight envelope and probably greatly reduced the likelihood of error.

At 2344 the FO briefed the cabin crew manager of the situation and advised the flight would be returning to Brisbane for a normal landing.

The departures controller asked the flight crew about their intentions and they advised that they had no airspeed information. In response, the controller provided groundspeed information and offered to provide regular groundspeed updates, which the captain accepted. The controller advised the tower controller of the situation, and the tower controller performed many of the required alert phase^[29] actions including preparing for fire services.

At 2353, the flight crew discussed available options for landing. They decided to conduct an overweight landing on runway 01 and began planning their approach and landing accordingly.

Approach and landing

The flight crew requested a descent from ATC, which the captain, as PF, commenced at 2358. The plan was for an instrument landing system approach with a long (20 NM) final approach leg^[30] to runway 01, with ATC providing vectors, groundspeed, wind and distance to run. The BUSS provided the primary speed reference and the FO provided pitch, thrust, and speed reference information from the QRH to the captain.

The flight crew obtained the Brisbane automatic terminal information service, and reviewed the systems affected and the potential effects. They advised ATC that the aircraft would require a tug after landing (due to the loss of nose wheel steering). The flight crew discussed what they would do if a missed approach was required.

The flight crew also discussed who should fly the approach and landing. Operator policy required the captain to do so in abnormal situations, but in this case the captain felt it better to effectively monitor and manage the unfamiliar situation personally while delegating the PF role to the FO who had significant experience on the A330.

ATC transferred the aircraft to the tower at 0031, when the aircraft was at 1,900 ft on approach. The departures controller advised the tower controller, who was the same controller as during the take-off, that the flight crew requested groundspeed information.

At 0033, the flight crew conducted an overweight^[31] landing on runway 01 at 152 kt groundspeed, touching down at about 390 m from the threshold, near the aimpoint. The maximum recorded vertical acceleration on landing was 1.26 g, which the aircraft manufacturer reported was within the design load limits. The FO selected reverse thrust and stopped the aircraft about 1,600 m short of the runway end.

The aircraft could not be moved immediately due to the main landing gear doors, which do not close following a gravity extension, being in contact with the runway. The LAE was called to the flight deck and, after the flight crew explained the instrumentation problem, recalled that pitot probe covers had been fitted and suspected that they may not have been removed. The LAE opened and leaned out of a side window and identified the presence of covers on the pitot probes.

After ground inspections established that the aircraft was safe to tow, it was towed to the terminal where the passengers and crew disembarked. There were no reported injuries.

Aircraft damage

The main landing gear doors had minor abrasion damage where they contacted the runway surface on landing. If the main landing gear doors are opened on the ground, such as for maintenance activity, they typically remain clear of the ground. However, compression of the main landing gear struts during the overweight landing led to contact between the doors and the runway surface (Figure 10).

Figure 10: Right main landing gear door showing runway contact mark

Source: ATSB

The pitot probe streamers were damaged by airflow and left red marks on the fuselage skin where they rubbed during the flight (Figure 12). The sheaths were partially burned where they folded over the heated pitot probes in the airflow.

Figure 11: Reconstruction of pitot probe covers on 9M-MTK, showing pitot probe cover damage and contact marks on aircraft skin from the streamer

Source: ATSB

Figure 12: The right and left sides of the aircraft’s nose shortly after landing, showing pitot probe covers installed

Source: Brisbane Airport Corporation, annotated by the ATSB

Due to the absence of airspeed data the flight crew did not have the usual indications for maximum flap and landing gear speeds. Airspeed estimates using groundspeed, wind data, and atmospheric data indicate that the maximum flap extension speed was most likely exceeded by up to 14 kt during the climb through 4,000 ft, and by up to 5 kt on descent through 7,500 ft. The maximum landing gear extension speed was probably not exceeded. Inspections (required after potential speed exceedances) were carried out and did not identify any damage.

__________

1. Pitot probes provide air data computers and flight instruments with airspeed information, and are ineffective if covered or blocked.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. More information about the flight deck displays is provided in Aircraft information.
4. PAN PAN: an internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
5. LAE: equivalent term for LAME (licensed aircraft maintenance engineer).
6. Aircraft Maintenance Services Australia was rebranded as Heston MRO in February 2019.
7. The LAE did not have the relevant Australian security pass to access the ramp area unescorted.
8. Dispatch coordination is the task of controlling and coordinating pushback between the ground handlers and flight crew. It is also known as the headset function because the dispatch coordinator wears a headset to communicate with the flight crew.
9. Pushback: using a tug to push an aircraft backwards from the terminal so that it can then taxi under its own power. .
10. None of the personnel were found to have been likely experiencing a level of fatigue known to have a demonstrated adverse effect on performance at the time of the occurrence
11. The pitot probe covers used were different to the type approved by the aircraft manufacturer. See Pitot probe covers for further information. See Airport information for further information about the mud wasp hazard at Brisbane.
12. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned flight crew roles with specific duties. In normal operations, the PF controls the aircraft and navigates. The PM carries out support duties, monitors the PF’s actions and the aircraft’s flight path, and makes radio communications. Tasks can be reallocated as required. In abnormal operations, the PF makes radio communications while the PM applies required procedures and actions. See Flight crew procedures. 
13. The flight crew performed the calculations manually and separately, and their results for V1 differed by 1 kt. The captain chose the lower of the two results. Take-off speeds were recomputed by Airbus after the occurrence: the recomputed V1 was 150 kt, and the recomputed VR was 159 kt.
14. A dispatch coordinator, or ‘headset’ person, coordinates pushback tasks between the ground crews and the flight deck, communicating with the flight crew via a headset. See Activities and duties in preparation for flight for more information about this role and related training.
15. The FO’s channel was more distorted, so the area channel was the preferred source where a difference existed.
16. The first part of this utterance sounded similar to the second syllable of ‘abort’, but there was no discernible ‘a’ sound.
17. Air data reference (ADR): This is a likely reference to the air data switch. See Air data indicating systems.
18. The angle of attack data from each ADR was flagged invalid due to airspeed being below 60 kt, leading to all three ADRs being rejected by the flight control computers at the time of lift-off and reversion to alternate law.
19. FLEX: a thrust lever setting that provides a de-rated amount of thrust for take-off to reduce engine wear.
20. In this context, ‘speed’ means ‘airspeed’. More information on this procedure and context about memory items is in Aircraft information.
21. TOGA: Take-off / go-around, a thrust lever setting that applies maximum available thrust.
22. The electronic centralised aircraft monitor (ECAM) monitors aircraft systems, displays aircraft system information, and specifies flight crew actions to be taken in the event of abnormal or emergency situations.
23. In abnormal and emergency situations, the PF is required to advise air traffic control
24. Actioning the After take-off/Climb procedure confirms that the landing gear was up, flaps were retracted (not applicable with unreliable speed indication, which did not allow configuration changes), and air conditioning packs were on to pressurise the aircraft.
25. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s altitude at standard air pressure is referred to as a flight level (FL). FL 150 equates to 15,000 ft.
26. The captain and FO later discussed whether to follow the operational policy that the captain should take over flying in abnormal situations, but the captain did not feel it was necessary in this circumstance. The FO had significantly more experience on the A330 than the captain.
27. This action does not actually turn the ADRs off, but prevents the data from being used for display and control purposes.
28. An aerodynamic stall is a very serious loss of control condition in a large passenger aircraft.
29. Alert Phase (ALERFA): an emergency phase declared by the air traffic services when apprehension exists as to the safety of the aircraft and its occupants.
30. The final leg of an approach is the period between the last turn onto the runway direction and touchdown. Extending the final leg gives the flight crew more time to stabilise the approach.
31. An ‘overweight’ landing is conducted at an aircraft weight higher than certified maximum landing weight, and involves greater structural forces and longer landing distances. The aircraft’s weight on landing was about 211,500 kg, and its maximum landing weight was 187,000 kg.

Context

Airport information

General airport information

Brisbane Airport’s main runway was 01/19, which was 45 m wide and 3,560 m long. It was equipped with edge lighting, centreline lighting, and instrument landing system (ILS) in both directions. Runway 01, used for the take-off and landing, was fitted with approach lighting and a precision approach path indicator,^[32] and was approved in the ILS category I. To its north was a secondary runway (14/32), and a parallel main runway (01L/19R) was under construction to the west.

Mud wasp hazard

‘Mud wasp’ is a colloquial term encompassing numerous species of wasp, including those known as mud‑dauber, keyhole, and potter wasps.^[33] They are named for their nests, constructed mostly from mud or sand, which are sometimes built within abandoned nests of other species or small cavities within human-made objects. The wasps then place captured spiders or insects inside as food for their larvae. Other wasp species can take over these nests parasitically. For these reasons, analysis of the nest’s contents may not always reveal the species of wasp responsible for the original construction of the nest.

Mud wasps are found throughout Australia with the majority found along the eastern seaboard, especially in tropical Queensland.^[34] At least 10 distinct mud wasp species have been identified at Brisbane Airport.

Historically, mud wasps have been known to build nests in aircraft pitot probes, entering through the forward-facing opening (Figure 13). Nesting and food material placed in the cavity blocks the probe, to the point where it may no longer provide accurate airspeed information. A partial blockage, such as that caused by the first addition of mud for a nest, may be enough to cause anomalous airspeed readings as air flow is disturbed.

The Civil Aviation Safety Authority (CASA) reported that the potential for pitot probe contamination may arise within 20 minutes of availability (Appendix A). Wasps have been observed inspecting aircraft within a few minutes of arrival at the gate. There may not be external signs of the presence of a nest or partial nest within the probe, and there have been occurrences at Brisbane airport where pitot probes were blocked during a turnaround by a partially completed wasp nest (see Related occurrences).

House and others (2020a) conducted a study at Brisbane airport to determine the species and prevalence of mud wasp nest building using replica pitot probes of various types, finding that only keyhole wasps (Pachodynerus nasidens, originating from the Caribbean-South American region) constructed nests in the replica probes, although other species could not be excluded. Brisbane Airport is the only place in Australia that is known to have a resident population of this species. It is also present in Hawaii and Micronesia.

Figure 13: Female keyhole wasp (Pachodynerus nasidens) on a replica DHC8 pitot probe, Brisbane Airport, May 2016

Source: House 2020b

The Brisbane Airport study found that the wasps could nest in replica pitot probes of all types. Replica pitot probes with apertures of 7.2 mm (modelled after those fitted to a typical Boeing 737‑400) were the most affected, followed by 5.5 mm (A330) and 5.0 mm (Boeing 737-800).

The study also found that 96 per cent of keyhole wasp nesting occurred between November and May. Keyhole wasps are generally active only during the day, but strong airport lighting appears to have allowed them to build nests at night on at least one occasion. Ecosure (2017) stated:

At [Brisbane Airport], mud nests have been reported on all types of buildings including hangars, terminals and other structures, but only in pitot probes of aircraft parked near terminal buildings or in hangars. This suggests that aircraft parked in open areas are difficult for wasps to locate and nest on.

Airworthiness bulletin on wasp nest infestation

In May 2015, CASA issued Airworthiness Bulletin (AWB) 02‑052 ‘Wasp Nest Infestation – Alert’ to ‘urgently advise operators, maintainers and pilots of the dangers associated with undetected wasp infestation in aircraft, and the circumstances under which they can occur.’ It was available on the CASA website and emailed to subscribers. Its two pages contained background information regarding Australian mud-dauber wasps and their potential to make nests in aircraft, originally stating that their nests can completely block a pitot tube within 2 hours. Recommendations were given for the parking and storage of aircraft.

The AWB was updated from time to time with amendments summarised as follows:

• From issue 2 (March 2016):
  • included anecdotal evidence that mud dauber wasps ‘can build a significant nest capable of completely blocking a pitot tube, vent, or drain in around 20 minutes’
  • recommended operators ‘be aware that on-ground pre-flight air data module [built-in] tests and/or computer checks will usually not test pitot probes or static vents for blockages.’
• From issue 3 (December 2017):
  • provided information on the criticality of relevant failures in accordance with the United Sates Federal Aviation Administration (FAA) advisory circular (AC) 23.1309-1E as follows:
• Pitot tubes blocked in flight can cause total loss of function of airspeed or altitude indication. This is classified as hazardous.
• Total loss of function of flight controls is catastrophic.
• Misleading and/or malfunction without warning of electrical trim control systems is catastrophic.
  • advice regarding the fitment of pitot probe covers during turnarounds, and that it was important the covers were approved by the manufacturer, as others may not fit correctly.
• From issue 4 (May 2018):
  • a significant expansion of information from 5 to 11 pages including information from a report commissioned by Brisbane Airport Corporation about keyhole wasps, and noted that as their eradication was not possible, notification of their presence was permanently published in the Airservices Australia’s En Route Supplement Australia (ERSA) section on Brisbane Airport (see Aeronautical charts).
  • mentioned newer design pitot probe covers fabricated from materials ‘such as fibreglass or Nomex’ being able to withstand higher temperatures, as would be required during turnarounds prior to heated pitot probes having cooled sufficiently.
• From issue 5 (February 2021), AWB 02-052 stated the criticality of failure differently:

Pitot tubes or static ports blocked (or even partially blocked) in flight can cause total loss of airspeed or altitude indication. This is classified as hazardous. Misleading and/or malfunction without warning can be catastrophic.

Airbus guidance

In July 2016 Airbus published an article on pitot probes blocked by insect activity in its free Safety First magazine, which shares non-mandatory safety information with Airbus operators and flight crews. The article mentioned a 2013 occurrence investigated by the ATSB (see Related occurrences) and presented an excerpt from an Brisbane Airport ERSA entry that warned of the potential for wasps to block pitot probes. It proposed the use of pitot probe covers as a preventative measure, stating (Airbus 2016):

Parking procedures available in the Aircraft Maintenance Manual [AMM] will request that approved protective covers are installed on each of the air data probes or devices, including Pitot probes. But many operators will not apply the AMM parking procedure if the aircraft only has a short turnaround time or remains on the flight line. …

With the recent finding from the example incident where a Pitot probe obstruction occurred in less than two hours, it is important to know if Pitot probe protection is a priority in local airport ground handling or turnaround procedures. The aircraft operator should collaborate with the local airport authorities to assess the risk of Pitot probes being blocked by sand, dust, dirt or insects activity at their operational base or destination airports. For example, check if a wildlife management plan is part of the airport’s hazard management strategy and what mitigations are in place to detect or manage insect activity. Confirm how each airport will alert airlines or operators where there is evidence that local conditions may contribute to an increased risk of Pitot blockage to aircraft on the ground.

Depending on the outcomes of this risk assessment, the operator should consider implementing a specific policy on the use of Pitot covers even for a short turnaround time. Some airlines already have policies in place for certain airports that require Pitot covers to be used for all aircraft on the ground regardless of turnaround times.

Brisbane Airport wasp management activities

Brisbane Airport Corporation manages the risk to aircraft posed by mud wasps as part of a broader wildlife hazard management. The airport conducts bi-monthly internal wildlife management meetings and quarterly external wildlife management meetings and produces education material for airport workers. Other activities for wasp management include the application of direct and indirect control methods such as removal of nests, limiting availability of nesting materials and food sources, and selective eradication. In addition, there are ongoing studies into the activity and biology of mud wasps in the area and the effectiveness of control methods (Ecosure 2017). Some operators and ground service providers also have wasp management programmes in place.

Aircraft information

General information

The aircraft was one of 15 Airbus A330-300 aircraft operated by Malaysia Airlines. The Airbus A330 is a large capacity, wide-body, twin-engine aircraft, which is used for medium-to-long-range air transport operations and was first certified in Europe in 1993.

Inspection of the on-board aircraft documentation showed that the aircraft had one deferred defect which was an unserviceable park brake light indicator, which is located on the nose gear. It illuminates to indicate to ground personnel when the park brake is set. No other maintenance issues were recorded.

Flight control system

The Airbus A330 has fly-by-wire flight controls. The aircraft’s flight control surfaces are electrically controlled and hydraulically actuated, and flight control computers process pilot and autopilot inputs to direct the control surfaces as required. There are three flight control primary computers and two flight control secondary computers.

The flight control computers continuously monitor outputs from the 3 air data inertial reference units (ADIRUs). There are different rules for comparing discrepant values; typically, each individual value is compared with the median value. If the difference is above a predetermined threshold for a predetermined duration, then the associated part of that ADIRU was rejected and the two remaining sources were used for flight control purposes. When two sources are rejected, the system reverts from normal law to alternate law.

In normal law, the computers prevent the exceedance of a predefined safe flight envelope using a range of protections (load factor, pitch attitude, angle of attack, high speed, and bank angle).

Alternate law is used when there is insufficient air data for normal law to operate correctly. Some of the protections are not provided or are provided with alternate logic. There are two levels of alternate law; the loss of reliable airspeed means the aircraft enters the more degraded level where only load factor protection remains, and the high angle of attack protection is replaced by a stall warning.

Flight crew alerting systems

The A330’s electronic centralised aircraft monitoring (ECAM) system presents aircraft system data to the flight crew. The ECAM comprises the engine and warning display (E/WD) and system display in the centre of the instrument panel.

The lower part of the E/WD displays messages and specifies flight crew actions to be taken in the event of abnormal or emergency situations. The left section presents warning messages and the right section lists the affected systems, secondary failures, memos or special notices (such as ’LAND ASAP’).

Individual aircraft system failures are graded according to their safety effect on the aircraft. The ECAM has three failure mode levels (Figure 14). Alerts are prioritised so that higher-level alerts are displayed first, and also prioritised within each level.

Figure 14: Airbus A330 failure mode levels
 

WARN: warning. CAUT: caution.
Source: Airbus

Master warning (flashing red) and master caution (steady amber) lit buttons are located on the glareshield in front of each pilot to draw their attention to important messages on the ECAM, and can be pushed to suppress the alerts until a new alert occurs. A continuous (repeating) chime plays when a master warning occurs, and a single chime plays when a master caution occurs.

In addition to the ECAM system, Airbus has a series of procedures for abnormal or emergency situations where flight crew may not receive an ECAM alert or warning. These are known as memory items. Memory items are procedures, or critical immediate actions of an ECAM/quick reference handbook (QRH)/operations engineering bulletin (OEB) procedure, that the flight crew must apply by memory to ensure continued safe flight. In some time-critical situations, the flight crew has no time to refer to the ECAM and/or to the QRH.

Air data indicating systems

Measurement

Most modern aircraft measure airspeed by comparing total air pressure at the front of a pitot probe with static (still) air pressure measured elsewhere. The A330 has 3 pitot probes—2 on the left side and 1 on the right side—and 6 static ports (Figure 15 and Figure 16). On the A330 and A340, the pitot probes are about 2 m above typical eye level and cannot be closely inspected without an access stand (moveable platform). Specialised equipment is needed to detect internal contamination or leakages.

Figure 15: Airbus A330 pitot probe and static port positions

Source: Airbus

Figure 16: View of an exemplar A330 from eye level, with similar pitot probe covers to those used on the occurrence aircraft

Source: ATSB

The pitot probes had a tube that projected out from the fuselage, with the opening of the tube pointed forward into the airflow. The tubes had drain holes to remove moisture and were electrically heated to prevent icing during flight. The A330 uses UTC Aerospace Systems 0851HL pitot probes (Figure 17 and Figure 18), also used on Airbus A318, A319, A320, A321 and A340 aircraft.

Each of the A330’s pitot probes and static ports are connected to a separate air data module, which converts air pressure into digital electronic signals that are passed to one of the 3 ADIRUs.

Each ADIRU comprises two parts which are integrated into a single unit: an air data reference (ADR) part and an inertial reference part. One part can be switched off while the other part can still operate. The ADRs use total pressure and static pressure to compute indicated airspeed and Mach number, which are then passed to other systems including the flight deck instruments. The inertial reference part independently calculates parameters such as groundspeed.

Figure 17: Pitot probe external view

Source: ATSB

Figure 18: Pitot probe internal construction
 

Representative only; the drawing shows a Thales pitot probe and not a UTC Aerospace Systems pitot probe as used on 9M-MTK.

Source: Airbus

The ADRs feed each primary flight display (PFD):

• ADR 1 processes data from the captain’s pitot probe on the mid-lower left side of the airframe, digitised by the associated air data module, and is presented on the captain’s (left side) PFD.
• ADR 2 processes data from the first officer’s pitot probe on the lower right side of the airframe, digitised by the associated air data module, and is presented on the first officer’s (right side) PFD (identical to the captain’s PFD).
• ADR 3, processing data from the standby pitot probe on the lower left side of the airframe, digitised by the associated air data module.

The pitot probe and static ports used by ADR 3 are also used by the integrated standby instrument system (ISIS) for its display of air data.

Displays

The electronic flight instrument system displays comprise two PFDs, one in front of each pilot, showing mostly flight parameters, and two navigation displays (NDs) that show navigation data (Figure 19). The ISIS is to the right of the captain’s displays.

Figure 19: A330 instrument panel

Source: Airbus, annotated by the ATSB

Airspeed is normally displayed as a vertical tape on the left side of each PFD (Figure 20) and the ISIS (Figure 21), with altitude on the right of each. A speed trend (acceleration) vector is shown as a vertical yellow arrow when airspeed is above 30 kt, and V₁ is shown with a ‘1’ symbol. Groundspeed is displayed at the top left of the NDs (Figure 22).

Figure 20: PFD on a typical take-off, showing airspeed scale (left) at 120 kt

Source: Airbus

Figure 21: ISIS showing airspeed (left) at the bottom of the scale (30 kt)

Source: ATSB

Figure 22: Groundspeed indication on ND

The ND has a number of selectable display modes, including weather radar as shown.

Source: Airbus

An air data switch on the switching control panel, at the forward end of the centre pedestal, permits the flight crew to change the source of air data for one of the PFDs to ADR 3 (Figure 23 and Figure 24). An overhead panel shows the status of each ADIRU and allows the flight crew to turn the air data or inertial part of each ADIRU off separately.

Figure 23: Air data switch
 

Source: ATSB

Figure 24: Part of the operator’s safety reporting process, also used for general safety risk management

 Source: Airbus

Validity monitoring

The air data system has a complex and interrelated set of rules to evaluate the validity of data from the sensors. ADIRUs, flight control computers, and other equipment continuously conducts various validity checks, including the following:

• Airspeed is not recorded or displayed to the flight crew when it has a calculated value below 30 kt.
• When the aircraft is on the ground, airspeed is below 30 kt and groundspeed above 50 kt, the associated PFD displays a red speed flag (similar to Figure 25). The ISIS will show airspeed at the bottom of the scale at 30 kt under these conditions, and a speed flag for some other failures of the third air data system.
• Generally when all airspeeds are above 90 kts on ground, or at all times in flight, the flight control system uses the median value of the 3 sources. If any of the sources deviates from the median by more than 16 kt for at least 10 s:
  • that airspeed source is considered invalid
  • the associated ADR is rejected (no longer used)
  • the NAV IAS DISCREPANCY (navigation indicated airspeed discrepancy) message and master caution are presented if the airspeed source was displayed on a PFD.
• If an ADR is rejected or flags its data as invalid and there are then differences between the two remaining sources of more than 16 kt for at least 1 s, the remaining ADRs are rejected and the NAV ADR DISAGREE (navigation ADR disagreement) message and master caution is presented.
• Angle of attack is flagged invalid when airspeed is invalid or below 60 kt.

A rejected ADR is not used by the electronic flight control system (which manages control surface movement). Autopilot and autothrust require two or three valid ADRs.

Figure 25: Speed flag on left of PFD (indicative)

This is a composite image and does not exactly reproduce the aircraft display.

Source: Airbus, modified by the ATSB

Alerts on take-off

The flight warning computer inhibits some warnings and cautions for each of the 10 predefined flight phases. Most warnings and cautions are inhibited (temporarily disabled) during some phases, including take-off, to prevent flight crew distraction from more important and time-critical tasks. In these phases, failures that require immediate crew action or affect the safety of flight (such as fire detection) remain active.

Warnings and cautions that are not considered by the manufacturer to be essential to safety in certain flight phases are inhibited (prevented from being displayed) if they appear in those phases. This is to avoid unnecessarily alerting the pilots at times of high workload (such as take-off or landing). They are displayed in the next flight phase for which they are not inhibited if the condition still exists. Examples are listed in Table 1.

Table 1: Selected warnings and cautions and applicability during take-off

Annunciation	Description	Availability during take-off	Alert level	Alert type
NAV IAS DISCREPANCY	With 3 valid airspeed sources, one airspeed source deviates from the median by more than 16 kt for at least 10 seconds	Active after the aircraft reaches 80 kt, but may not always trigger as it requires all airspeeds to be above 30 kt, and a 16-kt discrepancy to remain present for at least 10 seconds	Caution	Aural and visual
NAV ADR DISAGREE	After an ADR is rejected or flags its data as invalid, there are then differences between the two remaining sources of more than 16 kt for at least 1 second	Inhibited	Caution	Aural and visual
NAV ADR 1 FAULT	Fault within ADR(s) or absent data from ADR(s)[35]	Inhibited after 80 kt if valid airspeed is available	Caution	Aural and visual
NAV ADR 1+2 FAULT
NAV ADR 1+2+3 FAULT	Warning	Aural and visual
ENG FIRE	Engine fire detected	Active except from V1 to 15 seconds after lift-off	Warning	Aural and visual
APU FIRE	Auxiliary power unit fire detected	Active except from V1 to 15 seconds after lift-off	Warning	Aural and visual
(speed flag on PFD)	Invalid airspeed (below 30 kt)	Active after groundspeed exceeds 50 kt	Warning[36]	Visual

Back up speed scale

The back up speed scale (BUSS), fitted to 9M-MTK, has been available as standard fitment on the Airbus A380, and as an option on the A330/A340 since 2006 and the A320 series since 2007, with a reported cost of about €300,000 per aircraft in 2010.^[37]

The BUSS is activated by turning off all the ADRs. The BUSS then provides flight crews with a visual indication of the safe speed envelope related to angle-of-attack, obtained through the inertial reference part of the ADIRUs (Figure 26). The airspeed tape on the PFDs, or speed flag if present, is replaced with a colour-coded scale. The pilot flying (PF) maintains the indication within the green zone by adjusting pitch and thrust. Since turning the ADRs off makes static pressure unavailable, pressure altitude is replaced with GPS altitude (Figure 27).

Figure 26: Back up speed scale display
 

Source: Airbus

Figure 27: Back up altitude display with BUSS active

Source: ATSB

With the BUSS active:

• the flight crew adjusts aircraft pitch and thrust to keep the indicator within the green area of the speed scale
• the stall warning remains operational
• cabin pressure must be controlled manually
• the flight crew are not permitted to use speed brakes (because this affects the relationship between angle-of-attack and airspeed and will cause the BUSS to display erroneous data)
• the flight crew should aim to change the aircraft configuration (extending or retracting flaps or landing gear) with wings level and aim to do so when the indicator is within specific regions of the green band.

Flight crew information

The captain had flown for Malaysia Airlines since 1993 on Boeing 747 and 737 variants, transferring to the Airbus A330 in May 2017 and cleared to line operations in the A330 in September 2017. The FO had flown for the operator since 2009 on the Boeing 737, transferring to the Airbus A330 in 2011. Both pilots held the appropriate qualifications to conduct the flight.

The captain had 14,411 total flying hours, including 555 on the A330. The FO had 6,544 flying hours, including 4,583 on the A330.

The flight crew had arrived in Brisbane on 16 July and had 48 hours’ opportunity to rest before the flight. The captain reported feeling adequately rested.

Further flight crew details are in Appendix B.

Flight crew procedures

See Activities and duties in preparation for flight for information about the flight crew walk-around procedure.

General principles

Flight crew procedures and guidance were tailored to the operator from standard Airbus documents, and comprised the:

• flight crew operating manual (FCOM), which included information about the aircraft systems, performance information, loading data, and standard operating procedures
• quick reference handbook (QRH) for in-flight reference of some procedures and performance information
• flight crew techniques manual (FCTM) containing supplemental guidance material.

The operator also had an operations manual for general policies and procedures not specific to aircraft types.

The FCTM stated that the PF is required to ‘monitor and control the pitch attitude, bank angle, airspeed, thrust, sideslip, heading, etc., in order to achieve and maintain the desired targets…’ The PM was required to ‘actively monitor’ flight parameters and call out any excessive deviation. This role was described as ‘very important’.

According to the relevant policies, flight crew were required to announce and confirm the initiation of any procedure, as well as changing aircraft settings other than flight control, thrust manipulation, seat adjustment and the like.

On first recognition of an abnormal situation or emergency that requires a procedure to be completed, the crewmember who first recognised the situation was required reset the master warning/caution if applicable. For each ECAM procedure, the pilot monitoring was required to call out the title of the applicable procedure. This allowed each pilot to be aware of the situation and be prepared to react correctly in regard to standard operating procedures, crew coordination, task sharing and communication.

In some time-critical situations, there may be critical actions of a procedure that the flight crew must apply immediately by memory to ensure a safe flight path rather than refer to the ECAM or QRH. If the procedure has memory items the flight crew must carry them out before any other actions, while calling the relevant procedure using specific terms, such as ‘unreliable speed’.

The FCTM stated:

The flight crew must ensure a safe flight path. If the safe conduct of the flight is affected, the flight crew applies the memory items.

The memory items enable to rapidly establish safe flight conditions for a limited period of time in all phases of flight and in all aircraft configurations (weight and slats/flaps).

The flight crew must apply the memory items, if they have a doubt on their ability to safely fly the aircraft in the short term with the current parameters, i.e.:

-    The flight crew has lost situation awareness, or

-    The current pitch and thrust are not appropriate for the current flight conditions, or

-    The aircraft has an unexpected flight path for the current flight conditions.

There were ten A330 procedures with memory items:

• loss of braking
• emergency descent
• stall recovery
• stall warning at lift off
• unreliable speed indication
• EGPWS cautions
• EGPWS warnings
• TCAS warnings
• windshear
• windshear ahead

After the memory items are complete, the PF should then command applicable ECAM or QRH actions. This prompts the pilot monitoring (PM) to manage the failure by first confirming the failure and then conducting the procedure as displayed electronically or with the QRH carried in the flight deck.

In abnormal operations the following principles applied, as written in the FCTM:

It is the responsibility of the PF to:

-    FLY ^[38]

-    NAVIGATE

-    COMMUNICATE after the initiation of:

-    The ECAM actions, or

-    A QRH procedure.

It is the responsibility of the PM to:

-    MONITOR the flight path and the navigation

-    Perform ECAM actions or apply QRH/OEB^[39]

The FCTM stated that the PF takes over communication duty from the PM in abnormal operations because ‘the cognitive skills of the PM are mostly dedicated to the understanding and the application of the ECAM/QRH/OEB actions. Therefore, their situation awareness of the environment and the navigation is less effective than the PF’s one.’

The FCTM stated that the flight crew must pause any normal or abnormal procedures or ECAM actions currently underway to perform the After Take-off/Climb procedure (or any other normal procedure that is due), stating:

The flight crew must perform the pending normal C/L [checklist (procedure)] at this stage as it is a good compromise between the necessary application of ECAM procedures and system analysis and the delay in the check of systems status (e.g. in the case of failure after takeoff, flaps and landing gear retracted)

Pre-flight procedures

The relevant parts of the Preliminary cockpit preparation procedure and the Before start checklist are shown in Figure 28 and Figure 29 respectively.

The Preliminary cockpit preparation procedure required the pilot monitoring to check that the gear pins and covers (meaning pitot probe covers and the like) were stowed onboard (in the flight deck), followed by the external aircraft walk-around. More information on the walk-around is in Flight crew walk-around procedure.

The first item of the Before start procedure required the crew to both confirm that they had previously completed the Preliminary cockpit preparation procedure.^[40] The second item of the Before start checklist was for the flight crew to cross-check that the ‘gear pins and covers’ had been removed. Since this is after the completion of the flight crew walk‑around and flight deck compartment check (both part of the Preliminary cockpit preparation procedure), this item effectively reconfirms the findings of those checks with regard to the gear pins and covers.

Figure 28: Extract from Preliminary cockpit preparation procedure
 

Source: Malaysia Airlines

Figure 29: Before start checklist
 

Source: Malaysia Airlines

Take-off procedure

Tasks and monitoring

During a take-off, the PF is required to set take-off thrust, maintain directional control along the runway centreline and occasionally scan the engine instruments and airspeed. The PM is required to monitor engine instruments and airspeed.

The take-off procedure as written in the QRH is provided in Figure 30, and additional guidance from the FCOM is provided in Figure 31. The 100 kt announcement (by the PM) and cross-check (by the PF) must be referenced using airspeed. The PM is required to monitor for an automatic callout at V₁; if it is not made, the PM must announce it.

Figure 30: Take-off procedure in QRH

Source: Malaysia Airlines

Figure 31: Take-off guidance in FCOM

EPR and EGT are engine parameters.

Source: Malaysia Airlines

In addition to the required actions, it is normal for both flight crewmembers to perform some monitoring of things that are not their primary responsibility. For example, the PF may check flight and engine instruments and the PM may look outside the aircraft to check for traffic and monitor the aircraft’s course.

The PF normally rotates to 15° pitch attitude then follows the aircraft’s speed reference system (SRS) guidance, which provides an indication of the required pitch attitude to maintain a predetermined climb speed in the current configuration. The autopilot can be used to follow the SRS. In alternate law, SRS is not available.

Rejected take-off

The Malaysia Airlines operating procedures stated that the captain held sole responsibility for the decision and action to reject the take-off or continue.

The FCTM included guidance to assist captains with their decision-making process, and provided standard terminology for take-off decision callouts:

It is … recommended that the Captain keeps his hand on the thrust levers until the aircraft reaches V1, whether he is Pilot Flying (PF) or Pilot Monitoring (PM).

-    If a malfunction occurs before V1, for which the Captain does not intend to reject the takeoff, he will announce his intention by calling "GO".

-    If a decision is made to reject the takeoff, the Captain calls "STOP". This call both confirms the decision to reject the takeoff and also states that the Captain now has control. It is the only time that hand-over of control is not accompanied by the phrase "I have control".

The take-off is divided into two phases: low speed (below 100 kt) and high speed (above 100 kt). Guidance on the decision-making for a rejected take-off from the FCTM is shown in Figure 32.

Figure 32: Rejected take-off decision guidance in FCTM
 

ENG: engine. F/CTL: flight control. EGT: exhaust gas temperature.
Source: Malaysia Airlines

Unreliable airspeed procedure

Detection

Erroneous (or unreliable) airspeed can be detected in a number of ways, including:

• the aircraft detects a problem and alerts the flight crew through:
  • a speed flag on the PFD
  • an ECAM alert
• the flight crew detect a problem directly, through:
  • observing abnormal airspeed values or trends
  • comparing any of the three airspeed displays throughout the take-off, all of which can be seen from both flight crew positions
  • performing the 100 kt cross-check.

Airbus analysis of reported unreliable airspeed events at take-off found that all significant airspeed anomalies appeared before the aircraft reached 100 kt.

The FCTM stated:

The ADRs detect most of the failures affecting the airspeed or altitude indications. These failures lead to:

-    Lose the associated speed or altitude indications in the cockpit

-    Trigger the associated ECAM alerts.

However, there may be cases where an airspeed and/or altitude output is erroneous, while the ADRs do not detect it as erroneous. In such a case, no ECAM alert is triggered and the cockpit indications may appear to be normal whereas they are actually false. Flight crews must have in mind the typical symptoms associated with such cases in order to detect this situation early and apply the "UNRELIABLE SPEED INDICATION" QRH procedure.

The FCTM detailed the effects in normal flight, with one erroneous ADR, and with two or three erroneous but different ADR outputs. The FCTM additionally provided the following case (in entirety):

ONE ADR IS CORRECT, BUT THE OTHER TWO ADRS PROVIDE THE SAME ERRONEOUS OUTPUT, OR IF ALL THREE ADRS PROVIDE CONSISTENT AND ERRONEOUS DATA:

The systems reject the correct ADR and continue to operate using the two erroneous but consistent ADRs. The flight crew can encounter such a situation when, for example, two or all three pitot tubes are obstructed at the same time, to the same degree, and in the same way. (Flight through a cloud of volcanic ash, takeoff with two pitots obstructed by foreign matter (mud, insects)).

Regarding differences between airspeed indications the FCTM stated:

The most probable reason for erroneous airspeed and/or altitude information is an obstruction of the pitot and/or static probes. Depending on how the probe(s) is obstructed, the effects on cockpit indications differ.

It is highly unlikely that the aircraft probes will be obstructed at the same time, to the same degree and in the same way. Therefore, the first effect of erroneous airspeed/altitude data in the cockpit will most probably be a discrepancy between the various indications (CAPT PFD, F/O PFD and STBY instruments).

ATSB observation Although the A330 flight crew techniques manual correctly stated that an ADR would be rejected by aircraft systems with two erroneous yet similar air data indications, it incorrectly stated that the same effect would also occur in the case of three erroneous yet similar air data indications. However, the ATSB considered it very unlikely that two flight crew members faced with this scenario would both misunderstand the description to the extent that it would lead to an incorrect diagnosis of the problem or an incorrect response.

The FCTM provided five non-exhaustive examples of airspeed failure cases and their varying consequences, and explained in detail the effects of pitot probe obstruction during flight, where ice blockages are a significant hazard. One example discussed the effects of total pitot obstruction due to foreign objects, one of the effects of which was constant indicated airspeed. There were no examples specific to the take-off phase of flight. The FCTM stated:

It should be noted that the cases described … cover situations where probes (eg pitot) are totally obstructed. There can be multiple intermediate configurations with similar, but not exactly identical consequences. The … table clearly illustrates that no single rule can be given to conclusively identify all possible erroneous airspeed/altitude indications cases.

In correspondence with ATSB in 2021, Airbus emphasised the importance of flight crew monitoring on take-off, stating that the known causes of unreliable airspeed would lead to the condition being detectable by pilots prior to 100 kt.

Management

When detecting erroneous airspeed, the observing pilot is required to immediately call ‘unreliable speed’ and the flight crew then apply the Unreliable speed indication procedure. The procedure is not associated with an ECAM message. This procedure stated that if the ‘safe conduct of the flight is impacted’ the flight crew were required to carry out a set of memory items which included:

• autopilot, autothrust, and flight directors off
• pitch and thrust:
  • 15° pitch and take-off/go-around (TOGA) thrust (when below the thrust reduction altitude^[41]
  • 10° pitch and climb thrust (when between the thrust reduction altitude and 10,000 ft)
  • 5° pitch above 10,000 ft
• maintain flap configuration, or set to configuration 3 if full flaps are set
• retract speedbrake and landing gear
• level off for troubleshooting when at or above the minimum safe altitude or circuit altitude.

The Unreliable speed indication procedure did not give separate instructions for take-off. There was no specific instruction or guidance in the flight manuals on the type or number of unreliable airspeed indications for which a take-off should be rejected. In a March 2021 article of the Airbus Safety First magazine^[42] titled Unreliable airspeed at takeoff, Airbus stated that a ‘flight crew should be prepared to reject the takeoff at the time of the 100 kt crosscheck if an airspeed discrepancy is observed.’

When a safe flight path is assured, the flight crew can level off and maintain a safe speed using tables in the QRH that provide pitch angles and thrust settings (these vary depending on the aircraft’s altitude, weight, and configuration).

When all ADRs are affected or the flight crew cannot identify the faulty ADR(s), and the aircraft is below flight level 250, the flight crew are required to switch OFF all ADRs, activating the BUSS.

Training

Unreliable airspeed indication is a standard training scenario delivered to most pilots, usually simulated during climb, cruise or descent. Anecdotally, specific training for unreliable airspeed on take-off is rarely, if ever, part of an airline’s regime. The operator’s pilots received separate training and guidance on unreliable airspeed and rejected take-off scenarios separately, but there was no specific guidance for unreliable airspeed on take-off in the aircraft flight manuals, and the occurrence pilots did not receive training for this situation

Non-mandatory additional guidance

A number of articles published by Airbus in its Safety First magazine addressed unreliable airspeed in flight and during take-off. A 2007 article stated:

An unreliable speed situation may be difficult to identify, due to the multiple scenarios that can lead to it. Therefore, training is a key element: indeed the flight crew’s ability to rapidly detect the abnormal situation, and to correctly handle it, is crucial. In case of any doubt, the pilot should apply the pitch/thrust memory items, and then refer to the QRH to safely fly the aircraft, and to positively determine the faulty source(s) before eliminating it (them).

With regard to take-off, a later article stated (Airbus 2021):

Early detection of an unreliable airspeed event will enable the flight crew to reject the takeoff at a lower speed. From the start of the takeoff roll, the pilot monitoring must check for inconsistent airspeed indications, abnormal airspeed trends, or the absence of airspeed indications, and alert the pilot flying as early as possible if an issue is detected.

In correspondence with the ATSB, Airbus later confirmed that a flight crew has to consider rejecting the take-off if unreliable airspeed is observed before reaching 100 kt. Articles that addressed unreliable airspeed during take-off advised to reject the take-off if unreliable airspeed is observed before the decision speed. The 2021 article stated:

The 100 kt crosscheck is the last line of defense to prevent taking off with an unreliable airspeed indication. The flight crew should be prepared to reject the takeoff at the time of the 100 kt crosscheck if an airspeed discrepancy is observed.

An earlier Safety First article (Airbus 2006) also advised pilots to ‘abort their take-offs when airspeed indication is detected unreliable’, adding:

…after take-off thrust setting, both crewmembers should scan airspeed indications. In case of detection of an unreliable condition of one of the airspeeds before V₁, take-off should be aborted.

In some articles, Airbus advised flight crews to follow the Unreliable speed indication procedure in all flight phases, including take-off (Airbus 2007):

If the safe conduct of the flight is affected, the flight crew applies the memory items: these allow “safe flight conditions” to be rapidly established in all flight phases (take-off, climb, cruise) and aircraft configurations (weight and slats/flaps). The memory items apply more particularly when a failure appears just after take-off.

A further Safety First article about ice ridges (which can form on the ground in cold conditions and disrupt airspeed measurements during take-off) similarly advised (Airbus 2018):

What to do in the case of an unreliable speed event during takeoff?

…in any event where an airspeed discrepancy is detected by the flight crew, the UNRELIABLE SPEED INDICATION must be applied. Refer to FCOM UNRELIABLE SPEED INDICATION procedure and associated FCTM chapter for more information on the procedure application.

With regard to how unreliable airspeeds will appear to pilots, the 2006 Safety First article gave an example where an aircraft had two simultaneous and near-identical pitot probe blockages on take-off and discussed the potentially very serious effects of this scenario on aircraft controllability, particularly at higher speeds. Conversely, a later article titled The Adverse Effects of Unrealistic Simulator Scenarios stated (Airbus 2019):

Multiple Pitot obstructions can never occur exactly at the same time and can never have permanently the same obstruction characteristics [over] time. This is fundamental because multiple Pitot obstructions will undoubtedly lead to airspeed discrepancy detected by the flight control system which, in this case, will reject the erroneous airspeed information and associated ADR and revert to alternate law.

This 2019 article was about training scenarios that simulate simultaneous blockage of both openings in multiple pitot probes (which has different effects to this occurrence), arguing that it is not a realistic training scenario because such an occurrence had never happened in operation.

In 2021, the ATSB asked Airbus for its recommendation for how flight crews should respond to an airspeed discrepancy that is identified after 100 kt but before V₁. Airbus stated that:

…above 100kts, and approaching V₁, the Captain should be "go-minded" and only reject the takeoff in very few occasions such as sudden loss of thrust, any indication that the aircraft will not fly safely, any triggering of ECAM alert. Thus, UAS [unreliable airspeed] events do not belong to the events that the crew has to consider for discontinuing the take-off above 100 kt.

In further correspondence in 2022, the ATSB asked Airbus to provide further guidance on specific scenarios (such as the single complete loss of airspeed detected before the 100 kt airspeed check, or scenarios where unreliable airspeed was detected at 100 kt). Airbus responded that the decision to continue or reject a take-off lies with the captain and that all significant unreliable airspeed events were present from low speed and were detectable before 100 kt. The French Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) and Airbus advised the ATSB that they ‘do not consider that there is a need to specifically address the case of unreliable airspeed being identified after 100 kt.’

Sterile flight deck procedure

The purpose of a sterile flight deck is to focus the flight crew’s attention on their primary operational duties, usually applied during the departure and approach phases of flight. In these periods, pilots are not permitted to engage in non-essential conversations that are not pertinent to safe aircraft operation or to engage in any activity which could distract any flight crew member from the safe conduct of their duties.

The operator’s sterile flight deck policy was outlined in its operations manual. It stated the requirements for departures which included:

The period shall be in effect during critical phases of flight. Critical phase of flight involves all ground operations from taxi, take-off, landing, and all other flight operations below 10,000 feet above mean sea level, except cruise flight.

Specifically, the departures phase was defined as:

…from pushback (or as determined by the PIC [pilot in command; i.e. captain] due operation reasons) until the Fasten seat belt sign is switched off during climb.

Flight crew training

Flight crew training overview

Malaysia Airlines flight crews were required to complete recurrent training and checks. Normal procedures were assessed during aircraft flights (line checks) and simulator sessions (recurrent training and proficiency checks). Abnormal and emergency procedures such as unreliable airspeed and rejected take-off scenarios were included in simulator training and proficiency checks. Several recurrent elements would be trained or assessed in each session, with full coverage expected over a period of years (3 years in Australia).

In flight operations generally, assessable skills can be divided into two categories:

• technical skills: the manipulative and knowledge skills a pilot employs while operating an aircraft
• non-technical skills (NTS): the cognitive, social, and personal resource skills that complement technical skills and contribute to safe and efficient task performance (Flin and others 2008).

The operator graded performance in technical skills for line and proficiency checks using a 5‑point scale with the option for the trainer to provide additional information about each grading by marking one or more reason codes. The 7 reason codes were split into domains (knowledge, skills, and affective) and global markers (communications and communication environment, leadership, situation awareness, and decision-making).

NTS was evaluated and separately graded at each training session, proficiency check, and line check. The operator defined 10 assessable NTS elements (such as monitor/cross check, workload assignment and management, assertiveness and receptiveness), and 3 phases of flight to which some or all elements applied (before take-off, take-off to cruise, and descent to taxi). This meant the evaluator marked a total of 26 NTS elements during each flight crew assessment. NTS grades used a 3-point scale: satisfactory, satisfactory with briefing, and unsatisfactory. Behavioural markers (observable behaviours) for each skill were defined.

The ATSB compared the Malaysia Airlines approach to NTS evaluation with that of 4 other airlines operating in Australia and New Zealand. These operators all provided 4–5 NTS markers among the reason codes for grading technical skills, and only one graded NTS separately to technical skills (using a 5-point scale).

ATSB observation Unlike most other reviewed operators, Malaysia Airlines assessed NTS separately to technical skills. This probably provided significant advantages over the method of evaluating NTS only as markers for the performance of technical tasks. This was with a 3-point grading scale, whereas the other operator that evaluated NTS separately used a 5-point scale.

The flight crew’s most recent simulator proficiency checks and recurrent training were in January 2018 (captain) and March 2018 (FO). They were assessed as meeting the operator’s standard. The captain was debriefed on standard operating procedures, ECAM management, task management and problem solving. The FO was debriefed on monitoring/cross-checking and assertiveness.

Flight crew walk-around

The captain was last assessed in external visual inspection of the A330 in September 2017, receiving a grading of 3 (‘consistently meets and sometimes exceeds expectations’). The captain’s only other assessments on record for the flight crew walk-around since 2015 were during line checks on the 737, for which the captain received one grading of 4 (‘consistently exceeds expectations and sometimes only meets expectations’) and one grading of 5 (‘consistently exceeds expectations’ and ‘no area for improvement is readily identifiable’).

In interview, the captain said that the walk-around training took about an hour. The captain described the flight crew walk-around as ‘cursory’. The captain reported that they were not shown what a static or pitot probe cover looked like during walk-around and had not seen them before, other than on aircraft in storage from a distance.

Unreliable airspeed indication

Both flight crew demonstrated competency separately in an unreliable airspeed scenario during their last recurrent training in early 2018. Records showed that both received ‘satisfactory with briefing’ gradings on the element relevant to this scenario. The records did not state the phase of flight where this scenario was applied; the FO recalled theirs to be during the cruise phase and stated that they had not received training for unreliable airspeed during take-off, and until this occurrence did not know whether to reject the take-off. Both flight crew had used the BUSS during the scenario.

The captain’s training record had check marks in the ‘knowledge’, ‘affect’, and ‘situational awareness’ reason boxes and remarks indicating that a briefing was conducted on the application of the unreliable airspeed procedure and flight path management.

The FO’s training record had check marks in the ‘knowledge’ reason box and remarks indicating that there was a briefing on assertiveness and knowledge.

Rejected take-off

Pilots were required to complete a proficiency check in a simulator every 6 months, and it was mandatory for pilots to be assessed in rejected take-off procedures during that check. Anecdotally, rejected take-off scenarios are commonly associated with ECAM alerts and engine failures.

Both flight crew had been assessed in the conduct of a scenario described as ‘a rejected take-off at a reasonable speed before reaching V1’ during their last proficiency checks, each receiving a grading of 4.

The captain had been assessed on this element for the A330 on only one other occasion, receiving a grading of 3. The captain previously received gradings of 4 or 5 in proficiency checks for the 737.

The FO had been assessed on this element for the A330 on several occasions in the previous 3 years, receiving a grading of 4 each time.

Non-technical skills

In the 2 years prior to the occurrence, the captain was assessed for NTS 5 times and the FO was assessed 10 times. They each mostly received almost entirely ‘S’ gradings with the following relevant exceptions:

• on the captain’s most recent assessment, they received a ‘satisfactory with briefing’ grading for the ‘monitor/cross check’ element for the flight phase from take-off to cruise, and the phase from descent to taxi.
• the FO received ‘satisfactory with briefing’ gradings for the ‘assertiveness’ and ‘monitor/cross check’ elements in March 2018 and August 2017 respectively.

Study on flight crew take-off monitoring

In 2018/19, a study of flight crew monitoring in an Airbus A380 simulator was conducted using specialised eye-tracking equipment (Knabl and others 2018). It examined aspects of instrument monitoring for several captains and first officers as both PF and PM, including how this affected their decisions to continue or reject a take-off with a simulated engine failure at 10 kt before V₁ (a period of about 3 s) when presented with ‘ambiguous cues in a time-critical situation’. The cues were abnormal engine indications and a slight yaw movement to simulate an engine failure with limited cues:

A non-critical engine failure (ENG [engine] 2 flame-out) occurred at V₁-10kt which was set at 119kt. No ECAM [message] was triggered but the ENG failure could be identified by monitoring the engine display. Moreover, a slight yaw movement of the aircraft would have served as a cue which would have been easier to detect for the PF than the PM.

There were no master warning/caution alerts generated by the simulated engine failure. A total of 13 scenarios were observed, with a captain being assigned as PF on 6 occasions and PM on 7 occasions.

The participants generally reported having a ‘more active monitoring’ behaviour than usual, including more attention on the instruments, due to the nature of the test and their expectation that something would go wrong. It should also be noted that the flight crews were being examined on their ability to detect changes on a different display (the engine/warning display in the centre of the instrument panel) than the PFD.

The study found that:

• visual behaviour (scan patterns) ‘differed greatly’ among the pilots
• 6 crews rejected the take-off and 7 continued
• 6 of the 7 captains in the PM role continued the take-off, while 5 of the 6 captains in the PF role rejected the take-off
• for crew who continued the take-off, the PM spent ‘considerably’ more time looking outside (particularly those qualified as captains), and less time looking at the PFD, to those who rejected the take-off
• the PM of crews who rejected the take-off generally spent more time looking outside than PMs of crews who continued, and less time looking at the PFD
• overall, above 100 kt, the PF primarily looked at out of the windscreen (82% of the time) followed by the PFD (9%)
• above 100 kt, the PM primarily looked at the PFD (40% of the time) and out of the windscreen (35%)
• two PMs (who were also both captains) were looking at the engine instruments at the time of the simulated failure but did not respond (‘looking without seeing’).

Aeronautical charts

En route supplement Australia

General information

Australian regulations required an aerodrome operator to ensure sufficient information about the aerodrome was published in the En Route Supplement Australia (ERSA).^[43] These include runways specifications and local precautions. The ERSA contains information used for planning a flight and for the pilot in flight.

The manual of standards for Civil Aviation Safety Regulation (CASR) Part 139 – Aerodromes provided further details of the information to be included in the ERSA. This included the width and lighting information for each runway and ‘important cautionary or administrative information relating to the use of the aerodrome’. For example, the ‘additional information’ section of the ERSA for the aerodrome was also required to include ‘significant local data’. For many Australian aerodromes, this section contained hazards such as birds or other animals, weather balloon launches, or the likelihood of turbulence on approach to a runway.

Brisbane airport En Route Supplement

From November 2015 onwards, the ERSA information for Brisbane Airport included a note regarding significant mud wasp activity, and the following other safety-relevant information:

2.   Significant bird hazard exists.

a.   Nankeen Kestrel (birds of prey), peak activity on airfield expected March-July.

b.   Australian White Ibis flocking on airfield HJ [sunrise to sunset], increased numbers expected February-June.

c.   Straw Necked Ibis present on airfield HJ, increased numbers expected July-October.

d.   Flying Fox HN [sunset to sunrise] only.

e.   Cattle Egret present on airfield HJ, increased numbers expected NOV-MAR.

f.    Increased pelican and cormorant in VCY of AD [vicinity of aerodrome].

3.   Significant mud wasp ACT WI AD VCY [activity within aerodrome vicinity] affecting pitot tubes. Pitot tube covers recommended.

The ERSA entry for Brisbane Airport also had information about the potential for false course capture from a navigation aid.

Lido route manual

Airport operational information

The Lido route manual, published by Lufthansa Systems, was used by Malaysia Airlines to provide charts and aerodrome information to its flight crew. The suite of documents included the airport operational information (AOI).

The Lido AOIs contain information about a particular airport. The AOIs are arranged into general, arrival, and departure chapters, with a subsection for ‘warnings’ in the general chapter. The Lido AOI warning information for Brisbane Airport included the same information as in the ERSA about the false course capture (but presented differently), and the following:

Birds in vicinity of AD [aerodrome], increased number expected NOV-MAR.

The ATSB compared the warning information in the 2020 Lido AOIs for Melbourne, Darwin, Perth, and Sydney with the relevant ERSA information. Melbourne and Perth closely aligned with the ERSA data. The Darwin AOI did not include information regarding unlit military helicopter operations in the area and the Sydney AOI did not include information about the hazard posed by a searchlight in the area.

Lido chart development process

The ATSB sought information from Lido about the content development, and revision process of its AOI. Lido stated that as the Lido route manual is designed to carry relevant information for pilots only, not all AIP content is transferred to the AOI. Lido’s guidance manual for such decisions stated that charts should include:

Caution notes for dangers such as bird hazards or strolling animals on RWY [runway] shall be published.

With regard to the expertise of the people involved, Lido advised the ATSB:

Generally, if a person applies to work for our Route Manual production, he or she shall have a strong aviation background (pilot, air traffic controller, dispatcher) or have long-term experience in the area of professional aviation. Then, after having applied successfully, the person undergoes training according to a team dedicated training concept. Amongst many other topics, the content of the QuickRef [Lido’s guidance manual] is part of this.

The relevant process flowchart provided showed a quality check at the end of production.

Other sources of aerodrome information

The Australia Airport Directory, a similar publication published by Jeppesen used by some other airlines operating in Australia, had the following in the Brisbane airport information section:

Significant mud wasp activity within apt [airport] vicinity affecting pilot tubes. Pitot tube covers recommended.

Pitot probe covers

Overview

Pitot probes can become blocked by a range of contaminants including dust, sand, water (such as rainwater, ice accumulation, condensation, or water used during washing), by the remains of insects or other animals after in-flight impact, or by the nesting activity of insects such as mud wasps.

Pitot probe covers provide protection from foreign object obstruction when the aircraft is on the ground. The need for pitot probe covers is dependent on a number of factors, such as the duration the aircraft is on the ground, and local factors such as wildlife and weather. There may be a formal requirement by operators to fit pitot probe covers in these circumstances. Because pitot probes are heated in-flight, maintainers need to wait 15-30 minutes for them to cool after landing before fitting covers (Airbus 2016).

Pitot probe covers typically incorporate a ‘remove before flight’ warning streamer (also known as a flag or ribbon) intended to alert relevant personnel of its presence. Streamers come in various lengths^[44] that are determined by a design specification, or locally fabricated as required. Visibility of the streamer may be improved by fitting an extended streamer or incorporating a lanyard between the cover and its streamer.

Pitot probe covers are regarded as ground service equipment (GSE). Other examples of GSE include towbars, landing gear lock pins and aircraft jacks. While there are some exceptions, GSE is not fitted to an aircraft for flight. GSE can be supplied by an aircraft manufacturer, be generic across multiple aircraft types, or be manufactured by a third party to be comparable in function, however sometimes it may be different in design. GSE manufactured by a third party or locally can be approved internally by operators as there are no regulatory requirements for GSE.^[45]

Pitot probe covers are typically supplied by the aircraft manufacturer with a new aircraft. Over time as they become worn, operators may choose to replace them with a cover manufactured by a third party. Airbus advised the ATSB:

Flight kit and its content (including Pitot covers) are referenced in the IPC [illustrated parts catalogue] (IPC 25-73-04-01). As such, it is part of aircraft configuration. Airbus recommends managing the flight kit and its content like any IPC item. If an operator uses alternative covers not included in the IPC, it is under its own responsibility. This is what is reminded in ISI [in-service information] 34.11.00026, section 5.6.4.

Malaysia Airlines pitot probe covers

At some time in 2018 prior to commencing flights to Brisbane, Malaysia Airlines supplied Aircraft Maintenance Services Australia (AMSA) with a set of Airbus-approved pitot probe covers (Figure 33). These were not fitted to the occurrence aircraft.

Figure 33: Airbus-approved pitot probe covers supplied by Malaysia Airlines to AMSA

Source: AMSA

Aircraft Maintenance Services Australia pitot probe covers

The pitot probe covers fitted to the occurrence aircraft were the property of AMSA, and manufactured by a company specialising in ground support equipment. AMSA fitted these covers to any operators’ A330 aircraft as part of AMSA’s compliment of equipment used during aircraft receipt and dispatch.

The pitot probe covers fitted to 9M-MTK were manufactured by Sesame Technologies with part number KPC4-480-321. They consisted of a triple-layer woven Kevlar sheath about 12 cm long, with a non-reflective 30 cm ‘remove before flight’ warning streamer attached by a short lanyard (Figure 34). They could be installed by hand using an access stand, or alternatively, a pair of loops at the opening of the cover enabled them to be fitted from the ground using a special pole. A single loop on the opposite end enabled them to be removed with the same pole. These poles were not used by AMSA.

Figure 34: Pitot probe covers removed from 9M-MTK after the occurrence flight, and exemplar covers of the same type

Source: ATSB

Airbus pitot probe covers

The pitot probe covers approved for use by Airbus are a synthetic fabric sheath 22 cm long (Figure 35 and Figure 36). The sheath is held in place on the pitot probe by spring clips. A 30 cm ‘remove before flight’ warning streamer is attached to the sheath by a 21 cm lanyard making the overall length of the streamer/lanyard assembly about 51 cm. This pitot probe cover is listed in the A330 illustrated parts catalogue as part number 98A10001005000, with an alternate part number of A1000100500000. There are no other alternatives approved by Airbus, which stated that ‘using the approved pitot probe covers is important as the covers for other manufacturers’ aircraft may not be the correct fit or offer complete protection for the pitot probes of Airbus aircraft’ (Airbus 2016).

Figure 35: Airbus-approved pitot probe cover with lanyard and streamer

Source: ATSB

Figure 36: Airbus-approved pitot probe covers fitted to the left side pitot probes of an A330

Source: Malaysia Airlines

Other pitot probe covers and flight deck warning placard

Some operators use extended streamers for improved visibility during turnaround operations in Brisbane (Figure 37) or flight deck placards to alert flight crews of the presence of covers (Figure 38). A manufacturer of pitot probe covers is developing a system to alert flight crews of the presence of covers with a visual indicator that attaches to an aircraft’s window (Figure 39).

Figure 37: Exemplar pitot probe covers with extended streamers for improved visibility

Source: ATSB

Figure 38: Exemplar flight deck warning placard placed on thrust levers
 

Source: Supplied

Figure 39: Visual indicator of probe cover fitment

Source: Sesame Technologies

Activities and duties in preparation for flight

Use of pitot probe covers

Brisbane Airport is the only port used by Malaysia Airlines with a known mud wasp problem, and one of a very small number worldwide where the use of pitot probe covers during short turnarounds is recommended to prevent insect infestation.

Malaysia Airlines sent one set of pitot probe covers to AMSA but had not formalised their use. The provisional contract with AMSA included a provision for AMSA to provide various covers, including for pitot probes, with no detail on requirements for their fitment.^[46]

AMSA was contractually required to use pitot probe covers for some other airlines in Brisbane. There was no written guidance on this subject issued by AMSA to its employees. AMSA managers and engineers reported that they preferred to use pitot probe covers for airlines that did not specifically request it, including Malaysia Airlines, because of the risk of mud wasp infestation.

The Malaysia Airlines technical handling manual did not require a technical log entry to record the fitment of pitot probe covers, but engineers were able to do so. When interviewed, AMSA managers stated that they expected a maintenance log entry would be made by an appropriately approved person for the fitment of pitot probe covers. The technical log is checked by flight crew prior to departure, and any open entry such as the fitment of pitot probe covers would require rectification before dispatch.

Of the 21 available technical logs of Malaysia Airlines A330 turnarounds in Brisbane between 9 June and 18 July 2018, 4 contained entries for the fitment of pitot probe covers. Covers might have been used on other flights but were not recorded.

Records showed that the AMSA support engineer had handled 4 other Malaysia Airlines aircraft in this period, as well as the occurrence aircraft. One of these was the 12 July turnaround for which a CCTV recording was available, where pitot probe covers were not used. Technical logs for the other 3 flights recorded the use of pitot probe covers once. This was the only turnaround for Malaysia Airlines that the support engineer recalled, reporting that they were instructed to fit (and later remove) the covers by the Malaysia Airlines engineer.

The Malaysia Airlines’ investigation report indicated that engineers had sometimes requested permission from the Malaysia Airlines engineers to fit covers or told the engineers that covers had been fitted. When asked, the Malaysia Airlines engineers typically instructed AMSA engineers not to install pitot probe covers when they were asked, due to the short turnaround time and because it was not a standard procedure for Malaysia Airlines. After the occurrence, the licensed aircraft engineer (LAE) heard from another engineer that, on at least one previous occasion, another of the Malaysia Airlines’ engineers had noticed that pitot probe covers were fitted and asked for them to be removed.

Flight crew

Flight crew walk-around procedure

The Malaysia Airlines operations manual stated:

Prior to each flight, maintenance must verify the airplane condition is acceptable for flight. The flight crew will also conduct a cursory walk around to verify the aircraft exterior is in a satisfactory condition. During the exterior aircraft inspection (walk-around), flight crew shall focus on safety critical areas of the aircraft and ensure that:

i.    The pitot and static ports are not damaged or obstructed

ii.    Flight controls are not locked or disabled (as applicable, depending on aircraft type);

iii.   Frost, snow or ice is not present on critical surfaces; and

iv.    Aircraft structure or structural components are not damaged.

The FCTM stated:

The objectives of the exterior inspection^[47] are:

-    To obtain a global assessment of the aircraft status. […]

-    To ensure that main control surfaces are in adequate position relative to surface control levers.

-    To check that there are no leaks. For example, engine drain mast, hydraulic lines.

-    To check the status of the essential visible sensors, i.e. AOA, pitot and static probes.

-    To observe any possible abnormalities on the landing gear status.

The FCOM stated:

The exterior walkaround ensures that the overall condition of the aircraft and its visible components and equipment are safe for the flight.

Complete inspection is normally performed by maintenance personnel or, in the absence of maintenance personnel, by a flight crewmember before each originating flight.

An accompanying illustration showed a path that the flight crew can take when conducting the walk-around (Figure 40). Numbers represent a pause point to inspect a particular section of the aircraft, each associated with a section of a list of 42 check items. All the pause points except numbers 5, 13 and 16 had check items, including number 2 for a condition check of the pitot probes (Figure 41). The check is done by memory.

The ATSB estimated that to walk directly through all the pause points in the recommended order would require a path of about 250 m, which would take about 3 minutes at average walking speed (1.4 m/s) if done without pausing.

Figure 40: Flight crew operating procedure illustration of the flight crew walk-around
 

Source: Malaysia Airlines

Figure 41: Extract from the flight crew walk-around procedure

Source: Airbus

Airbus provided operators with computer software that showed a narrated animation of a full flight crew walk-around, and enabled users to self-assess their recall of check items (Figure 42).

Figure 42: Airbus Virtual WalkAround software
 

Source: Airbus

Other guidance

In July 2016, Airbus published an article in its Safety First magazine titled Pitot Probe Performance on the Ground, which provided information about pitot probes and potential blockages, advising:

Always look at the Pitot probes carefully during the pre-flight exterior inspection and check that all of the covers are removed before flight. Ensure there is no damage to the Pitot probe and that the general condition is good. This will give confidence that the correct airspeed readouts will be available on all of the instruments in all flight phases.

Flight crew pre-flight walk-around for the occurrence flight

Figure 43 compares the flight crew walk-around check procedure with the path taken by the captain as recorded on the single-view video. While walking towards the aircraft, the captain shone a torch on the lower left forward fuselage area for a total of about 4 seconds, including towards the left upper pitot probe for about 1 second when about 7 m away. The captain did not shine the torch on the area of the left lower pitot probe, or on the right side of the nose where the third probe was located. After pausing to inspect the nose gear, the captain walked directly from the rear of the nose gear towards the front of the right engine, out of view.

About 30 seconds later, the captain’s torchlight could be seen for a few seconds as the captain moved from right to left under the fuselage near the main landing gear.

The torchlight then reappeared on the ground outboard of the left engine, before apparently being shone on the side of the left engine cowl (out of sight of the camera) for about 2 seconds. The captain then walked directly out of view to the gate entry point. The walk-around took about 1 minute 32 seconds to complete and the captain was not observed looking in detail at any part of the aircraft apart from the nose gear.

Figure 43: CCTV still image of 9M-MTK overlaid with the required flight crew walk-around path and the captain’s visible walk-around path.

Source: Brisbane Airport Corporation, modified by the ATSB

Engineering

Aircraft certification

At the time of the occurrence the technical handling (engineering) functions in Brisbane were the responsibility of the Malaysia Airlines licensed aircraft engineer (LAE). Technical handling tasks in Brisbane included:

• engineering inspections (a transit check)
• refuelling
• general maintenance
• rectifying defects
• certification of all engineering work.

The LAE’s assignment was to travel on a flight from Kuala Lumpur to Brisbane and conduct technical handling of that aircraft before it returned. After an overnight rest in Brisbane, the LAE would return to the airport in the evening and conduct technical handling of the next aircraft, and then board it for the return flight. In this way, one LAE would be assigned technical handling of two successive turnarounds in Brisbane across three days (with one rest day between), and then another LAE would be assigned the next two successive aircraft, and so on.

The LAE reported that they were informed by Malaysia Airlines that their task was to conduct transit and rectification duties in Brisbane, and would be receiving engineering support assistance. However, Malaysia Airlines did not provide details about who would be doing dispatch duties, or anything related to the requirements for the fitment of pitot probe covers in Brisbane.

The LAE involved with the occurrence aircraft had arrived on another aircraft on 16 July and performed defect rectification, inspections, and certification of that aircraft, aided by a different AMSA engineer. Neither engineer stayed with that aircraft for dispatch.

Engineering support

Throughout June and July 2018, AMSA provided security escort and technical assistance to Malaysia Airlines travelling engineers and did not provide aircraft certification or dispatch coordination. The organisations worked under written ad-hoc indemnity release agreements, signed on site by line personnel from both organisations at the time of each arriving flight. These agreements did not contain information about services expected or provided.

AMSA managers and engineers advised the ATSB that their understanding of AMSA tasking was to facilitate LAE access to the apron and provide general engineering assistance as instructed by the LAE on the day.

There was no agreement or procedure in place for the fitment of pitot probe covers and no written requirement for the support engineer to be present at the aircraft for arrival or at the time of dispatch.

The support engineer reported assuming that the ground handlers, being responsible for dispatch, would perform a final walk-around to check doors, gear pins, pitot probes, and the like. As a result, the support engineer did not think it was necessary to be present for dispatch.

Tool control

AMSA had documented tool control policies and procedures which required AMEs and licensed aircraft maintenance engineers (LAMEs) to record the removal of company tooling from its storage location. LAMEs were required to account for all tooling prior to certifying an aircraft for release to service. At the end of a shift, AMEs and LAMEs were required to account for personal tooling, and regional managers were required to review the movement of company tooling. Tooling that for operational reasons remained away from its storage location at the end of a shift, was to be recorded in the shift handover diary by the regional manager.

AMSA supplied basic tooling specific to aircraft turnarounds in a transit toolbox. This included a headset to communicate with the flight crew, marshalling wands, and a steering bypass pin^[48] specific to an aircraft type. Additional items such as pitot probe covers could be added to the transit toolbox as required. The relevant procedure required its removal from its storage location be recorded, and for its return to be recorded along with a condition check of the items it contained.

According to interviewed engineers, at the time of the occurrence, transit toolboxes (containing pitot probe covers) were being removed from their storage location without the action being recorded.

Transit check requirements

Malaysia Airlines technical handling manual required that the aircraft undergo a transit check (a type of engineering inspection) while in Brisbane. This required certification in the technical log when completed. The LAE indicated that there were paper copies of the transit check sheets available in all company aircraft as a reference. The LAE stated that they did not use a paper copy as they were very familiar with the check requirements.

The requirement to check various items on the aircraft exterior was not described as a ‘walk‑around’, but it was likely to be done in that way for the sake of convenience (for example, it would make sense to check the nose landing gear while checking other items near it, rather than returning later). For simplicity, this report refers to this element as an ‘engineering maintenance walk-around inspection’.

The transit check procedure began with tasks mainly related to verifying the aircraft’s airworthiness, and later tasks were primarily concerned with verifying the aircraft’s general condition (that no damage had been incurred during the turnaround) and readiness for flight. It had the following general sequential structure:

• initial parking
• check technical log for reported defects
• check engine oil, hydraulic oil, auxiliary power unit oil, and conduct other similar tasks (from cockpit indications)
• check fuselage, empennage, engines, wings, landing gear, and doors for damage, leaks, missing fasteners, and the like
• check pitot probes, angle of attack sensors, static ports and their surrounding areas for ‘obvious damage’
• check interior and conduct interior maintenance tasks
• refuel the aircraft.

After refuelling, the following tasks were required:

• ‘remove all landing gear lockpins, engine blanks, airframe blanks and pitot covers if installed’
• check air intakes for foreign objects or obstruction
• check all doors and panels are closed and secured
• ‘perform a walkaround inspection of the aircraft exterior. Identify and report external damage found’
• ‘verify that no tools are being left in the aircraft and any tools loaned out from the Tool Crib are returned prior to aircraft departure’
• check all required documents are on board
• certify (sign) that a transit check has been performed
• depart the aircraft.

Review of the CCTV footage indicated that the LAE conducted a transit check walk-around which appeared to follow the correct path of the transit check procedure up to the point of refuelling the aircraft. This walk-around of the aircraft took the LAE about 12 minutes.

Following the aircraft refuelling, the transit check takes on a preparation for flight aspect to ensure that the aircraft is correctly configured for flight with panels and doors closed, tools, blanks, and covers removed. The portion of the transit check following the refuelling of the aircraft was not undertaken.

Ground handling

Ground handling functions

Menzies provided Malaysia Airlines with ground services including ramp support, equipment, towing/pushback of aircraft, and dispatch coordination from the commencement of flights on 6 June 2018. Menzies ground handlers in Brisbane routinely performed dispatch coordination for 3 operators, including Malaysia Airlines. Menzies did not have the capability to provide engineering services in Brisbane.

Menzies reported that dispatch coordination was rarely conducted by Menzies employees; the operators usually engaged engineers from other organisations for this function.

Ground handling procedures were provided in the Menzies aviation ground operations manual. The applicable Menzies procedures required ground handling personnel to conduct:

• an arrival walk-around, immediately after arrival
• a dispatch walk-around, immediately prior to dispatch.

Details on these procedures are provided in the following sections.

At the time of the occurrence, a ground handling agreement between Malaysia Airlines and Menzies had not been signed (see Operator planning for resumption of Brisbane operations) and Menzies was working under its own standard procedures. There were no significant differences between the Menzies and Malaysia Airlines procedures. The agreement signed after the occurrence equivalently required a ‘visual external safety/ground damage inspection’ to be performed ‘immediately upon arrival’ and ‘immediately prior departure’.

Ground handling tasks

The ground handling roles included:

• A leading hand (or flight supervisor), who was responsible for the management of the ground handling requirements of the aircraft turn around. In some instances, this responsibility could be split between teams with one responsible for the arrival and one responsible for the dispatch. In the case of the incident aircraft, the same leading hand was responsible for the arrival and the dispatch.
• A dispatch coordinator (or headset operator), who was responsible for aircraft dispatch communications from the ground to the flight deck during pushback. The role also included a requirement to conduct a post-arrival walk-around and dispatch walk-around inspections of the aircraft. This role within Menzies was usually conducted by the leading hand but in this case was performed by another ground crewmember who had finished assigned duties with another aircraft.

The leading hand and dispatch coordinator both reported being aware of the need to conduct a dispatch walk-around.

Prior to aircraft arrival, the leading hand was required to conduct a briefing and assign responsibilities for the turnaround, including ensuring that required staff are present.

ATSB observation The Menzies leading hand was required to ensure that appropriately qualified staff were available for the turnaround. The leading hand later reported that they thought they were not qualified to coordinate dispatch for Malaysia Airlines aircraft, but if so, this means the leading hand did not ensure that a qualified person would be available. This indirectly led to a last-minute handover of dispatch duties, during which a breakdown in communication occurred meaning that the incoming dispatch coordinator remained unaware that a walk-around had not been conducted.

Procedure for arrival walk-around

The manual stated that:

Upon arrival…the responsible person (Team Leader or equivalent) is required to perform an aircraft inspection for any aircraft damage. This shall be conducted prior to any equipment, including all GSE and Passenger Boarding Bridge (Jetty), positioning to the aircraft. Minimal arrival aircraft inspection shall consist of the following:

-    All cargo doors

-    All access panels and servicing access points

-    Aircraft fuselage

-    Aircraft engine cowlings

-    Aircraft passenger doors.

Procedure for dispatch walk-around

The dispatch walk-around was not an engineering inspection; it was intended to verify the aircraft’s general condition and readiness for flight. The manual stated:

Headset operatives [dispatch coordinator] must carry out a pre-flight check that:

-    All doors and hatches are secured and handles are flush with the aircraft fuselage

-    Nosewheel steering by-pass pin inserted if applicable

-    No visible damage of the aircraft caused by equipment during ground operations

-    No loading or other debris is left in the area of engine intakes

-    All ground locks, engine blanks, pitot head and static vent covers removed (if appropriate)

-    Static vents and pitot tubes are clear of debris or de-icing fluid etc. (as appropriate).

The manual further stated:

A pre-departure walk-around MUST be made before the aircraft is allowed to depart.

Staff must be vigilant and check for any damage or loose hatches (even if a hatch has not been opened at your station).

Any hold or passenger door that is opened after the walk-around (or not closed at that time) the closure must be personally supervised by the headset operative.

Note: The walk-round is primarily a visual check, which is performed at normal walking pace. Hold and access doors and hatches are ‘pushed’ to ensure correct closure. Other hatches can be confirmed as secure if all latches are closed and laying flush in recess.

Note: The walk-round should be carried out prior to engine start-up. To facilitate an on-time departure the main check can be carried out prior to completion of loading, or before doors are closed. Any holds or doors open at this time can be rechecked when closure takes place, without the need to re-check other items.

The relevant Menzies training notes listed 12 key check items, including ‘pitot tubes’, and contained the following information about dispatch:

NOTE: although a licenced engineer or member of the flight crew will have carried out and signed for a Pre-Departure inspection (PDI) of the aircraft, it is vital that the headset operator visually completes a thorough PDI check of the aircraft and immediate areas. … Confirm all doors, panels, hatches secure…

After the tow bar is connected to the push back tractor the headset operator should allow plenty of time to perform the walk round inspection of the aircraft. When all loading and service functions have been completed, the headset operator is required to walk-around again and ensure that all hatches and latches are secure.

After the air bridge or steps have been removed the cabin door/s must be checked to ensure they are closed and secured correctly. Particular attention to the likelihood of straps etc. protruding of door handle/s not stowed in the recess correctly.

The trainer’s notes on operating headsets stated:

The headset operator is required to follow the illustrated walk round sequence when inspecting the aircraft prior to departure. The walk round shall start on the left side of the aircraft nose leg and proceed in a clockwise direction.

A diagram was provided to show the conduct of the dispatch walk-around, including symbols drawing attention to the pitot probes (Figure 44).

Figure 44: Menzies diagram of dispatch walk-around sequence for ground handlers
 

Source: Menzies

Training and qualifications for dispatch coordination

Menzies stated that staff were chosen for training in dispatch duties only after they had at least 2 years’ general ground handling experience. They were required to conduct a classroom theoretical training session, followed by 15 supervised dispatches on various aircraft types. They were then assessed over 2 flights and provided they were found to be competent were considered qualified to conduct dispatches. Staff also undertook recurrency training every 3 years.

The leading hand believed that dispatch coordination required specialist training on each aircraft type. The leading hand stated that they personally had the appropriate qualification to perform dispatch coordination but believed that none of the team assigned to 9M-MTK had the requisite training to do this for a Malaysia A330 specifically.

On whether airline and/or aircraft specific training was required for the headset coordinator role, Menzies stated that:

No specific training was required, as no differences had been identified either by [Malaysia Airlines] or Menzies.

Menzies stated that both the leading hand and ground handler who dispatched the aircraft were qualified to conduct the dispatch.

The leading hand’s training records indicated that they had received training for dispatch duties on 16 August 2017. There was no record of training for specific aircraft types or operators. The training material in place at the time of the occurrence indicated that the training was generic in nature with a reference to numerous aircraft types including the Airbus A330.

Operator training of Menzies ground handling staff

On 28–29 May 2018 Malaysia Airlines provided training to 3 Menzies instructors to enable them to deliver training to other Menzies staff on the operator’s requirements and any differences with Menzies standard operating procedures. Menzies and Malaysia Airlines compared the required processes for receipt and dispatch, and no substantive differences were identified.

The operator provided further training to 3 Menzies instructors on 6 June 2018 (the day that operations commenced in Brisbane). This was to enable them to deliver training on receipt and dispatch, including dispatch coordination, to other Menzies staff.

Menzies reported that operator-specific training was gradually rolled out over the course of 2–3 weeks in June. However, no records of training delivery of this type were available and neither the leading hand nor dispatch coordinator reported having received training specific to Malaysia Airlines.

Dispatch coordinator communications and phraseology

Ground to flight deck communications has common phraseology for each phase of the aircraft turn around, for arrival, push back and tug disconnection.

At the beginning of the push back phase, the flight crew will prompt the dispatch coordinator that they are ready by stating ‘ready for departure checks please’. Provided the ground handlers are ready, the dispatch coordinator will respond by stating ‘departure checks complete, all doors and hatches closed and secure’.

ATSB observation The dispatch coordinator did not use the standard phrase ‘all doors and hatches closed and secure’, which might have provided a stronger prompt for the dispatch coordinator to perform the required walk-around or to check whether the leading hand had done so.

Menzies quality assurance

Menzies had eight external audits by airlines in 2018 with no significant adverse findings. Menzies, as a major international ground handling group, also conducted audits on various sections of its operations from time to time, with the last Brisbane group audit before the occurrence being conducted in 2016 with no significant adverse findings. One such area audited included:

If an airline is providing the same training instead of the Menzies training, a GAP analysis^[49] must be done to identify the difference between the [Menzies] & airline training and [Menzies] staff trained on the differences as appropriate.

Menzies Brisbane also conducted continual internal incremental line audits (observation audits) on various sections of the operation. In the area of ground handling arrivals and dispatch there were specific audit ‘questions’ such as:

-    Does the Headset Operative carry out a pre-departure check (walk around) that ensures there is no visible damage to the aircraft caused by equipment during ground operations and all cargo/access doors are closed and secured?

-    Before the aircraft commences taxiing under its own power, all equipment and personnel must be moved clear of the aircraft. Does the headset operative ensures that no equipment remains within the aircraft footprint?

-    Does the Headset Operative carry out a pre-departure inspection (walk around) to ensure all ground locks, engine blanks, pitot head and static vent covers have been removed and are clear of debris, de-icing fluid or other substances?

-    Does the Headset Operative carry out a pre-departure inspection (walk around) to ensure Power cables and the boarding bridge is fully retracted and not in the path of the aircraft?

Does the Headset Operative carry out a pre-departure inspection (walk around) to ensure there are no visible leaks of lubricants or hydraulics from the undercarriage?

-    Does the pre-departure inspection (walk around) include check that engine cowling latches are engaged?

-    Is aircraft clear of all obstacles along the intended movement path?

-    Is departure damage check performed?

-    Is predeparture walkaround inspection performed, ensuring landing gear pins are removed?

The audit logs for Brisbane operations over two separate 9-month periods in 2018 and 2019 indicated:^[50]

• Overall, there were 3,181 audits (averaging 6 per day), answering 53,357 audit questions. There were 145 recorded non-compliances in total, which is a compliance rate of 99.7%.
• There were 544 turnarounds where the dispatch coordination function was assessed, asking 872 questions with a compliance rate of 100%. Of these, 414 audits asked questions relating to specific elements of the dispatch walk-around^[51] (a total of 595 questions). The question ‘Is a complete walk-around inspection done to check that cargo/access doors are closed and secured, that there is no visible damage to the aircraft and that the gate area is clear of equipment? (incl wing tips)’ was asked 104 times.
• There were 122 turnarounds for which the arrival walk-around was assessed, with one non-compliance, equivalent to a compliance rate of 99.2%. The non-compliance was for a Malaysia Airlines flight in 2019.
• Malaysia Airlines turnarounds were audited for arrival and/or departure walk-arounds 24 times, including 3 times in Jun–July 2018, with records of the latter indicating:
  • 2 arrival walkarounds were assessed and completed
  • 1 departure walkaround was assessed with 5 distinct questions, of which 1 was answered ‘yes’ and the others ‘n/a’
• Menzies staff coordinated dispatch for at least 11 different airlines in June–July 2018.

Review of other turnarounds

Video recordings of Malaysia Airlines turnarounds

CCTV recordings showing four Malaysia Airlines A330 turnarounds in Brisbane in July 2018, including the one on the night of the occurrence, were assessed by the ATSB. A summary of the assessment is provided in Table 2, with a focus on the use of pitot probe covers and the required turnaround checks. Different personnel appeared to be involved in all turnarounds, except that only two LAEs were involved, each handling two successive flights. The walk-arounds were not assessed in detail for completeness; a walk-around was assessed as ‘partial’ if there were areas of the aircraft and/or obvious check items that were missed. The time taken for the inspections was also noted as a general reflection of the quality and detail.

Table 2: Malaysia Airlines turnarounds in Brisbane during July 2018

		Turnaround date (duration)
	12/07/2018 (2:45)	14/07/2018 (2:45)	16/07/2018 (about 6:00[1])	Occurrence flight 18/07/2018 (2:45)
Pitot probe cover use (AMSA)	No	No	No	Yes
Arrival walk-around (Menzies)	Yes, with torch.	Partial, without torch.	Yes, with torch.	No
Engineering inspections (Malaysia Airlines)[2]	Maintenance walk-around inspection (other than pre-departure)	Partial, with torch. (00:02:15)	Partial, without torch. (00:01:47)	Yes, with torch. (00:08:32)	Yes, with torch (00:11:45)
Pre-departure walk-around inspection	No	No	No	No
Flight crew pre-flight walk-around (Malaysia Airlines)	Yes, with torch (00:04:26)	Yes, with torch. (00:04:56)	No	Partial[3] with torch (00:01:32)
Dispatch walk-around (Menzies)	Partial, with torch. (about 00:03:30)	Yes, with torch. (00:02:45)	Yes, (twice) with torch. 00:03:21 the first time, 00:03:55 the second time.	No

[1]  This turnaround was extended due to an aircraft repair being carried out.

[2]  The Malaysia Airlines engineers were responsible for certification for these checks but could delegate parts of the check (other than certification) to an AMSA engineer. One engineer handled the 12 and 14 July turnarounds, and another handled the 16 and 18 July turnarounds.

[3]  See Flight crew pre-flight walk-around for the occurrence flight.

Video recordings of other operator turnarounds

The ATSB reviewed video of 3 other long-haul passenger aircraft turnarounds on 18 July 2018 involving other operators and engineering organisations. All the dispatch walk-arounds appeared to be conducted by engineers.

All the arrival, engineering, flight crew, and dispatch walk-arounds appeared to be completed in full for each turnaround, except for one dispatch walk-around which was done partially. The range of durations of fully completed walkarounds were 7–8 minutes (engineering), 3.5–8 minutes (flight crew), and 3–7 minutes (dispatch).

Pitot probe covers were only used on the longest of these 3 turnarounds, with the covers being fitted for a total of about 9.5 hours of the 12-hour turnaround. The other turnarounds were 69- and 80-minutes’ duration.

ATSB observation Although the number of reviewed Malaysia Airlines turnarounds was limited, video evidence indicated that the required walk-around inspections and checks by ground handlers, engineers and flight crew were not always conducted, and in some cases were not conducted to the required standard. The 3 reviewed turnarounds involving other operators and engineers had more consistent and thorough engineering and flight crew walk-arounds. The absence of any final engineering walk-around inspection over the course of the four reviewed Malaysia Airlines turnarounds, including by the occurrence engineer whose other inspections were satisfactory, is likely to indicate systemic problems with Malaysia Airlines engineers. Further, the extremely high level of recorded compliance during Menzies audits, including the assessed 100% compliance for dispatch walk-arounds, was very unlikely to be an accurate reflection of actual compliance based on video evidence showing that the required arrival and dispatch walk-arounds were only completed in full on 1 out of 4 flights.

Operator planning for resumption of Brisbane operations

General information

Malaysia Airlines operated flights into Brisbane for many years prior to 2015.^[52] During this period, the operator did not routinely use pitot probe covers in Brisbane. Operations to Brisbane were suspended in August 2015 for commercial reasons. This was about 3 months after the first issue of the CASA AWB on wasp nest infestation was first introduced. The operator did not use pitot probe covers in the intervening period.

The operator later prepared to resume Brisbane operations, planning 4 round trips per week between Kuala Lumpur and Brisbane from 6 June 2018. The project for the resumption of services was led by the airport services department (AS) under the regional AS head (one level below the AS department head), with involvement with the engineering and maintenance (E&M) and flight operations departments for matters relevant to them (such as planning for the use of engineers and pilots, respectively).

The ground handling and engineering arrangements in place at the time of the incident (18 July 2018) were an interim measure put in place until approval from the Malaysian Civil Aviation Authority was received for AMSA to certify for Malaysia Airlines aircraft in Brisbane. After that, the operator planned to permanently engage AMSA for all technical handling (engineering) functions plus dispatch coordination; Menzies would then cease dispatch coordination but continue with its other ground handling functions and there would no longer be an operational need for Malaysia Airlines to supply its own engineers for the Brisbane turnarounds.

The agreements were made in the form of a standard ground handling agreement (SGHA) between Malaysia Airlines and each of the two ground services providers, and a service level agreement (SLA) between Malaysia Airlines and Menzies (Table 3). When the operator resumed flights between Kuala Lumpur and Brisbane on 6 June 2018, no formalised service agreements had been finalised with either Menzies or AMSA.

Table 3: Agreements between the operator and service providers

Agreement	Operator signature date	Completed date	Effective at start of operations	Finalised before occurrence
Standard ground handling agreement (SGHA) between Malaysia Airlines and AMSA	10 July 2018	18 July 2018	No	Yes[1]
Service level agreement (SLA) between Malaysia Airlines and Menzies	25 May 2018	10 August 2018	No	No
Standard ground handling agreement (SGHA) between Malaysia Airlines and Menzies	6 June 2018	23 July 2018	No	No

[1]  Both organisations reported that this agreement was signed prior to the occurrence. The original physical copy was sent by Malaysia Airlines after signing, arriving on 16 July 2018. In practice, line personnel were unlikely to be aware of its completion at the time of the occurrence.

An SGHA is an agreement used commonly by aviation organisations worldwide. The International Air Transport Association (IATA) SGHA contains a pro-forma list of potential services for each arriving and departing aircraft, and the two organisations adapt the list to form their agreement by including only those services they agree upon. The SGHAs between Malaysia Airlines and the two service providers had a simple list of services (without detailing how they should be provided) as well as financial and legal obligations. The SGHA is primarily a commercial agreement, and not operational. That is, it typically contains information about the type of services and equipment provided, but details about how they are to be applied would only be in a very general sense (‘as required’) or absent entirely.

An SLA is a commitment between a service provider and client which, among other things, lists and/or details services that are to be provided. In the case of the SLA between Malaysia Airlines and Menzies, it included details about how some of the services were to be provided (for example, punctuality instructions). It also included agreed performance measures between the two parties, applicable charges, penalty clauses and other matters not covered in the SGHA. A timeline illustrating the key events related to the resumption of Brisbane services is provided in Figure 45, with further details provided in the following sections.

Figure 45: Timeline of key events for the Malaysia Airlines resumption of Brisbane services

Source: ATSB

Engineering support and certification

A number of documents and records of communication from February 2018 onwards show that Malaysia Airlines intended to engage an external provider for engineering services. The operator conducted evaluations of prospective engineering service providers, including AMSA, in February and April.^[53]

A Malaysia Airlines email sent to AMSA on 17 April 2018 listed items to be included in a proposed agreement, which included only the provision of some ground support equipment and did not include any services. A letter of intent sent to AMSA by the operator dated 28 April^[54] stated that there had been a decision to engage AMSA for ‘technical handling with [aircraft] certification’ at that time.

The operator was required to obtain approval from the Malaysian Civil Aviation Authority for any foreign (non-Malaysian) entity to conduct certification of its aircraft. An application for AMSA to conduct certification of Malaysia Airlines aircraft was submitted on 1 June 2018 and approval was granted later that year.^[55] In the interim, AMSA engineers were not permitted to certify for work conducted on the operator’s aircraft.

The SGHA between Malaysia Airlines and AMSA, finalised on the day of the occurrence but not effective in practice, indicated that AMSA was to provide engineering services including, among others:

• provide, position and/or remove pitot probe covers
• perform line inspection in accordance with the operator’s current instructions and certify for its conduct in the aircraft technical log
• provide personnel to assist the flight crew or ground staff in the performance of the inspection
• conduct ramp to flight deck communications during arrival and dispatch (that is, arrival and dispatch coordination)
• carry out a safety/ground damage inspection immediately upon arrival and prior to departure
• check that all doors and access panels are properly closed and locked.

ATSB observation The prospective agreement with AMSA, signed by Malaysia Airlines a few weeks after the resumption of services and by AMSA on the day of the occurrence, included the requirement to provide, position, and/or remove pitot probe covers. As with many other services listed, and in accordance with how the IATA SGHA is typically applied, it did not specify whether this meant that pitot probe covers were to be used for all turnarounds or on an ‘as needed’ or other basis. This information was not recorded elsewhere. An application for regulatory approval for AMSA to provide certification to Malaysia Airlines aircraft was not submitted until a few days before operations were due to recommence. The operator probably did not allow sufficient time for the regulator to evaluate the application.

Over 25–29 June, 2 AMSA engineers were trained in Malaysia Airlines engineering certification procedures, including:

• online access to and general use of publications and forms including check sheets and technical logs
• transit check requirements and access to the check sheets (the training did not cover the content of check sheets)
• ground handling requirements for Malaysia Airlines aircraft, including the A330, and
• general notes about dispatch coordination.

The operator provided AMSA with copies of, and online access to, relevant procedures and other documents.

Ground handling

Malaysia Airlines conducted an evaluation of Menzies across a range of areas in April 2018.^[56] A plan for the engagement of Menzies was drafted on 27 April 2018 and finalised in May 2018. It did not explicitly state whether Menzies would be responsible for dispatch coordination, but had provisions for Menzies to provide numerous ground services including ramp handling.

Both draft agreements between Malaysia Airlines and Menzies listed the following services to be provided, among many others:

• carry out a safety/ground damage inspection immediately upon arrival and prior to departure
• check that all doors and access panels are properly closed and locked.

Dispatch coordination

The April 2018 letter of intent advising of the decision to engage AMSA for technical handling (engineering) did not explicitly specify that AMSA were to conduct dispatch coordination, although that could be interpreted to be included in the term ‘technical handling’. The draft agreements between Malaysia Airlines and Menzies, signed by the operator in the two‑week period leading up to the resumption of operations, both required Menzies to conduct ramp to flight deck communications during arrival and dispatch (that is, arrival and dispatch coordination).

The Malaysia Airlines investigation report stated that on 4 June 2018 AMSA advised Malaysia Airlines that it would withdraw from the proposed agreement to provide services in Brisbane, which included dispatch coordination. The report stated that tasking for dispatch coordination was transferred from AMSA to Menzies from this point The Malaysia Airlines investigation report stated:

After further discussion, AMSA had later agreed to provide technical support to MAB [Malaysia Airlines]. In the meantime, MAB appointed Menzies to perform headset function during aircraft pushback operations, as an interim measure. This arrangement was different from other Australian airports where the headset function is normally assigned to the engineering support (AMSA) personnel, rather than ramp handlers such as Menzies.

AMSA had no records relating to a change of services from the initial arrangement to what was actually provided when operations resumed. As stated above, the SGHA between the operator and AMSA (signed by Malaysia Airlines on 10 July) included a requirement for AMSA to conduct dispatch coordination.

ATSB observation Malaysia Airlines reported that in early June 2018 AMSA withdrew from an agreement to provide ground services, which led to the requirement to engage Menzies for dispatch coordination. However, Malaysia Airlines had signed a draft agreement for Menzies to perform this function two weeks before that, and there was no evidence available to indicate that Malaysia Airlines intended to engage AMSA for dispatch coordination at that time. The first unambiguous record available engaging AMSA for dispatch coordination was the draft agreement signed by Malaysia Airlines on 10 July, after Brisbane flights had resumed. This agreement was most likely the result of an intent to engage AMSA for both engineering certification and dispatch coordination once regulatory approval for certification was gained.

Acquisition of mud wasp information

Malaysia Airlines reported that it did not have a formal process to monitor some types of safety information (including AWBs) from foreign civil aviation authorities. Nevertheless, the operator reported that both the E&M and flight operations departments obtained the March and May 2018 issues of AWB 02‑052 Wasp Nest Infestation – Alert, possibly through subscriptions to CASA’s automated email alert system.

The operator reported that the flight operations department performed a risk assessment in relation to hazards affecting flight operations at Brisbane Airport. The operator reported that the assessor examined the available Lido chart for Brisbane Airport and, based on the observation that the airport characteristics (such as runway length and approach procedures) and published hazards presented a similar risk profile to other major airports, did not document the risk assessment.

Flight operations evaluators did not visit the airport and relied on the information contained in the Lido aeronautical charts for flight risk information, and the individuals involved in the port assessment process were unaware of the mud wasp hazard.

AMSA and Menzies reportedly both advised the operator’s evaluation team about the mud wasp hazard at Brisbane during the operator’s on-site visit.

In the 17 April 2018 email exchange between Malaysia Airlines and AMSA, the operator included pitot probe covers in a list of required equipment. The AMSA representative advised:

…please be aware that all other carriers into BNE install pitot covers because of wasp infestations at this airport, you may also want to position the covers with AMSA and we will fit them as part of the transit, this will not incur an additional charge provided we do not have to provide the covers.

The operator sent a set of pitot probe covers to AMSA, however, no record of the date, the sender, or recipient was available.

An email from the operator’s station manager in Brisbane to a manager in Malaysia, dated 20 June 2018, stated that there was a ‘known issue’ and regulator advice about mud wasps building nests in pitot probes in Brisbane, adding that they can do so ‘very rapidly’. The station manager asked if it were possible to arrange for pitot probe covers to be fitted for every turnaround in Brisbane as a preventative measure, suggesting that AMSA could do so.

A response to this email on the same day stated that one set of pitot probe covers was now in AMSA’s possession, and that the operator would ‘advise our LAE to comply’ with the recommendation for their fitment.

ATSB observation Different departments in Malaysia Airlines became aware of the mud wasp hazard at Brisbane Airport through various means, including through regulator publications and local knowledge of the service providers. Individuals within the operator’s engineering and maintenance department were aware of the hazard several weeks before the commencement of operations, and sent a set of pitot probe covers to AMSA to be used on the operator’s aircraft without providing guidance or instructions on their intended use to the operator’s line engineers. Although some flight operations staff had obtained the relevant CASA airworthiness bulletin about mud wasps at Brisbane, this information did not reach, or was not used by, the individuals responsible for assessing the port safety from a flight operations perspective.

Risk assessment for Brisbane operations

On 25 May 2018, the operator’s AS department completed a risk assessment relating to the resumption of services to Brisbane. The risk assessment covered aviation safety risk as well as other business- and service-related risks. The record indicated that it was conducted and approved by the regional head of AS (one level below the AS department head). There was no record of other individuals or departments being involved, and no recorded risk assessment by any other department in relation to the resumption of Brisbane services.

The assessment used the ‘change management risk register form’ (see Operator change and risk management processes). This form allowed for an evaluation of initial risk, identification of treatments in the form of risk controls, and evaluation of residual risk (the risk that remains after treatment). The form also afforded the user space to name the assessor and set a status for each risk.

The ATSB’s examination of the overall risk assessment found that:

• four risks, including a risk that identified the mud wasp hazard, had a residual risk rating that was incorrectly calculated one level lower than it should have been (‘low’ instead of ‘medium’)^[57] no risk category information was recorded in the individual risk or control descriptions (for example, a fatigue risk due to having an unsupported station head was recorded; it was not stated whether this was an individual health and safety risk, a risk to customer service, or a risk to the safety of flight)
• there was insufficient information recorded about the nature of each risk and the risk controls to justify reductions in likelihood and severity, including:
  • risks were reduced in severity without listing controls that would feasibly have an effect on severity
  • some of the risk controls were vague or would have no effect on the identified risk (for example, ‘[ground handling agent] assured, will ensure smooth MH [Malaysia Airlines] Operations.’)
• two of the initial risk ratings were incorrectly labelled ‘minor’ (a severity rating) instead of ‘medium’
• some risk controls listed as initial (or existing) were prospective (that is, should have been listed as additional risk controls)
• some risk controls were more about planning than directly controlling risk (such as ‘oversight will be done by airport services trainer and station head’)
• some additional controls were rewordings of existing controls or stating how they were to be achieved, rather than separate controls (for example an existing control for one risk was ‘engineering … to provide flying engineer for aircraft certification at station’ and two additional controls associated with the same risk were ‘engineer will be onboard all aircraft and provide certification for all in and outbound flights’ and ‘station head to ensure engineer is available on all flights’)
• there was no identification of new risks introduced by the implementation of controls, including the risk of having mixed engineering responsibilities or the use of pitot probe covers
• there was no action associated with prospective risk controls or a record of responsibility to ensure that action would be taken, and
• all of the ‘risk assessor’ and ‘risk status’ cells, probably intended to track individual responsibility and completion of risk activities, were blank.

In all, there were 7 identified risks, each of which were assessed as having ‘medium’ initial risk and ‘low’ residual risk. Six of the risks related to turn around times, ground services and management of customers, with no immediately obvious relevance to safety. The other risk, the mud wasp hazard, was described as relating to aviation safety and is reproduced verbatim in Table 4.

Table 4: Record of operator’s risk assessment for the mud wasp hazard at Brisbane

Risk	Mud Wasp effecting Safety of aircrafts. Wasp build nest at tiny holes. Mainly at "pitot".
Existing risk controls	a. Engineer and Technical handler briefed to ensure pitot holes are covered during transit. b. GHA [ground handling agent] to remind Engineering and Technical handler comply to work process. c. To prepare checklist ensure compliance.
Initial risk assessment	Likelihood: remote
Severity: moderate
Risk: medium
Additional risk controls	a. Engineer will log in daily service register to ensure pitot holes are covered. b. Hazard reports to be raised and ensure corrective action.
Residual risk assessment	Likelihood: improbable
Severity: moderate
Risk: low

The risk assessment identified the need for the installation of pitot probe covers for aircraft transits at Brisbane Airport as a risk control. According to the operator, the risk assessment was entered into the AS business unit risk register, but not the applicable domain operational risk register. It was reported that the flight operations department personnel responsible for the operational aspects of the change were not appraised of risks relevant to it, including the mud wasp hazard.

The operator reported that the risk controls concerning mud wasps were communicated to the E&M department, outside of the mechanisms intended to support mitigation of risk and implementation of controls. There was no evidence of E&M department involvement in the conduct of the risk assessment or identification of risk controls, and the E&M department did not perform a separate risk assessment. The AS department did not follow up on the required actions and no risk controls were implemented by E&M as a result of this risk assessment.

ATSB observation The operator’s risk assessment for the resumption of Brisbane flights identified the presence of a mud wasp hazard. Issues with the risk assessment meant that its evaluation of the effectiveness of risk controls, and the remaining residual risk, had limited value. In any case, the identified risk controls were ultimately not implemented. Additionally, the unusual ground operations arrangements in Brisbane were not treated as a safety risk, and not effectively managed.

Operator change and risk management processes

Overview

The operator’s corporate safety management manual (CSMM) contained information about its safety management system and broadly aligned with the format and headings of the framework provided in the International Civil Aviation Organization (ICAO) Annex 19, Safety Management. It included policy, procedures, and guidance on change management and risk management.

Safety risk assessment team

The CSMM stated:

Safety Risk Assessment Team (SRAT) is one of a management review venue which will be held on a regular basis. SRAT comprises of departmental managers, subject matter experts (SME) and other related personnel nominated by the BU [business unit] Head.

The SRAT included managers and other personnel from across the organisation, including the AS and E&M departments. Its objectives included hazard/risk identification and assessment, and change management. The operator reported that activities deemed to trigger change management process were to be identified to and deliberated by the SRAT. The CSMM stated:

During the year, SRAT representatives are responsible for ensuring supplemental risk assessment activities are undertaken and risk registers are updated whenever there is a significant change

The CSMM also stated:

SRAT representatives are to ensure that Risk Assessment Records are reviewed a minimum of once each quarter. This review will provide evidence that identified risks are being monitored, and risk ratings and mitigation plans are being updated to reflect the current status and operating environment.

The operator required that (untreated) risks assessed as ‘medium’ or above were to be notified to, and then monitored by, the SRAT. The SRAT was not notified of the risks identified for Brisbane operations.

The ATSB reviewed SRAT meeting minutes for the 5 monthly meetings held over the period that the changes were being planned and implemented for the resumption of Brisbane services (that is, January–July 2018). The minutes recorded 23–34 attendees and 24–33 absences from each meeting, across all departments. There was a nominated ‘accountable person’ for each department including AS, E&M, and flight operations.

Representation from the 3 departments involved in this activity (AS, E&M, and flight operations) is detailed in Table 5. In some cases, an alternate representative from the department presented information in the absence of the accountable person. One of the attendees at the April 2018 SRAT meeting noted that the meeting schedule sometimes clashed with flight operations roster for some attendees.

Table 5: Departmental representation at SRAT meetings in 2018

	SRAT meeting
Department	1 February	9 March	17 April	16 May	28 June
Airport services (AS)	None	None	Alternate	Alternate	Alternate
Engineering and maintenance (E&M)	Alternate	None	Alternate	None	None
Flight operations	None	Accountable person	None	Accountable person	Unknown[1]

[1]  The minutes for June were inconsistent: the attendance list had the flight operations accountable person as absent, while the minutes proper indicated that they were possibly present.

There was no record of discussions relating to the Brisbane operations in the minutes, and the operator’s investigation found that this topic was not discussed. The regional AS manager, who approved the change risk assessment for the resumption of Brisbane operations, was not among the usual required attendees, and did not attend any of the meetings.

ATSB observation There was limited involvement from the relevant departments with the operator’s SRAT meetings in the first 6 months of 2018 when the resumption of Brisbane operations was being planned. Most notably, the ‘accountable person’ for the department responsible for coordinating and planning the resumption of Brisbane services was not present at any of the meetings, and an alternative was only present for some. The risk assessment for the resumption of Brisbane operations was performed between the May SRAT meeting and the 6 June resumption of operations, so there was no opportunity to present the results until after that. Finally, relevant risks were not raised by the alternative representative at the next meeting in late June.

Change management

International Civil Aviation Organization guidance

ICAO Annex 19 describes the responsibility of the operator with respect to the management of change:

The service provider shall develop and maintain a process to identify changes which may affect the level of safety risk associated with its aviation products or services and to identify and manage the safety risks that may arise from those changes.

Annex 19 is supported by ICAO document 9859 (Safety Management Manual), the 4th edition of which was published in January 2018. The 4th edition of the ICAO Safety Management Manual was updated from the 3rd edition (published in 2013) to be less prescriptive and to focus on the intended outcomes of each activity and process.

ICAO Annex 19 and the Safety Management Manual tie the management of change directly to safety risk and integrate it with safety risk management processes. The Safety Management Manual states:

Safety management practices require that hazards resulting from change be systematically identified, and strategies to manage the consequential safety risks be developed, implemented and subsequently evaluated.

The ICAO Safety Management Manual further stated:

The organization’s management of change process should take into account the following considerations:

a)    How critical is the change? The service provider should consider the impact on their organization’s activities, and the impact on other organizations and the aviation system.

b)    Availability of subject matter experts. It is important that key members of the aviation community are involved in the change management activities; this may include individuals from external organizations.

c)    Availability of safety performance data and information. What data and information is available that can be used to give information on the situation and enable analysis of the change?

Malaysia Airlines processes

The operator’s CSMM included policy, procedures, and guidance on change and risk management. It included a 3-page section on change management. About half of this section contained a detailed list of events to trigger change management procedures, which included:

• addition or removal of an airport/station
• new routes
• any other significant change that is deemed to carry operational risk.

Beyond this, there was a change management process, described by a flowchart (Figure 46), and a written description which stated, in entirety:

Relevant Divisional Heads are responsible for initiating change management procedures for activities for which he/she is responsible, and for maintaining a record of each assessment.

Activities deemed to be change management triggers are to be identified at the monthly operational risk meetings (SRAT). A risk assessment must be conducted and identified risks and mitigation plans must be documented in the applicable domain or subsidiary operational risk register.

Refer to Appendix A.12 for the Change Management Risk Register Form.

Figure 46: Malaysia Airlines change management process flowchart

Source: Malaysia Airlines

ATSB observation The resumption of Brisbane operations qualified as a change management trigger. However, although there was generally wide representation at the SRAT meetings and individuals aware of the change were probably present, there were no records of its discussion at the SRAT as required by the change management process.

The ‘change management risk register form’ in the manual’s appendix was used for the risk assessment for Brisbane operations, and had the same headings as that assessment. The form was a basic register of risks, and did not support any type of transition planning or management in respect of management of change.

As an example of current aviation industry practices, the 4th edition of the ICAO Safety Management Manual provided enhanced guidance on change management processes over the 3rd edition including greater detail of the steps involved. An ATSB comparison of the operator’s change management process with this guidance is provided in Table 6.

Table 6: Current aviation change management guidance and Malaysia Airlines implementation in 2018

ICAO Safety Management Manual guidance	ATSB observation of Malaysia Airlines implementation
a) understand and define the change; this should include a description of the change and why it is being implemented;	The process did not specifically require, or include guidance or instruction, on how to define the change.
b) understand and define who and what it will affect; this may be individuals within the organization, other departments or external people or organizations. Equipment, systems and processes may also be impacted. A review of the system description and organizations’ interfaces may be needed. This is an opportunity to determine who should be involved in the change. Changes might affect risk controls already in place to mitigate other risks, and therefore change could increase risks in areas that are not immediately obvious;	The process did not include a step to define relevant stakeholders. There was no requirement to involve stakeholders in the management of the change except through the risk management process, if the risk was not ‘acceptable’. The process did not require existing risk controls to be linked to the new hazard in the risk register, increasing the likelihood that the link could be overlooked in future.
c) identify hazards related to the change and carry out a safety risk assessment; this should identify any hazards directly related to the change. The impact on existing hazards and safety risk controls that may be affected by the change should also be reviewed. This step should use the existing organization’s SRM [safety risk management] processes;	The process required a risk assessment mitigation plan to be completed. There was no guidance on the purpose, content, or development or use of a risk assessment mitigation plan. There was no requirement for a change management action plan or the nomination of a responsible person to plan or document the change overall. There was no requirement to produce or track actions.
d) develop an action plan; this should define what is to be done, by whom and by when. There should be a clear plan describing how the change will be implemented and who will be responsible for which actions, and the sequencing and scheduling of each task;
e) sign off on the change; this is to confirm that the change is safe to implement. The individual with overall responsibility and authority for implementing the change should sign the change plan; and…	There was no guidance about what level of authority was required for a change (although the risk management section provided guidance on the levels of authority to accept risk).
f)  assurance plan; this is to determine what follow-up action is needed. Consider how the change will be communicated and whether additional activities (such as audits) are needed during or after the change. Any assumptions made need to be tested.	There was no means of assurance for change management implementation and follow-up to monitor and review changes.

Risk management

General content

The safety risk management section in the CSMM was more substantial than the change management process, with elements such as a reporting policy, flight safety analysis, just culture, investigation, and fatigue risk management.

Information about safety risk assessments was distributed across several subsections, with a flowchart, risk matrix and associated category definitions in a section about safety incident and hazard reports, and a broad text description of the process in a separate section on safety risk assessment.

The section detailing the method of performing a safety risk assessment was about 3 pages long, including 1 page of definitions and several subsections describing how risk assessments fit in with the broader operational environment (such as how risk registers are managed and information about annual reviews). The risk management process was described as follows:

Operational risk assessments will be performed using the same 5 x 5 risk matrix and process as defined for occurrence report risk rating at section 2.2.5 of this manual.

All identified risks will be fully documented on the Risk Assessment Record (Appendix A).

SRAT representatives are to ensure that Risk Assessment Records are reviewed a minimum of once each quarter. This review will provide evidence that identified risks are being monitored, and risk ratings and mitigation plans are being updated to reflect the current status and operating environment.

Risk assessment categories and matrix

The CSMM defined multiple categories of risk (for example, safety of flight, business or environmental). Neither the standard risk assessment form or the change management risk register form required the category of each risk to be defined.

The risk level was determined using a 5x5 risk matrix and a risk tolerability table. The CSMM defined 5 ratings for likelihood (from ‘extremely improbable’ to ‘frequent’) and 5 ratings for severity (from ‘negligible’ to ‘catastrophic’). There were 4 levels of overall risk, from ‘low’ to ‘critical’. The CSMM provided guidance for each of the risk levels, indicating that ‘low’ risks were acceptable (tolerable) and were to be routinely monitored by the head of the relevant department.

Severity could be assessed in terms of 14 categories, including injury/illness, airworthiness, and safety of flight. Within each category, a description of the kinds of impact or severity associated with each severity level was provided, with relevant examples reproduced verbatim in Table 7.

Table 7: Safety of flight severity categories used by the operator

Safety of flight severity category	Description
Minor	·        deviation with some potential to impact safe operation of an aircraft, or ·        managed by air crew using non-normal checklist procedures.
Moderate	·        deviation impacting the continued safe operation of an aircraft ·        managed by air crew using multiple non-normal checklist procedures or additional actions

The risk assessment record template in the manual’s appendix was separate to the change management form template, and required additional information, including:

• impact category
• tracking source
• details about safety actions
• remarks
• review

Unlike the change management form template, the risk assessment record template did not include a space to record the residual likelihood or residual consequence (only the overall residual risk).

Risk management process

The ‘process as defined for occurrence report risk rating’ (referred to by the risk management process for identified operational risks) had a flowchart to illustrate the process (partially reproduced in Figure 47). It indicates the steps involved in processing hazard and occurrence reports. These steps included determining the risk level of each hazard or incident, investigation level, assignment to respective business unit, and closure of investigation.

After initial report collection and risk classification, there was a decision point where incidents and hazards with:

• ‘high’ or ‘medium’ risk were to follow a detailed investigation process with differing priorities, including steps for corrective actions, review, acceptance, implementation, monitoring and closure (via the arrows to the right of Figure 47).
• ‘low’ risks were directed to a decision labelled ‘Investigate?’; following the ‘no’ path ends the process without further steps, and the second unlabelled path passes to the same investigation process as for higher risks but with low priority.

The CSMM did not clarify whether the ‘risk’ decision point was to be based on initial or residual risk.

Figure 47: Part of the operator’s safety reporting process, also used for general safety risk management
 

Source: Malaysia Airlines

There was no guidance on identifying and involving stakeholders, and although the process listed ‘monitoring’ as a key step, there was no guidance for how this should be accomplished.

The CSMM stated:

Domain and subsidiary Risk Assessment Records are to be consolidated into a business unit [departmental] operational risk register and this is to be [consolidated] into a Master Operational Risk Register.

Related occurrences  

Brisbane Airport

Overview

A review of the ATSB occurrence reporting database^[58] indicated that, from 2008–2018, there were at least 20 other airspeed anomaly occurrences involving high-capacity regular public transport aircraft on take-off from Brisbane.^[59] There were 5 reported airspeed anomalies during take-off due to system failures other than pitot system blockages, and 15 due to pitot system blockages.

In all the occurrences involving pitot system blockages, one pitot probe was blocked. Six of them were associated with insects or insect nests, all between the months of January and April, with the remaining 9 having no recorded cause. There were 5 different aircraft types involved: Airbus A330, Boeing 737, ATR 72, Fokker F28, and Dornier 228. None were operated by Malaysia Airlines.

The ATSB investigated two other A330 aircraft where one of the pitot probes had been blocked with wasp nests: one in 2006 and one in 2013. There have been no reported instances where more than one pitot probe was blocked by wasps.

Overall, the 20 airspeed anomaly occurrences that were examined resulted in 10 rejected take‑offs, 9 flights turning back after take-off, and 1 flight that continued to its destination. The occurrences involving Airbus aircraft (all A330s) resulted in 3 rejected take-offs and 1 air turn-back.

2006 occurrence

In 2006, the flight crew of an Airbus A330 taking off from Brisbane observed a discrepancy between their airspeed indications: at that time, the PF’s airspeed was 110 kt and the PM’s airspeed was 70 kt.^[60]The crew rejected the take-off, and the aircraft reached 122 kt before decelerating. Reverse thrust was not used. Due to excessive heat in the aircraft’s main landing gear brakes, the fusible plugs on six of the eight main landing gear wheels melted and the respective tyres deflated during taxi. There were no injuries.

The operator required the fitment and removal of pitot probe covers ‘as necessary if the ground time exceeds 12 hours, or less at the discretion of the certifying engineer.’ About 2 months before the occurrence, an email instructed maintenance staff to ‘fit pitot probe covers as soon as possible and remove them as close as possible to departure.’ In this case, the relevant engineer did not fit pitot probe covers because the aircraft’s turnaround was expected to be short: about 55 minutes.

There had been 5 incidences of pitot system failure associated with Brisbane operations in January–March 2006, including the investigated occurrence. At the time, they were suspected to be the result of mud wasp infestation but debris was only reported to have been found in the pitot probe of the investigated occurrence aircraft. Of the 5 occurrences, 3 resulted in rejected take-offs in Brisbane, and 1 other aircraft later had 2 rejected take-offs after the problem was not identified during maintenance.

2013 occurrence

In 2013 at Brisbane Airport, an Airbus A330 took off with two airspeed sources inoperative.^[61] The flight crew had rejected an earlier take-off attempt at about 88 kt after observing an airspeed indication problem on the captain’s display. The flight crew taxied back to the terminal where troubleshooting was carried out. During troubleshooting, in accordance with manufacturer instructions, ADIRU 1 was suspected faulty. It was exchanged with ADIRU 2 and disabled, with the FO’s air data source now set to ADIRU 3, which was permissible under the minimum equipment list. During a second take-off with the captain as PF, the aircraft passed the V₁ decision speed (151 kt in this case) before the flight crew detected that the captain’s display remained erroneous. The investigation report stated:

During the second take-off roll, the crew reported that the red airspeed flag was not apparent until after V₁. However, the recorded flight data again indicated that it was likely that a red airspeed flag would have been displayed on the captain’s PFD, after the groundspeed had reached 50 kt.

The take-off was continued. Once airborne, with only one valid source of airspeed data, the crew declared an emergency and returned to Brisbane. There were no injuries. Remnants of an insect nest consistent with that of a mud wasp was found in the captain’s pitot probe, likely formed during the 2-hour turnaround (pitot probe covers were not fitted).

Database searches

Australian aircraft defect reports

An ATSB search of the CASA Defect Report Service database for reports from 2010–2020 involving transport category^[62] aircraft identified:

• 54 reports of wasp or insect infestation of pitot probes:
  • 10 were in Brisbane, 2 elsewhere in Queensland (Coolangatta and Townsville), 4 in Sydney, 3 in Perth, 2 in Fiji, and 1 in a remote town in Western Australia (32 locations were not stated)
  • 21 events involved failures that would probably not be detectable on take-off, and a further 9 events had no flight phase stated
  • of those that might have been detectable on take-off, 11 take-offs were continued and 15 were rejected (including 3 rejected take-offs for the same problem); 6 rejected take-offs were from below or slightly above 100 kt and there was no information available for the others.
  • a variety of aircraft types were affected with no clear correlation with any type or manufacturer
  • on several occasions, pitot/static system tests did not initially reveal obstructions, sometimes leading to further rejected take-offs when the blockages reappeared
  • one report stated that a wasp infestation had occurred in a 20-minute period after pitot probe covers were removed for flight
  • there was at least one reported event in every month, with most (72%) between December and April, and a further 15% in October or November.
• other sensors including static ports, elevator feel pitot probes^[63] and engine sensors were also affected several times
• on 12 occasions, wasp nests were found on external surfaces such as control surfaces, actuators, pressure outlet valves, and doors.

Airbus operator reports

Airbus received reports of 0–4 in-service pitot probe blockage events causing unreliable airspeed on take-off each year from 2010–2019, mostly from insect activity and mostly from different airports. The number increased in 2020, with 55 reports from January 2020 to March 2021. Data on all of these occurrences is limited. Airbus reported that about one-third of occurrences through each period resulted in the take-off being continued.

Of the 55 recent reports of unreliable airspeed on take-off, 44 were due to blocked pitot probes, mostly due to insect activity after extended storage, although there were some involving aircraft that were on the ground for less than 2 hours. Most (36) unreliable airspeed events resulted in rejected take-offs, with the other 19 take-offs being continued.

A post-flight report, containing limited data about the flight, was available for 17 of the 19 continued take-off events. Airbus analysis of these records found that:

• for 2 events the ISIS was the only instrument displaying unreliable airspeed
• for 1 event, a speed flag appeared
• for 1 event, an ECAM message and master caution (single chime) alert were triggered before 80 kt.

Aside from the occurrence event, there were 2 flights with reported blockages of multiple pitot probes from 2010–2019, and 5 from January 2020–April 2021. These led to 3 rejected take-offs (at 125 kt, 100 kt, and an unknown speed) and the other 4 take-offs being continued.

Airbus later reported that, from April to July 2021, a lower proportion (13%) of unreliable airspeed occurrences resulted in a continued take-off.

Airbus published case studies about airspeed anomalies on take-off in an article titled Unreliable Airspeed at Takeoff (Airbus 2021). The occurrence event was one case study. The other two were:

• In an A330, the captain’s airspeed during take-off was low, displaying 55 kt at the time of the 100 kt speed call (when the flight crew detected the discrepancy), and 80 kt at rotation (133 kt). The speed flag was not displayed because the measured airspeed was above 30 kt and the difference to groundspeed was not sufficient to trigger the flag. The take-off was completed and the flight crew decided to return. The article stated:

If the airspeed was monitored even more closely by the flight crew during the takeoff roll, they may have identified the speed discrepancy sooner, allowing them to reject the takeoff and bring the aircraft safely to a stop.

• In an A320, the captain’s airspeed read 45 kt with the aircraft at a standstill on the ground. During the take-off roll, the captain’s indicated airspeed increased slightly but fell below actual airspeed and read 58 kt at the 100 kt speed call, at which point the flight crew detected the problem and rejected the take-off. The article stated:

The Standard Operating Procedure requests monitoring of the PFD speed scale during the entire takeoff roll. Following this recommendation may have made the flight crew aware of the airspeed discrepancy earlier than the 100 kt callout and enabled them to reject the takeoff at lower speed.

Occurrences related to air data sensor malfunction

Air data malfunctions directly related to maintenance activities

• Airbus had records of 3 occasions where aircraft took off with one pitot probe cover installed, involving various Airbus types with broadly similar warning systems and displays to the A330. They resulted in one rejected take-off from 95 kt, one continued take-off after the problem was detected at about 100 kt, and one continued take-off from an unknown speed. There were no previous recorded occurrences with more than one pitot probe cover installed.
• The ATSB recorded 2 previous instances of high-capacity air transport aircraft departing an Australian airport with pitot probe covers left on from 1998–2018. Both were Fokker F28s with one pitot probe left on, resulting in rejected take-offs.
• In 2021, a Boeing 787 that had flown from Melbourne, Victoria to Los Angeles, United States was found to have tape (with ‘remove before flight’ streamers) left over the engine static ports following previous maintenance. This occurrence is under investigation by the ATSB.^[64] In 2012, an A330 turned back due to discrepancies between the airspeed indications that appeared after take-off.^[65] Later analysis found that the PF’s (captain’s) airspeed was reading 20–30 kt too low and the standby airspeed was 30–50 kt too low. The investigation found debris in all three pitot systems that was from pitot probe covers that were damaged when probe heat had been applied with the covers still fitted at some point prior to the flight.
• In 2008, the flight crew of an Airbus A320 lost control during a test flight while carrying out an improvised low-speed test at low altitude over the Mediterranean Sea near the French coast.^[66] The investigation found that water had entered angle-of-attack sensors that had been incorrectly left uncovered during aircraft washing. The water froze, immobilising two of the three sensors and disabling the aircraft’s low speed protections. There were 7 fatalities.
• In 1996, a Boeing 757 impacted water after take-off in darkness from Lima, Peru.^[67] Just after take-off, the flight crew identified multiple problems with the air data system and received multiple contradictory alerts. The flight crew attempted an approach and landing at Lima, experiencing several stalls and altitude loss. The air traffic controller provided altitude information to the flight crew, which was incorrectly assumed to be valid but was actually erroneous as it was provided by the aircraft’s systems. Distracted by the contradictory warnings, the flight crew did not respond to the radar altimeter’s indications (which were not affected by air data) at low altitude and the aircraft impacted water. All 70 occupants were fatally injured. The investigation found that the aircraft’s static ports had been blocked by tape that was installed during a maintenance activity, and not removed afterwards. Relevant recommendations included pilot training for unreliable airspeed and more conspicuous covers for static ports.

Insect ingress

• In June–July 2021, several aircraft had abnormal pitot/static system events in aircraft operating from or stored at London Heathrow Airport, United Kingdom, leading to two rejected takeoffs,^[68] one flight returning after the aircraft displayed multiple fault messages shortly after push-back, and one aircraft that displayed a pitot probe heater fault in-flight without any other abnormal indications. One take-off involving an A320 was rejected at 104 kt after the captain (PF) observed less than 40 kt on the captain’s PFD and 70 kt (the actual airspeed) on the FO’s. Another A320 take-off was rejected at about 60 kt after both flight crew observed low airspeed indications (less than 30 kt) early in the take-off roll. The AAIB investigation identified the cause to be the nesting activity of certain species of wasps and bees within pitot probes. On inspection, three additional aircraft were found to have blocked pitot probes. Some insects and larvae were sampled and identified as Ancistrocerus parietum (a species of mud wasp) and Megachile pilidens (a species of solitary bee). Most of the aircraft had been in storage.
• In 2020, the flight crew of an Airbus A321 taking off from Doncaster, United Kingdom, rejected the take-off at V₁ (120 kt in this case) after no airspeed was seen on the captain’s display.^[69] Insect larvae was found in the corresponding pitot probe. The aircraft had been stored for nearly 12 weeks with pitot probe covers fitted.
• Airbus advised the ATSB that in 2011, an A320 took off with 3 different airspeeds displayed. Although data is limited, Airbus analysis indicated that the captain’s and ISIS airspeeds were both under-reading; the captain’s by about 8 kt initially and the ISIS by about 36 kt shortly after take-off. The FO’s airspeed may have also been erroneous. The NAV IAS DISCREPANCY message and master caution were presented during the take-off roll, indicating that a discrepancy of at least 25 kt was present for at least 10 s, although the time at which this triggered is not known. The flight crew turned back. All 3 pitot probes were found blocked by insects. The flight was the first after maintenance.
• An operator reported several airspeed anomalies in its Airbus A330 fleet between June 2011 and February 2015 in airports in Hawaii and California, United States (Ecosure 2017). Insect debris consistent with wasp activity was detected in eight of the involved aircraft. Non-insect material in two others was initially believed to be associated with human construction activities but it was later suggested that these could be from preliminary nest building activity by wasps.
• In 2009, a Boeing 757 took off from Accra, Ghana, with erroneous airspeed indications on the captain’s side.^[70]The captain, who was pilot flying, detected the problem before the aircraft reached 80 kt (at which point a speed call was required in this aircraft type) and decided to continue the take-off while referencing the standby and first officer’s instruments. The flight crew and an engineer on board correctly diagnosed the failure of the left air data system and selected the captain’s instruments to the alternate system before engaging the first officer’s autopilot, believing that their actions had disconnected the erroneous air data from the flight management computers. In fact, the aircraft’s flight management computers continued using the erroneous data, and falsely sensed an overspeed condition which resulted in an automatic pitch‑up command. The flight crew disconnected the autopilot and returned to Accra. There were no reported injuries. A beetle or similar insect was later found in the left pitot system. The investigation concluded that ‘although the commander [captain] considered that conditions were suitable for resolving the problem when airborne, a low speed rejected take-off would have been more appropriate in these circumstances.’ The operator subsequently advised flight crews to reject a take-off if a similar airspeed problem is recognised below 80 kt.
• In 1996, a Boeing 757 impacted water after take-off in darkness from Puerto Plata, Dominican Republic after a failure of the captain’s airspeed display (the FO’s and standby airspeed displays were correct).^[71] When performing the required airspeed cross-check at 80 kt during the take-off roll the flight crew identified that the captain’s airspeed indicator was erroneous. The flight crew continued the take-off. During the climb, aircraft systems presented multiple warnings associated with excess speed. Although the aircraft was flying slowly, the flight crew thought that it was flying too fast and reduced thrust. The stick-shaker stall alert system, alerting the crew to the aircraft’s slow speed, activated. The captain increased thrust in response to the conflicting alerts. The left engine flamed out due to inadequate airflow to the left engine, while the right engine’s thrust increased, and control was lost. The aircraft impacted water and all 189 occupants were fatally injured. An investigation by the Dominican Junta Investigadora de Accidentes Aéreos (​JIAA) found that the pitot probe feeding the pilot’s airspeed indicator was blocked by an insect nest. It highlighted the importance of recognising a speed indication malfunction during take-off and recommended, among other things:
  • training emphasis ‘on the importance of recognising a malfunctioning airspeed indicator during take-off
  • the use of blocked pitot probe scenarios in flight simulator training, and
  • inclusion of a ‘caution alert’ when erroneous airspeed is detected.

Water or ice ingress

There have been several occurrences, a very small number of which were fatal accidents, where in‑flight pitot probe icing was encountered in recent decades.

In 2009, an Airbus A330 stalled and collided into the sea at night while en route to France from Rio de Janeiro, Brazil.^[72]The investigation found that in-flight pitot probe obstruction due to ice accumulation had led to discrepancies in the airspeed displays and multiple alerts.. The flight crew did not carry out the unreliable airspeed procedure. Following pitch-up control inputs made by the pilot flying, the aircraft entered a stall which the flight crew did not diagnose and control was not regained. There were 228 fatalities. The aircraft was not fitted with the BUSS.

A complete review of other in-flight pitot probe icing events was not undertaken by the ATSB. Other related occurrences (on take-off or associated with pitot probe drain blockages) include:

• In 2018, an Antonov An-148 crashed shortly after take-off in icy instrument meteorological conditions from Moscow, Russia.^[73] With three different airspeed indications, the flight crew lost control. There were 71 fatalities. Pitot probe heating had not been selected on, and the three pitot probes had become blocked with ice.
• In 2015, the crew of an Airbus A320 received multiple alerts arising from erroneous airspeed measurements in all three systems at various times during the take-off and climb from Perth, Australia.^[74] The flight crew incorrectly diagnosed the source of the problem (interpreting an airspeed problem as an angle-of-attack problem) and subsequently thought that a stall warning was spurious when in fact the warning was valid. The flight returned to Perth. The airspeed disagreement was due to the pitot probes being contaminated with foreign material that prevented water from draining..
• In 1999, a McDonnell Douglas MD-11F freighter crashed on landing at Subic Bay, Philippines.^[75] There were no fatalities. The Aircraft Accident Investigation Board (Philippines) found that drain holes in the captain’s pitot tube were likely blocked, leading to erroneous airspeed indications on the captain’s display. The investigation stated that the available flight crew indications (the display of an amber ‘IAS’ on the PFD and three alerts associated with other systems) did not directly lead the flight crew to commence the appropriate ‘Airspeed: Lost, Suspect or Erratic’ checklist. The NTSB also stated that the flight crew did not make use of the standby airspeed indication to determine the reliability of the other indications. The investigation report detailed other air data anomalies in related aircraft types.

Other debris

• On 6 November 1996 a McDonnell Douglas MD-11 overran the runway during landing at Buenos Aires, Argentina.^[76] The aircraft received minor damage and there were no injuries. No investigation report was available; the NTSB stated in the 1999 Subic Bay investigation report that:

…the crew landed long and fast as a result of erroneous airspeed indications. It was determined that these indications were caused by water in the pitot tubes as a result of blocked pitot tube head drain holes. Laboratory analysis of the debris blocking the drain holes revealed fiberglass shards, which may have entered the uncovered pitot tubes as a result of on-airplane radome repairs.

There were 2 identified previous instances of similar alerts and anomalies in the same operator’s other MD-11 aircraft that were also caused by blocked pitot probe drain holes, and 3 other instances likely due to air data computer malfunction or other reasons.

Aircraft returned to service after storage

There have been numerous reports of aircraft having air data problems after being returned to service after periods of storage during the COVID-19 pandemic from early 2020 onwards. For example:

• On 12 June 2020 (revised 7 October 2020), IATA issued Guidance for Managing Aircraft Airworthiness for Operations During and Post Pandemic, with advice on the prevention of problems with air data systems during prolonged storage. IATA drew attention to concerns about contaminated air data systems on aircraft after a period of storage, stating that ‘unreliable airspeed and altitude indications are key contributing factors leading to [loss of control and controlled flight into terrain] accidents in the past’. It urged flight crews to include related elements in pre-flight threat and error management (TEM) briefings, such as cross-checking airspeed, the rejected take-off procedure, and memory items of unreliable airspeed and altitude indication procedures.
• On 20 July 2020, the European Union Aviation Safety Agency (EASA) issued a publication titled Return to service of aircraft after storage: Guidelines in relation to the COVID-19 pandemic, indicating that there had been occurrences of ‘erroneous air data information including contaminated / blocked pitot-static systems’ following aircraft storage. The guidance was later updated with additional examples of hazards, mitigation strategies and other guidance.
• On 5 August 2020, EASA issued safety information bulletin 2020‑14 Pitot‑Static Issues After Storage due to the COVID-19 Pandemic which stated:

EASA has noticed an alarming trend in the number of reports of unreliable speed and altitude indications during the first flight(s) following the aircraft leaving storage, caused by contaminated air data systems. This has led to a number of Rejected Take-Off (RTO) and In-Flight Turn Back (IFTB) events. Most of the reported events concerned the accumulation of foreign objects, such as insect nests, in the pitot static system. This contamination caused obstruction of pitot probe and static port orifices, in some cases on multiple systems, even when the covers were installed. The risk of such contamination was increased, if the aircraft storage/de-storage procedures were not completely or improperly applied at the beginning, during or at the end of the storage period.

A later revision recommended rejecting a take-off if an airspeed anomaly is detected, and stated:

Operators should also consider including the unreliable air data scenario into the operator’s post-Covid re-qualification simulator programme. The Operator’s policy on take-off briefings should be re-assessed to consider the issues highlighted in this SIB [Safety Information Bulletin].

• On 3 June 2021, the Dutch Safety Board issued 21.0004423 Interim warning in response to two serious incidents involving commercial aircraft, related to return to service of aircraft following temporary storage, stating:

The Safety Board is currently investigating two occurrences involving commercial aircraft that encountered problems with their airspeed and altitude indications shortly after takeoff… In one of these occurrences, a cover had not been removed, while in the other a number of pressure lines had not been properly connected. In both cases, the pilots were presented with incorrect altitude and airspeed information as a consequence.

• On 12 June 2021, the United Kingdom Civil Aviation Authority (CAA) issued safety notice SN‑2021/014 Pitot Blockage Events that stated:

The UK CAA and AAIB [Air Accidents Investigation Branch] have been advised of three separate events occurring at London Heathrow Airport between 9 June 2021 – 11 June 2021, whereby aircraft have been subject of pitot blockages that resulted in airspeed discrepancies and associated crew actions. The cause of these events are the subject of ICAO Annex 13 investigation, which the UK AAIB is undertaking, however initial feedback suggests a form of insect infestation may have contributed to these events.

The notice additionally stated:

Crews should be made aware of this potential issue, reminded of the importance of the speed checks during the take-off roll and the actions to be taken in the case of a discrepancy, as well as the appropriate unreliable speed indications for their aircraft type should they discover the issue once airborne.

__________

32. A precision approach path indicator is a set of lights installed near the runway aim point that provides pilots with guidance on acquiring and maintaining the correct vertical approach path to a runway
33. Information in this section is mainly derived from House and others 2020a, House and others 2020b, and Ecosure 2017.
34. Atlas of Living Australia (2015), in Ecosure (2017).
35. The number(s) of each failed ADR is presented. These messages are not caused by sensor issues or disagreements.
36. The colour of the flag is red, which is exclusively used for warnings.
37. BUSS cost reported in ABC News, The Last Four Minutes of Air France Flight 447; https://abcnews.go.com/Travel/minutes-air-france-447/story?id=9951878, accessed 9 July 2021.
38. Maintain aircraft control.
39. OEB: operations engineering bulletin. A temporary procedure published for flight crews when a situation is identified that could pose a potential risk to the safe operations of the aircraft and there is no existing procedure or technical solution to manage this risk.
40. Items marked with ‘BOTH’ are to be confirmed by both flight crew.
41. Thrust reduction altitude: the altitude at which thrust is normally reduced after take-off. In this case it was 1,500 ft.
42. Published by the Airbus product safety department, Safety First shares information and lessons learnt about safety topics related to the design, maintenance, and operation of Airbus aircraft. The content does not constitute or supersede approved guidance – see https://safetyfirst.airbus.com/about/.
43. The ERSA was part of the Aeronautical Information Publication (AIP) published by Airservices Australia.
44. One standard for ‘remove before flight’ steamers is the National Aerospace Standard NAS1756. These streamers are 3 inches wide and can be supplied in various lengths as designated by the part number suffix, that denotes their length in inches.
45. This does not include tooling for aircraft maintenance and equipment used for measurement.
46. This contract was not implemented at the time of the occurrence; see Operator planning for resumption of Brisbane operations.
47. The flight crew manuals termed it an ‘exterior inspection’ or ‘exterior walkaround’; this report refers to it as a ‘flight crew walk-around’ to avoid confusion with other similar activities.
48. A steering bypass pin when fitted to an aircraft allows it to be manoeuvred on the ground. 
49. Gap analysis: an activity that compares actual performance with expected or desired performance
50. All totals and percentages in this section exclude questions that were answered ‘N/A’ or ‘Not observed’.
51. These questions would normally only be answered positively if the dispatch coordinator conducts all or the relevant part of a dispatch walk-around, excluding checking the nose gear steering pin which can be done as part of other functions. 
52. The current operator, Malaysia Airlines Berhad (MAB), was formed from Malaysian Airline System (MAS) in 2015, retaining most of the former operator’s structure, personnel and assets.
53. The evaluation of AMSA found three non compliances with regulatory requirements: wheels in storage were overdue a regular rotation, a tyre pressure gauge calibration certificate was not available, and a handover book was not signed on one day
54. The operator’s investigation stated that this letter was transmitted on 16 May
55. AMSA reported the approval was issued on 19 September 2018; the operator reported the approval was issued on 1 December 2018.
56. Some non-compliances involving ramp handling were identified, although details were not recorded.
57. These risks, which had the combination of ‘improbable’ likelihood and ‘moderate’ severity, should have been rated ‘medium’ according to the operational risk matrix and not ‘low’ as recorded. This was possibly a mistake in using the risk assessment spreadsheet. A formula for looking up the appropriate risk rating based on selected likelihood and severity was used in some cells, while others had the text ‘Low’ copied or typed directly into those cells.
58. The database contains data on transport safety occurrences that are reportable under the Transport Safety Investigation Regulations. Reportable occurrences include ‘malfunction of an aircraft system’ if it ‘compromises or has the potential to compromise the safety of the flight’. However, not all occurrences are notified to the ATSB, and many pitot probe contamination events do not result in a reportable occurrence. As a result, these statistics are representative only.
59. A 2013 occurrence involving one rejected take-off and one returned flight and was counted as one occurrence, and is discussed further below.
60. ATSB investigation report 200601453, Rejected takeoff - Brisbane Airport, Qld - 19 March 2006 - VN-QPB, Airbus A330-303. Available at www.atsb.gov.au.
61. ATSB investigation report AO-2013-212, Air data system failure involving Airbus A330-243, A6-EYJ, near Brisbane Airport, Qld on 21 November 2013. Available at www.atsb.gov.au.
62. Transport category generally applies to multi-engine aircraft primarily intended for the regular public transport of passengers and/or cargo for hire or reward, and with a maximum take-off weight exceeding 5,700 kg.
63. The Boeing 737 has pitot probes mounted on the vertical stabiliser to provide airspeed data to an elevator feel computer.
64. ATSB investigation AO-2021-040, Aircraft preparation involving a Boeing 787-9, registration VH-ZNJ, discovered at Los Angeles International Airport, USA on 22 September 2021
65. Aviation Investigation Bureau (Kingdom of Saudi Arabia), Unreliable Airspeed Indication System/Component Failure or Malfunction (Non-Powerplant) (Scf-Np), Airbus A330-343E, Registration HZ-AQA, Jeddah, Saudi Arabia, 9 May 2012.
66. Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile report d-la081127, Accident to an Airbus A320 232 registered D-AXLA operated by XL Airways Germany on November 27, 2008 near Canet-Plage.
67. Accident Investigation Board (Peru), Accident of the Aeroperú Boeing 757 Aircraft with Registration N52AW.
68. Air Incidents Investigation Branch (AAIB) investigation AAIB-2736, AAIB investigation to various Airbus and Boeing aircraft between 9 June and 19 July 2021, United Kingdom.
69. Air Accidents Investigation Branch (AAIB, United Kingdom) report AAIB-26741, AAIB Bulletin 11/2020.
70. AAIB (United Kingdom) report EW/A2009/01/03, AAIB Bulletin 12/2009
71. Junta lnvestigadora de Accidentes Aéreos (Dominican Republic), Final Aviation Accident Report, Birgenair Flight ALW 301, February 6, 1996. 
72. Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (France), Final Report on accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF447 Rio de Janeiro – Paris.
73. Aviation Accident Investigation Commission (Commonwealth of Independent States), Final Report on the Results of the Investigation of the Aircraft Accident An-148-100V RA-61704, Stepanovskoye, Moscow region, 11 February 2018. 
74. ATSB investigation report AO-2015-107, Unreliable airspeed indication and stall warning involving an Airbus A320, VH‑FNP, near Perth, Western Australia, on 12 September 2015. Available at www.atsb.gov.au
75. Aircraft Accident Investigation Board (Philippines), Aircraft Accident Investigation Report, Federal Express N581FE MD 11 Aircraft, October 7 1999, Subic Bay International Airport
76. In Aircraft Accident Investigation Board (Philippines), Aircraft Accident Investigation Report, Federal Express N581FE MD 11 Aircraft, October 7 1999, Subic Bay International Airport, p.20

Safety analysis

Introduction

Pitot probe covers were fitted to the aircraft during the three-hour turnaround, which is a strategy used by many airlines to prevent wasp infestation at Brisbane Airport, Queensland. There were numerous opportunities for their presence to be communicated to or identified by other people, but a range of individual errors and organisational problems interfered, and ultimately, the covers were not removed.

With covers fitted to all three pitot probes, the aircraft’s three air data systems were prevented from measuring airspeed. Airspeed is a critical flight parameter. It is particularly important to flight crew during take-off and initial climb, as it is the basis for their awareness of flight conditions such as the approach of aerodynamic stall and determination of critical decision points.

Wasp ingress almost always affects just one system, and larger aircraft typically have multiple airspeed data sources. Conversely, the non-removal of pitot probe covers potentially results in the loss of all airspeed data, which increases the potential for adverse consequences.

Aircraft of various types have commenced take-off with erroneous or absent airspeed on numerous occasions. Sometimes multiple indication systems were affected for a variety of reasons. Nearly all occurrences result in a successful rejected take-off or turn-back. A small number of flight crews had significant trouble correctly ascertaining the nature of the problem and determining the aircraft’s actual airspeed, or had such a high workload that other problems (such as low altitude) were overlooked, occasionally resulting in fatal accidents.

In this occurrence, both flight crew became aware of the problem at different points in the take-off, but did not communicate or coordinate well and make a clear decision to reject or continue while it was still safe to reject. As the aircraft continued to accelerate, the flight crew were left with no safe option other than to continue the take-off. After take-off, the flight crew regained effective coordination through the application of published procedures and, crucially, did not allow the problem-solving process to distract from keeping the aircraft within a safe flight envelope.

Having reached a safe altitude the flight crew completed the required troubleshooting actions, which activated an optional-fitment indication system called the back-up speed scale (BUSS). Coupled with information from air traffic control, this provided enough information for the pilots to maintain control of the aircraft and land safely.

In the following sections, this analysis discusses a wide range of factors associated with the occurrence, broadly divided into factors associated with:

• management of the take-off and flight without airspeed information
• the mud wasp hazard, use of pitot probe covers, and the aircraft being dispatched with pitot probe covers fitted
• Malaysia Airlines’ management processes.

Take-off without airspeed information

Relevant concepts

A common and significant challenge for the human factors discipline is to explain why a person does not detect or correct a problem when it appears, particularly when the indications of a problem and the right course of action appear obvious in hindsight.

Figure 48 provides a simplified representation of the activities involved in recognising and recovering from a problem. Take-off is one of the highest workload phases of flight (Lee and Liu 2003), and abnormal events occurring at this time further increase workload (Orasanu 1994). In such situations, an individual’s cognitive capacity can be reduced by stress, slowing or even halting the processes involved in recovering from a problem.

Figure 48: Activities involved in recovering from a problem

Source: ATSB

Although each stage adds to the total recovery time, the more significant delays are usually the perception and assessment stages, and these delays are generally more to do with the focus of attention rather than the perception process.

During the take-off, red speed flags on both primary flight displays from 50 kt onwards unambiguously indicated that airspeed data was erroneous. This gave the flight crew about 12 seconds to detect the problem and respond before reaching the speed at which they should be ‘go-minded’ (100 kt), and a further 15 seconds before the aircraft passed the decision speed where they could no longer reject the take-off without significant risk of an accident.

In this context, the crew first had to identify the problem, either through detecting the absence of movement (or slow movement) on an airspeed tape, a discrepancy between the airspeed indications, observing the presence of a speed flag on a PFD (after 50 kt), or through one flight crewmember observing a cue and alerting the other. The nature of unreliable airspeed indications and flight crew guidance will be discussed in the following section.

Surprise occurs where there is a mismatch between new information and a person’s expectations (Landman and others 2017). It has been found that during an unexpected event, there is a delay in pilots’ response to the situation and there is also more variation in response times (Casner and others 2013). For example, when faced with an unexpected aerodynamic stall, pilots took almost 9 times longer on average to respond than when the situation was expected—as long as almost 20 seconds. It has been found participants reacted more slowly to reject a take-off when they were not expecting a significant failure (Stevens and others 2007).

Flight crew actions prior to reaching 100 kt

Flin and others (2008) state that decision errors can occur ‘when conditions change so insidiously that the operators do not update their situation assessments often enough.’ A crew would not immediately notice erroneous airspeed prior to 30 kt in the take-off, because the speed tape is not expected to move until this speed. The cue itself is very subtle: it is difficult to notice the absence of movement as well as judge the point at which the tape should move. Individuals are less likely to respond quickly to a gradually emerging situation (Landman and others 2017, Underwood and others 2013).

After 30 kt, the airspeed tape would normally begin to move and a yellow airspeed trend arrow would appear. Their absence in the period between 30 kt and 50 kt was not noticed by either flight crew member.

At 50 kt, a red speed flag would have appeared on both PFDs. The captain identified the presence of a speed problem as soon as it was clearly displayed, as indicated by the ‘speed’ statement 2 seconds after the speed flags appeared. The captain did not act on the information, and probably remained in the assessment stage, unsure of the right decision. Possible explanations for this might include:

• surprise and/or stress due to the unexpected and extremely rare nature of the problem, which had not been encountered before (stress could be indicated by the captain’s increased breathing rate and reported time compression)
• time taken to understand the full nature of the problem, possibly related to the captain’s relatively low experience on Airbus aircraft or the nature of the problem’s presentation (discussed in a later section)
• miscalculation of the severity of the problem and not projecting it forward as a future threat, therefore not justifying a rejected take-off (what might be phrased as ‘not wanting to turn a small problem into a big problem’)
• distraction from hearing an unrelated radio call very soon after noticing the problem (the flight crew need to pay attention to radio calls to identify potential conflicts).

In a 2022 article titled Training Pilots for Resilience, Airbus stated (2022):

When a flight crew is exposed to unexpected disruptions, they may experience a physiological reaction, known as the startle effect. This involuntary and uncontrollable reaction may be accompanied by a momentary loss of situational awareness resulting in a temporary deterioration in performance.

The captain’s ‘speed’ statement was relatively quiet and apparently did not gain the FO’s attention. Effective crews build shared situation models when threats arise. They assess and communicate the nature of the threat, the degree of risk, and time available (Orasanu 2010). Put simply, for a crew to be effective, both crewmembers need to have awareness of a situation, not just individually. Research has found that higher-performing crews talked more about cues that signalled the possibility of future problems, which set them up to monitor the situation closely and to establish contingency plans in case conditions deteriorated (Orasanu 1994).

Airbus have repeatedly emphasised the importance of flight crew monitoring of airspeed on take-off (Airbus 2007, Airbus 2021). The flight crew procedures require the pilot monitoring (PM) to monitor airspeed, and although there is no strict requirement for the pilot flying (PF) to do so, it is normal for them to check airspeed from time to time. The FO, who was PF, almost certainly did not perceive a problem (either by seeing a speed flag or hearing the captain’s ‘speed’ statement) until the 100 kt speed call when the crew are required to cross-check their airspeed indications.

Research has found variation in flight crew scan patterns during take-off (Harris and others 1986). Studies have also shown that there is significant variability in flight crew monitoring during take-off and that the PF spends most of the time looking out of the windscreen (Knabl and others 2018, Mumaw and others 2001). This was likely the case in the occurrence event, especially in the dark lighting conditions that prevailed.

The PF needs to focus outside the aircraft most of the time, and can only glance at the instruments, with a significant amount of potential information needing to be assimilated in that glance. There is also a task switching cost in terms of a slower response time and increased errors when changing focus and assimilating information, such as changing from ‘eyes outside’ to ‘eyes inside’ (Monsell 2003). Further, people are inherently poor at monitoring for infrequent events (CAA 2013).

Flight crew actions from 100 kt onwards

The 100 kt speed call was likely made on the basis of groundspeed, which is not a valid reference for that call and the captain did not advise the FO that groundspeed was used as the captain’s reference. The captain later did not recall making the call. Research has found that it can be difficult for people to recall events that occurred during a stressful period (Wolf 2014). The captain’s (and, later, FO’s) breathing rate was elevated, which can be another indication of stress (Veltman and Gaillard 1996).

Research by Orasanu and others (1998) of tactical decision errors made by pilots (as identified in accident investigation reports) found that about three-quarters of the errors were of the type that involved a continuation with the original plan despite cues that suggested changing the course of action. Common contributions to these errors were ambiguous dynamic conditions and goal conflicts. Orasanu and others (1998) stated:

Ambiguity and goal conflicts both imply that multiple courses of action should be entertained, first, because different readings of ambiguous cues might lead to different actions, and second, because different actions might be needed to satisfy competing goals.

In this case, the flight crew had to choose between two competing and risky options: continuing a take-off without any valid airspeed or rejecting a take-off when there was a realistic possibility that the aircraft could not be stopped before it reached the end of the runway. To add to the problem, the second option was becoming riskier with time.

Stress is one factor that effects situation assessment because reaching decisions requires projection and evaluation of the consequences of the various options (Orasanu and others 1998). Stress limits the decision maker’s ability to project the situation into the future and mentally simulate the consequences of a course of action. Orasanu and others (1998) continue by stating:

Reaching decisions [with multiple options] requires projection and evaluation of the consequences of the various options. If pilots are under stress, they may not do the required evaluations. Stress limits the decision maker's ability to project the situation into the future and mentally simulate the consequences of a course of action. …

…. Certain phases of flight induce higher levels of stress. namely those in which time is limited, workload is heavy, and there is little room for recovering from an error. These tend to be take-off and landing situations. Mistakes during these periods may have serious consequences.

Dealing with a serious and unfamiliar problem adds to this stress and interferes with the flight crew’s ability to understand, decide, and act. The flight crew’s stress and workload was indicated by their somewhat limited recall of events, the captain’s reported time compression, and later, possibly task-shedding (such as not changing frequency after take-off after being prompted).

Once aware of the problem, the FO likely went to the next step of the mental process, which was to assess the information. The captain’s 100 kt call gave the FO no indication of the existence of a problem. Until the FO performed the cross-check, the situation was normal in their mind and the FO would have been surprised to see a speed flag with no previous indication of a problem. Therefore, the FO had to assimilate the available information and (possibly) resolve the apparent contradiction between the 100 kt call and the presence of the speed flag on both displays.

The FO’s first response showed confusion (‘eh?’). The next statement might have been a suggestion to reject the take-off (as ‘[a]bort, uh?’), but the captain then said either ‘borders are red’ (possibly referring to the speed flag, which has red borders) or ‘both also don’t have’ (possibly referring to the absence of both pilots’ airspeed indications). The FO responded ‘ah’ and ‘oh no’ or ‘both no’. This exchange indicates that until about this point, the FO had not yet fully understood the problem and had not reached a decision. The FO’s increased breathing rate indicates their level of stress increased during this period.

The FO then prompted the captain for assessment or action (‘captain?’). The captain, likely still assessing the situation, did not immediately respond but then said ‘okay, check’ which did not make sense in that context, indicating continuing confusion.

Had the captain come to a decision to continue the take-off at any point, this should have been clearly commanded by calling ‘GO’ in accordance with the aircraft flight manuals. Only the captain had the authority to make such a decision; without this command, and with too little time to evaluate the captain’s responsiveness, the FO could only continue the take-off or suggest appropriate actions.

With more experience on the aircraft type, the FO had apparently arrived at a decision by this point, and said ‘go to ADR three’ (meaning to switch indicated air data to a third source). This is a step from the Unreliable speed indication procedure, which neither crewmember called for as required by the flight manual.

The FO, as PF, also did not first perform the required memory items of this procedure: pitch and thrust. The procedure required these actions to be taken if the ‘safe conduct of the flight is impacted’, and while the flight crew may have individually considered this not to be the case, they did not verbally confirm it with each other or challenge that assumption. There was no way for the flight crew to verify that the aircraft’s acceleration performance was adequate, which meant their situational awareness was not assured.

Pitching up on take-off too early slows the aircraft’s acceleration, so it is understandable why this step was not immediately accomplished. However, once it was clear the take-off would continue, the use of maximum available thrust would have enabled the aircraft to gain a safe speed and then climb to a safe altitude as quickly as possible. The FO may have also thought that a rejected take-off was still a viable option, and using maximum thrust or rotating would have effectively removed that option. In addition, the FO does not have control of the thrust levers after initially setting take-off thrust.

The FO’s next statement was indistinct on the recording. The operator interpreted it as ‘abort, abort’, which would be consistent with the FO’s recollection. If so, in the absence of specific terminology for the FO’s use in this circumstance, ‘abort, abort’ was an appropriate phrase to convey this intention. However, the indistinctness of the statement on the recording may also mean that it was not spoken clearly enough for the captain to understand. Also, it was spoken immediately after the suggestion to ‘go to ADR three’ so a suggestion to reject the take-off at this point would be unexpected. In any case, the captain did not respond.

Throughout this period, with no airspeed data available and only groundspeed and outside visual cues available, one or both of the flight crew were likely to be considering how close the aircraft was to the decision speed. As the aircraft accelerated, the flight crew had limited information to determine whether they had already passed, or were about to pass, this point. Harris and Khan (2003) found that once an aircraft approaches the decision speed, there is an increase in flight crew response time due to the increased difficulties of making a decision under time pressure. This may also be associated with a narrowing of perceptual scan, fixation on inappropriate solutions, and reduction of working memory capacity (Stokes, Kemper, and Kite 1997, referenced in Orasanu and Fischer 1997).

The flight crew’s process of perception, assessment, and decision-making was delayed, which took the crew past the period when the take-off could have been rejected with virtually no risk and resulting in a situation where the comparative risks of continuing or rejecting were uncertain.

Just 15 seconds after the 100 kt speed call, the aircraft passed the decision speed, and the flight crew could no longer reject the take-off without likely overrunning the end of the runway. Likely uncertain of the aircraft’s speed, the captain did not make the required V₁ call even though groundspeed was available as an approximation. This may be due to ongoing confusion, and is also consistent with research that shows that people are likely to shed tasks when under a high workload (Wickens and others, 2013).

It is very likely that the FO decided that it was safer to rotate than to reject at about this time, and was able to commence the rotation at the correct time through judgement and experience (and possibly assisted by reference to groundspeed).

In summary, the flight crew’s inaction when faced with an unreliable airspeed indication on take-off can be explained by a range of factors. Surprise, uncertainty, time pressure, and ineffective communication probably led to stress and high cognitive workload, particularly after 100 kt. In turn, this led to a delayed, and ultimately absent, decision.

Most critically, the captain was aware of a problem but likely unsure how to manage the situation; the FO was not aware of a problem until the appropriate decision was much less clear. Furthering these issues, the two crewmembers made multiple remarks without clearly and assertively identifying the problem, proposing a solution, or responding to each other. This limited communication was coupled with and contributing to a limited capacity for each pilot to individually understand the problem, which delayed their response until the choice to reject the take-off was no longer available.

Management of the flight after take-off

Although by the time of lift-off both flight crew members recognised the existence of an airspeed indication problem, neither made the required ‘unreliable speed’ call and there was no coordinated action to apply the Unreliable speed indication procedure until about 3 minutes after take-off.

During the intervening period, the FO maintained normal pitch and thrust settings, instead of applying the 15° nose-up pitch attitude and take-off/go-around (TOGA) thrust memory items of the Unreliable speed indication procedure. In the absence of any airspeed indication and in alternate law with reduced flight envelope protection, it would have been prudent to apply these memory items to establish a safe speed and climb gradient as soon as possible. Maintaining a pitch attitude that was potentially lower than normal in the absence of airspeed indication also risked accelerating past the maximum flap and landing gear extension speeds.

Without either crew calling for the Unreliable speed indication procedure (which had troubleshooting steps including switching air data), the FO twice more asked for the air data to be switched to a third source, and one of the flight crew did so with the FO’s air data source at about the same time. It is not clear whether the other crewmember was aware of this action through non-verbal communication. While the action did not pose an immediate threat to safety, troubleshooting outside of established procedure can be hazardous, and doing so without the confirmation of both crew risks a crewmember losing awareness of the aircraft’s ongoing status and flight path.

Perhaps distracted by the erroneous airspeed problem, the flight crew did not carry out the After take-off/Climb procedure which is still required to be conducted in abnormal conditions to ensure a safe aircraft configuration. Although not having an effect in this case, this bypassed some important checks of aircraft configuration that could have led to other problems later in the flight.

The flight crew advised ATC of the problem and established a safe altitude before carrying out troubleshooting and applicable procedures. The flight crew’s workload was reduced by:

• their request for a block level, granted by air traffic control, rather than a specific level
• provision of groundspeed information and vectoring from air traffic control
• following standard procedure and effective crew resource management principles.

Once activated, the Airbus back up speed scale (BUSS) gave the flight crew immediate indication of the aircraft’s safe speed limits. This almost certainly resulted in a significantly lower workload than they had during the climb and working from pitch-and-thrust tables. This and other occurrences, such as the 2009 A330 accident over the southern Atlantic Ocean, illustrate the safety value of the BUSS.

The reduction of workload greatly helped the flight crew in the ongoing management of the remainder of the flight. Apart from not establishing the correct pitch and thrust settings immediately after take-off, the flight crew managed airspeed and altitude within safe limits to a reasonable extent based on the limited data they had available. The aircraft did not approach a stall or descend too close to water or terrain at any point. Although the aircraft probably exceeded the maximum configuration speed on about two occasions, it was by a small amount for brief periods.

Air traffic controller response to urgency call

No reason could be established for the tower controller not hearing the PAN-PAN call. There had been enough time since the preceding telephone call for it to no longer be a significant distraction, particularly for an air traffic controller well-used to multitasking. There were no other known distractions or issues that could have interfered with the controller’s perception of the urgency call.

It is possible that, having just asked the aircraft to transfer to the departures frequency and received acknowledgement, the tower controller may have unintentionally disregarded the next transmission from that aircraft as being on another frequency or otherwise being unrelated to the tower controller’s duties, and later forgotten about it.

Take-off airspeed monitoring and decision-making

Introduction

Flight crew monitoring and rapid decision-making during take-off are critical. Flight crews need to detect a problem and arrive at the safest decision based on the information presented to them and their previous training. Unfortunately, there are sometimes situations when the correct course of action is not immediately obvious, and flight crews need to consider the risks of each option and choose between them. This is a significant challenge in unfamiliar, time-critical situations such as the loss of airspeed indications on take-off.

Air data problems can manifest in many different ways that can be hard to differentiate and diagnose quickly. The instrument indications may be obviously false or may appear to be normal but are actually false. Airspeed displays may differ but remain somewhat close in value, which can be particularly difficult to detect when they are rapidly changing. In these situations, crews can be unsure about the very existence of a problem. The process becomes even more difficult when considering the potential for multiple failures, such as when two sources agree: the third might be correct but could be untrusted. Airbus stated (2007):

…it should be emphasized that identifying an unreliable speed indication is not always obvious: no single rule can be given to conclusively identify all possible erroneous indications and the display of contradictory information may confuse the flight crew.

When presented with a clear indication that airspeed was unavailable, the occurrence flight crew still experienced uncertainty and did not actively decide on a response until the alternative (rejecting the take-off) was no longer available. The occurrence shows that, even when flight crews are faced with unambiguous displays, a range of human factors can interfere with expected behaviour and result in suboptimal actions. A greater proportion of crews will make errors when presented with information that needs to be evaluated.

This occurrence involved the concurrent failure of three air data probes due to a common cause. While this particular failure mode (multiple covered pitot probes) is extremely rare, failure of one or more airspeed systems on take-off occurs from time to time and is likely to be more difficult to identify quickly. Experience has shown that these failures occur in a variety of ways—with airspeed that reads too high or too low, and sometimes with multiple systems. Diagnosing an airspeed problem quickly enough to reject a take-off at low speed has proven challenging for many crews. The occurrence flight crew had not received training that involved unreliable airspeed on take-off.

Flight crews need to become aware of an airspeed issue as early as possible in the take-off. They then need to make the appropriate decision quickly depending on the aircraft’s proximity to the ‘decision speed’ (V₁): the last point at which the crew can reject the take-off and still come to a stop before the end of the runway. Even before V₁, however, the hazards of a rejected take-off are still present: ineffective or overheated brakes, burst tyres, and occasionally runway veer-offs have been encountered.

Rejecting a take-off becomes much more hazardous as the aircraft’s speed increases. The United States Federal Aviation Administration (1993) found that most accidents that occurred during a rejected take-off were from the very small proportion (2%) that were rejected above 120 kt. An earlier rejection is safer for two primary reasons: at the initial application of brakes the aircraft’s speed is lower, limiting most of the adverse effects, and it has travelled less distance along the runway. This is the basis of Airbus’ philosophy for flight crews to be ‘go-minded’ past 100 kt—a crucial point during the take-off.

The safest response to unreliable airspeed on take-off mainly depends on the aircraft’s speed at which the problem is detected. Airbus analysis of past occurrences suggests that unreliable airspeed indications should almost always be detectable before the aircraft has reached 100 kt. At these low speeds, immediate action is needed if the take-off is to be rejected. However, statistics indicate that some flight crews either undergo similar decision-making delays as the occurrence flight crew, or do not become aware of the problem until late in the take-off, when they are supposed to be ‘go-minded’. This places them in a difficult position where they have to make a quick decision while facing a potentially serious and unfamiliar problem.

Normally, both flight crew check their respective airspeed displays and verify that they are close to 100 kt, or by the time the PF checks, just past it. Although the captain had detected an airspeed issue earlier, this is when the flight crew truly began to assess the situation but they were then faced with a very limited amount of time in which to decide what to do. It is likely that this time pressure applied in other occurrences where flight crews continued the take-off, as well as other factors such as uncertainty over whether an airspeed problem actually exists.

In fact, with the 100 kt airspeed cross-check necessarily occurring in the high-speed regime, pilots need to make the decision more quickly and may be more inclined to continue if they do not detect unreliable airspeed until then. In an Airbus A330, the decision speed can be as low as about 120 kt, potentially requiring the flight crew to call, check, respond, decide and act in just a few seconds. Some other aircraft types have an airspeed cross-check at 80 kt.

Following an investigation involving a Boeing 737-800 with a faulty angle-of-attack sensor, where two take-offs were continued after the flight crew saw an airspeed discrepancy at the 80 kt speed check, the French Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile reported (BEA2018-0071.en):

The take-off is a dynamic phase during which the crew may not have the resources to identify all the possible consequences of a failure of the speed indicator. Given the importance of the speed indications to continue the flight, a doubt as to this parameter should incite the crew to envisage rejecting the take-off when this is still possible.

Following two low-speed rejected take-offs due to unreliable airspeed in 2021, the United Kingdom Air Accidents Investigation Branch (AAIB) noted (AAIB-2736):

The pilots of G-EUUO observed that, at the unusually low operating weights associated with low passenger numbers, the Airbus A320 SOP [standard operating procedures] 100 kt check can be very close to V₁, leaving little time for a rejected takeoff decision if the speed anomaly is only detected at that point. The equivalent speed check on the Boeing 777 is made at 80 kt. The recorded data traces for the rejected takeoffs showed that both aircraft briefly continued to accelerate after their thrust levers were retarded. The investigation was made aware of a similar incident at Luton Airport where a lightweight Airbus A319’s takeoff was rejected at V₁ (109 kt), but before the retardation devices overcame the aircraft’s residual acceleration, its airspeed peaked at 120 kt. While its speed exceeded V₁ during the rejected takeoff, the aircraft’s relatively light weight meant that there was more than sufficient runway stop margin available.

This emphasises the importance of flight crews being able to detect the condition early in the take‑off and then quickly make an appropriate decision. Pilot awareness and decision-making are two of the key factors that control whether a flight crew continue or reject a take-off when faced with unreliable airspeed, and both were involved in the occurrence event. These factors will be discussed in the following sections, as well as analysis of the flight crew’s non-technical skills (NTS) training to evaluate whether this might have affected their performance.

Occurrence data

Before 2020, when unreliable airspeed occurrences apparently increased more than tenfold over the previous average (largely due to aircraft having been in storage), Airbus flight crews encountered unreliable airspeed on take-off at least about once a year. It appears that in most cases of serious unreliable airspeed occurrences (that is, other than slight discrepancies) where the take-off is continued, flight crews turn back, indicating that if they become aware of unreliable airspeed while still able to reject the take-off safely, most flight crews would do so in the absence of confounding factors. This suggests that a deliberate decision to continue would not be common, and probably mostly associated with relatively minor airspeed failures (such as slight discrepancies).

Overall, although unreliable airspeed is a potentially hazardous condition, historic occurrences suggest that pilots have a varying response to airspeed anomalies on take-off. In at least one case, an Airbus flight crew rejected a take-off at the decision speed when one display was incorrect. There were several occasions where flight crews in various aircraft types continued a take-off with one or more erroneous airspeed displays, either because the issue was not detected while it was still safe to reject the take-off, delayed flight crew response to an observed problem, or because the flight crew decided to continue.

A combination of these factors was involved in the occurrence event: the captain was aware of a problem initially, while the FO was not aware of a problem until the aircraft’s speed was past 100 kt. The fact that a decision to continue or reject was not made indicates the presence of factors that affected or delayed decision-making throughout the take-off, as well as with factors that affected the FO’s initial awareness.

The failure of a single airspeed source is significant enough for Airbus to recommend rejecting the take-off if identified at the time of the 100 kt cross-check (Airbus 2021) or before the decision speed (Airbus 2006). Occurrences involving multiple unreliable airspeed indications should generally be more readily detectable than single erroneous indications. Once the situation is detected, flight crews would be more likely to reject a take‑off because of the increased risk of flight with multiple failures. Therefore, it would be expected that these situations would most often result in a low-speed rejected take-off.

However, only 1 of 8 occurrences of multiple erroneous airspeeds on take-off has resulted in this outcome.^[77] Five of these occurrences involving multiple unreliable airspeed indications were continued, including the occurrence flight, and a further two were rejected past 100 kt.

More broadly, Airbus records show that, of 55 occurrences involving single or multiple unreliable airspeed indications on take-off, 19 (35%) were continued. While there was no data available for 2 (4%) of these, the remainder comprised:

• 2 (4%) with erroneous airspeed on the integrated standby instrument system (ISIS)
• 8 (15%) with erroneous airspeed on one of the PFDs
• 7 (13%) with an audible alert and ECAM message that appeared at 80 kt.

The proportion of take-offs rejected in the high-speed regime (above 100 kt) is not known but these have occurred and add to the proportion of occurrences with undesirable outcomes. Separate data indicates that in the last decade, at least 6 unreliable airspeed indications were not detected until after 100 kt, and 2 of these were not detected until V₁.^[78] Flight crew responses were mixed, with half of each group rejecting the take-off and the others continuing.

This strongly indicates that in many cases either the erroneous indications were not clear enough to the flight crew or because their decision-making was not optimal. It further suggests an inconsistency in flight crew responses.

Following the two low-speed rejected take-offs due to unreliable airspeed, the AAIB reported (AAIB-2736):

As a precaution, the crews proactively took things a little slower, extended their briefings and placed extra focus on aircraft external checks and cockpit switch selections. They reported that this approach was in line with their company’s “defensive operations” policy which had been implemented as mitigation for reduced pilot recency.

On the other hand, the AAIB also stated:

…one pilot considered that reduced recency had caused them to initially question their fault diagnosis, prompting them to seek additional information before confirming the failure.

Unfortunately, the available occurrence records are not detailed enough to permit a review of the speeds at which flight crews become aware of a problem and evaluate the reasons for their actions. Further study may be beneficial.

Nevertheless, this limited occurrence data indicates that at least a third of erroneous airspeed occurrences result in an undesirable outcome (continued take-off with erroneous ­­airspeed, or rejected take-off at high speed), and that the proportion worsens with the number of erroneous indications. The reasons are currently unclear, as airspeed monitoring—particularly on take-off—is a fundamental and extremely important pilot skill, but likely to involve delayed detection and/or decision-making.

Flight deck indications and flight crew guidance for unreliable airspeed on take-off

The current European Certification Specifications (CS) 25.1322 for transport category aircraft require a warning indication if ‘immediate corrective action is required’, and ‘timely attention-getting cues through at least two different senses by a combination of aural, visual, or tactile indications’ for all warning-level alerts.

This requirement does not apply retroactively and certification of the A330 preceded it. In many situations on take-off, indications of an airspeed problem are only presented visually. Although the condition is likely to require immediate corrective action (on take-off), and the speed flag is red (the colour associated with warning indications), there are no associated audible alerts and the display itself is static, limiting its capability to draw attention (the speed flag also only appears once groundspeed is above 50 kt and does not appear on the ISIS). Similar limitations exist for inconsistent airspeed alert messages, due to the relevant alerts being inhibited during take-off or requiring differences to exist for relatively long periods. It is important to get the crew’s attention when, and only when, an action is necessary to cope with a failure or to cope with a possible future failure (Brière and others 2001).

Recognition of auditory warnings is improved in comparison to visual warnings in situations where the pilot is required to visually attend to more than one thing a time, because the pilot may not be looking in the direction of a visual display (Stevens and others 2006). For this reason, auditory rather than visual warnings are often used to convey information in emergency situations (Doll and Folds, 1986). An auditory warning would have likely gained the PF’s attention in this occurrence, and probably also in other occurrences.

In addition to gaining a flight crew’s attention, alerts can help inform the flight crew of the severity of the situation. Flight crews ‘must be able to differentiate between situations that are detrimental to operational safety, and those that are not’ (Airbus 2014). Orasanu and others (1998) suggest that flight crews might ‘press on’ with an original plan in the face of cues that suggest a change would be warranted, mediated by an underestimation of the risk associated with the problem and a failure to evaluate the possible consequences of continuing or adopting a different course of action. They add that ‘the evidence must be unambiguous and of sufficient weight to prompt a change of plan.’

Decision types fall into two subgroups depending on whether a prescriptive rule exists that defines a situationally appropriate response; if not, the decision primarily relies on the pilot’s knowledge and experience (Orasanu and Fischer 1997). With regard to deciding whether to continue or reject a take-off based on predefined rules, Orasanu and Fischer state:

The crucial aspect of the decision process for rule-based decisions is accurate situation assessment. The major impediment is ambiguity. Such decisions are often made under high time pressure and risk; thus, the [aviation] industry has prescribed appropriate responses to match predictable high-risk conditions. Once the situation is recognized, a fast response may be required for safety.

In other words, there needs to be enough unambiguous information for the flight crew to identify the problem and apply the appropriate rule. Initially, the captain saw indications that might have been unambiguous in the sense that the nature of the problem (absent airspeed indications) was apparent, but the problem itself—not the indication—was ambiguous because there was no prescriptive rule for responding to it. At the time, the optimal response was not clear to the captain. While the captain probably had some appreciation of the importance of the situation when it arose, as indicated by an increased breathing rate, an auditory or otherwise more prominent warning may prompt a more automatic response to reject the take-off immediately.

The flight crew’s situation assessment difficulties continued once the FO became aware of the problem: by this time, the flight crew needed to jointly assess and decide on a problem with outcomes that were both potentially serious now that the aircraft was approaching V₁. Any other flight crew who do not observe unreliable airspeed until the 100 kt cross-check would also be in this situation.

Orasanu and Fischer (1997) add:

‘Ill-structured’ problems entail ambiguity, either in the cues that signal the problem or in the available response options. Cues may be sufficiently vague or confusing that the crew cannot identify the problem (‘situational management’ decisions), or crews do not know what to do even if the problem is understood (‘creative problem solving’ required).

In its Safety First magazine, Airbus justifiably suggest rejecting a take-off even when there is a single airspeed indication failure, as long as the aircraft is below the decision speed. In 2021 correspondence with ATSB, Airbus advised that unreliable airspeed should not be a reason for rejecting a take-off above 100 kt. As guidance for responding to unreliable airspeed on take-off is not part of the formal documentation provided to operators, these views may not be universal.

According to the Airbus flight crew techniques manual, a rejected take-off should be seriously considered if any electronic centralised aircraft monitor (ECAM) warning or caution is activated in the low-speed regime (below 100 kt). This emphasis on ECAM warnings and cautions is reinforced by the unreliable airspeed guidance, which states that the air data systems ‘detect most of the failures’ affecting the airspeed indications and that these failures ‘trigger the associated ECAM alerts.’ Thus, a flight crew is, by design, less likely to seriously consider rejecting a take‑off unless presented with an ECAM alert, fire, loss of thrust, or other obvious danger signals.

In the absence of alerts that convey the urgency of a situation as well as its nature, it can take a flight crew several seconds to understand and react—possibly more time than they have, especially if a failure occurs close to or after the decision speed.

A330 flight crews are provided a list of conditions for which they would be expected to reject a take-off after reaching 100 kt:

At these speeds [above 100 kt], the Captain should be “go-minded” and very few situations should lead to the decision to reject the takeoff:

1.    Fire warning, or severe damage

2.    Sudden loss of engine thrust

3.    Malfunctions or conditions that give unambiguous indications that the aircraft will not fly safely

4.    Any red ECAM warning

5.    Any amber ECAM caution of the ENG [engine] system or the F/CTL [flight control] system.

Although a pilot may not have these specific situations in mind during the take-off, they would likely have a reasonable understanding of the types of failure that should result in a rejected take-off. In addition, any warning received during the period of take-off from 80 kt indicated airspeed ‘must be considered as significant’. Training in rejected take-offs is likely to be predominantly associated with ECAM alerts and engine failures, which provide clear indications and prompts.

While the loss of airspeed indication is hazardous, the manner of its presentation is usually less prominent than other dangers like a fire warning or loss of engine thrust. There is often no ECAM alert or master warning/caution. There may be a discrepancy between multiple indications—an indication that may not be detected by flight crews until the speed check at 100 kt— or sometimes the appearance of a speed flag on the affected display. To a pilot, these may not be ‘unambiguous indications that the aircraft will not fly safely’, especially to those unaware of the manufacturer’s advice to reject the take-off if the crew are confident that the aircraft is below the decision speed.

The list of situations that should result in a rejected take-off did not address airspeed indication failures. There was also no instruction or guidance in the flight manuals on the type or number of unreliable airspeed indications for which a take-off should be rejected, or whether this decision should change if the crew is in doubt over the aircraft’s proximity to the decision speed.

Furthermore, the Unreliable speed indication memory items are not always applicable during take-off: if the airspeed is low enough to safely reject, crews should do so, and if in doubt, application of TOGA thrust is appropriate, but the application of 15° pitch-up too soon would only slow the aircraft’s acceleration.

If a flight crew is uncertain of the aircraft’s airspeed, it would probably be safer to assume the decision speed has been exceeded than to reject a take-off past that speed, but this is not a desirable situation.

In summary, the objective should be for flight crews to detect unreliable airspeed as early as possible in a take-off and to provide them with enough information (at the time and through training) to make an immediate decision in most circumstances. Relying on the 100 kt cross-check may not be sufficient, as it takes the aircraft into the high-speed regime where a rejected take-off is a more significant, and potentially risky, event. The current A330 flight deck indications of unreliable airspeed are not prominent enough to reliably gain a pilot’s immediate attention as well as adequately convey sufficient unambiguous information to allow for quick comprehension of the severity of the problem.

Further, flight crew training and guidance for unreliable airspeed on take-off may not equip them with sufficient knowledge to make a decision in the limited time they have available.

These concerns are not unique to the A330 or Airbus aircraft, and the lessons about flight crew guidance and unreliable airspeed indications are almost certainly relevant to a range of aircraft types. Accordingly, the ATSB encourages all manufacturers of larger air transport aeroplanes to consider what types of unreliable airspeed events can occur, how the information is presented to flight crews, and what responses are the safest in different phases of the take-off and in a range of potential situations. Ultimately there needs to be sufficient assurance that flight crews become aware of and understand how to appropriately respond to unreliable airspeed on take-off in a timely manner.

Flight crew non-technical skills training

The ATSB reviewed past assessments the flight crew had received in non‑technical skills (NTS), such as communication, leadership, assertiveness and receptiveness. Although both pilots required occasional briefings, this did not indicate a history of substandard NTS performance in either pilot.

The NTS grading methodology was also considered. Unlike some other operators, Malaysia Airlines graded flight crew proficiency in NTS separately to technical skills. This approach provides significant advantages over evaluating NTS only as markers for the performance of technical tasks. For example, it provides opportunities for more in‑depth evaluation and feedback of NTS.

However, the use of a 3-point scale for these NTS somewhat limited the operator’s capability to capture slight but important differences in NTS performance between sessions and between pilots. With limited granularity in grading scales, it can be difficult to detect whether an individual’s performance had improved or degraded over time. There is also no visible scope for improvement once a ‘satisfactory’ level is reached: pilots who receive limited feedback about their individual NTS strengths and weaknesses might be less likely to recognise and work on the areas of underperformance and may have less motivation to improve beyond a base level of competency. Furthermore, evaluators may not identify consistently marginal performance.

To address this, Holt and others (2001) suggest using a 4- or 5-point scale for NTS. Similarly, two of the most well-known marker systems are the University of Texas system developed by Robert Helmreich and colleagues (Flin and O’Connor 2001), which uses a 4-point scale, and the NOTECHS (non-technical skills) scheme (Joint Aviation Authorities 1997) using a 5-point scale. Baker and Dismukes (2002) propose enhancing rating accuracy by providing evaluators with NTS performance examples using a 4‑point scale (excellent, standard, debriefed, and repeat).

In flight training, it can be difficult to detect a change in performance or identify when performance is consistently acceptable but not to a high level of proficiency, especially when multiple trainers are involved. Organisations can use standardised NTS assessment guidelines to reduce subjectivity, helping trainers recognise behavioural markers consistently so that they can then address the problem. Doing so successfully requires a mature understanding of the standards by the trainers/assessors and crew, so this level of standardisation needs to be developed over time. If done too early, there can be too much inconsistency in the application of finely-graded standards, making comparison and tracking even less reliable.

Notwithstanding this minor limitation, the Malaysia Airlines method of grading NTS was probably as or more effective than the method used by the majority of other reviewed operators.

Airport operational information

The operator’s flight operations department used the airport operational information (AOI) published by Lido for an assessment of the hazards that existed at Brisbane Airport before services recommenced. The AOI was also used by pilots on an individual basis as airport reference guidance. However, there was no information about the mud wasp activity affecting pitot probes and the recommendation to use pitot probe covers in the AOI when referencing Brisbane Airport.

The absence of relevant hazard information could mean that operators generally might not know about and address important hazards at an organisational level. Additionally, as the use of pitot probe covers in airline operations is primarily a maintenance activity, pilots who are aware of this hazard are more likely to note the presence (or absence) of pitot probe covers, may request them to be fitted, and could be more prepared for the potential for airspeed problems on take-off.

Lido drew on information from the Aeronautical Information Publication (AIP) for inclusion in the AOI. Along with the wasp hazard, other safety-related information in the AIP was absent from the AOI. For example, the AIP stated that various kinds of large bird were active at Brisbane throughout the year but the AOI stated that bird activity was only during part of the year.^[79] The Lido AOIs for other selected Australian airports had not reproduced a small number of minor safety-related items, including one military traffic hazard.

Internal Lido guidance for the development of AOI content unambiguously required caution notes for bird and military traffic hazards, and for ‘any kind of dangers officially referenced in source documents’ such as the mud wasp hazard.

The absences led the ATSB to review the Lido process for choosing what types of safety-related information was promulgated in AOI, and how that information was reviewed before publication. No obvious problems were identified with that process or the required expertise of the people involved, and no other reason for the identified absences was established.

However, the ATSB notes that the information contained in the AIP presents safety information that local subject matter experts consider to be important; any process with the potential to alter or omit such information before it is presented to pilots could increase risk.

Risk controls associated with the use of pitot probe covers

Introduction

Pitot probe covers are normally fitted to aircraft when parked overnight or for extended periods. Fitting covers during turnarounds is not common and requires the use of controls to ensure they are removed prior to departure.

During the planning for resumption of flights to Brisbane after a cessation of over 2 years, the operator planned to use pitot probe covers as a risk mitigation strategy for the mud wasp risk at Brisbane Airport. However, a complete strategy for their fitment and removal was not implemented. As a result:

• there was no procedure or guidance for front-line personnel (the operator’s engineers and the support engineers) to use pitot probe covers at Brisbane Airport during turnarounds
• flight crew and the operator’s engineers were not informed about the mud wasp hazard or the recommended use of pitot probe covers specific to Brisbane Airport
• use of pitot probe covers at Brisbane was intermittent, so the operator’s aircraft were often exposed to the potential for pitot probe contamination from mud wasps during turnarounds.

Furthering these problems, engineering arrangements in Brisbane were somewhat unusual: the routine use of a travelling engineer for aircraft certification, who were required to board the same aircraft they were working on before departure. This working environment gave rise to the risk of miscommunication and miscoordination among ground crews, leading to some important tasks being overlooked or incomplete.

A 2009 ATSB report, Ground operations occurrences at Australian airports 1998 to 2008, stated that the relatively low ‘industry-wide attention on risk controls to improve safety in ground operations’ had led to little change in the frequency of adverse ground operations events in Australia over the previous few decades. The report stated:

The most common contributing factor to ground operations occurrences were individual actions. For occurrences between 1998 and 2008, these most frequently involved action errors, where a person deviated either from plans or standard operating procedures. Common examples were towbar connection procedures and pushback errors, like turning back too sharply with the tug and damaging the nose or landing gear of the aircraft. Less frequently, individual action errors were associated with a violation, information, or decision error.

A number of ground crew errors were involved in this occurrence, across a variety of categories. Certain themes underlie some of these errors—at times, some personnel exhibited a lack of diligence, attentiveness, communication, and ownership of important tasks.

However, personal factors were not sufficient to explain why the aircraft was allowed to depart with pitot probe covers fitted. Individual errors and undesirable personal factors are suppressed in a well-defined work environment where individual responsibilities are clear, when tasks do not change hands, and when the practical implications of front-line work have been thoroughly considered. The following sections explore how these errors were allowed to contribute to the occurrence by the environment in which they were made.

Use of pitot probe covers

Fitment of pitot probe covers prior to the flight

Engineering support staff at Brisbane Airport had become accustomed to fitting pitot probe covers to various airlines aircraft, following individual airline requirements, CASA advice, and probably airport advice to a point that it became normalised practice. In the absence of any information to the contrary, the support engineer believed that pitot probe covers were to be fitted to all aircraft during turn arounds in Brisbane, including Malaysia Airlines aircraft.

On the other hand, the Malaysia Airlines LAE knew none of this. Following the fitment of the pitot probe covers, the support engineer reportedly told the LAE that pitot probe covers had been fitted. At that time the LAE did not acknowledge what had been said or make an entry in the technical log as a risk control to ensure the pitot probe covers were removed before flight. The LAE did not later recall being informed of the pitot probe covers by the support engineer and likely did not hear or assimilate the information.

The use of closed-loop communication—seeking, receiving, and understanding an acknowledgement—is a way to ensure effective communication and has been found to reduce error (Foushee and Manos 1981). In this case, the support engineer did not receive or seek confirmation that the message about pitot probe covers was understood.

Furthermore, the support engineer was not permitted to enter the details of the fitment of pitot probe covers into the aircraft’s technical log and did not press the issue after seeing that the LAE did not do so. The support engineer may not have seen it as a sign that the LAE did not hear the support engineer’s statement.

As there was no technical log entry, there was no prompt for the LAE or flight crew to recall the presence or confirm the absence of pitot probe covers when the log was later checked.

The support engineer was needed for the removal of the pitot probe covers before dispatch, either to do so personally or escort the LAE for security purposes. However, it is unlikely that the support engineer thought about the practicalities of removal at the time the covers were fitted, or when deciding to work with another aircraft for a while. The support engineer likely forgot about the need to remove the covers.

The support engineer then left the aircraft to work on another aircraft. This made it less likely that the support engineer would recall the presence of pitot probe covers later (having moved onto other tasks) and removed any opportunity of seeing them during incidental activities around the aircraft. In effect, the support engineer tacitly passed responsibility for the covers onto the LAE, who had not accepted that responsibility.

Fitment of pitot probe covers on other occasions

In the absence of guidance from Malaysia Airlines or written procedures from AMSA, the use of pitot probe covers for the operator’s aircraft was inconsistent. Pitot probe covers were used for 3 out of 19 turnarounds prior to the occurrence for which technical logs were available (it is possible, though not highly likely, that pitot probe covers had been used on other occasions without a technical log entry being made).

Since AMSA engineers were not controlling or conducting all of the engineering activities, the use of pitot probe covers increased the likelihood of miscommunication or error because it split responsibility for the task between the AMSA engineers (who supplied and fitted pitot probe covers but could not make technical log entries) and the Malaysia Airlines engineers (who had limited awareness of the need for pitot probe covers at Brisbane).

Pre-flight walk-arounds

Introduction

There were effectively five walk-around checks required between the aircraft’s arrival and its dispatch, four of which did or should have taken place during the period in which the pitot probe covers were fitted. These were the:

• engineering maintenance walk-around inspection
• flight crew walk-around
• engineering pre-departure walk-around inspection
• dispatch walk-around.

The procedures specifically included checks of the pitot probes and should have presented multiple opportunities for the covers to be detected and removed, in addition to incidental opportunities during general ground activities. In each case, individual errors and violations prevented the detection and removal of the pitot probe covers.

Engineering maintenance walk-around inspection

While conducting the first part of the transit check the LAE saw that the pitot probe covers were fitted to the aircraft. According to the LAE, this was unexpected as they were not aware of any instances where pitot probe covers were required to be fitted during turn arounds and they had not been informed of any requirement to fit pitot probe covers in Brisbane. The LAE intended to ask the support engineer to remove them. However, the support engineer was not nearby at that time so the LAE decided to continue with the transit check tasks. Subsequently the LAE did not remember to request the removal of the pitot probe covers when the support engineer returned to the aircraft a few minutes later. Any reasons why the LAE did not remove them personally were not explored.

Prospective memory is the suspending or deferring of a task with the intention to return to it later or forming an intention to add a new task at a later time. A failure of prospective memory has occurred when a person does not return to complete the task as intended. Prospective memory failures often occur with tasks that are not habitually performed (Dismukes 2008). In this case, the LAE did not routinely use or need to remove pitot probe covers, and never used them during turnarounds.

Another reason why people forget to complete tasks as intended is the absence of reminder cues (Dismukes 2012, Reason 2016). There were no cues that may have prompted the LAE’s memory. The continuing presence of the pitot probe covers went unnoticed, likely because the LAE was working elsewhere or because the streamers were outside of the LAE’s immediate vision, the matter was not brought up in later discussions with the support engineer and flight crew, and there was no entry in the aircraft’s technical log that was required to be cleared when the LAE certified for the transit check.

Engineering pre-departure walk-around inspection

The pre-departure walk-around inspection (required as part of an engineer’s transit check) and dispatch walk-around (required to be conducted by the person conducting dispatch duties) have a similar purpose: to check the aircraft for any damage that may have occurred while on the ground, and to ensure that the aircraft is correctly configured for flight – for example, that doors and panels have been secured, any pins, blanks and covers have been removed, and that the aircraft is clear of equipment.

Although the engineers and ground handlers were both required to perform separate final walk-arounds, only one walk-around is required in cases when engineering and dispatch duties are conducted by the same engineer. That is, the general airworthiness functions of the check can be combined with the check of the aircraft’s readiness for flight. Accordingly, there is often only one ‘last’ opportunity to identify any problems with the aircraft before it departs, such as unlatched doors or the presence of pitot probe covers. In this case, the operator’s arrangements meant that both checks were required.

The LAE did not conduct a pre-departure walk-around inspection, which might have prompted a recall of the presence of pitot probe covers. The LAE had not conducted the required pre-departure walk-around inspection for the previous turnaround either, even though they were not travelling on that flight.

The LAE, not having been informed of how responsibilities were to be shared, assumed that the support engineer would conduct the pre-departure walk-around, without confirming that was the case. The LAE was not aware that the ground handling organisation was conducting dispatch coordination duties, so was not aware that the support engineer was not responsible for a pre-departure walk-around inspection and was not required to stay with the aircraft until dispatched. Without this knowledge it is likely that the LAE did not see a need to tell the support engineer to perform a pre-departure walk-around, reportedly assuming that it was part of the support engineer’s responsibilities. It is unclear whether the LAE was aware that the other AMSA engineer on the previous turnaround also did not perform a pre-departure walk-around.

Meanwhile, the support engineer’s understood function was only to assist the LAE as instructed, and to provide access to, and escort the LAE around the tarmac. The support engineer was free to leave once the LAE advised that there were no further tasks.

Therefore, both engineers had different understandings of their respective roles with regard to this check. They did not confirm their responsibilities or intentions with each other or challenge their individual assumptions.

They were placed in this position by engineering arrangements that were unusual by most standards but had become routine in Brisbane. On every second turnaround, the operator required an LAE to conduct a transit check and board the same aircraft for the return flight. Thus, the LAE was required to board the aircraft before the final check of the aircraft’s readiness for flight and could not check for security of the cargo and passenger doors. This meant that the transit check could only be completed in its entirety with the support engineer performing the last few steps, which probably contributed to the LAE’s assumption that the support engineer would conduct a final walk-around.

The LAE boarded the aircraft about 36 minutes before the aircraft was dispatched following the completion of aircraft refuelling, citing the need to board the aircraft before its international flight. While this reasoning is understandable, there was no compelling reason for the LAE not to perform a partial check of the aircraft’s readiness for flight during this period, omitting a small number of items like the cargo and passenger doors. This could also have been done alongside the captain during the flight crew walk-around.

Had the LAE conducted a final walk-around, they most likely would have seen the pitot probe covers again and removed them or had them removed, as the aircraft was close to being dispatched.

More generally, in the absence of any other agreements or guidance, AMSA engineers would no longer be directly responsible for the dispatch walk-around, and there was no explicit requirement for them remain with the aircraft until pushback. This indirectly led to the omission of the engineering pre-departure walk-around inspection, which engineers would normally combine with the dispatch walk-around, but now there was a situation where both engineers might not (and did not) realise that the engineering inspection was not done.

Flight crew pre-flight walk-around check

The brief amount of time the captain’s torch dwelled over the pitot probe, and the omission of other check items of the walk-around, are strongly indicative of reduced attention in general. During the walk-around, the captain briefly shone the torch on one of the aircraft’s left pitot probes, which had covers fitted at the time. The captain did not recall the presence of the pitot probe covers when interviewed after the occurrence, and likely overlooked them partly as a result of this reduced attention.

Research in visual attention found that people rarely cognitively perceive what they are looking at unless their attention is directed to it in a phenomenon sometimes known as ‘inattentional blindness’ (Mack 2003). The conduct of the captain’s walk-around reduced the likelihood that abnormalities would be noticed.

Another factor that is likely to be involved is expectation. Expectation has an influence on perception: people see what they expect to see (Hawkins 1987). The operator had not advised flight crews of the mud wasp risk or the use of pitot probe covers and, in part due to the absence of a warning in the Lido airport information, the captain was not aware of the mud wasp activity and requirements to fit pitot probe covers at Brisbane.

Expectation is influenced by how frequently a person had previously encountered an item (Wolfe and others 2013). The captain reported never seeing pitot probe covers during previous walk‑arounds and likely did not expect to see them on the aircraft in Brisbane.

Flight crew and engineer walk-arounds for other flights

While the need to board the aircraft may have distracted the LAE to some extent, the same LAE did not need to board the flight on the previous evening, yet had not conducted a final walk-around on that occasion either. The same is true of the previous LAE, who had worked the preceding two turnarounds. From the video evidence available, in total, both LAEs omitted the required engineering pre-departure walk-around inspection on all of the 4 turnarounds, including both occasions when they were not required to board the aircraft. Further, two of the transit checks overall were of a very short duration and did not inspect all key areas required.

Similarly, the captain’s walk-around was only partially completed, while one other pilot omitted the flight crew walk-around completely. Of the four flight crew walk-arounds that were required, only two were likely to have been completed in full to the standard required by procedure.

The operator’s use of the term ‘cursory’ to describe the required flight crew walk-around is not appropriate for a task of this level of importance. The Macquarie Dictionary defines ‘cursory’ as ‘going rapidly over something, without noticing details; hasty; superficial’. Although performing the task rapidly is not inherently problematic, it is very important for a flight crew to notice details and avoid being hasty or superficial. However, while the captain chose the same word in interview to describe the required walk-around, it is uncertain whether this choice of term affected the captain’s attitude towards this task.

While individual factors were likely involved, the high incidence of incomplete or absent walk-arounds from the operator’s engineer and flight crews may be indicative of a systemic, cultural issue, possibly that of a casual approach to these important tasks.

Walk-arounds need to be completed in full and with careful diligence. Each one needs to be conducted with the mindset that it may be the sole opportunity to detect damage or other irregularities and confirm the aircraft’s readiness for flight. The ATSB has investigated recent occurrences where serious damage was not detected despite multiple routine walk-around visual inspections by flight crew and engineers. These include tail damage to an ATR-72,^[80] and engine nacelle damage to a Boeing 737.^[81]

Dispatch coordinator walk-around

In Brisbane, Menzies did not typically perform dispatch duties or the associated dispatch walk-arounds, but ground handling staff received training and guidance appropriate to the duty. There were procedures that required the dispatch walk-around to be undertaken, specifically identifying pitot probes as an item to check. Accordingly, had a walk-around been done, the presence of the pitot probe covers was likely to have been identified.

The leading hand stated that they did not do a dispatch walk-around because they did not have headset duties for that aircraft, as that responsibility had been handed over to another ground handler who was called to assist in the final minutes before departure. The other ground handler who was called to assist with the dispatch stated that they believed the leading hand had already done a walk-around as the aircraft appeared to be ready for dispatch.

Regardless of whether the leading hand was qualified to perform the dispatch, the leading hand and dispatch coordinator were both aware of the need to conduct a dispatch walk-around. The leading hand, who would have known that it had not been done, did not do it personally or tell the dispatch coordinator that one was needed. Having remained in the area after handing over dispatch duties, it would have been readily apparent to the leading hand that the dispatch coordinator did not perform a walk-around. The dispatch coordinator, who held primary responsibility for the task, may have assumed that it had been done but did not check, and could have done it if there was any doubt. The omission of this walk-around was therefore probably the result of a combination of individual violations and poor communication.

Menzies stated that operator-specific training was delivered to line personnel in June 2018, and the occurrence leading hand thought that it was required to be able to conduct dispatch coordination of Malaysia Airlines aircraft. However, Menzies did not have records of this training being required or delivered, and neither of the occurrence Menzies staff recalled having received it.

The level of non-compliance for walk-arounds of Malaysia Airlines aircraft in July 2018 (2 absent and 2 partial walk-arounds out of 8) is indicative of a non-compliance rate that should be detectable through observation audits, particularly those that assess multiple elements of the activity as Menzies did. However, Menzies audits over two separate 9-month periods in 2018 and 2019 showed 100% compliance with assessed elements of the 544 required dispatch walk‑arounds, and a 99.2% compliance rate for the less safety-critical arrival walk-arounds (one non‑compliance out of 122).

It is unlikely that there were confounding factors related to the arrangements with Malaysia Airlines, as both relevant personnel were aware of the need to conduct walk-arounds when coordinating dispatch. Further, the requirement for arrival walk-arounds was not dependent on the operator but the conduct of arrival walk-arounds was similarly inconsistent.

While a high compliance rate is desirable, the assessed 100% compliance does not reflect actual compliance from the small sample assessed by the ATSB using video recordings. Such a mismatch between audited and actual compliance may indicate problems related to the manner in which the audits were conducted (for example, the auditing process being visible and inadvertently encouraging adherence) or non-compliance with the audit process itself (such as elements being marked as correctly completed when they were not observed).

Tool control

The undetected presence of a foreign object on an aircraft could potentially compromise flight safety or cause damage. For this reason, tools used for maintenance and ground handling of aircraft requires formal and informal controls to ensure they have been accounted for prior to flight. ATSB (2009) found that about 19% of foreign object damage (FOD) occurrences were from tools and equipment and:

The most common factor that contributed to FOD occurrences was individual actions relating to aircraft maintenance. These included replacing, repairing, and installing aircraft components, and the use and removal of tools and personal items from aircraft prior to the issue of a maintenance release or aircraft dispatch.

The primary function of tool control is to prevent tooling remaining on board (or fitted to) an aircraft prior to its departure. Its secondary function is to account for tooling as an asset. With the provision of a non-certifying engineer (AME) to assist Malaysia Airlines turnarounds, the relevant AMSA tool control requirements were not a reliable means to account for tooling (such as pitot probe covers) prior to aircraft dispatch. This was because the procedural checks were to be carried out when returning the tooling after the aircraft had departed and at the end of a shift, rather than prior to aircraft dispatch as licensed aircraft maintenance engineers (LAMEs) were required to do. This requirement was not relevant in this case, as the AME was in a non-certifying role. In addition, the existing controls were further degraded by the local practice whereby pitot probe covers, and other equipment were drawn from their storage location without being recorded.

Reliance on the technical log alone introduces practical considerations: either the LAME removes pitot probe covers sooner than strictly necessary, which would leave the probes vulnerable to insect contamination, or certifies for an aircraft with the covers still fitted with the intention to remove them later, which introduces the potential for error.

Gear pins and covers check

The Preliminary cockpit preparation procedure required flight crews to conduct a ‘pins and covers check’—that is, landing gear pins and pitot probe covers. When only this equipment is used for the aircraft, this check helps flight crews to ensure that the pins and covers would not be fitted at the time of departure.

However, Malaysia Airlines did not routinely carry pitot probe covers as part of the aircraft’s standard equipment, but retained the check for pitot probe covers. Because of this, flight crews would become accustomed to pitot probe covers being absent from the check, making the check ineffective for these items because others would have to be used. This was likely the case in this occurrence.

It was not possible to determine whether the captain physically checked for the presence of pitot probe covers in the flight deck compartment as required. Nevertheless, had they done so, they would have expected to find only landing gear pins because pitot probe covers were not routinely carried on the operator’s aircraft.

Procedural problems such as this can arise from conducting operations in a different way than originally intended, if there is insufficient consideration of how the change can affect the way procedures are carried out. The resulting inconsistencies can lead to an automatic prompt-and-response rather than actual verification that the check had occurred and affect flight crew perceptions of procedures in general.

Pitot probe cover characteristics

The pitot probe covers were fitted to the aircraft for most of the time that it was on the ground. Over much of this period, their presence would not necessarily be notable to people working in the area because they are not important at that time. However, in the short period leading up to pushback and taxi, ground crews begin to think in terms of the aircraft’s immediate readiness for flight, including whether the doors and panels are closed, whether ground equipment is still attached, and so on. If there is something preventing the aircraft’s readiness for flight, it needs to be resolved.

The main purpose of ‘remove before flight’ streamers is to create this awareness: if a person were to check for the presence of pitot probe covers or a landing gear pin, their attention is drawn to the required item by the checklist they are following, and a streamer simply helps them to find it. On the other hand, the streamers are used to draw attention at times when a person is not specifically looking for that item. In other words, the streamers exist to improve the likelihood of incidental—not purposeful—detection.

Therefore, while it is not surprising that the ground crews did not notice or act on the presence of the pitot probe covers during the majority of the turnaround, it is notable that several of them (all of whom would almost certainly be aware of the importance of a streamer marked ‘remove before flight’) apparently overlooked their presence in the immediate period before, during, and after pushback. For example, the leading hand was looking in that direction just before pushback, and the dispatch coordinator was looking in that direction when showing the flight crew the nose gear steering pin after the tug was disconnected.

While it is not clear whether the ground crews were paying much attention to the aircraft itself through this period, it is apparent that the pitot probe covers and streamers did not gain their attention, either from nearby (being well above normal eye height) or from a short distance (when they fill much less of an observer’s field of view).

The purpose of a ‘remove before flight’ streamer, attached to an item of ground support equipment such as a pitot probe cover, is to gain the attention of someone who is not primarily looking for the equipment.

A number of characteristics contribute to the conspicuity of streamers. Red streamers can provide effective contrast against a white fuselage in good light but may not be as attention-attracting in poor lighting such as night, especially when they are dirty. Reflective materials may be helpful at night.

Another factor is length. The streamers attached to the pitot probe covers provided by AMSA were about 60% the total length of lanyards and streamers attached to other covers approved by the aircraft manufacturer and used by Malaysia Airlines. Shorter streamers are less likely to draw a person’s attention when in their visual field even if they are not paying particular attention to that area.

A longer streamer, or one with a lanyard, is more likely to move if wind is present. In general, a human’s perceptual system is sensitive to motion, particularly in their peripheral vision (McKee and Nakayama 1984; Wickens and others 2013). However, it has been reported that the greater force on longer streamers in strong winds can occasionally drag the covers off. Operators need to balance the likelihood of this occurring against the need to ensure their removal before flight through the use of longer streamers.

Larger aircraft such as the A330 have pitot probes that are well above eye height and therefore often out of sight or in the peripheral vision of people working nearby. People are not effective at perceiving details in the peripheral vision (Proctor and Proctor 2012). With such aircraft, a longer streamer and/or lanyard would enter their field of vision more often, increasing the likelihood of being noticed during normal activities.

The limited conspicuity of the pitot probe covers used on the occurrence aircraft reduced the likelihood of incidental detection of the covers, which is important during turnarounds. Pitot probe covers are frequently used when aircraft undergo deeper maintenance or are parked or stored for an extended period, where their use is routine and there is ample opportunity to detect them once an aircraft is to be released to service. On the other hand, there are increased time pressures and fewer opportunities for their removal during turnarounds. However, there are incidental opportunities that arise for ground crews to notice pitot probe covers while doing unrelated tasks such as attaching a tug and pushing the aircraft back, and the likelihood of this incidental detection is increased with the use of larger or brighter streamers.

Operator port induction for Brisbane

Application of engineering functions in practice

A standard ground handling agreement for AMSA to perform all technical handling functions was completed on the day of the occurrence. However, the arrangements for Malaysia Airlines to perform and control the technical handling functions with assistance from AMSA continued in practice, so the terms of the agreement probably did not have any substantial effect on the night of the occurrence. The operator’s interim arrangement of having a travelling LAE assisted by a local engineer was probably associated with being unable to obtain the required approvals in a short period of time.

Although there were no settled agreements between the organisations, line personnel and their immediate managers did appear to have a clear understanding of their broad roles, including which people were responsible for engineering certification (the LAE) and dispatch coordination (Menzies staff).

However, the interim arrangement changed the way engineering functions were carried out compared with normal operations. In particular, the operator did not appear to recognise that the LAEs would be likely to feel higher time pressures than usual, due to the need to board the aircraft for flight, and could not in practice perform the engineering pre-departure walk-around inspection because the aircraft doors had to be closed and then checked from outside.

This demanded a higher level of improvisation, communication, and coordination than usual, during every turnaround, and contributed to a working environment in which errors were less likely to be caught.

Dispatch coordination

Although an agreement for Menzies to provide dispatch coordination had been drafted about 2 weeks before the resumption of flights, the operator only delivered a course to Menzies instructors for dispatch coordination a few hours before operations were to resume. This increased the risk of underqualified staff being rostered had there been important safety elements to convey.

Separately, although using ground handlers and not engineers to perform dispatch coordination should not inherently carry any additional risk, an engineer is more likely to identify things that could affect the safety of flight (such as the presence of pitot probe covers during pushback) and is more likely to remember any incomplete tasks when staying involved in the turnaround operation until the end. An engineer also has a deeper level of understanding about the requirements for safety of flight (including the importance of pitot probes) and is therefore more likely to identify less-obvious problems.

Finally, in this case, using an engineer for dispatch coordination would have been one way to overcome the problem of how the engineering pre-departure walk-around inspection could be done in practice. Task analysis activities can also help identify these types of problems. This involves breaking a task (such as managing a turnaround) into progressively smaller tasks and considering variables that may impact the completion of certain steps. For example, by considering each step that each person must complete during a turnaround with the arrangements in place at Brisbane, it may become clear that the LAE would not be able to finalise the transit check from on board the aircraft. The process can then be changed to prevent this situation from arising.

Continuation of operations without firm arrangements

The Malaysia Airlines investigation report stated that the ground service arrangements had substantially changed in the days before the resumption of Brisbane flights, but in terms of dispatch coordination this was not corroborated by other evidence such as the draft agreement for Menzies to perform dispatch coordination signed by the operator 2 weeks beforehand. Furthermore, had AMSA withdrawn from an agreement to conduct engineering certification, the short-term situation remained the same because regulatory approval was still pending.

Regardless of whether a late change actually did occur, other records indicate that some of the key activities required for the recommencement of Brisbane operations were conducted shortly before, and sometimes after, flights had resumed. Specifically:

• a risk assessment had been performed less than 2 weeks previously, leaving little time to approve and implement mitigation strategies
• long-term engineering arrangements had not been finalised, with an agreement with AMSA not yet being signed by either party (and possibly not yet drafted)
• there was no regulatory approval for AMSA to perform aircraft certification (likely requiring Malaysia Airlines to make interim arrangements with a travelling engineer and local support engineer)
• long-term ground handling arrangements had not been finalised, with two agreements being Menzies were drafted and signed by the operator (one on the same day as the first flight) but not finalised by Menzies
• training had only been provided to Menzies trainers on the day that flights resumed, and there was uncertainty around whether that training was required to be—or actually—provided to Menzies front-line personnel.

In total, while line personnel might not generally be aware of the broader organisational picture, details about operational implementation of contractual agreements do filter through, and there was an unusually high level of vagueness how all turnaround tasks would be performed in practice.

When working in an established role in a consistent way, people develop personal practices and habits that generally reduce the incidence of error. When an unusual situation arises, as is common in the ramp environment, it is necessary to rely on the initiative, knowledge and skills of individuals. No process can address every potential situation. However, relying on individuals increases the risk of individual error, so relying heavily on individuals who are largely working outside defined procedure should not become the norm.

In this case the engineers and dispatch coordinators were required to perform their roles in a different way to how they were accustomed. For example, there was also overlap in specific services that were agreed with both providers; for example, the agreements with both providers included dispatch coordination. Although in practice there was no apparent uncertainty about this particular function, this type of inconsistency can sometimes translate to misunderstandings about roles and responsibilities among line personnel, particularly when arrangements change or the individuals are performing tasks to which they are not accustomed.

Although this problem is foreseeable, it can be easily overlooked. A broadly similar problem with communication and coordination resulted in an uncommanded aircraft movement during pushback in 2016, resulting in aircraft damage.^[82]The use of specialised methods (such as task analysis) can help identify this kind of risk. Also, the ICAO Safety Management Manual suggested joint hazard-identification activities guidance on hazard identification when working with other organisations:

Organizations should also identify hazards related to their safety management interfaces. This should, where possible, be carried out as a joint exercise with the interfacing organizations. The hazard identification should consider the operational environment and the various organizational capabilities (people, processes, technologies) which could contribute to the safe delivery of the service or product’s availability, functionality or performance.

As an example, an aircraft turnaround involves many organizations and operational personnel all working in and around the aircraft. There are likely to be hazards related to the interfaces between operational personnel, their equipment and the coordination of the turnaround activity.

Airlines world-wide have an increasing reliance on external engineering and ground handling support services. Therefore, it is of vital importance that there are clear lines of communication, procedures, and standards in place between all parties involved to ensure that tasks are implemented and undertaken correctly. This necessitates thorough planning, initiated early, with check points along the way to ensure that the implementation is on track.

Limitations of the risk assessment

The risk assessment for the resumption of Brisbane operations had numerous problems that reduced its effectiveness. For example, where controls changed a risk category or posed other risks (for example, using pitot probe covers), these effects were not fully recorded or explored. The ICAO Safety Management Manual stated:

A determination of any unintended consequences, particularly the introduction of new hazards, should be made prior to the implementation of any safety risk controls.

The risk assessment had limited or absent categorisation of risk, which meant that compound risks—those where the hazard can have multiple effects—were not fully explored. This can result in misconception of the risk. For example, the use of pitot probe covers may present a risk to safety of flight (through being left on) and customer service (through delays) if their use is not well-managed. Treating one risk may result in the other being overlooked, depending on the chosen risk controls. By specifying each category of risk and treating them separately, the identified risk controls can then have adequate coverage of the potential undesired outcomes and aid the prioritisation and allocation of resources.

The assessment also obscured the distinction between existing and additional risk controls. That is, future activities were listed as existing controls, and prospective assurances from third parties, which do not necessarily translate to actual activities, were listed as though they had a direct effect on risk. Also, additional controls were sometimes rewordings of existing controls or stating how they were to be achieved, which does not have any additional effect on risk. Therefore, risk could not be reduced by the stated controls.

Furthermore, the risk assessment contained a number of errors, most notably that four of the residual risk entries were erroneously recorded as ‘low’ instead of ‘medium’ (possibly as the result of a data entry error). This, in part, allowed the operator’s review and assurance processes to be bypassed, as will be explained in Limitations of operator change and risk management processes, below. In essence, a mistake allowed it to bypass a means for detecting mistakes.

Overall, these problems with the risk assessment approach—the lack of outside involvement, absence of consideration of introduced risk, limited categorisation, incorrect use of controls, and errors—negated its value. The E&M and flight operations departments were probably not involved in the risk assessment, and did not perform or record a separate risk assessment. The absence of this specialist input increased the likelihood of certain risks being overlooked or underestimated.

Non-implementation of risk controls

Although the risk assessment for the recommencement of services into Brisbane was conducted less than two weeks before operations resumed, the risk assessment identified generally appropriate safety risks, including the mud wasp hazard, and the need for appropriate risk controls. Although this was late in the planning process, there was no evidence whether the limited time prevented implementation of the identified risk controls (as the operator had not previously used pitot probe covers at Brisbane, this was not just a matter of reactivating existing controls).

The Malaysia Airlines airport services (AS) department, which held overall responsibility for the planning and implementation of the resumed service to Brisbane, conducted the risk assessment without apparent involvement from other relevant departments. This probably limited the quality of the risk assessment, particularly regarding the identification of hazards and the evaluation of risk control practicality and effectiveness.

In particular, within the scope of the change management process, the flight operations department was not appraised of the assessment of the mud wasp risk or the proposed use of pitot probe covers. Therefore, subject matter experts therein had no prompt to manage the potential effects of the hazard or control on the safety of flight from a flight operations perspective.

The engineering and maintenance (E&M) department was reportedly informed of the need to implement certain risk controls, including a checklist for the installation and removal of the pitot probe covers during transit at Brisbane Airport. No such checklist or similar process was developed for reasons that could not be fully established.

Although the operator had high-level processes for tracking implementation of risk controls and other actions, the processes permitted some risks to be managed at a departmental level, which occurred in this case. The AS and E&M departments probably had informal risk management processes, and ultimately, it appears that individuals within those departments did not follow up on the identified actions. It is likely that, in the absence of formal action tracking, a combination of individual errors led to the required control not being implemented and the issue not being finalised.

In addition, the risk assessment was approved by the regional AS department head, which was one level below the required approval level required by the corporate safety management manual (CSMM). There was no evidence to evaluate whether this had an impact on the quality of the assessment.

Promulgation of safety information regarding the wasp hazard at Brisbane

It was reported that the Malaysia Airlines flight operations assessors planning for the resumption of Brisbane operations were not aware of the mud wasp hazard at Brisbane. This was due to the relevant information not being included in the airport operational information used by Malaysia Airlines. Additionally, there was no formal process to monitor relevant safety information from foreign regulators to ensure that it reached the appropriate people. Some flight operations staff had obtained the airworthiness bulletin about mud wasps at Brisbane, but this information did not reach the individuals responsible for assessing the port safety from a flight operations perspective.

As a result, the flight operations department did not perform a risk assessment for the hazard, so there were no Brisbane-specific flight operations risk controls in place such as measures to advise flight crews of the increased risk of erroneous airspeed (either due to mud wasp nesting or pitot probe covers remaining fitted) or of the use of pitot probe covers to provide an expectation for them during walk-arounds.

Separately, the operator’s airport services (AS) and engineering and maintenance (E&M) departments became aware of the mud wasp hazard at Brisbane through advice from the local service providers as part of a broader port assessment process. However, there was no strategy to control the fitment and removal of pitot probe covers, which increased both the risk of mud wasp infestation (since they were only sometimes fitted) and the risk of non-removal of pitot probe covers when they were used.

Had a strategy been in place, it is likely that the flight crews and engineers would have been informed about the use of pitot probe covers at Brisbane and been more likely to notice or remember their presence. It would have also been more likely to result in improved coordination about their use between Malaysia Airlines and AMSA engineers.

On a separate but related note, the agreements (once settled) between Malaysia Airlines and the two ground services providers did not explicitly state whether the available services would always, or only sometimes, be applied. Most relevantly, the agreements requiring the provision of pitot probe covers did not include information about when their fitment was expected: on every turnaround, if an aircraft is to be parked for a period of days, or some other condition. It is feasible that two organisations could pass different interpretations of the requirement onto line personnel, increasing the likelihood of miscoordination or miscommunication on the ground.

Limitations of operator change and risk management processes

Introduction

The operator had multiple pathways, including risk management processes and change management processes, for significant operational risks to be (a) brought to the attention of relevant departments and (b) to be managed and tracked at a higher level. According to these processes, risks that could not or should not be managed within one department were meant to be brought to the attention of senior managers at safety risk assessment team (SRAT) meetings. In principle these processes should be sufficient to manage risk.

However, the SRAT was not notified of the resumption of Brisbane operations. This was due, in part, to a combination of problems in the relevant processes, allowing the circumvention of broader risk and change management pathways that would normally involve the SRAT in the management of significant changes and risks. This meant the opportunity to strengthen the risk assessment through peer review and oversight was lost. There was no opportunity for stakeholders to learn of the risk and help manage it effectively, including the use of the SRAT’s formal risk management records.

Stakeholder involvement in change and risk management processes

First, the corporate safety management manual (CSMM) required significant changes to be notified to the SRAT, and the resumption of Brisbane operations after a 3-year cessation clearly fell under several of the applicable criteria. The reasons for the change not being tabled (even though preparations were underway) are unclear, although re‑establishing a route to an established international airport may not have been seen as a high-risk enterprise.

There was representation of various departments at the SRAT, as well as nominated accountable persons, increasing the likelihood that important changes and risks would be raised at that forum if the other processes had not done so. However, accountable representatives of the various departments were only intermittently present at the SRAT meetings held during the relevant period. In particular, the accountable person for the AS department (the department responsible for managing the change) was absent from all those meetings, which placed higher dependence on the alternate representatives. These representatives attended only 3 meetings and did not table the change at these meetings, or table the risks associated with the change at the next meeting after the risk assessment was done.

Given the involvement of other departments in the actual activity of planning the resumption of services to Brisbane, it is highly likely that there was wider awareness of the change across the SRAT, and yet the SRAT as a group did not proactively identify it as a change that needed its attention.

In addition, according to the operator’s processes, the SRAT would only become involved in the risk management process for higher-level risks. While this is a reasonable (and common) provision to limit the number of less-important risks that the SRAT had to manage, the risk management process did not require any level of review or stakeholder involvement to identify problems with a risk assessment, such as if the assessor does not identify all relevant risks, underestimates risks, overestimates the effectiveness of controls, or makes other errors in the assessment.

The ICAO Safety Management Manual states:

It is important to involve the “end users” and subject matter experts in determining appropriate safety risk controls. Ensuring the right people are involved will maximize the practicality of safety risk chosen mitigations.

In this case, subject matter experts and key stakeholders in associated disciplines (especially flight operations and engineering) were not involved in the process of assessing the safety risk and the identification of effective controls, and the wider group (with established processes) was not used for assurance and oversight of the implementation of risk controls. Management of safety risk could therefore, in some circumstances, be left to one person.

This meant that there was a likelihood of the change initiator having an incomplete picture of risk, and that identified controls could not be checked for validity and effectiveness by the people responsible for implementing them.

Potential for process misinterpretation and non-registration of risk controls

The second problem was related to the change and risk management processes both allowing an interpretation that permitted risks to be managed by the responsible department alone if the risks could be reduced to ‘low’ after applying risk controls. In this case, through the change management process, Malaysia Airlines identified seven risks that were rated as ‘medium’ initially, and then reduced to a ‘low’ residual risk through proposed risk controls. That assessment was flawed, as discussed previously, but this may also explain why the risks were not raised at the next SRAT after the risk assessment: the assessor may have thought it meant ‘low’ residual risks did not need further attention.

This may have been partly because the risk management process used a flowchart for the safety investigation process (Figure 49). This was specific to the safety reporting process, but it was used as the generic process for all other risk assessments. This required a substantial amount of interpretation by the user because several of its elements were only applicable to the safety reporting process and subsequent investigation.

Figure 49: Part of the operator’s safety risk management process, annotated

Source: Malaysia Airlines, annotated by the ATSB

From a safety investigation perspective, the ‘risk?’ decision point clearly referred to initial risk, because this part of the process would come before the investigation and identification of additional risk controls. However, from the perspective of a person applying the flowchart to risks identified by a change management process, the distinction between initial and residual risk is less clear. That is, the process did not clearly state whether the ‘risk?’ decision point should be based on initial or residual risk.

The flowchart had a decision point marked ‘Investigate?’ for risks assessed as ‘low’, which led to no further action if the assessor answered ‘no.’ This decision point was appropriate for the safety report investigation process but was not fully applicable to change-oriented risks. There was no guidance about how to make this decision, and a person could reasonably think that there was no need to ‘investigate’ if they felt they had the required knowledge at hand and was unaware of any errors in the assessment.

Separately, the change management process had a similar potential for misinterpretation (Figure 50). The intention of the flowchart appears to have been to:

• prompt a risk assessment
• prompt a mitigation plan and registration of controls if the initial risk was not acceptable
• enable the implementation of a change if the initial (untreated) or residual (treated) risk was acceptable (the pathways leading to ‘Implement Change’).

Figure 50: Operator’s change management process flowchart, annotated
 

Source: Malaysia Airlines, annotated by the ATSB

However, the flowchart may have unintentionally allowed the implementation of change based only on the residual (treated) risk in the following manner. A person conducting the assessment was prompted to propose risk controls when using either of the available risk assessment forms (the change management form or the risk assessment record form) as part of the ‘Risk Assessment’ step. This assessment would produce both an initial risk and a residual risk. There was no guidance on which of these should be used for the ‘Risk Acceptable?’ decision, allowing ‘low’ residual risks to be accepted without review even if the initial risk was moderate or above as the process probably intended. In fact, the pathway shown in Figure 50 was applied during the assessment for the resumption of Brisbane flights, although it is unclear whether the above reasoning was used in this instance.

The risk controls identified during this process reduced the risk from a level requiring mitigation and ongoing monitoring to a level that did not, but did so only nominally. If following the illustrated pathways, the risk and change management flowcharts only required existing risk controls to be registered, not new controls. As a result, there was limited assurance that the assessed reduction in risk actually took place. If the risk controls were ineffective, not implemented, or introduced other risks—all of which occurred in this instance—then the actual risk could be higher than estimated.

Other limitations of the change management process

The resumption of Brisbane services was correctly treated as a change in accordance with the CSMM (with the exception that it was not notified to the SRAT). However, there were limited records of the planning and conduct of the change, indicating that a complete change management process may not have been followed.

Change management is an important element of a safety management system. The operator’s change management process and guidance overall was very limited and omitted many key elements of an effective process, including requirements to:

• plan the change
• identify stakeholders and assign responsibilities
• document the change (such as through a change control register)
• categorise the change (enabling tailoring of the process across minor and significant changes),
• identify regulatory compliance requirements
• produce and track actions, and
• monitor and review the change after implementation.

The ICAO Safety Management Manual (primarily directed towards states rather than operators) first detailed such change management steps in the 4th edition, published in January 2018. Nevertheless, these principles had been well-established before then; for example, Hayes (2002) expanded on a wide range of change management topics, drawing on models and methods developed over the preceding decades. This more-detailed level of organisational change management has also been applied to aviation (Flouris and Yilmaz 2011).

Many key elements of established change management practices were omitted from the Malaysia Airlines planning and implementation of a major change (the reintroduction of Brisbane services). This may be due to the absence of details about change management in the CSMM, which hindered the operator’s ability to systematically validate the tolerability of risk, meet the strategic objective (namely, the successful implementation of change) and potentially affecting the safety objectives as well.

There were also problems with the defined process. The written description of the change process did not clarify how change management triggers were to be identified to the SRAT meetings, or who held the responsibility to do so.

Also, the provided change management form was essentially an alternative risk assessment form despite being used for a different purpose, and this may have led the assessor to conflate the two purposes to some degree. Furthering this problem, the labelling of the form as a change management form may lead to the risks not being entered into the appropriate risk registers as would be expected if the risk assessment form is referenced instead. These issues ultimately meant that the assessment had reduced value both as a change management exercise and as a risk management exercise.

__________

77. These 8 occurrences are: the occurrence flight, 2 other flights from 2010–-2019, and 5 flights from January 2020–April 2021. See Airbus operator reports
78. The latter two occurrences are the A330 in Brisbane in 2013, and the A321 in Doncaster in 2020.
79. Although there is little benefit in naming all relevant species (pilots may not be familiar with relevant bird and bat types), operational information should include details such as the size of the animals as well as relevant information about their flocking and movement habits so that pilots can plan and prepare appropriately.
80. In-flight upset, inadvertent pitch disconnect, and continued operation with serious damage involving ATR 72 aircraft, VH-FVR, 47 km WSW of Sydney Airport, NSW on 20 February 2014. Available at www.atsb.gov.au.
81. Engine nacelle strike and continued operation involving Boeing 737-8FE, VH-YIW, Faleolo Airport, Apia, Samoa on 23 April 2016. Available at www.atsb.gov.au.
82. ATSB investigation AO-2016-028, Ground handling occurrence involving Airbus A330, 9M-MTB, Melbourne Airport, Vic, on 31 March 2016, available at www.atsb.gov.au.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors. Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the airspeed indication failure on take-off involving Airbus A330, 9M MTK, at Brisbane Airport on 18 July 2018.

Contributing factors

• In the absence of clear instruction or guidance, the Aircraft Maintenance Services Australia support engineer fitted pitot probe covers to the aircraft shortly after its arrival, as was done for some other airlines to mitigate the threat of wasp infestation. Later, the engineer left to perform tasks on another aircraft and did not return to the aircraft prior to its departure as intended.
• Due to miscommunication or error, a technical log entry was not made following the fitment of pitot probe covers. As a result, when the technical log was reviewed prior to flight, the presence of pitot probe covers was not detected.
• The Malaysia Airlines engineer saw the pitot probe covers fitted to the probes during the transit check, about 2 hours before departure, and intended to ask the support engineer to remove them. However, associated with the limitations of prospective memory, the operator’s engineer subsequently did not remember to do so.
• The captain did not expect, or detect, the presence of the pitot probe covers during their pre-flight exterior inspection (walk-around). The captain did not include a number of the required check items, including the right side pitot probe, and looked at the left side pitot probe area briefly.
• The Malaysia Airlines engineer did not perform a final walk-around inspection of the aircraft, including a check for pitot probe covers, as required by the transit check that the engineer had certified as complete. The engineer assumed that the walk-around would be completed by the support engineer and/or ground handlers.
• The Menzies Aviation person assigned as dispatch coordinator for the aircraft handed over that duty to another person immediately before pushback, and neither person conducted the required dispatch walk-around. This was the last procedural opportunity to identify the presence of pitot probe covers before the flight.
• The aircraft was released for flight with covers fitted to all three pitot probes, preventing the air data systems from measuring airspeed.
• There was limited and ineffective communication between the captain and first officer in response to the speed flag on each of the primary flight displays (which appeared at about 50 kt groundspeed during the take-off). This significantly reduced their coordination and capacity to interpret the situation with the limited time available.
• While independently trying to diagnose a rare and unfamiliar problem during take-off, the flight crew experienced high cognitive workload, time pressure, and stress. This reduced their capacity to effectively interpret the situation and make a decision early enough to safely reject the take-off.
• The Airbus guidance provided in the flight crew techniques manual and other manuals for assisting A330 flight crews to decide whether to continue or reject a take-off did not discuss unreliable airspeed indication scenarios. (Safety issue)
• In the Airbus A330, there was no auditory alert associated with nil or unreliable airspeed from two or more sources during take-off (a high workload, critical phase of flight). Comparatively, other critical failures provide both visual and auditory indications. (Safety issue)
• Although suitable for use in most situations, the streamers attached to the pitot probe covers supplied and used for A330 operations by Aircraft Maintenance Services Australia provided limited conspicuity due to their overall length, position above eye height, and limited movement in wind. This reduced the likelihood of incidental detection of the covers, which is important during turnarounds. (Safety issue)
• Some Aircraft Maintenance Services Australia (AMSA) engineers extended the use of pitot probe covers (to mitigate the threat of wasp infestation) to operators that did not explicitly require it, including Malaysia Airlines. This increased the likelihood of error associated with the use of pitot probe covers because AMSA engineers were not controlling the engineering activities and were not permitted to make technical log entries. (Safety issue)
• Aircraft Maintenance Services Australia did not have a reliable method to account for tooling and equipment (such as pitot probe covers) prior to aircraft dispatch when providing non-certifying engineering support. (Safety issue)
• Menzies Aviation staff did not consistently carry out the required arrival and pre-departure aircraft checks of Malaysia Airlines aircraft, and Menzies Aviation audit processes were not effective at evaluating compliance with these requirements. (Safety issue)
• Malaysia Airlines flight crew and engineers did not fully complete the required aircraft inspections. (Safety issue)
• Malaysia Airlines did not clearly specify the division of engineering responsibilities between Malaysia Airlines and Aircraft Maintenance Services Australia engineers at Brisbane, leading to ambiguity with regard to who should conduct the final walk-around portion of the transit check. This risk was increased by the operator commencing and continuing flights to Brisbane with interim ground handling and engineering arrangements that varied from usual industry practice. (Safety issue)
• Malaysia Airlines did not develop and disseminate guidance and procedures about the use of pitot probe covers to flight crews and engineers, and there was limited awareness among those groups of the need for pitot probe covers at Brisbane Airport. (Safety issue)
• The Malaysia Airlines risk assessment for the recommencement of operations into Brisbane had numerous errors and omissions that potentially reduced its effectiveness.
• Although Malaysia Airlines identified the potential risk of pitot probe obstruction by wasps at Brisbane, and decided to address the risk with the use of pitot probe covers, it did not effectively communicate risks and required actions between departments and follow them through to completion.
• Malaysia Airlines’ processes for the management of change did not follow recommended industry practices, and its risk and change management processes were not detailed and clear enough to assure:
  • the appropriate level of involvement of subject matter expertise and safety groups
  • that risk controls were implemented and monitored. (Safety issue)

Other factors that increased risk

• The flight crew briefly attempted to conduct troubleshooting during a critical stage of flight without calling for and adhering to the pitch attitude and thrust setting memory items of the Unreliable speed indication procedure, and also omitted the After Take-off/Climb
• For reasons that could not be determined, the tower controller did not respond to the initial PAN PAN call made by the flight crew after take-off.
• The Lido airport operational information did not include the Australian Aeronautical Information Publication (AIP) advice to fit pitot probe covers at Brisbane Airport (related to significant mud wasp activity), as well as other safety related AIP information. (Safety issue)

Other findings

• Once activated, the aircraft's back up speed scale (BUSS) was highly effective in reducing the flight crew's workload during approach and landing and provided critical flight information that would have otherwise been unavailable. The BUSS is available as an option on the Airbus A330 and other Airbus types.
• After the initial climb, the flight crew managed the unreliable airspeed issue with effective communication and coordination.
• The departures controller provided effective support to the flight crew from soon after take-off, including taking the initiative to provide groundspeed information.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.  All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Instruction and guidance for unreliable airspeed on take-off

Safety issue number: AO-2018-053-SI-16

Safety issue description: The Airbus guidance provided in the flight crew techniques manual and other manuals for helping A330 flight crews decide whether to continue or reject a take-off did not refer to unreliable airspeed indications.

Alerts associated with nil or unreliable airspeed during take-off

Safety issue number: AO-2018-053-SI-10

Safety issue description: In the Airbus A330, there was no auditory alert associated with nil or unreliable airspeed from two or more sources during take-off (a high workload, critical phase of flight). Comparatively, other critical failures provide both visual and auditory indications.

Pitot probe cover characteristics

Safety issue number: AO-2018-053-SI-09

Safety issue description: Although suitable for use in most situations, the streamers attached to the pitot probe covers supplied and used for A330 operations by Aircraft Maintenance Services Australia provided limited conspicuity due to their overall length, position above eye height, and limited movement in wind. This reduced the likelihood of incidental detection of the covers, which is important during turnarounds.

Aircraft Maintenance Services Australia use of pitot covers

Safety issue number: AO-2018-053-SI-01

Safety issue description: Some Aircraft Maintenance Services Australia (AMSA) engineers extended the use of pitot probe covers (to mitigate the threat of wasp infestation) to operators that did not explicitly require it, including Malaysia Airlines. This increased the likelihood of error associated with the use of pitot probe covers was because AMSA engineers were not controlling or conducting all of the engineering activities and were not permitted to make technical log entries.

Aircraft Maintenance Services Australia tool control

Safety issue description: AO-2018-053-SI-07

Safety issue number: Aircraft Maintenance Services Australia did not have a reliable method to account for tooling and equipment (such as pitot probe covers) prior to aircraft dispatch when providing non-certifying engineering support.

Menzies audits of dispatch coordination tasks

Safety issue number: AO-2018-053-SI-18

Safety issue description: Menzies Aviation staff did not consistently carry out the required arrival and pre-departure aircraft checks of Malaysia Airlines aircraft, and Menzies Aviation audit processes were not effective at evaluating compliance with these requirements.

Malaysia Airlines inconsistent walk-arounds

Safety issue number: AO-2018-053-SI-12

Safety issue description: Malaysia Airlines flight crew and engineers did not fully complete the required aircraft inspections.

Interim engineering arrangements

Safety issue number: AO-2018-053-SI-02

Safety issue description: Malaysia Airlines did not clearly specify the division of engineering responsibilities between Malaysia Airlines and AMSA engineers at Brisbane, leading to ambiguity with regard to who should conduct the final walk-around portion of the transit check.

Guidance about the use of pitot covers

Safety issue description: AO-2018-053-SI-14

Safety issue description: Malaysia Airlines did not develop and disseminate guidance and procedures about the use of pitot probe covers to flight crews and engineers, and there was limited awareness among those groups of the need for pitot probe covers at Brisbane Airport.

Change and risk management processes

Safety issue number: AO-2018-053-SI-05

Safety issue description: Malaysia Airlines’ processes for the management of change did not follow recommended industry practices, and its risk and change management processes were not detailed and clear enough to assure:

• the appropriate level of involvement of subject matter expertise and safety groups
• that risk controls were implemented and monitored.

Lido airport operational information

Safety issue number: AO-2018-053-SI-03

Safety issue description: The Lido airport operational information did not include the Australian Aeronautical Information Publication (AIP) advice to fit pitot probe covers at Brisbane Airport (related to significant mud wasp activity), as well as other safety AIP information.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety advisory notice to operators conducting flights to Brisbane Airport

SAN number:

AO-2018-053-SAN-003

On 30 August 2018, ATSB issued a safety advisory notice advising all operators that conduct flights to Brisbane Airport to consider the use of pitot probe covers and, if covers are used, ensure there are rigorous processes for confirming that covers are removed before flight.

The safety advisory notice is available at /publications/safety-advisory-notice/ao-2018-053-san-003/.

Amended airworthiness bulletin

On 6 July 2021, the Civil Aviation Safety Authority amended airworthiness bulletin AWB 02-052 Wasp Nest Infestation – Alert encouraging operators to ‘ensure all pitot / static and vent covers are removed prior to flight.’

Glossary

ADIRU	Air data inertial reference unit
ADR	Air data reference
AIP	Aeronautical Information Publication: a package of documents which provides all of the operational information necessary for the safe and efficient conduct of national (civil) and international air navigation throughout Australia and its States and Territories
ALERFA	Alert phase
ALT	Altitude
AME	Aircraft maintenance engineer (non-certifying)
AMSA	Aircraft Maintenance Services Australia
AOA	Angle of attack
AOI	Airport operational information
AS	Airport services
ATC	Air traffic control
AWB	Airworthiness bulletin
BEA	Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile
BUSS	Back up speed scale
CASA	Civil Aviation Safety Authority
CASR	Civil Aviation Safety Regulations
CCTV	Closed-circuit television
CSMM	Corporate safety management manual
CVR	Cockpit voice recorder
DAR	Digital aircraft recorder
E&M	Engineering and maintenance
E/WD	Engine and warning display
ECAM	Electronic centralised aircraft monitor: aircraft systems, displays aircraft system information, and specifies flight crew actions to be taken in the event of abnormal or emergency situations
EGT	Exhaust gas temperature: an engine status parameter
EPR	Engine pressure ratio: an engine status parameter
ERSA	En route supplement Australia: part of the Aeronautical Information Publication published by Airservices Australia, containing pictorial presentations of all licenced aerodromes and other information specific to aerodromes for planning a flight and for a pilot in flight.
FLEX	Flexible temperature: a thrust lever setting that provides a de-rated amount of thrust for take-off to reduce engine wear
FCOM	Flight crew operations manual
FCTL ALTN LAW	Flight control alternate law (ECAM message)
FCTM	Flight crew techniques manual
FDR	Flight data recorder
FL	Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s altitude at standard air pressure is referred to as a flight level. FL 150 equates to 15,000 ft.
FO	First officer
FOD	Foreign object damage
GHA	Ground handling agreement
GSE	Ground support equipment
IAS	Indicated airspeed
IATA	International Air Transport Association
ICAO	International Civil Aviation Organization
ISIS	Integrated standby instrument system
LAE	Licensed aircraft engineer (equivalent term to licensed aircraft maintenance engineer or LAME)
LAME	Licensed aircraft maintenance engineer: a ground engineer approved to certify for maintenance within the scope of their licence
NAV ADR 1 + 2 + 3 FAULT	Fault with all 3 ADRs (ECAM message)
NAV ADR DISAGREE	ADR disagreement (ECAM message)
NAV IAS DISCREPANCY	Navigation indicated airspeed discrepancy (ECAM message)
ND	Navigation display
OEB	Operations engineering bulletin
PAN PAN	An internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance
PF	Pilot flying: the pilot who controls the aircraft and, in normal operations, navigates
PFD	Primary flight display
PFR	Post-flight report
PM	Pilot monitoring: the pilot who, in normal operations, carries out support duties, monitors the pilot flying’s actions and the aircraft’s flight path, and makes radio communications
QRH	Quick reference handbook
RTO	Rejected take-off
SAN	Safety advisory notice
SGHA	Standard ground handling agreement
SLA	Service level agreement
SPD	Speed
SRAT	Safety risk assessment team
SRS	Speed reference system
TOGA	Take-off / go-around: a thrust lever setting that applies maximum available thrust
V1	Decision speed: the maximum speed at which a rejected take-off can safely be initiated in the event of an emergency
VR	Rotation speed: the speed at which rotation should be initiated

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew, engineers, and ground handlers
• Malaysia Airlines
• Aircraft Maintenance Services Australia and Heston MRO
• Menzies
• Civil Aviation Safety Authority
• Airservices Australia
• Lido
• Airbus
• Brisbane Airport
• aircraft recorded data.

References

Airbus (2006) ‘Pitot probes obstruction on ground’, Safety First, December, 11: 10–13.

Airbus (2007) ‘Unreliable speed’, Safety First, December, 5: 14–19.

Airbus (2014) ‘Control your speed… at take-off’, Safety First, July, 18: 6–17.

Airbus (2016) ‘Pitot probe performance covered on the ground’, Safety First, July, 22: 6–13.

Airbus (2019) ‘The adverse effects of unrealistic simulator scenarios’, Safety First, July, 28: 20–27.

Airbus (2020a) ‘Aircraft parking and storage’, Safety First, July, pp.1–8.

Airbus (2020b) ‘Preparing for a safe return to the skies’, Safety First, July, pp.1–9.

Airbus (2021) ‘Unreliable airspeed at takeoff’, Safety First, July, pp.1–10.

Airbus (2022) ‘Training pilots for resilience’, Safety First, January, pp.18–27.

Air Incidents Investigation Branch (AAIB) investigation report AAIB-2736, AAIB investigation to various Airbus and Boeing aircraft between 9 June and 19 July 2021, United Kingdom.

ATSB aviation research investigation AR-2009-042, Ground operations occurrences at Australian airports 1998 to 2008, Australia.

ATSB occurrence investigation AO-2011-102, VFR flight into dark night involving Aérospatiale, AS355F2 (Twin Squirrel) helicopter, VH-NTV, 145 km north of Marree, SA on 18 August 2011, Australia.

Baker DP and Dismukes RK (2002) ‘A framework for understanding crew performance assessment issues’, The International Journal of Aviation Psychology, 12(3), pp.205–222.

Boeing (2003) ‘Erroneous Flight Instrument Information’, Aero, July, pp.11–21.

Brière, D, Favre C and Traverse P (2001) ‘Electrical flight controls, from Airbus A320/330/340 to future military transport aircraft: a family of fault-tolerant systems’, in Spitzer, CR (ed) The Avionics Handbook, CRC Press, United States.

Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) investigation report BEA2018-0071.en, Incidents to the Boeing 737-800 registered F-GZHO operated by Transavia France on 7 February 2018 at Norwich (United Kingdom) and 8 February 2018 at Paris-Orly, France.

CASA (Civil Aviation Safety Authority) (2017) Advisory Circular, Teaching and assessing non-technical skills for single-pilot operations, AC 61-08, January 2017, Australia.

Casner SM, Geven RW & Williams RT (2013) ‘The effectiveness of airline pilot training for abnormal events’, Human Factors: The Journal of the Human Factors and Ergonomics Society, 55(3): 477–485.

Civil Aviation Authority (CAA) (United Kingdom) (2013) Monitoring matters: guidance on the development of pilot monitoring skills, 2013/02, April 2013, United Kingdom.

Civil Aviation Authority (CAA) (United Kingdom) (2021) Safety Notice, Pitot Blockage Events, SN‑2021/014, June 2021, United Kingdom.

Dismukes RK (2012) ‘Prospective memory in workplace and everyday situations’, Current Directions in Psychological Science, 21(4): 215–220.

Doll TJ and Folds DJ (1986) ‘Auditory signals in military aircraft: ergonomic principles vs. practice’, Applied Ergonomics, 17(4): 257–264.

Dutch Safety Board (2021) Interim warning in response to two serious incidents involving commercial aircraft [online document], accessed 9 June 2021.

Ecosure 2017. Mud-Nesting Wasps and Aircraft Safety at Brisbane Airport – progress report. Presented to Brisbane Airport Corporation, 2017.

European Union Aviation Safety Agency (EASA) 2020. Guidelines, Return to service of aircraft after storage: Guidelines in relation to the COVID-19 pandemic, TE.GEN.00107-003, November 2020, Germany.

FAA (Federal Aviation Administration) (1993) Takeoff Safety Training Aid, PB93-780013, August 1993, United States.

Flight Safety Foundation (1999) ‘Erroneous Airspeed Indications Cited in Boeing 757 Control Loss’, Accident Prevention, October, pp. 1–8.

Flin R and Martin L (2001) ‘Behavioral markers for crew resource management: a review of current practice’ The International Journal of Aviation Psychology, 11(1): 95–118.

Flin R, O’Connor P and Crichton M (2008) Safety at the sharp end: a guide to non-technical skills, CRC Press, Florida US.

Flouris TG and Yilmaz AK (2011) Risk management and corporate sustainability in aviation, Ashgate, Aldershot UK.

Foushee HC and Manos KL (1981) ‘Information transfer within the cockpit: problems in intracockpit communications’, in Billings CE and Cheaney ES (eds) Information transfer problems in the aviation system, NASA Technical Paper 1875.

Harris RL, Glover BJ and Spady AA (1986) Pilot workload and eye tracking, NASA Technical Paper 2525.

Harris D and Khan H (2003) ‘Response time to reject a takeoff’, Human Factors and Aerospace Safety, 3(2): 165–175.

Hawkins FH (1987) Human factors in flight, Ashgate, Aldershot UK.

Hayes J (2014). The theory and practice of change management, 4^th edition. Palgrave, United States.

Holt RW, Boehm-Davis DA and Beaubien JM (2001) ‘Evaluating resource management training’, Improving teamwork in organizations: Applications of resource management training, pp.165–188. CRC Press.

House AP, Ring JG and Shaw PP (2020a) ‘Inventive nesting behaviour in the keyhole wasp Pachodynerus nasidens Latreille (Hymenoptera: Vespidae) in Australia, and the risk to aviation safety’ PloS one, 15(11): 1–14.

House AP, Ring JG, Hill MJ and Shaw, PP (2020b) ‘Insects and aviation safety: the case of the keyhole wasp Pachodynerus nasidens (Hymenoptera: Vespidae) in Australia’, Transportation research interdisciplinary perspectives, 4: 1–14.

International Air Transport Association (IATA) (2020) Guidance for Managing Aircraft Airworthiness for Operations During and Post Pandemic. 2^nd edition, IATA, Canada.

Joint Aviation Authorities (1997) JAR–FCL: Part 1. (Aeroplane) flight crew licensing requirements. Hoofddorp, Netherlands: Author.

Knabl P, Cameron M, Dahlstrom N, Nolan P, Myers R and Da Cruz J (2018) Emirates/Seeing Machines A380 Eye tracking study 2018/2019 Internal report. Unpublished.

Landman, A, Groen, EL, van Paassen, MM, Bronkhorst, AW and Mulder M (2017) ‘The influence of surprise on upset recovery performance in airline pilots’, The International Journal of Aerospace Psychology, 27(1-2): 2–14.

Lee, YH & Liu, BS 2003, ‘Inflight workload assessment: Comparison of subjective and physiological measurements’, Aviation, Space, and Environmental Medicine, 74(10): 1078–1084.

Mack, A (2003) ‘Inattentional blindness: Looking without seeing’, Current Directions in Psychological Science, 12(5): 180–184.

McKee, SP and Nakayama, K (1984) ‘The detection of motion in the peripheral visual field’, Vision Research, 24(1): 25–32.

Mumaw, RJ, Sarter, NB and Wickens, CD (5-8 March 2001) ‘Analysis of pilots’ monitoring and performance on an automated flight deck’ [conference paper], 11th International Symposium on Aviation Psychology, Ohio, accessed 15 August 2019.

Orasanu, JM (1994) ‘Shared problem models and flight crew performance’ in Johnston, N, McDonald and Fuller, R (eds) Aviation Psychology in Practice, Ashgate, Aldershot.

Orasanu, J, Martin, L and Davison, J (29-31 May 1998) ‘Errors in aviation decision making: bad decisions or bad luck?’ [conference paper], Fourth Conference on Naturalistic Decision Making, Virginia, accessed 20 January 2021.

Orasanu JM (2010) ‘Flight crew decision-making’, in Kanki BG, Helmreich RL and Anca J (eds) Crew resource management, Elsevier, Amsterdam.

Proctor RW and Proctor JD (2012) ‘Sensation and perception’, in Salvendy G (eds) Handbook of human factors and ergonomics, John-Wiley and Sons, New Jersey.

Reason, J (2016) Managing the risks of organizational accidents, Routledge, United Kingdom.

Samn SW and Perelli LP (1982) ‘Estimating aircrew fatigue: a technique with application to airlift operations’ United States Air Force (USAF) School of Aerospace Medicine SAM-TR-82-21, United States.

Stevens, C, Perry, N, Wiggins, M and Howell, C (2006) Design and evaluation of auditory icons as informative warning signals, ATSB Transport Safety Report B2005/0120.

Stevens, SM, Goldsmith, TE, Johnson PJ and Moulton JB (2007) ‘Performance Differences on Rejected Takeoffs as a Function of Expectancy’, Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 51(2): 80–84.

Underwood, G, Ngai, A and Underwood, J (2013) ‘Driving experience and situation awareness in hazard detection’, Safety Science, 56: 29–35.

Veltman, JA and Gaillard, AWK (1998) ‘Physiological workload reactions to increasing levels of task difficulty’, Ergonomics, 41(5): 656–669.

Wickens, CD, Hollands, JG, Banbury, S and Parasuraman, R (2013) Engineering psychology and human performance, 4th edn. Pearson, United States.

Wolf, OT (2014) ‘Stress and memory retrieval: mechanisms and consequences’, Current Opinion in Behavioral Sciences, 14: 40–46.

Wolfe, JM, Brunelli, DN, Rubinstein, J and Horowitz, TS (2013) ‘Prevalence effects in newly trained airport checkpoint screeners: trained observers miss rare targets, too’, Journal of vision, 13(3): 1–9.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Airbus
• Airservices Australia
• Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA)
• Brisbane Airport Corporation
• Civil Aviation Safety Authority
• Heston MRO (previously Aircraft Maintenance Services Australia)
• Lufthansa Systems
• Malaysia Airlines
• Menzies Aviation
• captain and first officer
• leading hand and dispatch coordinator
• licensed aircraft engineer
• support engineer
• Swiss Transportation Safety Board
• tower and departure controllers.

Submissions were received from the following parties:

• Airbus and BEA
• Civil Aviation Safety Authority
• Malaysia Airlines

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Airworthiness bulletin AWB 02-052: Mud Wasp Infestation – Alert (Issue 6)

Appendix B - Personnel information

Captain

The captain held a Malaysian Air Transport Pilot (Aeroplane) Licence (ATPL), was certified in English proficiency at level 6 and held a valid Class 1 medical which contained limitations of ‘valid only as or with a co-pilot and shall wear corrective lenses. The captain held the appropriate qualifications to command the flight. Table C1 summarises the captain’s aeronautical experience.

Table C1: Summary of captain’s aeronautical experience

Total flying hours	14,411 hours
Total hours on the A330	555 hours
Total flying last 28 days	72.07 hours
Last proficiency check (simulator)	27 January 2018
Last line check (aircraft)	14 September 2017

The captain had worked for Malaysia Airlines since 1993 on Boeing 747 and 737 variants. In May 2017 the captain transferred from the 737-800 fleet to the Airbus A330 fleet. The operator’s A330 conversion course consisted of computer-based training, simulator training and line training in the aircraft.

A review of training records noted that training and check pilots commented that the captain’s abilities and performance during training were about average. A range of comments were noted on the captain’s command line training forms, generally not associated with any particular theme except that they showed that the captain may have had some difficulty with hand-flying using instrument raw data on the A330 only (likely to be associated with relative inexperience on this type). During the conversion training conducted in the simulator the A330 unreliable airspeed indication procedure was demonstrated to the captain.

The captain also completed the operator’s training programs in the following areas:

• crew resource management training in March 2017
• emergency procedures A330 conversion training in May 2017.

On 15 September 2017, the captain was cleared to line flying on the A330.

The occurrence flight was the first time the captain had operated to Brisbane Airport on an A330.

First officer

The first officer (FO) held a Malaysian ATPL, a current Class 1 medical certificate and held the appropriate qualifications to conduct the flight. Table C2 summarises the FO’s aeronautical experience.

Table C2: Summary of FO’s aeronautical experience

Total flying hours	6,544 hours
Total hours on the A330	4,582 hours
Total flying last 28 days	95.53 hours
Last proficiency check (simulator)	7 March 2018
Last line check (aircraft)	21 March 2018

A review of training records since 2016 indicated that the FO’s abilities and performance were consistently assessed to an above average standard.

Licensed aircraft engineer

The Malaysia Airlines licensed aircraft engineer (LAE) who certified for the aircraft on the night of the incident conducted an apprenticeship with the operator and attained an engineer licence in 2000, further attaining a type rating for the Airbus A330 in 2008. The LAE’s normal role was leading hand on a line maintenance shift at the operator’s main base in Kuala Lumpur, Malaysia.

When asked to self-rate fatigue using the Samn-Perreli scale (Samn and Perelli 1982), the LAE reported a rating of 4-5, indicating a level between ‘a little tired, less than fresh’ and ‘moderately tired, let down’. Accordingly, further information was obtained about the LAE’s 72-hour history.

The LAE took an 8-hour flight from Kuala Lumpur to Brisbane at 2030 on 16 July, having obtained ‘a few hours’ of sleep on the flight. Upon arriving in Brisbane, the LAE conducted a transit check on the aircraft. This aircraft had a hydraulic leak, which delayed its departure until about 0330. The LAE got to sleep about 0600, sleeping until about 1400 and having the rest of that day (17 July) off.

The LAE obtained about 10 hours of sleep the night before the occurrence, waking at 0600 on 18 July and spending the day at leisure before commencing travel to the airport at about 1700.

Based on this information, ATSB analysis, including the use of fatigue modelling software indicated that the LAE was not likely to have been experiencing a level of fatigue known to have a demonstrated effect on performance at the time of the occurrence.

Support engineer

The support engineer had about 18 years of experience in aircraft maintenance and joined AMSA in 2015. At AMSA the support engineer carried out line maintenance on customer aircraft as directed by AMSA licensed aircraft maintenance engineers.

There were no indications that the support engineer was experiencing fatigue at the time of the occurrence.

Leading hand

The leading hand had worked as a ground handler for about 6 years and was qualified to manage a team of ground handlers and certify for aircraft loading. The leading hand was also trained in receipt and dispatch in August 2017 through theoretical and practical training and assessment. That training covered several different aircraft types including the Airbus A330.

The leading hand started a ten-hour shift at 1500. They reported having a ‘pretty good’ level of alertness during the shift.

Dispatch coordinator

The dispatch coordinator had about 8 years of ground handling experience and was qualified to conduct leading hand duties, certify for loading aircraft and conduct dispatches. Training records showed the completion of dispatch coordination training, including both theoretical and practical training, in November 2016. That training appeared similar to that of the leading hand and covered several different aircraft types including the Airbus A330.

The dispatch coordinator started a ten-hour shift at 1500.They indicated that they ‘did not feel tired’ at the time of the occurrence, having just had 2 days off.

Appendix C - Recorded data

Overview

The ATSB recovered and downloaded data from the aircraft’s cockpit voice recorder (CVR) and flight data recorder (FDR) and obtained data from the aircraft’s digital aircraft recorder (DAR), used for routine monitoring by the operator. The post-flight report (PFR) was viewed and printed on the aircraft.

The data from the CVR and FDR contained all of the occurrence flight, while the DAR included all data up to 2348 and intermittent data after that time.^[83]

Flight data recorder and digital aircraft recorder

Airspeed measurement

The FDR recorded computed airspeed (CAS) from air data inertial reference unit (ADIRU) 3 once per second, and additionally from any one of the three ADRs twice per second depending on flight crew selection and data validity:

• if the air data switch is in NORM^[84] or F/O ON 3,^[85] and the data from ADIRU 1 is valid, the data from ADIRU 1 is recorded
• if the air data switch is in NORM or F/O ON 3, and the data from ADIRU 1 is invalid, the data from ADIRU 2 is recorded
• if the air data switch is in CAPT ON 3,^[86] and the data from ADIRU 3 is valid, the data from ADIRU 3 is recorded
• if the air data switch is in CAPT ON 3, and the data from ADIRU 3 is invalid, the data from ADIRU 2 is recorded

For each ADIRU, the airspeed data is considered valid when it is above 30 kts and there are no related fault conditions. Invalid data is indicated in the recording.

Throughout most of the flight, the recorded airspeed was invalid. There were some periods where airspeed data was valid (but incorrect), notably:

• For a period starting at 2331:39, after the aircraft passed 140 kt groundspeed on take-off, the CAS was recorded increasing through 32 knots, indicating that ADIRU 1 or ADIRU 2 first sensed airspeed above 30 kt at this time.
• At rotation, the FDR recorded 38 kt airspeed from ADIRU 1 or ADIRU 2 and the airspeed from ADIRU 3 had not yet reached 30 kt.
• ADIRU 3 first sensed airspeed above 30 kt at 2331:54 (the ISIS would have stayed at or near the bottom of the speed scale throughout take-off). The maximum airspeed sensed by ADIRU 3 was 57 kt.
• At 2338:29 the airspeed again reduced below 30 knots and was marked invalid. Over the following 10 minutes there were short intervals where the airspeed was recorded above the 30‑kt threshold.
• The maximum airspeed recorded was 66 kt at 2337:13 when the aircraft was at about 11,000 ft with a groundspeed of 226 kt.

Overall, these recorded airspeeds were consistent with the pitot probes being covered and having partial airflow passing through the covers at times, resulting in erroneous low airspeeds being measured.

The DAR sampled CAS once per second and preliminary analysis shows broadly similar values as the FDR.

Airspeed displays

It is generally not possible to conclusively determine which of the primary flight displays (PFD) (captain, first officer (FO), or both) showed valid airspeed when the recorded data became valid (above 30 kt) on take-off from 2331:39. After the air data switch was selected to F/O ON 3 at 2332:11, the FDR would have recorded the data from ADIRU 1 if valid, or ADIRU 3 if ADIRU 1 was invalid. Since it recorded valid data but the FDR‑recorded data from ADIRU 3 remained invalid, this means that the data recorded reflected a valid airspeed shown on the captain’s PFD at this time and also reflected the captain’s PFD (that is, from ADIRU 1) until the switch position changed later in the flight. Further, there was no sudden change in this parameter when the switching was made, suggesting that it is more likely than not that it was also recording from ADIRU 1 just before the switch to F/O ON 3 at 2332:11.

After the switch to F/O ON 3, as the ISIS CAS was still invalid, the FO’s PFD would have displayed the red speed flag from that point even if the data from ADIRU 2 was valid. From this point until the switch was returned to NORM, the recorded PFD CAS would have therefore been the same as shown on the captain’s PFD (through ADIRU 1).

When airspeed is invalid or below 60 kt, the associated angle of attack (AOA) data is flagged invalid. All three ADIRUs flagged AOA as invalid throughout the take-off. Since AOA 2 was invalid, if ADIRU 1 and ADIRU 2 airspeeds had both been displayed at any point during the take-off, the airspeed on the FO’s PFD remained below 60 kt.

The first time AOA 2 became valid was at 2332:24, at which time the air data switch was in the F/O ON 3 position and the FDR recorded 38 kt airspeed. This means that, at this time, the recorded airspeed data would have been from ADIRU 1; the captain’s PFD was indicating about 38 kt and the FO’s PFD was indicating at least 60 kt.

AOA 1 first became valid at 2333:40. The recorded CAS parameter smoothly reached 60 kt at this time, indicating that the recording was from ADIRU 1 at this point. AOA 3 was invalid for the entire flight.

The aircraft’s flight control computers entered normal law from 2333:42 to 2333:45. At the time, recorded CAS was 62 kt, the integrated standby instrument system (ISIS) CAS was 37 kt, and both AOA 1 and AOA 2 were valid. This means that the airspeed data, though invalid, met the conditions for the aircraft’s flight control computers to reconfigure to normal law for this brief period, .

Potential for stall

An aircraft may stall if AOA, which is the vertical angle of the airstream relative to the aircraft, is too high. This can occur when a pilot attempts to maintain height or climb when airspeed is too low. Although the AOA sensor data was treated as invalid for most of the flight because each associated airspeed was mostly below 60 kt, the AOA sensors were functioning correctly, and the FDR recorded their measurements. The ATSB estimated the aircraft’s proximity to the stall warning angle throughout the flight based on available recorded data. The AOA measured throughout the flight was below the estimated stall warning angle and well below the actual stall angle, meaning that the aircraft did not approach a stall condition at any point throughout the flight.

Potential speed exceedances

The ATSB estimated airspeed throughout the flight using the groundspeed, heading, and the recorded winds aloft at around the time of the flight. The resulting speeds are indicative of potential exceedances of the aircraft’s maximum permissible speed with the current configuration (flaps and landing gear) throughout the flight.

The maximum flap extended speed may have been slightly exceeded twice:

• for a period of about 2 minutes on climb (750–6,000 ft), by an average of about 8 kt up to a maximum 14 kt
• for a period of about 80 seconds after levelling off, by an average of about 3 kt up to a maximum of 5 kt

Cockpit voice recorder

Overview

The CVR recorded three channels: the captain’s and FO’s microphones and an area microphone. The CVR recording was from about 1303:22 onwards.

Interpretation of flight crew utterances

The audio quality of the captain’s and area channels were generally satisfactory. The FO’s channel was somewhat distorted.

Three ATSB investigators separately evaluated the flight crew speech and then compared interpretations. In addition, the operator’s interpretation of the area microphone channel (with the assistance of the flight crew) was also considered. The operator allowed the flight crew to review the recording.

Where there was any significant doubt about an interpretation, the more likely interpretation was given preference while allowing for the possibility of other interpretations. The least distinct statements are listed in Table C8.

Table C8: Least distinct flight crew statements

Time	Speaker	ATSB interpretation	Operator interpretation	ATSB comments
2331:18	Captain	‘ah, speed, speed’.	‘speed’	Very faint on the area channel.
2331:31	FO	‘bort uh’, ‘both yes’ or ‘what uh’	‘abort?’ (sounded like ‘bort?’)	Sounded most like ‘bort.’
2331:32	Captain	‘borders are red’	‘both also don’t have’	Syllable count is most consistent with ‘borders are red.’ The operator’s interpretation was that the captain was responding to the FO’s question, thinking that the FO had said ‘both?’, as in ‘are both airspeed indications inoperative?’
2331:33	FO	‘oh no’ or ‘both no’	‘both no’	-
2331:37	FO	‘captain?’	‘capt..?’	-
2331:40	FO	‘go to ADR three’ then indistinct	‘put to ADR three… abort, abort’	FO’s channel and area channel sounded completely different on the indistinct part.
2331:40	Captain	‘okay, check’	‘ah check’	Difficult to hear on the area channel as it was at the same time as the FO’s statement.

Loudness of speech during take-off

The loudness of the flight crew utterances during the take-off from commencement of take-off roll to rotation were measured using Audacity software (version 3.0.2, build ff5003a) with the ‘contrast analysis’ tool.^[87] This tool measures the difference between foreground (target) audio and background audio according to the WCAG 2 standard,^[88] which is an accessibility standard for web content. Under this standard, a minimum 20 dB^[89] loudness above background noise is required for the content to be considered acceptable.

The average loudness of the captain’s speech during this period was measured to be 25.8 dB above the background noise, and the FO’s was 27.8 dB. All statements by both pilots exceeded the 20 dB WCAG 2 standard except for the captain’s ‘speed’ utterance, which was 17.8 dB above the background noise.

Flight crew breathing rate during take-off

Respiratory (breathing) rate and intensity can be indicative of a level of individual stress. Typical respiratory rate for a healthy adult at rest is 15–18 breaths per minute.

The captain’s breathing was indistinct (indicating low intensity) until 2331:19, just after the ‘speed’ statement. Between that point and aircraft rotation, the captain’s breathing rate was at least 33 breaths per minute.

The FO’s breathing was indistinct until 2331:27, just before the 100 kt call, when a very faint breath was heard. The FO’s breathing increased in intensity from 2331:32 onwards, and until rotation the FO’s breathing rate was at least 26 breaths per minute.

Post-flight report

The PFR is a record of faults and messages detected by aircraft systems. Electronic centralised aircraft monitor (ECAM) messages, along with faults that are not presented to the flight crew are recorded in the PFR with the time that each fault or message first arose being recorded with 1‑minute precision. The order of messages and faults is not preserved when they fall within the same 1‑minute period.

The PFR was closed (that is, it ceased recording faults and messages) at 2336 due to logic intended to mark the end of a flight: when one of the ADIRUs provides a valid airspeed value above 80 kt for more than 1 s, and then none of the ADRs provided any valid airspeed above 80 kt for the next 150 s. These conditions were probably initially met at 2333, consistent with the brief presence of valid AOA data from ADIRU 2 at 2333 that indicated the associated pitot probe measuring airspeed above 60 kt at that time (that data was not directly recorded).

The PFR faults and messages, along with other effects, are listed in Table C9 with explanations based on ATSB and Airbus analysis.

Table C9: Effect of air data absence on aircraft systems

Time	Effects	Explanation
ECAM messages to the flight crew
2331	FLAG ON CAPT PFD: FD FLAG ON CAPT PFD : SPD LIMIT FLAG ON FO PFD: FD FLAG ON FO PFD : SPD LIMIT	The flight director and speed limit indications on both PFDs became unavailable as a result of the absence of valid air data.
AUTO FLT A/THR OFF	Autothrust disconnected due to the absence of two valid air data systems. This resulted in a master caution and associated chime after take-off.
F/CTL ALTN LAW	The loss of valid air data led to the flight control system entering alternate law at 1500 ft radar altitude (the alert is inhibited before then). Full stall prevention was not available, replaced by a stall warning that used AOA data[90] routed through the inertial reference part of the ADIRUs.
2332	ENG 1 EPR MODE FAULT ENG 2 EPR MODE FAULT	Engine pressure ratios were invalidated due to the absence of valid air data. As a result, the engines reverted to a degraded mode, where the thrust levers command N1 (compressor/turbine speed) rather than the engine pressure ratio.
Recorded fault messages (not displayed to the flight crew)
2331	ADIRU1+2+3 (1FP1+2+3) ADR	Each ADIRU flagged its associated AOA data invalid because the associated airspeed did not reach the minimum of 60 kts for AOA validity. The electronic flight control system rejects an ADIRU when it has invalid AOA data and the aircraft is airborne; this occurred for all 3 ADIRUs at lift-off, resulting in this fault.
2332	SENSE LINE: P2 TO EEC/EEC(E1-4000KS)	Engine pressure sensors, which were probably sensing valid data, were invalidated because they disagreed with the incorrect but matching pitot pressures provided by 2 of the ADIRUs.
2333	AUTO FLT REAC W/S DET FAULT	Reactive windshear detection fault was generated due to absence of valid angle of attack data.
2334	Intermittent EFCS	Maintenance messages associated with the receipt of invalid air data.
Hard ADIRU2(1FP2)/ FMGEC2(1CA2)

__________

83. The DAR was set to only record information that met the operator’s flight data analysis capture criteria.
84. NORM: normal.
85. F/O: first officer.
86. CAPT: captain.
87. See https://manual.audacityteam.org/man/contrast.html
88. WCAG: web content accessibility guidelines. See https://www.w3.org/TR/WCAG20/. Although this standard is not intended for analysis of CVR audio and does not necessarily mean that the speech cannot be (or is unlikely to be) heard and understood, it was considered a reasonable indication of the relative loudness of each utterance. Criterion 1.4.7 was used.
89. Ratios between two values are often expressed in decibels (dB). Speech that meets the 20 dB requirement will seem approximately 4 times louder than background noise.
90. Although AOA data was treated as invalid by the air data systems because the measured airspeed was too low, the data was treated as valid by the stall warning system.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 12 July 2018, the crew of a Boeing 737-8FE, registered VH-VUB was preparing for its flight from Sydney to Melbourne. During pre-flight preparation, the crew did not correctly configure air conditioning pack switches and did not identify the error following take-off. Consequently, the aircraft did not pressurise as expected and the Cabin Altitude warning presented as the aircraft passed 13,500 ft. The crew identified that the pack switches were OFF, reset them to AUTO and descended to 10,000 ft. After a short time, cabin pressurisation was under control and the crew continued the flight to Melbourne.

What the ATSB found

The ATSB found that the incorrect configuration of the pressurisation system resulted in the cabin altitude rising above 10,000 ft. Normal procedures and checklists, which were designed to ensure that the aircraft is correctly configured for flight, were not completed due to a number of factors, including training, distraction, high workload, low expectancy of error and supervision lapses.

What's been done as a result

The operator published a summary of the occurrence in an internal safety publication. They also issued a flight crew notification and conducted a roadshow to remind flight crew of the importance of standard operating procedures and checklist discipline. The operator is reviewing the checklist and is considering an additional check of packs/pressurisation during the climb. The operator has also introduced a flight operations safety assurance program, additional pressurisation event training and amended its training program to ensure continuity for trainee pilots.

Safety message

Flight crews are reminded that effective checklist management is essential for verifying that critical procedural items are undertaken and ensuring safe aircraft operation. Consequently, it is important to prioritise checklists appropriately and avoid conditions that may introduce potential errors or omissions. Flight crews are also reminded to use all available means for verifying correct system configuration and operation.

 

The occurrence

On 12 July 2018, a Boeing Company 737-8FE, VH-VUB, operated by Tiger Airways Australia (Tiger) was being prepared for its flight from Sydney, New South Wales to Melbourne, Victoria. For this flight, a trainee First Officer was the pilot flying (PF) and a training Captain was the pilot monitoring (PM).^[1]

The pilots switched off both air conditioning packs in accordance with the standard operating procedure (SOP) for starting the engines. The before taxi procedure followed engine start and although it included selecting the air conditioning packs to AUTO, the air conditioning packs remained OFF.

The aircraft took off at about 1136 Eastern Standard Time (EST).^[2] After flap retraction at approximately 1137, the crew completed the final component of the take-off procedure, followed by the after take-off checklist. At about the same time, air traffic control (ATC) issued several instructions to the crew. The take-off procedure and after take-off checklist both included a requirement to check the position of the air conditioning packs switches. However, during both the procedure and the checklist, the packs were not identified as being OFF.

At about 1142, while the aircraft was still climbing and passing 13,500 ft, the cabin altitude warning horn sounded. The First Officer identified that both air conditioning packs switches were in the OFF position. Both packs were then immediately switched to AUTO. The Captain took over control of the aircraft and selected altitude hold on the autopilot. The aircraft reached a maximum height of 14,900 ft (at about 1144), whereby the Captain disengaged the autopilot and commenced a descent to 10,000 ft. The warning ceased at about 1146. During this time, both pilots donned oxygen masks in accordance with the cabin altitude warning procedure.

Once level at 10,000 ft, the crew completed the remainder of the cabin altitude warning checklist. As the cabin pressure was now under control and operations were normal, the crew continued the flight to Melbourne.

__________

1. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) +11 hours.

Context

Pilot information

Captain

The Captain had been operating at Tiger since 2012, having joined as a direct entry Captain on the Airbus A320. He had previous experience as an airline training captain on Fokker F50, Fokker F28 and Airbus A320, a role he subsequently undertook at Tiger. In 2016, he transitioned to the Boeing 737 as part of Tiger’s introduction of the aircraft. The Boeing 737 type rating was completed in October 2016. The Captain completed Tiger line training in January 2017 and commenced instructional duties on type in March 2017.

The Captain’s previous experience included Fokker F50, Fokker F28, Airbus A319/320, Boeing 767 and varied operations including charter and instructional flying. The Captain reported that he had a total 21,511 hours with 949 hours on the Boeing 737. Command time on the Boeing 737 was 946 hours.

The Captain’s last line check was in February 2018 with no major concerns noted.

First Officer

The First Officer was an experienced pilot having been a captain on other types including Boeing 777 and 767. His operational experience included charter, regional, domestic and international flying. Returning to Australia in 2015, he did not fly for two years prior to joining Tiger in 2017.

The First Officer completed the Boeing 737 type rating in June 2017. The Tiger operational conversion course was completed in September 2017. Line training commenced in March 2018 and the occurrence flight was his 12th line training event.

Tiger reported that the First Officer had a total of 18,300 hours of which 14,400 hours was in command of various types. Twenty-seven hours were on the Boeing 737.

The First Officer undertook five transition simulator sessions between 31 March 2018 and 7 April 2018. Actual flying training commenced 22 June 2018.

As part of line training, Tiger required the presence of a safety pilot. The safety pilot was to observe the overall operation of the aircraft and ensure that the training captain was aware of any divergence from standard operating procedure (SOP) and any potentially unsafe conditions. This First Officer required a minimum eight sectors to be flown with a safety pilot.

The First Officer had flown the required eight sectors, including two as pilot flying (PF). He had also demonstrated the additional requirements of being able to recall abnormal/emergency memory items and was deemed proficient in the procedure for crew incapacitation. The First Officer was cleared of the requirement for a safety pilot on 7 July 2018.

As the First Officer was yet to be checked to line, further supervision of the First Officer was reliant on the assigned training captain. A training captain was responsible as both the pilot in command and as the instructor and assessor of the trainee.

In the flights following removal of the safety pilot requirement, the First Officer’s training records indicated satisfactory performance. The First Officer had flown with the same Captain on three previous occasions (5, 9 and 11 July 2018) and there was no reason to consider a reintroduction of a safety pilot. There were no issues relating specifically to the before taxi procedures and his pre-flight preparation was recorded as consistently improving.

The Captain reported being satisfied with the First Officer’s performance and held a reasonable level of confidence in his progress potential on the Boeing 737.

Aircraft information

Pressurisation system

Cabin pressurisation is essential to providing a safe and comfortable environment for aircraft occupants flying at high altitude. In an unpressurised cabin at high altitude, aircraft occupants are exposed to the possibility of hypoxia,^[3] which can lead to loss of consciousness and possible loss of life.

Cabin pressurisation utilises air bled from the engines, which is distributed throughout the cabin via two air conditioning packs. A cabin pressurisation controller modulates the cabin pressure via an outflow valve. The controller is normally set to AUTO and it operates independently of the air conditioning packs attempting to modulate cabin pressure regardless of the pack switch setting. Normal operation is for both packs switches to be in AUTO. If the packs are OFF, the outflow valve will drive closed to prevent the escape of cabin air. However, without bleed air via the air conditioning packs, there will be insufficient air to pressurise the aircraft.

The cabin pressurisation controller normally controls the cabin altitude rate of climb as well as the cabin altitude up to a cabin altitude (equivalent) of 8,000 ft at the maximum certified aircraft ceiling of 41,000 ft. The system has both an aural and visual warning for cabin altitude rising above 10,000 ft. Above 10,000 ft, flight crew are required to use supplementary oxygen. The system will also automatically deploy passenger oxygen masks once the cabin altitude rises above 14,000 ft.

The system has a number of other cautions to alert the crew to a malfunction, but there is no warning or caution to alert the flight crew if air conditioning packs are OFF.

Pressurisation system controls

Air conditioning, pressurisation controls and cabin pressure indications are located at the right-hand side of the forward overhead panel in the flight deck. The controls use toggle type switches with placards to indicate position. Analogue gauges indicate bleed air duct pressure, cabin altitude, cabin rate of climb and differential pressure.^[4] Digital displays are used to set cruise altitude and destination landing altitude (required for control of cabin pressurisation).

Visibility and accessibility of the controls and cabin pressure indications is most convenient for the right-hand seat crew member (First Officer) as the panel is above their seat. The left-hand seat crew member (Captain) may have to move in order to adequately view them and avoid any parallax error^[5]. Some placards indicating position are obscured by the switches when viewed from the left-hand seat. Figure 1 shows the view that the Captain may have had from the left-hand seat.

Figure 1: View of air conditioning packs switches from the Captain’s side

Source: Tiger Airways Australia, annotated by ATSB.

Figure 2: Close-up view of air conditioning pack switches

Source: Tiger Airways Australia, annotated by ATSB.

Aircraft serviceability

The aircraft did not have any technical issues related to the pressurisation system.

Recorded data

The ATSB retrieved data from both the flight data recorder (FDR) and the quick access recorder (QAR). Only the FDR required analysis, which identified:

• Both engine bleed switches were ON from take-off (departure) until time of warning.
• Both air conditioning packs were OFF from time of take-off (departure) until after warning presented.

The data does not record the highest cabin altitude reached. However, considering that the cabin oxygen masks did not deploy, it is unlikely to have exceeded 14,000 ft. There was nil evidence to suggest settings or events that could have affected the aircraft pressurisation, other than the air conditioning pack switches being OFF.

Operating procedures

The Tiger Boeing 737 Flight crew operating manual (FCOM) contained the expanded normal procedures, which were divided according to the phase of flight with separate duties for each crew member. Since the procedures were conducted by memory, a normal checklist was used to verify that critical items within the procedures had been completed. The checklist contained the minimum items needed to operate the aeroplane safely.

Irrespective of who read or responded to each checklist item, both pilots were required to visually verify the switch associated with each item was in the required configuration or that a step had been done.

Pre-flight and engine start procedures

As part of the pre-flight procedure, the air conditioning packs were required to be switched to AUTO or HIGH. The cabin pressurisation panel was also configured at this stage with the cruise altitude and destination altitude set. The pressurisation mode selector is set to AUTO for normal operation. This formed part of the First Officer’s pre-flight procedure and was completed correctly.

In accordance with the engine start procedure, the First Officer turned OFF the air conditioning pack switches. This was the only component of the pressurisation system that requires turning OFF during engine start.

Before taxi procedure

The before taxi procedure was designed to ensure that the aircraft condition and flight deck configuration is correct prior to taxiing for the departure runway. The procedure commenced upon completion of engine start. During the procedure, the air conditioning pack switches were reset to AUTO, a task allocated to the First Officer as per the FCOM procedure (Appendix A, Figure A1). Upon completion of the procedure, the Captain was required to call for the before taxi checklist. The pack switches were not included in the before taxi checklist (Appendix B, Figure B1).

At about the same time as the commencement of the procedure, the Captain recalled that they discussed the method of confirming the ground crew had removed the steering bypass pin. The discussion was in reference to differences between the ground and flight manuals, and that the ground crew expect a certain procedure for confirmation that crew have acknowledged removal of the steering bypass pin. The crew did not recall any other possible distractions or disruptions to the before taxi procedure.

By take-off, the First Officer had not reset the pack switches to AUTO. The crew did not notice the incorrect configuration and packs switches remained OFF.

Take-off procedure

The take-off procedure (shown at Appendix A, Figure A2) included a step for the pilot monitoring (PM) to set or verify that engine bleeds and air conditioning packs were operating. The FCOM did not explain what set or verify meant, however, Tiger training pilots reported that this should be achieved by visually identifying that the switches were in the correct position and viewing the cabin altitude and differential gauges to ensure they were giving expected readings. Following completion of the procedure, the after take-off checklist (shown at Appendix B Figure B1) is required to be called. This checklist included confirmation steps for both the engine bleeds and air conditioning packs.

Appendix A, Figure A2 states that this final part of the procedure is to take place after flap retraction is complete, which in this case was about 1138.^[6] At 1139, air traffic control (ATC) issued the aircraft several instructions, cancelling the SID, directing a turn to 150° and a climb to Flight Level 280 (FL280). At 1140, ATC cleared the aircraft to track direct to Wollongong.

Also during this timeframe, the Captain recalled that he rushed the after take-off checklist in order to discuss the mitigation of traffic threat associated with the noise abatement departure procedure (NADP) being flown, specifically with regard to the high rate of climb induced by the NADP and their initial altitude restriction of 5,000 ft.^[7] The Captain recalled looking at the pack switches and the cabin altitude and differential gauges, but remembered the gauge readings being as expected and did not identify that the pack switches were OFF.

While the PM was required to read and respond to the checklist, both pilots were required to verify each item of the checklist. The First Officer (PF) explained that his workload in flying the aircraft during the busy departure prevented him from checking pressurisation, as would normally be his habit.

Climb procedure

The FCOM climb procedure did not include pressurisation checks. The last formal check was during the after take-off checklist. Boeing reported that following the after take-off checklist, their recommended checks did not include a formal check of pressurisation or aircraft warnings associated with incorrect configuration of the pressurisation system until the cabin altitude warning was triggered at 10,000 ft cabin altitude. If the cabin altitude warning was triggered, the crew were required to conduct the associated immediate action checklist to mitigate the safety risk.

Tiger training captains reported that informal periodic checks of the pressurisation are taught during operational conversion course and line training. Checks included visually identifying switch positions and expected gauge indications based on FCOM guidance for the differential pressure limits at various altitudes. In this case, the Captain specifically mentioned noting that the differential was where he expected it to be based on current situation and previous flights, explaining his habit up until then was to look early in climb for expected readings.

Related occurrences

The following occurrences involving Boeing 737s are recorded in the ATSB database.

ATSB Occurrence 200402855

While on climb, the crew noticed that the pressurisation system was not operating. The aircraft was descended and returned to Melbourne for a landing. The air conditioning packs had not been turned on after engine start.

ATSB Occurrence 200506419

As the aircraft climbed through FL130, the cabin altitude warning horn activated indicating that the cabin altitude was at 10,000 ft. The crew obtained clearance to descend to 9,000 ft. The crew then noticed that the pressurisation mode selector was in manual and selected it to auto. The flight continued normally.

ATSB Occurrence 201104003

During climb, the cabin depressurised, and the passenger oxygen masks deployed. The aircraft descended to 10,000 ft and returned to Sydney. Engineering investigation revealed the cause to be incorrect switching of the pressurisation system.

Other occurrences

There are several similar occurrences involving Boeing 737s overseas that departed with an incorrectly configured pressurisation system. In most cases, the error was detected following system warnings with the exception being the Helios Airways accident in 2005. Helios Airways flight HCY522, a Boeing 737-31S departed Larnaca, Cyprus for Prague, Czech Republic. Cabin pressurisation control was in the manual setting for departure and not identified by the crew through procedures or checklists. Whilst the crew heard the cabin altitude warning horn, they believed it to be the take-off configuration warning and commenced trouble shooting for that. Subsequently, the crew succumbed to hypoxia and the aircraft continued the flight on autopilot until it exhausted its fuel supply and crashed, killing all on board.

Whilst being similar in that an incorrect configuration was not identified through multiple procedures and checklists, the crew of Flight TT229 (this occurrence), like those of the other Australian occurrences documented above, did not confuse the cabin altitude warning, quickly identified the issue and corrected it without delay.

__________

3. Hypoxia: a deprivation of oxygen to the body at the tissue level.
4. Differential pressure: the difference in pressure between inside and outside the aircraft cabin. The flight crew operating manual had differential pressure limits based upon selected cruise flight level.
5. Parallax error: an error due to the difference in the apparent position of an object based upon different viewing angles.
6. Flight data at Appendix C, Figure C2 shows flaps in UP position by 1138.
7. The aircraft was initially directed to maintain 5,000 ft shortly after take-off at about 1136, then at 1139, directed to climb to 28,000 ft.

Safety analysis

Incorrect configuration

Incorrectly configured air conditioning packs (OFF instead of AUTO) resulted in the cabin altitude rising above 10,000 ft, triggering the cabin altitude warning. There were no technical or performance reasons for the packs to be OFF and once returned to the AUTO selection, the cabin pressurisation returned to normal. Flight data recorder data, supported by crew interviews, confirms that the packs switches being OFF was the only reason for the cabin altitude warning.

Procedure and checklist management

Before Taxi Procedure

The First Officer did not turn the packs to AUTO during the before taxi procedure. This was contrary to the FCOM procedure but there was no evidence to suggest other deviations took place. The Captain did not notice this error.

The First Officer had significant experience on other aircraft types and his training records at Tiger did not show that an error of this type had occurred previously. The lengthy break in flying roles and significant gaps in the training program may not have allowed the First Officer sufficient time to consolidate the procedures to an intuitive level that was resilient to error. Acquired skills decay over time and consistent rehearsal and application are essential for long-term retention. Despite this, the First Officer had demonstrated satisfactory performance thus far in his training, having been assessed as no longer requiring a safety pilot.

The Captain’s discussion of the ground disconnect requirements may have served as a distraction for the First Officer. The Captain could not recall exactly when this discussion occurred, but the procedure position was approximately the same time as the First Officer’s required actions to reconfigure the pack switches following engine start. Distraction can interrupt the procedural sequence. As the before taxi procedure was conducted from memory, pilots were required to remember at what point the interruption occurred in order to recommence the sequence. This may lead to further error if there is not a conscious recognition of that distraction and interruption.

The ATSB noted that the before taxi checklist did not include checks for the correct configuration of pack switches. However, the Boeing 737 has supplementary procedures for a no engine bleed or unpressurised take-off, which required the crew to reconfigure the air bleeds and packs after take-off.  If this was missed or done incorrectly, then the after take-off checklist was designed to capture the error.  According to Boeing, the after take-off checklist is also in place to catch a bleed/pack configuration error made during the before taxi procedure. Consequently, absence of this step in the before taxi checklist was not considered as being contributory.

The ATSB also considered whether the First Officer’s previous experience as a captain, and the recent experience of the crew having flown together contributed to a relaxed level of supervision by the Training Captain. The Captain and First Officer had flown together on three occasions in the previous week. The Captain was well aware of the First Officer’s flying experience and had been satisfied with his previous performance such that he had a reasonable level of confidence in First Officer. The Captain explained that the First Officer had got it right before and that he (Captain) may have relaxed his supervision of the First Officer thus contributing to him not identifying the error at this time. Although a highly experienced pilot, the First Officer was still a trainee on the Boeing 737 and as such, required vigilant supervision of a training captain. This is a crucial defence against error by a trainee pilot.

The combination of relative inexperience, disjointed training, distraction and lapses in supervision appear to have contributed to the omission of the pack switches step during the before taxi procedure.

After Take-off Checklist

The take-off is a high workload phase of flight and Sydney is known to be a busy airport to operate from. The procedures to ensure that the air conditioning packs were correctly configured placed significant reliance on the after take-off checklist to achieve this. The high workload experienced by the crew included the procedural actions required by the departure flown and the training being undertaken. This workload was increased by the operational discussions that took place which appeared to have distracted the crew from correctly completing the procedure and subsequent checklist.

Whilst the Captain reported that he did look at the gauges and switches, he is likely to have had a low level of expectancy of error with regard to the pack switches. His confidence in the First Officer’s performance during training and not knowing the First Officer to have made that same mistake before is likely to have caused him to not perceive the error, despite looking at the switches. This would have been exacerbated by rushing the checklist as he reported.

In this case, the pressurisation controller was correctly set and functioned normally by closing the outflow valve to prevent the escape of cabin air. This likely resulted in a natural lag in cabin altitude rising since the controller closed the outflow valve to prevent the escape of cabin air, but additional air via the air conditioning packs was not available to pressurise the aircraft. The Captain specifically mentioned that when he looked at the gauges, the cabin differential and altitude were as expected. Considering the timing of the check (early stage of climb) and the gauges reading as expected, this probably indicated to him that the pressurisation system was correctly operating and gave him no reason to believe that the pack switches were OFF.

The investigation also considered the effect of viewing the air conditioning and pressurisation panels from the left seat. In this case, the Captain may not have moved enough, or at all, to allow a complete view of all gauges and switches, especially given he described rushing the checklist. It is likely that his low expectation of error was reinforced by the cabin differential and altitude appearing to be as expected.

Workload management and disruption also affected the First Officer’s ability to accurately conduct the checklist while flying the aircraft, especially considering the operational discussion that took place during that time. The operational requirements of ATC are considered normal but in light of the induced additional workload due to discussion and distraction, the First Officer did not check pressurisation as would normally occur.

Findings

From the evidence available, the following findings are made with respect to the incorrect configuration of a Boeing Company 737-8FE, registered VH-VUB, that occurred near Sydney, New South Wales on 12 July 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The aircraft did not pressurise due to an incorrectly configured pressurisation system.
• The incorrect configuration was the result of procedures and checklists not being managed appropriately.

Safety actions

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Action taken by Tiger Airways Australia

Tiger Airways Australia (Tiger) advised the ATSB of the following safety actions taken as a result of this occurrence:

• Tiger issued a flight crew notification to flight crew highlighting the need to adhere strictly to standard operating procedure (SOP). The notification explained that on some occasions, the checklist was completed but there had not been conscious verification of the action taken. Tiger reminded flight crew that when conducting checklists, to be mindful to challenge—verify—respond and that verification is to be a very deliberate act undertaken by both the Pilot Flying and Pilot Monitoring.
• A summary of Tiger’s internal investigation was included in a quarterly safety publication.
• Tiger’s flight standards team is undertaking a review of the Boeing 737 checklist and if additional checks of the pressurisation system is required.
• Tiger’s flight training team is undertaking a review of safety pilot requirements.
• The Head of Flight Operations and Head of Safety and Security conducted a road show to present the importance of SOPs and checklist discipline.
• Tiger introduced a flight operations safety assurance program to undertake flight deck observations to identify potential adverse trends in procedural compliance. Tiger advised only minor observations were noted.
• Tiger established a program with Virgin Australia to conduct line training for Boeing 737 pilots in order to ensure crew have continuous training required to embed skills and knowledge.
• Tiger have introduced additional pressurisation event training.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Flight crew of VH-VUB
• Flight data recorder from VH-VUB
• Tiger Airways Australia (Tiger)
• Boeing
• Airservices Australia.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, Tiger Airways, Boeing, and the Civil Aviation Safety Authority.

Submissions were received from the flight crew, Tiger Airways and Boeing. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – B737 FCOM Normal Procedures – Amplified Procedures

Figure A1: Before Taxi Procedure extract

Source: Tiger Airways 737 FCOM

Figure A2: Take-off Procedure extract

Source: Tiger Airways 737 FCOM

Appendix B – B737 Normal Checklist

Figure B1: Before Taxi and After Take-off Checklists

Source: Tiger Airways QRH

Appendix C – Recorded data from the incident flight 12 July 2018

Figure C1: Flight data – Cabin Altitude > 10,000 ft Warning

Source: ATSB

Figure C2: Flight data – Air conditioning pack switch position

Source: ATSB

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On  4 June, 2018, about 1152 PDT (Pacific Daylight Time), a GippsAero GA10, VH-XMH, was substantially damaged following a loss of control during spin testing and subsequent impact with terrain at Mojave, California.

The crew were assessing the aircraft’s spin characteristics with a belly-mounted cargo pod installed. An attempt to deploy the spin chute to aid the spin recovery failed, resulting in the crew electing to bail out. The two crew successfully exited the aircraft and deployed their parachutes whereupon they landed safely, but suffered minor injuries. The aircraft was operating under an Australian experimental certificate and a Federal Aviation Administration (FAA) special flight authorisation.

The NTSB have released the final report into this investigation.

Any enquires relating to the investigation should be directed to the NTSB: www.ntsb.gov

Safety summary

What happened

On the 26 June 2018, QantasLink was operating a De Havilland Aircraft of Canada DHC-8-400 aircraft, registered VH-LQD, on a scheduled passenger service from Mackay to Brisbane, Queensland. As the aircraft approached the top of descent, the right engine shut down uncommanded. The crew were unable to feather the propeller and it continued to rotate at low speed, in a coarse pitch condition. The crew actioned the ‘Non-Normal’ checklist and continued to Brisbane Airport where the aircraft landed safely.

What the ATSB found

The ATSB found that a bearing within the engine’s intercompressor case fractured, leading to an automated in-flight engine shutdown. Despite detailed technical examination, the reason the propeller did not feather could not be established. However, the operator identified that the one engine inoperative performance reduction between a counter‑weight coarsened propeller and a fully feathered propeller was only 0.5–0.9 per cent.

The ATSB also found that aircraft maintainers missed an opportunity to ground the aircraft when, on the day before the flight, metal debris was detected on the turbomachinery chip detector. It was identified that the procedures in the aircraft maintenance manual were confusing and ambiguous. This probably led to a misunderstanding by the personnel within the approved maintenance organisation and the continuing airworthiness maintenance organisation, which allowed the aircraft to be released to service.

The ATSB also found that the approved maintenance organisation personnel were not recording all the work performed during regular inspections. This meant that the maintenance information system was incomplete and an opportunity to identify the developing bearing degradation was missed.

What's been done as a result

As a result of this occurrence, QantasLink released a technical advisory bulletin to pilots advising of the incident and warning that the propeller may not always feather as practiced in the simulator.

They have also introduced a system to monitor metallic debris found on chip detectors. This will assist trend identification and ensure analysis results can be accessed quickly in the event of a reoccurrence of debris. Additionally, the organisation contracted to assist with engine monitoring now has a function, which allows monitoring and alerting of fault messages within recorded engine and flight data.

In addition, QantasLink have issued an airworthiness standing order to all certifiers within the approved maintenance organisation to introduce a single certification statement standard for all maintenance. They have also introduced a documentation check to be completed by supervisors after maintenance is completed. A recurrent course is also under development for all certifiers to ensure they remain current with all aircraft maintenance documentation recording requirements.  

The engine manufacturer Pratt & Whitney Canada advised they have standardised the wording relating to debris analysis guidance in the next revision of the aircraft maintenance manual. The ATSB acknowledges the improvement this will make, but considers that there is still ambiguity and the potential for the confusion in the procedure.

As such, the ATSB has issued a recommendation to Pratt and Whitney Canada to improve the clarity of procedures within the chip detector debris analysis section of the aircraft maintenance manual.

Safety message

When performing safety‑critical tasks like aircraft maintenance, it is very important that procedures are clear and unambiguous in order to avoid misinterpretation and error such as those that occurred in this incident.

The occurrence also illustrates that the high reliability of modern aircraft maintenance depends on accurate record keeping of all performed tasks to both communicate what has been done and assist in trend identification.

 

The occurrence

What happened

On the 26 June 2018, a QantasLink De Havilland Aircraft of Canada (formerly Bombardier Inc.) DHC-8-402, registered VH-LQD (LQD), was operating a regular passenger service within Queensland from Brisbane to Mackay and returning to Brisbane. The flight crew consisted of two captains, one in the right seat who was training to get an approval to operate the aircraft from the right seat, and a training captain who was pilot in command.

When the flight crew arrived at LQD to begin their pre-flight preparations, they identified a number of maintenance requirements for the right engine related to ongoing inspections. These requirements were for advice-only to the flight crew. After completing their pre‑flight preparations, they flew from Brisbane to Mackay with no issues.

The return flight to Brisbane had four crewmembers and 74 passengers on board. For this flight, the training captain was the pilot monitoring (PM) and the trainee captain, acting as first officer, was the pilot flying (PF).^[1]

At approximately 1749 Eastern Standard Time,^[2] as the aircraft approached the top of descent at FL 250,^[3] the aircraft yawed and there was a warning chime. The flight crew identified that the full authority digital engine control (FADEC) had shut down the right engine without warning. Due to their concern about the resultant windmilling propeller,^[4] the crew actioned the engine shutdown procedure from memory rather than by using the quick reference handbook. As this did not result in the propeller feathering,^[5] they selected the alternative feathering system. They observed the ‘feather pump running’ advisory light was illuminated, indicating that the alternative feather pump was working. The crew reported the propeller continued to turn at approximately 270 RPM and that the remainder of the checklist items were actioned.

The crew assessed the available landing options and decided that despite being slightly closer to the Sunshine Coast Airport, they would continue to Brisbane as they were prepared and had briefed for that approach. As expected, the aircraft could not maintain speed at FL 250 with one engine inoperative, so they slowed towards 190 kt. The PM contacted air traffic control (ATC) to advise them of the situation and requested a descent to FL 200, which was approved. They then made a PAN PAN^[6] call and advised ATC that emergency services would be required on landing.

The PM contacted the cabin crew to advise them of the situation and requested that they prepare the cabin and passengers. A public announcement was then made to the passengers.

The propeller was still rotating at approximately 270–300 RPM, but as the aircraft descended and the airspeed increased, the propeller rotations increased to approximately 660 RPM. To reduce the RPM, the flight crew slowed the aircraft. During the descent, the batteries in the PF’s noise cancelling headset failed. It was reported that, as the batteries were being changed, the PF could hear what appeared to be grinding from the rotating propeller. Consequently, the PM contacted the company’s engineering section to ensure all appropriate actions had been completed.

About 45 km from the airport, the training captain took over flying the aircraft. As they descended through 5,000 ft, the aircraft exited cloud and the crew sighted the airport. They requested radar vectors for the Runway 19 instrument landing system, to ensure they were set up to conduct a stabilised approach. They then advised ATC that they expected to conduct a normal landing but as the propeller had not feathered, they could not guarantee missed approach performance and so would not conduct a missed approach.

At 1845, the aircraft landed and was stopped on the second high speed turnoff. This allowed the aviation rescue firefighting (ARFF) service to inspect the engine for excessive residual heat or oil leaks. Following advice from the ARFF that there were no observed engine issues, the aircraft was cleared to taxi to the bay.

The flying pilot observed that the only handling difference from an engine failure practiced in the simulator was that when the operating engine was selected to flight idle during the landing, the aircraft yawed significantly more than expected. He commented that it required almost full right rudder to maintain the aircraft on the centreline.

__________

1. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
4. Windmilling: a rotating propeller being driven by the airflow rather than by engine power, and results in increased drag at normal propeller blade angles.
5. Feathering: the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.
6. PAN PAN: an internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Context

Engine and propeller examination

The aircraft was equipped with two Pratt & Whitney Canada PW150A engines, each driving a Dowty Propellers’ six-blade R408 propeller system. The affected engine, serial no. PCE-FA0815, was sent to a Pratt & Whitney Canada engine facility in Canada for inspection. Their examination identified that the uncommanded engine shutdown was the result of a No. 30 bearing fracture. Due to the extent of damage, it was not possible to establish the bearing fracture mechanism.

The No. 30 bearing is part of the tower shaft for the accessory gearbox that runs the main engine oil pump and fuel metering unit, among other systems.

Figure 1: No. 30 bearing broken cage pieces, damaged ball bearings and spalling on the inner and outer bearing races

Source: Pratt & Whitney Canada report received from the operator

The propeller pitch control unit, propeller overspeed governor, and auxiliary feather pump were sent to the relevant manufacturer for inspection. The auxiliary feather pump was not test run prior to being disassembled and inspected however, nothing was found during the inspections that contributed to the propeller not feathering.

The operator advised that while the propeller did not feather, and the reason for this could not be identified, the propeller did go to a safe coarse condition due to the counterweights in the propeller system, as it would if there was no oil in the propeller system. The manufacturer’s analysis showed that with one engine inoperative, the difference between a counterweight coarsened propeller and a fully feathered propeller was a 0.5–0.9 per cent decrease in aircraft performance.

Airworthiness and maintenance

The operator had a Civil Aviation Safety Authority-approved Civil Aviation Safety Regulation (CASR) Part 42 continuing airworthiness maintenance organisation (CAMO). The CAMO maintained the aircraft maintenance program, which included:

• maintenance planning
• the reliability program
• recording of data in the maintenance information system.

The operator also had a CASR Part 145 approved maintenance organisation (AMO) to perform the required maintenance on the aircraft.

The CAMO planned the maintenance actions and issued work orders to the AMO. The work orders contained task cards that directed the AMO to conduct specific tasks. Personnel from the AMO were required to:

• complete the task
• record what work was completed
• sign the task as complete
• attach the task card to the work order.

The overarching work order was then signed as being complete and a summary recorded. Those records were then returned to the CAMO to assess the completed work and record the information in the maintenance information system. Information in the system was available to both CAMO and AMO personnel.

Engine monitoring systems

During the 12 months prior to the incident, the operator had been introducing a new engine monitoring system across their DHC-8 fleet—the flight-data acquisition, storage and transmission (FAST) system. This system provided automated transmission of flight and engine health data to an organisation contracted to provide technical support. An automated email was sent to selected people within the CAMO if a fault was generated within the critical (as specified by the engine manufacturer) health data.

At the time of the incident, the procedures for what data was emailed and how to use the data had not been implemented. Since this occurrence, the installation of the FAST system has been completed across the fleet. Procedures on how to deal with notifications generated by the FAST system have also been introduced.

The FAST system had been installed on LQD. The system was producing data, and emails relating to faults were being sent to selected people within the CAMO.

While the FAST system was being installed across the fleet, the operator conducted regular engine trend-monitoring inspections as per the approved maintenance program. This included a work order to conduct routine interrogation of the engine central diagnostic system (CDS) by personnel within the AMO every 50 hours. Each work order contained a task card instructing the AMO to check, investigate and clear CDS faults and to record the relevant faults. Relevant faults codes included those which occurred during normal operations:

• resulting in the subsequent reset of a system in accordance with the De Havilland Supplemental Procedure Ground Reset Guide (SPGRG)
• or maintenance activities and required a subsequent maintenance action to clear.

Maintenance actions prior to the uncommanded engine shutdown

On the 13, 18 April, and 27 May, personnel within the CAMO received automated emails from the contracted organisation notifying them of ‘Fault code 938 – Turbomachinery chip detector’ generated by the FAST system, for the right engine on LQD. No actions were taken in response to these emails, and as the procedures were not yet in place, no action was required.

On the 13 April, earlier on the day the CAMO received the first email relating to the fault, personnel working within the AMO signed a work order as complete, recorded that there were no defects and ticked the ‘Fault code(s)’ ‘No’ box on the task card. The fault, recorded in the email received by the CAMO, was most likely generated after this check was completed. This fault was probably cleared on the 18 April, when a separate powerplant message was cleared, and the fault generated again on a flight later the same day resulting in the second email being forwarded to the CAMO. An inspection on 20 April was also completed with no faults recorded and the ‘Fault code(s)’ ‘No’ box ticked.

During an inspection on 26 April, ‘Fault code 938 – Turbomachinery chip detector’ was detected on the CDS. On further inspection, ‘minor fuzz’ was detected on the turbomachinery chip detector. The AMO categorised the debris as ‘permitted’, which was described in the aircraft maintenance manual as a ‘small quantity of hair like filaments (fuzz) or powder provided there has been no prior history of debris (allowable or non-allowable) within the last 400 hours’.

After consulting the aircraft maintenance manual, the engine was returned to service. The debris was not analysed, and there was no requirement to do so. The fault was recorded in the technical log, and the fault code ‘No’ box was ticked on the task card and work order (Figure 2).

Figure 2: Example of two task cards from different maintenance inspections

The task card on the left references the task in the technical log and shows that the fault code ‘No’ box is ticked although a fault code was present.
The task card on the right is the task on the 30 May 2018, where the fault code 938 had been received and cleared in the CDS and no information about the maintenance task had been recorded on the task card. These tasks were completed by different engineers.
Source: Operator annotated by ATSB with identifying information redacted.

The AMO conducted nine more inspections of the CDS with no defects recorded and the fault code ‘No’ box ticked on each occasion. Different personnel within the AMO completed these inspections.

After the incident, the operator interrogated the CDS to investigate why the FAST system had recorded 938 fault codes, but no such fault codes were recorded during most of the 50 hourly routine tasks. The interrogation found that during the maintenance task on the 30 May, the ‘Fault code 938 – Turbomachinery chip detector’ had been cleared in the CDS. This indicated that when the maintainer interrogated the CDS, they identified fault code 938, and had cleared it.

The AMO could not provide evidence that further actions had been taken in relation to CDS ‘Fault code 938 – Turbomachinery chip detector’ although they stated that it was highly likely that the appropriate maintenance actions had taken place when the faults were cleared.

This omission in the recording of maintenance had not been detected by the AMO, as there was no requirement to ensure that the work completed was recorded in the paperwork correctly. It was also not detected within the CAMO, as personnel working within the technical records area have no way of knowing what unscheduled maintenance was completed unless it was written on a task card.

A review of tasks cards found a number on which the maintainer had listed the fault codes that had been detected and the work completed to clear those codes, but the fault code ’No’ box was ticked (see Figure 2). This was not detected during the assessment of the paperwork by the technical records area, as there was no requirement to check this specific area of the form. The AMO could not explain why the same error was made by different maintainers over a number of inspections.

There is a regulatory requirement that an operator ensure that all stages of maintenance are complete and recorded, with details of the maintenance conducted, before an aircraft is released to service. There is also a regulatory requirement that licenced aircraft maintenance engineers’ record all maintenance conducted within the continuing airworthiness records system before an aircraft is released to service.

Oil sampling trial

On 18 May, an oil sample was taken from the occurrence engine as part of a trial being conducted by the engine manufacturer. There were no requirements on the operator to collect the sample and no procedures on how quickly the sample was to be sent for analysis to the engine manufacturer’s facility. The sample was sent to the manufacturer’s facility on 25 June. The results, which indicated that the bearing and gear material were above the set threshold, were not received by the operator until 12 September.

Maintenance actions immediately prior to the uncommanded engine shutdown

Overnight on 25 June, the FAST system recorded three fault codes - ‘Fault code 938 – Turbomachinery chip detector’, ‘Fault code 915 - Main Oil Filter’ and ‘Fault Code 932 - Scavenge Oil Filter’. Due to the system’s set-up, personnel from the CAMO received an automated email from the contracted organisation notifying them of ‘Fault code 938 – Turbomachinery chip detector’. On receipt of this email, they raised an urgent technical service request (UTSR) which was sent to the AMO.

During scheduled maintenance on the evening of 25 June, personnel from the AMO also noted that the CDS had recorded ‘Fault code 938 – Turbomachinery chip detector’, ‘Fault code 915 - Main Oil Filter’ and ‘Fault Code 932 - Scavenge Oil Filter’. As a result, they conducted an inspection of the engine.

Personnel from the AMO found debris on the turbomachinery chip detector and the main oil filter and classified this as ‘Non-Permitted Category 3’ debris (dark irregular magnetic chips or small clusters of magnetic flakes or all other debris not defined elsewhere, Figure 3). This required that a sample of the debris be sent to a laboratory for analysis.

They then, in consultation with personnel from the CAMO, used a flow chart to determine whether to return the engine to service. This flow chart indicated that if the turbomachinery had a history of contamination within the previous 400 hours, they must ‘wait for the results of the previous lab report prior to continuing operation’. The personnel from the AMO and CAMO together decided not to include the previous permitted ‘minor fuzz’ found on the chip detector on the 26 April, which was within the previous 400 flight-hours, due to an assessment that it did not constitute an occurrence of debris. There was no record in the maintenance information system that ‘Fault Code 938 – Turbomachinery chip detector’ had been received and cleared on previous occasions, as this had not been recorded on the task cards.

The personnel from the AMO and CAMO discussed the steps in the flow chart procedure and assessed that with no history of debris, the engine could be returned to service with a 20 flight‑hour limitation. The debris was sent for laboratory analysis. The report with the results of the debris analysis, which showed the sample contained bearing material, was received by maintenance personnel while the aircraft was in cruise, 35 minutes before the engine shutdown.

The personnel from the AMO and CAMO did not consult with the engine manufacturer during this process as it was not a requirement when following the Aircraft Maintenance Manual.

Debris assessment

The aircraft maintenance manual PSM 1-84-2, covered the classification and required actions to be taken when debris was detected on the turbo machinery chip detector. As part of their investigation into the incident, the operator reviewed the relevant sections of the manual and found a number of ambiguities in terminology and required actions.

In the section to classify the debris found in the turbomachinery and reduction gearbox oil system (subtask 79-22-00-750-009 table 601, Figure 3), the debris classification table used the terms ‘permitted’ and ‘non-permitted’ to classify the debris. However, in the definitions, the terms were changed to ‘allowable’ or ‘non-allowable’. The next section interchangeably used the terms ‘debris’ and ‘contamination’, ‘bearing material’ and ‘material’.

Figure 3: Extract of task 79-22-00-750-009 table 601 giving criteria for classification of debris found in oil system

The table shows the debris type and definition.

Source: Aircraft manufacturer

In the classification system, category 3 debris was smaller than category 1 debris. Unlike category 2 debris, the category 3 debris definition did not consider if there was a history of debris within the previous 400 hours.

The aircraft maintenance manual directed the user to a flow chart that set out the steps to be taken when debris was detected on the turbomachinery chip detector and/or the main oil filter. Step 16 in the flow chart (Figure 4) asked if the turbomachinery had ‘a history of contamination within 400 hours?’. This step changed the term from ‘debris’ to ‘contamination’ and it also did not include the words ‘allowable’ or ‘non-allowable’.

Figure 4: Extracts of flow chart of decision-making map for debris on turbomachinery chip detector

Source: Aircraft manufacturer

If the answer to step 16 was ‘yes’ then the flow chart directed the user to step 29 (Figure 5). This asked if a laboratory report was available for the previous event of contamination and if the answer was ‘no’, directed the user to go to step 30. Step 30 stated ‘wait for the results of the previous lab report prior to continuing operation’.

Figure 5: Extracts of flow chart of decision-making map for debris on turbomachinery chip detector

Source: Aircraft manufacturer

The operator found that the personnel from the ‘AMO and CAMO were then faced with a situation whereby the guidance required them to wait for the results of a debris analysis that had not taken place’. This step also directed the user to Note 6 (Figure 6) which directed the user to obtain an analysis of the ‘last’ sample. The operator noted that the use of the word ‘last’ here was open to interpretation, as this could be interpreted as ‘last’ being the previous debris or ‘last’ being the latest debris. It also did not specify that the debris could be ‘allowable’ or ‘non-allowable’, as specified in other sections of the manual.

Figure 6: Extract from aircraft maintenance manual Note 6

Source: Aircraft manufacturer

To assess the clarity of the procedure, the operator conducted an informal survey of other maintenance staff using this documentation. They found that the maintenance staff came to different conclusions as to the action to be taken.

Engine manufacturer’s comments

The engine manufacturer considered that the in-flight shutdown of the turbomachinery was a preventable occurrence. They classified the debris identified on 25 June as ‘Non-permitted Category 2’ (Any quantity of hair like filament (fuzz) or powder if the module has a history of generating debris (allowable or non-allowable) within the previous 400 hours). They advised that the ‘minor fuzz’ detected on the 26 April should have been classified as ‘previous history’ for the purpose of considering the debris identified on 25 June. This would have required the aircraft to be grounded until the results from the analysis of the debris was received.

The engine manufacturer also advised that worldwide, this was the third fracture of the No. 30 bearing since May 2013, when the entire fleet had incorporated service bulletin SB35216. There have been over 10 million hours flown worldwide since the service bulletin was incorporated. In all three events, it was impossible to detect what had led to the bearing fracture, but two of the three events had resulted in uncommanded inflight engine shutdowns.

Safety analysis

Introduction

During cruise flight, a bearing fracture within the intercompressor case resulted in an automated shutdown of the right engine. Due to the extent of the damage, and consistent with previous similar occurrences, it was not possible to establish the bearing fracture mechanism.

After the uncommanded engine shutdown, the propeller did not feather as expected, instead going into a design coarse position. This decreased the aircraft’s one engine inoperative performance by up to 0.9 per cent from that expected had the propeller feathered. Detailed technical inspection was unable to identify the reason why the propeller did not feather.

This analysis will discuss the indications of the deterioration of the bearing and the maintenance actions in the months and days preceding the uncommanded engine shutdown. It also examines the maintenance procedure used to determine whether the aircraft should be grounded pending the analysis of the debris found on the turbomachinery chip detector.

Maintenance action

During a number of regular inspections leading up to the detection of what maintenance personnel considered to be category 3 chip detector debris, different maintainers from the operator’s approved maintenance organisation (AMO) had identified ‘Fault Code 938 – Turbomachinery Chip Detector’. For reasons that could not be determined, and contrary to the required procedure, these faults were cleared without recording the fault and maintenance actions in the task card. The associated fault code ‘No’ box was also ticked on each occasion.

There was no process, nor was there a requirement within the AMO, to ensure that the completed maintenance related to fault codes were correctly recorded in the maintenance documentation. Additionally, there was no way or means for personnel within the continuing air maintenance organisation (CAMO) to detect when unscheduled maintenance was completed but not documented. They also did not have a procedure to ensure that when there were faults recorded on the task card, that the fault code ‘Yes’ box was ticked.

As a result, the opportunity to identify the developing debris trend associated with the gearbox bearing deterioration was missed.

On the evening of 25 June, ‘Fault Code 938 – Turbomachinery Chip Detector’ fault was detected, and debris found on the turbomachinery chip detector and the main oil filter. The debris was classified as ‘Non-permitted Category 3’ debris. In consultation, personnel from the CAMO and the AMO decided that the previous instance of debris (26 April) did not constitute a history of debris.

Based on that assessment, they used the information provided in the aircraft maintenance manual to release the engine to service with a 20 flight-hour limitation while a sample of the debris was sent for analysis.

The engine manufacturer’s intent was that the prior ‘fuzz’ should have been considered a history of debris. This would have required the debris detected on the 25 June to be analysed and the results reviewed, before the aircraft was released to service. Had that occurred, the uncommanded engine shutdown would probably have been avoided.

Procedural confusion

The aircraft maintenance manual procedures for assessing chip detector debris were written in a way that could cause confusion and error. For example, in describing the classification of the debris, the ‘Non‑permitted Category 3’ description did not mention a previous history of debris. This allowed the user to read the classification description in isolation and, as in this case, disregard the previous instance of ‘permitted’ debris. This was not the manufacturer’s intended interpretation.

Additionally, some of the required maintenance steps relied on the results of debris analysis but it was not always clear what debris was being referred to—current or previous. Terminology was also interchanged without explanation.

These aspects of the assessment flowchart most likely influenced the maintenance personnel’s decision to discount the previous history and release the engine to service with a 20 flight-hour limitation, while they waited for the results of the debris detected on the 25 June to be analysed.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors. Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the uncommanded engine shutdown involving a De Havilland DHC-8, registered VH-LQD, near Brisbane, Queensland, on 26 June 2018.

Contributing factors

• During cruise, a bearing in the intercompressor case fractured, leading to an automated in‑flight engine shutdown.
• Following detection of category 3 debris on the chip detector and the oil filter, the maintenance personnel discussed a previous detection of debris but incorrectly concluded that it did not need to be considered. This resulted in the aircraft being released to service, and the uncommanded engine shutdown, within the 20 flight-hour limitation.
• The procedures in the aircraft maintenance manual relating to chip detector debris analysis were written in a way that could cause confusion and error. This probably influenced the actions of the maintenance personnel to release the aircraft to service with a deteriorating bearing. [Safety issue]

Other safety factors

• Multiple maintenance personnel did not record 'Fault code 938 - turbomachinery chip detector' as required when conducting 50 hourly inspections.
• There were no processes within the aircraft maintenance organisation or QantasLink to ensure that maintenance tasks associated with fault codes were correctly documented.

Other findings

• After the uncommanded engine shutdown, the propeller did not feather. Instead, it moved to a safe coarse position, which resulted in a decrease in the aircraft’s one engine inoperative performance of 0.5‑0.9 per cent compared to a feathered propeller.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Unclear procedures in Aircraft Maintenance Manual

Safety Issue number: AO-2018-049-SI-01

Safety issue description: The procedures in the aircraft maintenance manual relating to chip detector debris analysis were written in a way that could cause confusion and error. This probably influenced the actions of the maintenance personnel to release the aircraft to service with a deteriorating bearing.

Safety recommendation description: The Australian Transport Safety Bureau recommends that Pratt & Whitney Canada takes safety action to improve the clarity of procedures within the chip detector debris analysis section of the aircraft maintenance manual.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety action by QantasLink

QantasLink now proactively requires all debris detected during inspections of engines and turbomachinery chip-detectors to be sent for analysis. The results of this analysis is stored and can be referenced, should further faults be detected, without having to wait for analysis.

QantasLink’s AMO introduced a ‘supervisor documentation quality check’ and issued a maintenance standing order. Shift supervisors are now required to conduct final checks of all aircraft maintenance and check packages for correct completion, certification and coordination in accordance with the:

• AMO Internal Procedures Manual
• Continuing Airworthiness Maintenance Organisation’s Approved Maintenance Program
• certification practices and procedures and the Civil Aviation Safety Regulations.

Following these checks, all necessary maintenance records and data are to be sent to the CAMO technical records department.

While the CAMO ‘Documents & Procedures’ course is delivered to new AMO employees, a recurrent course has not previously been available. A recurrent ‘Docs & Procs’ online course is now under development. This course is intended to ensure all certifiers remain current with all aircraft maintenance documentation recording requirements.

Implementation of the FAST system has now been completed on all QantasLink Dash-8 aircraft. This system allows monitoring of faults, including accessing the date and time the faults were triggered via the contracted organisation’s systems portal. For selected fault codes, as recommended by Pratt & Whitney Canada (P&WC), an automated alert email is also provided to selected staff by the contracted organisation. A ‘work instruction’ detailing the process to react to FAST system generated alerts, has been published (AWI-TS10). This ‘work instruction’ is based around P&WC Service Information Letter PWC150-045 along with other P&WC data.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• interviews with the flight crew
• QantasLink
• De Havilland Aircraft of Canada
• Pratt & Whitney Canada
• the Transportation Safety Board of Canada.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, QantasLink, Pratt & Whitney Canada, De Havilland Aircraft of Canada, the Transportation Safety Board of Canada, Transport Canada and the Civil Aviation Safety Authority.

Submissions were received from the flight crew, QantasLink, De Havilland Aircraft of Canada, Pratt & Whitney Canada and Transport Canada. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly. Australian Transport Safety Bureau

The ATSB is an independent Commonwealth Government statutory agency. The ATSB is governed by a Commission and is entirely separate from transport regulators, policy makers and service providers. The ATSB’s function is to improve safety and public confidence in the aviation, marine and rail modes of transport through excellence in: independent investigation of transport accidents and other safety occurrences; safety data recording, analysis and research; fostering safety awareness, knowledge and action.

The ATSB is responsible for investigating accidents and other transport safety matters involving civil aviation, marine and rail operations in Australia that fall within the ATSB’s jurisdiction, as well as participating in overseas investigations involving Australian registered aircraft and ships. A primary concern is the safety of commercial transport, with particular regard to operations involving the travelling public.

The ATSB performs its functions in accordance with the provisions of the Transport Safety Investigation Act 2003 and Regulations and, where applicable, relevant international agreements.

Developing safety action

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues in the transport environment. The ATSB prefers to encourage the relevant organisation(s) to initiate proactive safety action that addresses safety issues. Nevertheless, the ATSB may use its power to make a formal safety recommendation either during or at the end of an investigation, depending on the level of risk associated with a safety issue and the extent of corrective action undertaken by the relevant organisation.

When safety recommendations are issued, they focus on clearly describing the safety issue of concern, rather than providing instructions or opinions on a preferred method of corrective action. As with equivalent overseas organisations, the ATSB has no power to enforce the implementation of its recommendations. It is a matter for the body to which an ATSB recommendation is directed to assess the costs and benefits of any particular means of addressing a safety issue.

When the ATSB issues a safety recommendation to a person, organisation or agency, they must provide a written response within 90 days. That response must indicate whether they accept the recommendation, any reasons for not accepting part or all of the recommendation, and details of any proposed safety action to give effect to the recommendation.

The ATSB can also issue safety advisory notices suggesting that an organisation or an industry sector consider a safety issue and take action where it believes it appropriate. There is no requirement for a formal response to an advisory notice, although the ATSB will publish any response it receives.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

At about 1728 Central Standard Time,^[1] on 3 July 2018, a Cessna 172RG aircraft, registered VH‑LCZ, commenced circuit operations at Parafield Airport, South Australia (SA) with the pilot as the sole occupant. The flight commenced in day conditions and transitioned to operation under the night VFR^[2] after last light, which occurred at 1743.

There were no identified aircraft defects and it was fully refuelled immediately prior to the flight. The pilot reported that he had conducted a post‑refuel drain and that there was nothing abnormal in any of the fuel samples.

At about 1748, the pilot performed a touch and go landing, and departed the runway for the sixth, and intended final, circuit. The pilot recalled that the engine ‘coughed’ once as the aircraft accelerated along the runway. He noted no other abnormalities and continued the take-off normally. About 10 minutes later, the pilot received air traffic control (ATC) clearance to land. He turned the aircraft onto final at an altitude of about 500 ft approximately 1,500 m from the runway threshold, and configured it for landing (full flap and landing gear extended).

On descent through 450 ft, the pilot observed the propeller speed reduce from 1,800 to 1,300 rpm. He selected the carburettor heat, increased the throttle and changed the position of the fuel selector from BOTH to LEFT. The pilot reported that, with the exception of this troubleshooting, he did not apply carburettor heat during any of the previous circuits. The engine did not respond to the pilot’s carburettor nor fuel selection inputs and the propeller speed remained constant at 1,300 rpm. The pilot then deselected the carburettor heat and moved the fuel selector back to its original position. A short time later, he assessed that the aircraft did not have sufficient altitude to reach the runway and that a forced landing would be necessary.

At about 1758, the pilot declared a PAN^[3] and informed ATC that he was unable to make the runway. The pilot recalled that he had sighted an unlit area ahead, which he assumed to be an open space. He turned the aircraft towards that area and pitched the nose down to achieve the airspeed associated with the maximum glide distance. The pilot reported that, as the aircraft approached the open space, he heard the fuselage hitting treetops. Seconds later, the aircraft stopped abruptly as the nose wheel struck a power line and it then collided with the ground (Figure 1).

After the collision, the pilot attempted to switch off the master switch but was unable to do so due to distortion of the instrument panels. He then swiftly exited the aircraft through the co-pilot’s side window and moved away from the wreckage. Emergency services attended the scene shortly after. The pilot sustained minor injuries and the aircraft was substantially damaged.

Figure 1: Aircraft wreckage (note power line fouling the nose wheel)

Source: South Australia Police

Carburettor icing

Induction icing, often referred to as carburettor icing, is the accumulation of ice within the induction system of an engine fitted with a carburettor. This ice forms as the decreasing air pressure and introduction of fuel reduces the temperature within the system. The temperature may reduce sufficiently for moisture within the air to freeze and accumulate. This build-up of ice restricts airflow to the engine, leading to a reduction in engine performance and possible engine failure. Environmental conditions influence the likelihood of carburettor ice forming.

Weather observations recorded by the Bureau of Meteorology at Parafield Airport indicated a temperature of 12.2° C and a dew point^[4] of -0.6° C at the time of the accident. Figure 2 (see annotation in yellow) shows that these meteorological conditions presented a risk of moderate icing when using cruise power and serious icing when using descent power. At the time of the power loss, the engine was operating at descent power.

Figure 2: Carburettor icing probability

Source: CASA, annotated by the ATSB

The Cessna 172RG pilot operating handbook (POH) provided the following guidance for carburettor icing:

• before landing, switch carburettor heat to ON to prevent ice formation
• in the event of a rough engine running or loss of power:

An unexplained drop in manifold pressure and eventual engine roughness may result from the formation of carburettor ice. To clear the ice, apply full throttle and pull the carburettor heat knob out until the engine runs smoothly; then remove carburettor heat and re-adjust the throttle.

Safety analysis

A post-accident examination of the engine was not conducted and therefore the possibility that a mechanical defect contributed to the accident could not be ruled out. However, the ATSB assessed the evidence with respect to some common known causes for an engine power loss. The evidence indicated that fuel contamination, fuel exhaustion and aircraft maintenance issues were unlikely.

Contrary to the guidance in the POH, the pilot reported that he did not apply carburettor heat while descending to the runway during any of the circuits. This combined with weather conditions conducive to severe carburettor icing at descent power made it likely that the power loss was due to the accumulation of carburettor ice.

The POH listed carburettor icing as a cause of the engine running rough or losing power. The actions listed in the POH to clear carburettor ice, however, do not clear ice immediately as it takes some time for the heat to take effect. The pilot first observed a reduction in propeller speed just after the turn onto final. Although he responded by applying carburettor heat, the short time between troubleshooting the engine power loss and conducting the forced landing meant there was probably insufficient time to clear enough ice for the engine to recover.

The pilot completed the turn onto final at an altitude of about 500 ft approximately 1,500 m from the runway threshold, which is within the normal profile for a powered approach. After troubleshooting the engine issues, the aircraft had already descended to about 450 ft. The POH indicated that, in ideal conditions, a maximum glide distance of about 1,500 m could be achieved from an altitude of 500 ft. However, a turn onto the final approach at that position is unlikely to permit an aircraft configured for landing to glide to the runway in the event of a power loss.

Consideration of a flight profile that balances the requirement for a stable approach while increasing the likelihood of being able to reach the runway in the event of a power loss is particularly important when flying in night VFR conditions. Selection of a suitable unprepared landing site is more difficult at night due to reduced visual discrimination. In this instance, the selected large unlit area was assumed to be clear but obstructions, such as the power lines, were not discernible.

Following the partial engine failure, the pilot resisted the temptation to lift the nose of the aircraft in an attempt to stretch the glide to the runway. That decision, to follow his training and pitch the nose of the aircraft down to establish the optimum glide speed, enabled him to maintain control of the aircraft. That action likely prevented a low altitude stall and uncontrolled collision with terrain.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• On final approach, the engine of VH-LCZ failed, likely due to carburettor icing.
• The engine failed at a position during the final approach that did not permit the aircraft to glide to the runway and afforded limited alternative landing area options.
• While descending during the forced landing at night, the aircraft struck a power line and then collided with terrain, resulting in minor injury to the pilot and substantial damage to the aircraft.

Safety message

Engine failure during single-engine aircraft operations is by far the most serious night time emergency. The Civil Aviation Safety Authority (CASA) advisory circular, Night VFR Rating, provides useful recommendations for minimising risk during night visual flight rules (VFR) operations, including:

• planning to fly at a higher altitude will increase the options available
• planning the descent onto the base leg so that the aircraft is positioned to start the turn onto final at about 600 ft to 700 ft above ground level.

The routine application of carburettor heat during the period between the base turn point and late in the final approach will significantly reduce the potential for an ice-related power loss. More information regarding carburettor icing can be found in the ATSB report, The ongoing danger of carburettor icing.

While a successful landing was not achieved in this instance, the pilot's actions after realising he would not reach the runway closely followed the guidance in the Federal Aviation Authority pilot’s handbook (Airplane Flying Handbook). Flying in a controlled manner, wings level and at the recommended glide speed has a better survivability outcome than when control of the aircraft is lost. The pilot’s actions in maintaining control of the aircraft maximised the likelihood of a successful forced landing.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Central Standard Time (CST): Universal Coordinated Time (UTC) + 9.5 hours.
2. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going
3. PAN PAN: an internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
4. Dewpoint is the temperature at which water vapour in the air starts to condense as the air cools. It is used among other things to monitor the risk of aircraft carburettor icing or likelihood of fog at an aerodrome.

On 6 August 2017, an Airbus A320, registered VH-VGY and operated by Jetstar Airways, inadvertently descended below a 2,500 ft minimum safe altitude during an arrival procedure into Christchurch, New Zealand.

As the incident occurred in New Zealand, under paragraph 5.1 of Annex 13 to the Convention on International Civil Aviation and in accordance with the New Zealand Transport Accident Investigation Commission Act 1990, the Transport Accident Investigation Commission (TAIC) commenced an investigation into the occurrence. The Australian Transport Safety Bureau (ATSB), representing the state of the operator and in accordance with paragraph 5.18 of Annex 13, provided an accredited representative to participate in the TAIC inquiry. In accordance with the Australian Transport Safety Investigation Act 2003, an ATSB investigation was commenced to support the TAIC inquiry.

The ATSB has finalised its support of this investigation. The TAIC is responsible for the release of the final investigation report into this incident. TAIC have completed the investigation and published the investigation on their website on 2 May 2019 at  AO-2017-007.

Any enquires regarding the TAIC investigation and report should, in the first instance, be directed to the:

Transport Accident Investigation Commission
Level 9, 114 The Terrace
PO Box 10323
Wellington, 6143, New Zealand

The TAIC can also be contacted via: www.taic.org.nz

___________
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003.

 

Safety summary

What happened

At about 1710 on 8 June 2018, the pilot of a Cessna Aircraft Company 172S, registered VH-EWE, was returning to Moorabbin Airport, Victoria, following a one-hour private flight. While on final approach, and shortly after receiving clearance to land, the pilot transmitted ‘we’ve got engine failure’. Shortly after, witnesses observed the aircraft’s left wing and nose drop, consistent with an aerodynamic stall. The aircraft collided with terrain in a residential street about 680 m from the airport. The pilot was fatally injured, and a post-impact fuel-fed fire destroyed the aircraft.

There was minor damage to one residence and a vehicle, there were no injuries to persons on the ground.

What the ATSB found

The ATSB examined the aircraft’s engine, its components and fuel system, but was unable to determine the reason for the reported engine power loss. The investigation also found that when control of the aircraft was lost, there was insufficient height to recover.

Safety message

The loss of engine power while on final approach presents a scenario where there may be limited forced landing options, especially when there is insufficient height to glide to the airport. This is particularly relevant where the approach is over built-up areas, such as at Moorabbin Airport. The ATSB publication, Avoidable Accidents No. 3 - Managing partial power loss after take-off in single-engine aircraft provides guidance that is also applicable to an engine failure occurring at low-level during an approach. Taking positive action and ensuring that control is maintained has a much better survivability potential than when control of the aircraft is lost. In addition, using the aircraft structure and surroundings to absorb energy and decelerate the aircraft can assist in minimising injury.

Having a clear, defined emergency plan prior to the critical stages of the flight, such as approach, removes indecision and reduces pressure on the pilot while in a high stress situation. Further, flying the approach as per manufacturer and airport procedures places the aircraft in the optimum configuration and position.

Proficiency in in-flight emergencies can be improved by regularly practicing these emergencies. The United States Federal Aviation Administration safety briefing September/October 2010 described this as ‘imbuing the quantity of all your flying, however limited, with quality’.

 

The occurrence

What happened

On 8 June 2018, a Cessna Aircraft Company C172S, registered VH-EWE (EWE), was being operated on a private flight from Moorabbin Airport, Victoria. The flight was the first one after scheduled maintenance and the pilot, an employee of the maintenance organisation, was the sole occupant.

The aircraft departed Moorabbin Airport at 1604 Eastern Standard Time.^[1] Flight tracking data showed that it climbed to an altitude of 3,000 ft above mean sea level and tracked towards Tyabb, Victoria. EWE then tracked south toward Hastings, south-east to Inverloch, and north-east toward Leongatha, before heading north-west to return to Moorabbin Airport (Figure 1 inset).

Figure 1: VH-EWE flight path

Source: Flight Aware flight data and Google Earth, modified by ATSB

At 1706, the pilot advised Moorabbin Air Traffic Control (ATC)^[2] that EWE was at reporting point GMH,^[3] at 1,500 ft and inbound to Moorabbin. ATC acknowledged and instructed the pilot to join base (see the section titled Circuit operations) for runway 35 Right (35R), the expected arrival runway when tracking from GMH. At 1711, due to the number of aircraft tracking for 35R, ATC subsequently requested EWE change runways to 35 Left (35L), which the pilot accepted.

At 1712:41, EWE was cleared to land on runway 35L and this was acknowledged by the pilot. ATC’s observation of EWE during the approach was that the aircraft was a little low, but not unusually so, with flaps extended and a slight nose-up attitude.

At about the time the aircraft was cleared to land, witnesses on the ground observed EWE heading toward Moorabbin and described hearing the engine ‘spluttering’, ‘struggling’ and that it ‘sounded like a lawn mower struggling to start’. Some witnesses also reported the aircraft was quite low and slower than expected. Witnesses located 120 m from the accident site reported EWE was heading in a westerly direction, at a height of about 25 m (82 ft) above the ground, with no engine noise.

At 1713:05, the pilot of EWE broadcast MAYDAY^[4] and stated ‘we’ve got engine failure’. In response, the tower controller directed his attention to EWE and observed that the aircraft was ‘low’ and the nose had ‘started to pitch up’ before the MAYDAY call was finished. At the completion of the MAYDAY transmission, the surface movement controller looked toward EWE and also noticed the aircraft was in a nose‑up attitude. About 2–3 seconds later, they both observed the left wing and nose drop, before they lost sight of the aircraft below the tree line.

The MAYDAY broadcast also prompted several pilots to look toward EWE.^[5] These pilots reported observing that EWE was:

• initially in a shallow left turn, with increased angle of bank, prior to a left wing drop
• in ‘a sharp left turn’, then the left wing dropped
• ‘near to a 30˚ bank to the west…the aircraft lost considerable height in this manoeuvre and continued in this state’ [before he lost sight]
• ‘banked in an uncontrolled state at about 150–200 ft…heading toward the ground’.

A security camera located two houses to the west of the accident site captured the accident sequence. The footage showed EWE enter the frame in a slight left bank and initially on about a westerly heading. The aircraft was descending with a nose attitude appearing higher than that for a normal glide (Figure 2). As the aircraft passed behind a tree, the aircraft appeared to stall, indicated by the sharp reduction in pitch attitude and left wing drop (see the section titled Stall characteristics and recovery). The left wing subsequently clipped the power service line^[6] to a corner property. The footage showed that the wing flaps were in the retracted position.

Figure 2: Security camera footage

Source: Supplied, modified by ATSB

EWE collided with the top of a concrete column and tubular steel fence located at the front of a property. The propeller and nose wheel impacted the grass verge with the aircraft stopping behind a parked vehicle on the southern side of the street (Figure 3). A severe post‑impact fuel‑fed fire commenced immediately. Witnesses reported that ignited aircraft fuel leaked from EWE and flowed along the street gutter.

The pilot was fatally injured, and a post-impact fuel-fed fire destroyed the aircraft. There was also some damage to a residential property and the parked car. There were no injuries to members of the public.

Figure 3: Accident site

Source: ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Moorabbin ATC had a tower controller and a surface movement controller (SMC) on duty at the time of the occurrence. ATC, for the remainder of the report, refers to the tower controller.
3. GMH is an identifiable landmark 7 nm east of Moorabbin used as an entry point for aircraft visually approaching the airport.
4. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
5. Two pilots were located on the ground at Moorabbin, the others were on final to 35R at about the same time EWE was tracking to 35L.
6. The service wire connects a property to the power distribution lines.

Context

Pilot information

The pilot held a Commercial Pilot Licence (Aeroplane), issued in January 1989, with single- and multi-engine aeroplane ratings and had accrued about 1,400 hours of total flight experience. The pilot held the appropriate licences and qualifications and met all currency requirements to operate VH‑EWE (EWE).

The pilot conducted his last flight review in a Cessna 182 on 14 July 2017, 11 months prior to the accident. Competencies demonstrated at this time included:

• entry and recovery from stall
• recovery from incipient spin
• management of engine failure after takeoff and in the circuit area (simulated)
• performance of forced landing (simulated).

The pilot’s training records showed he conducted a ‘recurrency’ flight with an instructor, in a Cessna 172, on 25 August 2017. Comments from that flight included that the approach speed was ‘initially a little slow’ and the pilot had ‘a tendency to use aileron in an approach stall recovery’. Normal, flapless and glide approaches to Moorabbin were also practiced. The instructor noted that they worked on power settings and attitudes on the approach, resulting in subsequent approaches being ‘much improved’ and that pilot flew to a ‘safe standard’.

The pilot’s logbook did not record any additional stall and/or engine failure training, either formal or informal. It was possible, however, that this practice had been conducted without being documented. The pilot had flown once in the preceding 30 days and had flown less than 2 hours in the preceding 90 days, all in the Cessna 172.

Medical information

The pilot held a current Class 1 aviation medical certificate, with restrictions. These restrictions had been successfully managed by the pilot and the Civil Aviation Safety Authority (CASA), for several years.

Post-mortem and toxicological examinations of the pilot did not reveal any medical issues that may have contributed to the accident. Additionally, there were no indicators that the pilot was experiencing a level of fatigue known to affect performance.

Aircraft information

General

EWE was a Cessna Aircraft Company 172S all-metal, four-seat, high-wing aircraft designed for general utility and training purposes (Figure 4). EWE was powered by a Lycoming IO‑360-L2A fuel-injected piston engine and fitted with a McCauley two-blade, fixed-pitch propeller. The aircraft was manufactured in the United States in 2006 and first registered in Australia the same year. EWE had been owned and operated by the same flight training organisation since 2007 and had accumulated 6,348 hours in service prior to the accident flight.

A Garmin G1000 (G1000) integrated flight deck system was installed in EWE. The G1000 system consists of two display units, presenting flight instruments, position, navigation, communication and identification information to the pilot. Each display had two slots for secure digital (SD) memory cards, one for the navigation database and one for flight plans, software updates and flight data logging. SD cards were installed in the slots of at least one of the display units at the time of the accident.

EWE was fitted with a standard stall warning system, which consisted of a stall warning horn and scoop assembly. The warning system was designed to activate the horn between 5–10 knots above the stall speed in all configurations.

Weight and balance calculations showed that the aircraft was well within the weight and centre‑of‑gravity limits at all stages of the flight.

Figure 4: VH-EWE

Source: Phil Vabre

Fuel system information

The Cessna 172 fuel system has a total capacity of 212 litres (of which 200 litres is useable) and consists of two vented integral fuel tanks, one in each wing. The tank is located in the inboard section of each wing and has two fuel pick-ups, forward and aft. Surrounding each pick-up is a baffle, to reduce any sloshing affecting fuel flow downstream.

A fuel selector valve lever (Figure 5), operated by the pilot, allows fuel to gravity flow from either the left or right, or both wing tanks to a reservoir (feeder) tank. The handle is indexed and therefore cannot be fitted incorrectly. The Cessna 172 pilot operating handbook (POH) recommends checking the fuel selector is in the BOTH position prior to engine start, prior to take-off, and before landing.

An auxiliary pump^[7] draws fuel from the reservoir and delivers it, under pressure, to the engine‑driven pump and fuel injector unit.^[8] The fuel injector unit meters the fuel/air ratio that is delivered to the flow divider, which distributes the fuel to each cylinder nozzle, for combustion.

A fuel shut-off valve is located between the auxiliary and engine driven pumps. The POH requires the fuel shut-off valve to be selected to ‘off’ (closed) in the event of a forced landing due to engine failure.^[9] The fuel shut-off valve is located separate to the fuel selector valve to prevent inadvertent shutting of the fuel system when selecting between tanks. Fuel shut-off valve operation, via mechanical linkage, is achieved by pulling the knob full out (rearward).

Figure 5: Typical Cessna 172 fuel and engine control locations

Source: ATSB

The throttle is configured so that it is open in the forward position and closed in the full aft position. The throttle also has a friction lock to hold it at the selected position. The mixture control allows the pilot to vary the fuel/air mixture entering the engine. The ‘rich’ position is fully forward. Moving the control aft leans the mixture and full aft is idle-cutoff (engine shutdown).

Each tank has a low fuel sensor that indicates when the tank quantity drops below about 18 L for 60 seconds. The POH states that in this condition, a LOW FUEL amber message will flash on the annunciator panel for about 10 seconds, then remain steady. There is no aural warning for low fuel. In addition, the POH recommends that if the selected tank is less than one‑quarter full (28L), uncoordinated/unbalanced flight with respect to rudder input should be avoided for periods longer than 30 seconds.

Maintenance information and history

EWE was maintained in accordance with a CASA-approved System of Maintenance, which required a periodic check to be conducted every 105 hours or 6 months, whichever came first. A review of the aircraft logbooks did not identify any significant incidents, accidents or major repairs in the aircraft’s maintenance history. EWE was last flown on 3 June 2018, with no reports of concern about its serviceability prior to it entering routine maintenance.

Maintenance prior to accident flight

EWE underwent scheduled maintenance during the week of 4-8 June 2018 at the flight training organisation’s maintenance facility at Moorabbin Airport. This included a periodic inspection, other scheduled maintenance, and minor additional maintenance/rectifications. A scheduled engine change was also completed. In addition, the fuel selector handle was removed, painted and reinstalled, and the stall warning air scoop was replaced and tested.

The accident pilot, who was also a licenced aircraft maintenance engineer (LAME), worked on the airframe and was assisted by an apprentice. The engine change was conducted by another LAME.

At the completion of the maintenance, the aircraft was washed and readied for engine runs. An initial ground run was carried out, for about 5–10 minutes. The LAME who had conducted the engine change reported that he conducted a leak check and adjusted the idle mixture, with satisfactory results. A second engine run, of about 20–30 minutes, was then conducted and included checks of the magnetos, fuel flow, cylinder head temperatures, exhaust gas temperatures and oil pressure. Once the engine oil reached operating temperature, the idle RPM was noted to be a little low and was adjusted accordingly. EWE was then returned to the hangar, engine cowls were fitted, and a new maintenance release issued.

While there was no formal requirement for a test flight, the chief engineer advised it was standard procedure for LAME’s holding pilot licences to conduct an ‘acceptance flight’ in the aircraft at the completion of major work. Several pilot-licenced LAMEs took it in turns to conduct these flights with the knowledge of the flight training organisation.

The acceptance flights were generally about 60 minutes duration and operated at about 65‑75 per cent power, to help bed the piston rings, when an overhauled engine had been installed. A visual inspection and leak check was then conducted after landing. The chief engineer surmised the pilot had ‘done about 50’ of these flights during the approximate 20 years he had been working for the company.

Engine history and overhaul information

The Lycoming IO-360-L2A is a four-cylinder, direct drive, horizontally opposed, air-cooled, fuel‑injected piston engine. Engine serial number L-32890-51E was installed new in one of the flight school's aircraft in 2006 and removed twice for 3,000 hour scheduled overhaul. After each overhaul, the engine was installed in a different aircraft. The second installation was in EWE.

The engine was inspected and overhauled at an authorised maintenance and overhaul facility in Victoria. The facility received the engine on 10 April 2018 and the engine inspection worksheets did not indicate any issue with the engine strip and inspection.

The scheduled maintenance included replacement of the engine hoses, baffles and mount components. Two overhauled magnetos were fitted at this time. In addition, inspection of the fuel injection supply lines was conducted in accordance with the United States Federal Aviation Administration (FAA) airworthiness directive (AD) 2015‑19‑07. The flow divider was replaced with an overhauled item. The fuel injector and fuel nozzles were disassembled, cleaned and inspected. The flow divider, fuel injector and fuel nozzles were bench tested with satisfactory results.^[10] They were then fitted to the engine for the engine post-maintenance test-bed runs.

Following overhaul, the engine was run on the overhaul facility’s test bed on 25 May 2018 with satisfactory results. The engine test schedule included two runs, for a total of 75 minutes, with a shutdown and oil level check in between runs.

Additional maintenance carried out during the engine change included:

• idle mixture and idle RPM adjustment^[11]
• replacement of two engine control rod ends due to wear.

Site and wreckage information

The accident site was located on a residential street in the Melbourne suburb of Mordialloc, about 680 m south of the runway 35L threshold. A school oval (210 m long by 120 m wide) was situated about 50 m south of the accident site (Figure 6).

Figure 6: Accident site location

Source: Victoria Police, modified by ATSB

Security camera footage, along with statements from two nearby witnesses, were used to calculate the height of the aircraft at the time of the apparent stall. From this, EWE was estimated to be about 85 ft above ground level at the commencement of the loss of control.

The security footage showed the landing light was in operation immediately prior to the collision with terrain, which was consistent with the aircraft electrical system being energised. The fire initiation point could not be determined. However, it was likely the energised electrical system or hot engine components ignited the fuel on board.

The post-impact fire destroyed the cabin section of the fuselage and most of the left wing, which precluded a complete examination of those sections of the aircraft. The on-site examination of the wreckage identified:

• no evidence of in-flight break-up
• no evidence of pre-existing damage or anomalies in the flight control system that may have contributed to a loss of control
• at the point of impact the propeller was not rotating and the flaps were retracted.

The engine assembly and fuel selector valve were retained for further examination. One of the G1000 units was identified in the wreckage, however the SD cards were destroyed in the fire and no data was able to be retrieved.

Engine and fuel systems examination

Engine examination

The engine was disassembled and examined at a CASA-approved engine overhaul facility under the supervision of the ATSB. The engine condition was consistent with the operated life of the engine and limited run time (bedding in) following the recent overhaul.

Fire and heat damage prevented functional testing of the engine ancillary components. However, visual examination of the engine-driven fuel pump did not identify any anomalies that may have affected its operation. Disassembly and examination of the magnetos, vacuum pump, oil pump and associated oil system components, and drivetrain similarly did not identify any failure or condition that may have affected engine operation.

The throttle and mixture controls were identified in the forward positions. The fuel injector was found in the open (full power) condition, consistent with throttle being fully forward, and the throttle valve had full and free movement. The fuel metering section of the injector was severely damaged by fire and heat, however it was noted there was no evidence of oil contamination. Engine fuel system component disassembly and inspection did not identify any failure, seizure or blockage that may have prevented fuel flow to the engine cylinders.

The spark plugs were noted to be a darker colour than standard, this could be due to:

• an engine running rich
• the ‘bedding in’ phase, for up to 25 hours after the overhaul
• the engine being flooded during an attempted restart.

It is unlikely that the engine was running excessively rich, as this was the first flight after the overhaul and the engine and fuel components had been tested prior to reinstallation. In addition, the pilot probably adjusted the mixture control for each phase of flight in accordance with normal operating procedure and should have identified if there was a higher than usual fuel flow. Witness reports of the engine spluttering or struggling to start may be indicative of the pilot attempting an engine restart.

In summary, examination of the engine did not identify any failures or issues that may have contributed to the loss of engine power.

Fuel system examination

Examination of the fuel system identified that:

• both fuel tank filler caps were secure^[12]
• the inboard section of the left wing, including fuel tank, was destroyed by the fire
• the right wing, including fuel tank, had minor heat damage, to the inboard section only
• a small fracture to the right tank inboard skin upper half that was likely a result of impact forces
• about 2 litres of fuel drained from the right tank when the wing was inverted
• the fuel shut-off valve was in the off (closed) selection
• the fuel selector valve was mid-travel between the ‘left’ and ‘both’ ports.

It was standard practice to fuel the flight school aircraft to ‘full’, however an accurate ‘fuel on board’ figure was not recorded. Fuel delivery records showed the EWE was fuelled after its last flight, prior to entering maintenance and the amount of fuel uplifted was consistent with completely filling the tanks.

Fuel usage calculations (including on-ground engine runs) indicated there should have been about 121–146 L on board EWE at the time of the accident, of which between 109–134 L was usable.^[13] Considering a worst-case scenario, with the aircraft being operated solely on one tank for the engine runs and flight, fuel calculations indicated that there should have been 17 L (11 L useable) remaining in the selected tank. Additionally, flight with the left tank full and the right nearly empty would likely have induced noticeable flight handling characteristics.

Given the duration of the accident flight, it was considered unlikely that there was any problem with the fuel quality. That assessment is supported by the fact that a number of other aircraft used the same fuel source, with no reported issues.

Meteorological information

The Bureau of Meteorology’s Moorabbin Airport automatic weather station recorded a temperature of 13˚C and a 13 kt northerly wind at 1700 on 8 June 2018. This corresponded with the conditions recorded on the Moorabbin Airport automatic terminal information service, which the pilot acknowledged receiving.

Sunset occurred at 1706, 7 minutes prior to the accident. After the pilot declared MAYDAY, EWE was observed in a left turn toward the west. Calculations and recorded video showed that sun glare and lighting conditions would not have reduced visibility at the time of the accident.

Approach profile considerations

Standard approach and glide profiles

The Cessna 172 POH does not provide approach profile guidance, however, it does contain the following information regarding landing approaches:

Normal landing approaches can be made with power on or power off with any flap setting within the flap airspeed limits. Surface winds and air turbulence are usually the primary factors in determining the most comfortable approach speeds.

The glide distance capability of aircraft varies with the effect of ambient wind, reducing with a headwind component. A headwind is most commonly experienced during an approach to land and was present during the accident approach.

The glide distance capability of the aircraft also reduces with flap extension and an increase in bank angle. The best gliding distance capability of the Cessna 172 is achieved with wings level and the flaps fully retracted. However, an approach is typically conducted with flaps extended. Retracting the flaps to increase gliding distance results in an initial reduction in lift and associated loss of height. Furthermore, the POH instructs that FULL flap be used for a forced landing without power to facilitate the lowest possible touchdown groundspeed. Multiple configuration changes at low level however, may distract a pilot and make it more difficult to maintain control of the aircraft.

Forced landing

Forced landing without engine power

The Cessna 172 POH provided guidance on restart procedures for an engine failure during flight should sufficient height and time be available. The POH also included guidance for ‘engine failure after take-off’. While not directly related to this occurrence, the guidance was relevant to an engine failure on approach as it occurs at low-level, with limited options and time to effect a successful landing.

ENGINE FAILURE IMMEDIATELY AFTER TAKEOFF

1. Airspeed   - 70 KIAS - Flaps UP
                     - 65 KIAS - Flaps 10° - FULL

2. Mixture Control - IDLE CUTOFF (pull full out)

3. FUEL SHUTOFF Valve - OFF (pull full out)

4. MAGNETOS Switch - OFF

5. Wing Flaps - AS REQUIRED (FULL recommended)

6. STBY BATT Switch - OFF

7. MASTER Switch (ALT and BAT) - OFF

8. Cabin Door - UNLATCH

9. Land - STRAIGHT AHEAD

The ATSB publication Avoidable Accidents No. 3 - Managing partial power loss after take-off in single-engine aircraft outlined the hazards associated with engine power loss at low height and strategies to minimise the associated risk. In addition, the guidance included ‘knowing that you have planned your action under non-stressful and controlled circumstances should give you the confidence to carry out the actions in an emergency situation’.

Moorabbin Airport

Moorabbin Airport is located 21 km south-east of Melbourne, Victoria at an elevation of 55 ft above means sea level. The airport is home to a range of general aviation activities including flying training, flight charter, aviation maintenance, and general and recreation aviation operations. The published circuit altitude is 1,000 ft.

The standard approach to runway 35 left (35L) and runway 35 right (35R) involves flight over a nature reserve, a residential area, the Woodlands Golf Course and a light industrial area (Figure 7). Lower Dandenong Road forms the southern boundary of the airport and has powerlines running along its southern edge and the airport perimeter chain-link fence to the north. The area from the fence to the start of 35L, about 240 m, consists of undulating, clear grass ground and two internal airport service roads.

Figure 7: Overview of Moorabbin Airport vicinity showing VH-EWE departure and approach track

Source: Google Earth, modified by ATSB

Options for forced landing

Theoretical glide distances were calculated for three points (last radio call, midway between last radio call and MAYDAY call, and the MAYDAY call location) using ATC recorded audio, radar data, flight tracking data and witness reports. At each point, it was theoretically possible to make the edge of the airport with a perfect glide. However, accounting for the effects of wind, flap configuration, tolerances on the data and reaction time of the pilot, this may not have been achievable.

The school oval and Woodlands Golf Course were possible landing options for the pilot if he believed he could not glide to the runway. The golf course as a landing option was deemed impractical as EWE was calculated to be at, or near, overhead the golf course at a height above the ground of around 300 ft at the time of the MAYDAY.

The security footage and witness reports indicate that EWE may have turned left and been heading in a westerly direction shortly after the MAYDAY call. Based on this, it was possible that the pilot was attempting to conduct a forced landing on the school oval. EWE’s estimated location during the MAYDAY call would have required a 180˚ left turn in order to conduct a southerly, downwind landing on the oval. The oval was about 210 m at its longest point, which is shorter than the approximately 375 m required for the Cessna 172 to land and come to rest.

Engine power loss during approach and forced landing guidance

FAA guidance

The United States Federal Aviation Administration publication Airplane Flying Handbook, Chapter 17 Emergency Procedures advises that when an emergency landing in terrain makes extensive aeroplane damage inevitable, pilots should keep in mind that keeping the cabin area relatively intact will help minimise injuries. This can be accomplished by using dispensable structure (wings, landing gear, fuselage bottom) to absorb the impact before it affects the occupants. In addition, vegetation, including brush and small trees, can provide considerable cushioning and braking effect without destroying the aeroplane.

Most pilots instinctively—and correctly—look for the largest available flat and open field for an emergency landing. If beyond gliding distance of a suitable open area, the pilot should judge the available terrain for its energy absorbing capability.

It was noted that EWE’s final approach was slightly lower than usual, prior to the MAYDAY broadcast. Chapter 8 Approaches and Landings includes accident statistics that show that a pilot is at more risk of an accident during the approach and landing than in any other phase of a flight. Further, following established procedures reduces the likelihood of an accident or mishap.

In addition, the guidance advised that in an emergency, such as an engine failure, elevator back pressure should not be applied to stretch a glide back to the runway. This will likely lead to the airplane landing short and may even result in a loss of control if the airplane stalls.

Other guidance

Flight Safety Australia published the article Your one and only: mitigating the risk of engine failure in singles in March 2019. This article highlighted that, while rare, engine failures should still be considered in the pre-flight planning.

Although reassuring, the statistics on engine failure don’t give licence to assume engine failure in a single won’t happen to you. Rather than passively waiting for power loss and falling back on trained responses, pilots must actively defend their aircraft against the consequences of engine failure. Know your aircraft and procedures. Fly as high as practical, keep your options open and have a clear plan rehearsed for engine failure during every sequence of flight.

CASA developed ‘a ten-part video series providing tips and advice from experts about keeping safe and legal’ titled Out-n-Back. Episode 8 Emergency procedures recommended that ‘the more you practise forced landings, the more readily those immediate vital actions will kick in, and the less daunting and intimidating your task will seem’.

Stall characteristics and recovery

An aerodynamic stall occurs when airflow separates from the wing’s upper surface and becomes turbulent, resulting in reduced lift and increased drag. In addition to any stall warning devices, pilots are trained to recognise an impending stall via sight, sound and feel.

A stall can be identified by an increasing descent rate, often accompanied by a rapid reduction in pitch attitude. An uncommanded roll or ‘wing drop’ may also occur when one wing stalls earlier than the other. Stall recovery practically involves lowering the nose of the aircraft and, if available, applying power to increase airspeed. Pilots are trained and assessed in stall identification and recovery during initial flight training and also during regular ongoing flight reviews. The POH stated that altitude loss of a C172, during a stall recovery, may be as much as 230 ft.

Circuit operations

In order to assure a safe and orderly traffic flow into and out of an airport, a standard circuit traffic pattern is used. The circuit consists of four legs: crosswind, downwind, base and final as shown in Figure 7, with standardised methods for joining the pattern to avoid traffic conflicts.

Figure 7: Standard circuit pattern

Source: Airservices Australia

Similar occurrences/research

A review of the ATSB national aviation occurrence database for single-engine piston-powered aeroplanes was conducted for the period January 2009 to January 2019. In total, out of 1,346 engine failure occurrences, 103 resulted in a loss of control. Engine failure or malfunction is not common, however there is increased pressure on the pilot when it occurs at critical stages of a flight, such as take-off and during final approach.

ATSB investigations

AO-2018-050

On 3 July 2018, the pilot, and sole occupant, of a Cessna 172RG aircraft, registered VH‑LCZ, was conducting circuit operations at Parafield Airport, South Australia. At about 1758 Central Standard Time,^[14] while under the night VFR^[15] operations, the engine failed, likely due to carburetor icing. The engine failed at a position during the final approach that did not permit the aircraft to glide to the runway, and afforded limited alternative landing area options. While descending during the forced landing at night, the aircraft struck a power line and then collided with terrain, resulting in minor injury to the pilot and substantial damage to the aircraft.

While a successful landing was not achieved in this instance, the pilot's actions after realising he would not reach the runway closely followed the guidance in the Federal Aviation Authority pilot’s handbook (Airplane Flying Handbook). The pilot’s actions in maintaining control of the aircraft maximised the likelihood of a successful forced landing.

AO-2015-079

Late in the afternoon on Sunday 19 July 2015, an amateur-built Stoddard Hamilton Glasair SH‑2FT two-seat aeroplane, registered VH-HRG and operated in the Experimental category, was seen flying due north, consistent with the downwind leg of a circuit for landing at Wedderburn Airport, New South Wales. Witnesses stated that they heard the aircraft’s engine surge twice and then silence, prior to hearing the aircraft collide with wooded terrain about 900 m north of the runway threshold. No witness reported seeing the aircraft turn onto the base leg or final approach, nor the aircraft collide with terrain. The pilot sustained serious injuries, the passenger was fatally injured and the aircraft was destroyed.

The ATSB found that during the turn onto final approach to land, the aeroplane’s engine ceased operating, probably due to carburetor icing. Following the loss of power, the pilot was unable to control the aircraft’s descent to an appropriate forced landing area before colliding with the ground.

AO-2014-149

On the morning of 14 September 2014, the pilot and passenger of an amateur-built Van's Aircraft RV-6, a two-seat aeroplane, registered VH-TXF, approached Mudgee Airport, following a 25‑minute flight. Witnesses stated that the pilot conducted a tight left turn onto final approach at a slow speed and low height. The witnesses also recalled hearing the aeroplane’s engine ‘splutter’ and then silence during the turn. The aeroplane continued its high-angle-of-bank left turn until it collided with terrain about 300 m south-west and short of the runway threshold. The pilot and passenger were fatally injured and the aeroplane was substantially damaged.

The ATSB found that during the turn onto final approach to land, the aeroplane’s engine ceased operating, likely due to carburetor icing. Analysis of the aeroplane’s global positioning system data showed that it was common for this pilot to fly approaches at lower than recommended circuit heights and at speeds close to the aircraft’s stall speed. The aeroplane’s airspeed before the engine failure was within about 0.5 kt of the estimated stall speed during the high-bank turn. After the engine failure, it is likely the aeroplane entered an aerodynamic stall. The associated loss of control was not recovered and the aircraft continued in the turn until it collided with terrain.

__________

7. The auxiliary pump is operated by the pilot and primarily used for engine starting and in the event of an engine-driven pump failure.
8. The fuel injector is referred to as the fuel/air control unit in the airframe documentation.
9. Closing the fuel shut-off valve prevents fuel from flowing to the ‘hot’ engine and spark plugs, removing a potential ignition source.
10. The fuel injector had been previously overhauled by the same facility in August 2013. The test sheet from this overhaul was compared with the most recent. In both cases, all parameters were within limits. In addition, there was little difference in actual figures between the two bench tests.
11. The idle adjustments made at overhaul are within manufacturer’s limitations. Minor adjustments may then be conducted at fitment, to suit the airframe characteristics.
12. The right filler cap was secure on the right wing. The left filler cap was located in the fire-damaged remains of the left wing, in a closed and secure configuration.
13. Fuel calculations considered the ‘maximum’ and ‘reasonably expected’ fuel burn for various phases of ground operations and flight.
14. Central Standard Time (CST): Universal Coordinated Time (UTC) + 9.5 hours.
15. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.

Safety analysis

VH-EWE (EWE) experienced an engine power loss while on final approach to land at Moorabbin Airport. The pilot transmitted a MAYDAY distress message, which was shortly followed by a loss of control and subsequent collision with terrain. The analysis will examine the factors involved in the engine power loss and subsequent loss of control.

Engine power loss

The pilot had been in contact with Moorabbin air traffic control for over 6 minutes with no indication of any engine issues. The pilot transmitted MAYDAY, stating ‘engine failure’, about 20 seconds after acknowledging his clearance to land, consistent with the engine issue developing relatively rapidly.

The engine had been operated, during testing and in the aircraft, for about 4 hours, with no indication of abnormalities. Further, the engine examination did not identify a mechanical reason for the loss of power. In the absence of an identified mechanical failure, the ATSB considered the possibility of a fuel-related issue.

Fuel calculations indicated there should have been over 100 L on board EWE at the time of the accident. In addition, the intense post-impact fire was consistent with there being a substantial quantity of fuel on board.

Wreckage examination identified that the right wing had minor heat damage whereas the forward fuselage and left wing were almost entirely consumed by the fire. In addition, the engine issue occurred shortly after EWE turned right onto final. The investigation therefore explored the possibility that EWE had been operated solely on the right fuel tank during maintenance runs and flight, resulting in fuel starvation that was potentially influenced by un‑porting of the fuel tank outlet. The fuel selector valve position prior to the accident could not be determined. However, fuel tank selection should be checked prior to start, prior to takeoff and before landing to ensure that fuel is drawn from both fuel tanks simultaneously. Further, the fuel quantity in both tanks would normally be monitored by the pilot throughout the flight to identify any fuel consumption variation.

In addition, the following factors opposed this hypothesis:

• there should have been at least 17 L (11 L useable) remaining in the right tank at the time of the accident, even if the entire flight was conducted using fuel from the right wing tank
• conducting a coordinated turn should avoid un‑porting of the fuel tank outlet in low-fuel quantity conditions
• the LOW FUEL warning should have indicated if the fuel quantity was less than 18 L for 60 seconds however, as there is no aural warning for low fuel, the pilot may have missed any activation of the warning light during the relatively high workload period setting up for landing
• flight with the left tank full and right nearly empty would likely induce flight characteristics that would be noticed by the pilot.

Therefore, while the uneven fire damage was unusual, there was insufficient evidence to determine that fuel starvation occurred following operation solely on the right tank. Further, there was insufficient evidence to determine if a temporary interruption to fuel flow or other intermittent fuel starvation event occurred.

Witness reports of unusual engine sounds of an engine struggling to start could be indicative of the pilot attempting to restore power. However, it was also likely that the pilot closed the fuel shut off valve, which was consistent with a decision to conduct a forced landing without engine power.

In summary, the reason for the engine power loss could not be determined.

Loss of control

The final approach path was situated over residential and light industrial areas, with few options for an off-airport landing. The pilot had worked at, and flown out of, Moorabbin Airport for many years, so was presumably aware that the departure and approach paths offered limited options for off-airport forced landings. Air traffic control’s observation of EWE’s approach was that the aircraft was a little low but not unusually so. In normal circumstances, the lower than normal height would not have affected the landing. In this occurrence, however, it reduced the likelihood of being able to safely glide to the airfield following the engine failure.

After the pilot’s MAYDAY transmission, both air traffic controllers noted that EWE’s nose attitude increased. This may have been indicative of the pilot attempting to extend the glide to the airport. Acknowledging that such an action would be instinctive when faced with the potential of a forced landing over an unsuitable area, the most important actions are to ‘continue flying the aircraft’ and achieve best glide speed. Raising the nose, without the addition of power, reduces airspeed, which can lead to loss of control if the aircraft slows excessively. The pilot also retracted the flaps, consistent with attempting to achieve the best glide distance. However, with the flaps retracted, the aircraft’s stall speed also increased.

The theoretical glide distance from the approximate location of the MAYDAY call, in ideal conditions, indicated it may have been possible to reach the airport property short of runway 35L. However, given the headwind and time required for the pilot to identify and react to the situation, had he attempted to conduct a forced landing straight ahead it is likely the aircraft would have landed just short of the airport.

Notwithstanding the chance of the touchdown occurring on a relatively busy road, landing short of, and passing through, the perimeter fence would have reduced the aircraft’s forward momentum. In addition, the open grassed area between the fence and runway threshold was relatively energy‑absorbent and free of obstacles. As such, and consistent with advice provided by the United States Federal Aviation Administration, a forced landing in these conditions was conducive to increased survivability.

The ATSB considered whether the school oval may have appeared more desirable to the pilot than a forced landing straight ahead, which presented buildings, roads, power lines and the airport perimeter fence. This may have prompted the reported left turn shortly after the MAYDAY broadcast. However, the act of turning increases the angle of bank and, in turn, the stall speed if back pressure is applied.

Ultimately, the left wing drop and sharp nose drop were consistent with an aerodynamic stall. In addition, the aircraft was calculated to be at about 85 ft when the stall occurred, considerably lower than the published minimum height required for stall recovery.

The pilot’s last flight review, 11 months prior to the accident, included practice engine failures. While the pilot may have conducted additional practice in the intervening time, there was no documented evidence of any additional practice, either formal or informal, having been conducted. The extent to which the pilot’s recency in management of emergencies influenced the development of the accident could not be determined. However, regularly practicing the appropriate emergency response improves readiness and proficiency, should an engine power loss occur.

When faced with in‑flight emergencies such as a loss of engine power, pilots needs to make decisions on how to manage the situation under conditions of stress, uncertainty, high workload, and time pressure.

During pre‑landing planning, considering factors such as wind direction and landing options on and off the airfield will likely reduce the pilot’s mental workload if an engine power loss occurs. While it was not possible to determine the degree to which the pilot considered the potential for an engine power loss, pre-planning generally mitigates the detrimental effects of decision-making under stress.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving a Cessna Aircraft Company 172S, registered VH-EWE that occurred near Moorabbin Airport, Victoria on 8 June 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During final approach, for reasons that could not be determined, VH-EWE experienced an engine power loss, at a position that afforded limited clear landing area options.
• Following the engine power loss, control of the aircraft was lost at a height insufficient for recovery prior to collision with terrain.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the Civil Aviation Safety Authority
• Airservices Australia
• Cessna Aircraft Company (manufacturer)
• the flight training organisation

References

Australian Transport Safety Bureau Avoidable Accidents No. 3 - Managing partial power loss after takeoff in single-engine aircraft

United States Federal Aviation Administration (FAA) Airplane Flying Handbook. Available on the FAA website www.faa.gov

FAA Safety briefing September/October 2010

Civil Aviation Safety Authority (Australia) Out-n-back. Available via www.casa.gov.au

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, Airservices Australia, the United States National Transportation Safety Board, the aircraft and engine manufacturers, the aircraft maintainer, and the flight-training organisation.

Submissions were received from the Civil Aviation Safety Authority, Airservices Australia, the United States National Transportation Safety Board, the aircraft and engine manufacturers, the aircraft maintainer, and the flight training organisation. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 18 June 2018, during cargo discharge operations while alongside at Port Kembla, New South Wales (NSW), a fire broke out in the internal cargo handling spaces of the self-unloading (SUL) bulk carrier Iron Chieftain.

The ship’s crew initiated an emergency response but shipboard efforts to control the fire were ineffective. The fire soon established itself and spread to the exterior of the ship, setting the discharge boom on deck alight. The ship’s crew were evacuated and shore firefighting services from Fire and Rescue New South Wales (FRNSW) took charge of the response to the fire. The fire was contained and eventually extinguished about 5 days after it started.

The ship sustained substantial structural damage, including breaches of two fuel oil tanks, and key components of the SUL system were largely destroyed. The ship was declared a constructive total loss and subsequently dispatched to be recycled. There were no serious injuries or pollution of the sea reported.

What the ATSB found

The ATSB investigation concluded that the fire originated in Iron Chieftain’s C-Loop space and was likely the result of a failed bearing in the ship’s conveyor system which created the heat necessary to ignite the rubber conveyor belt. The ATSB also determined that the ship did not have an emergency contingency plan for responding to fire in the ship’s SUL spaces and that there were technical failures of the ship’s alarm systems during the emergency response to the fire. Furthermore, some aspects of the shipboard response likely aided the fire’s development while others increased risk by removing shipboard capability.

The ATSB found that the risk of fire in Iron Chieftain’s C-Loop space was identified and documented by the ship’s operators, CSL Australia, as being unacceptable about 5 years before the fire. This risk rating was primarily due to the absence of an effective means of fire detection and fire suppression for the SUL system spaces. However, measures taken to address the risk were either inadequate or ineffective. Furthermore, the lack of adequate regulatory requirements or standards related specifically to the fire safety of SUL ships has been a factor in several fires, including Iron Chieftain. The ATSB also identified that the regulatory oversight of Iron Chieftain did not identify any deficiencies related to the safety factors identified by this investigation, or to the ship’s inherent high fire safety risk and management of that risk.

In addition, the ATSB identified a safety issue related to the marine firefighting capability of FRNSW as well as other safety factors related to the inconsistent conduct of ship’s drills and Port Kembla’s emergency response plans.

What has been done as a result

In response to this accident, the CSL Group (the parent company of the ship’s owners and managers—CSL Australia) initiated a fire risk mitigation project across its global fleet with the aim of:

• improving fire detection and suppression technology
• reviewing firefighting policy
• setting minimum fire safety standards for early fire detection and suppression at the ship design and build stage.

The ship’s managers advised that linear heat detection systems and/or closed circuit television camera systems integrated with video analytics to provide or enhance the capability for early fire detection were installed on board six conveyor belt-equipped SUL ships operated by CSL Australia with installation of similar systems planned for a seventh ship. A CSL Australia-operated SUL ship with internal conveyor spaces was equipped with a Hi-Fog water mist fixed fire-extinguishing system covering the ship’s internal SUL spaces. In addition, one ship with external conveyor systems was equipped with a deluge system and installation of a deluge system is intended for at least one other ship. Additionally, ship‑specific emergency contingency plans for fires in the SUL spaces have been developed and implemented across the CSL Australia fleet.

The Australian Maritime Safety Authority (AMSA) and Lloyd’s Register have undertaken to approach the International Maritime Organization (IMO) and the International Association of Classification Societies (IACS) respectively, to raise the identified safety issue related to the inadequacy of fire safety standards or regulations for SUL system spaces. However, due to limited detail and a timeframe to seek resolution of the safety issue by the IMO, the ATSB has issued a safety recommendation to AMSA. The ATSB will continue to monitor the safety issue while actively working to highlight and promote awareness of the issue.

With respect to the regulatory oversight of SUL bulk carriers, AMSA has provided its inspectors and delegated organisations with updated guidance related to the focus of audits and inspections particularly with regard to the fire safety risk aspects associated with these ships. In addition, AMSA is progressing an inspection campaign concentrating on SUL bulk carriers operating in Australian waters, with a focus on fire safety and emergency preparedness.

Fire and Rescue New South Wales has advised that work is underway through the Australasian Fire and Emergency Service Authorities Council (AFAC) Working Group for Marine Firefighting to produce a nationally consistent approach to marine firefighting which will inform the development of new FRNSW standard operating guidelines. In addition, FRNSW continues to undertake familiarisation and training exercises to improve marine firefighting capability and awareness. While welcoming the safety action, the ATSB has issued a recommendation that FRNSW takes further action to address the safety issue related to marine firefighting capability.

The PANSW advised that the Port Kembla Marine Oil and Chemical Spill Contingency Plan and the Crisis Management Plan were to be updated to reflect the guidelines for responding to fires on a vessel as described in the NSW State Waters Marine Oil and Chemical Spill Contingency Plan.

In addition, the Memorandum of Understanding in relation to Hazardous Material Incidents on Inland and State Waters between Transport for NSW (NSW Maritime), FRNSW and the PANSW was being updated, with changes including specific handover arrangements being considered.

Safety message

The investigation into the fire on board Iron Chieftain has highlighted the inadequacy of fire safety regulations and standards for the cargo handling spaces on board self-unloading bulk carriers. The effectiveness of a shipboard response to a fire depends primarily on the ability to detect the fire at an early stage and quickly extinguish it at the source. Where it has been identified that the lack of such systems has resulted in the risk of a fire in a space being unacceptable, suitable control measures need to be implemented in order to reduce the risk to an acceptable level.

The introduction of mandatory minimum standards for suitable fire detection and extinguishing systems, to address the known high fire risk spaces of self-unloading bulk carriers, can significantly reduce the risk of major fires in these spaces. Additionally, the introduction of standards governing the fire resistance properties of conveyor belts used in shipboard systems can help reduce the likelihood of ignition in the first place.

 

The occurrence

Overview

On 18 June 2018, a fire broke out on board the Australian registered, 202 m self-unloading (SUL) bulk carrier Iron Chieftain during discharge of the ship’s cargo of dolomite in Port Kembla, New South Wales. The fire quickly overwhelmed the ship’s crew, and it took shore firefighting services about 5 days to contain and extinguish the fire. The ship sustained substantial damage as a result of the fire and was subsequently declared a constructive total loss (CTL)^[1]

Arrival and cargo operations

At about 0222 Eastern Standard Time^[2] on 15 June 2018, Iron Chieftain (Figure 1) arrived at the pilot station off Port Kembla, New South Wales, following a voyage from Ardrossan, South Australia. The ship was loaded with about 41,832 tonnes (t) of dolomite.^[3] At 0530, a pilot embarked the ship and by 0700, Iron Chieftain was safely alongside, (starboard side to) at berth number 113, owned and operated by BlueScope Steel.

Figure 1: Iron Chieftain on fire at Port Kembla

Source: ATSB

The ship commenced discharging cargo shortly after berthing, at about 0755. The cargo was discharged into trucks through a shore-side hopper using the ship’s self-unloading system (Figure 2). The system consisted of a series of hydraulically operated gates under the cargo holds through which cargo was deposited onto conveyor belts running in tunnels under the ship’s holds. The cargo was transported to two smaller athwartships transfer conveyor belts, up a vertical conveyor belt system, known as the C-Loop elevator, and then across the ship’s deck to the shore-side hopper and trucks via a discharge boom (see the section titled The self-unloading system).

Figure 2: Iron Chieftain's self-unloading system

Source: CSL Australia, annotated by the ATSB

On 15 June 2018, the first day of discharging, the tunnel conveyors had to be briefly stopped to rectify a frozen conveyor idler roller.^[4] Cargo discharge operations proceeded without incident for the next 3 days with the exception of a few unexplained automatic system stoppages. On each occasion, the system’s programmable logic controller was reset, and discharge continued without issue. The expected completion time for cargo discharge operations was on the morning of 18 June 2018.

Cargo rounds

The ship’s deck officers and integrated ratings (IR)^[5] maintained 4-hour cargo watches in port. The officers controlled and monitored the cargo discharge operation at the SUL system control console on the navigation bridge (bridge) while the IRs monitored operations on deck. The ship’s engine room was unattended at night,^[6] with the duty engineer notified of any alarms through the engineer’s alarm panel in their cabins.

As part of their duties during cargo watch, IRs conducted fire and safety rounds of the ship, which included checks of the SUL system. The rounds consisted of checks of the cargo discharge boom on deck, the vertical C-Loop space, the athwartships transfer belts (at the bottom of the C-Loop space), and along each fore and aft tunnel under the cargo holds (Figure 2). These rounds were usually conducted at least twice during every 4-hour watch.

In addition, the ship’s deck mechanic conducted regular inspections of the SUL system spaces between the hours of 0800 and 1700, with an additional round at evening (usually between 2000‑2100) before retiring for the day. The deck mechanic’s inspection consisted of a general visual check of the system and conveyor belts as well as the use of a pyrometer^[7] for temperature checks of various components such as bearings, rollers, and motors.

Activity leading up to the fire

On the morning of 16 June 2018, the ship took on heavy fuel oil (HFO) bunkers. Following bunkering, the total quantity of HFO held on board was recorded as being about 952 t, of which about 815 t was held in the port and starboard HFO tanks, adjacent to the C-Loop space, with the remainder in the engine room’s settling and service tanks.

On the evening of 17 June 2018, during safety rounds of the SUL system, the 1600–2000 IR observed that the rubber coverings had come off a conveyor idler at the base of the C-Loop elevator belts. He reported that this was advised to the chief mate.

At about 2000, the deck mechanic conducted a safety round of the SUL system. The deck mechanic reported that the system was operating satisfactorily during his round with no issues observed. The 2000–0000 IR also conducted two safety rounds during his watch with nothing of significance reported.

At 0100 on 18 June, the 0000–0400 IR conducted a safety round of the SUL system. At the conclusion of the round, at about 0125, the SUL system was reported to be operating smoothly with no abnormal odour, noise, or observations.

The fire

At 0300, the IR radioed the second mate, who was the officer of the watch, and informed him that he was about to start his rounds again. The second mate started the ventilation fan (located on the foc’sle) which provided airflow through the tunnels from forward to aft. By this time, just under 40,000 t of cargo had been discharged from the ship’s five cargo holds with about 2,000 t remaining to be discharged from hold number 3 (Figure 3). The hatch covers on hold number 3 were open with those on the four empty cargo holds closed.

Figure 3: Iron Chieftain – Ship’s plans highlighting relevant spaces and information

Source: CSL Australia, modified and annotated by the ATSB

At the time the IR commenced his rounds, the wind was south-westerly, at about force three^[8] (7‑10 knots), blowing offshore across the ship’s deck from starboard to port. The IR walked to the aft end of the cargo discharge boom on the ship’s main deck and climbed up to the port side of the boom. As the IR walked forward along the port side of the boom, he noticed an unusual smell. The IR quickly continued forward and crossed over to the starboard side at the discharge end of the boom. Once on the starboard side of the boom, the IR smelled something similar to rubber and started to walk aft to make his way back down to the deck. As the IR neared the aft end of the boom, he saw something that looked like white smoke or dust coming from the C-Loop casing door on the main deck, which was always open during cargo operations (Figure 4). As the IR climbed down from the boom to the deck and walked to the door, the smoke reportedly abruptly changed from white to black.

Alarm raised

The IR immediately used his radio to report the strange smell and smoke to the second mate on the bridge and requested that cargo discharge be stopped. The IR considered entering the C‑Loop space but decided that it was too dangerous due to the large amount of smoke. The second mate acknowledged the IR’s report and asked him to confirm his request for the cargo discharge to be stopped. The IR confirmed this and then made his way to the bridge using the ship’s elevator. Once on the bridge, the IR and second mate could clearly see black smoke rising from below the bridge front where the C-Loop casing was located.

At 0306, the second mate stopped cargo discharge by closing the gates at the bottom of the cargo hold and shutting down the SUL conveyor belt systems. This stopped the system’s conveyor belts in sequence, with the tunnel conveyor belts stopping first, then the transfer belts, the C-Loop belts and finally the discharge boom conveyor belt.

At about 0307, the second mate telephoned the chief mate and first engineer to alert them to the situation and inform that cargo discharge had been stopped. The chief mate acknowledged the report, dressed, and proceeded to the main deck to assess the situation while the first engineer advised the second mate to call the deck mechanic. When the chief mate arrived on deck, he saw black smoke at the aft end of the discharge boom and concluded that there was a fire in the C‑Loop space or tunnels and radioed the second mate to raise the alarm.

Shortly after, the chief mate was joined by the deck mechanic. Together they attempted to open the valve for the C-Loop dust suppression spray system, which was in front of the accommodation to port of the C-Loop casing. However, they could not approach it due to the smoke and heat emanating from the C-Loop casing. They decided to go back to the emergency muster station and organise an emergency party to return and open the valve.

Figure 4: C-Loop casing door and C-Loop spray system valve
 

Source: ATSB, modified and annotated

Meanwhile, the IR went back down to the deck, using the ship’s elevator, to start setting up fire hoses for firefighting and boundary cooling. The IR went to the port side of the main deck but due to the amount of smoke being blown to port, made his way around to the starboard side and began to rig the fire hoses for boundary cooling.

At 0311, the second mate activated the ship’s fire alarm,^[9] which sounded for 13 seconds before unexpectedly stopping. The second mate used the bridge telephone to call the master who had heard the alarm. He then activated the fire alarm again, which sounded for 12 seconds before again stopping. About 8 seconds later, the alarm sounded for 1 second, and soon after, for 2 seconds before going silent. By this time, several crewmembers, including the off‑duty IRs, had been woken by the alarms. Most of them turned on their radios, heard reports of the fire and began making their way to the emergency muster station, located outside the fire control station, on the starboard side of A-deck, aft of the accommodation.

At 0312, the master arrived on the bridge. By this time, the second mate had notified shore personnel of the fire and they began to evacuate their trucks from the wharf area. The second mate then left the bridge to go down and assist with firefighting efforts. Once on deck, the second mate joined the 0000–0400 IR in rigging hoses for boundary cooling the C-Loop casing from the starboard side of the main deck.

At 0313, a smoke detector activated the fire alarm, which sounded for 9 seconds. The master checked the fire detection system control panel and saw that a number of zones had activated. The master then attempted to sound the ship’s general emergency alarm^[10] to muster the ship’s crew. The alarm sounded but stopped after four short blasts. The master tried to sound the general emergency alarm again, but it did not work. Shortly after, the master broadcast a request over the radio to the BlueScope Steel shift supervisor ashore requesting that emergency services be notified. The master then made an announcement on the ship’s public address system notifying the ship’s crew of the fire and instructing them to proceed immediately to the ship’s emergency muster station.  

Just after 0314, the fire detection system panel indicated ‘fire’ followed by ‘system failure’. This sequence continued for the next minute or so. By this time, the second engineer, who was the duty engineer, had been woken by the engineer’s alarm in his cabin (also activated by the fire detection system). He went up to the bridge to see what was happening and, on seeing the activity, decided to proceed to his muster station in the engine control room. On his way down, he met the electrical engineer who accompanied him to the engine room. Shortly after, the second engineer radioed the bridge that he was at his muster station in the engine control room.

At about 0315, some 10 minutes after the initial detection of the fire, the BlueScope Steel shift supervisor ashore called the emergency services and reported a fire on board Iron Chieftain. The shift supervisor then advised the master that emergency services had been notified and were on their way.

At 0316, the third mate arrived at his muster station on the bridge to assume his emergency duties of managing external communications. The third mate reminded the master that the general emergency alarm should be sounded to muster the ship’s crew. The master told him that he had tried to sound the alarm but that it did not work. The third mate then suggested that he would go around the accommodation and physically check that everyone was awake and aware of the fire. The master agreed and the third mate left the bridge and made his way down through the ship’s accommodation notifying personnel along the way, including the chief engineer, first engineer and third engineer.

Shipboard response to the fire

At about 0318, Fire and Rescue New South Wales (FRNSW) began to assign assets to respond to the fire. As per its standard operational procedures, FRNSW tasked two fire appliances^[11] to respond to the incident, which was initially described as a ‘fire in galley or crew quarters’.

At about the same time, the chief mate reported to the master that the seat of the fire was still unknown and that he was unable to approach the main deck door to the C-Loop space due to smoke and heat. Meanwhile, several crewmembers had gathered at the ship’s emergency muster station.

The chief mate briefed the gathered crew on the situation and gave orders for further actions. These included:

• starting the emergency fire pump
• shutting ventilation flaps around the accommodation
• starting boundary cooling
• organising the emergency party.

The two-person emergency party consisted of the deck mechanic and the chief IR. They were instructed to don the two fireman outfits and self-contained breathing apparatus (SCBA) stored in the fire control station, approach the C-Loop casing, close the C-Loop casing door on the main deck and open the dust suppression spray system valve. The chief mate then went to the bridge and started the cargo hold washing pump that supplied water to the spray system.^[12] At 0319, the second engineer radioed to report that the engine room’s forward bulkhead adjoining the C-Loop space was very hot. The master acknowledged the report and asked the second engineer to shut down ventilation to the ship’s accommodation. Shortly after, the second engineer reported that the paint on the engine room forward bulkhead was starting to blister.

By this time, the chief engineer had made his way to the bridge. He observed that several fire zones, including those covering the engine room, were active on the ship’s fire detection system control panel.

At 0320, the master radioed the chief mate with instructions for two men in fireman outfits and SCBA sets to locate the source of the fire and for at least two men to be sent down into the engine room to set up boundary cooling of the bulkhead. By this time, the master had started the main and emergency fire pumps.

At 0321, the third mate arrived at the muster station and, together with an IR, set off for the foc’sle to retrieve the two fireman outfits, SCBA sets and spare air cylinders stored in the foc’sle store. Once there, they noticed that the ventilation fan blowing air through the tunnels and the SUL system spaces was still operating. The IR reported this over the radio and asked for it to be stopped. The pair then gathered the stored equipment and made their way back to the emergency muster station.

At 0322, the second engineer broadcast multiple reports over the radio that there was a ‘big fire’ in the engine room. The master acknowledged the report and ordered the chief mate to send any SCBA-equipped crew to the engine room. The master reported the fire in the engine room to the BlueScope Steel shift supervisor ashore who in turn reported this to Port Kembla vessel traffic information centre (VTIC). The master also checked with the shift supervisor as to the status of shore firefighting services and was reassured that they were not far away. By this time, FRNSW assets were en-route to the port.

Meanwhile, the two-person emergency party, equipped with fireman outfits and SCBA sets, made their way to the front of the accommodation and attempted, unsuccessfully, to open the C-Loop spray valve. They also noticed that the tunnel ventilation fan was still running. They returned to the muster station to replace their air cylinders and to get a tool to help open the pressurised valve.

Shortly after, the chief engineer followed by the master, ordered the engine room to be evacuated as use of the engine room’s carbon dioxide (CO₂) fixed fire-extinguishing system was being contemplated. The master and chief engineer then left the bridge for the muster station. Before leaving, and in preparation for the imminent release of CO₂, the chief engineer activated the bridge emergency stops, which shut down the:

• accommodation and cargo hold fans
• other engine room auxiliary machinery, including the diesel and fuel oil transfer pumps.

On the way down, the master went to his cabin to attend to two family members who were visiting, and found the chief mate assisting them prepare for evacuation.

The chief engineer manually stopped the air conditioning system fans and ordered that all fuel quick closing valves (QCVs) be activated, and engine room fire flaps closed in preparation for CO₂ release. At 0323, the second engineer reported that the fuel QCVs in the fire control station had been activated while the first engineer shut the engine room’s funnel doors, dampers, and flaps.

The chief engineer then went to the fire control station and checked that the main fire pump, emergency fire pump and the general service pump were running. He also ordered that the emergency generator be started manually but not put on-line while the main generators in the engine room were still powering the ship. The second engineer and third engineer went to the emergency generator room and manually started the emergency generator. Soon after, the activation of the QCVs took effect and the ship’s main generators shut down thereby blacking out the ship. The chief engineer then ordered the emergency generator brought on-line.

Arrival of Fire and Rescue New South Wales

At about 0325, about 10 minutes after the initial FRNSW notification and 20 minutes after the fire was first detected, the first FRNSW assets began arriving at the port facility. At about this time, the master ordered all crew to the muster station for a headcount to ensure that there was no one left in the engine room when CO₂ was released.

By 0329, the master had completed a headcount and confirmed that all personnel were accounted for. All engineers were clear of the engine room while the chief mate, second mate, two IRs and one trainee IR were engaged in boundary cooling forward of the accommodation with five fire hoses.

At 0330, Port Kembla VTIC notified the harbour master of the fire on board Iron Chieftain. At about the same time, the first FRNSW assets were arriving on the wharf.

Meanwhile, the emergency party returned to the C-Loop casing with a wheel spanner and successfully opened the C-Loop spray valve. This time, the tunnel ventilation fan was reported as being stopped likely as a result of the main generators shutting down. Shortly after, the master ordered all crew to prepare to evacuate the ship.

Fire and Rescue New South Wales operations

18 June 2018

At about 0333, the first FRNSW firefighters boarded the ship. The first arriving firefighters observed that there was heavy, black smoke with significant heat and flame issuing from the C‑Loop casing at deck level. They also noted that the discharge boom conveyor belt on deck was smouldering along its entire length but was not alight. The firefighters set up a defensive firefighting strategy and escalated the FRNSW response to a ‘5^th alarm level’.^[13] Meanwhile, FRNSW began to notify other relevant agencies and organisations including Marine Rescue New South Wales, Environmental Protection Agency (EPA), Roads and Maritime Services (RMS), New South Wales Police and ambulance services.

The ship’s master, aided by other senior officers, briefed FRNSW firefighters on the situation and explained that there was a fire most probably in the C-Loop space. The crew also began to disembark the ship on the master’s orders. The master, chief mate, chief engineer, and the ship’s emergency party (deck mechanic and chief IR) remained on board to assist FRNSW with familiarisation of the ship’s spaces and gaining access to the C-Loop casing.

The master discussed the option of activating the engine room CO₂ fixed fire-extinguishing system with FRNSW firefighters and advised that the system was prepared and ready for release. The firefighters concurred with this course of action and, shortly after, the chief engineer flooded the engine room with CO₂. By this time, the emergency generator had been successfully brought on-line although, in the course of completing this task, the first engineer reported smoke and a minor fire in the emergency switchboard.

At 0350, the Port Kembla harbour master declared a port emergency and suspended all shipping activity. The harbour master also established contact with FRNSW over the telephone and delegated incident controller status to them.

By this time, the discharge boom conveyor belt on deck was alight, with the fire spreading rapidly (Figure 5). FRNSW firefighters on scene advised that it would be a protracted response and requested additional resources. The firefighters then focused on extinguishing the visible fire on the discharge boom. FRNSW noted that 22 people, including the ship’s crew, and the master’s family, had been evacuated from the ship. Over the following days, members of the ship’s crew, often including the master and chief engineer, returned to the ship to assist firefighting efforts and assessment activities, including making entry to the C-Loop casing with FRNSW firefighters.

Figure 5: Boom conveyor on fire

Source: Port Authority of New South Wales

At about 0351, the tug Barunga, assigned by Port Kembla VTIC to assist with firefighting efforts, arrived on scene. VTIC advised FRNSW firefighters that the tug could be contacted on very high frequency (VHF) radio channel 11 and provided the tug master’s mobile telephone number. About 20 minutes later, tug Svitzer Kiama also arrived on scene. The port’s pilot boat, which was equipped with a forward-looking infrared camera, also provided imagery and on-water assistance to FRNSW throughout the response to the incident.

By 0400, FRNSW firefighters decided that internal firefighting operations on the ship were impossible due to the volume of smoke but continued with defensive firefighting operations.

At 0420, on the harbour master’s orders, Port Kembla VTIC formally transferred incident controller status from the Port Authority of New South Wales to FRNSW.

By 0447, firefighting crews began to withdraw from the ship as the fire gained intensity and they became aware of the two HFO tanks adjacent to the C-Loop space. Defensive firefighting continued and the ship was reported to be well alight internally with large volumes of smoke.

At 0457, a senior FRNSW officer arrived on scene, assumed the incident controller (IC) role, and began to set up an Incident Management Team (IMT). By about 0532, a FRNSW mobile command centre (MCC)^[14] had arrived on site.

By 0606, the IMT was established and included representatives from FRNSW, the ship, police, and the port authority. An anti-pollution boom was also installed around the ship by the port authority and tug support remained in place (Figure 6). Representatives from the ship’s owners, Canada Steamship Lines Australia (CSL Australia) also arrived on site later that day.

Figure 6: Port Kembla tugs assisting with firefighting efforts

Source: Port Authority of New South Wales

At about 0703, FRNSW made the decision to stop the emergency generator and isolate all shipboard power. Internal temperatures were measured at about 200 °C with no elevated external temperatures. By 0830, FRNSW considered the fire contained and extinguishment plans were being developed. Meanwhile, high-expansion firefighting foam was being sourced from across NSW and interstate.

By 0942, the firefighting strategy began to transition from defensive to offensive firefighting using foam. At about 1144, firefighters reported zero visibility at the C-Loop casing door with temperatures between 46‑56 °C. Shortly after, the ship’s master went aboard to provide assistance with opening the bow access hatch to the forward end of the SUL system tunnel spaces. Meanwhile, firefighting continued using aerial appliances and without the firefighters entering the C-Loop space (Figure 7).

Figure 7: Firefighting using aerial appliances

Source: Fire and Rescue New South Wales

At 1200, the harbour master re-opened the port to shipping.

At 1659, temperatures of about 109 °C were recorded in holds number 3 and 4. Soon after, a changeover of the IMT got underway in accordance with FRNSW Standard Operating Guidelines (SOG) and, at about 1800, crews were rotated.

Sometime that evening, firefighters tasked with conducting an internal assessment, accessed the port tunnel via the bow access hatch. They made their way aft down the port tunnel and reported an active fire at the aft end of the tunnel as well as the sound of falling metal objects.

At 2106 that night, firefighters attempted to gain access to the SUL system spaces through the C‑Loop casing door but reported that access was too dangerous for firefighting operations. Infrared imagery indicated that the fire was active in the C-Loop space and aft sections of the tunnels (Figure 8).

Figure 8: Infrared imagery on 18 June

Source: Port Authority of New South Wales (left) and FRNSW (right)

19 June 2018

At 0029 on 19 June 2019, firefighters using SCBA sets entered the tunnel spaces through the access hatch on the ship’s bow. The crews proceeded aft down the starboard tunnel and noted minimal indications of fire on the starboard side. At about midships, the crews crossed over from the starboard tunnel to the port tunnel through a communicating passageway.

Once on the port side, the crews saw a fire burning at the aft end of the port tunnel. A fire hose was lowered through an access hatch midships between holds number 2 and 3. The crews advanced as far as the hose would allow before they had to withdraw due to their air cylinders running low. The hose was lashed to the ship’s structure and left in place. On deck, firefighting crews connected foam monitors to the hose lines and commenced introducing low-expansion foam into the tunnels. This had the effect of forcing smoke and hot gases aft and out through the C-Loop. The effectiveness of this strategy was then monitored on an hourly basis.

At about 0200, IMT and crew changeovers took place. At 0243, the discharge boom conveyor belt fire on deck was fully extinguished.

By 0428, firefighters reported that access aft in the tunnels was restricted from about 50 m from the C-Loop due to water, foam, and submerged obstructions. The firefighting strategy was modified to using hoses in a vertical attack from the deck through hatches adjacent to the superstructure.

At 0516, firefighters in SCBA sets entered the ship’s accommodation to retrieve crew personal effects and documents. The ship’s living quarters were identified to have high carbon monoxide (CO) levels.

At 1058, the master and chief engineer boarded the ship to retrieve the HFO tank sounding logs and other records. Shortly after, ship’s staff and members of the IMT began considering the risk of the HFO tank bulkheads being breached. While the master and chief engineer worked to assess if there was a leak from the HFO tanks, FRNSW ceased all water application to the C-Loop space.

At 1230, a multi-agency briefing took place. Options were discussed for obtaining temperatures of the HFO tanks. It was considered too dangerous for readings to be taken physically on board the ship. Instead, FRNSW hazardous materials (HAZMAT) crews were assigned to monitor the lower explosive limit (LEL) gas readings^[15] from the HFO tanks vents. HAZMAT crews were also assigned to the tug to take temperature readings of the port side HFO tank while an aerial firefighting appliance was assigned to monitor the temperature of the starboard tank. Meanwhile, the strategy of application of low-expansion foam continued while FRNSW awaited receipt of high‑expansion foam supplies.

At 1350, HAZMAT crews found LEL readings at the HFO tank vents were negligible.

At 1446, the temperature in the port and starboard HFO tanks had reached 45 °C and 50 °C, respectively.

At 1524, on the master’s advice, FRNSW crews began to attempt to activate the C-Loop spray system. However, because the system was not part of the fire main, the ship’s international shore connection^[16] could not be used to connect to the spray system line. A suitable connection was then fabricated by BlueScope Steel and, by 1552, water application through the C-Loop spray system was activated.

By 1600, temperatures in the post and starboard tanks had increased to 60 °C and 50 °C, respectively.

At 1721, FRNSW assessed that the internal conveyor belt had probably collapsed resulting in a deep-seated rubber fire. All tunnel ventilation was shut to seal the space and to reduce the chimney effect caused by smoke and hot gases being drawn up to the top of the C-Loop space. Foam was being applied through the C-Loop stores hatch and the C-Loop casing door, with boundary cooling being conducted using other FRNSW assets and tugs (Figure 9). LEL levels and temperature readings continued to be monitored at 30-minute intervals. By this time, some high-expansion foam supplies had arrived from the Australian Capital Territory while further deliveries were awaited from Queensland and elsewhere in New South Wales.

Figure 9: Foam application to C-Loop space

Foam being introduced through the C-Loop stores hatch aft of cargo hold number 5. In background, note hose leading to foam applicator in the C‑Loop casing door.

Source: Fire and Rescue New South Wales, annotated by the ATSB

By 2115, HFO tanks temperatures had increased to 55 °C at the starboard tank and 88 °C at the port tank. An assessment of the ship’s stability showed that the ship was stable with a draught of about 9.9 m. It was also assessed that a maximum draught of 11 m was allowable before there was a risk of the ship grounding. Firefighting operations remained in defensive mode and CSL Australia representatives were assigned the task of collating engineering details and assessing the consequences of continued water application.

20 June 2018

At 0343 on 20 June 2018, the FRNSW IC and CSL Australia determined that, based on the ship’s stability and volume of water applied, the rubber conveyor belts were likely to be under water. Water application through the C-Loop spray system was therefore shut off.

Shortly after, the tug assisting with boundary cooling on the ship’s port side was called away to other duties. At 0427, the FRNSW IC requested that a tug be stationed permanently at the ship to assist with firefighting efforts. Subsequently, tug Barunga was permanently assigned to the ship.

At about 0800, a consultant from the Minton, Treharne, and Davies Group (MTD) with expertise in fire science arrived on site. ^[17] The consultant was engaged to provide liaison services between CSL Australia and other authorities including FRNSW, as well as to provide fire science analysis and advice to expedite the extinguishment of the fire.

At 1132, the local emergency plan was activated. An Emergency Operations Centre (EOC) was set up at a port authority building located a short distance from the wharf. The IC (and incident control) transferred from the FRNSW MCC on the wharf to the EOC at the port authority building.

In addition, local and regional emergency operations controllers started to assist with the management of the response.

Separately, the Port Kembla harbour master, acting on behalf of the port authority, engaged a marine salvage firm, Ardent Oceania, to provide salvage and fire advice. Representatives from the salvors arrived late that afternoon.

Shortly after midday, a FRNSW remotely piloted aircraft system (RPAS) was deployed to assist firefighting efforts by providing aerial daylight and thermal imagery  (Figure 10).

Figure 10: RPAS footage of Iron Chieftain on fire on 20 June

Source: Fire and Rescue New South Wales

At 1309, fire crews accessed the ship’s engine room to determine if there were any signs of fire and found that temperatures within the space were normal. At about 1345, the ship’s chief engineer went aboard to inspect the engine room and machinery to check temperatures and HFO quantities and, to assess the feasibility of restoring power to the ship.

At 1453, a specialist tank-gauging device was obtained from a nearby fuel storage facility to assist with measuring the temperatures and quantities of HFO in the tanks. Shortly after, preparations were made to resume application of water through the C-Loop spray system and hydrants. At about 1535, the deck discharge boom was freed from the shore hopper, on which it had come to rest as the ship’s draught increased. The discharge boom was then stabilised and locked in position.

At 1600, HFO tanks temperatures were recorded as 63 °C at the starboard tank and 105 °C at the port tank.

At 1916, a decision was made to implement a change in firefighting strategy with high-expansion foam to be introduced directly into the C-Loop space using four lines. It was estimated that 1600 cubic metres (m³) of foam would be required to fill the space. By this time, sufficient foam stocks had arrived to begin to implement this strategy with further stocks expected later that evening to allow for topping-up of the foam.

At 2149, the initial estimate of foam required to fill the C-Loop space was revised to 2500 m³. By this time, the C-Loop spray system had been stopped because the spray nozzles were found to be completely ineffective.

Fire extinguished

During the night of 20 June 2018 and the morning of 21 June 2018, the C-Loop was filled with foam and tugs continued boundary cooling. The foam was regularly topped up and temperatures continued to be monitored. On 21 June, at 1233, soundings of the HFO tanks indicated a discrepancy in tank levels. By 1352, the port HFO tank was confirmed to be leaking oil, probably into the C-Loop space as inspections of the engine room had found no sign of HFO. By 1645, a leak was confirmed in the starboard HFO tank as well.

On 22 June 2018, at 0755, firefighting crews along with ship’s engineers completed an assessment of the cargo holds, engine room and superstructure. The low temperature readings and gas monitoring readings obtained indicated that extinguishment had been achieved (Figure 11). The inspections also revealed that HFO, firefighting water or a combination of both had leaked from the tunnels into cargo hold number 3. FRNSW continued to maintain the foam blanket in the C-Loop space while monitoring the situation and beginning preparations to hand over the site.

Figure 11: Iron Chieftain, with the fire extinguished

Source: ATSB

At 0600 on 23 June 2018, temperatures and LEL readings remained stable. At 1837 on 23 June, the hatch covers of cargo hold number 5 were opened with no obvious signs of fire observed although it was evident that HFO and/or firefighting water had leaked into this cargo hold as well. At 1552 on 24 June, FRNSW handed over the site to New South Wales Police and CSL Australia.

Over the 7-day duration of the incident, a total of 245 FRNSW appliances and 192 officers and specialist staff attended the fire. In addition,  marine firefighters from Victoria’s Metropolitan Fire and Emergency Services Board (MFB) attended the Iron Chieftain incident at FRNSW’s invitation to observe and assist the IMT as subject matter experts.

There was no reported pollution to the marine environment and, except for minor damage to the shore discharge hopper, no significant damage to port infrastructure. FRNSW reported minor injuries to several firefighters over the course of the incident.

Fire damage assessment

Iron Chieftain sustained substantial damage including breaches of the two HFO tanks as a result of the fire. The SUL system components and spaces bore the brunt of the fire damage. The boom was significantly damaged with parts of the conveyor belt and associated structures destroyed. In the C-Loop space, the drive motors, pulleys, idlers and associated belt equipment showed varying degrees of fire, heat and smoke damage. The inner and outer conveyor belts that comprised the C-Loop elevator were destroyed. There was also significant structural damage to support members resulting in the collapse of several conveyor rollers.

At the bottom of the C-Loop space, in addition to the fire damage, there was also HFO contamination and water. It was estimated that a total of about 507 m³ (approximately 456 t) of HFO was lost from the port and starboard HFO tanks into the C-Loop space and tunnels. The aft ends of the port and starboard tunnels sustained fire damage to conveyor belts and associated structures and fittings.

As a result of the substantial damage sustained due to the fire, Iron Chieftain was declared a constructive total loss (CTL). The ship remained at Port Kembla for several months while work continued to remove and dispose of the remaining fuel and contaminated firefighting water on board. On 27 March 2019, the ship departed Port Kembla under tow, for Aliaga, Turkey to be recycled (Figure 12).

Figure 12: Iron Chieftain, departing Australia under tow

Source: ALP Maritime

__________

1. A constructive total loss (CTL), in the case of damage to a ship, occurs when the cost of repairing the damage under its insurance terms would exceed the value of the ship when repaired.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. Dolomite is a light yellow or brown coloured mineral stone used as a sintering agent and flux in metal processing. As a bulk cargo, dolomite is considered non-combustible, with a low fire risk.
4. A non-driven roller supporting the belt and the load carried on the belt.
5. Integrated ratings are qualified to perform the duties of both an able seaman and an engine rating.
6. The ship was equipped, surveyed, and certified to operate with the machinery spaces periodically unattended.
7. A pyrometer is a device used to remotely measure the temperature of an object or surface.
8. The Beaufort scale of wind force, developed in 1805 by Admiral Sir Francis Beaufort, enables sailors to estimate wind speeds through visual observations of sea states.
9. Continuous ringing of the ship’s bells.
10. The general emergency alarm signal is at least seven short blasts followed by one long blast on the ship’s whistle and repeated on the ship’s alarm bell system.
11. Fire appliance: A fire appliance means any vehicle that forms part of the equipment of a fire brigade and that is equipped with an audible warning device and flashing lights. This includes tankers, pumpers, aerial firefighting appliances and other specialised appliances.
12. The cargo hold washing pump supplied the C-Loop spray system, tunnel spray system and deck washing line.
13. Alarm Response Protocols (ARP) are a standardised response level for incidents within specific areas of NSW. Under FRNSW Standard Operating Guidelines, a 5th alarm level denoted a significant structural fire. At a 5th alarm level, 10 firefighting appliances, three aerial appliances, hazardous material appliances, senior officers and an Incident Management Team, among other resources, are deployed.
14. The Mobile Command Centre (MCC) provides a platform for FRNSW Incident Management Teams (IMT) and interagency liaison officers to command, control and coordinate the response and recovery phases during major emergencies and events.
15. Lower explosive limit (LEL) is the concentration (by percentage) of a hydrocarbon gas or vapour in air below which there is insufficient hydrocarbon to support and propagate combustion.
16. An international shore connection consists of a standard flange that is fitted to the ship’s fire main. It allows land-based fire services hose to supply the ship’s fire main. The ship’s part of the international shore connection also has a flange. Once the flanges have been bolted together, fire service pumps can supply water to the ship’s fire main.
17. The Minton, Treharne and Davies Group (MTD) are a consultancy with expertise in matters relating to science and engineering in the marine industry.

Context

Iron Chieftain

Iron Chieftain was a gravity fed, C-Loop, self-unloading bulk carrier built in 1993 by Hyundai Heavy Industries in Ulsan, Republic of Korea. At the time of the fire, the ship was Australian registered and classed with Lloyd’s Register.

The ship was purpose-built for Broken Hill Proprietary (BHP) ^[18] who owned and operated it from 1993 to 2003 carrying coal from Port Kembla, New South Wales (NSW) to Whyalla, South Australia (SA) and iron ore back to Port Kembla. In December 2003, Iron Chieftain was purchased from BHP by Canada Steamship Lines Australia (CSL Australia). The ship was operated by CSL Australia and employed on the Australian coast carrying cargoes including coal, iron ore and dolomite.

The ship was equipped with the necessary navigational, firefighting and lifesaving equipment required by SOLAS^[19] for a ship of its size (see the section titled The self-unloading system). This included a Japan Radio Corporation JCY 1850 voyage data recorder (VDR)^[20] from which information useful to the investigation was recovered, including bridge voice recordings.

Ship’s crew

Iron Chieftain was manned by crews operating on an 8-week roster with most of the crew assigned to the ship for several years.

At the time of the fire, Iron Chieftain had a multi-national crew of 20 Ukrainian, Australian, New Zealand, and Philippines nationals.

The master had about 14 years of seagoing experience, held a Ukrainian master’s certificate of competency and the equivalent Australian certificate of recognition. The master had about 10 years’ experience on SUL ships most of which was with the CSL Group. He first joined Iron Chieftain about 7 years previously (as third mate) and had worked almost exclusively on board the ship since. He had about 8 months experience as master and this was his third trip in command of Iron Chieftain. He had joined the ship about 2 weeks before the fire.

The chief mate had about 22 years of seagoing experience, held a Ukrainian master’s certificate of competency and the equivalent Australian certificate of recognition. The chief mate had about 16 years’ experience on SUL ships of which the last 8 years were with the CSL Group. He had about 11.5 years’ experience as chief mate and had worked on Iron Chieftain for the previous 2.5 years. He had joined the ship about a month before the fire.

The second mate had about 18 years of seagoing experience, held a Ukrainian chief mate’s certificate of competency and the equivalent Australian certificate of recognition. The second mate had about 12 years’ experience on SUL ships most of which was with the CSL Group. He had about 10 years’ experience as second mate. This was his first trip on board Iron Chieftain, which he had joined about 2 weeks before the fire.

The third mate had about 15 years of seagoing experience and held an Australian deck watchkeeper certificate of competency. The third mate had about 8 years’ experience on various ships in the CSL fleet including on SUL ships. He had about 5 years as third mate and had worked on Iron Chieftain for about 8 months. He had joined the ship about 2 weeks before the fire.

The chief engineer had about 15 years of seagoing experience, held a Ukrainian chief engineer’s certificate of competency and the equivalent Australian certificate of recognition. The chief engineer had about 10 years’ experience on SUL ships with the CSL Group. He had worked on Iron Chieftain for the previous 5 years and this was his third trip as chief engineer. He had joined the ship about 3 weeks before the fire.

The second engineer had about 12 years of seagoing experience, held a Philippines engineering watchkeeper certificate of competency and the equivalent Australian certificate of recognition. The second engineer had about 7 years’ experience in the rank with all of it on board Iron Chieftain. He had joined the ship about 3 weeks before the fire.

The deck mechanic had about 12 years of seagoing experience, held a Ukrainian rating’s qualifications and the equivalent Australian certification of recognition. The deck mechanic had about 8 years’ experience on SUL ships with the CSL Group, all of it on board Iron Chieftain. He had joined the ship about 2 weeks before the fire.

The 0000–0400 IR had about 20 years of seagoing experience and held an Australian integrated rating’s qualifications. The IR had worked on Iron Chieftain for about 7 years and had joined the ship about 3 weeks before the fire.

The rest of the ship’s ratings held appropriate qualifications for their roles, and they had all served on board Iron Chieftain previously.

Cargo

The ship’s cargo for the voyage from Ardrossan, SA to Port Kembla, NSW was granular dolomite in bulk. The ship was carrying three separate parcels of different grades of dolomite in its five cargo holds.^[21]

The ship’s previous cargo was coal, shipped from Gladstone, Queensland (QLD) to Whyalla, SA. Prior to loading the dolomite in Ardrossan, the ship’s cargo holds, and tunnels were cleaned and then washed. Some of the residues from the previous coal cargo were disposed of ashore while some was swept into piles and consolidated near the aft end of the tunnels and near the athwartships transfer belts. The total quantity of remaining coal residues was estimated by ship’s staff to have been between 3 and 4 cubic metres (m³).

Dolomite

Dolomite is a very hard and compact, light yellow or brown coloured mineral stone composed of calcium magnesium carbonate. The International Maritime Solid Bulk Cargoes Code (IMSBC Code)^[22] classified dolomite as a Group C cargo. Group C consisted of cargoes which are neither liable to liquefy (Group A) nor possess chemical hazards (Group B).

The IMSBC Code entry for dolomite states that the cargo is ‘non-combustible’ and has a low fire risk with no special hazards.

The self-unloading system

General description

Self-unloading bulk carriers were an innovation that originated in the Great Lakes of Canada and the United States. The concept allowed these ships to operate at ports with limited or no traditional bulk-handling facilities and infrastructure.

Iron Chieftain’s self-unloading (SUL) system was based on a design by Stephens-Adamson Canada. The system was designed to achieve a maximum discharge rate of 3,000 tonnes (t) per hour for a cargo of coal or iron ore. At the time of the fire, cargo was being discharged to trucks ashore at a slower rate of about 500–700 t per hour.

The SUL system consisted of the cargo holds and gates, the mainly rubber conveyor belt systems (see the section titled Conveyor belt specifications and condition), and the discharge boom on deck. The conveyor belt systems in turn comprised the tunnel conveyors (port and starboard), the transfer conveyors (port and starboard), the vertical C-Loop elevator and the boom conveyor on deck. The SUL system also consisted of several pulleys and hundreds of idlers of various types.

Holds

Iron Chieftain’s five cargo holds were each designed with tapered hoppers at the bottom that led to hydraulically operated gates. These gates directed cargo on to one of the two tunnel conveyor belts below. There were 66 gates in total (33 on each side)^[23] and each gate was fitted with a hydraulically operated vibrator to facilitate the free flow of cargo.

The hopper slopes, hold inclines, and hogbacks^[24] were lined with ultra‑high molecular weight (UHMW) polyethylene sheeting to reduce friction and assist with the gravity feed of the cargo. The rate of cargo flow through the gates to the hold conveyor belts below was controlled by adjusting the gate openings. The gates provided for cargo flow control but did not form a watertight or airtight seal when closed.

Each of the five cargo holds had a standard, weathertight hatch cover on the main deck. The hatch cover consisted of two panels on a hatch coaming that rolled in an athwartships direction to open and close the hatch.

Tunnel conveyors

There were two hold conveyors (tunnel conveyors), port and starboard, that ran longitudinally under the cargo holds. The tunnels themselves were about 2 m in height with a common area at the forward end near the bow and at the aft end near the C-Loop elevator. Additionally, there was a communicating passage between the two tunnels amidships. The tunnels could be accessed from the C-Loop space aft, through an access hatch at the bow and through access hatches on deck.

Each tunnel conveyor belt was about 2.1 m wide, 20 mm thick and about 278 m long (in total). The tunnel conveyor belts were arranged in a ‘trough’ profile supported by idler rollers with the drive pulley^[25] at the aft end driven by electric motors. The tunnel conveyor belts were hydraulically tensioned at their forward end. The tunnel conveyors transported cargo from the hold gates and deposited them on the transfer conveyor belts at the base of the C-Loop elevator (Step 1 in Figure 13).

Transfer conveyors

There were two transfer conveyor belts, port and starboard, one each at the aft end of each tunnel conveyor belt. The transfer belts were oriented in the athwartships direction, perpendicular to the tunnel belts. Each transfer conveyor belt was about 2.1 m wide, 26 mm thick and about 19 m long (in total). The transfer conveyors were driven by electric motors and were mechanically tensioned. The transfer conveyors moved the cargo from the tunnel conveyors to a discharge hopper above the horizontal section of the C-Loop outer belt at the bottom of the C-Loop space (Step 2 in Figure 13).

C-Loop system

The C-Loop vertical elevator system was situated on the ship’s centreline, aft of the transfer belts, with the aft bulkhead of the space contiguous with the engine room’s forward bulkhead. The vertical space housing the C-Loop system emerged from the upper deck just forward of the accommodation to form a C-Loop ‘casing’ or ‘tower’. At the bottom of the C-Loop space, forward of the transfer belts and between the port and starboard tunnels, there was a space containing a small workshop and storage area. There were also two small spillage clean-up conveyors on either side at the base of the C-Loop belts.

The C-Loop conveyor belts consisted of an outer electric motor-driven conveyor belt loop onto which the cargo was loaded from the transfer belts (Step 3 in Figure 13). The outer belt was paired with a passive (non-motor driven) inner belt which rotated in the opposite direction to the outer belt so as to ‘sandwich’ the cargo and transport it vertically up the C-Loop elevator tower (Step 4 in Figure 13). The inner and outer belt loops separated at the top where the cargo was discharged into a chute and on to the discharge boom conveyor (Step 5 in Figure 13).

The outer belt was about 2.6 m wide, 23 mm thick and about 95 m long while the inner belt was about 2.7 m wide, 23 mm thick and about 69.5 m long. The C-Loop belts were hydraulically tensioned.

Discharge boom conveyor

The discharge boom conveyor on deck transported the cargo from the termination of the C-Loop elevator belts, just forward of the accommodation, to receiving facilities ashore or on another vessel (Step 6 in Figure 13). The boom conveyor belt was enclosed within corrugated metal roofing with timber anti-spill liners. The boom was 72 m long giving it a working radius of about 56 m from the ship’s side. The boom could be hydraulically slewed up to 90° to either side and luffed up to an angle of 18° from the horizontal. The discharge boom conveyor was driven by electrical motors.

The boom conveyor belt was about 1.9 m wide, 22 mm thick and about 165.8 m long.

Figure 13: General operation of Iron Chieftain's SUL system

Source: CSL Group, modified and annotated by the ATSB

Control, monitoring and safety systems

SUL operations console

The SUL system was controlled and operated by the ship’s officers from a control console located in the ship’s bridge. The control system incorporated a programmable logic controller (PLC) and a computer to provide a display and a control interface for the operation of the system. There was no recoverable data available from the computer system or the PLC. There were no reported alarms or automatic shutdowns of the SUL system prior to the fire.

CCTV

The SUL system included closed-circuit television (CCTV), with the images displayed at the control console on the bridge. The CCTV system comprised 12 cameras with five fixed cameras distributed through each of the port and starboard tunnels. The cameras in the tunnels faced forward and monitored the aftermost gates for each hold. In addition, there were two portable cameras, one used to monitor the cargo hold being discharged and the other positioned at the discharge end of the boom conveyor on deck. There were no cameras in the C-Loop space. The second mate reported that there were no signs of fire on the CCTV in the time leading up to the fire. There was no recorded CCTV data available.

Gas monitoring system

The hold conveyor tunnels had a gas monitoring system with sensors located at the aft and forward end of the tunnels. The system’s sensors could monitor oxygen, methane, carbon monoxide and hydrogen sulphide gas levels as well as the concentration of any flammable gases in the tunnel atmosphere (as a percentage of the lower explosive limit described previously). The control and monitoring equipment for this system was in the chief engineer’s office on the upper deck, which was unmanned at the time of the fire. The system was not connected to the ship’s bridge or fire detection and alarm systems and there was no recoverable data available.

Emergency stops

The SUL system had thirteen emergency stops distributed throughout the tunnel spaces, C-Loop space, and boom conveyor. Activating an emergency stop closed all the hold gates, turned off the gate vibrators and stopped all conveyor belts.

The system had an in-built control that ensured that any stoppage of the conveyor belts occurred in a sequential order. The tunnel conveyor belts stopped first followed by the transfer conveyors, the C-Loop belts and finally the boom conveyor. This ensured that any load on the belt was run off before the system comes to a standstill.

Conveyor belt safety systems

The conveyor belts had additional protection systems installed. These included electrical protection devices offering overcurrent and thermal protection for the belt drive motors as well as belt slippage^[26] and belt drift^[27] detection systems.

The C-Loop belts did not have belt drift detection sensors installed and misalignment of these belts was prevented by keeping the ship’s list to a minimum during cargo operations. Red and green lights on the ship’s foremast and on the external SUL casing indicated the ship’s list. There were also red, amber, and green lights at regular intervals in the tunnels to indicate load on the tunnel conveyor belts.

There was no evidence to indicate the ship had a list during cargo operations that may have caused a belt misalignment and no indications of a parted conveyor belt in the SUL system. There were also no apparent issues with the various electrical systems and components serving the SUL system.

Rules and regulations

There were no SOLAS regulations or requirements covering the SUL system equipment or conveyor belt standards. Similarly, there are also no classification society rules governing the flammability of conveyor belt systems or the fitting of fire detection or fixed fire extinguishing systems in the SUL system spaces.

Conveyor belt specifications and condition

Rubber conveyor belts are usually composed of two key elements—a central ‘carcass’ which provides the tensile strength and mechanical characteristics of the belt and, top and bottom rubber covers which protect the carcass. The carcass could be of textile (fabric) or steel cord construction.

Iron Chieftain’s conveyor belts were of a multi-ply, polyester/nylon fabric construction with rubber covers. The belt carcasses were made up of layers (or plies) of polyester and nylon adhered to each other. The tunnel belts, transfer belts and boom belt were of 5-ply construction while the C‑Loop belts were of 6-ply construction.

Table 1 summarises key information related to the lifespan, grade, and specifications of the various conveyor belt rubber in use on board Iron Chieftain, based on an assessment conducted in April 2018.

Table 1: Iron Chieftain - Conveyor belt details

Conveyor belt	Installation date	Grade of belt rubber	Remaining lifespan
Tunnel conveyor (P)	1993 (Original)	RMA 2	1 year
Tunnel conveyor (S)	1993 (Original)	RMA 2	1 year
Transfer conveyor (P)	2014	AS1332-M	2 years
Transfer conveyor (S)	2014	AS1332-M	1 year
Outer C-Loop belt	2014	AS1332-M	1 year
Inner C-Loop belt	2014	AS1332-M	2 years
Boom conveyor	2014	AS1332-M	6 to 12 months

Source: CSL Australia

Grade of conveyor belt rubber

The original design specification for the SUL system required the conveyor belt rubber covers to be of Rubber Manufacturer’s Association (RMA) Grade 2 rubber^[28] (or an equivalent German Institute for Standardization Grade N rubber).^[29] The current international standard equivalent to RMA Grade 2 rubber is Association for Rubber Products Manufacturers (ARPM) Grade 2 rubber.^[30]

The port and starboard tunnel conveyor belts were still the original belts installed by the shipbuilders, Hyundai. They had been in use since 1993 and were of RMA Grade 2 rubber (ARPM Grade 2). The C-Loop inner and outer belts, the transfer conveyor belts, and the boom conveyor belts were replaced in January 2014 with belts of AS 1332 Grade M rubber,^[31] manufactured by Goodyear.

Properties of the conveyor belt rubber

The RMA Grade 2 (ARPM Grade 2) rubber conveyor belt covers, originally installed on board Iron Chieftain and still in use in the tunnels, was classified as a general-purpose rubber cover.^[32] ARPM Grade 2 rubber was described as having ‘good to excellent abrasion resistance properties’ but the description did not include any reference to flame or heat resistance.^[33]

Similarly, the AS1332 Grade M rubber covers comprising the other conveyor belts on board were also considered to be general-purpose rubber. The relevant Australian standard (AS1332-2000) did not include any requirements for flame or heat resistance properties for AS1332 Grade M rubber.^[34]

The AS1332-2000 standard referred to two other standards^[35] which described the methods of testing conveyor and elevator belting for ignitability, flame propagation characteristics and maximum surface temperature of belting subjected to friction. Variations of the mandated tests were performed to determine if the AS 1332 Grade M rubber exhibited any flame or heat resistance properties generally tested for in belts (such as self‑extinguishing properties or minimal ‘afterglow’ requirements).

The tests were conducted at the ATSB’s laboratories in Canberra and used a sample of spare conveyor belt retrieved from Iron Chieftain. The tests showed that the belt was capable of catching fire through the application of flame as well as through the application of heat. Once alight, the flame was self-sustaining, even after the original source of ignition had been removed, and the fire continued burning until the entire test sample had been consumed.

The tests confirmed that the AS1332 Grade M rubber used in Iron Chieftain’s C-Loop, transfer belts and boom conveyor did not exhibit any flame or heat resistance properties.

Condition of conveyor belts

An inspection of the ship’s conveyor belts carried out in December 2015 assessed the condition of the C-Loop belts, boom belt and transfer belts as ‘good’, the port tunnel belt as ‘fair’ and the starboard tunnel belt as ‘poor’.

At the time of the fire, the tunnel and boom conveyor belts were generally described as being in a ‘worn’ condition. The C-Loop belts were described as being in a ‘poor’ condition with metal fasteners, which was a common method used to repair existing splices that had started delaminating until permanent repairs were carried out. Repairs were performed on the C-Loop inner belt in December 2015 and on the C-Loop outer belt in December 2017. These repairs involved the splicing of new sections of belt into the existing belt using metal clamps, to repair damaged sections where the belt had started to delaminate. In addition, there were several other minor repairs carried out by the ship’s crew as part of routine maintenance.

Delamination or damage, particularly to the edges of the conveyor belts, can aid ignition and fire spread due to the greater surface area presented and the thinner nature of the rubber material.

Fire detection, containment, and extinguishment

SOLAS regulations, specifically Chapter II-2, sets out the fire protection, fire detection and fire extinction regulations for ships. In Australia, the Australian Maritime Safety Authority’s (AMSA) Marine Order 15 gives effect to Chapter II-2.^[36]

As a regulated Australian vessel, Iron Chieftain was required to comply with the relevant SOLAS fire safety regulations.

At the time of the fire, Iron Chieftain held Cargo Ship Safety Construction and Cargo Ship Safety Equipment Certificates issued by the ship’s classification society, Lloyd’s Register. The certificates and associated surveys showed that the ship complied with the relevant requirements of Chapter II-2 of SOLAS including those requirements regarding fire safety systems, appliances, and plans.

Fire detection system

Iron Chieftain was equipped with a Thorn Minerva T880 32-zone fire detection system. The ship was divided into 17 fire-detection zones utilising 139 individual smoke, flame or temperature detectors spread across the ship’s accommodation, machinery, and other spaces.

There were no fire detectors installed in any of the SUL system spaces.

The activation of a detector head would set off an audible alarm on the ship’s bridge with a visual indication of the relevant zone and detector. The alarm could then be silenced while the detector activation was investigated and dealt with. If investigation found that there was no cause for concern, then the system was reset at the bridge fire panel. In the event the bridge audible alarm was not silenced within a set period, the ship’s fire alarm signal consisting of the continuous ringing of the ship’s bells would automatically activate.

Unresolved anomaly

A report from an authorised technician’s inspection of the ship’s fire detection system from May 2016 noted an anomaly arising from an internal issue with the fire alarm panel. The anomaly meant that when the system was reset from a detector activation, zone 1 detectors would indicate as active and the ship’s fire alarm would be activated. The report also noted that the anomaly only occurred at the system reset stage and did not hinder the correct activation of detectors. The report concluded with a recommendation that the fire alarm panel be replaced in the near future. The anomaly was not reported to the Australian Maritime Safety Authority (the ship’s flag State administration) as the system was still considered operational.

In November 2017, the fire detection and alarm system was serviced and tested by an authorised technician. The system, including the general alarm system, was noted to have been operating correctly and there was no reference to the anomaly.

At the time of the fire, the fire detection system anomaly remained unresolved. Accounts from several of the ship’s crewmembers mentioned the anomaly and the resulting instances of spurious activation of the ship’s fire alarm. They reported that, when the ship’s fire alarm activated, crew generally waited for a PA announcement or the sounding of the general emergency alarm before responding.

Fire containment

The design and layout of Iron Chieftain’s SUL system meant that the 140 m long port and starboard tunnels, along with the vertical C-Loop casing and communicating spaces, formed one large compartment. There were no internal divisions or doors fitted that could be used to further compartmentalise the space. There was also no means of sealing the upper termination of the C‑Loop, where the inner and outer belts separated to deposit cargo onto the boom conveyor.

In addition, the cargo hold gates were not airtight making it almost impossible to completely seal off the SUL system space.

Fire extinguishment

Iron Chieftain’s fire plan showed the following firefighting appliances covering the ship’s C-Loop and tunnel spaces:

• Twenty-four fire hydrants with manual valves
• sixteen fire hose reels with nozzles and 38 mm fire hoses (15 m in length).

In addition, there were 22 fire hydrants and 11 fire hose boxes (with nozzles and hoses) capable of covering the boom conveyor on the ship’s upper deck.

The fire hydrants were served by the ship’s fire main line (fire main), and water could be supplied by three pumps—a main fire pump, a general service pump and an emergency fire pump. The emergency fire pump was connected to the emergency switchboard and emergency generator. The pumps could be started from the bridge, engine control room, fire control station and locally at each pump. The fire main had two isolation valves located on the upper deck—one isolated the deck from the engine room and the other isolated the deck from the tunnel fire main.

There were five portable dry powder extinguishers located at the bottom of the C-Loop space, although they were not required by the fire plan.

Fixed fire-extinguishing system

There was no fixed fire-extinguishing system fitted to protect the C-Loop or tunnel spaces on board Iron Chieftain.

SOLAS required a fixed gas fire-extinguishing system^[37] be fitted to protect cargo spaces^[38] of ships above a certain size. However, the regulations also allowed ships to be exempt^[39] from this requirement if they were constructed and intended solely for the carriage of cargoes that were considered to constitute a low fire risk.^[40]Iron Chieftain held an exemption certificate on the basis that the ship only carried the cargoes listed in the certificate. Iron Chieftain’s list of permitted cargoes included coal, ore and cargoes listed in groups A and C of the IMSBC Code (such as dolomite).

Iron Chieftain’s engine room and machinery spaces were protected by a gas (carbon dioxide) fixed fire-extinguishing system.

Dust suppression and cleaning systems

The C-Loop conveyor belts and tunnels were fitted with a dust-suppression and cleaning spray system. These systems were neither designed nor intended for firefighting purposes although the ship’s crew treated them as such.

The C-Loop spray system consisted of 39 spray nozzles (20 on the port side and 19 on the starboard side) directed at the belts but not at the bearings supporting either ends of the idler rollers (Figure 14). The C-Loop spray system was not part of the fire main. The system was supplied by a hold washing pump located in the engine room, which usually drew fresh water from a dedicated hold washing tank although it could be set up to draw seawater. The piping to the C‑Loop spray system was routed to the upper deck where there was an isolation valve to port of the C-Loop casing, just forward of the accommodation. This isolation valve had to be manually opened to allow water flow to the C-Loop spray system.

Figure 14: C-Loop spray system nozzle

A C-Loop dust suppression spray system nozzle directed at where the conveyor belt would normally be. Note the exposed idler rollers of the C-Loop elevator belt system.

Source: MTD

The tunnel spray system consisted of eight nozzles (four in each tunnel). The system was supplied by the same hold washing pump that supplied the C-Loop spray system although the manual isolation valve for the tunnel system was in the engine room. In addition, each of the eight spray nozzles had their own individual, manually operated valves that were normally kept shut. At the time of the fire, these valves were shut, and they remained so throughout the incident.

The hold washing pump and its associated suction and discharge valves could be controlled from the bridge. The control panel had instructions attached to it which emphasised the need to ensure that at least one spray valve was open before the pump was started. This was because the system had no pressure relief valve. Operating the pump with the valves closed would pressurise the system and make it harder to operate manual valves.

The C-Loop spray nozzles were reported to have been in very poor condition. Furthermore, when the spray system was set up for dust suppression (as it was at the time of the fire),^[41] the water spray pressure was usually too low to be effective for firefighting.

Fire safety on board SUL bulk carriers

The International Safety Management (ISM) Code^[42] has as its objective the prevention of human injury or loss of life and the avoidance of damage to the environment and to property. Among other things, it requires companies to provide for safe practices in ship operations, to assess all identified risks to ships, personnel and the environment and, to establish appropriate safeguards against these risks. The Code aims to achieve this by requiring companies to develop, implement and maintain a safety management system (SMS), with instructions and procedures to ensure the safe operation of ships, to prepare for and respond to emergencies and to conduct regular audits and reviews of the system. SOLAS Chapter IX requires relevant ships to comply with the ISM Code.

Iron Chieftain’s shipboard SMS consisted of general procedures and instructions broadly grouped under sections such as fleet operations, company operations and safety and environmental procedures. In addition, the SMS included a specific set of procedures and instructions for the operation of SUL bulk carriers including a section on general safety.

The SMS section on general safety for SUL bulk carriers contained information on safe work practices as well as sub-sections on how to prevent and deal with conveyor belt fires.

Prevention of conveyor belt fires

The procedures emphasised that there were no smoke or heat detectors in the C-Loop space or tunnels and that ‘frequent’ fire rounds by ship’s personnel were necessary, especially when the SUL system was in operation. Therefore, the documented instructions for the prevention of conveyor belt fires concentrated on guidance for personnel conducting fire rounds.

Some key pieces of advice for these fire patrols included the need to use all senses of sight, smell, and hearing during fire rounds and to check for:

• overheating bearings or rollers
• noise or squeaking sounds from bearings
• hydraulic oil leaks, oily rags, or smoke
• normal running of belts
• rubbing of belts against spilled cargo.

During cargo discharge operations on board Iron Chieftain, the deck mechanic spent most of his time inspecting the SUL system and monitoring its operation but only between the hours of 0800‑1700 (and with one additional inspection at night). The deck mechanic checked temperatures of machinery and other components of the SUL system but did not record these. The ship’s IRs conducted fire and safety rounds of the SUL system spaces every 2 hours, but they did not conduct temperature checks and relied largely upon their senses to detect any abnormalities in the system.

Procedures for dealing with belt fires

The general safety procedures for the SUL system provided advice on dealing with conveyor belt fires. It stated that rubber belt fires were highly toxic with acrid smoke and required the use of SCBA sets when fighting these fires. It also stated that the C-Loop casing and tower acted as a high riser encouraging the fire. The procedure also stated that the shore fire brigade should be contacted immediately for assistance.

Other key points in the advice for dealing with belt fires are summarised below:

• if the belt catches fire while running, do not stop the belt
• train fire hoses on the running belt at intervals to cool other parts of the belt
• hose down the seat of the fire
• start loop sprinkler system if fitted
• shut hold gates and gate pumps
• tunnel exhausts must be kept running initially but stopped when entry is made
• evacuate and seal exits if efforts prove insufficient or fire becomes unmanageable.

The procedures clarified that the water sprinkler (dust suppression spray) system was not automatic and that the water output might prove inadequate. Nevertheless, the guidance stated that this system should be started immediately in the event of a fire until fire hoses could be readied. It also advised that the arrangement should be tested regularly to ensure spray nozzles did not become clogged.

In addition to the guidance in the procedures, there was relevant information in an operations checklist that covered the use of the ship’s dust suppression, cleaning, and deluge systems. It advised that, in the event of an overheating belt caused by a bearing failure or by fire, one should:

• sound the alarm
• ensure all persons are accounted for (muster)
• open deluge valve located on accommodation front [C-Loop dust suppression spray system valve]
• start hold cleaning pump with seawater suction
• in event of belt fire, do not stop the belt
• reverse tunnel ventilation fan motor direction to suck out smoke
• if the cargo hold above the fire is empty, consider opening the hatch lid and gates to apply water with fire hoses.

By keeping the belt running, the entire length of the belt could be cooled by fire hoses at a single location. The movement of the belt also prevented any one section of belt from coming into prolonged contact with a hot spot such as seized idler or pulley.

Both the general SMS procedures for dealing with belt fires and the water deluge systems operations checklist instructed that, if the conveyor belt was on fire, it was not to be stopped. Most of the ship’s crew were also aware that in the event of a conveyor belt fire, the belt should not be stopped. Past instances of overheated frozen idlers and failed bearings had been dealt with by closing the cargo hold gates to stop cargo flow, keeping the belt running and cooling it with water until the failed components had cooled sufficiently for the system to be stopped and repaired.

Response on 18 June 2018

Upon detecting the fire, the IR reported a ‘smell’ and ‘smoke’ to the second mate. There was no definitive mention of ‘fire’. The IR also requested that cargo discharge be stopped. The second mate promptly shut down the system which stopped the conveyor belts in sequence with the boom conveyor belts being the last to stop.

With the belt stopped, the option of training fire hoses on the running belt at intervals to cool other parts of the belt was lost.

Another firefighting option recommended in the procedures was the opening of the hatch overs of cargo hold number 5 and directly attacking the seat of the fire (at the base of the C-Loop). Cargo hold number 5 was empty at the time of the fire, but this firefighting option was not attempted during the shipboard response.

At the time the fire was detected, the tunnel ventilation fan was operating and blowing air through the tunnels from the forward to aft. The direction of the tunnel ventilation fan was not reversed nor was it manually stopped. The fan eventually stopped with the loss of power as a result of the activation of the fuel quick closing valves (QCVs) in preparation for the release of CO₂ into the engine room.

SUL fire safety risk assessment

The IMSBC Code required on board operational fire safety risk assessments to be carried out by the ship's crew for cargo handling areas on SUL bulk carriers featuring internally installed conveyor systems.^[43]

The IMSBC Code stated:

Routine on board operational fire safety risk assessments shall be carried out by the ship’s crew for cargo handling areas on self-unloading bulk carriers featuring internally installed conveyor systems within the ship's structure. Due consideration shall be given to fire prevention and the effective operation of fire detection systems, containment and suppression under all anticipated operating conditions and cargoes. The fire safety risk assessments shall be detailed in the ship’s Safety Management System (SMS) together with a recommended timing to provide regular assessments.

The Code required these risk assessments be detailed in the ship’s SMS together with a recommended interval to provide for regular reviews of the assessments.^[44] The IMO resolution amending the Code to introduce the requirement for the risk assessment was adopted in June 2015 and first appeared in its 2016 edition. The inclusion of this requirement in the Code was a result of safety action following an investigation into a fire on board an SUL bulk carrier in the UK in 2010 (see the sub section titled Yeoman Bontrup in Fires involving SUL bulk carriers). Although the amendments to the Code were adopted in 2015, many SUL ship owners and operators had already implemented this requirement and conducted or started conducting these risk assessments. 

Iron Chieftain’s SMS section on general safety for SUL bulk carriers included a documented requirement for an annual on-board review of the ship-specific SUL fire safety risk assessment. This requirement was also reflected in the company’s schedule of drills, training, and reviews as a part of the master’s annual review of the SMS that was required by the ISM Code.

The SMS included general guidance and procedures to support the effective conduct of risk assessments on board. However, there were no specific instructions or guidance in the SMS for the conduct of the SUL fire safety risk assessments.

SUL fire safety risk on board Iron Chieftain

CSL Australia provided the ATSB with a collation of fire safety risk assessments of SUL system spaces for ships owned and operated by them, including one for Iron Chieftain. The risk assessments were dated 10 April 2013 and had not been annually reviewed or updated following the initial assessment.

Iron Chieftain’s SUL fire safety risk assessment (from 2013) evaluated the operational fire safety risk for the different locations/components that constituted the ship’s SUL system—the tunnel spaces, the transfer belts, the C‑Loop elevator and the boom (Appendix A). The assessment identified the cargo‑handling equipment in each location, associated hazards, and existing control measures before assessing the residual fire safety risk. The risk assessment document also included summaries of past SUL ship fires and their causes.

The hazards identified in the four different SUL system spaces were the same and consisted of hot bearings, hot idlers, and the potential for belt slippage.

Existing risk control measures were divided into fire detection and fire suppression measures. Fire detection measures common to all four locations included belt slippage detectors, temperature checks by the deck mechanic and fire rounds by ship’s IRs. The risk assessment also recorded the CCTV in the tunnel spaces as a fire detection control measure.

Fire suppression measures listed in the risk assessment were the ship’s fire main as well as the dust suppression and cleaning water spray systems.

The residual risk rating was obtained by multiplying the consequence rating (1—5) by the likelihood rating (1—5). Risk ratings lower than 4 were considered ‘generally acceptable’ while ratings 15 and higher were considered as ‘generally unacceptable’.

The residual fire safety risk for Iron Chieftain based on the existing control measures was assessed as follows (Table 2):

Table 2: Iron Chieftain SUL fire safety risk ratings

Location	Severity of consequence	Likelihood	Risk
Tunnels	Catastrophic (5)	Remote (2)	Higher than acceptable but not unacceptable (10)
Transfer belts	Catastrophic (5)	Remote (2)	Higher than acceptable but not unacceptable (10)
C-Loop elevator	Catastrophic (5)	Occasional (3)	Generally unacceptable (15)
Discharge boom	Moderate (3)	Remote (2)	Generally acceptable (6)

Source: CSL Australia

The results of the risk assessment showed that, for the C-Loop elevator in particular, the fire safety risk was ‘generally unacceptable’ in the absence of any further control measures.

The risk assessment included a section on ‘planned future control measures’ which, if implemented, would reduce the fire safety risk to an acceptable level. These planned future measures included heat detection systems for pulley and idler bearings, a low-pressure sprinkler system and a procedure for use in the event of a fire.

At the time of the fire, these long-planned control measures had not been implemented.

SUL fire safety risk on board other CSL Australia ships

The risk assessment documents from April 2013 showed that two other CSL Australia ships, CSL Pacific and CSL Whyalla, were assessed as having ‘generally unacceptable’ levels of fire risk in one or more of their SUL system spaces. Fire safety risk assessments for other CSL Australia SUL ships were updated in September 2018, after the Iron Chieftain fire. The updated risk assessment document from 2018 showed that the fire safety risk on one of these ships, CSL Whyalla, remained at a ‘generally unacceptable’ level.

Emergency preparedness and firefighting

Emergency contingency plans

Iron Chieftain’s SMS required that any contingencies that might arise during the operation of the ship be dealt with according to the ship’s contingency plans. These contingency plans were contained in a master document titled the Emergency Contingency Plan (ECP).

The SMS stated that instruction and training were to be carried out for various emergencies using the relevant contingency plans in the ECP. Following each exercise or drill, a review was to be conducted with the aim of identifying improvements to the contingency plan. The plans were also to be used as tools to familiarise crew with the different circumstances of an emergency and the actions required. The SMS stated that the principle was to use the plans as a framework so that in a genuine emergency or in a training exercise, the ship’s crew could act ‘confidently and without delay’.

Iron Chieftain’s ECP comprised a class-approved Shipboard Oil Pollution Emergency Plan (SOPEP)^[45] as well as 26 additional emergency contingency plans covering various potential emergency scenarios such as grounding, collision, and fires. There were emergency contingency plans specifically tailored to fires and explosions in the accommodation, engine room, on deck and during bunkering. However, there were no emergency contingency plans for fires in the SUL system spaces.

ECPs from seven other CSL Australia SUL or conveyor belt equipped vessels were examined and six were found not to have specific contingency plans for SUL system fires or conveyor belt fires.

Drills and exercises

Iron Chieftain’s SMS stated that the master was responsible for the effective training and exercising of contingency plans according to the company’s schedule of drills, training, and reviews. The schedule described in the SMS included mandatory drills required by the regulations as well as specialised drills required by the company.

Fire and abandon ship drills

Iron Chieftain’s SMS reflected SOLAS requirements for mandatory abandon ship and fire drills. SOLAS required that every crewmember participate in at least one abandon ship and one fire drill every month. If more than 25 per cent of the ship’s crew had not participated in an abandon ship or fire drill on board that ship in the last month (for example, after a crew change), then drills of the ship’s crew had to take place within 24 hours of the ship leaving port.

Emergency drills including an abandon ship drill and a fire drill were last held on board Iron Chieftain on 25 May 2018 (24 days before the fire). Following these drills, a crew change of five crewmembers took place on 27 May in Gladstone, QLD. A further crew change of nine crewmembers took place on 5 June at Whyalla, SA. This crew change included the second mate (on duty when the fire started) for his first assignment on the ship. The other regular crew who joined the ship had been off for about 8 weeks and therefore, had not participated in a drill on board the ship in the last month.

On Iron Chieftain’s departure from Whyalla on 7 June, 14 of the ship’s crew of 20, had not participated in an abandon ship or fire drill in the last month. Despite that, there were no drills conducted in the 24 hours after the ship left port nor were any conducted in the intervening time before the ship called at Port Kembla.

Fire drills involving the SUL system spaces

The company’s training schedule included a requirement for additional fire drills on SUL bulk carriers. These drills were focussed on fighting fires in the SUL system spaces and were additional to the SOLAS-mandated fire drills. The drill schedule specified drills involving the C‑Loop conveyor belts, the boom conveyor belt, the tunnel conveyor belts and cargo fires on the belts. These additional SUL system fire drills were to be held monthly on a rotating basis.

The ship’s record of training showed that no SUL system fire drills had been held in the five months preceding the fire.

The last SUL system fire drill held on board Iron Chieftain was a fire drill involving the boom conveyor, held on 17 Jan 2018. However, the participants in this drill, including the master, were predominantly crew from the opposite duty cycle to those who were on board Iron Chieftain at the time of the fire. There was a fire drill involving a fire in the SUL system tunnel spaces conducted by the master on duty at the time of the fire on 30 November 2017. However, the other participants in this drill were also predominantly crew from the opposite duty cycle. The last SUL system fire drill involving the master and most of the officers who were on board Iron Chieftain at the time of the fire was on 29 October 2017.

Analysis of the training records showed that, in the 12 months preceding the fire, only five SUL system fire drills were conducted. Of these five drills, three scenarios involved a fire on the discharge boom and two involved fires in the tunnel spaces. The last documented fire drill involving the C-Loop belts or C-Loop space was reported to have been in January 2016.

Familiarisation

All of Iron Chieftain’s crew at the time of the fire had served on board the ship before with the exception of the second mate and the deck cadet. A shipboard familiarisation checklist had been completed for the second mate. The checklists included reminders to ensure the new joiner was made aware of the ship’s emergency signals, muster stations, emergency duties and actions in the event smoke or fire was detected.

The checklists also specified role-specific tasks such as familiarisation with the procedures relevant to deck officers. This included a note advising officers to refer to operational checklists that might be relevant to them (such as the one related to the use of the ship’s water spray systems).

Alarm signals and mustering

SOLAS regulations required ships to post a muster list detailing, among other things, the ship’s alarm signals, actions in the event of the various alarms and emergency duties in the event of different emergencies.

On board Iron Chieftain, the muster list identified the fire alarm signal as the ‘continuous sounds of the alarm bell’. The muster list also stated that ’fire will be investigated by duty IR/ duty engineer and announced on the PA system’.

The ship’s SOLAS fire training manual^[46] also identified the fire alarm signal as the ‘continuous ringing of the ship’s alarm bells’. The training manual stated that it was the duty officer’s responsibility to have the cause of the alarm investigated. If a fire was confirmed or, if the duty officer believed the alarm to be of ‘a serious nature’, the manual required that the general emergency alarm be sounded and that ship’s personnel mustered. Alternatively, if the alarm was found to be false, an announcement to that effect was to be made on the ship’s PA system.

In addition to the muster list and training manual, a ‘Welcome letter’ was provided to visitors to the ship which also included information alarms and mustering. The letter described the fire alarm as the ‘continuous sounding of the alarms accompanied by four long blasts on the ship’s whistle’ and instructed visitors to proceed to the muster station immediately on hearing it.

Use of ship’s elevator

The ship’s SMS stated that, in the event of an emergency alarm being sounded the elevator was not to be used by anyone on board. Signs prohibiting the use of the elevator in emergency situations were posted in the elevator car. However, evidence indicates that the elevator was used by ship’s staff early in the response to the fire.

Muster and headcount

The muster list and other procedures related to emergency response and firefighting instructed that after mustering, all personnel were to be accounted for and that this was to be reported to the ship’s bridge.

Analysis of VDR audio recordings showed no evidence of a headcount being taken or reported to the bridge during the initial muster and response. The first verified report of a headcount was at about the time when shore firefighting services began to arrive, at about 0329, half-an-hour after the fire was first reported. The master ordered all crew to the muster station for a headcount in preparation for the activation of the engine room’s carbon dioxide (CO₂) fixed fire-extinguishing system.

Electrical power and firefighting

Electrical power for Iron Chieftain’s machinery and equipment including fire pumps, ballast pumps, ventilations fans, alarm systems and SUL system equipment depended on the ship’s generators. Iron Chieftain’s main power-generating capability when alongside were the main generators and an emergency generator.^[47]

Main generators

Iron Chieftain was equipped with three Hyundai 6L28/32H diesel engine-driven main generators each with a rated power output of 1,050 kW. The main generators, located in the ship’s engine room, powered the ship’s main fire pump, general service pump, fuel transfer pumps, cargo hold washing pump, SUL system conveyor belt drive motors, hydraulic power packs, cargo hold hatch cover operating equipment and ventilation fans. The emergency fire pump was supplied by the main generators but could also be powered by the emergency generator.

Activation of the engine room CO₂ system

The activation of a ship’s fixed fire-extinguishing system was a command decision that could only be ordered by the master. Following the arrival of FRNSW at the ship, the master, after consultation with FRNSW, decided to activate the engine room’s CO₂ fixed fire‑extinguishing system. The master’s reasoning behind the activation of the system was that if a fire was active in the engine room, the CO₂ system would extinguish it, and if not, the CO₂ system would ‘inert’ the engine room and prevent a fire from spreading to the space and causing further damage.

The activation of the emergency stops on the bridge and the fuel QCVs in the fire control station in preparation for the release of CO₂ had the effect of shutting down the main generators. This consequently also rendered almost all equipment and machinery on board inoperable except for those capable of being supplied by the emergency generator. The equipment rendered inoperable included the:

• main fire pump
• general service pump
• fuel transfer pumps
• hold washing pump and C-Loop spray system
• machinery to open and close the hatch covers
• hydraulic power packs and drive motors for the SUL system, including for the hold gates
• tunnel ventilation fan.

Emergency generator

SOLAS regulations required that cargo ships have an emergency source of electrical power capable of supplying electrical power, for a certain period, to services deemed essential for safety in an emergency.^[48] Where the emergency source of electrical power was an emergency generator, it had to be capable of starting automatically and supplying the required load to the emergency switchboard within 45 seconds of the failure of the main source of electrical power. The services required to be supplied included, among others, emergency lighting at key locations around the ship, the fire detection and alarm system and a fire pump. 

Iron Chieftain was equipped with a SsangYong NTA-495-GCM1 diesel engine-driven emergency generator with a rated power output of 120 kW. The emergency generator and switchboard were in a room on the upper deck separate from the ship’s engine room. Accounts from the chief engineer and other engineers indicated that when the generator was brought on-line, there was a minor fire in the emergency switchboard. However, this was quickly dealt with and did not interfere with the subsequent operation and supply of power from the emergency generator.

Following neutralisation of the main generators, the emergency generator remained as the sole source of shipboard power. It supplied emergency lighting and shipboard firefighting water through the emergency fire pump, until it was shut down and isolated by Fire and Rescue New South Wales (FRNSW). This was because FRNSW standard practice generally considered electricity a ‘critical factor’^[49] and it was usually isolated during firefighting operations. When the emergency generator was stopped and isolated, all shipboard power and the use of machinery and equipment it was powering was lost.

Maintenance, testing and inspection

Iron Chieftain’s SMS required that all firefighting and lifesaving equipment be inspected on a weekly basis using a checklist. Examination of the checklists for the months preceding the fire showed that these checks were marked as being completed regularly.

Records showed that the ship’s fire alarm, general emergency alarm and water spray systems had been regularly checked and marked as satisfactory with no issues logged. The last weekly checks completed were recorded for the week of 4 June to 10 June 2018, about a week before the fire.

Records also showed that the ship’s emergency generator, emergency fire pump and main fire pump had not been marked as checked in the last two weekly checklists. The last logged checks were recorded in the week of 21 May to 27 May 2018. Previous checklists indicated that this equipment had been checked and found to be operating satisfactorily.

Origin and cause of the fire

Fire investigations

The Iron Chieftain fire was the subject of an investigation by FRNSW Fire Investigation and Research Unit (FIRU). Additionally, the marine consulting group of Minton, Treharne, and Davies (MTD) were engaged by the CSL Group to investigate and report on the origin and cause of the fire.

FIRU and MTD investigators attended the ship both during and after the fire, conducted inspections of accessible spaces and spoke to involved personnel. The following is a summary of relevant observations from both investigations.

Cargo

Both the FIRU and MTD investigations considered it highly unlikely that the ship’s cargo of dolomite was associated with the cause or origin of the fire.

With regard to the residues of the ship’s previous coal cargo, the MTD investigation report noted that these residues may have provided additional fuel for the fire. The FIRU investigation observed that although it was possible that coal dust was the initial ignition source, the conveyor belt rubber would still have been the communicating fuel source that spread the fire.

Accommodation

The exterior of the ship, in particular the front of the accommodation and superstructure, showed significant smoke staining.

The interior of the ship’s accommodation was also smoke stained to various degrees. Inspections of the superstructure and accommodation showed that the spaces surrounding the C-Loop tower were the most affected by the fire.

There were areas of localised fire damage due to heat conduction, structural distortion and buckled decks in the spaces and cabins adjacent to (Figure 15) and directly above the C-Loop space. The severity of this damage increased as one progressed upwards in the accommodation. Apart from the few spaces surrounding and above the C-Loop casing, fire had not spread further into the accommodation.

The evidence suggested that the fire did not originate in any of the accommodation spaces or compartments surrounding the C-Loop casing.

Figure 15: Locker in the ship's accommodation adjacent to the C-Loop space

Source: ATSB

Main deck and cargo holds

Inspections of the main deck by the FIRU showed that the hatch covers for hold number 3 were open and that there was evidence of coal dust on deck.

The SUL system boom had been fire‑damaged with some of the conveyor belt and timber shuttering destroyed (Figure 16). Other components of the boom such as the idlers, pulleys, drive motors and gear boxes showed signs of heat, fire, or smoke damage. Both the FIRU investigation and the MTD investigation considered the fire on the boom to be consequential to the initial fire and a result of a transfer of heated material from below.

The interior of the cargo holds, particularly holds number 4 and 5, had sustained heat damage and were stained by HFO and water.

Figure 16: Fire damage to the SUL system boom

Source: MTD

Machinery spaces

The engine room showed widespread smoke damage and evidence of heat conduction and damage to the forward bulkhead that separated it from the C-Loop space. The forward bulkhead and the deck head above showed signs of burnt paint, deformation and heat damage to fittings and machinery in the vicinity (Figure 17). The evidence indicated that the heat had been directed from within the C-Loop space and both investigations assessed that the fire did not originate in the engine room.

Figure 17: Heat damage to engine room forward bulkhead

Source: ATSB

Tunnel spaces

At the bow, as the FIRU investigators descended into the tunnel spaces through the access hatch, they noted the tunnel ventilation fan in operation and observed that it forced air down into the tunnels with considerable force.

There was minimal evidence of fire damage at the bow end of the tunnels. The FIRU considered it unlikely that the ignition source was in the tunnel conveyor belts based on the absence of any transported burnt material near the bow end of the tunnels.

Proceeding aft down the port tunnel, about halfway down, there was increasing fire damage and oxidation further aft. The tunnel conveyor belt in the vicinity of hold number 4 had been completely consumed by the fire. The level of damage increased significantly at the aft end of the tunnel where the transfer belt was located. There were heavy fuel oil (HFO) deposits on the deckhead, and a fire hose reel showed considerable damage with the fire hose itself completely consumed by the fire.

At the aft end of the starboard tunnel, the fire damage was considerably less than on the port side. The corresponding fire hose reel as the one destroyed on the port side showed little fire damage although it was oil-stained, and the rubber conveyor belt was largely intact (Figure 18, top). Both tunnels showed evidence of coal and coal dust on the hold gates, conveyor structures and deck.

The workshop area between the aft ends port and starboard tunnels also showed a greater degree of damage to steel structures and electrical fittings structures located on the port side compared to the starboard side (Figure 18, centre). There was conveyor belt rubber left on the starboard side whereas the belt in a similar position on the port side was missing (most probably consumed in the fire).

The MTD investigation made similar observations to the FIRU above, noting that fire damage appeared to be minimal at the forward end of the tunnels and increased significantly further aft. The MTD investigation also documented the significantly greater damage in the port tunnel compared to the starboard. The investigation noted that this disparity was possibly the result of the greater airflow in the port tunnel due to the open or partially open access hatches that were used to lower fire hoses down to the tunnels.

Figure 18: Disparity in fire damage between port tunnel (left) and starboard tunnel (right)

Source: Fire and Rescue New South Wales

Transfer belts

In the vicinity of the athwartships transfer belts, the cages surrounding the port transfer belt showed greater deformation than the cage surrounding the starboard belt. A fixed floodlight on the port side also showed significantly more damage than the corresponding floodlight on the starboard side (Figure 18, bottom). A 38 mm FRNSW fire hose was observed tied-off , aimed at the port transfer conveyor belt and observed to be leading forward, up the port tunnel to an access hatch on deck.

The MTD investigation also noted the increased levels of fire damage in the area of the port transfer belt compared to the starboard transfer belt and the tied-off fire hose leading to the access hatch. As with the surrounding areas, there were clearly noticeable oil and water residues.

C-Loop space

There was limited access to the C-Loop space for investigators due to safety reasons. The FIRU investigators noted that the upper levels of the C-Loop space showed significant oxidation and deformation of steel structural members. Further down, near the bottom of the C-Loop space, there was a thick coating of HFO with evidence of HFO deposits high up on the bulkheads of the space indicating that the HFO leak occurred sometime after the fire began.

The MTD investigation documented severe smoke damage at the main deck entrance to the C‑Loop space and noted that the C-Loop dust suppression spray system valve was in the ‘open’ position. At the upper, discharge end of the C-Loop, the drive motors, pulleys, idlers, and associated equipment had been damaged by fire, heat, and smoke.

About midway down the C-Loop space, the inner and outer conveyor belts of the C-Loop were absent and the associated conveyor components were severely fire damaged. There was significant deformation of the athwartship ship’s structural members with several pulling free of the bulkheads. Several idlers had pulled free of their supports and fallen down into the C-Loop space.

Further down, near the bottom of the C-Loop space, in addition to the fire damage, there was also HFO and water contamination (Figure 19). There was also clear evidence of the further tensional structural damage to ship’s support members. There were remnants of the burnt conveyor belts as well as displaced idlers that had fallen from above.

Figure 19: Bottom of C-Loop space, looking aft

Note HFO coating on bulkheads at height above the deck.

Source: MTD

At the base of the C-Loop, where the transfer belts deposited cargo into the C-Loop loading hopper, there were collapsed idlers and a few cubic metres of coal residues mixed with water and HFO.

There was also significant damage to the various hydraulic systems serving the SUL system. However, the reservoirs of hydraulic oil for the various systems showed little or no decrease in oil levels and engine room alarm logs showed no hydraulic system alarms leading up to the fire.

HFO tanks

On either side of the central C-Loop space and tower were bulkheads forming the forward boundary of the HFO tanks. The ship’s structural strength members in this area had buckled under compressive forces. On the port side of the C-Loop space, including on the HFO tank bulkhead, there were significant, solidified carbonaceous residues. Clearing the residues exposed a crack that penetrated the full thickness of the bulkhead to the HFO tank. Further examination showed another larger crack, at least 5 mm in breadth extending the full thickness of the plate. There was also evidence of a further potential crack extending upwards.

There were also cracks identified in the starboard HFO tank bulkhead, albeit smaller than on the port side.

Idlers and pulleys

As part of the MTD investigation, accessible SUL system conveyor belt idlers and pulleys were examined. Some of the idlers and pulleys associated with the tunnel conveyors were in the fire-affected area and displayed damage consistent with attack by fire. Other idlers forming part of the C-Loop elevator system had collapsed and were buried in the debris at the base of the C-Loop. These idlers and their bearings could not be examined and consequently could not be discounted as potential sources of ignition. However, examinations of their mounting brackets did not show any severe localised heat damage, metal deformation, mechanical damage or any of the other signs usually associated with a failed idler or idler bearing.

The investigation found four specific areas of interest during the examination of the accessible C‑Loop idlers and pulleys (Figure 20).

C-Loop inner belt support idler

A C-Loop inner belt support idler (Figure 20, Component A) about mid-way up the C-Loop space exhibited signs of impact damage possibly associated with the collapse of the tension pulley or fire damage to the conveyor belt or both. The idler had fallen and impacted ship’s structure below. However, it was considered unlikely it interfered with the belt’s movement even if it collapsed before the fire began. The damage was assessed as probably a result of the fire rather than causative.

C-Loop inner belt tensioning pulley

The tensioning pulley for the C-Loop inner belt (Figure 20, Component B) had also collapsed and wedged near the base of the C-Loop. One of its bearings was found to be displaced and showed evidence of heat damage. However, the damage was more consistent with mechanical impact from falling down into the C-Loop space followed by exposure to the fire rather than due to a failure during normal operations.

C-Loop outer belt return pulley

The cover of the C-Loop outer belt return pulley’s (Figure 20, Component C) port side bearing showed signs of being slightly displaced from its original position. However, this was more consistent with a bearing in the early stages of a potential failure rather than a bearing that had already failed.

Starboard lower snub impact idler assembly

At the base of the C-Loop was a series of idler rollers and impact idlers^[50] collectively known as the lower snub impact assembly (Figure 20, Component D).^[51] The lower snub impact idler of the C-Loop inner belt assembly consisted of aft and forward components.

Figure 20: Location of idlers and pulleys of relevance to the fire investigation

Source: CSL Australia, modified and annotated by the ATSB

The forward component comprised an impact idler covered with rubber impact discs which remained intact, although fire damaged. The aft component consisted of five idlers and served the inner belt of the C-Loop. The bearings of the port side outboard idler showed no signs of mechanical failure, nor did the central idlers. However, the bearing of the starboard side outboard idler and most of its metal components were destroyed (Figure 21). The degree of damage was considered highly unlikely to have been the result of fire damage and was not observed at any other bearings.

Figure 21: Failed starboard outboard bearing of lower snub impact idler and intact bearing on port side (for comparison)

Source: MTD

Visual examination of the damaged bearing indicated that the bearing shaft was displaced laterally from the bearing housing by about 35 mm. There was also visible damage to the idler shaft as well as evidence of erosion of the inner surface of the idler-shaft interface (Figure 22).

Figure 22: Image showing damage to idler bearing

Source: MTD

The ship’s original drawings showed that, of the five idlers comprising the aft components of the snub impact assembly, the central three idlers were rubber-cushioned impact idlers while the outer two were solid-type rollers. The MTD investigator’s examination indicated that the installed idlers all appeared to be metal idlers with remnants of burnt conveyor belt stuck to them but no evidence of rubber impact discs.

During a safety round of the SUL system on 17 June 2018, the 1600–2000 IR had reported that some rubber impact discs had come free from an idler roller at the base of the C-Loop. The IR also stated that the observed idler missing the rubber impact cushions was situated under the C‑Loop outer belt and therefore, unlikely to be related to the failure of the inner belt’s lower snub impact idler bearing. Additionally, it was reported that it was a relatively regular occurrence for impact idlers to lose the rubber impact discs.

It is possible that the central three rubber-cushioned impact idlers had been replaced with solid metal idlers at some point in time. This change may have increased the loading on the outboard idlers which may in turn have increased wear and tear and reduced the life of the bearing. Iron Chieftain’s planned maintenance system (PMS) records indicated that the lower snub impact idler’s bearings had been replaced during the ship’s last drydock in 2014. The ship’s PMS also required annual inspections of the impact idler and its bearings with the last inspection logged in November 2017. Greasing of the bearings was undertaken using a semi-automatic system. While there were no records of greasing in the PMS system, statements from the ship’s officers and crew generally indicated that the idlers were usually well lubricated.

FIRU investigation conclusions

The FIRU investigation concluded that the fire originated in the conveyor belt system, possibly in the port transfer conveyor belt, although a full excavation and examination of the transfer conveyor belts could not be conducted. The most likely hypothesis developed by the FIRU was that a roller beneath the port transfer conveyor belt had seized creating friction and resulting in the thermal runaway^[52] of the belt which brought the rubber to its ignition temperature (between 260‑316 °C). The short length of the transfer conveyor belt meant there was minimal time for any heat to dissipate and the likely fuel source was rubber, which disintegrated and was transported up the C-Loop along the conveyor belt system.

The C-Loop space, which was open at the top, acted as a chimney allowing it to draw smoke, heat and hot gases from below. The combustion process was aided and accelerated by the tunnel ventilation fan forcing air through the tunnels towards the C-Loop and by the open hatch covers of cargo hold number 3. The situation was further exacerbated by the fact that the C-Loop space had a fuel source (the rubber of the inner and outer belts) distributed throughout its height.

The breach of the HFO tanks during the fire allowed HFO to leak out and become an additional fuel source.

CSL-commissioned investigation conclusions

Based on the available evidence and pattern of damage, the MTD investigation concluded that the fire originated in the SUL system of the ship, most probably in the C-Loop space. The most likely cause of the fire was assessed as being the failure of the starboard outboard bearing of the lower snub impact idler of the C-Loop inner belt. The bearing failure resulted in the overheating of an idler and consequent ignition of the conveyor belt.

The fire acted upon the HFO tank bulkheads and the resulting movement, expansion and buckling of the bulkheads exceeded the strength of HFO tank structures. This resulted in fractures to the HFO tank bulkheads that extended through the tank plate thickness and allowed HFO to flow into the C-Loop space, adding fuel to the fire. The height of the water and oil marks on the C-Loop space bulkheads suggest that a significant amount of firefighting water had been delivered to the space before the HFO started to leak. That is, the HFO leaks occurred after the fire had been burning for some time.

CSL Australia

Canada Steamship Lines Australia (CSL Australia) is part of the CSL Group headquartered in Montreal, Canada. CSL Group owns and operates fleets of specialised SUL vessels, offshore transhippers, and bulk carriers worldwide.

CSL Australia was established in 1999, based in Sydney, NSW. In 2021, the company operated a fleet of 14 vessels including 10 Australian‑ and Bahamas‑registered vessels equipped with some form of SUL or conveyor belt systems. These included hybrid SUL vessels, transhipment shuttles, a floating offshore transfer barge and SUL transhipment barges.

Following purchase from BHP in December 2003, Iron Chieftain was initially managed by Inco Ships. However, in April 2015, CSL Australia took over management of Iron Chieftain.

Safety management system

With the change of ship management, a new SMS, titled the Australian Vessel Management System (AVMS) was implemented on board Iron Chieftain. The effectiveness of the implementation of the various policies, procedures, instructions and processes comprising the company’s SMS was regularly audited both internally, by the company, and externally, by commercial vetting organisations. Additionally, AMSA, as the organisation responsible for regulation of the ISM Code and its requirements in Australia, also conducted certain ISM Code audit and certification activity (see the section titled Australian Maritime Safety Authority for details).

Audits and inspections

Annual internal ISM audits were conducted by CSL Australia in 2015 and 2016, and by a marine safety consultant, on behalf of CSL Australia, in 2017. The audits identified a number of minor safety-related and administrative observations and non-conformances. None identified any issues relevant to the unacceptably high fire safety risk identified in the SUL system or to the absence of a reviewed or updated SUL fire safety risk assessment as required by the SMS and training schedule. The 2017 audit noted that the basic cause of the identified observations and non‑conformances was that the ship’s management team was not thoroughly familiarised with the AVMS.

The ship was also subject to annual inspections by RightShip^[53] , who were engaged by CSL Australia. The most recent survey, in November 2017, identified minor deficiencies related to the ship’s lifeboat engine and oil leaks in the engine room and forecastle.

Australian Maritime Safety Authority

As the flag State administration, the Australian Maritime Safety Authority (AMSA) is responsible for checking and monitoring that Australian vessels comply with the requirements of various Acts and subordinate legislation including those that give effect to relevant mandatory international conventions.

Class certification and surveys

AMSA delegates certain flag State administration functions to recognised organisations. These recognised organisations, usually classification societies, take on certain survey and certification functions on behalf of AMSA for vessels registered in Australia.

Iron Chieftain was classed with Lloyd’s Register. As a recognised organisation acting on behalf of AMSA, Lloyd’s Register surveyed the ship to ensure compliance with relevant legislation and issued the appropriate statutory certificates under the applicable marine orders.

In November 2017, Lloyd’s Register conducted annual surveys for Iron Chieftain’s safety construction and safety equipment certificates, among others. The safety surveys did not identify any issues related to the ship’s fire safety or emergency preparedness. Following completion of the surveys, the relevant certificates were appropriately endorsed.

There were other special surveys conducted in May 2018, however these were related to hull and structural issues and not relevant to fire safety or emergency preparedness.

ISM Code compliance

AMSA is the competent authority responsible for regulation of the ISM Code and its requirements in Australia. As such, AMSA^[54] conducted audit activity and certification related to the ISM Code for Australian‑registered vessels, including for the issue and maintenance of documents of compliance (DOC)^[55] and safety management certificates (SMC).^[56]

Following CSL Australia’s assumption of ship management responsibilities and the implementation of the new SMS in April 2015, AMSA conducted an initial SMC audit of Iron Chieftain on 23 September 2015. As an initial SMC audit, all elements of the ISM Code were audited by the AMSA auditor. The audit included interaction with ship’s officers with safety‑relevant responsibilities and the audit report recorded that subjects such as emergency preparedness, drill plans and records, and fire prevention were covered with the relevant officers.

The audit recorded one minor observation regarding training in the use of the new SMS not being provided to the ship’s officers. Following the audit, the ship was issued with a full-term SMC (valid for five years) subject to an intermediate audit between the second and third anniversary of the SMC issue date. The intermediate SMC audit was planned for July 2018 (the fire occurred in June).

In addition to ISM Code certification activity, AMSA monitored ISM Code compliance in conjunction with flag State inspections, in line with AMSA procedures.

Flag State inspections

International conventions give responsibilities to Australia (and other States) to check and control ships in a State’s waters to ensure that they do not pose a threat to the safety of the ship, crew, cargo or the environment. AMSA is empowered to perform this enforcement function through the implementation of flag State control (FSC) and port State control (PSC) regimes. Under the FSC program, AMSA is responsible for monitoring the operational safety standards of Australian-flagged ships. According to AMSA, compliance with regulations is monitored through a sampling process as AMSA, like many other regulators, is not resourced to be able to ensure compliance. The obligation to ensure compliance rests with the regulated entity (for example, the ship owner) while the role of AMSA is to hold the regulated entity to account in meeting its obligations.

AMSA employs marine surveyors to conduct PSC and FSC inspections among other duties. AMSA surveyors conduct inspections on Australian-flagged vessels, in a similar manner to arrangements applied to foreign-flagged ships.  

Iron Chieftain was subject to AMSA flag State inspections on a roughly biannual basis. Between September 2015 and April 2017, five flag State inspections were conducted. Of these, two inspections identified no deficiencies and the other three identified a small number of safety‑related deficiencies none of which resulted in the ship’s detention. The flag State inspections did not identify any issues relevant to the unacceptably high fire safety risk identified in the 2013 SUL fire safety risk assessment.

The most recent flag State inspections were conducted in October 2017 in Gladstone, Queensland and in April 2018 in Port Kembla, NSW. The reports from these flag State inspections showed that they did not identify any deficiencies on board the ship. AMSA ship inspection checklists used in the FSC inspections were unavailable for examination.

AMSA investigations

According to AMSA, the primary purpose of its regulatory investigations is prosecution. AMSA’s decisions to investigate are informed by several elements including the existence/extent of fatalities, injuries or pollution, the prospect for success, any precedent that may be set and the potential deterrence any outcome might provide to encourage future voluntary compliance.

In the case of the Iron Chieftain fire, noting that the ATSB had initiated an investigation, AMSA determined that there was little value in it also investigating the fire.

Emergency management in New South Wales

Emergency management arrangements

In NSW, the State Emergency and Rescue Management Act 1989 (SERM Act 1989) sets out the general legal and governance framework for emergency management. Emergency management planning within the state is a structured process that comprises three types of plans at state, regional or local level—emergency management plans, supporting plans and sub-plans.

Emergency management plans are the main plans which outline the overarching management arrangements and documents the agreed roles and functions of various agencies.

Supporting plans are prepared by NSW government agencies or ‘functional area’ to describe the arrangements by which support services will be coordinated. For example, ‘functional areas’ include Transport Services, Environmental Services and Health Services.

Sub-plans are action plans for a specific hazard, critical task, or special event. A sub plan may be required where the planning is more specialised or detailed than can be provided for in an emergency management plan. For example, a sub-plan may be required specifically to deal with bushfires, floods, fires, or storms.

Emergency Management Plans

The NSW State Emergency Management Plan (EMPLAN)^[57] set out the State‑level approach to emergency management, the governance and coordination arrangements and roles and responsibilities of agencies. The State EMPLAN and other NSW emergency response plans do not require formal activation as they are always considered active.

The State EMPLAN identified responsible agencies, known as ’combat agencies’, in relation to specific hazards and emergencies (Table 3). A combat agency was defined as ‘the agency primarily responsible for controlling the response to a particular emergency’.

Table 3: NSW EMPLAN - Emergencies and responsible agencies

Emergency	Responsible agency
Fire (within a fire district)	Fire and Rescue NSW
Hazardous materials ·   On land ·   Inland waters ·   State waters	·   Fire and Rescue NSW ·   Fire and Rescue NSW ·   Relevant port authority
Marine oil and chemical spills	Relevant port authority

Source: Resilience NSW

In addition to a combat agency, the State EMPLAN also defined a ’lead agency’ as ‘the agency who has overall leadership in a given situation’. The lead agency could be the combat agency or some other agency. The plan did not specify responsible lead agencies identified emergencies.

The State EMPLAN did not include guidance for a shipboard fire nor did it specifically list such an emergency or assign a responsible agency.

Regional EMPLAN

The Illawarra South Coast Regional Emergency Management Plan (2012)^[58] detailed the arrangements for emergencies that had the potential to impact the Illawarra South Coast Region Emergency Management area. The Regional EMPLAN covered the local government areas (LGA) of Wollongong, Shellharbour, Kiama, Shoalhaven, Eurobodalla, and Bega Valley. Port Kembla is located in the Wollongong LGA.

The Regional EMPLAN used the term ’lead agency’ and defined it as ‘the agency identified in the State EMPLAN as the agency primarily responsible for controlling the response to a particular emergency’. The plan identified Fire and Rescue NSW (FRNSW) as the lead agency for urban industrial and commercial fires and for bush and grass fires within a fire district. NSW Maritime (NSW Roads and Maritime Services)^[59] was identified as the lead agency for a major marine transportation incident and for marine oil and chemical spills.

There was no specific information for a shipboard fire in the Regional EMPLAN that was in force at the time of the fire. In February 2019, an updated version of the Regional EMPLAN was published.^[60]

Local EMPLAN

The Illawarra Local Emergency Management Plan (2017)^[61] detailed the arrangements for emergencies within the LGAs of Wollongong, Shellharbour, and Kiama.

The Local EMPLAN used the term ‘combat agency’ to identify responsible agencies for specific emergencies. The plan identified FRNSW as the combat agency responsible for fires including industrial, commercial, and residential fires. The relevant port or maritime authorities were identified as the responsible combat agency for sea-based transport emergencies.

There was no specific information for a shipboard fire in the Local EMPLAN.

NSW State Waters Marine Oil and Chemical Spill Contingency Plan

The NSW State Waters Marine Oil and Chemical Spill Contingency Plan (State spill contingency plan)^[62] , issued in December 2016, was a sub-plan to the State EMPLAN and the National Plan,^[63] produced by NSW Roads and Maritime Services (RMS).

The plan outlined the arrangements to deal with marine oil or chemical spills and maritime incidents such as groundings, collisions, disabled vessels or fire on a vessel that could result in an oil or chemical spill into State waters of NSW.^[64] Responsibility for responding to incidents in NSW State waters was based on geographical divisions and shared between NSW Maritime (RMS) and the three major ports managed by the Port Authority of New South Wales (PANSW): Newcastle, Sydney and Port Kembla. Incidents on the high seas (outside State waters) were dealt with by AMSA.

The State spill contingency plan used the term ‘combat agency’ to refer to the agency responsible for controlling the response to a maritime incident. The PANSW (Port Kembla) was the assigned combat agency with responsibility for responding to maritime incidents and emergencies between Garie Beach to Gerroa, including Port Kembla.

All combat agencies for maritime incidents use a version of the Australasian Inter-Service Incident Management System (AIIMS)^[65] incident control system, called the Oil Spill Response Incident Control System (OSRICS),^[66] to control and manage maritime incident and emergency response. The system provided for four main functions: planning, operations, logistics and, finance and administration. Officers were appointed to oversee each function with an Incident Controller (IC) responsible for controlling all operational activity in response to an incident.

Roles and responsibilities

The plan required the PANSW, in its capacity as combat agency, to:

• notify appropriate agencies and higher-level control within an agency of an incident or emergency
• provide an incident controller
• provide trained emergency response staff to control the incident or emergency response
• provide trained equipment operators
• make available emergency response equipment under its control
• establish an incident control centre (ICC) from which the incident or emergency will be controlled.

Where the PANSW was supporting a combat agency, it was required to:

• provide trained emergency response staff
• make available emergency response equipment under its control
• provide a liaison officer.

According to the State spill contingency plan, FRNSW were a supporting agency for marine oil and chemical spills and could be called upon to provide advice and support to the combat agency.^[67]

Guidelines for responding to a fire on a vessel

Appendix 17 of the State spill contingency plan, the Guidelines for Responding to a Fire on a Vessel, was developed to:

…complement the maritime incident response arrangements described in the NSW State Waters Marine Oil and Chemical Spill Contingency Plan in recognition of the additional coordination required and complexities involved in responding to a fire on a vessel, either at sea or in a port.

The purpose of the guidelines was to ensure a coordinated approach to responding to a fire on a vessel, regardless of the vessel location, and to describe the approach and the communications arrangements between the incident controller, the vessel and the supporting agencies.

Combat agency for a fire on a vessel

The guidelines designated the responsible combat agency for a shipboard fire based on geographical divisions in a similar manner to marine spills. The guidelines stated:

Fire on a vessel in port will normally be responded to according to the port’s local incident response contingency plan. A vessel when in a port including moored at a wharf is in State waters and under the NSW emergency management arrangements the Port Authority of NSW or NSW Maritime is the combat agency for the response unless control is handed to Fire & Rescue NSW. It is preferable that the Port Authority of NSW or NSW Maritime is in control of the response and work closely with Fire & Rescue NSW using an MAICT approach.

Based on the geographical divisions outlined in the appendix, the responsible combat agency for a shipboard fire in Port Kembla was the PANSW (Port Kembla). On the morning of 18 June 2018, however, when Port Kembla’s harbour master formally transferred incident controller status from PANSW to FRNSW, control of the response to the incident (the combat agency role) transitioned to FRNSW (which was allowed under the guidelines). FRNSW subsequently maintained the incident controller and combat agency roles until the conclusion of the incident response on 24 June 2018.

MAICT approach

For maritime incidents, such as a shipboard fire, involving large commitments of FRNSW personnel and resources, the maritime combat agencies agreed to use a Multi-Agency Incident Control Team (MAICT) approach based on the OSRICS structure. The MAICT approach used the following principles:

• the combat agency would provide the incident controller (IC), planning and administration functions
• FRNSW would provide the operations officer
• the logistics function would be provided by either the combat agency or FRNSW, depending on the size and complexity of the required response
• the combat agency would establish the incident control centre (ICC) at a suitable location
• a forward command post may be established and managed by the operations officer
• additional positions, such as vessel coordinator and fire operations coordinator, may be appointed.

The guidelines stated that the vessel coordinator should be ‘a marine officer of a Port Authority of NSW, marine pilot or marine surveyor’. A vessel coordinator was to be appointed when there was a need to have a person on the ship to act as a single point of contact for communications to and from the vessel and reporting to the IC. The guidelines also stated that ‘such a person should have a strong marine background to provide accurate information about the vessel, its cargo (if any) and the location and nature of the fire’.

The guidelines stated that the fire operations coordinator should be an experienced FRNSW officer. A fire operations coordinator was to be appointed to provide advice and assistance when the ship’s crew needs assistance to fight a fire.

There was no documented record of the roles of vessel coordinator or fire operations coordinator being appointed in response to this occurrence. Accounts of the incident response, however, indicated that the intent of these roles were fulfilled by personnel performing other functions, from other organisations or on an as-needed basis.  

NSW South Coast Marine Oil and Chemical Spill Contingency Plan

The NSW South Coast Marine Oil and Chemical Spill Contingency Plan (NSW South Coast spill contingency plan)^[68] was a supporting plan to the NSW State spill contingency plan and was used to coordinate local resources in responding to a maritime incident in the NSW South Coast regional area. The plan indicated that reference to an oil or chemical spill in the plan included any maritime incident that had the potential to result in an oil or chemical spill (such as a fire).

As with the State spill contingency plan, PANSW was identified as the combat agency for maritime incidents in certain areas, including Port Kembla and the surrounding area. The South Coast regional spill contingency plan did not include specific guidelines for responding to shipboard fires although it was stated that it was to be read in conjunction with the State spill contingency plan (which did contain such guidelines).

Other arrangements

In addition to the arrangements contained in the State spill contingency plan, a memorandum of understanding (MoU) existed between NSW Maritime, FRNSW and the former port corporations that were subsequently amalgamated to form the PANSW (see the section titled Port Authority of New South Wales). The MoU outlined combat agency responsibilities and supporting arrangements in relation to hazardous materials incidents including oil and chemical spills. Similar to the arrangements in the State spill contingency plan, combat agency responsibility for hazardous materials incidents in the waters of Port Kembla was assigned to the relevant port corporation.

Port Authority of New South Wales

On 1 July 2014, the port corporations of Sydney, Newcastle and Port Kembla were amalgamated to create the Port Authority of New South Wales (PANSW). The PANSW manages the navigation, security and operational safety needs of commercial shipping in six NSW ports, including Port Kembla, and appoints their harbour masters.

Transport for NSW issues a Port Safety Operating Licence (PSOL) to the PANSW. The PSOL covers port safety functions that must be undertaken in designated NSW ports. The PSOL also sets out the relevant performance standards and requirements that must be met by the licensee (PANSW) in the fulfillment of these functions. Port safety functions performed by the port authority include port communications, investigation of marine pollution incidents and emergency response, among others.

The licence required PANSW to respond to port-related emergencies and incidents as required by the relevant NSW emergency plans and by the State spill contingency plan. The licence also required the port authority to have emergency response plans with documented operational procedures for its emergency response activities and conduct annual exercises.

Port Kembla

Port Kembla is the deepest harbour on the eastern seaboard of Australia and is one of three major ports in the State of NSW. Port Kembla was established in the late 1890s to service the needs of regional industries such as the export of coal from the Illawarra region and the import of raw materials and steel products for the steel industry. Over time, the port diversified its trade base to include general and break-bulk cargoes, containers, and motor vehicle imports.

The port operates across two precincts, the inner harbour, and the outer harbour. The outer harbour accommodates the common user terminals and bulk liquids facility while the inner harbour includes coal, grain, car, container, and general cargo terminals. The BlueScope Steel terminals, where Iron Chieftain was berthed, were in the inner harbour.

Svitzer Australia held the licence to provide towage services at Port Kembla. As part of their services, Svitzer were required to provide a certain number of tugs with specified firefighting capabilities to respond to any emergencies within the port limits when required by the harbour master.

Emergency response plans and exercises

As part of this investigation, the ATSB sought procedures and plans relevant to a shipboard fire in Port Kembla. The documents provided included a PANSW Crisis Management Plan and a Port Kembla Marine Oil and Chemical Spill Contingency Plan.

Additional documents provided included standard operating procedures for Port Kembla’s vessel traffic information centre (VTIC) and a suite of documents being prepared for Port Kembla’s proposed future transition from a VTIC to a vessel traffic service (VTS). The sections of the VTIC operating procedures that dealt with emergencies were largely restricted to information gathering and notification while the proposed future VTS procedures were considered irrelevant to the investigation.

Port Kembla Marine Oil and Chemical Spill Contingency Plan

According to the PANSW, the Port Kembla Marine Oil and Chemical Spill Contingency Plan (Port Kembla spill contingency plan) was applicable to a shipboard fire response in the port. The plan was dated August 2015, was a sub-plan to the Illawarra Local EMPLAN and referenced a superseded, 2012 version of the State spill contingency plan.

The stated aim of the plan was to outline the arrangements to deal with marine oil and chemical spills or potential spills within the Port Kembla harbour boundaries. The plan used the term ‘combat agency’ as defined in the Illawarra Local EMPLAN and confirmed that, for the area covered by the plan, the PANSW (Port Kembla) was the relevant combat agency.

The Port Kembla spill contingency plan went into detail on the arrangements in place to respond to a marine spill. The practical arrangements outlined in the plan, including the use of the OSRICS concept and the key roles required to be filled by PANSW as a combat agency for a marine spill, were largely similar to those in the 2016 State spill contingency plan. However, the Port Kembla spill contingency plan did not contain any information related to the response to a shipboard fire, nor did it include any reference to the guidelines for such a response as described in the 2016 State spill contingency plan.

PANSW Crisis Management Plan

The port authority’s crisis management plan (May 2016) provided the main guidelines for managing the strategic response to a major incident affecting the port authority’s activities and was to be applied in conjunction with other response procedures, including State plans. The plan stated that it was not intended to provide comprehensive instructions or precise actions for any given situation but to provide simple, clear checklists, guidelines, and reminders about the main elements and key factors in an effective response. The crisis management plan was not specific to Port Kembla but applied generally to the PANSW.

The plan included guidelines for various incident scenarios. For each scenario, the guidelines documented a lead agency, a combat agency, and a support agency. They also provided some guidance on the port authority’s role in each scenario and a few key high-level steps that the port authority could take in the immediate response to the incident.

One of the incident scenarios described was for a fire or explosion aboard vessels. In such a scenario, the guidelines delegated the lead agency and support agency roles to the PANSW with responsibility for the overall coordination of the response, exercise of harbour master powers and provision of technical advice, transport and logistics support. The plan delegated the combat agency role for a shipboard fire to FRNSW. In addition to the advice on key roles, the guidelines outlined certain key steps that could be facilitated by the port such as cessation of shipboard operations, notifications, communications, evacuation, liaison operations and information gathering.

The crisis management plan did not include detailed operational procedures and very little other information for the emergency response to a shipboard fire in port. The plan also did not integrate or reflect details of the guidelines for responding to fires on a vessel described in the NSW State spill contingency plan.

Annual exercises

The conduct of annual exercises was a requirement of the PSOL. Port Kembla also had a maritime firefighting training agreement with FRNSW that covered the familiarisation of shore firefighters with the port’s tugs and their firefighting arrangements. The harbour master also reported that familiarisation visits to ships were organised for FRNSW firefighters however there was no documented record of these visits available.

On 17 May 2018, the PANSW led a multi-agency maritime incident response exercise, designated ‘Exercise Whale’, in Port Kembla’s outer harbour. The exercise scenario was based on a large visiting oil tanker catching fire and involved an explosion, missing casualties, and an oil spill within the port. Although the drill was based on a shipboard fire, there was no actual ship involved in the exercise. Participants included PANSW, FRNSW, NSW Police, NSW RMS, Svitzer tugs and Park Fuels (operators of the bunkering service at Port Kembla).

The drill’s stated objectives were to engage FRNSW and other stakeholders to deploy to the port in an incident, to engage NSW RMS and NSW Police in the maintenance of on-water safety while the emergency response proceeded and to demonstrate effective use of the port’s spill containment boom.

The exercise was initiated by notifications to VTIC, followed by onward notifications to the harbour master, FRNSW and other agencies based on the Port Kembla spill contingency plan. An ICC was set up by the harbour master with a VTIC officer acting as IC. The simulated fire at the oil tanker berth was dealt with by tugs, shore-based fire monitors and FRNSW who established an on-scene commander. Meanwhile, a NSW Police patrol vessel and the port’s pilot boat patrolled the waters around the affected area. The port’s oil pollution resources and spill containment booms were also deployed during the drill.

The delegation of roles and functions in the exercise implied that PANSW assumed the combat agency role, with FRNSW conducting the operational response with the support of the tugs and the berth’s firefighting assets.

Overall, the drill was considered to have met its objectives by the organisers. Outcomes of the drill included recommendations for reviews of the communications plan for emergencies and the need to make familiarisation of the port a priority for local FRNSW personnel.

BlueScope Steel

BlueScope Steel owns and operates the Port Kembla Steelworks and, at the time of the fire, operated five berths in Port Kembla.

BlueScope Steel’s emergency response plan for incidents at the bulk berths covered alert signals for various situations and response actions to incidents affecting the facility. While the plan did not specifically address the scenario of a shipboard fire, it did provide guidance on general actions in the event of an external emergency. In such a scenario, the plan designated a department emergency controller who would oversee the assembly of personnel in a suitable area and attempt to address the cause of the emergency.

If on-site resources were insufficient to manage the emergency, the controller would attempt to contain it while additional resources such as FRNSW arrived. The plan also detailed the firefighting resources available at the facility, such as the fire hydrants located on the wharf.

Port Kembla’s emergency response plans did not allocate any specific responsibilities to BlueScope Steel, in the event of an emergency. In practice, BlueScope Steel had a supporting role and were responsible for the safety of their own personnel and controlling access to the site. In addition, BlueScope Steel personnel notified FRNSW and Port Kembla VTIC of the fire and provided meeting rooms and office space when necessary during the response.

Fire and Rescue New South Wales

Fire and Rescue NSW (FRNSW) is the State Government agency responsible for the provision of fire, rescue, and HAZMAT services in urban areas across New South Wales. FRNSW is also a key agency involved in the response phase of most emergency or disaster events throughout NSW.

The ATSB incident database indicates that 34 shipboard fires occurred in NSW ports or off the NSW coast in the last three decades.^[69] Of these notified occurrences, only five reports had information indicating FRNSW involvement in the fire (including Iron Chieftain). Major shipboard fires in NSW have been a relatively rare occurrence and ones involving FRNSW participation even rarer.

Marine firefighting in NSW

FRNSW did not maintain a specialised marine firefighting capability. Firefighters were provided a range of skills and training in the course of their progression through the organisation. Incident management teams (IMT),^[70] usually comprised of senior officers, were trained to respond to a wide variety of scenarios across a range of industries and communities through familiarisation, training, drills, exercises, and engagement. In addition, FRNSW capability incorporated marine assessment teams, although these were largely focussed on HAZMAT incidents.

According to FRNSW, the most likely risks and scenarios that firefighters could be expected to encounter based on the nature of the local industry and community were to be captured and assessed in station-level or zone office-level risk registers.^[71] The assessment in the risk registers could then be used to tailor training and resourcing best equip firefighting personnel for their local area. For example, in the Port Kembla area, resourcing could be concentrated on preparing firefighters for port and shipboard fires and large industrial fires among others. However, at the time of the ATSB investigation, these registers had not been developed.

Training

FRNSW training material included a shipping training manual that was issued in 1996. Shipping‑related training was to be provided to FRNSW firefighters as part of station training plans. The ATSB requested copies of the station training plans showing when shipping training was last provided to the first responders^[72] to the Iron Chieftain fire. However, no documented evidence of the provision of specific shipping training was provided.

The training manual compared ship fires to shore fires with similar features such as warehouse fires, workshop fires and hotel fires. The manual included a general introduction to ships and ship types, information on shipboard fire firefighting systems and techniques and other aspects of firefighting unique to ships such as ship stability and other safety considerations. The information in it was generally relevant in certain areas but in places was outdated or inaccurate. Some examples of the anomalies and errors, the training manual stated that:

• ‘In a cargo vessel, the engine and boiler rooms are usually located amidships.’
  • [The vast majority of modern ships have the machinery spaces located aft]
• ‘Container ships are designed to carry up to 3,600 containers…’
  • [Modern container ships calling at Australian ports can carry more than 7,000 containers with the largest ships in existence capable of carrying over 21,000 containers.]
• ‘If you do use CO_2, leave the affected area closed for at least ten minutes to allow burning materials to cool below their ignition temperature.’
  • [CO₂ has limited cooling effect and premature entry into a space can cause a fire to re‑ignite.]
• ‘You should enter the engine room through the shaft tunnel.’
  • [Any entry into a fire-affected space should be by the safest means of access based on a risk assessment under the prevailing circumstances.]
• ‘All ships over 1000 t are required by International Maritime Law to provide an international shore connection on both sides of the ship.’
  • [SOLAS requires ships above 500 gross tonnage to carry at least one international shore connection.]

The FRNSW shipping training manual included brief descriptions of various types of ships such as container ships, car carriers and tankers. However, there was no section on bulk carriers. The manual also made no mention of the ship’s emergency generator or of its significance in firefighting operations.

Standard Operating Guidelines

FRNSW issued Standard Operating Guidelines (SOG) to describe the standardised method used to manage all emergency incidents attended by FRNSW resources. The SOG document provided general incident management guidelines as well as more detailed ones for specific scenarios and functions such as bushfires, aircraft incidents, land transport and tunnel incidents, rescue, and special incidents among others.

There were no specific FRNSW guidelines for a marine‑ or shipping-related emergency, although FRNSW, using the AIIMS system, would generally seek the advice of subject matter experts to assist in the formulation of incident action plans.

Equipment and resources

FRNSW firefighters and fire appliances were not provided with marine-specific firefighting resources, tools, or equipment as standard.

Evidence indicates that FRNSW first responders were initially not equipped with an international shore connection that could be used to pressurise the ship’s fire main. Communication with the port’s tugs was also hampered by the absence of a suitable communication method and by the lack of very high frequency (VHF) radios, which is standard marine voice communication equipment.

Foam was identified as key to the extinguishment of the C-Loop fire early in the response. However, obtaining the type(s) of foam in the necessary quantities required to implement a successful extinguishment strategy took time and required FRNSW to call on foam stocks in NSW and from interstate.

There were no marine-specific documentary resources or aide-memoires for use by first responders when confronted with a shipboard fire. Generic incident action plan templates were available, but first responders needed to rely upon recalling past marine training or experience when developing firefighting strategies and applying tactics for a shipboard fire.

Marine firefighting in Australia

ATSB investigations

The ATSB has investigated a number of shipboard fires across Australia, some of them major. Prior to Iron Chieftain, the most recent shipboard fires that resulted in substantial damage to the involved ships were both in Western Australia (WA). In 2014, the ATSB investigated fires on the livestock carrier Ocean Drover in Fremantle and the bulk carrier Marigold in Port Hedland, WA. These investigations offered an insight into the organisational and operational marine firefighting arrangements in WA, and their development over the last two decades.

Department of Fire and Emergency Services, WA

WA’s Department of Fire and Emergency Services (DFES) arranged brigades into three classifications based on their marine firefighting capability:

• Marine fire assessment and suppression capability (MFASC) brigades
  • An MFASC brigade has the training, specialist equipment, procedures, and crews to respond to and suppress a marine fire alongside or at sea.
• Marine fire support (MFS) brigades
  • An MFS brigade has the appropriate training and understanding of equipment to support an MFASC brigade in the response to a marine fire alongside but were not expected to enter the interior of a burning vessel.
• Marine fire assessment and containment (MFAC) brigades
  • An MFAC brigade is a volunteer brigade that has the appropriate training and equipment to mount an initial response to a marine fire incident alongside, assess the fire and contain it until additional expertise could be mobilised.

Marine firefighting training was targeted at each of these brigades based on their classification and the capabilities required of each.

The ATSB investigations into the fires in WA identified that training was delivered using the 2014 edition of the DFES marine firefighting manual. The manual included shipping-related material similar to that in the FRNSW manual although updated, with greater detail and with more information relevant to modern shipping. In addition, the DFES manual included a section on dry bulk carriers with a description of an SUL vessel similar to Iron Chieftain. The DFES manual also included case studies and examples of previous ship fires highlighting important lessons relevant to shipboard firefighting.

Brigades located at select WA ports were provided with a ‘ship firefighting cache’ in easily transportable boxes. The cache contained an international shore connection, spanners, specialised thermometers, couplings, fittings, and other tools to enable firefighters to readily operate onboard a ship on fire.

Crews are also provided a ‘ship fire response checklist’, stored in the ship firefighting cache. The checklist was a response guide to assist fire crews in dealing with a marine fire and recording incident information. The ship firefighting checklist was part of a larger, ready-use document called a ‘marine fire emergency response guide’. The guide included information for use by ICs or IMTs when assessing priorities and determining strategy and tactics at a ship fire incident. The guide also contained a flowchart that provided a sequence of actions to take based on the effectiveness of firefighting efforts and forms to record shipboard temperature and stability parameters.

Fire Rescue Victoria

Fire Rescue Victoria (FRV)^[73] has a legislated responsibility for fire and HAZMAT incidents within the waters of the Port of Melbourne, an area covering approximately 1,000 sq. km of Port Philip Bay, Victoria, and a developed marine firefighting capability.

FRV organisational structure includes a marine commander to oversee marine operations and specialist marine firefighters are located at selected stations around Melbourne in close proximity to port infrastructure. These career firefighters are provided specialist marine firefighting training^[74] to respond to shipboard fires, rescues, and other incidents like chemical spills on ships and in ports.

FRV also operate several marine firefighting vessels (fireboats) and marine firefighters have access to dedicated caches of equipment.

National initiatives

During the course of this investigation, the Australasian Fire and Emergency Service Authorities Council (AFAC)^[75] established a marine working group (including representatives from FRNSW and FRV) to develop common doctrine and minimum standards for equipment and training related to national marine firefighting capability. AFAC members include FRNSW, DFES and FRV as well as other fire and emergency services organisations from across Australia and New Zealand. Additionally, AMSA is an AFAC affiliate.

FRNSW review of Iron Chieftain incident

Following the Iron Chieftain fire and emergency response, FRNSW conducted several reviews at various organisational levels in an effort to identify aspects of the response that worked well and areas for improvement.

Overall, these reviews concluded that a good outcome had been achieved with good incident command and with extinguishment achieved without the ship grounding, pollution, serious injury or damage to port infrastructure and facilities.

A number of positive strategic elements were identified. On the other hand, some of the key observations and areas of improvement identified by FRNSW, included:

• communication with external agencies was not always effective
  • Initially there was no direct way to contact the tug masters. Mobile phones were the main source of communication once contact numbers were obtained.
• critical factors must be identified and dealt with based on the conditions of the incident, not in a generic way based on previous incidents
  • Electricity was identified as a critical factor and switched off. This affected a number of the ship’s systems, including stability.
• the role of Planning Officer was not filled for some of the incident
  • As a result, certain longer-term planning functions did not occur, for example, consideration for the duration of the incident and handover requirements.
• the number of handovers and change of IMT roles that took place with the change of shift meant that there were unnecessary changes to strategies and tactics
• senior Officers did not report to the assigned staging location
  • This led to delays with handovers taking place and officers being released at the end of their shift
• fatigue for members of the IMT working on night shifts.

Fires involving SUL bulk carriers

A review of past fires involving SUL bulk carriers with conveyor belt systems identified several occurrences with circumstances relevant to this investigation.

Halifax

On 6 April 1993, a fire broke out in the tunnel spaces of the Canada registered, SUL bulk carrier Halifax whilst underway on the St. Mary’s River, Ontario, Canada. The fire resulted in damage to the ship with a loss of one life but was successfully extinguished by the ship’s crew with an hour.

The Transportation Safety Board of Canada (TSB) investigated the fire and published report number M93C0001. The investigation found that the fire started when hydraulic oil mist from a disconnected hose was ignited by a halogen lamp that was missing its protective cover. The ship’s crew fought the fire by making entry to the tunnels from the forward end, opening the cargo hold hatch covers and directing fire hoses at the seat of the fire. The cooling of the cargo holds, and flooding of the tunnel proved effective in preventing the fire from spreading. The tunnel ventilations fans were not used for fear of feeding the fire and the sprinkler system in the loop belt casing area was turned on to cool the belts.

Ambassador

On 31 December 1994, a fire broke out in the conveyor belt system of the Vanuatu‑registered, SUL bulk carrier Ambassador during cargo (rock phosphate) discharge operations at the port of Belledune, New Brunswick, Canada. The fire spread to the ship's accommodation, and the combined efforts of the ship's crew and shore fire departments were required to extinguish it, some 28 hours later. The fire resulted in significant damage to the ship’s SUL system, tunnels and part of the accommodation.

Canada’s TSB investigated the fire and published report number M94M0057. The investigation found that, during a suspension of cargo operations, a section of a conveyor belt ignited, probably because the belt was in contact with an overheated roller. The investigation concluded that the roller probably overheated due to a bearing failure or to being jammed with refuse.

The investigation also found that:

• the fixed sprinkler system in the loop belt casing was ineffective in controlling a major fire
• the open top of the loop belt casing and the hold gates to cargo hold number 3, which were not airtight, allowed a continuous supply of oxygen to the fire
• some of the shipboard firefighting equipment was sub-standard
• the crew had not been drilled in firefighting during weekly emergency drills
• none of the shore-based firefighters had been trained in fighting shipboard fires

The investigation report noted that Ambassador complied with SOLAS, Vanuatu and Canadian regulations.

The report stated that early detection and prompt extinguishing of fires in cargo conveyor systems depends on the presence of personnel in the area. Furthermore, on board Ambassador, the sprinkler system proved inadequate and the area of the fire was not covered by a fixed fire‑extinguishing system.

TSB records indicated that, in the 15 years before the Ambassador fire, there had been at least eight fires on board Canadian SUL ships. These included the fire on Algosoo in 1986 and the fire on H.M. Griffith in 1989, both at Port Colborne, Ontario, Canada. None of the ships involved were fitted with a fire-detection or fixed fire-extinguishing system capable of suppressing large fires, and all the fires required direct firefighting by ship personnel.

The TSB recommended that the Canadian Department of Transport review the requirements for fire protection systems for tunnel areas on Canadian self-unloaders, with a view to ensuring a capability for suppressing large fires. It was subsequently assessed that improved procedural approaches to fire prevention adopted by operators appeared to be effective and therefore, no further regulatory amendments were pursued.

The TSB also recommended that the Canadian Department of Transport seek support from the International Maritime Organization (IMO) in addressing the need for enhanced fire detection and extinguishing systems in the tunnel area of SUL ships. This recommendation received insufficient support and no approach was made to the IMO.

Yeoman Bontrup

On 2 July 2010, a major fire and explosion occurred on board the Bahamas‑registered, SUL bulk carrier Yeoman Bontrup during cargo (granite) loading at Glensanda Quarry, Loch Linhe, United Kingdom (UK). The fire was discovered near the bottom of the vertical conveyor belt system during repair work to a hopper and it spread rapidly to the adjacent engine room, accommodation and steering gear compartment. The ship’s crew attempted to fight the fire, but they eventually evacuated the ship, and it was left to burn out. The fire resulted in significant damage to the ship including a violent explosion which tore the poop deck from the ship.

The United Kingdom’s Marine Accident Investigation Branch (MAIB) investigated the grounding and published Report No. 5/2011. The MAIB determined that the most likely cause of the fire was the ignition of the vertical conveyor belt by hot debris from the hopper repair work.

The investigation found that although Yeoman Bontrup complied with the extant standards, attempts to contain and fight the fire were hampered by the following factors:

• the conveyor belt systems posed a high fire risk
• the lack of an effective means of early detection meant that the fire was already well established by the time it was detected
• the fire spread quickly through the compartment, making manual firefighting difficult due to the absence of means of containing the fire
• the compartment was not equipped with a fixed fire-extinguishing system.

The investigation also found that the ship’s crew were not practised in fighting a fire in the cargo handling spaces and the drill schedule did not specify requirements for such drills despite the recognised high risk.

Following the fire, Yeoman Bontrup’s owners established an SUL operator and owners forum with representation covering 90 per cent of the SUL industry, including CSL. The forum agreed to jointly fund the testing of suitable fire detection and extinguishing systems

The MAIB recommended that the Bahamas Maritime Authority (BMA), supported by the UK’s Maritime and Coastguard Agency (MCA), submit proposals to the IMO to review and improve fire detection, containment and extinguishing standards for cargo handling areas on board SUL vessels and to develop standards for conveyor belt fire resistance properties. The BMA proposed that a general requirement to perform fire safety risk assessments for cargo conveyor spaces on SUL bulk carriers be placed in the IMSBC Code while testing and assessment of suitable fire detection and extinguishing systems for SUL vessels continued.

The proposed amendments to the IMSBC Code were adopted in June 2015 and entered into force from 1 January 2017 (and could be applied voluntarily from 1 January 2016). With regard to the development of standards for conveyor belt fire resistance properties, the BMA noted there was an existing International Organization for Standardization (ISO) standard regarding flammability and that the SUL group considered the issue emphasised but noted the need for balance between fire resistance and flexibility. Consequently, the BMA did not take this recommendation forward.

In addition to safety action by the ship’s flag State, the ship’s manager implemented a number of safety actions including amending the drill schedule to include a requirement for fire drills in the cargo handling areas of SUL vessels.

Fires on board CSL Australia ships

By the time of the fire, CSL Australia was almost certainly aware of the safety concerns highlighted by past SUL ship fires and of the lessons learned as a result. The CSL Group participated in the SUL forum organised in response to the Yeoman Bontrup fire and was instrumental in the development and trialling of new fire detection and extinguishment technology. Safety action prompted by some of these fires had also been incorporated into CSL Australia procedures, including the added requirement for SUL system fire drills and the need for annual fire safety risk assessments of SUL system spaces.

Spencer Gulf (2017)

On 11 January 2017, a fire broke out in the external conveyor belt system of the Australia registered domestic commercial vessel (DCV), Spencer Gulf, following cargo transfer operations off Whyalla, SA. The fire was detected on the vessel’s external conveyor and boom conveyor whilst alongside a bulk carrier. The fire was extinguished, about two hours after it was detected, by ship’s crew with firefighting assistance from the bulk carrier and tugs. The vessel sustained damage to the boom, supporting conveyor structure, electrical systems, and instrumentation.

The fire was investigated by CSL Australia with external expert assistance. The cause of the fire was determined to be heat generated due to friction as a result of stoppage in the boom conveyor while the main drive pulley continued to run. The investigation report noted that that there was no fire suppression system covering the vessel’s SUL system and that the firefighting capabilities of the vessel alone were insufficient to handle a fire of this magnitude.

The investigation examined the SUL fire safety risk assessment for Spencer Gulf^[76] and noted that there had been a failure to implement identified ‘planned future control measures’ such as linear heat detection systems that may have provided advanced warning and additional response time. The investigation concluded that there was a failure to manage the risk of fire on board the vessel.

Although notified of the incident, AMSA did not have direct regulatory responsibility for DCVs at that time as State regulators effectively regulated DCVs through delegations from the National regulator (AMSA). The incident was also not reported to the ATSB nor was it required to be as the fire occurred while the vessel’s operations were exclusively within State waters.

Spencer Gulf (2020)

On 20 September 2020, a fire was detected in Spencer Gulf’s main hopper during cargo operations off Whyalla, SA. The fire was visually detected during checks by the vessel’s deck mechanic following a shutdown of the vessel’s conveyor system initiated by an alarm for a high material level in the hopper. The fire was extinguished by crew within an hour of detection with no injuries reported. The vessel sustained fire damage to a conveyor belt, three impact idlers and an electrical sensor.

CSL Australia’s investigation identified failed bearings on two rubber-covered impact idlers. The idlers had seized following the bearing failures which resulted in friction, heat build-up and subsequent smouldering of the conveyor belt. There was no system in place to detect high temperatures in the impact idler’s bearings. The heat from the fire damaged a sensor in the vicinity of the idlers which resulted in the high material level alarm and shutdown of the conveyor system.

Donnacona

On 8 September 2020, a fire was detected on the boom of the Australia registered, SUL bulk carrier Donnacona during cargo (magnetite) transfer operations off Cape Preston, Western Australia. The fire was detected visually by the duty rating who witnessed smoke and flames issuing from the boom whilst the ship was alongside a bulk carrier. The fire was extinguished within an hour of detection by the ship’s crew using fire hoses with the conveyor belt kept running. The fire resulted in damage to the pulley bearings on the boom and minor injury to a crewmember.

CSL Australia’s investigation identified a collapsed bearing as the cause of the fire with the resulting friction from the collapsed bearing likely igniting the grease in the bearing housing. The ship was equipped with a high bearing temperature alarm and monitoring system however, the system was not set up with a hierarchy of critical alarms and that the number of alarms generated overwhelmed the user.

__________

18. In 2001, BHP merged with Billiton to form BHP Billiton. However, in 2018, ‘Billiton’ was dropped from the organisation’s name and is now known as BHP.
19. International Maritime Organization, 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.
20. A voyage data recorder is designed to collect and store data from various shipboard systems in compliance with SOLAS requirements.
21. Granular Dolomite: 10 mm, 20 mm, and 30 mm grades.
22. The primary aim of The International Maritime Solid Bulk Cargoes (IMSBC) Code is to facilitate the safe stowage and shipment of solid bulk cargoes by providing information on the dangers associated with the shipment of certain types of solid bulk cargoes and instructions on the procedures to be adopted when the shipment of solid bulk cargoes is contemplated.
23. Hold numbers 1 and 5 had six gates each on either side while hold numbers 2, 3 and 4 had seven gates each on either side.
24. An inverted ‘V’ shaped steel structure in the cargo holds.
25. The drive pulley is driven by the drive train (motor). The drive pulley transmits the driving force to the conveyor belt.
26. The belt slip detector worked by detecting any discrepancy between the speed of the drive pulley and the speed of another non-driven pulley or idler on the same belt, in this case, the tail pulley (return pulley).
27. Belt drift occurs when the belt deviates laterally from the system’s optimal alignment.
28. RMA (Rubber Manufacturers Association).
29. DIN (Detaches Institut fur Normung): German Institute for Standardization.
30. ARPM (Association for Rubber Products Manufacturers): Formed in 2011, the ARPM took over the rights for the publishing, sale and editing of former RMA publications including those related to standards.
31. Australian Standard 1332-2000: Australian Standard for Conveyor belting – Textile reinforced.
32. Association for Rubber Products Manufacturers, 2011, Conveyor and Elevator Belt Handbook, Fourth Edition, Indianapolis, US.
33. Conveyor belt rubber covers with high-temperature service and flame-resistance service classifications were designated ARPM-HR (Classes 1, 2 and 3).
34. Under the AS1332-2000 standard, rubber with fire and heat resistance characteristics were designated Grade R and Grade S.
35. Standards AS1334-10-1994 and AS1334-11-1988 described the methods of testing the fire/heat resistance standards of the Grade R and Grade S rubber belts. The first standard specified a test involving placing a flame under a sample of the belt. The second standard outlined a test involving heating a section of the belt through friction with a rotating metal drum. Due to equipment constraints, an approximation of the second test was simulated by the ATSB with a heat gun.
36. Marine Orders are legal instruments made by AMSA pursuant to powers under Commonwealth legislation. They are also described as regulatory instruments or legislative regulations.
37. SOLAS Ch II-2/Reg 10.7.1.3.
38. Cargo spaces are defined as spaces used for cargo, cargo oil tanks, tanks for other liquid cargo and trunks to such spaces.
39. SOLAS Ch II-2/Reg 10.7.1.4
40. MO Circular MSC.1/Circ.1395/Rev.1 List of solid bulk cargoes for which a fixed gas fire-extinguishing system may be exempted or for which a fixed gas fire-extinguishing system is ineffective.
41. The spray system had been set up and used for dust-suppression purposes the day before the fire although it was not in use during cargo discharge operations on the night of the fire.
42. International Maritime Organization, 2018, International Management Code for the Safe Operation of ships and for Pollution Prevention (ISM Code) as amended, IMO, London.
43. In Australia, AMSA’s Marine Order 34 (Solid bulk cargoes) 2016, gave effect to the IMSBC Code.
44. International Maritime Organization (IMO), London, 2020, The International Maritime Solid Bulk Cargoes Code (IMSBC Code), Section 3 Safety of personnel and ship, 3.1 General requirements.
45. Under the regulations of the International Convention for the Prevention of Pollution from Ships (MARPOL 73/78), every oil tanker of 150 tons gross tonnage and above and every ship, other than an oil tanker of 400 tons gross tonnage and above, are required to carry an approved Shipboard Oil Pollution Emergency Plan (SOPEP).
46. SOLAS Ch II-2/Reg 15.2.3 requires ships to provide training manuals that contain instructions and information related to the ship’s fire safety. The required contents of the manual included meanings of ship’s alarms, general fire safety practice and general instructions and procedures on firefighting activities, among others.
47. The ship was also equipped with a shaft generator which could be used when the ship was steaming.
48. SOLAS Ch II-1/Reg 43
49. FRNSW considered critical factors to be elements that, if not dealt with rapidly, could cause expansion of the incident or a threat to firefighters or others.
50. An ‘impact idler’ is a steel roller idler, fitted with rubber rings or other resilient shock-absorbing material to resist or absorb energy where cargo falls on the belts.
51. A ‘snub pulley’ is a pulley located close to the drive pulley to increase the ‘wrap’ of the conveyor belt around the drive pulley.
52. Thermal runaway: An unstable condition when the heat generated exceeds the heat losses within the material to the environment.
53. RightShip is a commercial organisation that provides risk management and environmental assessment services to the maritime industry.
54. As of 1 July 2020, AMSA has delegated ISM authorisation, to conduct required audits and issue applicable certificates, to recognised organisations.
55. A document of compliance (DOC) is issued to a company (or organisation), which complies with the requirements of the ISM Code.
56. A safety management certificate (SMC) is issued to a ship to signify that the company and shipboard management operate in accordance with the approved SMS.
57. State Emergency Management Committee, 2012, New South Wales State Emergency Management Plan.
58. Illawarra South Coast Region Emergency Management Committee, 2012, Illawarra South Coast Region Emergency Management Plan.
59. NSW Maritime was the agency responsible for marine safety, regulation of commercial and recreational boating and the safety functions of NSW port corporations. In November 2011, NSW Maritime was merged with the Roads and Traffic Authority to form the NSW Roads and Maritime Services (RMS). Any reference to NSW Maritime in this report refers to RMS.
60. A Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
61. The updated plan assigned combat agency responsibilities for a 'Transport Emergency (Maritime)' to the relevant port/NSW Maritime/FRNSW. The updated plan also referred to the NSW State Waters Marine Oil and Chemical Spill Contingency Plan, which contained guidelines on responding to shipboard fires.
62. Illawarra Local Emergency Management Committee, 2017, Illawarra Local Emergency Management Plan.
63. NSW Roads and Maritime Services, 2016, NSW State Waters Marine Oil and Chemical Spill Contingency Plan.
64. The National Plan for Maritime Environmental Emergencies (National Plan).
65. State waters means coastal waters extending from the low water mark or other baseline to 3 nautical miles seaward of that mark or baseline as well as other waters within the limits of the State as prescribed by the regulations.
66. AIIMS was developed in Australia in the 1980s based on the US National Inter-agency Incident Management System (NIIMS). AIIMS is the system of incident management adopted nationally by Australia’s emergency management services. It provides a common management framework for organisations working in emergency management roles and is based on the principles of management by objectives, functional management, and span of control.
67. OSRICS is the system used to manage marine spills and emergency response. Although based on the AIIMS incident control system, it has been modified to take into account the emphasis placed on record keeping and cost recovery from the polluter.
68. In NSW, FRNSW was the designated combat agency for inland waters and land based hazardous materials (HAZMAT) incidents and emergencies.
69. NSW Roads and Maritime Services, 2017, NSW South Coast Marine Oil and Chemical Spill Contingency Plan.
70. A The database for the most part covered reports received from SOLAS ships and did not include data on fire aboard domestic commercial vessels or small recreational vessels.
71. The deployment of an IMT was usually triggered by a request from first responders when there was a requirement to escalate the strategic level of an incident structure or when incidents surpassed certain limits in relation to location, size and type of incident.
72. A zone covered 16 stations.
73. The first firefighters that arrived on scene at the Iron Chieftain incident at Port Kembla were from the Wollongong station (503) and Warrawong station (422).
74. In 1994, Victoria’s Port Services Act was amended to include port waters as part of the Metropolitan Fire and Emergency Services Board’s (MFB) response district. This change saw MFB’s response area double in size, with the addition of nearly 1,000 square kilometres of Port Phillip Bay to the existing 1,000 square kilometres of land in metropolitan Melbourne. On 1 July 2020, the MFB, its stations and firefighters, were absorbed into the newly created Fire Rescue Victoria.
75. The firefighting training adhered closely to National Fire Protection Association Standard 1405 (NFPA 1405) – Guide for Land-Based Fire Departments that Respond to Marine Vessel Fires. The National Fire Protection Association (NFPA) is an international, non-profit organisation devoted to eliminating death, injury and, property and economic loss due to fire, electrical and related hazards.
76. The Australasian Fire and Emergency Service Authorities Council (AFAC) is the peak body responsible for representing fire, emergency services and land management agencies in the Australasian region.
77. The same risk assessments dated 10 April 2013, that identified and documented an unacceptable level of fire risk on board Iron Chieftain.

Safety analysis

Introduction

On 18 June 2018, during cargo discharge operations while alongside at Port Kembla, New South Wales (NSW), a fire broke out in the internal cargo handling spaces of the self-unloading (SUL) bulk carrier Iron Chieftain.

The ship’s crew initiated an emergency response, but their efforts to control the fire were ineffective. As a result, the crew were evacuated and shore firefighting services from Fire and Rescue New South Wales (FRNSW) took over the response to the fire. The fire was subsequently contained and extinguished about 5 days after it started.

The ship sustained substantial damage with major elements of the SUL system destroyed and two heavy fuel oil (HFO) tanks breached. The ship was declared a constructive total loss and subsequently dispatched to be recycled. There were no serious injuries or pollution of the sea reported.

The following analysis will examine the cause of the fire, the emergency response and fire safety risk management on board SUL ships.

Cause of the fire

The fire on board Iron Chieftain was initially detected by the observation of smoke issuing from the C-Loop casing door leading to the C-Loop and SUL system spaces. Subsequent investigations by FRNSW and an expert engaged by the ship’s managers confirmed that the fire originated within the conveyor belts of the ship’s SUL system.

The most likely cause of the fire was assessed to be a failed idler bearing in a component of the SUL system at the bottom of the C-Loop space. The SUL system contained hundreds of idlers and the potential fire hazard from overheated bearings and rollers was well known from past fires overseas and was documented in the ship’s SMS and risk assessment. The failure most likely occurred in an idler under the port transfer conveyor belt at the base of the C-Loop or in a bearing associated with an impact idler at the lower end of the C-Loop inner conveyor belt. In either case, the seized component created friction which generated sufficient heat to ignite the rubber conveyor belts.

The SUL system spaces contained a large quantity of rubber in the form of conveyor belts, which provided an ample source of fuel, and the vertical nature of the C-Loop space aided air flow and facilitated the development of the fire. The dolomite cargo was discounted as an ignition source, or contributor to the fire, due its high ignition temperature.

The inability to extinguish the fire at an early stage allowed it to act upon the bulkheads of the ship’s HFO tanks situated adjacent to the C-Loop space. Thermal stresses imposed by the fire likely resulted in deformation of the bulkheads and the subsequent breach of the HFO tanks. This resulted in the introduction of HFO as an additional fuel source which added a layer of complexity in controlling the fire.

Regulations and standards

Investigations into past SUL ship fires overseas, particularly Ambassador and Yeoman Bontrup, had highlighted the high fire risk associated with SUL ship cargo handling spaces and the inadequacy of existing regulations for fire detection and extinguishment in these spaces. Safety action in response to recommendations following these fires had resulted in efforts to improve international fire safety regulations and requirements for SUL ships and had prompted the development of suitable detection and extinguishment technologies.

However, at the time of the Iron Chieftain fire, the situation regarding regulations and standards had not changed. There were no SOLAS regulations or classification society rules related to fire detection, containment and extinction that were specific to the cargo handling spaces of SUL vessels, nor were there standards governing the properties of conveyor belt rubber used in SUL systems.

Iron Chieftain was designed, constructed, and equipped in accordance with the prevailing regulations and standards. However, in the absence of any requirement to do so, the ship’s SUL system spaces were not equipped with an automated fire detection system or a remotely activated fixed fire-extinguishing system and the conveyor belt rubber did not possess any fire resistance properties.

Consequently, the fire on board Iron Chieftain was able to establish itself and develop rapidly with few viable firefighting options available to the ship’s crew.

Management of risk

The ISM Code placed a responsibility on companies to assess all identified risks to its ships, personnel and the environment and establish appropriate safeguards against these risks. More specifically, the IMSBC Code required operational fire safety risk assessments to be conducted regularly for the cargo handling areas of SUL ships equipped with internal conveyor systems. This measure was a direct result of safety action taken in response to previous major SUL ship fires.

Iron Chieftain’s SMS reflected the requirements for the SUL system operational fire safety risk assessment and furthermore, required the risk assessment to be reviewed annually. The SUL fire safety risk assessment conducted for the ship’s SUL system spaces in April 2013 assessed the fire risk associated with the ship’s C-Loop as being unacceptable.

The unacceptably high fire risk for the space was based on the existing control measures in place at the time which included safety rounds by the ship’s IRs, temperature checks by the deck mechanic, the ship’s fire main and the dust suppression spray system. These control measures were ineffective in detecting a fire in sufficient time to be able to respond effectively using the ship’s available firefighting resources. While the IRs took rounds every 2 hours, temperature checks were only performed by the deck mechanic during daylight hours and once at night. The spray system was not designed for firefighting, was not connected to the fire main and was ineffective against a fire while the ship’s hydrants could not be effectively deployed once the space was on fire.

Other safety measures such as the requirement for monthly SUL fire drills (also a lesson from past fires) were also not implemented effectively as these drills were not conducted as required by the SMS.

The risk assessment identified ‘planned future control measures’, which, if implemented, would reduce the risk to an acceptable level. These proposed control measures included the installation of heat detection systems for bearings, installation of a low-pressure sprinkler system and the development of a procedure for use in the event of a fire.

Despite being identified in 2013, at the time of the fire in June 2018, none of these planned control measures had been implemented. Fire detection and suppression systems had not been upgraded to address the identified unacceptable fire risk, nor were there emergency contingency plans for fires in the SUL system spaces. Furthermore, the risk assessment was neither reviewed nor updated after the initial assessment in 2013.

Shipboard response to the fire

In addition to the inherent high fire risk associated with Iron Chieftain’s SUL system spaces, there were also elements of the ship’s emergency preparedness and initial emergency response that influenced the outcome of the fire and/or increased safety risk in general.

Emergency contingency plans

Iron Chieftain’s SMS required that emergency situations be dealt with according to plans in the ship’s Emergency Contingency Plan (ECP) document. However, while the ECP contained plans for responding to various shipboard emergencies, including fires in certain locations on the ship, there were no contingency plans for responding to fires in the ship’s SUL system spaces. Furthermore, a number of other CSL Australia ships were also found not to have contingency plans in place for responding to conveyor belt fires or fires in the SUL system spaces.

The contingency plans in the ECP were to be used as a framework to ensure that crew could act confidently in the event of an emergency with drills and training exercises to be used as learning experiences to make improvements to the plans. The importance of having an available plan was clearly understood as evidenced by the fact that development of a procedure for use in the event of a fire was identified as planned future control measure in Iron Chieftain’s SUL system fire safety risk assessment.

The absence of contingency plans for SUL system fires meant that there was no practiced plan that could be implemented in the event of a fire in those spaces. It also meant that there was no plan to use as a framework to practice with or build upon when conducting fire drills in these spaces. This increased the risk that the shipboard emergency response to a fire in the SUL spaces would be ineffective.

Drills

SOLAS and AMSA regulations, as well as Iron Chieftain’s SMS, required that drills of the ship’s crew be conducted within 24 hours of the ship leaving port if more than 25 per cent of the ship’s crew had not participated in drills aboard the ship in the previous month. These drills served to familiarise crew, particularly new crew, to the ship, its emergency arrangements and the actions required of them in the event of an emergency.

By the time of the fire, 14 of the ship’s crew of 20, including the second mate who was new to the ship, had not participated in a fire drill on board in the last month. Consequently, when the fire broke out, the new second mate who was, coincidentally, the officer on duty at the time, had not participated in a fire drill on board Iron Chieftain. The officer was called upon to respond to a genuine emergency less than 2 weeks after joining the ship for the first time and having never participated in a drill or exercise on board.

In addition to the drills required by the regulations, Iron Chieftain’s SMS required additional monthly fire drills focussed on fires involving the SUL system spaces. The inclusion of these additional drills was an outcome of safety action from a past major SUL ship fire overseas in recognition of the high fire risk and unique firefighting circumstances of SUL system spaces. However, Iron Chieftain’s drills records showed that in the 12 months before the fire, only five SUL system fire drills had been conducted and none of them involved a fire in the C-Loop space. The irregular conduct of drills that were required specifically to improve preparedness to respond to fires in the SUL spaces increased the risk of an incorrect response to a real fire.    

Alarms and mustering

During the immediate response to the fire, the ship’s fire alarm, general emergency alarm and public address (PA) system all failed to work as expected. Nevertheless, most crew were woken by the sound of the intermittent alarms and were then alerted to the unfolding emergency by radio traffic from crew already involved in the response to the fire.

While the poor performance of the ship’s alarm and PA systems probably did not delay the muster of the ship’s crew significantly, it nevertheless hindered an effective muster as it required the diversion of the third mate from his usual muster duties on the bridge to ensure that all crew were alerted to the fire.

The anomaly in Iron Chieftain’s fire detection and alarm system was reported to have been a cause of frequent false alarms. However, the instructions in the ship’s muster list and fire training manual clearly stated that an audible fire alarm signal would be followed by an investigation of the alarm. A muster of the ship’s crew would only be prompted by a PA announcement or the general emergency alarm if the original alarm was found to be substantiated.

Therefore, it is unlikely that the anomaly had a significant influence on crew behaviour and on the muster in the response to the fire. Nevertheless, unresolved faults and anomalies in critical safety equipment such as the ship’s fire detection and alarm systems can hamper the response to an emergency.

Emergency response actions

The detection of the fire on board Iron Chieftain resulted in a number of actions and decisions in response with some of these early actions being influential to subsequent events and the eventual outcome of the fire.

Among the most influential of the early decisions was the second mate’s decision to stop the conveyor belts. All available guidance, instructions, and procedures for dealing with shipboard conveyor belt fires indicated that the belts should not be stopped. The action of stopping the belts had a clearly observable effect on events on the night.

Upon first discovering the fire, the IR was able to approach the C-Loop casing door although there was smoke issuing from it. Later, shortly after the belts were stopped, the chief mate reported difficulty approaching the area due to the heat and volume of smoke. By the time FRNSW attempted to enter the space, the heat, smoke, and flame made access impossible. Similarly, when FRNSW firefighters first arrived, the boom conveyor on deck (the last conveyor to be stopped in the sequence) was reported to be smouldering but not alight. Shortly after, the boom conveyor burst into flame. It is likely that at the time the decision to stop the belts was made, the second mate was uncertain as to the precise nature of the unfolding emergency. Nevertheless, the decision to stop the belts almost certainly aided the development of the fire.

Another factor that likely aided the fire’s development was the failure to stop the forward tunnel ventilation fan. This fan blew significant volumes of air down into the tunnels toward the C-Loop with great force and almost certainly facilitated the early development and growth of fire in the space. The fan was not stopped until the ship lost power following the activation of the fuel quick closing valves (QCVs) and the release of CO₂ into the engine room.

A viable firefighting option in response to Iron Chieftain’s C-Loop fire was described in the ship’s SMS. The suggested tactic involved opening the hatch covers and hold gates of an empty cargo hold and attacking the seat of the fire directly. Cargo hold number 5, located above the aftermost end of the tunnels, was empty. Opening the hatch covers and gates may have allowed firefighters to train fire hoses directly at or close to the seat of the fire at the base of the C-Loop. However, this tactic was not attempted by ship staff and, in any case, when the ship lost main generator power, the option of pursuing this tactic was lost as opening of the hatch cover required electrical power.

During the shipboard response to the fire, there were other actions that increased safety risk even if they did not directly influence the fire or adversely affect the response. These included the use of the ship’s elevator by the 0000—0400 IR following the detection of the fire and the omission of an initial headcount to account for all personnel following the activation of the ship’s alarms and initiation of the emergency response.

Another factor that likely increased risk was the chief mate’s decision to start the hold washing pump supplying the C-Loop spray system before opening the manual valve on deck. The action of starting the pump first probably made it harder to open the manual C-Loop spray valve adjacent to the C-Loop casing due to the associated water pressure. Opening this valve eventually required multiple attempts by the ship’s fire party, putting them in harm’s way unnecessarily. 

Use of fixed fire-extinguishing system

Post-fire examinations of Iron Chieftain’s engine room indicated that the fire did not originate in the space nor was there evidence of significant fire spread apart from localised damage due to heat conduction.

The ship’s second engineer, whose muster station was in the engine control room, broadcast multiple reports of a ‘big fire’ in the engine room on the radio. It is likely that the second engineer’s belief that there was a big fire was influenced by the blistering paint and associated smoke from the engine room’s forward bulkhead. The master relied on the second engineer’s information and consequently proceeded under the assumption that there was probably a fire in the engine room. The engine room’s carbon dioxide (CO₂) fixed fire-extinguishing system was subsequently activated, with FRNSW agreement. While this would likely have extinguished any active fire and supressed any potential fire in the space, it also had implications for firefighting efforts directed at the actual fire in the ship’s C-Loop space.

In preparation for the activation of the engine room’s CO₂ system, the ship’s crew activated the fuel QCVs and other emergency stops, in advance of FRNSW arrival on board. This shut down much of the ship’s machinery and equipment in the engine room. The subsequent CO₂ release meant it was no longer possible to occupy the engine room and maintain normal operation of machinery. While it is difficult to speculate how the availability of ship’s machinery and equipment might have influenced the eventual outcome of the fire, it nevertheless affected the ship’s capability in a number of ways. For example:

• The loss of the main fire pump reduced capability to the single emergency fire pump.
• The loss of the ship’s ballast and general service pumps removed the capability to influence the ship’s draught, stability, trim and list.
• The loss of the ship’s fuel and transfer pumps removed the capability to influence the volume of HFO exposed to the fire in the HFO tanks.
• The loss of hold washing pump meant that the C-Loop spray system ceased operation, although it is unlikely that this system would have influenced the outcome of the fire.
• The inability to open and shut hatch covers meant that cargo hold number 3 could not be closed to restrict air supply to the tunnels.
• The hatch covers to cargo hold number 5 and the hold gates below could not be opened to try and attack the fire directly.

The decision to deploy the ship’s engine room fixed fire-extinguishing system should be one that is carefully considered after weighing up all relevant factors. In this case, the master’s decision was probably influenced by factors such as the chief engineer’s advice, the belief that there was a fire reported in the engine room, FRNSW practice of isolating machinery and electricity, and the fact that FRNSW firefighters concurred with the master’s proposed course of action.

The decision possibly even resulted in some advantages such as the assurance that the CO₂ limited the potential for fire spread to the engine room where there were significant quantities of oil and other combustibles and that electrical circuits associated with machinery were de-energised and could be discounted as a hazard. 

While acknowledging the master’s reasoning, the possible advantages conferred by the use of the CO₂ system and the potential difficulties associated with manning an operational engine room adjacent to a space on fire, the decision to activate the fuel QCVs and subsequently flood the engine room with CO₂ thereby isolating it, nevertheless influenced firefighting capability and removed options that might otherwise have existed.

Shore response to the fire

The fire on board Iron Chieftain quickly overwhelmed the firefighting capabilities of the ship and its crew with shore assistance being requested at an early stage. The subsequent management of the response drew on elements of State, regional, local and Port Kembla’s emergency management arrangements, with FRNSW acting as the combat agency.

The ATSB investigation examined the shore response to the fire with a view to identifying any safety learnings. The investigation identified safety factors which, although found not to be contributory, were nevertheless worth highlighting. These factors related to FRNSW capability with regard to marine fires and the port’s documented plans for emergency response.

FRNSW capability

On boarding Iron Chieftain, FRNSW first responders were confronted with an intense, well‑developed fire in the unfamiliar environment of an SUL bulk carrier. The fire had already overwhelmed the ship’s inadequate firefighting capabilities and, at an early stage in the response, incident control (and combat agency responsibility) was delegated to FRNSW. It therefore fell to FRNSW firefighters to adapt to the shipboard environment, contain the fire and associated hazards, and ultimately lead the development and implementation of an extinguishment strategy. However, FRNSW did not maintain a specialist marine firefighting capability. The relatively rare occurrence of major shipboard fires in New South Wales (NSW) waters and ports also meant that there was limited opportunity for FRNSW to gain practical experience in fighting such fires.

Furthermore, while FRNSW training material included a section on shipboard firefighting and incident management teams (IMT) were generally trained to respond to a variety of scenarios (utilising skills applicable and transferrable to shipboard firefighting), there was no documented evidence of the FRNSW shipboard firefighting training being delivered to local firefighters or to the IMT personnel who first responded to the fire.  A review of the FRNSW shipping training manual indicated that it was last updated in May 1996 and that it contained some information that was outdated or inaccurate.

In addition, FRNSW first-responders were not provided with marine-specific documentary resources to assist with tactical familiarisation and strategic planning when responding at a shipboard fire nor was there evidence of stations in Port Kembla’s vicinity being equipped with marine firefighting tools such as an international shore connection or couplings. There were also logistical challenges with obtaining the quantity and type of foam required to implement a decisive extinguishment strategy although these were eventually overcome.

The ATSB’s investigation included an evaluation of contemporary agencies in Western Australia and Victoria, which offer examples of organisations (with legislated responsibilities) that maintain a specialist marine firefighting capability integrated into the organisation’s general structure and supported by up-to-date training, specialist equipment and documentary resources.

In submission to the draft of this report, FRNSW stated that it did not maintain a specialist marine firefighting capability for the following reasons:

…FRNSW were not the combat agency but a support agency. … [and]

FRNSW are not designated as the combat agency under statue in NSW until control is passed from the harbour master to FRNSW.

FRNSW were the combat agency for the major part of the response to the Iron Chieftain fire commencing at the time when control was passed from the harbour master to FRNSW on 18 June 2018 until its conclusion on 24 June 2018.

The intention of submissions… above is to make clear that FRNSW is not explicitly denoted as a shipboard firefighting combat agency. This is in contrast to the situation in Melbourne where the MFB [Fire Rescue Victoria’s predecessor] have been the combat agency for shipboard fires since amendments in 1994 to the Port Services Act to include port waters as part of MFB’s response district.

The ATSB acknowledges the stated position of FRNSW, including that NSW emergency management arrangements do not explicitly assign the combat agency responsibility for a shipboard fire in port to FRNSW and that the documented, preferred arrangement is for the Port Authority of NSW (PANSW) to maintain this role. However, the arrangements do allow for control of the response to such a fire to be passed to FRNSW at which time it becomes the combat agency for a shipboard fire in NSW. Furthermore, the port’s crisis management plan documented FRNSW as the combat agency for a shipboard fire.

On the night of the fire, incident control was handed to FRNSW early and, FRNSW assumed and maintained control of the response to the fire, performing the combat agency role until the incident was concluded. Therefore, while FRNSW may not be ‘designated as the combat agency under statute in NSW’, in practice it is very likely that FRNSW will be called upon to assume the responsibility in the event of a major marine fire, as was the case in the Iron Chieftain fire.

In the Iron Chieftain incident, FRNSW were presented with a complex, multi-dimensional fire, with several associated challenges and its contribution in bringing the fire to a safe conclusion with no serious injuries, infrastructure damage or pollution of the sea is commendable. It should be noted that the joint exercises, such as those conducted at Port Kembla, contributed to building a close working relationship between the Port Authority of NSW (PANSW), NSW Maritime and FRNSW. This had a positive impact on operations both during the initial response and hand‑over as well as during the extended response to the incident.

Following the fire, FRNSW conducted a robust performance review and identified several potential areas for improvement. These included improving communications with external agencies, filling key roles promptly, better management of the change of IMTs, the setting up of clear staging locations and incident-specific management of critical factors. However, there were other aspects of FRNSW training, organisation, and resourcing with regard to marine firefighting which should be addressed. Such safety action will almost certainly result in an improved level of marine firefighting capability and preparedness in NSW.

Port Kembla contingency plans

The PANSW’s operating licence required ports to respond to emergencies and incidents as required by State plans. It also required the port authority to have emergency response plans with documented operational procedures to guide its emergency response activities. For shipboard fires in port, the State spill contingency plan required that the response be conducted according to the port’s local incident response contingency plans. For Port Kembla, this was the Port Kembla Marine Oil and Chemical Spill Contingency Plan (Port Kembla spill contingency plan).

The Port Kembla spill contingency plan reflected the State spill contingency plan’s arrangements and instructions for the response to a marine spill. However, the State plan also included specific guidelines that provided practical advice on implementing the coordinated, multi‑agency approach required of a response to a shipboard fire. Port Kembla’s spill contingency plan did not include any reference to the State plan’s guidelines for responding to a shipboard fire. Consequently, it did not contain the useful information specific to the response arrangements to a shipboard fire such as the combat agency arrangements, the multi-agency approach and, the need for vessel coordinators and fire operations coordinators. The omission of any reference to the vessel coordinator was particularly relevant given that the guidelines recommended the appointment of a PANSW officer to the role. While the intent of these specific roles appears to have been met during the Iron Chieftain incident, the absence of a reference to the need for these roles in the port’s plans increased the risk that they may be overlooked during future incidents.

Similarly, while the PANSW’s crisis management plan included some guidance of a general nature on responding to a shipboard fire in port, it did not integrate specific details from the State guidelines such as the preference that PANSW take on the combat agency role. Furthermore, the crisis management plan made reference to the terms ‘lead agency’ as well as ‘combat agency’ in assigning responsibilities. While both these terms were used in the State plan in force at the time, it was inconsistent with the State spill contingency plan which only used the term ‘combat agency’ with regard to the arrangements for responding to a shipboard fire in port. This had the potential to create significant role confusion.

Regulatory oversight of Iron Chieftain

The ATSB investigation identified several factors related to safety and emergency preparedness at the shipboard and management levels. For example, the intermittent functioning of Iron Chieftain’s alarm bells and PA system during the fire. The ATSB considered it far more likely that these were pre‑existing issues, rather than an improbable coincidence that night.

The irregular emergency drills (contrary to procedures) particularly the SUL system fire drills,  and the absence of a contingency plan for SUL system fires indicated the ship’s emergency preparedness, at least for fires involving the SUL system, was non-compliant with the SMS and below any acceptable standard.

The vulnerability of SUL ships to fire was a known factor from past fires and had resulted in an IMSBC Code requirement for the conduct of fire safety risk assessments of SUL system spaces. Iron Chieftain’s risk assessment identified an unacceptable level of fire risk in the C-Loop space. However, the risk went unaddressed for more than 5 years and the risk assessment was not reviewed or updated following the initial assessment. This eventually culminated in a major fire resulting in significant damage and the ship consequently being declared a constructive total loss.

The Australian Maritime Safety Authority (AMSA) is responsible for checking and monitoring that ships flying the Australian flag comply with the relevant international regulations and obligations, including the ISM Code. AMSA also monitored the operational safety standards of Australian-flagged ships through the flag state control regime.

The ATSB acknowledges the challenges AMSA has in identifying specific indicators of risk during ship inspections within the limited time frame of port calls amid competing priorities. Nevertheless, the last two AMSA flag State inspections of Iron Chieftain before the fire did not identify any deficiencies on board the ship and flag State inspections from previous years did not identify any shortcomings with regard to the management of risks, in particular fire risk, on board CSL Australia vessels.

Similarly, while Iron Chieftain’s SUL fire safety risk assessment was dated April 2013, the ship’s initial ISM audit in September 2015 did not identify any deficiencies related to the inadequate management of fire risk on board. However, it should also be acknowledged that the amendment to the IMSBC Code requiring these assessments had only been adopted about 3 months earlier, in June 2015. It is therefore justifiable that such a new requirement may not have been audited or the risk assessment sighted.

As indicated earlier, AMSA investigation activities are primarily directed towards prosecution with a reliance on ATSB investigations to inform awareness of any identified safety issues and the need for safety improvement.

AMSA is not prevented from investigating in parallel to the ATSB to identify any readily apparent regulatory or oversight issues. However, in the case of Iron Chieftain, noting that there were no fatalities or pollution and that the ATSB was investigating, AMSA determined that there was little value in a regulatory investigation.

The fire on board CSL Australia’s Spencer Gulf in 2017 provided another opportunity for intervention and scrutiny of the management of fire risk on board Australian-flagged SUL ships. However:

• its status as a domestic commercial vessel operating within State waters
• the fact that AMSA did not have direct regulatory responsibility for it
• no requirement for the fire to be reported to the ATSB

resulted in no investigation or regulatory action being undertaken by the ATSB or AMSA. Consequently, an opportunity to identify safety issues and potentially improve oversight of high fire-risk SUL ships was missed.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the fire on board Iron Chieftain at Port Kembla, New South Wales on 18 June 2018.

Contributing factors

• The fire on board Iron Chieftain originated within the C‑Loop space of the ship's self-unloading system. The fire was probably the result of a failed conveyor idler bearing, which created the necessary heat for the ignition of the rubber conveyor belt.
• The officer of the watch's immediate response to being notified of an irregularity in the self‑unloading system was to stop the cargo discharging process including stopping the conveyor belts. This action, and other aspects of the shipboard response, aided the fire's development and increased the risk of damage, injury, and loss of life.
• Iron Chieftain's operators had formally identified the fire risk in the ship’s cargo self-unloading system spaces, particularly the C-Loop, as being unacceptably high 5 years before the fire due to the absence of fire detection or fixed fire extinguishing system. However, at the time of the fire, the prevention and recovery risk mitigation measures had not reduced the risk to an acceptable level. [Safety issue]
• The cargo handling spaces of specialised self-unloading bulk carriers continue to present a very high fire risk due to the inadequacy of standards or regulations for self‑unloading systems, including for conveyor belts, and dedicated fire detection/fixed fire‑extinguishing systems. This has been a factor in at least three major fires over a 25‑year period, including Iron Chieftain’s constructive total loss. [Safety issue]

Other factors that increased risk

• In the course of the shipboard emergency response to the fire, there were intermittent failures of the ship’s fire alarm system, general emergency alarm system and public announcement system. This probably hindered an effective muster of the ship's crew as it required the delegation of an officer to physically ensure that all crew were notified of the emergency.
• Iron Chieftain’s fire detection system, covering the accommodation and machinery spaces, had an unresolved anomaly, which increased the incidence of false alarms being generated. This increased the risk that crew would not react effectively to a fire alarm emergency signal.
• Although based on the belief that there was a fire in the engine room, the activation of the space's fuel quick closing valves, fuel pump shut-offs, ventilation shut-offs and CO₂ fixed fire extinguishing system rendered ship's machinery and equipment ineffective. That impacted the firefighting response by removing options such as the ability to pressurise the fire main, operate cargo hatch covers/hold gates and control the ship's stability and fuel tank levels.
• Emergency drills, generally required by regulations following a change of more than a quarter of the ship's crew, were not carried out after crew changes that occurred about 3 weeks before the fire. Furthermore, additional fire drills in the ship's self-unloading system were not carried out in accordance with the ship's safety management system requirements. Consequently, the officer of the watch at the time of the fire had not participated in a fire drill on board Iron Chieftain.
• Iron Chieftain's Emergency Contingency Plan did not include a response plan for fire in the high fire risk self-unloading system spaces. Consequently, there was no clear plan or practiced sequence of actions that could aid emergency preparedness. [Safety issue]
• Port Kembla's local emergency response plans had not adequately integrated key elements of the state's guidelines for responding to a fire on a vessel.
• The capability of Fire and Rescue New South Wales to effectively respond to a shipboard fire in Port Kembla, was limited by:
  • a lack of specialised marine firefighting expertise
  • outdated marine training for firefighters
  • relative inexperience in shipboard firefighting associated with the rarity of major shipboard fires
  • an absence of marine-specific firefighting resources and aids for use by first responders. [Safety issue]
• Regulatory safety oversight of Iron Chieftain, which comprised flag State audits, surveys and inspections had not identified safety deficiencies with respect to the ship’s fire safety, risk management, emergency preparedness and emergency response. [Safety issue]

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the marine industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.   Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Management of risk

Safety issue number: MO-2018-011-SI-01 

Safety issue description: Iron Chieftain's operators had formally identified the fire risk in the ship’s cargo self-unloading system spaces, particularly the C-Loop, as being unacceptably high 5 years before the fire due to the absence of fire detection or fixed fire extinguishing system. However, at the time of the fire, the prevention and recovery risk mitigation measures had not reduced the risk to an acceptable level.

Inadequate standards and regulation

Safety issue number: MO-2018-011-SI-02

Safety issue description: The cargo handling spaces of specialised self-unloading bulk carriers continue to present a very high fire risk due to the inadequacy of standards or regulations for self-unloading systems, including for conveyor belts, and dedicated fire detection/fixed fire-extinguishing systems. This has been a factor in at least three major fires over a 25-year period, including Iron Chieftain’s constructive total loss.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Australian Maritime Safety Authority takes steps to formally raise this safety issue with the International Maritime Organization to seek safety action aimed at addressing the risk of fire in the cargo handling spaces of self-unloading bulk carriers due to the inadequacy of the current associated standards/regulations.

Shipboard emergency contingency plans

Safety issue number: MO-2018-011-SI-03

Safety issue description: The cargo handling spaces of specialised self-unloading bulk carriers continue to present a very high fire risk due to the inadequacy of standards or regulations for self-unloading systems, including for conveyor belts, and dedicated fire detection/fixed fire-extinguishing systems. This has been a factor in at least three major fires over a 25-year period, including Iron Chieftain’s constructive total loss.

Fire and Rescue New South Wales marine firefighting capability

Safety issue number: MO-2018-011-SI-04

Safety issue description: The capability of Fire and Rescue New South Wales to effectively respond to a shipboard fire in Port Kembla, was limited by:

• a lack of specialised marine firefighting expertise
• outdated marine training for firefighters
• relative inexperience in shipboard firefighting associated with the rarity of major shipboard fires
• an absence of marine-specific firefighting resources and aids for use by first responders.

Safety recommendation description: The Australian Transport Safety Bureau recommends that Fire and Rescue New South Wales takes further action to address the limited marine firefighting capability in Port Kembla due to the lack of specialised marine firefighting expertise, experience, updated training and resources.

Regulatory oversight

Safety issue number: MO-2018-011-SI-05

Safety issue description: Regulatory safety oversight of Iron Chieftain, which comprised flag State audits, surveys and inspections had not identified safety deficiencies with respect to the ship’s fire safety, risk management, emergency preparedness and emergency response.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Additional safety action by the Port Authority of New South Wales

On 15 February 2021, in response to the ATSB draft report, the Port Authority of New South Wales advised the ATSB of the following safety action:

• Port Authority intends to update its Port Kembla Marine Oil and Chemical Spill Contingency Plan to include information related to the response to a shipboard fire consistent with the latest version of the NSW State Waters Marine Oil Chemical Spill Contingency Plan.
• Port Authority is in the process of updating its Crisis Management Plan and will ensure that the Plan integrates the details of the guidelines for responding to fires on a vessel described in NSW State Waters Marine Oil Chemical Spill Contingency Plan.
• The Memorandum of Understanding in relation to Hazardous Material Incidents on Inland and State Waters between Transport for NSW (NSW Maritime division), Fire and Rescue NSW and Port Authority of New South Wales is currently being updated and Port Authority will now seek to amend the MoU to implement the findings of the Report.
• Port Authority intends to approach Transport for NSW’s marine division to consult on amendments to NSW State Waters Marine Oil Chemical Spill Contingency Plan, including Appendix 17 to reach agreement on the appropriate circumstances in which the combat agency role should be transferred from Port Authority to FRNSW when responding to a shipboard fire. Port Authority will request that these circumstances be appropriately documented in either Appendix 17 or the appropriate subplan and internal plans and will ensure that all future exercises in relation to this issue incorporate these elements.
• Port Authority will also approach Transport for NSW to identify and correct the inconsistencies between the Regional EMPLAN and the NSW subplan to reflect the NSW State plan and subplans.

General details

Occurrence details

Date and time:	18 June 2018 – 0300 EST
Occurrence category:	Accident
Primary occurrence type:	Fire/explosion
Location:	Berth 113, Port Kembla, New South Wales
Latitude:  34º 27.580' S	Longitude:  150º 53.750' E

Ship details

Name:	Iron Chieftain
IMO number:	9047740
Call sign:	VNVD
Flag:	Australia
Classification society:	Lloyd’s Register
Departure:	Ardrossan, South Australia
Destination:	Port Kembla, New South Wales
Ship type:	Self-discharging dry bulk carrier
Builder:	Hyundai Heavy Industries
Year built:	1993
Owner(s):	Canada Steamship Lines Australia
Manager:	Canada Steamship Lines Australia
Gross tonnage:	34,422
Deadweight (summer):	50,587 t
Summer draught:	12.018 m
Length overall:	202 m
Moulded breadth:	32.30 m
Moulded depth:	19.24 m
Main engine:	Hyundai Heavy Industries 5S60MC
Total power:	11,628 kW
Speed:	13.5 knots
Injuries:	Crew – 0	Passengers – 0
Damage:	CTL (Constructive total loss)

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• ALP Maritime
• Australian Maritime Safety Authority
• BlueScope Steel
• CSL Australia
• Department of Fire and Emergency Services, Western Australia
• directly involved officers and crew of Iron Chieftain
• Fire and Rescue New South Wales
• Fire Rescue Victoria
• information from the Bahamas Maritime Authority
• investigation reports from the Marine Accident Investigation Branch, United Kingdom
• investigation reports from the Transportation Safety Board of Canada.
• Lloyd’s Register
• Minton, Treharne, and Davies
• New South Wales Police Force
• Port Authority of New South Wales
• recorded information from Iron Chieftain’s voyage data recorder (VDR)
• records, documents, manuals, and logbooks from Iron Chieftain
• Resilience NSW.

References

Australian Maritime Safety Authority, 2014, Marine Order 15 – Construction—fire protection, fire detection and fire extinction, AMSA, Canberra. Available at www.amsa.gov.au

Australian Maritime Safety Authority, 2016, Marine Order 21 – Safety and emergency arrangements, AMSA, Canberra. Available at www.amsa.gov.au

Australian Maritime Safety Authority, 2016, Marine Order 34 – Solid bulk cargoes, AMSA, Canberra. Available at www.amsa.gov.au

Australian Maritime Safety Authority, 2020, ISM Code Certification Guidelines for Regulated Australian Vessels, AMSA, Canberra. Available at www.amsa.gov.au

International Maritime Organization (IMO) 1995, International Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code) as amended, IMO, London.

International Maritime Organization (IMO) 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.

International Maritime Organization (IMO), 2020, The International Maritime Solid Bulk Cargoes Code (IMSBC Code) as amended, IMO, London.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• directly involved officers and crew of Iron Chieftain
• CSL Australia
• Fire and Rescue New South Wales
• Port Authority of New South Wales
• Resilience NSW
• Australian Maritime Safety Authority
• Lloyd’s Register
• BlueScope Steel
• New South Wales Police Force
• Transport for New South Wales.

Submissions were received from:

• Iron Chieftain’s master
• CSL Australia
• Fire and Rescue New South Wales
• Port Authority of New South Wales
• Australian Maritime Safety Authority
• Lloyd’s Register
• Transport for New South Wales.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Iron Chieftain SUL fire safety risk assessment

Risk assessment with existing control measures

Risk assessment with planned future control measures

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.