Safety summary

What happened

At 2000 Central Standard Time on 13 May 2018, the crew of a Leonardo Helicopters AW139, registered VH-YHF, departed Darwin, Northern Territory, to search for an active emergency position-indicating radio beacon (EPIRB). The crew flew under night visual flight rules with support of a night vision imaging system.

During an approach to a potential EPIRB target, smoke from nearby bushfires affected visibility and the helicopter developed an uncommanded high rate of descent. The Aircrew Officer, in the rear of the helicopter, called ‘Climb! Climb! Climb!’, and the pilot regained control with a rehearsed recovery drill. During the recovery procedure, the power demand exceeded airframe limitations. This exceedance went undetected, and the helicopter was flown on a second sortie that same evening.

What the ATSB found

The pilot entered instrument meteorological conditions during approach, and lost control of vertical speed. The helicopter descended to 31 ft above ground level during the event. Reversion to standard patter and practiced drills allowed the crew to recover the situation and avert an accident.

Two layers of protection available to the crew of the helicopter were not used. Flight instruments were not referred to in the incident approach, and a crewmember trained to support the pilot in monitoring the approach was required to be in the rear of the aircraft.

A main gearbox over-torque of 159.5 per cent occurred during the recovery. The crew could not determine the magnitude of the potential over-torque after the event. Subsequently the aircraft remained in service in a condition of uncertain airworthiness.

What has been done as a result

CareFlight has established three main controls aiming to prevent reoccurrence:

• Stabilised Approach Criteria was written into standard operating procedures, requiring an immediate go-around if the aircraft leaves a prescribed range of approach parameters.
• Controlled flight into terrain (CFIT) avoidance training was incorporated into the ground-based training syllabus.
• Improved advice on use of auto hover functions was written into aircraft handling standard operating procedures. This included a requirement that the function was not to be engaged while the helicopter was descending.

Safety message

Pilots must be aware of the human factors hazards associated with loss of visual references. Pilots can protect themselves by maintaining the use of instrument scans in approaches at night, and making use of monitoring by trained and available crewmembers.

Flight planning should include assessment of the risk of a degraded visual environment. Operators should document their minimum acceptable levels of illumination and levels of tolerable risk. Where the risk exists, predetermined responses should be readily available.

Instrument flight rules (IFR) pilots in IFR-rated aircraft should prioritise use of inadvertent instrument meteorological conditions drills and pre-planned exit routes over recovery of visual meteorological conditions.

Flight crew and engineering teams should not rely solely on indicators, or absence of indicators, to determine airworthiness. If there is any reason to suspect exceedance of aircraft limits, operators should run diagnostics to determine the airworthiness of the aircraft beyond doubt.

People have a responsibility to aid their own rescue. Up-to-date registration of an EPRIB, and correct use of an EBIRB and other signalling equipment, simplifies a rescue of people in need. Australian Maritime Safety Authority guidelines exist to help people prepare for onshore and offshore remote area travel.

The occurrence

Incident flight

On the evening of 13 May 2018 at 1943 Central Standard Time,^[1] the Rescue Coordination Centre (RCC) tasked the crew of a Leonardo Helicopters AW139, registered VH-YHF, to locate an active emergency position-indicating radio beacon^[2] (EPIRB) 38 km north-east of Darwin Airport, Northern Territory. The EPIRB had been activated within the vicinity of a waterway called Salt Water Arm (Figure 1).

Figure 1: Map showing Darwin take-off point, search area, and location of incident event

Source: Google Earth annotated by the ATSB

The area was popular with recreational anglers, so the crew of VH-YHF anticipated responding to a boating event. They also determined that such a response would likely require use of the aircraft’s winch.

The crew configured the aircraft with the pilot on night vision goggles^[3] (NVG) in the front right seat, the aircrew officer (ACO) with NVG in the rear cabin by the right hand door, and the flight nurse in the rear cabin without NVG. Lighting within the cockpit and cabin was NVG-compatible. Two steerable searchlights mounted to the front, one steerable searchlight mounted to the right side of the aircraft, a handheld light operated by the ACO, and LED light bars at the front and rear of the helicopter supported the Night Vision Imaging System^[4] (NVIS).

At about 2000, the crew departed Darwin Airport with good visibility. At that time, a five-metre tide was receding from Salt Water Arm. There was little illumination as the moon had set at 1653, and the sun had set at 1830. There was limited celestial light available through the gaps in the clouds which were forecast as scattered^[5] cumulus and stratocumulus clouds at 2,000 ft, with cloud tops to 10,000 ft. Smoke from outlying grass fires drifted across the search area below 7,000 ft, reducing visibility to 4 km in places. The crew could not easily detect the smoke due to low illumination.

As the crew descended into the search area and commenced the search, smoke became evident as the task progressed. The ACO described visibility as 5 km but dropping in and out due to large amounts of smoke. These conditions are common for the region, and recent check flights for the crew had been conducted in similar conditions.

During the flight, the beam of the search light would reflect off smoke and ash. Backscatter from the beam was affecting visibility, reducing NVG image quality, and reducing peripheral vision. As a result, the beam required frequent adjustment. The ACO contacted the RCC and advised that limited visibility may hamper the operation.

The helicopter was fitted with direction-finding equipment (DF) which enabled the crew to locate the source of a 121.5 MHz beacon signal, such as the EPIRB. The crew found that readings from the DF were erratic and unreliable. This added a level of complexity to the operation, making it difficult to locate the beacon. As a result, the crew conducted a visual search for potential targets from a safe working height of above 800 ft above ground level (AGL).

While the use of NVG allowed the crew to detect targets, the image quality was not high enough to verify the targets from this safe working height. The crew had to fly the aircraft down to 400 ft AGL to verify whether their target was one requiring rescue. The crew flew the descent to the target visually, using searchlights to ensure the approach and departure paths were clear of obstacles. The intent was to decrease rate of descent and airspeed before activating auto-hover (HOV) mode at 400 ft AGL.

At 2110:30, the crew commenced an approach from the north to a point of interest in Salt Water Arm. The pilot reported visibility on approach to the target as good to the north-west, and dark to the north and east. During this approach, the pilot lost visual references. At 2110:40, the pilot activated HOV mode. At this time, the helicopter had already developed an undesired high rate of descent (Figure 2).

Figure 2: Flight path of VH-YHF during the event

Source: Leonardo interpretation of data from the Flight Data Recorder, annotated by ATSB

At the point of activation of HOV mode, the aircraft was at 430 ft, pitched 19.7 degrees nose-up, and descending at over 1,300 ft/min with a ground speed of 14 kt. The autopilot increased collective^[6] pitch to 48 per cent to arrest the rate of descent.

Due to the lighting installed on the aircraft, and prioritisation of peripheral vision, the ACO could see the ground below and advised the pilot of a high rate of descent. The ACO provided advice twice more to the pilot before transitioning to an emergency call of ‘Climb! Climb! Climb!’ The pilot was by now receiving clear visual cues and detected a rapid rate of closure with the ground.

At 2140:46, at a height of 280 ft with a rate of descent of 1,630 ft/min, in a reversion to drilled emergency procedures, the pilot overrode aircraft automatics and used forward cyclic^[7] and collective to reverse the rate of descent. The pilot directed his attention to the attitude indicator and the picture outside. The pilot increased collective pitch to 77 per cent. At this point, the rate of descent increased to 1,952 ft/min, indicative of onset of vortex ring state^[8].

Maintaining forward cyclic, the pilot was aware of engine temperature limits and made a small reduction in collective to avoid exceeding the limits, before increasing collective again to 84 per cent.

At 2140:50, a yellow caution light illuminated and a crew alert system (CAS) message appeared on the display. Occupied with the recovery procedure, the pilot flew solely through the outside picture and the attitude indicator. The aircraft descended to a height of 31 ft AGL before attaining a positive rate of climb. As the pilot’s recovery manoeuvre ceased and control inputs returned to normal, the warning self-extinguished at 2140:57. The pilot noticed the warning, but could not read it before it extinguished.

It is likely that any further delay in conduct of the recovery drill would have led to an impact with terrain.

Return to base

The crew advised the RCC that they would end the flight and return to base. The crew landed the helicopter back at base at 2158. The pilot found that ash had accumulated on the fuselage of the helicopter, confirming flight through streams of smoke. During the flight through smoke, visibility was reduced below the visual minima.

A crew debrief took place and it was thought that a main gearbox overtorque could have occurred. There is no capacity in the aircraft for the crew to check for overtorque without the presence of an aircraft maintenance engineer (engineer). As a precaution, and as per Operations Manual requirements, the crew called a duty engineer to explain the situation and seek advice.

The duty engineer asked the crew to check the CAS system for messages. If an overtorque occurred, a white status message saying ‘maintenance’ would be present. This would signal a requirement to download and analyse data from the aircraft’s central maintenance computer (CMC).

The pilot estimated the extent of a potential overtorque to be within operational limits. The crew did not detect a maintenance message. With this information, the duty engineer advised that no maintenance activity was required.

Subsequent mission flight

Prior to the mission’s second flight, the crew thoroughly discussed the event. They developed a different strategy for the search to prevent reoccurrence, including the use of topography over the DF.

At 2254, the crew departed for the second flight to locate the source of the EPIRB transmission. The crew flew the arms of the river system at 1,000 ft using the autopilot, with the pilot flying with reference to instruments, and the ACO visually searching from the back.

The EPIRB was successfully located and noted to be in the bottom of a 14 ft metal-hulled recreational fishing boat. The boat carried two people and was in total darkness. As the vessel was unlit, the ACO could see the EPIRB flashing in the bottom of the boat. The position of the EPIRB had most likely resulted in the sporadic readout of the DF.

The helicopter crew directed a nearby Northern Territory Water Police vessel to the scene. The Water Police were then able to assist.

Detection of main gearbox overtorque

The following day, the crew related the experience to an engineer in the hangar and requested a download of the CMC data to check for potential issues. An overtorque of the main gearbox is recorded when a torque limit is exceeded. The limits for all engines operative are 110 per cent for five minutes, or 121 per cent for 5 seconds.

The engineer downloaded and analysed the data. An overtorque in excess of 125 per cent requires grounding of the aircraft, and analysis of the data by the engine and airframe manufacturers. He found that a main gearbox overtorque to 159.5 per cent had occurred during the first flight. The extent of the overtorque was such that the helicopter should not have been flown until the engine and airframe manufacturers declared the helicopter serviceable.

The engineer grounded the helicopter and sent data to the manufacturers of the engines and airframe for analysis. This meant that the crew had departed for their second flight of the previous evening in an aircraft of uncertain airworthiness.

Five days later, the engine manufacturer confirmed that the engines were undamaged and suitable for service. The helicopter manufacturer advised that the helicopter’s main gearbox was serviceable and required inspection of oil for metal contamination at 50 flight-hour intervals. The engineers carried out the necessary actions, and subsequently returned the helicopter to service.

__________

1. Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours.
2. EPIRB: Emergency Position-Indicating Radio Beacon. A distress beacon which, when activated, broadcasts a 406 MHz signal to a network of satellites, and a 121.5 MHz signal for homing in on by search and rescue assets.
3. Night Vision Goggles (NVG): A helmet mounted binocular device that intensifies ambient light, providing flight crew with improved vision at night.
4. Night Vision Imaging System (NVIS): a system of internal and external lighting, combined with night vision goggles, which provides enhanced vision to crew for operation at night.
5. Scattered clouds cover between three eights and one half of the visible sky.
6. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
7. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.
8. Vortex Ring State: an undesirable state of powered flight where the helicopter settles in its own downwash.

Context

Personnel

Pilot

The pilot had over thirty-seven years’ experience in flying helicopters. He held an Airline Transport Pilot Licence (Helicopter) and instrument rating (Helicopter), authorising him to conduct night visual flight rules^[9] (NVFR) and instrument flight rules^[10] (IFR) operations as pilot. The pilot had gained experience around the world in military helicopter operations, onshore and offshore resource support, mountain flying, search and rescue, and ambulance helicopter operations. He held a current Class 1 Aviation Medical Certificate.

Table 1: Pilot’s rotary-wing hours accumulated

Source: Pilot

The pilot had more than 100 hours’ experience in command with night vision imaging systems (NVIS) and held a grade 1 NVIS rating. The operator’s training and checking system evaluated the pilot as level 2 night vision goggles (NVG).

The pilot achieved currency with an NVIS proficiency check on 9 May 2018. Notes on file advised the pilot to seek practice opportunities in order to consolidate skills for future upgrade to a level 1 NVG pilot. The report also noted that a lack of opportunity to practice was preventing the pilot from making best use of the aircraft’s automated systems.

The pilot’s roster pattern was week-on, week-off, performing 24-hour standby while rostered on. The most recent pattern started on 09 May 2018. In the 4 days prior to the incident, the pilot had accumulated 27.3 hours of duty and 5.8 hours of flight time. Within the Operator’s Fatigue Risk Management System^[11] (FRMS), scores of 75 or less were considered consistent with safe working practices. The pilot’s score was 51. He reported feeling well and alert.

Aircrew Officer

The Aircrew Officer (ACO) had 23 years’ experience in crewing Search and Rescue (SAR) and Emergency Medical Services (EMS) helicopters as winch operator and down the wire rescue crewmember. He also held a Commercial Pilot Licence (Helicopter). His total experience in crewing helicopters was over 3,500 hours.

The ACO was NVIS and winch current, having undergone currency and proficiency flights on 10 and 12 May 2018. The Operator’s AW139 crewmembers all completed a pilot’s ground school course for the AW139. The ACO was trained and competent in front seat support and rear cabin activities. The ACO was rated as a Level 1 NVG crewmember within the operator’s system. He had over ten years’ NVIS experience, and he was part of a team that first integrated NVIS into company operations.

The ACO worked on a week-on, week-off, 24-hour standby roster. The ACO reported feeling well and rested at the time of the incident. The ACO’s score of 32 in the Operator’s FRMS supported this.

Flight Nurse

The Flight Nurse (FN) was a medical crewmember responsible for patient care, and not expected to be involved in the operation of the aircraft in flight.

Flight crew configuration

Exemption to operate with crewmember in rear cabin

The Civil Aviation Safety Authority (CASA) provided the Operator with an exemption to Supplement 60 of the AW139 rotorcraft flight manual. The exemption allowed the ACO to operate from the rear cabin of the aircraft during flight below 300ft and for landing at unimproved sites.

The Operator provided a risk analysis for landing at unprepared helicopter landing sites (HLS) under NVG to CASA in support of the exemption. For the descent and final approach phases, the identified risks were concerned with unintentional interference from the ground, obstacles, and loose objects. The helicopter manufacturer had no technical objection to the exemption on the provision that, amongst other things, the crewmember focussed on ensuring identification of obstacles.

Focussing on flight below 300 ft, the risk analysis provided for the initial exemption did not consider risks in the approach phase of flight relating to monitoring and the need for a single pilot to transition from outside goggle vision to instruments to supported peripheral vision. This exemption was later rendered unnecessary by an amendment to Supplement 60 in revision 22 of the AW139 rotorcraft flight manual on 19 October 2017. The manufacturer stated that they addressed risks during transition phase in the initial NVIS certification of the aircraft.

Climb-through

The Operator listed the responsibilities of an ACO in their operations manual as:

Under direction of the pilot assist with the operation of all aircraft equipment and systems during the conduct of VFR, NVG and IFR operations;

and

… operate the winch, dispatch, and recovery of personnel and assist the pilot in maintaining clearance from obstacles by lookout and reporting over the intercom.

Company ACOs could not carry out all of their duties from one location in the aircraft. The ACO had to climb between the front and back as operational requirements demanded. CASA’s position was that they supported the role of the ACO in the front left seat and did not support the transfer of the ACO from the front to rear of the cabin and vice versa in flight. CASA preferred operators to land for the ACO transfer through the aircraft to take place.

When responding to an emergency, the ACO would ordinarily begin the flight in the front and assist the pilot, then climb through to the rear to operate the winch as required. When an ACO used the climb-through, the company required the crew to file a report for data collection and analysis of the procedure.

On this flight, with no available landing sites on scene, and a short flight to the search area with anticipated use of the winch, the ACO began the flight in the back of the helicopter.

Aircraft information

General

Leonardo Helicopter’s AW139 is a medium-sized twin-engine helicopter powered by two Pratt & Whitney PT6C-67C engines (Figure 3). Each engine is capable of producing take-off power of 1,252 kW. Each engine produces enough power for the aircraft to climb in the event of one of the engines failing. The main gearbox’s maximum limit for power from both engines is 1,641 kW. Therefore, overtorque of the transmission can occur when a pilot demands excessive engine power with both engines operative.

VH-YHF

AW139 serial number 31108 was registered in Australia on 18 February 2008 as VH-YHF, and at the time of the occurrence had flown 3,423 hours. The helicopter was certified and maintained for IFR and NVIS operations.

The helicopter’s autopilot was a 4-axis system with enhanced 3-cue flight director (FD). The FD is capable of controlling the helicopter’s movement in the pitch, roll, yaw, and vertical axis. The installed version of the FD had auto-hover functionality (HOV) mode, yet did not offer SAR modes that can mark, return, and transition down to a selected target.

Figure 3: AW139 helicopter VH-YHF

Source: Careflight

Auto-hover

HOV mode incorporates two systems to hold the aircraft at a point in space selected by the pilot. The first system controls the pitch and roll of the aircraft to maintain a zero ground speed in all directions. The second uses the barometric altitude or the radio altimeter^[12] (RADALT) information and control of height to maintain the altitude selected by the pilot.

Aside from the panel-mounted autopilot controller, the pilot can activate both systems with the centre of the pitch/roll beep trim selector switch on the cyclic (Figure 4). With the airspeed below 75 kt, ground speed below 60 kt and altitude between 15 ft and 2,000 ft above ground level the system can be engaged. Engaging the system instructs the autopilot to make control inputs to bring the aircraft to a hover at the height showing on the RADALT at the time the pilot presses the switch. There was no vertical speed limit to engage HOV mode. The manufacturer did not intend for HOV mode to be engaged with a high vertical speed, though it did not preclude a pilot from doing so.

If engaged with a high vertical speed, the system would show as engaged and the autopilot would make adjustments necessary to attain the height designated by the pilot. This would induce a magnitude of overshoot relative to the vertical speed at time of engagement. A difference between the reference height and actual height would trigger a warning once large enough. For example, at a reference height of 500 ft, a message ‘HTLM’ appears on the PFD and ‘ALTITUDE, ALTITUDE’ sounds when the actual height passes below 430 ft.

Figure 4: Exemplar AW139 Cyclic and PFD showing HOV Mode engaged

Source: Leonardo Helicopters, annotated by the ATSB

Crew Alert System

The primary flight display (PFD) and the multi-function flight display (MFD) present instrumentation to the pilot (Figure 5). The PFD displays FD modes selected, and their status. The MFD displays engine and aircraft system data and the crew alert system (CAS). The CAS displays messages pertaining to the operation and condition of the aircraft to the crew for information and action.

Figure 5: Exemplar AW139 cockpit displays

Source: Leonardo Helicopters file photo, annotated by the ATSB

The CAS messages appear in order of priority. Red warnings appear at the top of the list, next are yellow caution messages, third are green advisory messages, and fourth are white status messages. The final line in the list is white text stating ‘END.’ Each page shows twelve lines and crew can scroll through pages. When scrolling, red warnings cannot be hidden and remain at the top of the list on each page.

A warning or caution message will show with a coloured background until acknowledged. Once acknowledged, it appears as coloured text on a black background. Some messages such as “XMSN OVTQ” (main transmission overtorque) will disappear when the condition causing them has passed. White status messages will only show on the ground with weight on wheels (Figure 6).

The “MAINTENANCE” message is significant because following exceedance of a limit such as torque, it will illuminate after landing. The presence of the “MAINTENANCE” message is a cue to an aircraft maintenance engineer (engineer) to investigate and rectify the cause of the message before cancelling the message.

Figure 6: Exemplar caution light and maintenance message on CAS

Source: Leonardo Helicopters, annotated by the ATSB.

Night vision imaging system

To improve vision during night operations, the helicopter crew utilised an NVIS. The operator was experienced in application of these technologies. They trained their own crews and offered NVIS training to other operators.

The operator’s NVIS comprises:

• AN/AVS-9 green phosphor Night Vision Goggles (NVG)
• NVG-compatible cockpit lighting
• NVG-compatible cabin lighting
• 2 x 450 W incandescent forward facing steerable search lights
• 1 x 450 W incandescent steerable search light by winch
• White flood lights at the front and back of the aircraft.

The operator mandated the use of NVIS for all visual flight rules (VFR) flights at night.

Goggle position

The human eye carries two sets of light-sensitive receptors: rods and cones. The cones are packed into the fovea, the central part of the retina responsible for focal vision. The rods populate the area of the retina used for peripheral vision. The way in which information from the focal regions and information from the peripheral regions is processed differs significantly (Miller & Tredici, 1992).

Peripheral vision is processed automatically and quickly. Humans utilise peripheral information to orientate themselves within their environment without even noticing. Focal vision requires conscious processing, which happens slowly and takes up cognitive resources (RTCA, 2001). The information delivered to the user through NVG is largely within the focal region. The cognitive resources required take away from other tasks requiring focal vision, such as interpretation of instruments (Salazar et al, 2003).

NVG offer a field of view (FOV) of 40° vertically and horizontally, much narrower than the 200° horizontally and 120° vertically most humans experience (Morawiec and others, 2007). Goggles are normally adjusted to a point where the central image is sharp, and the edge of the picture is slightly blurred yet becomes sharp when focussed upon. This puts the eyepiece approximately 25 mm from the eye.

This operator advised that they extend the NVG further away from the eye again. This reduces the FOV by a couple of degrees and increases the amount of peripheral vision available. This, in combination with copious white light, provides for increased peripheral vision when looking around the goggles below 400 ft in the obstacle environment.

This provides benefit in spatial orientation in low-level hover operations. The effect will be lost if peripheral cues become unreliable and obscure the target, such as happens with backscatter from obscurants like smoke.

White light

The use of white light is fundamental to this operator’s NVIS usage strategy. NVG-friendly^[13] searchlights do not help in obstacle clearance as the NVG do not detect the light reflected by obstacles in the vicinity. White light (detectable by NVG) is amplified by the goggles and provides a clear image of where obstacles are. The crew moves the lights in a ‘scan and pause’ pattern with a wide swath either side of the planned approach and departure paths looking for obstacles.

The combination of peripheral vision and white light likely aided the ACO in his assessment of rate of closure and enabled his timely use of emergency phase Crew Resource Management (CRM).

NVIS approach procedure

Overhead the HLS or point of interest, the pilot marks the target on the GPS. The pilot then flies a circuit at 1,000 ft to set up an approach to the spot. Since the visual acuity afforded by the goggles does not provide ground cover detail until a height of 400 ft, the pilot must use instruments to monitor the progress of the aircraft, as per normal night flight procedures. The company operations manual highlights three critical instruments for the initial stage of the approach:

• attitude indicator, to avoid incorrect attitude adversely affecting airspeed and rate of descent
• vertical speed indicator, to make up for the reduced visual cues for rate of descent
• radio altimeter, to incorporate a visual and audible warning that is set at 400 ft as a defence against unexpected rates of terrain closure

The pilot manually flies to a datum point of 400 ft above ground level (AGL) to attain the visual acuity required to identify the target. It is common to come to a hover at 400 ft to complete the reconnaissance and crew brief. The pilot can select HOV mode to pause. If there is a need to descend to winching height, the crew scans the approach and departure paths with searchlights using a ‘stop, scan, move’ process.

Once clear, the crew agrees to continue and the pilot eases the aircraft forward and down with the autopilot. ACO and pilot will work together to bring the aircraft to the best hover reference.

Meteorological information

During the shift, the pilot monitored weather reports and weather forecasts from sources at Darwin and surrounding airports, and the Bureau of Meteorology (BoM). The Aerodrome Forecast (TAF) for Darwin airport, valid for the duration of the flight, forecast wind as 6 kt from the south‑east, visibility of 10 km or greater, nil significant weather, and nil significant cloud below 5,000 ft. The aerodrome report matched the forecast precisely with the exception of showing wind to be 5 kt.

The BoM issued a Graphical Area Forecast (GAF) at 1332 Central Standard Time (CST), which carried a validity from 2030 CST for six hours. The planned operation was within area B2, and the operations were close to the boundary with B1. The GAF forecast scattered cloud with base 2,000 ft and tops to 10,000 ft in the area of B1. The forecast for the area B2 was visibility over 10 km reducing to 5,000 m with isolated areas of smoke below 7,000 ft. The crew reported that some of the conditions associated with B1 existed in their area of operation.

At 1923 CST, BoM published a new GAF. The new GAF showed visibility of 10 km reducing to 4,000 m with isolated areas of smoke below 7,000 ft in B2. Pilots utilising NVG must maintain visibility of 5,000 m at or above 500 ft above terrain or obstacles (Civil Aviation Order 82.6). In areas of smoke, visibility could be expected to be below that required for VFR flight at night.

Environmental conditions

On the night of the incident, there was very little celestial illumination. The moon had set at 1653 CST, and the sun had set at 1830 CST. The only light was starlight. Clouds obscured much of the starlight available.

Grass fires had been burning to the southeast of the region for several days. Smoke from the outlying grass fires drifted across the search area below 7,000 ft, reducing visibility in places. The operations manual mentioned smoke as a common cause of loss of visual reference, and pilots were required to memorise loss of visual reference drills.

The crew reported that these conditions had prevailed for a week. Training notes from a flight three days prior described similar conditions. The report stated:

…this flight was conducted on an especially difficult NT typical night – no moon, very low illumination, and smoke contamination.

Where operationally viable, the crew flew the helicopter above the smoke inversion, which they reported to be at around 1,000 ft.

Risk management of deteriorating weather and loss of visual references

The operator’s risk management profile recognised the risk of deteriorating weather and loss of visual references during a SAR operation. Among the potential consequences was loss of control leading to an aircraft accident. The management of the risk included controls for prevention of an occurrence, and for recovery should the event occur.

Prevention controls

Documented controls for the prevention of loss of visual references were:

• Training and checking, to ensure that crews have relevant experience of similar conditions, all crew know how to assist in the approach and landing phase, and that procedures are being correctly followed.
• Maintenance of good CRM, to ensure effective mission management and decision making aboard the aircraft.
• Keeping the ACO current to assist the pilot with management of the flight.

Recovery controls

Recovery controls covered four aspects of operation:

• Equipment fit, ensuring that the aircraft is appropriately equipped and has a functioning RADALT and Attitude Indicator.
• Sound knowledge of procedures and limits for visual illusions and inadvertent instrument meteorological conditions (IIMC).
• Crew preparedness: Use of simulator training to ensure crews have exposure to implementing correct technique in recovery procedures.
• Crew Resource Management: Ensuring unambiguous and timely communication in situations requiring urgent action.

Beacon activation

Activating an emergency position-indicating radio beacon (EPIRB) begins a distress signal transmission on the 406 MHz frequency, which is detected by satellites. The transmission contains a code that identifies the registered owner of the EPIRB in a database. The Rescue Coordination Centre (RCC) can use the registration details to source information on the activation of the beacon, and contact the owner or a nominated emergency contact.

In this case, the EPIRB belonged to a Queensland-registered vessel, which was sold some time before without re-registration of the EPIRB. As a result, the RCC had no current contact details or information for the current owner of the EPIRB.

EPIRBs in Australia also transmit on the 121.5 MHz frequency. Search and Rescue Assets carry direction-finding (DF) equipment to home in on 121.5 MHz signals. When the beacon is correctly deployed, the DF shows the crew the direction the signal is coming from.

Similar occurrences

AO-2007-028

On 22 July 2007, the crew of a Bell 412 were searching for the source of an EPIRB transmission. The pilot was IFR-rated and the aircraft IFR-equipped. The crew were operating on a dark night with searchlights without NVG. There was smoke from active bushfires in the area.

During the approach, the pilot lost visual references due to the haze from smoke and dust in the atmosphere. The helicopter entered a high rate of descent. The aircrew officer called ‘zero airspeed.’ The pilot initiated recovery actions and the main gearbox was over-torqued in the recovery.

There was a landing site available and the pilot continued the approach from 200 ft AGL and inspected the helicopter after landing. The Bell 412 had a physical indicator that clearly indicated to the crew that overtorque had occurred.

AO-2009-077

In December 2009, the crew of a Bell 206L was conducting aerial work on a fire ground. The pilot was not IFR-rated and helicopter was not IFR-equipped. On take-off, the helicopter entered low cloud. The pilot lost control and the aircraft collided with the ground; the pilot was seriously injured and the passenger was fatally injured. There was no option for the pilot to conduct an IIMC drill to stabilise the aircraft and attain a safe profile.

AO-2016-160

On 21 October 2016, the crew of a BK 117-C2 were returning to base from carrying out an EMS mission. The pilot was IFR-rated and the aircraft was IFR-equipped. The flight was conducted under NVFR with NVIS. Conditions were marginal, and on departure, the helicopter entered low cloud.

The ACO declared loss of visibility on take-off. The pilot had poor visibility ahead yet could see well to the right. The pilot thought visibility would improve as they passed ground lighting that was reflecting in raindrops on the canopy.

The visibility did not improve, and the pilot slowed the aircraft to maintain visual meteorological conditions. The low-speed manoeuvre resulted in an undesired aircraft state and a terrain awareness warning activated. The pilot conducted an IIMC drill, restabilised control, and continued the flight before landing safely.

Aeromedical flights in the United States

In an analysis of aeromedical flights in the US, Aherne and others (2016) found that between 1995 and 2013, the US aeromedical industry had 32 fatal accidents resulting in 100 deaths. These flights were all single-pilot operations at night. All flights were operated under VFR, and two thirds of the fatal accidents occurred in instrument meteorological conditions (IMC).

__________

9. Night Visual flight rules (NVFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going, at night.
10. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
11. Fatigue Risk Management System (FRMS): defined by ICAO as "a data-driven means of continuously monitoring and maintaining fatigue related safety risks, based upon scientific principles and knowledge as well as operational experience that aims to ensure relevant personnel are performing at adequate levels of alertness".
12. Radio Altimeter: a device that detects phase shift between a transmitted and a reflected radio signal, to calculate the height of the aircraft from terrain directly below it. Also known as Radar Altimeter.
13. NVG-friendly: a light system that excludes frequencies detected by the NVG. The intent is for a light to be available for crews that does not dazzle the NVG wearer.

Safety analysis

Introduction

During an approach to a potential search and rescue target, smoke from nearby bushfires affected the visibility for the flight crew. The helicopter developed an uncommanded high rate of descent, and the aircrew officer in the rear alerted the pilot, at which point a recovery was enacted. The recovery manoeuvre resulted in an airframe limitation exceedance, which went undetected for the subsequent flight.

This analysis will examine the operator’s risk management, degraded visual environments, single pilot operations, and airframe limitation exceedance management.

Operator’s risk controls

On this occasion, prevention controls failed and recovery controls worked to save the aircraft and crew. There were, however, gaps in the implementation of all of the documented controls:

• Training and checking achieved the aim of creating relevant experience, yet an identified limited practice opportunity reduced efficacy.
• Crew resource management (CRM) lapsed in a missed announcement of loss of visual references. CRM was, however, restored to good effect in recovery.
• The aircrew officer (ACO) was trained yet not positioned to assist the pilot in managing the approach.

There were no preventative controls that helped crews to define limits of visibility beyond the description of visual flight rules (VFR) minima.

The operations manual stated:

Illumination levels are significantly affected by moon position and strength, cloud presence, and cultural lighting and during NVG operations; illumination levels have a profound effect on the ability of the NVG to clearly discern terrain at distance. Visibility is also affected by the usual day time issues of dust, snow, moisture, bushfire smoke and other atmospheric obscurants.

However, the operations manual offered no guidelines on interpretation of factors affecting visibility or definition of acceptable limits. This meant the crew had to interpret marginal conditions during operations and decide if the minima were sufficient. This meant that the organisation did not set its own tolerance for risk in this regard.

During the event, CRM, the well-rehearsed recovery drill, and use of the attitude indicator were all vital in recovering control of the aircraft. The documented and implemented recovery controls worked as intended.

Contribution of night vision imaging system

Studies have shown that night vision goggles’ (NVG) performance can lead pilots to revert to a daytime model of operation (Rash, 2010), leading them to overlook the threats and complexities of operating with NVG. The operator’s operations manual clearly reminded crew that NVG does not turn night into day, and that the use of NVG carries limitations and risk.

Low-contrast Terrain

The search area was an area of low-contrast terrain for night vision imaging systems (NVIS) operations. This meant that elements of the terrain reflected similar amounts of celestial light, creating a low-quality image in the NVG. This lack of detail reduced visual cues. The reduction in visual cues most likely led to difficulty in perceiving the aircraft’s attitude and estimation of terrain clearance (Parush et al., 2011).

Obscurants

Airborne particles affect the image that NVG produce. The cues that would normally be relied upon for loss of visual meteorological conditions (VMC)^[14] may not be present. Operating unaided, light sources begin to disappear as obscurants increase. Under NVG, as obscurants reduce the light energy reaching the goggles, NVG will continue to amplify the light signal, disguising the worsening visibility (see CAAP 174-01 11). There will be steady reduction in image quality outside of the bright spots as signal to noise ratio reduces. Scintillation^[15] in the image will occur.

Sighting pinpoints of bright light over long distances does not mean that visibility is in excess of 5 km. Visibility must be measured by the distance detail can be seen on the ground. If a pilot using NVG can see lights but no ground detail, they may be in or very close to instrument meteorological conditions (IMC).^[16] An early decision to use a recovery drill if visual references are lost is also vital to ensure entry into IMC does not develop into a loss of control or controlled flight into terrain.

Degraded visual environment

Conditions of degrading visibility create ambiguity. This ambiguity can stall decision-making, as two contextually different situations are faced (Orasanu and others, 2001). Either the approach continues and the target is assessed, or the approach is aborted and the mission is delayed.

Pilots rely on appropriate visual cues to assess quickly and accurately the aircraft’s current and future situation. Darkness, even while utilising a NVIS, reduces availability of these cues. No one is immune to these phenomena and strict adherence to an instrument scan on night approach is the primary protection available.

Pilots tend to underestimate the likelihood of loss of control and overestimate their ability to continue to control the aircraft if visual references are lost (Wiggins and others, 2012). The cues for IMC are an absence of those for VMC. The search area for cues to resolve the ambiguity is external to the aircraft, and as such, attention can be drawn outside (Summerfield & Egner, 2009).

Humans also often incorrectly believe that changes will be easy to detect in their environment. Unless someone observes a change while it is taking place, there is a good chance it will not be picked up (Wickens & McCarley, 2008). While searching outside for cues, changes on instruments can be missed. These missed changes can lead a pilot to believe that their knowledge of their position and trajectory in space is accurate. This belief leads to a reduction in the search for new information or information to the contrary (Wickens & McCarley, 2008).

Above 400 ft, the approach should be predominantly made with reference to instruments (see CAAP 174-01 D.3). The pilot was primarily using goggle vision and looking outside. The narrow field of view of the NVG’s requires a demanding and deliberate scan pattern to integrate the outside with instruments. As the pilot slowed to below 45 kt with reducing visual cues, the picture outside was not giving enough information to manage the closure rate of the aircraft. This resulted in a loss of the ability to recognise, with any accuracy, the aircraft’s position and trajectory.

Single-pilot operation

Monitoring is a fundamental tool to boost threat and error management (Flight Safety Foundation, 2014). Furthermore, inadequate monitoring is related to a high number of approach and landing accidents. While there is a clear benefit to multi-crew operations, there is no requirement for multi-crew in Australian search and rescue (SAR), and emergency medical services (EMS). SAR/EMS Operators in Australia tend to perform reduced crew flight operations, whereby extra crewmembers are called upon only for periods of vulnerability.

Crew in the back of an AW139 cannot hear alarms from the cockpit. The 400 ft warning from the Radio Altimeter (RADALT) and the 150 ft warning from the aircraft are only available to front seat crew. The aircraft descended through 400 ft at 1,430 ft/min. The pilot resumed manual control at the time of the emergency climb call as the aircraft passed through 280 ft, 3.5 seconds later.

Had there been a second person in the cockpit monitoring the approach, their first indication of a loss of visual reference, if not announced by the pilot, would most likely be an unusual combination of attitude and vertical speed. The aircraft had developed an unusually high 900 ft/min rate of descent 12 seconds before passing through 400 ft. This information may take a monitoring Aircrew Officer (ACO) a second or two to process. Once processed, however, the aircrew officer (ACO) is in a position to call for a go-around, and to provide accurate information to the pilot regarding the aircraft state much sooner in the sequence.

While facing a high risk of encountering a degraded visual environment, the requirement to have the ACO in the rear cabin for winch operations degraded the crew’s defences against loss of control. The addition of another trained crewmember would be an ideal risk control for operations in potentially degraded visual environments.

Caution and maintenance messages

There is no option for the crew to review caution messages once the message has self‑cleared, or to interrogate the system to discover the extent of any exceedance. As the main transmission torque limit exceedance message (XMSN OVTQ) was missed because it appeared during a time of high workload in flight, the crew could not know of the nature and extent of the exceedance without the support of an aircraft maintenance engineer (engineer).

The crew and the engineer who downloaded the data the following day reported that no maintenance message was detected on the crew alert system (CAS). Analysis of the central maintenance computer (CMC) log showed that eight minutes before the incident flight, a maintenance message activated for 41 seconds. A maintenance message again illuminated four minutes after landing for 31 seconds until shutdown.

The crew reported that the maintenance message was overly generic and related to a host of issues, ranging from critical to inconsequential. The only way to determine the meaning of the message was for an engineer to access the CMC through a laptop. Given the remote locations and 24‑hour nature of operations, engineer access was often impractical, and some telephone diagnosis had to take place.

Additionally, a software update had previously caused issues by instructing the aircraft that equipment it did not have was fitted. As a result, numerous maintenance messages related to the failure of the non-existent equipment were seen. This nuisance message issue was resolved 6 months prior to the event.

These nuisance alerts and generic nature of the message could combine to dilute the significance of the maintenance message and reduce the likelihood that crews would seek out and respond to genuine alerts.

Automatic hover mode use

The autopilot’s automatic hover (HOV) mode fitted to the helicopter could be engaged while the helicopter had a high rate of descent. If this system was not explicitly understood, the pilot may believe that HOV mode had adequate control of the aircraft upon activation. It would display as engaged even though it could be subject to a considerable overshoot, outside of the system’s capacity to recover before impact with terrain. At the height engaged, the mismatch between reference height and actual radar height would have triggered a PFD message ‘HTLM’ and an aural callout of ‘ALTITUDE, ALTITUDE’ after about 2.5 s, as the aircraft passed through a point between 39 ft and 70 ft below the reference height. The pilot input came 4.2 s after engagement of automatic hover. Without the correct mental model of HOV mode operation, time taken to interpret autopilot performance may have delayed manual recovery actions.

Beacon registration and placement

When the vessel was located, the crew saw the emergency position-indicating radio beacon (EPIRB) laying in the bottom of the boat and not deployed as per Australian Maritime Safety Authority guidance. This resulted in a scattered signal and created inaccuracies in the operation of the Direction Finder (DF). The crew could not resolve the direction of the beacon.

The lack of accurate registration details and sporadic output of the DF caused distraction to the crew and increased their time to find the target. The result for the crew was that they were required to identify a number of targets and make approaches to them for visual identification. This increased the complexity and time taken to complete the operation.

Figure 7: Correct EPIRB placement following activation

Source: Australian Maritime Safety Authority
__________

14. Visual Meteorological Conditions (VMC): an aviation flight category in which visual flight rules (VFR) flight is permitted – that is, conditions in which pilots have sufficient visibility to fly the aircraft while maintaining visual separation from terrain and other aircraft.
15. Scintillation: rapid changes in brightness at random points which to the viewer looks like a sparkling effect across the image.
16. Instrument meteorological conditions (IMC): weather conditions that require pilots to fly primarily by reference to instruments, and therefore under Instrument Flight Rules (IFR), rather than by outside visual reference. Typically, this means flying in cloud or limited visibility.

Findings

From the evidence available, the following findings are made with respect to the loss of control of a Leonardo Helicopters AW139, registered VH-YHF, on 13 May 2018, and the subsequent release of the aircraft without a required inspection. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During the search for a transmitting beacon, the helicopter crew planned to approach to a hover near a target. However, low celestial illumination and drifting smoke created a high risk of encountering a degraded visual environment. This resulted in a loss of visual references on approach.
• During the approach to hover in a degraded visual environment, searching outside for visual cues drew the pilot’s attention away from the flight instruments. This resulted in flight instruments not being referenced when they were needed.
• The required position of the aircrew officer in the rear of the helicopter prior to descent negated the benefit of having a trained and competent crewmember to assist the pilot, resulting in a degraded monitoring capability in the approach to hover.
• While on approach in a degraded visual environment, without the protections of flight instrument use or monitoring, the helicopter entered an uncommanded, undetected high rate of descent, resulting in a transmission overtorque during recovery.

Other factors that increased risk

• Auto hover had no design limit on vertical speed for engagement, which permitted overshoot following engagement with high rate of descent.
• As the aircrew could not confirm the existence of an exceedance, and a maintenance message was not detected on the Crew Alert System, the aircraft was operated despite requiring an inspection.

Other findings

• Application of good Crew Resource Management and practiced recovery techniques supported the crew in restoring control.
• The emergency position-indicating radio beacon was not registered to the current owner, and was incorrectly placed in the boat. The placement scattered the beacon's signal, leading to loss of accuracy in direction-finding equipment. As a result, mission complexity and time taken to rescue were increased.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot and crew
• Careflight
• Aviation Specialities Unlimited
• the Bureau of Meteorology
• Airservices Australia
• Leonardo Helicopters
• the Civil Aviation Safety Authority.

References

Aherne BB and others, 2016, Pilot Domain Task Experience in Night Fatal Helicopter Emergency Medical Service Accidents, Aerospace Medicine and Human Performance. 87(6). 550-556.

Arthur W and others, 1998, Factors That Influence Skill Decay and Retention: A Quantitative Review and Analysis, Human Performance. 11(1), 57-101.

Australian Transport Safety Bureau, 2004, ASR B2004/0152, Night Vision Goggles in Civil Helicopter Operations

Bailey RE and others, 2017, An Assessment of Reduced Crew and Single Pilot Operations in Commercial Transport Aircraft Operations, 2017 IEE/AIAA 36th Digital Avionics Systems Conference, St Petersburg

Biggs AT and others, 2015, Examining perceptual and conceptual set biases in multiple-target visual search, Atten Percept Psychophys. 77. 844-855.

Civil Aviation Authority, 2013, CAP 739, Flight Data Monitoring

Civil Aviation Safety Authority, 2017, CAAP 174-01 v2.1, Night vision imaging – helicopters

Dismukes RK & Berman B, 2010, Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail, National Aeronautics and Space Administration, Moffett Field

Ersting J & King P, 1995, Aviation Medicine, 2nd ed., Butterworth-Heinemann Ltd, Oxford.

Flight Safety Foundation, 2014, A Practical Guide for Improving Flight Path Monitoring, Washington.

Flight Safety Foundation, 2018, Position Paper: Pilot training and competency, Alexandria.

Miller RE & Tredici TJ, 1992, Night Vision Manual for the Flight Surgeon, Armstrong Laboratory, AL-SR-1991-0002

Morawiec G, Niall KK & Scullion K, 2007, Distance estimation to flashes in a simulated night vision environment, Defence R&D Canada, TR 2007-143

Orasanu J & Martin L, (1998). Errors in aviation decision making: A factor in accidents and incidents. In Proceedings of the Workshop on Human Error, Safety, and Systems Development. 100-107.

Orasanu J, Martin L & Davison J, (2001). Cognitive and contextual factors in aviation accidents, in Salas E and Klein G (Eds.) Linking expertise and naturalistic decision making, Lawrence Erlbaum Mahwah NJ. 209–226.

Parush A, Gauthier M, Arseneau L & Tang D, (2011). ‘The Human Factors of Night Vision Goggles Perceptual, Cognitive, and Physical Factors’, Reviews of Human Factors and Ergonomics. 7. 238-279.

Previc FH & Ercoline WR, 2004, Spatial Disorientation in Aviation, American Institute of Aeronautics and Astronautics, Inc., Reston.

Rash CE, 2010, ‘Lighting Up the Night’, Aero Safety World. August 2010. 14-18.

Robson D, Night Flight, 2008, Aviation Theory Centre, Cheltenham.

RTCA 2001, Concept of Operations: Night vision imaging systems for civil operators, RCTA/DO-268, RTCA, Washington, D.C.

Salazar G and others, 2003, Civilian use of night vision goggles, Aviation Space and Environmental Medicine. 74. 79-84.

Summerfield C & Enger T, 2009, Expectation (and attention) in visual cognition, Trends in Cognitive Sciences. 13(9). 403-409.

Wickens CD & McCarley JS, 2008, Applied Attention Theory, CRC Press, Boca Raton

Wiggins MW and others, 2012, ‘Characteristics of pilots who report deliberate versus inadvertent visual flight into instrument meteorological conditions’, Safety Science. 50(3). 472-477.

Wiggins MW and others, 2014, ‘Cue-utilisation typologies and pilots’ pre-flight and in-flight weather decision-making’, Safety Science. 65. 118-124.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, the Bureau of Meteorology, Leonardo Helicopters, the crew of VH-YHF, engineers for VH-VHF, and Careflight.

Submissions were received from the Civil Aviation Safety Authority, the Bureau of Meteorology, Leonardo Helicopters, the crew of VH-YHF and Careflight. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A: Flight data

Figure 8: Incident flight data

Source: Operator / Leonardo Helicopters, annotated by the ATSB

Figure 9: Incident flight data

Source: Operator / Leonardo Helicopters, annotated by the ATSB

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 15 May 2018, at 1903 Eastern Standard Time, a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.

What the ATSB found

The ATSB found that the pilot, who was conducting his first night training flight, likely became spatially disorientated during a go-around manoeuvre, which resulted in a loss of control at low level and collision with terrain.

The flight instructor did not intervene to take control of the aircraft during the go-around manoeuvre, because she was not aware the pilot had become spatially disorientated and was accustomed to directing the pilot to correct control problems. Inconsistent with Civil Aviation Safety Authority guidance, the instructor, who had previously instructed the pilot for his private instrument rating, did not provide a night flying demonstration before directing the pilot around the circuit.

Safety message

It is important for flight instructors to provide a demonstration when introducing a pilot to a new flight sequence or new flight environment. Time spent demonstrating the key points of a new sequence or environment will usually improve the learning process by ensuring that the development of a new skill is supported and preceded by knowledge and understanding from experience.

The flight instructor reported that for the delivery of future initial night flying training, she would conduct either a separate session of daytime flying training circuits prior to night, or deliver the training as day-into-night circuit training. She also commented that, prior to teaching night flying, flying training organisations should consider conducting refresher training in unusual attitude recoveries, irrespective of a pilot’s level of experience and qualifications.

The occurrence

On 15 May 2018, at 1903 Eastern Standard Time,^[1] a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.

The pilot held a private instrument rating and the accident flight was the pilot’s first training flight for a night endorsement to be added to his rating.^[2] The instructor arrived at the hangar in the evening, just as the pilot was completing his pre-flight inspection of the aircraft. They completed the inspection together and then the instructor delivered a night flying brief to the pilot. The briefing included the physiological effects of the night environment, procedural differences for the night circuit, and the instrument and visual sections of the night circuit, which included the need to transition onto instruments on rotation during take-off.

The pilot and instructor boarded the aircraft and completed all the checklist items on the multi‑function display (MFD). The wind appeared to be light and variable and they selected runway 11 for the circuits. The pilot activated the runway lighting while taxiing,^[3] which also provided precision approach path indicator (PAPI) lighting.^[4]

The instructor directed^[5] the pilot throughout the first touch-and-go^[6] circuit to runway 11, which she considered was flown to a good standard with the pilot responding to her direction. On the second circuit, at about 500 ft above ground level on approach to land, the pilot and instructor noted the approach was too steep. The pilot, with direction from the instructor, corrected the approach and they both observed two‑white and two-red PAPI lights on short final approach, which indicated they were on the correct approach path. The pilot flared the aircraft a ‘little high’ for the touchdown, and the aircraft bounced twice. The pilot elected to go-around and applied full power before touching down again.

When full power was applied, the aircraft pitched^[7] up. As the pilot was attempting to transition his scan onto the instruments, the instructor, whose attention was on the attitude indicator,^[8] directed him repeatedly to level the wings—‘wings level’. The pilot observed the runway lights disappear off to the right and felt the aircraft was in a roll^[9] as he was trying to focus his attention on the attitude indicator.^[10] Following a review of the ATSB’s draft investigation report, the pilot also reported that he manipulated the flight controls in an attempt to recover the aircraft. Shortly after, the aircraft collided with the ground, struck a fence and came to rest inverted.

The pilot reported that he ‘kicked the pilot’s door window out’ to exit the aircraft, at which stage the wings were alight and a grass fire had started.^[11] He then pulled the instructor out of the wreckage, who had lost consciousness after becoming disorientated while looking for the emergency egress hammer.^[12] Emergency services located at the airport immediately responded to the accident. Figure 1 shows the wreckage site with reference to runway 11. Weather conditions were not considered a contributing factor to the accident.

Figure 1: VH-PDC wreckage

Source: ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. A pilot who has a private instrument rating is authorised to operate at night under the instrument flight rules only if that pilot holds a night private instrument endorsement.
3. Pilot activated lighting (PAL) is activated by a pilot keying a series of transmissions, within a specified timeframe, on a specified radio frequency.
4. PAPI is a visual aid that provides pilots with guidance on acquiring and maintaining the correct approach path to a runway. The system consists of four side-by-side lights positioned next to the runway. When the aircraft is on the desired approach path (3°), two red and two white lights will be visible. More than two red lights indicates the aircraft is low on approach, and more than two white lights indicates the aircraft is high.
5. Airborne instruction is based on a building block approach using demonstrate, direct then monitor. The instructor flies the sequence in demonstrate, provides verbal commands to the student in direct and observes the student’s progress in monitor.
6. A procedure whereby an aircraft lands and takes off without coming to a stop.
7. Pitching: the motion of an aircraft about its lateral (wingtip-to-wingtip) axis. Increased thrust over the tailplane will increase the tailplane down force and pitch the nose upward.
8. Attitude indicator is a primary flight instrument, which displays the aircraft pitch and roll against an artificial horizon.
9. Rolling: the motion of an aircraft about its longitudinal axis.
10. The Cirrus SR22 aircraft’s propeller rotates clockwise, as viewed from the pilot’s seat. Therefore, an increase in power will increase the engine torque reaction and propeller slipstream. Without pilot input, the natural response from the aircraft is to roll and yaw (motion of an aircraft about its normal axis) to the left.
11. The fence was electrified, but it was not determined if the fence or the engine was the ignition source for the fire.
12. An eight-ounce ball-peen type hammer is located in the centre armrest. If the cabin doors are jammed or inoperable, the hammer may be used to break through the acrylic windows.

Context

Pilot information

The flight instructor held a valid Commercial Pilot Licence (Aeroplane), a Grade 1 flight instructor rating, an instrument rating and a night visual flight rules rating. She had a total flying experience of about 4,200 hours and last completed a flight review on 3 December 2017.

The pilot held a valid Private Pilot Licence (Aeroplane) and a private instrument flight rules rating. He last completed a flight review on 11 March 2017 (private instrument rating), had accrued about 500 hours on Cirrus aircraft, and about 50 hours of instrument flight time. The pilot had conducted the majority of his training and subsequent flying from Orange Airport, where his aircraft had been hangered.

Closed-circuit television footage

Closed-circuit television footage from Orange Airport depicted the aircraft rolling left at a low height above runway 11 before impacting the ground on the north-east side of the runway at 1903. A small fire ensued after impact, followed by deflagration of the fuel vapour about 7 seconds later. About 9 minutes later, the CAPS^[13] rocket fired. Figures 2, 3 and 4 depict the initial roll of the aircraft, deflagration of the aircraft fuel vapour and firing of the CAPS rocket.

Figure 2: VH-PDC in left roll

Source:  Orange City Council, annotated by the ATSB

Figure 3: Deflagration of fuel vapour

Source:  Orange City Council

Figure 4: CAPS rocket

Source:  Orange City Council, annotated by the ATSB

Aircraft information

Electronic stability and protection

Before take-off, the pilot checked the aircraft’s autopilot and then switched it off. When the autopilot is switched off, the aircraft’s electronic stability and protection (ESP) system is operational. The ESP system automatically activates the autopilot servos to recover the aircraft from excessive roll and pitch attitudes.

The ESP roll protection activates at 45° roll angle, reaches a maximum stick force at 50°, and disengages when the roll angle reduces to 30°. The ESP pitch protection engages at 17.5° nose up, reaches a maximum stick force at 22.5° and disengages at 12.5°. Although the ESP uses the autopilot servos to drive the controls, the pilot retains the ability to override the system.

Recorded data

VH-PDC carried a Garmin G1000 avionics package, and a Recoverable Data Module (RDM). The G1000 is capable of recording various parameters to a secure digital (SD) card, installed on the upper slot of the MFD. The same information is recorded to the RDM, which is an impact and fire resistant unit,^[14] installed on the vertical fin spar. The RDM and MFD modules were removed from the aircraft for examination by the ATSB.

The RDM was recovered from the severely fire damaged fin. The rear portion of the module was exposed to a high temperature and showed external heat damage. Disassembly of the crash hardened enclosure to access the data storage components revealed extensive fire damage to the memory devices. No data was recovered from this device.

Initial observations of the MFD SD card slots revealed they were substantially fire damaged and retained two SD cards; the top slot contained the data logging card, the bottom slot contained the Garmin database card. To access the cards, the MFD was disassembled, and the circuit board holding the two cards was removed. The data logging card was found to be substantially damaged (Figure 5). The encapsulated memory device was removed from the data logging card and cleaned. The data logs were then extracted with a modified SD card reader. A total of 241 flight logs were recovered, including the accident flight (Figure 6).

Figure 5: Data logging SD card

Left: Removed MFD slot with data logging SD card. Right: removed data logging card with card memory identified. 
Source:  ATSB

Figure 6: Recovered accident flight data

Source:  ATSB

The recovered flight data indicated that after touchdown, power was initially increased to about 45 per cent (19:02:15) and a slight left roll initiated. Power was then advanced to about 90 per cent (19:02:18) and the left roll developed to a peak value of -52° (19:02:23) with a pitch attitude of +20° (nose-up)^[15] and airspeed varying from 56–69 kt.^[16] The pitch attitude then increased to a peak value of +29° before lowering to +7° as the aircraft rolled right to a peak value of +27° at a height of about 100 ft above the runway (19:02:25).

The aircraft collided with the ground followed by the airport boundary fence and came to rest inverted during the period 19:02:26–30.^[17] The final track at initial impact was about 60° left of the runway centreline. During the accident sequence, the rate of heading change to the left developed commensurate with the angle of left roll, and the recorded normal and lateral G‑accelerations^[18] were minimal.^[19]

Wreckage information

With the exception of the right rudder cable, no mechanical defect was found that could have prevented the normal operation of the aircraft. The right rudder cable was found attached to the rudder, but the forward end was found with a failure near the connection to the rudder pedals. The cable was removed from the wreckage for examination by the ATSB. A preliminary examination determined it did not fail from fatigue. The aircraft’s flight data demonstrated the rudder was operational during the accident sequence. On that basis, it was concluded that the rudder failure observed was a result of the impact, and no further examinations were conducted on the rudder cable assembly.

Survival factors

The aircraft was fitted with a composite roll cage within the fuselage structure to provide roll protection for the occupants. The front seats were each fitted with a four-point inflatable restraint system with an inertia reel lock. Despite coming to rest inverted after striking the ground at about 60–70 kt, the pilot and instructor reported that they found themselves uninjured, but could not open the doors with the aircraft inverted.^[20] The inflatable restraints (air bag style system) did not activate, but this was considered likely to be due to the gradual level of deceleration.

The iBrace Survivor Questionnaire^[21] was completed for the pilot and instructor with the following results:

• The pilot was able to evacuate unassisted from the aircraft while it was filling with smoke by kicking out a window. He then pulled the instructor out of the burning wreckage after seeing her collapsed inside. He suffered from third-degree burns to 7 per cent of his body.
• The instructor was unable to evacuate unassisted from the aircraft after she became disorientated in the dark, smoke filled environment, which led to a loss of consciousness. She suffered from first and second-degree burns and smoke inhalation injuries, which required her to be intubated.

Closed-circuit television footage identified an ambulance crossing the runway towards the accident site about 3 minutes after impact. In addition, an emergency medical service helicopter was located at the airport with the crew on duty at the time of the accident. They transported the pilot and instructor to Sydney for treatment.

Additional information

Spatial disorientation

The pilot reported that the aircraft pitched up when he applied power for the go-around and that he observed the runway lights disappear off to the right. He felt that the aircraft was in a roll while he was trying to focus his eyes on the attitude indicator as the instructor was directing him to level the wings. He commented that without enough right rudder the aircraft will ‘pull to the left’ [when applying additional power] and that it is normal to apply right rudder, but that ‘it was pitch black’.

There is a small village, Spring Hill, located upwind of runway 11, but the instructor reported that it was not large enough to produce an illuminated horizon below about 200 ft above ground level. She reported that on the night of the accident, at low level with the runway lights obscured, it was ‘pitch black’, and that [for a pilot looking outside] the environment would have been ‘totally disorientating’.^[22]

Benson (1988; as cited in Gibb et al., 2011) defined spatial disorientation as:

The pilot fails to sense correctly the position, motion, or attitude of his [or her] aircraft or of himself [or herself] within the fixed coordinate system provided by the surface of the earth and the gravitational vertical.

The three sensory systems for determining orientation of the human body in space are the visual, vestibular,^[23] and somatosensory^[24] systems. Newman (2007) and others have reported that the visual system provides 80 per cent of the orientation information in normal conditions. However, in the absence of visual cues, orientation and motion information are divided between the vestibular and somatosensory systems. These systems can easily produce false information for a pilot due to local accelerations of the aircraft about the pitch, roll and yaw axes.

The vestibular system responds to head position and movement, which may lead to an incorrect perception of body motion if not supported by a visual reference. For example, an upward pitch (head backward) may be detected as a forward acceleration, and a roll as a lateral (sideways) acceleration. The somatosensory system detects local accelerations on the body, but if the pitching and rolling motions occur at close to +1G flight, such as during the accident sequence, the somatosensory system may not be able to resolve ambiguities generated by the vestibular system.

It was noted by Newman (2007) and Gibb et al. (2011) that spatial disorientation is likely an under‑reported phenomena in aviation. They suggested that this may be due to it resulting in one of two likely outcomes; either the pilot recovers the aircraft with no harm or damage done, and therefore does not perceive the need to report; or it results in a fatal accident and the investigation cannot verify from the evidence available that spatial disorientation contributed to the event.

Flight instruction

Instrument flying proficiency

The Civil Aviation Safety Authority’s (2007) Flight Instructor Manual: Aeroplane, chapter 18: Night Flying, states the following:

Before students undertake night solo circuit operations they must have received sufficient instrument flight training to enable them [to] carry out the following manoeuvres solely by reference to instruments: a) climb and climbing turns, b) straight and level flight and level turns, c) descent and descending turns, d) unusual attitude recovery full panel.

As the pilot already held a private instrument rating, the above training exercises were not required to be conducted as lead-in to his night flying training.

Demonstration

The Flight Instructor Manual stated that ‘airborne sequences must follow an acceptable method of teaching like: demonstrate, direct then monitor. However, the pilot acted as flying pilot for his first night flying training flight without a prior demonstration.^[25] The instructor explained that there were several reasons for this as follows:

• When the pilot first approached the instructor for his private instrument rating training, he was already a qualified pilot [private pilot licence] who owned his own aircraft and was capable of flying it competently. The instructor considered him an advanced student for the instrument training as he had already accumulated several hundred flying hours experience.
• The instructor used the direct method to deliver the pilot’s instrument training. This was about 40 hours of dedicated instrument flying training.
• At the time of the accident flight, the instructor and pilot had accumulated about 50 hours flying together without the need for the instructor to demonstrate a flying sequence or intervene to correct an improperly flown sequence. The pilot’s instrument flying training ensured he had accumulated sufficient minimum instrument flying prior to his first night flying training flight.

Benefit of demonstration

The benefit of demonstration as an instructional technique is that it permits the student to focus their attentional resources on key learning points for new sequences, without the diversion of those resources to managing the flight path. Studies have noted that observational experience, in addition to physical practice, can provide a more effective learning experience than physical practice alone.

In 2000, Shea et al. compared the performance of a physical practice group with a combined observation and physical practice group on a motor learning test. The physical practice group outperformed the combined practice group under the practice test conditions, but when the test conditions were varied from the practice conditions, the combined practice group ‘performed significantly better’ than the physical practice group.

Intervention

After the go-around was commenced, the instructor reported that the aircraft entered an unusual attitude. Both the instructor and pilot reported that the instructor was repeatedly directing the pilot to level the wings. The instructor commented that at the time, she was thinking ‘get that left wing up’, but directing ‘wings level’. At the time, her eyes were focused on the pilot’s attitude indicator^[26] and she was expecting the pilot to recover the aircraft. However, the pilot had become spatially disorientated, which she was not aware of. It was only a matter of seconds between the instructor’s comprehension that the aircraft was not responding and the impact with the ground. The instructor considered that it ‘happened very fast’, and that as she was not in the habit of taking over the controls from the pilot, her natural reaction was to direct what was needed. The pilot also reported that it ‘happened very quickly’, with ‘no height to recover’.

The Cirrus SR22 is fitted with two single-handed side control yokes mounted beneath the instrument panel on the left and right side of the cockpit, and the instructor reported that it is not an easy aircraft for an instructor to take over control from a student. She commented that the single-handed yokes are sensitive in their response, which can lead to ‘fighting over the controls’ if the instructor attempts to follow-through on the controls^[27] while a student is flying. Therefore, she was not following through on the controls during the touch-and-go sequence.

Previous similar accidents

Spatial disorientation

Spatial disorientation presents a danger to pilots as the resulting confusion can often lead to incorrect control inputs and resultant loss of aircraft control. Gibb and others (2010) state that spatial disorientation accidents have a fatality rate of about 90 per cent, indicating how compelling the misperceptions can be. A search of contributing safety factors in the ATSB aviation occurrence database revealed that of the investigated accidents where spatial disorientation was found to be a factor (about one per year), nearly all resulted in fatal injuries.

The United States National Transportation Safety Board’s database was searched for previous accidents involving spatial disorientation. A search of all aircraft categories returned 710 results. Cirrus SR20 and SR22 aircraft returned 18 results for spatial disorientation as a finding between 2003 and 2017, 13 of which were fatal accidents (four of the non-fatal accidents involved use of the Cirrus Airframe Parachute System for recovery). The conditions for all of the accidents were instrument meteorological or night, or combination of both. Of the 18 accidents for Cirrus aircraft, 10 were for instrument-rated pilots and four occurred during take-off.

The ATSB education booklet Avoidable Accidents No. 7, Visual flight at night accidents: What you can’t see can still hurt you (AR-2012-122) outlines a number of night-time accidents that have been a result of spatial disorientation due to dark night conditions.

Loss of control during go-around

A search of the ATSB database for previous SR22 accidents involving a loss of control during a go-around manoeuvre found one result of interest:^[28]

• During a touch-and-go training exercise, the aircraft veered off the runway to the left while under full power for take-off. The pilot reported that his attention may have been diverted to the flap control lever at the time (ATSB reference number 201006782).

The United States National Transportation Safety Board’s database was searched for previous similar accidents. The search criteria were Cirrus SR22, instructional flight, and accident. The search results were then filtered for loss of control events during an attempted go-around. The following results of interest were reviewed:

• Report ERA12FA540: Loss of control in-flight. ‘During the final approach, witnesses saw the airplane drifting to the left while descending at a relatively high sink rate. Witnesses heard the power being adjusted, and, close to the ground, the engine went to high power. The airplane’s nose rose, and the airplane veered to the left. The airplane touched down left wing down off the runway in grass, heading about 40 degrees left of the runway centreline. It then entered woods, where it hit numerous trees and came to rest upside down and on fire…Examination of the wreckage revealed no pre-existing mechanical anomalies that would have precluded normal operation’.
• Report ERA13CA222: Landing area overshoot. ‘According to the instructor, he and the student pilot were practicing short field landings. When the airplane was about 20 feet above the ground on approach to the runway, the airspeed suddenly decreased. The student pilot applied full engine power, the airplane yawed to the left, and the airplane impacted the ground before it reached the runway. The flight instructor reported no pre-impact mechanical malfunctions or failures with the airplane that would have precluded normal operation’.
• Report NYC07CA010. ‘As the pilot of the SR-22 was performing a flare for landing, the airplane’s airspeed “became too slow,” and the pilot applied full power and announced “go-around.” The airplane veered left, and continued approximately 100 yards, before it struck a tree and came to rest upright. The pilot reported no mechanical anomalies with the airplane’.

__________

13. The aircraft was fitted with the Cirrus Airframe Parachute System (CAPS), which is a ballistic parachute recovery system. When the pilot activates the CAPS system, a rocket in the aft fuselage ignites and dislodges the CAPS cover. The rocket then extracts a deployment bag containing the parachute from the aircraft.
14. As advertised by the manufacturer - Heads Up Technologies.
15. The nose-up pitch attitude on take-off and the first touch-and-go circuit was 7–9°. When the aircraft is trimmed for a low power and low airspeed approach, an increase in thrust over the tailplane will increase the down force produced by the tailplane, pitching the tailplane down and the nose up.
16. An approximate stall speed of 73 kt was calculated. Conditions were: full flap, full fuel, two occupants, 20° pitchup, 52° roll, density altitude 2,600 ft and idle power. The use of high power would reduce the stall speed.
17. The airport camera footage timings are about 30 seconds in advance of the aircraft recorded data for reasons undetermined.
18. G load: the nominal value for acceleration. In flight, g load represent the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value.
19. The peak variation in normal and lateral accelerations were +0.24 and -0.07 respectively (datum = 0.0).
20. The aircraft doors open upwards and forwards relative to the cabin with the aircraft in the upright position.
21. Davies J.M., Wallace W.A., Colton C.L. & Yoo K.I. (in press). Two aviation accident investigation questionnaires for passenger & crew survival factors & injuries. Aviation Medicine and Human Performance.
22. The instructor reported that the township of Orange, to the north of the extended centreline for runway 29, provided more lighting than Spring Hill, but was partially masked by the surrounding terrain and would not have provided any significant light had that runway been used at the height at which this event occurred.
23. The vestibular system consists of the semi-circular canals and otolith organs in the inner ear, which detect angular and linear accelerations of the head.
24. The somatosensory system uses nerves to detect external forces on the body.
25. The accident flight was the instructor and pilot’s first dedicated circuit flying training session together – the instructor was not involved in the pilot’s basic flying training.
26. Although the aircraft was fitted with two MFDs, the primary flight display with the attitude indicator is only displayed on the left MFD, except in the case of a failure of that MFD, in which case the primary flight display will be displayed on the right MFD.
27. For an instructor, ‘follow-through on the controls’ is the practice of holding the controls while the student is flying. This permits the instructor to feel the student’s control inputs and override incorrect control inputs to prevent the development of an unsafe situation.
28. There were other results of loss of control during go-around manoeuvres with full power for the SR22, but these included strong gusting wind conditions as contributing factors.

Safety analysis

Introduction

During a night training flight, a go-around from runway 11 at Orange Airport, New South Wales was commenced. Shortly after, the Cirrus SR22 aircraft, registered VH-PDC, collided with the ground. The flight instructor and pilot received serious injuries and the aircraft was destroyed.

As mentioned above, the presence of a fractured rudder cable in the wreckage was not considered a contributing factor. This was because the rate of heading change during the accident sequence followed the angle of roll, rather than the application of power, and there was no significant lateral acceleration associated with the application of power.

The data logging card did not record pilot control inputs or movement of the autopilot servos. Therefore, it could not be determined if the reversal of the initial rolling and pitching motion was the result of the actions of the pilot, or flight instructor, or the aircraft’s electronic stability and protection system. However, the thresholds for activation of the aircraft’s pitch and roll protection were reached during the accident sequence, and the reversal of the pitch and roll were consistent with the operation of the system. While the system was designed to mitigate an unusual attitude from developing, the act of recovering from a high pitch angle at slow speed will inevitably result in a loss of height.

The final approach on the accident flight was steep at 500 ft. While this was corrected before the landing, it would have increased the pilot’s workload during the approach. Using this as a trigger to conduct a go‑around would have provided the pilot with the opportunity to set up for a more stable approach on the next circuit.

This analysis will examine the conduct of flight demonstrations, and the pilot experiencing spatial disorientation and the flight instructor’s awareness of such.

Flight demonstration

The pilot was undergoing his first night flying training flight for the addition of a night endorsement to his private instrument rating. The flight instructor had previously instructed the pilot for his instrument rating, and considered him an advanced student. His instrument flying training was delivered by the instructor using the instructional method of direct, without the need to demonstrate any sequence or intervene to correct an incorrectly flown sequence. Because of this earlier experience, the instructor elected to use the instructional method of direct without first demonstrating any of the key learning points for the night flying environment.

Night circuits involve a unique runway environment for assessing the approach path and landing, and require a unique procedure for combining visual and instrument flying sequences. The Civil Aviation Safety Authority’s flight instructor manual emphasised that the ‘acceptable delivery rate of new information to the student [pilot] needs to be combined with good demonstrations and adequate student practice’. Consistent with this guidance, best practice is to ensure that the student [pilot] is introduced to a new environment in a gradual way. The lack of demonstration for the pilot’s introduction to night flying likely increased the risk of the pilot not having an adequate opportunity to attend to, and absorb, the key learning points before attempting to practice the sequences as the pilot flying.

Spatial disorientation

The flight instructor reported that the pilot’s first night circuit was flown to a reasonable standard with the pilot responding to her direction. At the end of the second circuit, the aircraft bounced twice during the attempted touchdown and the pilot applied full power to perform a go-around. In response to the application of full power, the aircraft pitched nose-up and started to roll to the left. The pilot reported that he lost all external visual references as the runway lighting disappeared from view underneath the aircraft, and was attempting to focus his attention on the attitude indicator as the aircraft continued to pitch up and roll left.

The pitching and rolling motion of the aircraft, in addition to the pilot and instructor reports that the external environment was ‘pitch black’, were all consistent with the pilot experiencing spatial disorientation. The nose up pitching motion and left rolling motion were consistent with the natural response of the aircraft without corrective pilot control input.

Flight instructor awareness

During the accident sequence, the flight instructor repeatedly directed the pilot ‘wings level’, but her attention was focused on the primary flight display and she was not aware the pilot had become spatially disorientated. Therefore, she did not immediately intervene to recover control of the aircraft during the accident sequence, which only lasted about 7 seconds from the decision to go-around to initial impact.

Findings

From the evidence available, the following findings are made with respect to the spatial disorientation and collision with terrain involving Cirrus SR22, registered VH-PDC, at Orange Airport, New South Wales, on 15 May 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• While attempting a go-around manoeuvre from an aborted touch-and-go, the pilot did not immediately transition his scan onto the attitude indicator and became spatially disorientated, which resulted in loss of control of the aircraft and collision with terrain.
• The flight instructor was not aware the pilot had become spatially disorientated, which resulted in her providing direction rather than intervention during the loss of control.

Other factors that increased risk

• Contrary to best practice, the flight instructor elected to direct the pilot for his first night flight without a demonstration. This decision was influenced by the pilots' experience, private instrument rating, and previous instructional method.

General details

Flight Instructor details

Pilot details

Aircraft details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Cirrus Aircraft
• Civil Aviation Safety Authority
• flight instructor
• Orange City Council
• pilot
• United States National Transportation Safety Board.

References

Civil Aviation Safety Authority 2007, Flight instructor manual: aeroplane, issue 2, CASA, Canberra.

Gibb R, Ercoline B & Scharff L 2011, ‘Spatial disorientation: decades of pilot fatalities’, Aviation, space, and environmental medicine, vol. 82, no. 7.

Newman DG 2007, An overview of spatial disorientation as a factor in aviation accidents and incidents, Australian Transport Safety Bureau, Canberra. Aviation research and analysis report – B2007/0063.

Shea C, Wright D, Wulf G & Whitacre C 2000, ‘Physical and observational practice afford unique learning opportunities’, Journal of motor behavior, vol. 32, pp. 27–36

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Cirrus Aircraft, Civil Aviation Safety Authority, flight instructor, pilot and United States National Transportation Safety Board.

The submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Terminology used in this report

Occurrence: accident or incident.

Safety factor: an event or condition that increases safety risk. In other words, it is something that, if it occurred in the future, would increase the likelihood of an occurrence, and/or the severity of the adverse consequences associated with an occurrence. Safety factors include the occurrence events (e.g. engine failure, signal passed at danger, grounding), individual actions (e.g. errors and violations), local conditions, current risk controls and organisational influences.

Contributing factor: a safety factor that, had it not occurred or existed at the time of an occurrence, then either: (a) the occurrence would probably not have occurred; or (b) the adverse consequences associated with the occurrence would probably not have occurred or have been as serious, or (c) another contributing factor would probably not have occurred or existed.

Other factors that increased risk: a safety factor identified during an occurrence investigation, which did not meet the definition of contributing factor but was still considered to be important to communicate in an investigation report in the interests of improved transport safety.

Other findings: any finding, other than that associated with safety factors, considered important to include in an investigation report. Such findings may resolve ambiguity or controversy, describe possible scenarios or safety factors when firm safety factor findings were not able to be made, or note events or conditions which ‘saved the day’ or played an important role in reducing the risk associated with an occurrence.

Safety issue: a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operational environment at a specific point in time.

Safety action: the steps taken or proposed to be taken by a person, organisation or agency in response to a safety issue.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On the morning of 9 May 2018, there were five controllers on duty in the Air Traffic Control (ATC) tower operated by Airservices Australia (Airservices) at Perth Airport, Western Australia (WA). One controller was acting as the surface movement controller (SMC)^[1]. One controller, who was being trained in air traffic control, was acting as the aerodrome controller (ADC)^[2] under the supervision of another controller. The other controllers on duty were in airways clearance delivery and tower supervisor roles.

At 0841 local time, the crew of a Regional Express SAAB 340 aircraft operating a passenger service, call-sign RXA2113, were at their departure bay. The crew contacted the airways clearance delivery controller who issued an airways clearance for the planned flight from Perth to Albany, WA. This clearance authorised the crew to track to Albany via SOLUS and flight-planned route. The crew was cleared to depart Perth in accordance with the SOLUS THREE standard instrument departure (SID) and climb to 5,000 ft. Figure 1 shows SOLUS THREE SIDs from runway 03 and runway 06.

Figure 1: Perth Airport SOLUS THREE SIDs from runway 03 (red highlight) and runway 06 (blue highlight)

Source: Adapted from Airservices Australia

The Automated Terminal Information Service (ATIS) that was available to pilots between 0852 and 0908 included the following information:

Runway 03 for all arrivals and for departures via [various waypoints including] SOLUS. Runway 06 for all other departures.

Based on the airways clearance and ATIS, the RXA2113 crew programmed the aircraft flight management system (FMS) for a departure from runway 03 direct to MIDLA followed by a left turn to track as specified by the SID to SOLUS, followed by the flight-planned route (Figure 1: red highlight).

The controller acting as SMC took control of this position at 0830. Between 0847 and 0901, the SMC had managed the taxi transit of five aircraft that all departed from runway 06.

At 0905, the RXA2113 crew contacted the SMC to request taxi clearance. The SMC recalled that he referred to the flight data record on his display and perceived that the aircraft was departing off runway 06. Accordingly, the SMC issued instructions for RXA2113 to taxi via taxiway ‘Charlie Six’ (C6) and hold short of runway 03 (Figure 2). At the same time, the SMC selected the intermediate hold point as the clearance limit on the ATS graphical display.

Figure 2: Perth Airport taxiway map with RXA2113 route highlighted in blue

Source: Adapted from Airservices Australia, annotated by ATSB

As required to ensure there was no conflicting traffic, the SMC coordinated a runway crossing for RXA2113 with the ADC. The SMC then issued onwards clearance for RXA2113 to ‘cross runway 03, taxi hold point Victor (V), runway 06’ and selected the hold point on the graphical display. Once the SMC was satisfied that the crew was complying with the instruction, he transferred the flight data record to the ADC screen as per standard procedure.

By now it was apparent to the RXA2113 crew that ATC intended for them to depart from runway 06 rather than runway 03 as nominated on the ATIS for SOLUS departures. At the time, the captain considered this and determined that they would still be compliant with the airways clearance as the runway was not part of the clearance and the SID was applicable to both runways. Given that key aspect and crew member experience of similar departures, the crew did not query ATC about the variation to the expected departure runway.

At hold point V the RXA2113 crew reprogrammed the FMS for the SOLUS THREE SID for runway 06. The captain recalled that this process did not present any problems to the crew and they were not aware of any safety implications.

In the tower, the trainee ADC was in the controlling position and the supervising ADC was seated behind and adjacent to the trainee. The trainee had full vision and control of the monitors and controls. The supervising ADC reported that although his view of the display was incomplete he remained vigilant of arriving and departing aircraft.

When the opportunity arose, the supervisor was asking the trainee questions about ATS policy and procedure as an ad hoc training activity. This was taking place while the RXA2113 crew prepared for take-off at the hold point. Although the flight data record for RXA2113 was displayed on the ADC display after the SMC had transferred it, there was no requirement for the ADC to pay attention to RXA2113 until the crew was ready for take-off.

At 0910, the RXA2113 crew contacted the ADC to advise they were ready to depart.

The supervising ADC recalled that the trainee ADC followed standard procedure to ensure that the runways and initial departure track were free of conflicting traffic. The supervisor did not have a clear view of the flight data record on the ATS display and it was unclear if the trainee ADC referred to it. Departures^[3] were being conducted in accordance with auto-release procedures so no coordination was required with the departures controller.

The supervising ADC related that during departures, the focus of both his and the trainee ADC’s attention was on monitoring for incoming and outgoing traffic, and checking that the runways were clear. At Perth Airport, the ADC controls arrivals and departures off all runways. This means that when an ADC issues a take-off clearance from one runway, he or she will also be aware of any aircraft arriving or departing from other runways.

The presence of the aircraft at hold point V indicated to the ADC that RXA2113 was scheduled to depart from runway 06, and the ADC issued a take-off clearance from that runway. The trainee ADC instructed the RXA2113 crew to line up, then at 0911 cleared the crew to take-off from runway 06 with instructions to contact ‘departures’ when airborne.

From the perspective of the crew and controllers in the tower, the take-off and departure was uneventful. However, the departures controller was expecting the aircraft to be on a northward track to MIDLA rather than tracking initially to the north-east before turning left to MIDLA (runway 03 departure, Figure 1). The aircraft was soon on the flight planned track and there was no reported loss of separation with any other aircraft.

The controllers in the tower were unaware of the discrepancy between the clearances issued to the crew of RXA2113 and the flight data record until advised by the departure controller.

Contextual information

The controllers described the traffic situation as quiet by 0840 because the number of aircraft movements had decreased from the earlier morning period. The weather at Perth Airport was not operationally significant, the visibility was good, and the wind was light and variable.

Personnel information

Surface movement controller

The controller who was performing the role of SMC held ATC certification and had about three years’ experience with Airservices. Prior to that, the controller had been trained by, and operated for, another ATC agency.

Prior to the day of the occurrence, the controller had three rostered days off. He reported having slept well the night before. Although the controller was concerned about the health of a close family member, he did not consider that his performance would be affected. There was no evidence to indicate that stress affected the actions of the SMC on the day of the occurrence.

Aerodrome controllers

The trainee controller who was performing the role of ADC under supervision had previous experience with another ATC agency. It was reported that the trainee controller had demonstrated competence at the console but needed further familiarity with Airservices’ policy and procedures.

On the day of the occurrence, both controllers in the ADC position started work at 0530, and had been working for approximately three and a half hours. They were in the second shift of their rotation, having come off rostered days off the day prior to the occurrence. It is not known what sleep either controller had prior to the occurrence.

Consideration of controller rostering and fatigue

The ATSB reviewed the actual hours worked and known sleep history of the SMC and ADCs for indications of fatigue on the day of the occurrence. Based on the available evidence, there is no indication that fatigue contributed to this occurrence.

ATC systems

Flight Data Record

The air traffic system automatically generated the departure runway for RXA2113 into the flight data record. This displayed the departure runway as 03 in the fourth column of the top row (Figure 3). The ATC system allowed the controllers to change the departure runway recorded for each flight. The system would notify other users that this change had occurred.

Figure 3: The Flight Data Record for RXA2113

Source: Adapted from Airservices Australia

Hold point selection panel

Immediately after the SMC instructed the RXA2113 crew to taxi to hold point V, he recorded that hold point in the ATC system. The SMC called up the ‘RWY03 Hold Points’ selection panel within the ATC system. The SMC used this panel to record the taxi clearance for RXA2113 to hold point V (Figure 4).

This panel presented all valid hold points for runway 03 departures. Although the hold point options on the graphical display were delimited to those associated with the system-assigned runway, hold point V was available to facilitate traffic flow from terminals 3 and 4.

Figure 4: Hold point selection panel in ATC system for runway 03 departures (Hold point V highlighted by ATSB)

Source: Adapted from Airservices Australia, annotated by ATSB

The ATSB noted that the ATS system did not provide any specific inhibitions to prevent or alert the controllers to the taxi of aircraft to non-conforming hold-points.

Safety analysis

Taxi clearance RXA2113

The surface movement controller issued taxi instructions to the crew of RXA2113 which directed them to runway 06. This was contrary to the departure runway (runway 03) recorded by the air traffic system and shown on the ATC flight data record.

When an aircraft crew requests a taxi clearance, the SMC would normally provide instructions based on the flight data record.

The ATSB considered the factors that might have adversely influenced the SMC’s attention and perception at the time. Based on the available information, there were no indications that fatigue, workload, expectancy, or stress from personal circumstances were contributory.

The ATSB also considered the presentation of the departure runway information on the flight data record. That information was presented clearly and saliently and there was a high level of contrast between the text and the background. No one reported that the flight data record was difficult to read or interpret. Therefore the runway information was readily accessible.

Therefore, as the SMC issued taxi instructions that were inconsistent with the flight data record, it is likely that he did not attend to the flight data record.

After the SMC issued the taxi instructions to hold point V, runway 06, there were no prompts for a reassessment of those instructions. Although they were not required to, if the crew of RXA2113 had requested confirmation that the departure runway was different to that expected, this would have prompted the SMC to check the flight data record. In this occurrence, the flight crew had identified the instructions were inconsistent with the information provided by the ATIS, as such this was a missed opportunity to identify and resolve this inconsistency. Although the ATC system limited the taxiway selections to those associated with the assigned departure runway, hold point V was necessarily available for use in conjunction with both runways 03 and 06.

Although the SMC instructed the crew of RXA2113 to taxi to a runway contrary to the flight data record, the ATSB did not identify any broader risk to safety posed by this action. There is no evidence that the taxi instructions issued to the crew reduced the safety of the aircraft or other traffic while it was taxiing and holding. The arrival of the aircraft at the hold point of runway 06 did have an effect on the ADC function.

Take-off clearance RXA2113

The trainee ADC issued a take-off clearance to the crew of RXA2113, which cleared them to depart from runway 06. Like the taxi clearance, this was also contrary to the departure runway recorded by the air traffic system and displayed on the flight data record.

The ATSB considered whether the training activity the ADCs were engaged in prior to issuing the take-off clearance affected their attention to and perception of the departure runway on the flight data record. The ADC supervisor related that the focus of attention of both ADCs during the take-off clearance was on monitoring incoming and outgoing traffic, and checking that the runway was clear and that in these circumstances the ADC would not normally focus on the flight strip of a taxiing or departing aircraft.

The ATSB also identified that the position of RXA2113, at hold point V, was a strong indicator to the ADC that aircraft was scheduled to depart from runway 06. Given the position of the aircraft at the hold point to runway 06 and crew report that RXA2113 was ready at that position, it is likely that both controllers engaged in the ADC function had an expectation that RXA2113 should depart from runway 06.

In this context it is unlikely that the training activity affected the likelihood of the ADC detecting the departure. The focus of the ADCs on traffic, and the expectation associated with the presence of the aircraft at runway 06, meant that the controller was unlikely to detect that the aircraft had been taxied to the incorrect runway, whether they were engaged in training or not. This expectation likely resulted in the two ADCs either not attending to the flight data record or misperceiving the runway information on the record.

Safety considerations

The departure of RXA2113 from runway 06 meant that the initial track of the aircraft was different to that expected by the departures controller. The departures controller used the air traffic system to identify which runway aircraft would depart from, in order to predict their track after departure.

Based on the information current in the air traffic system, the departures controller had expected RXA2113 to depart from runway 03 and commence on a northward track to MIDLA. Because RXA2113 departed from runway 06 and initially tracked to the north-east, this may have affected the departures controller’s understanding and awareness of the position of the aircraft.

The departure of RXA2113 from runway 06 was primarily the result of the taxi instructions provided by the SMC. After the SMC had issued these instructions, there were limited opportunities to identify the deviation in departure runway, or to update this information within the air traffic system.

The ATC system contains limited defences to prevent or identify deviations from the operational detail of the departure runway. The departure runway is recorded on the flight data record, and the system primarily relies on each controller attending to that record to ensure departures accord with the planned runway. In addition, aircraft separation relies on both controller and flight crew, and there is a role for flight crew to identify any perceived inconsistencies or errors to ATC.

The ATC system has comprehensive defences to ensure the separation of aircraft while taxiing, and during and after take-off. The ATSB did not identify any evidence that separation was affected at any stage during this occurrence.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The Perth SMC issued taxi instructions to the flight crew of a departing aircraft that directed them to the holding point of runway 06 rather than runway 03, which was assigned by the air traffic system and shown in the flight strip details.
• The aerodrome controllers cleared the crew of the departing aircraft to take-off from runway 06, which was contrary to the runway assigned by the air traffic system and shown in the flight strip details. As a result, the initial track of the aircraft was different to that expected by the departures controller.
• There was no broader safety risk identified as a result of either the taxi or take-off clearances. The taxi clearance provided to the crew of the departing aircraft did not reduce the safety of the aircraft while it was taxiing and holding. The take-off clearance did not reduce the separation of the aircraft during take-off or departure from the airport.

Safety action

Airservices reported that as a result of this incident, they have conducted a check assessment with the SMC. Airservices have developed a training and performance improvement plan for the SMC, to address several performance issues identified in their review.

Safety message

This occurrence highlights how deviations from flight details, as presented in the air traffic system, affect the ability of controllers and flight crews to understand and predict the behaviour of aircraft. Furthermore, limited defences exist to identify when instructions have deviated from the information recorded in the system. Although in this occasion the ATSB has not identified any significant risk to the safety of taxiing or departing aircraft, controllers are reminded that they play an important role in remaining vigilant to the content of displayed data, and updating the system when deviations do occur.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The surface movement controller (SMC) is responsible for controlling the movement of aircraft around the Aerodrome movement area. The SMC issues taxi instructions to aircraft to route them across the aerodrome surface.
2. The aerodrome controller (ADC) issues line up and take off clearances to the crew of departing aircraft, and landing clearances to the crew of arriving aircraft. The purpose of these instructions is to ensure that aircraft depart from and arrive on runways clear of obstructions, and that prescribed separation standards exist once aircraft take off.
3. The departures controller works in a separate location to the control tower at Perth airport.

What happened

On the evening of 9 May 2018, an Airbus A320, registration VH-VQL, was being operated on a regular public transport flight by Jetstar Airways Pty. Ltd. The flight departed Avalon Airport, Victoria, at about 1800 Eastern Standard Time,^[1] for Sydney, New South Wales.

Approaching Sydney Airport, air traffic control (ATC) cleared the aircraft for a high-speed descent from flight level FL 250^[2] for the RIVET TWO Standard Instrument Arrival (STAR).^[3] At about 1846, the first officer (FO), who was the pilot flying, commenced the descent via the published waypoints for the STAR (Figure 1).

Figure 1: Departure and approach chart – Sydney Airport

Source: Airservices Australia, modified by ATSB.

After passing DUDOK, ATC provided clearance to conduct the runway 34L^[4] Independent Visual Approach (IVA) and provided radar vectors for a final approach intercept (Figure 2 and red line on Figure 1). Crossing the coast, the aircraft was about 2,000 ft high on profile compared with other similar approaches (see the section titled Approach profiles) Figure 1.

After passing BOOGI on descent, the captain commented to the FO on the possibility of track shortening^[5] due to the only preceding traffic being on final approach for runway 34L.

Observing the aircraft was high, the flight crew selected ‘open descent mode’^[6] in order to increase the aircraft’s rate of descent. They then deployed speed brakes in an attempt to intercept the runway 34L glideslope.

After intercepting the final approach course, the flight crew selected landing gear down and disengaged the autopilot. The FO reported manually flying the aircraft to intercept the glideslope from above. At about 2,850 ft, which was 300 ft above glideslope, the flight crew selected the first flap setting for landing.

Figure 2: VH-VQL approach path to runway 34L Sydney

Source: Google earth, modified by ATSB

Prior to configuring for ‘flaps 2’, the flight crew selected the missed approach altitude of 3,000 ft in the altitude window of the flight control unit (FCU). The recorded data indicated that the altitude selector was also pulled, which changed the aircraft’s vertical flight mode from open descent to open climb. In response to the mode change, the auto-thrust system, which was active at the time, increased thrust to climb the aircraft to 3,000 ft. Unaware of the thrust increase, the flight crew continued configuring for the approach by selecting ‘flaps 2’.

The increase in thrust increased the aircraft’s airspeed. This led to the FO reducing the aircraft’s descent rate in an attempt to manage the acceleration and prevent flap overspeed. Despite this, the aircraft’s airspeed continued to increase, leading to a 2 kt flap overspeed. Reducing the rate of descent also resulted in the aircraft diverging further from the approach glide path.

The recorded data showed that a thrust lever reduction to idle occurred just prior to exceeding the ‘flaps 2’ extension speed. A few seconds later, the airspeed decreased back below the maximum ‘flaps 2’ extension speed. Observing that the approach was not stable, the captain commanded the FO to go around.^[7]

In response, the FO increased the thrust levers to the take-off/go-around setting (TOGA) however, recorded data showed that the aircraft was not pitched to the required 15° nose-up attitude. Consequently, the aircraft continued to accelerate. The captain reported that he announced ‘pitch’ and ‘speed’ to draw the FO’s attention to the under rotation. However, the aircraft’s airspeed exceeded the maximum ‘flaps 2’ extension speed by 8 kt. The FO reported identifying that as the aircraft was going to exceed the ‘flaps 2’ speed, he selected ‘flaps 1’, which was not in accordance with the standard operating procedures. However, the aircraft also accelerated through the maximum ‘flaps 1’ extension speed of 230 kt by about 8 kt and by the time the flap had fully retracted, the exceedance had increased to 24 kt.

Due to the aircraft’s acceleration the FO also ordered the retraction of the landing gear. By the time the landing gear had retracted fully, the aircraft had exceeded the maximum landing gear transition speed by 13 kt.

As the ‘flaps 1’ extension speed was exceeded, the captain advised the FO that he was taking control of the aircraft. Recorded data showed that the captain reduced the thrust, pitched the aircraft to 15° nose-up, and climbed to the missed approach altitude. The captain assumed the pilot flying role for the remainder of the flight, and an approach and landing was made on runway 34L.

Approach profile

A number of ATSB investigations have identified the importance of the management of the aircraft energy state and profile during the approach and landing phases of flight. They are known to be high workload periods for flight crew, especially during high-speed descents. This requires a high level of attention to ensure the aircraft meets the stabilised approach criteria prior to the required altitude.

The approach profile for VH-VQL, between DUDOK and final approach to runway 34L, was comparably higher and faster than previous flights (Table 1 and Figure 3).

Table 1: Comparative descent profiles for VH-VQL on the RIVET 2 STAR, Sydney

Source: ATSB

Despite being cleared for a high-speed descent during the initial phase of the arrival, the aircraft was recorded to have arrived at BOOGI slightly high on profile, with an airspeed reduced to 250 kt, which was required by the standard operating procedures (SOP). However, between DUDOK and NASHO the aircraft’s descent shallowed until crossing the coast prior to NASHO. This positioned the aircraft about 2,000 ft high on profile in comparison to other flights that were flown in the same aircraft type by different flight crews.

Figure 3: VH-VQL comparative approach to Sydney Airport, RIVET TWO STAR 34L

Source: Google earth, modified by ATSB

Recorded data indicated that the descent rate of the aircraft increased after crossing the coast, which corresponded to the ATC clearance for the commencement of the IVA. Further, the data showed the aircraft’s selected speed target remained set at 250 kt prior to intercepting the final approach track. The flight crew continued to use various speed targets for the remainder of the approach in an attempt to slow/configure the aircraft and capture the glideslope profile.

The data also indicated that the aircraft turned onto final approach at about 9.8 NM from the runway threshold, at about 3,400 ft. The aircraft’s speed turning final was about 223 kt. This resulted in delays with aircraft configuration and achieving a stabilised approach.

Stabilised approach criteria

The company Operations Manual detailed that an approach to land is stabilised when all of the following criteria are met by no later than 1,000 ft height above the aerodrome (HAA):

1. The aircraft is on the correct nominated flight path and only small changes to required bank angle and pitch are needed to maintain the correct flight path

2. The aircraft speed is not more than speed target +10 kt and not less than speed target -5 kt (refer Note immediately below);

Note: Reference (2) above: In VMC ONLY the approach may be continued below 1000 ft HAA provided the PIC is confident the speed target will be achieved by no later than 500 ft HAA.

3. The aircraft is in the correct landing configuration

4. Sink rate is no greater than 1000 ft per minute below 1000 ft above the aerodrome

5. Thrust setting is appropriate for the aircraft configuration and is not below the minimum power for the approach as defined in the aircraft’s operating manual

6. All briefings are completed.

Go-around procedure

In the event of an unstable approach, the company procedure detailed that the pilot flying (PF) should apply three initial actions simultaneously;

• Advance thrust levers to take‑off/go‑around (TOGA) thrust
• Rotate the aircraft to 15° of pitch, if all engines are operating
• Announce go‑around to the pilot monitoring (PM).

Subsequent assistance is then provided by the pilot monitoring (PM) to retract one setting on the flaps and the PF announces the flight mode readout. The PM then checks the modes on the flight mode annunciator and announces positive climb. The PF then commands landing gear up, the PM would then select the landing gear up and the rest of the procedure is actioned.

Flight Crew

The Jetstar operations manual required a minimum of two flight crew for the operation of the A320. Additionally, pilots must also meet the minimum experience and qualification requirements outlined in the company SOPs. To ensure that each member of the flight crew can demonstrate sufficient role competency, newly‑appointed captains and FOs operated on a restricted basis, after clearance to line, for a period of six and three months respectively. Jetstar also requires that no more than one pilot may operate under restriction on the flight deck of the A320 at any one time. The captain had just completed his initial command restriction period and all flight crew met the company requirements prior to the flight. Both flight crew were appropriately licenced, qualified and experienced on the aircraft type and held valid Class 1 medicals.

The captain had a total of about 20,000 hours flying experience, of which about 2,600 hours was on A320 aircraft. He had logged over 600 hours and over six months as captain on the A320 prior to the incident. His last flight check was conducted in an A320, on 22 February 2018, and he was familiar with runway 34L as he had been based in Sydney since 2012. He did not have any health issues and advised being well rested prior to the flight.

The FO joined the company in 2011 with significant civil and foreign military flying experience, and had logged over 8,700 flight hours total time, of which over 3,300 hours were on the A320. His last flight check was conducted in an A320 on 9 January 2018 and was familiar with runway 34L as he had been based in Sydney since 2016. The FO reported feeling well rested prior to the flight, and in good health.

Except for the previous sector, both pilots had not flown together in their respective roles on the A320. However, they had flown briefly together about five years prior on the A330 and were aware of each other’s experience and aviation background. In reflecting on the occurrence, the captain reported that his knowledge of the FO’s background created a performance expectation that reduced the cockpit gradient^[8] during the flight and delayed his intervention during the occurrence. The FO reported that his relationship with the captain was good.

Safety analysis

Management of the approach

The arrival to DUDOK was comparatively similar to other flights. However, after DUDOK, insufficient descent rate resulted in the aircraft being high on profile. Additionally, the flight crew maintained a selected speed of 250 kt prior to turning onto final, which positioned the aircraft in a high-energy state and led to delays configuring the aircraft. The high speed and profile required an irregular intercept of the glideslope from above, on final approach. It was likely that, at this time, the flight crew’s focus of attention was primarily on configuring the aircraft, reducing its speed and capturing the glideslope. In addition, the flight crew elected to descend manually using the flight directors, increasing their workload as they approached 1,800 ft.

Prior to 1,800 ft, the missed approach altitude of 3,000 ft was selected in the altitude window of the flight control unit (FCU). At this time, the altitude selector was also pulled which initiated a mode change to open climb. This change had the effect of increasing thrust, as the auto-thrust system was still active. This went unnoticed by the crew despite the annunciation and resulted in increasing airspeed.

Without the automated thrust increase the crew may have been able to stabilise the approach in accordance with the operator’s required criteria. However, the undetected thrust further destabilised the approach and subsequently led to the initial flap overspeed. Had the flight crew identified the flight mode annunciator (FMA) change, appropriate and timely action may have prevented the flap overspeed and prompted an earlier go-around.

The go-around

Having assessed that the aircraft was unlikely to meet the stable approach criteria, the captain appropriately initiated the go‑around.

A go-around requires a methodical sequence of many actions by both the pilot flying and the pilot monitoring. During a go-around, the aircraft transitions quickly from descending at relatively low thrust, to climbing at high thrust with a changing configuration. The tempo of the sequence is relatively rapid compared to other normal in-flight manoeuvres.

At the initiation of the go-around, the flight crew did not conduct the sequence in accordance with the required standard operating procedures. This led to the normal go-around flight crew actions being delayed, omitted, and out of sequence. Further, the nature of the two-engine, high-energy go-around is such that there is a rapid acceleration of the aircraft. When the FO did not increase the pitch to the expected nose up attitude, the aircraft accelerated more quickly than the flight crew expected. This limited the time available to complete the required actions of retracting flap and landing gear before exceeding the operational limitations of the aircraft.

As the pilot monitoring, the captain had good opportunity to observe the rapidly accelerating aircraft, and that the FO had not pitched the aircraft as expected. This, combined with the non‑standard flap selection made by the FO, were cues to the captain to formally intervene and reduce the risk of the flap and landing gear overspeed.

Cockpit gradient

The captain reported that he had high regard for the FO’s experience and that influenced the performance he expected from him. Consideration of the FO’s background also influenced the point at which the captain felt it necessary to intervene during the flight. In hindsight, the captain felt that the cockpit gradient contributed to the occurrence by delaying the required intervention.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• While descending through 1,800 ft, the crew inadvertently activated open climb mode with the selection of the assigned altitude selector to 3,000 ft. This resulted in an undetected increase in thrust, which destabilised the approach, and led to the flap overspeed.
• The use of a non-standard go-around procedure, including a lower than required pitch attitude, resulted in increased acceleration and exceedance of the flap and gear limitations.
• The captain's perception of the first officer's level of experience likely led to a shallow cockpit gradient. This influenced the captain's level of intervention during the approach and go-around.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The operator conducted an internal investigation which highlighted the importance of situational awareness of flight crews and reiterated the operational guidelines in the ‘Airbus ‘Golden Rules for Pilots’, which included rule 3 ‘Understand the FMA at all times’ and included expectations for the crew to monitor, announce, confirm, and understand FMA changes and annunciations.

Safety message

Handling of approach to land is one of the ATSB’s SafetyWatch priorities. Unexpected events during the approach and landing can substantially increase what is often a high workload period. Adherence to standard operating procedures and correctly monitoring the aircraft and approach parameters provides assurance that an independent visual approach can be safely completed. The selection of inappropriate auto-flight modes, unexpected developments, or any confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.

A go-around should be immediately carried out if the approach becomes unstable or the landing runway cannot be identified from the minimum descent altitude or missed approach point.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
3. Standard terminal arrival route.
4. Runway number: the number 34 represents the magnetic heading of the runway, 340°. The runway identification may include L, R or C as required for left, right or centre.
5. Track shortening occurs when air traffic controllers direct an aircraft to turn earlier than usual, to land in a shorter time frame, which assists with sequencing aircraft for landing and take-off.
6. The open descent mode is a selected mode where the aircraft uses target values set by the flight crew using the flight control unit (FCU) selections, while disregarding any constraints contained within the prepared vertical flight path loaded in the flight management guidance computer.
7. To abandon the landing and make a fresh approach.
8. The term ‘cockpit gradient’ can variously refer to the difference between involved pilots in terms of age, experience levels and position held in the organisation.

The occurrence

What happened

On 14 May 2018, a Gippsland Aeronautics GA-8 Airvan (Airvan) aircraft, registered VH‑BFL, departed Kununurra, Western Australia (WA) on a scenic charter flight. The pilot and three passengers were on board.

After about one hour and fifteen minutes, the aircraft landed at Bellburn Airstrip (Bellburn), 202 km SSW from Kununurra, and picked up four more passengers. The aircraft departed at about 1600 Western Standard Time^[1], to continue the scenic flight. A second company aircraft was utilised to carry the passengers’ baggage.

About 12 minutes after departure, the pilot commenced a planned climb from 2,500 ft to 3,500 ft above mean sea level, during which he felt the aircraft performance was a bit ‘sluggish’. The pilot reported that the climb rate was lower than expected with the aircraft’s speed between 85–100 kt. The pilot also observed the fuel flow was about 55–60 litres per hour (l/hr), which was less than expected for the full rich mixture setting selected.

The pilot reported that he then completed a check of the engine settings and physically confirmed, through touching the controls, that the mixture was full rich, the throttle control was set to 25 inches of manifold pressure, and the propeller lever was set to 2,500 revolutions per minute. The pilot turned the fuel pump on, which made no difference to the aircraft performance. He then notified the company chief pilot, who was flying the other aircraft.

The pilot decided to divert and commenced a turn back to Bellburn maintaining 3,500 ft. The pilot left climb power set and briefed the passengers that they were diverting to Bellburn. The fuel flow had now reduced to about 50–55 l/hr, however, airspeed and height were maintained. The pilot checked if there were any other abnormal indications but all gauges were indicating normally, with both fuel tanks indicating three quarters full and no warning lights illuminated.

During the transit back to Bellburn, the pilot performed some troubleshooting by gently moving the throttle back and forward. There was a noticeable deceleration when the throttle was moved back so the pilot returned it, to its original position for the transit back to Bellburn.

The pilot reported that about 18 km from Bellburn, without further pilot intervention, the power slowly started to decrease. To maintain height, the pilot increased the aircraft’s pitch, resulting in a decrease in airspeed. When the airspeed reached 80 kt, the best glide speed for the aircraft, the pilot commenced a shallow descent, maintaining 80 kt. The pilot reported fuel flow was reading approximately 45 l/hr in the turn. The pilot contacted the chief pilot to advise him of the descent and asked for further assistance. On suggestion from the chief pilot, the pilot moved the mixture control a few millimetres back and then forward again. Immediately the engine started to run very roughly. The fuel flow then dropped to 35 l/hr and the engine started to cough and splutter. The pilot estimated that they lost about 90 per cent of the power that had been available prior to adjusting the mixture setting.

At this point, the pilot determined that a forced landing was required and turned into wind. The pilot maintained 80 kt, and confirmed the fuel pump was on, the mixture control was set to full rich, the ignition was on both magnetos, and the throttle was pushed forward. The pilot advised the passengers that he was performing a forced landing and briefed them on the process for evacuating the aircraft after landing. During the descent, the pilot tried pushing the manual prime button, which produced no increase in engine performance.

The pilot selected a forced landing area and turned towards it. During the descent, at approximately 150 ft above ground level, the pilot secured the engine and turned off the aircraft’s electrical system. During the landing roll, the wings hit some small trees. Towards the end of the landing roll, the aircraft went into a ditch and tore off the nose landing gear.

The chief pilot reported that he notified air traffic control of VH‑BFL’s situation and position as the aircraft landed.

After the aircraft came to rest, the pilot directed the passengers out and away from the wreckage. The pilot checked everyone for injuries and provided assistance where required. The pilot returned to the aircraft, activated the emergency locator transmitter, and contacted the chief pilot in the company aircraft, which was circling overhead.

The pilot visually checked the fuel level in the left wing, and found it was close to full. There was a noticeable fuel leak from the right wing where a small tree had struck the wing, so the pilot turned off the master and avionics switches and went back to wait with the passengers.

After about ten minutes, two helicopters from Bellburn arrived and transferred the passengers and pilot back to Bellburn. The operator then utilised other aircraft in its fleet to ferry the pilot and passengers back to Kununurra where the pilot and three passengers attended the local hospital with minor injuries.

Figure 1: VH-BFL forced landing site

Source: Operator

The operator carried out a visual inspection of the aircraft at the accident site and noted that the number six cylinder air intake pipe was missing from the engine. Due to difficulties accessing the remote site, there was a delay in recovery and further examination of the wreckage by the operator.

The aircraft’s records indicated that a 110 hourly inspection was carried out three weeks prior to the accident. This included an inspection of the induction system and no defects were noted. The last engine overhaul was performed in April 2016, and no scheduled or unscheduled maintenance requiring the removal of the engine’s number six cylinder air intake pipe had been recorded since.

Records obtained from the fuel supplier indicated that checks were performed when the fuel was received, in addition to the subsequent daily inspections and a post-occurrence check following this occurrence. These checks all indicated the fuel was clear, bright, and contaminate-free.

Operator comments

The chief pilot provided the following comments:

• When visiting the forced landing site, several days after the event, a search of the forced landing site was performed however, the missing intake pipe was not found (Figures 2 and 3).
• The pilot had recently completed the company induction training package, which included several practice forced landings.

The chief engineer provided the following comments:

• A ’spanner check’ was carried out immediately after the accident on all Lycoming engines in the operator’s fleet. The same check was also carried out on engines from other manufacturers that had been recently overhauled and fitted. No deficiencies were found.
• Engineering staff were reminded to remain vigilant when refitting engine components.

Figure 2: Image of engine with number six cylinder air intake pipe missing

Figure 3: Lower (left image) and upper (right image) air intake pipe attachments points highlighted in red. Air intake pipe, bolts and flange are missing.

Source: Operator

Pilot comment

The pilot provided the following comments:

• On the day of the incident, the pilot had flown VH‑BFL from Kununurra to Bellburn and taken off again without any issues.
• The aircraft had sufficient fuel for the flight and was within weight and balance limits.
• Prior to the flight, the pilot conducted fuel drains on VH-BFL. No water or other contaminants were found in the fuel.
• Recent forced landing practice in the Airvan helped the pilot to feel more comfortable with the emergency. In particular, the recent practice gave the pilot a good appreciation for the Airvan’s glide ratio, which helped when selecting a suitable landing site.

Engine manufacturer comment

The engine manufacturer advised that detachment of an induction pipe will cause a loss of power and likely engine flame out. They further stated that:

The fuel injector measures the total induction airflow and meters fuel to the correct mixture ratio. An induction leak reduces the airflow through the injector, so there is less fuel metered, however the actual airflow to the cylinders is increased due to the leak, which results in an overall Lean mixture for all cylinders.

Previous occurrence

A review of the ATSB database identified a similar occurrence, involving the same aircraft type, which occurred on 21 October 2015, AO-2015-123. On that occasion the aircraft experienced a power loss shortly after take‑off however, sufficient power remained to permit a return to the departure airport. Prior to commencing operations that day a pre‑flight inspection of the aircraft had been conducted, with no defects found.

Examination of the aircraft after landing identified that the intake tube on the number four cylinder was loose. Maintenance, involving removal of the intake tube, had been conducted on 10 October 2019, however it was reported that the tube was securely re-fitted and that all other similar securing bolts were also checked. The circumstances that led to the fasteners loosening could not be established.

Safety analysis

During the flight from Kununurra to Bellburn and the subsequent departure from Bellburn, the pilot reported the aircraft was performing normally. From the start of the emergency, there was a gradual degradation in performance until a forced landing was required. The pilot noted that throughout the emergency, the fuel flow was indicating below normal and that all other engine indications were normal.

The reported performance of the aircraft was consistent with the likely symptoms resulting from the air intake pipe to number six engine cylinder becoming lose and then detaching in flight. Consequently, the ATSB concluded that the missing intake pipe was the cause of the loss of power however, consistent with the previous occurrence in 2015, the reason for the air intake pipe coming loose could not be determined.

The pilot made the decision to turn back to Bellburn Airfield early in this emergency and when the situation developed, he quickly recognised the need for a forced landing. By turning into wind and using the best glide speed for the aircraft, the pilot maximised the time available to deal with the emergency and his landing options. In addition, the pilot made good use of the supporting aircraft with the chief pilot on board for troubleshooting advice.

Although it could not be determined as to what extent the pilot’s recent forced landing practice influenced the accident sequence, it is likely that the practice reduced the risk of mishandling the emergency and may have prevented further injury to the occupants of the aircraft.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The air intake pipe to engine cylinder number six probably detached in flight, leading to the loss of engine performance. There was insufficient evidence to determine why the intake pipe detached from the engine.
• Recent forced landing practice performed by the pilot as part of the operator’s joining procedures likely reduced the risk of mishandling the emergency and may have prevented more serious injuries being received by the pilot and passengers during the forced landing.

Safety message

This accident highlights the importance of frequent emergency procedures training. The pilot’s handling of the forced landing contributed positively to the survivability of this accident in difficult terrain. Although, as a minimum, flight reviews are required every two years, pilots and operators are reminded of the benefits of more frequent practice of emergency procedures.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours

Safety summary

What happened

On 15 April 2018, a Qantas Airways Airbus A330, registered VH-EBR, departed Brisbane Airport, Queensland, for a regular public transport flight to Auckland, New Zealand. Shortly after departure, the crew received an advisory notification indicating excessive vibration from the left engine.

The crew reduced thrust on the left engine to idle, and the noise and vibrations ceased. The crew elected to return to Brisbane, and landed uneventfully. The thrust on the left engine remained at idle during the air turn back.

What the ATSB found

The General Electric CF6‑80E1 engine utilises rows of variable stator vanes (VSV) between each of its high-pressure compressor (HPC) stages for optimal airflow. Worn bushings led to fretting damage on a lever arm in the fourth-stage VSV system. The lever arm fractured, allowing the VSV to become off‑schedule (misaligned), affecting the airflow entering the stage four HPC.

The airflow disturbance resulted in abnormal aerodynamic loading and ultimately, fatigue failure of a fourth stage compressor blade. The downstream turbomachinery was then damaged due to the progression of blade debris through the engine.

Three non-mandatory VSV lever arm inspections were carried out prior to the occurrence but were not effective in detecting the bushing wear.

General Electric intended that replacement of the complete set of bushings was required when more than half of the accessible bushings were worn. However, the operator had proactively replaced worn bushings individually when found during maintenance. As a result, the threshold to replace the complete set would not be reached and inaccessible bushings would not be replaced.

What's been done as a result

As a result of this occurrence, Qantas inspected all CF6‑80E1 engines in the A330 fleet for similar defects. No defects were identified. Additionally, Qantas issued a maintenance memo to service personnel, highlighting the maintenance actions for the VSV system and precautions to be aware of when carrying out work in this area.

Safety message

When maintenance organisations carry out additional activities to what is required, they should consider checking with the manufacturer to confirm that no unintended consequences could be introduced.

The occurrence

At about 0905 Eastern Standard Time^[1] on 15 April 2018, Qantas Airways flight QF123, an Airbus A330-202 aircraft registered VH-EBR, departed Brisbane Airport, Queensland, for a regular public transport flight to Auckland, New Zealand.

About 4 minutes later, while climbing through 9,000 ft, the electronic centralised aircraft monitor displayed an ENG 1 N2 VIBRATION^[2] advisory notification, indicating excessive vibration on the left engine. The crew carried out actions in accordance with the abnormal and emergency procedures checklist, reducing thrust on the left engine. The aircraft continued its climb at reduced thrust.

After several minutes, while climbing through flight level 190,^[3] two loud bangs occurred and continuous airframe vibrations commenced. The crew reduced thrust on the left engine to idle and the noise and vibrations ceased. The thrust on the left engine remained at idle for the remainder of the flight. The crew declared a PAN PAN^[4] and returned to Brisbane, landing safely at about 0945.

__________

1. Eastern Standard Time: Coordinated Universal Time (UTC) + 10 hours.
2. N2: the rotational speed of the high-pressure compressor in a turbine engine.
3. Flight level: at altitudes above 10,000 ft. in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 190 equates to 19,000 ft.
4. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Context

Aircraft description

The Airbus A330 range of aircraft is a twin-engine, wide-body airliner. It is available with three different engine installation options. VH-EBR was fitted with General Electric (GE) CF6-80E1 (CF6) engines. Other engine options available for the A330 were the Pratt & Whitney PW4000, or the Rolls-Royce Trent 700 engines.

Recorded data

Figure 1 shows a plot of the data that was obtained from the quick access recorder (QAR). During the take-off roll, the left engine vibrations (black line) increased to a higher-than-normal level for the CF6. The vibrations continued to increase, resulting in the ENG 1 N2 VIBRATION message displaying on the electronic centralised aircraft monitor (ECAM) at about 0909. The left engine thrust was reduced in response. About 5 minutes later, two left engine vibration spikes were recorded, consistent with the loud bangs and airframe vibration reported by the crew. The left thrust lever was then reduced to idle.

The ATSB also downloaded data from the previous five flights. The recorded data showed that on each of those flights, the vibration level of the left engine was higher than normal but had not reached the limit to trigger the ECAM notification.

Figure 1: Plotted data from QAR showing vibration levels and thrust lever positions during the occurrence flight

Source: ATSB

Engine information

Post-flight engineering examination

A post-flight engineering inspection of the left engine identified metal fragments in the tail pipe and two missing fourth stage high-pressure compressor (HPC) blades. Figure 2 shows a cross‑section of the GE CF6 engine, with the location of stage four of the HPC highlighted.

The inspection also identified that several variable stator vane (VSV) lever arms were bent, and one was broken (Figure 3). The engine was subsequently shipped to an overhaul facility, where it was disassembled and inspected under the supervision of the engine manufacturer.

Figure 2: GE CF6 cross-section showing a detailed view of the HPC

Source: General Electric, annotated by ATSB

Figure 3: Section of the fourth stage variable stator vanes showing the fractured number 24 lever arm and resulting off-schedule vane. Inset shows location on engine at 3 o’clock position.

Source: Evergreen Aviation Technologies Corporation, annotated by ATSB

Engine disassembly and inspection

The engine disassembly and inspection revealed:

• there was no damage to the first three HPC stages
• two of the fourth stage HPC blade assemblies, number 3 and number 5, had separated at the dovetail-mounting portion of the blade root (Figure 4)
• of the 50 fourth stage VSV lever arms, eight were distorted and the number 24 position was completely fractured
• the separated blades had damaged the rear face of the fourth stage vanes with the distorted lever arms
• the compressor and turbine sections downstream of the separated HPC blades were damaged from progression of the blade debris through the gas path.

All of the fourth stage compressor blades, variable stator vanes and lever arms were sent to the engine manufacturer’s materials examination laboratory for analysis.

Figure 4: Disassembled engine showing fractured dovetails within fourth stage

Source: Evergreen Aviation Technologies Corporation annotated by ATSB

Component failure analysis

Fourth stage blades

A laboratory examination by GE found that the blade fitted to the number 3 position failed due to the propagation of a high-cycle fatigue^[5] crack that initiated in the blade root at the forward edge (in the direction of rotation). Other failures of the stage 4 blades have been reported previously, where the deterioration of the blade coating was identified as an important factor.  There was no significant deterioration of the blade coating on this engine.

The blade in the number 5 position failed as a result of more rapid fatigue crack progression cracking (Figure 5). The examination found that this was due to secondary damage, likely from impact by the released number 3 blade. One other fourth stage blade was cracked.

Figure 5: Detailed view of fractured blades

Source: General Electric, annotated by ATSB

Variable stator vane lever arm

The VSV lever arm fractured as a result of fatigue crack progression that originated at an area of fretting^[6] wear between the lever arm and washer (Figure 6 and Figure 7). The fretting on the lever arm was determined to have resulted from wear to the composite bushings fitted under the VSV lever arm. As the bushing wore, the VSV was allowed to tilt, placing a bending and twisting moment into the lever arm.

Figure 6: VSV design and component locations, highlighting outer bushing and lever arm

Source: General Electric, annotated by ATSB

Figure 7: Fractured VSV lever arm, its location and a close-up picture of the fracture surface showing fretting damage and high-cycle fatigue cracking

Source: General Electric, annotated by ATSB

Once the lever arm was broken, the vane rotated freely, which disrupted airflow into the fourth stage compressor. This created vibratory aerodynamic loading of the blades, which resulted in the fatigue cracking.

The bending damage in the nine VSV lever arms was determined to be secondary damage from contact with the separated compressor blades.

Engine maintenance history

The engine involved in this incident had accumulated 43,635 hours, 7,815 cycles since new and 13,047 hours, 3,352 cycles since its last overhaul. Since the last lever arm inspection, the engine had accumulated 2,474.46 hours and 551 cycles.

During the last engine overhaul, a number of fourth-stage compressor blades, including blade 3, were inspected, assessed as being serviceable and refitted. Others, including blade 5, were installed new at that time.

Variable stator vane inspections

Aircraft maintenance manual

VSV lever arm inspections were recommended by the engine manufacturer, but not mandatory. The inspection had an interval of 1,000 cycles between inspections. Qantas had opted to conduct this inspection, although in a modified form, due to a history of broken fifth stage lever arms experienced by other operators (see Related).

The aircraft maintenance manual (AMM) required inspection of the VSV:

stages 1, 2, 3 and 4 for vane trunnion metal touches stator case metal (MTM - metal-to-metal)

The manufacturer and operator both stated that lever arm looseness was identified through a wiggle check, which would indicate worn outer bushings. The AMM went on to state that if the engine had:

greater than 50% of the vanes in the stage with MTM

then the maintainer must:

replace outer bushings with new flanged outer bushings (this repair returns these parts to a serviceable condition).

This rectifying work could either be performed at the time of the initial inspection or postponed for a period, based on flight hours or cycles. The permitted extension was in place to allow time for maintenance action to be scheduled at the earliest opportunity.

Inspection accessibility

The ATSB examined a different CF6 engine fitted to an A330 undergoing maintenance and found that access to some VSV lever arms, at all stages of the compressor, was difficult.

About 75 per cent of the fourth stage VSV arms could be examined without engine removal and further disassembly of engine ancillary components. The remainder were not accessible due to the fitment of a large external gearbox covering the six to nine o’clock^[7] position of the engine. The number 24 lever arm was situated at the three o’clock position and was therefore accessible.

The ATSB asked the engine manufacturer how a maintainer could determine when 50 per cent of the lever arms were worn, if a quarter of them were not able to be accessed. The engine manufacturer advised that the determination was 50 per cent of the number accessible. The engine manufacturer also advised that the intent of the rectification requirements was that when the 50 per cent threshold was met, the bushings were to be replaced as a complete set on that compressor stage.

The engine manufacturer surveyed five other A330 operators on current inspection practices and common findings. Some operators did not carry out bushing inspections on-wing, due to the inspection being non-mandatory. They were only inspected during shop visits or if found during other maintenance. The operators did not report that the lever arm bushings wore preferentially in any location around each compressor stage.

Operator inspections

The operator proactively replaced any VSV bushing that was found worn, prior to the engine reaching the 50 per cent limit. Stage four bushings had been replaced on other engines where, a portion were replaced at any one time. They advised this was to improve the overall condition of the vane stages. They sought clarification from the engine manufacturer prior to the occurrence, regarding the suitability of individual replacement, but reported they had not received a response.

The engine involved in this incident had undergone three inspections of the VSV system since its last overhaul. No defects resulting from these inspections were noted, and no bushings had been replaced.

Related occurrences

In November 2017, a Qantas A330 experienced similar inflight vibrations. The flight continued to its destination, where an inspection found that number 24 lever arm was fractured and one HPC blade had separated. GE reported that there had been no other fourth stage lever arm occurrences of this type in over 23 million flight hours and 4.7 million flight cycles accumulated by the CF6-80E1 world fleet as at March 2018. There were a number of failures of HPC stage 5 lever arms prior to 2002, however that issue was resolved through redesigned lever arms and bushings.

The manufacturer analysed the November event and determined the lever arm and blade had failed in the same manner as the subject occurrence. There were no commonalities found with engine hours or cycles, and no indication that the event engines had been operated significantly differently from the fleet. The manufacturer therefore determined that the two events were most probably related to maintenance in the area.

The ATSB reviewed the maintenance work packages for the engines involved and considered, for example, whether the lever arms at the number 24 position had been unintentionally damaged during a particular maintenance practice, causing accelerated bushing wear. However, there were no aspects identified with respect to personnel or work practices that may have linked the two occurrences.

__________

5. High-cycle fatigue develops from repeated elastic (non-permanent) deformation of the material and is associated with a very high number of low-stress cycles.
6. High frequency, low amplitude relative motion between surfaces in contact.
7. O’clock: the clock code is used to denote the direction of, or the location on an aircraft relative to the observer’s position. In the case of an engine, when viewed from the rear.

Safety analysis

Engine vibration

The combination of worn outer bushings and fretting wear on a fourth stage high-pressure compressor (HPC) variable stator vane (VSV) lever arm resulted in a fatigue crack, leading to a fracture of the lever arm. The associated stator vane rotated into an off-schedule position and created turbulent airflow that acted like a cyclic pulse on the fourth stage HPC blades, as they passed the off-schedule vane. This aerodynamic cyclic loading resulted in initiation of a high-cycle fatigue crack in at least two compressor blades, until one blade separated at its root, causing damage to the downstream engine components and a noticeable increase in measured engine vibration.

Periodic maintenance

Qantas inspected the VSV system in accordance with the manufacturer’s non-mandatory inspection, with the exception of the individual replacement of worn bushings, as they were discovered. The inspections were generally effective in that assemblies accessible for inspection had previously been found to be loose and were replaced. However, while the failed (number 24) VSV lever arm was also accessible, no issues were found in the most recent inspections. Noting that the engine was approximately halfway between the 1,000 cycle inspections, it was possible that the looseness was not apparent at that time. Nevertheless, the inspections, as conducted, were not effective in detecting the worn bushing and thereby preventing this occurrence.

A consequence of the individual replacement of worn bushings, as opposed replacement of the entire set on a threshold of 50 per cent worn bushings, was that the inaccessible bushings would not be replaced while the engine was in service. While this would not have affected the outcome in this occurrence, modifying the replacement criteria reduced the overall effectiveness of the inspection.

Previous occurrences

This was only the second engine failure of its type on CF6‑80E1 engines. The occurrences were within five months of each other, involved the same operator and failure of the VSV arm in the same position. In the absence of commonalities in engine hours, cycles or service history, the engine manufacturer determined that the failures were most probably related to maintenance in the area of the VSV arm. The ATSB review of the associated maintenance work packages did not find any evidence to positively link the occurrences.

Findings

From the evidence available, the following findings are made with respect to the engine surge and high vibration involving an Airbus A330, registered VH-EBR, 44 km north-east of Gold Coast Airport, Queensland, on 15 April 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• A worn stator lever arm bushing resulted in fretting damage, initiation of a fatigue crack, and fracture of the lever arm.
• The fracture of the lever arm led to an off-schedule variable stator vane, which created turbulent airflow within the engine compressor section. This turbulent airflow led to the failure of a compressor blade at the blade root, due to high-cycle fatigue.
• The operator had conducted three non-mandatory inspections of the variable stator vane system since the engine's last overhaul. Despite these inspections being conducted, the outer bushing and lever arm at the number 24 position was able to wear, undetected.

Other findings

• The engine issue was one of two identified worldwide. Both occurred within 5 months of each other, in the same operator’s fleet and in the same number 24 position, and both on the left engine. The engine manufacturer, operator and the ATSB were unable to establish fully the reason for the timing, fleet, and position commonalities in the context of worldwide historical data.

Safety actions

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Qantas Airways

Qantas has taken proactive safety actions, including performing a once-through fleet inspection of variable stator vane (VSV) lever arms in the number 24 position, across the A330 fleet. No defects were identified as a result of this inspection.

Qantas also issued a VSV system awareness maintenance memo to engineering staff. The purpose of this memo was to highlight the importance of the inspection of VSV lever arm system for worn bushings and precautions to be aware of when carrying out work in this area.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Qantas Airways
• General Electric Aviation
• aircraft Quick Access Recorder.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Qantas Airways, General Electric Aviation, National Transportation Safety Board, Bureau d’Enquêtes et d’Analyses and the Civil Aviation Safety Authority.

Submissions were received from General Electric Aviation. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

At about 0600 Western Standard Time^[1] on 20 April 2018, the 103 m livestock carrier Angus Express (Cover) arrived at the Broome, Western Australia, pilot boarding ground. The ship had just completed a voyage from Singapore, and was expected to load cattle at berths 4 and 5.

A pilot boarded Angus Express and was escorted to the ship’s navigation bridge. The bridge team consisted of the master, chief mate (under supervision as trainee master), and a seaman as the helmsman. The chief mate, master and pilot then commenced the master-pilot information exchange (MPX). During the exchange, they discussed the ship’s characteristics, the inward passage and the berthing plan.

When booking the pilotage on 16 April 2018, the master had advised that the ship’s bow thruster was inoperable. The port’s handbook^[2] recommended that a ship of Angus Express’s length with no thruster utilise two tugs for arrival and departure. The tugs were booked in advance, but at about 1845 on 19 April, the pilot became aware that only one of the port’s two tugs would be available as the other tug was out of service for a week for repairs. He informed the harbour master who advised that provided there were no strong winds and the ship berthed within an hour or less of slack water,^[3] the pilot could make the decision whether to continue with the berthing. The pilot then conducted a risk assessment and discussed it with the harbour master. They determined that the ship could berth with the use of only one tug.

The pilot explained the plan to the ship’s chief mate and master during the MPX and they agreed with the plan. The pilotage into Broome continued with a tug in attendance from 0636 (Figure 1), and went as planned and without incident.

Figure 1: Angus Express’s arrival into Broome and the approach to berth 4 & 5

Source: Australian Hydrographic Service, annotated by ATSB

The pilot swung the ship to port and approached the wharf, to berth starboard side alongside. By 0710, the ship was alongside the wharf, with two Yokohama fenders^[4] positioned forward and aft, between the ship and wharf’s vertical fender posts (low water was at 0711 (1.55 m)).

The ship was about 8 m aft of its berthing position at berth 4 and 5, when mooring lines were run to the wharf. The pilot then tried to use the mooring winches to heave in the mooring lines to move the ship forward into position. However, by this time, the slack tide was starting to change and the pilot estimated there was a current working against the bow and the mooring winches were ineffective. The pilot then instructed the tug, in position about amidships, to push forwards at a 45° angle using minimum power, to assist repositioning the ship.

At 0712, the weight of the ship against the forward Yokohama fender forced it to pass under the fender posts, which resulted in the ship’s bow moving towards the wharf (Figure 2). Shortly after, an overhanging scupper^[5] protrusion made contact with the fender post (about 30 m from the ship’s bow).

Figure 2: Damage to the Angus Express’s starboard scupper protrusion

Source: Kimberley Ports Authority, annotated by ATSB

The pilot thought that the ship had pivoted on the Yokohama fender and instructed the tug to stop pushing. The ship moved slightly off the fender posts and the fender cleared the post.

At 0714, the pilot instructed the tug to push minimum forward again, resulting in the forward Yokohama fender once again passing underneath the fender posts. The ship’s bow again moved towards the wharf, and the scupper protrusion again made contact with the fender post (Figure 2). The pilot instructed the tug to stop, and the ship came away from the vertical fender posts.

The pilot then advised the master to use the ship’s engines to reposition the ship. At 0718, the ship was in position as intended and all fast^[6] with the height of tide now at 1.65 m.

The pilot reported the incident to the harbour master who subsequently attended the ship and found minor damage to the ship’s superstructure.

Yokohama fenders in Broome

The Yokohama fender system in the Port of Broome consisted of large floating cylindrical rubber fenders, secured to vertical fender posts, which allowed vertical movement as the tide changed. The tyres fitted with chain to the outside of the fenders for protection also increased their width. The use of fenders kept the ship’s side clear of the wharf, protecting both, and allowed longer loading windows (Figure 3). The added clearance from the wharf also reduced the steepness of the gangway in the large tidal range at Broome.

Figure 3: Berthing plan showing the position of the Yokohama fenders at berth 4 & 5

Source: Kimberley Port Authority, annotated by ATSB

After the incident, inquiries by Angus Express’s pilot resulted in a pilot who had worked in the port until 2015 providing relevant information about the Yokohama fender system. That pilot’s personal pilotage log indicated that a height of tide of less than 2.5 m was considered a significant factor with respect to the fenders at berth 5. When the water level fell below this height, the fenders could be forced under the vertical fender posts by a ship.

Post-incident investigations by Kimberley Ports Authority (KPA) and the pilotage provider, West Coast Pilots (WCP) confirmed that the fender posts at berths 4 and 5 were shorter than at others. No evidence was found to indicate that these shorter posts or the potential for fenders to be forced under them when water levels fell had been documented or otherwise promulgated to pilots through training or instruction.

Safety analysis

Yokohama Fenders

The height of tide at the time of the incident was 1.62 m, which was low enough to expose the base of the fender posts (Figure 3). When the pilot attempted to manoeuvre Angus Express forward using the tug, the force exerted on the Yokohama fender by the ship, allowed it squash and roll under the fender post. Consequently, the ship moved closer to the wharf and the scupper protrusion contacted the post.

Risk assessment

The reason for changing Angus Express’s berthing plan was a possible 1-week delay due to tug unavailability. Such a delay could have resulted in stranding a large number of cattle in holding yards for a long period with only about 8 hours of loading fodder available. Therefore, the reason to change the berthing plan (subject to a risk assessment) were valid.

However, at that time, neither the pilot nor the management of both WCP and KPA were aware of the shorter fender posts at berths 4 and 5, and the potential for Yokohama fenders to be forced under them. Had this information been known and effectively disseminated, it would have been considered during the risk assessment and the incident could have been avoided.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The height of tide when Angus Express was berthing was low enough to expose the base of the wharf’s fender posts. Consequently, when the tug pushed to move the ship, the forward Yokohama fender was forced under the post, which allowed the ship's starboard scupper protrusion to contact the post with resulting damage.
• The harbour master and pilot were unaware of any height of tide limitations associated with berthing ships alongside Yokohama fenders at berths 4 and 5. Therefore, the risk assessment did not include any mitigating factors for berthing alongside at a height of tide less than 2.5 m.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Kimberley Ports Authority

As a result of this occurrence Kimberley Ports Authority advised the ATSB that it had taken the following actions.

Berthing with Yokohama style fenders

Guidelines for berthing and being alongside when using Yokohama style fenders have been implemented for times of limiting low water levels. Also, the risk evaluation process between harbour master and pilot has been extended to include focussed quick risk assessment for circumstances such as tug shortages, vessel manoeuvring issues and tidal levels.

A memorandum has been issued to all pilots and port users advising of these changes.

Safety message

This incident highlights the fact that marine pilots may encounter operational parameters outside normal limits. Whenever this occurs and learning opportunities are identified, it is important to ensure these are captured through proper reporting processes. This information can then be shared through training and awareness to reduce risk and avoid incidents.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. Marine pilotage is one of the safety concerns, with further information available from the ATSB’s website.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Kimberley Ports Authority, Port of Broome, Port and Terminal Handbook.
3. The period between a flood steam and ebb stream, when there is little or no flow.
4. Yokohama fenders are pneumatic fenders used to avoid damage to the ship and the wharf, jetty or dock.
5. An opening in the side of a ship at or just below the level of the main deck, to allow water to run off.
6. The running of three head and stern lines and two forward and aft spring lines, to hold the ship alongside the wharf.

Safety summary

What happened

On 28 April 2018, a Qantas Boeing 737 (VH-XZM) landed on runway 03 at Perth, Western Australia. The aircraft exited the runway onto taxiway J2, which led to a holding point for crossing runway 06. The aircraft did not stop at the holding point and crossed an illuminated stop bar without an air traffic control clearance.

At that time, a second Qantas Boeing 737 (VH-VZL) had commenced take-off from runway 06. An automated warning alerted the aerodrome controller (ADC) of the stop bar violation and the controller issued an instruction for the departing 737 to stop immediately. Soon after, the flight crew of VH‑XZM became situationally aware of their position and stopped just before crossing the edge of runway 06. VH-VZL’s wingtip passed about 15 m from VH-XZM’s nose at low speed.

What the ATSB found

The captain of VH-XZM developed an incorrect mental model of the exit taxiways off runway 03, believing the aircraft would not have to cross runway 06 after exiting onto either of the potential taxiways (J2 or D). Due to this incorrect mental model, and a combination of workload and distractions at key times, the flight crew did not detect the runway crossing issue until their aircraft had almost reached the edge of runway 06.

Taxiway J2 was the preferred runway exit for jet aircraft landing on runway 03. However, the location and design of the taxiway significantly increased the risk of a runway incursion onto runway 06/24. In particular, it had a relatively shallow intersection angle with the runway and a relatively wide turn radius, leading to higher taxi speeds, and a short distance to the holding point for runway 06/24.

Although the junction around taxiway J2 was identified as a ‘hot spot’, there was no detailed information about the reasons why it was a hot spot on aerodrome charts, and Qantas did not specifically require pilots to brief hot spots during departure and approach briefings.

What's been done as a result

In response to the runway incursion, Airservices Australia made taxiway J2 unavailable for use. Subsequently, Perth Airport removed taxiway J2 from aerodrome charts.

In addition, Airservices Australia changed the settings of an alerting system to ensure tower controllers at Perth Airport performing multiple roles received appropriate aural and visual alerts at their workstation.

Qantas published a safety information notice to all pilots containing information about the background of runway incursions, details of two recent runway incursion occurrences and safety educational information related to influencing factors, stop bar techniques and strategies to avoid a runway incursion. Qantas also updated its Flight Administration Manual to include a requirement for pilots to brief relevant airport hot spots and their contingency planning to mitigate against the possibility of collision or runway incursion.

Safety message

Runway incursions are one of the most significant risks to safe aviation operations and a key global safety priority. Airport operators and local runway safety teams are strongly encouraged to identify and mitigate the risk of hot spots, especially those that involve short distances between runways, complicated junctions, and the potential for higher taxi speeds.

Pilots are strongly encouraged to identify runway hot spots during departure and approach briefings, and discuss the actions they will take to reduce the risk of a runway incursion at such hot spots.

Air traffic controllers are strongly encouraged to provide safety alerts and/or clear instructions (such as ‘stop immediately’) to the flight crews of all aircraft involved in runway incursions and related occurrences.

The occurrence

Overview

On 28 April 2018, a Boeing 737-838 (737) aircraft, registered VH-XZM, was being operated by Qantas Airways Limited (Qantas) on a regular public transport flight from Sydney, New South Wales to Perth, Western Australia. The aircraft landed on runway 03 and exited using taxiway J2 (Figure 1). The aircraft did not stop at the runway 06 holding point and crossed an illuminated stop bar without an air traffic control (ATC) clearance.

VH-XZM’s incursion into the flight strip of runway 06 resulted in a rejected take-off of another Qantas Boeing 737 aircraft (VH-VZL), which was taking off from runway 06. VH-VZL’s wingtip passed about 15 m from the nose of VH-XZM at low speed before stopping.

Figure 1: Overview of the runway incursion

Source: Google Earth, modified by ATSB

Events prior to the occurrence

VH-XZM departed Sydney at 1033 Western Standard Time^[1] on the scheduled flight to Perth. During their review of NOTAMs,^[2] the flight crew noted the recent installation of stop bars at Perth Airport.

On this sector the captain was pilot monitoring and the first officer (FO) was pilot flying.^[3] Prior to descent, the approach controller cleared the flight crew for an area navigation (RNAV-X) runway 03^[4] approach. Weather conditions for the descent and approach were good.

Prior to descent, the FO conducted an approach briefing, noting taxiway J2 (Figure 2) was the preferred exit and they would need to get an ATC clearance to cross runway 06. The FO recalled being aware that taxiway J2 was a designated ‘hot spot’ but did not brief it as a hot spot or state that runway incursions happened there. The captain expressed a preference to request taxiway D, which was closer to the terminal building. At the completion of the briefing, the FO believed that the captain understood they would vacate runway 03 onto taxiway J2 unless they had a clearance to exit at taxiway D.

The captain recalled the briefing as professional and very thorough, but did not fully absorb all of the FO’s briefing points (due to the level of detail in the briefing). The captain also recalled, that when discussing the taxi route to their assigned parking bay (13), being mainly focussed on vacating onto taxiway D, which led directly onto the apron, with taxiway J2 being the secondary plan. Having referenced the smaller apron chart (Figure 3) and not the larger aerodrome chart, the captain’s mental model of the taxiway J layout was that if they used taxiway J2 they would vacate the landing runway 03 directly on taxiway J1, which led directly to the apron area. The captain interpreted the FO’s point about a requirement to cross runway 06 as being during the landing roll on runway 03.

During the approach phase, another aircraft, also on approach to land on Perth runway 03, was following VH-XZM. It had been slowed down by ATC to coordinate the two arriving aircraft. ATC requested the flight crew of VH-XZM to maintain a high speed descent, which they accepted.

Figure 2: Perth aerodrome chart

Source: Airservices Australia, annotated by ATSB

Figure 3: Perth apron chart showing captain’s mental model of taxi routes to bay 13

Source: Qantas, annotated by ATSB

Final approach and landing

The RNAV-X runway 03 approach required a descending right turn from about 2,180 ft to 790 ft. The FO recalled the captain commenting that, when flying the RNAV-X runway 03 approach, it could be difficult to slow the aircraft down and they would need to conservatively configure the aircraft for the arrival.

At 1438:55, the captain made first contact with the aerodrome controller (ADC) on the Perth ADC (tower) frequency. The captain recalled that the radio call was made during a period of high workload while closely monitoring the FO, the aircraft speed and the approach profile, and that the aircraft was not slowing down as quickly as desired.

The aircraft descended through 1,600 ft, configured with gear down and flaps 15 set, and the airspeed about 175 kt. As that speed was the flaps extension limit speed for flaps 30 (the intended flaps setting for landing), the captain suggested to the FO they select flaps 25 (a non-normal setting) to decelerate to enable selection of flaps 30, which they did once the aircraft slowed.

The captain recalled being ‘totally focused’ on the FO flying an accurate approach profile and descending turn. Due to this high workload, the request to take taxiway D after landing was forgotten. The captain also forgot to pre-set the Perth ground frequency in the radio’s standby frequency position, a routinely performed task.

The captain started actioning the landing checklist. At 1439:28, that process was interrupted by the ADC issuing them a clearance to land on runway 03. At that time the aircraft was passing approximately 1,100 ft and still in a descending right turn to final approach. The flight crew completed the landing checklist and continued the approach within the requirements of the Qantas stabilised approach criteria.

During this time, VH-VZL was taxiing to runway 06 for departure and its flight crew were monitoring the Perth surface movement controller (SMC/ground) frequency. At 1440:59, that flight crew changed to the ADC frequency and advised the ADC they were ready. At 1441:02, the ADC cleared them to line up and wait on runway 06.

At 1441:21, VH-XZM landed on runway 03 and the FO selected idle reverse thrust. While the aircraft was decelerating, the captain realised that an egress onto taxiway D had not been requested from the ADC and believed they were now committed to vacate via taxiway J2. At about 60 kt, the captain took control of the aircraft from the FO (consistent with normal procedures)^[5] and applied heavier braking so the aircraft could make taxiway J2.

Approaching taxiway J2 for the first time, the captain thought it appeared to be a rapid exit taxiway (RET). The aircraft’s groundspeed was about 53 kt when, at 1441:42, the captain started to turn off the runway centreline towards taxiway J2, continuing to slow throughout the turn and passing over the left edge of runway 03 at 1441:47 at 35 kt.

Taxi and runway incursion

At 1441:51, once certain that VH-XZM would vacate runway 03 onto taxiway J2, the ADC issued VH‑VZL’s flight crew a take-off clearance on runway 06, which was then read back by the crew of VH-VZL. At 1441:59, another aircraft, which had been following VH-XZM and was now on final approach to runway 03, also made a transmission on the ADC frequency.

The captain of VH-XZM recalled hearing the ADC issue a take-off clearance to another Qantas aircraft but did not recall hearing the words ‘runway 06’ and did not associate it with a potential threat at the time. The FO did not recall hearing any ATC transmission at that time.

The SMC reported being aware that VH-XZM was on taxiway J2, and the flight crew would soon be calling on the SMC frequency to report they were at the holding point. However, when the ADC gave VH-VZL a take-off clearance, the SMC switched attention to other aircraft on the apron area, knowing that VH-XZM would not be able to cross runway 06 for a while.

Figure 4 shows the relative positions of VH-XZM and VH-VZL during the remainder of the occurrence sequence.

Figure 4: Overview of the runway incursion

White aircraft symbols show the aircraft positions at 5-second intervals. White lines show the angle between the two aircraft at some of those times. Labels show events that occur within 1 second of the aircraft’s position illustrated.

Source: Google Earth, modified by ATSB

At 1441:55, VH-XZM passed over the holding point for runway 03 at a groundspeed of about 22 kt. At about this time, the FO assessed that the captain was still slowing the aircraft at a rate to stop at the runway 06 holding point; the FO was aware that they needed an ATC clearance to cross runway 06 and assumed that the captain would stop.

The FO then refocused their attention inside the flight deck and noticed that the Perth SMC frequency had not been pre‑set as the radio’s standby frequency. As a result, reference was made to the aerodrome chart to find the frequency to set. This led to a delay in contacting the SMC to receive taxi instructions. The captain recalled also briefly looking down to understand the reason for the delay and telling the FO the required frequency.

Although being aware that stop bars had recently been installed at Perth, the captain recalled being surprised to see an illuminated stop bar ahead on the taxiway and thought it strange that a stop bar would be positioned at that location. The captain believed they were on taxiway J1, which did not require a runway crossing, and rationalised that the stop bar had been mistakenly constructed with omnidirectional lighting^[6] and that it was for aircraft taxiing from the opposite direction entering runway 03. The captain also thought that, given their current taxi speed and how quickly it appeared after exiting the runway, the stop bar could not be meant for their aircraft. The captain did not recall noticing any markings that identified runway 06. Consequently, they taxied over the illuminated stop bar and through the runway 06 holding point.

At 1442:01, the nose of VH-XZM passed the runway 06 holding point (with an illuminated stop bar) at a groundspeed of 17 kt. At 1442:04, in the tower, the integrated tower automation suite (INTAS) made the first of two aural and text alerts on the ADC’s workstation. The aural alert comprised a synthetic voice stating ‘warning runway zero six stop bar violation’. The alert was designed to trigger when the aircraft was registered to be 8 m past the stop bar. At this time, the aircraft was travelling at about 14 kt.

Due to default settings within INTAS, no aural or text alert was provided on the SMC’s workstation. The SMC later reported hearing the aural alert through a speaker on the ADC’s workstation, and then saw VH-XZM entering the runway and VH-VZL rolling for take-off. At this time the SMC was part way through providing a pushback clearance to another aircraft and the flight crew of that aircraft then read back the clearance details on the SMC frequency.

At the time of the first INTAS alert, the flight crew of VH-VZL had just commenced rolling for take-off on runway 06 and were setting engine thrust. The ADC recalled having communication with VH-VZL and considered that, as VH-XZM had vacated runway 03, it should have transferred to the SMC frequency. Initially, a radio transmission from another aircraft prevented the ADC from transmitting on the ADC frequency. As soon as it stopped, at 1442:11, the ADC instructed VH-VZL’s flight crew to ‘stop immediately, stop immediately, runway incursion ahead’.

The captain of VH-VZL subsequently reported being aware of the other aircraft when it was taxiing on taxiway J2. When the stop instruction from the ADC was received, the captain was just starting to have an element of doubt as to whether the other aircraft would stop, and during the instruction initiated a rejected take-off by bringing the thrust levers back and braking. At that time the aircraft’s groundspeed was 58 kt.

As VH-XZM’s flight crew had transferred to the SMC frequency at some point before 1442:11, they did not hear the stop instruction issued to VH-VZL and were unaware of that aircraft’s presence and proximity. The captain continued taxiing towards runway 06 at about 10 kt, and then observed another aircraft (a Boeing 787) ahead on the apron (Figure 5). It had recently pushed back and was now blocking taxiway J1. The captain reported being distracted by the aircraft on the apron as it blocked their intended route on taxiway J1 and now required their aircraft to turn onto taxiway A.

Figure 5: Aircraft on the apron as XZM taxis toward runway 06

Source: Perth Airport

At 1442:16, the second INTAS aural (‘warning runway zero six occupied’) and text alert activated while the flight crew of VH-VZL was rejecting the take-off. As with the previous alert, the second alert was not presented at the SMC’s workstation. As the first INTAS alert was still active, the controllers now had multiple warnings sounding, which increased the noise level in the tower.

At the same time as the second INTAS alert, VH-XZM’s FO contacted the SMC advising they were taxiing for bay 13. The SMC did not respond to that transmission, and subsequently could not recall whether that transmission was heard.

The captain of VH-XZM recalled seeing (in peripheral vision) an aircraft (VH-VZL) going faster than would be expected on a taxiway, then applying the brakes to stop the aircraft. The FO recalled that, when looking up, probably about the time the captain began braking, they realised they were in a different position to that expected and called ‘stop, stop, stop’.

The captain applied VH-XZM’s brakes at 1442:19, when the speed was 9 kt, and the aircraft came to a full stop at 1442:25. At 1442:29, VH-VZL came to a stop on runway 06, having just passed ahead of VH-XZM. The wingtip of VH-VZL passed about 15 m from the nose of VH-XZM at low speed.

At 1442:26, just before VH-VZL stopped, the SMC asked if VH-XZM was ‘on this frequency’ and the FO responded with ‘affirm’, their callsign, and the intended bay. The SMC advised VH-XZM’s crew that they had crossed a stop bar and had a runway incursion, and to hold position. The flight crew of VH-VZL were subsequently cleared to taxi back to runway 06 for departure. The flight crew of VH-XZM were cleared to taxi to bay 13.

__________

1. Western Standard Time (WST) was Coordinated Universal Time (UTC) + 8 hours. All times in this report are WST unless otherwise stated.
2. NOTAM: notice to airmen, which alerts pilots to any potential safety hazards along a flight route.
3. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
4. Runways are numbered in relation to their magnetic direction rounded off to the nearest 10°. This is the runway designation.
5. It is standard operating procedure on the Boeing 737 for the captain to take control of the aircraft after landing. The 737 has a single steering tiller located on the captain’s side of the flight deck. The tiller provides nose wheel steering control while the aircraft is taxiing.
6. Omnidirectional lighting is visible from all directions. Stop bar lighting is unidirectional (only visible from one direction).

Context

Personnel information

Flight crew of VH-XZM

The captain held an Airline Transport Pilot (Aeroplane) Licence (ATPL) and was appropriately qualified to conduct the flight. Having flown 737s since 2007, the captain had operated into Perth Airport many times, including three to four times in the last 4–5 months. Most of the landings at Perth were on runway 21 or 24, using taxiway J1 from runway 24. The captain had rarely landed on runway 03 and only recalled using taxiway D off that runway and had not previously used taxiway J2. Although aware that stop bars had been installed at Perth Airport, and having encountered them at other airports, the captain had not previously encountered them at Perth.

The first officer (FO) held an ATPL and was appropriately qualified to conduct the flight. The occurrence flight was the third set of flights since completing FO training on the 737, having previously operated as an Airbus A330 second officer. The FO had landed at Perth on five previous occasions, including two landings on runway 03 (which had exited on taxiway D). The occurrence flight was the first time the FO had landed on runway 03 and vacated via taxiway J2.

Both flight crew were based in Brisbane. They both had 3 days off duty during 24–26 April 2018, then on 27 April they commenced a 3-day trip together. On 27 April they signed on at 0530 Eastern Standard Time (EST)^[7] and flew a series of flights, ending their duty time at about 1530 EST. On 28 April, they signed on for duty at Gold Coast Airport about 0725 EST, then operated a flight from the Gold Coast to Sydney. Following a transit in Sydney they then commenced the flight to Perth. At the time of the occurrence both of them had been on duty for 10.3 hours. They described the workload during the day as not being significant or unusual. They departed Sydney about 1 hour behind schedule due to connecting aircraft and reported not feeling any commercial pressure.

The flight crew’s roster provided both flight crew with sufficient sleep opportunity in the nights prior to the occurrence. The captain reported having about 7 hours sleep the night before the occurrence and normal sleep in the nights before. The FO reported having a normal amount of sleep the night before the occurrence and the nights before that. Both flight crew reported being a little tired at the time of the occurrence. However, given the other available information, there was insufficient evidence to suggest they were experiencing a level of fatigue that has been demonstrated to adversely influence performance.

Air traffic controllers

At the time of the occurrence, Perth tower was staffed by two air traffic controllers:

• the aerodrome controller (ADC), who was responsible for controlling all aircraft and vehicle movements on all runways
• the surface movement controller (SMC), who was performing the combined duties of SMC (responsible for controlling all aircraft and vehicle movements on the airport aprons and other manoeuvring areas) and airways clearance delivery controller (responsible for issuing airways clearances to departing aircraft).

Both controllers were correctly endorsed for their roles. The ADC on duty at the time of the occurrence had over 30 years’ experience and was fully endorsed for all roles in the Perth tower. The SMC had 3 years’ experience at Perth tower (and prior experience overseas) and was endorsed for all roles in the Perth tower.

The controllers reported that aircraft movements had been ‘quiet’ in the period leading up to the occurrence, with only 4 or 5 aircraft movements occurring at intermittent times.

The ADC reported having about 8 hours sleep the night before the occurrence and normal sleep in the nights before. On 28 April, the ADC signed on for duty at 0730 WST and had several rest periods during the shift. At the time of the occurrence, the ADC had been on duty for 7.2 hours, due to sign off at 1530.

The SMC reported having a normal sleep the night before the occurrence and normal sleep in the nights before. On 28 April, the SMC signed on for duty at 1345, and had been performing the role for about 45 minutes prior to the occurrence.

Both of the controllers recalled feeling alert at the time of the occurrence and had sufficient sleep opportunity in the nights prior to the occurrence. There was no evidence to suggest they were experiencing a level of fatigue that has been demonstrated to adversely influence performance.

Meteorological information

At the time of the occurrence, the Perth automatic terminal information service (ATIS) broadcast the wind was variable at 5 kt with a maximum tailwind on runway 03 of 5 kt. The conditions were CAVOK^[8] and the temperature was 28 °C. The ATIS also advised that stop bars were active at all runway holding points.

The flight crew of VH-XZM reported the weather conditions as fine with light winds and good visibility. The captain stated there was no tailwind during landing on runway 03. There were no reported concerns with sun glare or other factors affecting visibility for the flight crew of VH‑XZM. The controllers stated the weather conditions were fine with no restrictions on visibility from the tower.

Closed-circuit television footage at the terminal verified all recollections of weather and visibility conditions made by flight crews and controllers.

Recorded information

On-board recordings

Both 737 aircraft involved in the occurrence (VH-XZM and VH-VZL) were fitted with a flight data recorder (FDR) and cockpit voice recorder (CVR) as required by the applicable legislation.

Qantas downloaded both FDRs and sent the digital files to the ATSB. Both FDRs included data over the period of the occurrence. This information has been included in this report where relevant.

Each CVR was capable of recording 2 hours of data, which would have included communications between the flight crew, communications with air traffic control and various flight deck sounds, alerts and warnings. The CVR for VH-XZM was not preserved before being overwritten during ground activities.^[9]

There were no reported defects associated with VH-XZM.

Air traffic control recordings

Air traffic control (ATC) audio recordings and integrated tower automation suite (INTAS) data records were obtained from Airservices Australia. The audio recordings provided all relevant radio communications between controllers and flight crews, and the synthetic voice INTAS warnings. INTAS data records provided aircraft position information that could be compared with other sources of recorded data.

Flight crew briefing requirements

Operator information

The Qantas Flight Administration Manual (FAM) outlined standard operating procedures and detailed guidance to flight crew on the conduct of briefings.

The FAM stated:

The objective of a briefing is to ensure all Flight Crew understand and share a common mental model for the proposed plan of action.

Furthermore, it stated that for the briefings to remain effective they should be:

Interactive – engaging all Flight Crew members and ensuring a practical understanding of what is proposed.

Threat and Error Management Based – briefing points should include identification and assessment of threats. Plans for dealing with identified threat should be discussed. The depth of the briefing content should be commensurate with the assessed threat environment.

Concise and Relevant – content must serve to refresh knowledge considered necessary for crew coordination. It is unnecessary to reiterate standard operating procedures or discuss every detail of published procedures as each Flight Crew member must review pertinent information and FMS [flight management system] setup in preparation for the briefing.

Briefing emphasis should be directed to plans or requirements which vary from those routinely used.

On a multi-sector tour of duty involving Australian ports, there is no requirement for repetition of items previously briefed for the same departure or arrival, provided that the Pilot In Command is satisfied that the pertinent information is understood by all Flight Crew.

Timely and Logical – to assist delivery and understanding, briefings must be scheduled so as not to interfere with operational tasks and the content should follow a logical sequence based on phase of flight. The briefing framework must conform to the following structure and sequence:

– Considerations with emphasis on threat identification, assessment and implementation of management strategies.

– Normal operations with emphasis on sharing plans of action.

– Contingency and non-normal aspects with emphasis on contingency planning.

For approach and arrivals at an airport, it was standard practice for the briefing to be completed prior to commencing the descent.

The FAM section 21.2.4.4 gave flight crew the following guidance:

Considerations – identify and assess the threats and considerations that may affect the arrival plan which may include but not necessarily be limited to terrain, adverse weather, airport conditions, NOTAMs, aircraft maintenance status, RMS [route manual supplement] or specific state requirements, traffic, ATC, ground support and fuel conservation opportunities.

Normal Operations

– Arrival and Approach – brief chart page number, together with relevant charted requirements. For runways where there is no published instrument procedure the anticipated arrival plan should be briefed. Nominate planned approach procedures.

– Navigation and Altimetry – brief the relevant navigation and altimetry requirements.

– Automation – brief the planned level of automation to be used and the transition to manual flight.

– Landing – brief landing flap configuration, level of reverse thrust and auto-brake setting for planned runway exit.

– Contingency Planning – brief contingency plans for all threats assessed as requiring crew management.

The FAM guidance did not specifically require flight crews to brief hot spot locations or describe how runway incursion threats would be mitigated.

Other guidance for flight crew briefings

International Civil Aviation Organization (ICAO) document 9870 Manual on the Prevention of Runway Incursions stated:

The “before start” and “descent” briefings should also contain a complete review of the expected taxi routes with special attention to the hot spots.

Guidance from the United States Federal Aviation Administration (FAA) in 2012 called for operators to develop and implement specific procedures to prevent runway incursions. The FAA advisory circular AC 120-74B (Parts 91, 121, 125, and 135 Flight crew procedures during taxi operations) emphasised that a thorough taxi briefing should include a review of the airport diagram and identify critical locations on a taxi route, including, but not limited to, hot spots, complex taxiway intersections and runway crossing points. In addition, the circular called for procedures that would require flight crews to describe how runway incursion threats would be mitigated: by briefing the timing and execution of checklists and communications, so that no flight crew member was preoccupied or head-down when approaching an active runway.

There was no CASA guidance regarding the inclusion of runway hot spots or incursion threats in pre-flight or in-flight briefings. The ATSB reviewed the documentation of two other Australian airlines and found that one specified a mandatory requirement for flight crews to verbally brief runway hot spots, and the other provided detailed guidance material regarding runway hot spots and recommended that flight crews verbally brief them.

Airport information

General information

Perth Airport had two runways. The main runway was oriented 03/21 and the cross runway 06/24 (Figure 2). Both were 45 m wide and had a 150-m wide flight strip.^[10]

Preferred taxiway

Since 2014, the Aeronautical Information Publication (AIP) entry for Perth Airport stated the preferred exit taxiways for arriving aircraft on each runway and for different types of aircraft. The preferred taxiway for jet aircraft landing on runway 03 was J2 and for turboprop aircraft it was A6. The AIP stated that the preferred taxiways were to ‘ensure minimum runway occupancy time and support optimum spacing on final [approach]’.^[11]

Data provided by Airservices Australia indicated that, from May 2017 to April 2018, about 24 per cent of all aircraft landing on runway 03 exited via J2. Data provided by Qantas showed that, of its 737 fleet landings on runway 03, about 44 per cent vacated runway 03 at taxiway J2. Qantas noted that its pilots preferred to exit runway 03 at taxiway D as it resulted in a shorter and more direct route to the terminal.

The AIP stated that, unless specified otherwise by ATC, an aircraft must promptly vacate the runway after landing without backtracking. There was no requirement under the AIP for an aircraft to use the first available taxiway.

Taxiway J2

Arrangement

Taxiway J2 was located approximately 1,911 m from the threshold of runway 03. It led to a 6-way intersection comprising runway 06/24 and three other taxiways (Figure 6).

Taxiway J2 intersected runway 03 at a 60° angle. The straight distance from the edge of runway 03 to the runway 06 holding point was approximately 176 m, and the distance from the runway 03 holding point and the runway 06 holding point was about 70 m. The distance from the runway 06 holding point to the edge of runway 06 was about 102 m.

Figure 6: Taxiway J2 in relation to runways and other taxiways

All annotations are approximate and for illustration purposes only.

Source: Google earth annotated by ATSB

The Civil Aviation Safety Authority (CASA) outlined Australian requirements for aerodromes in Civil Aviation Safety Regulation (CASR) Part 139 and the associated Manual of Standards (MOS). As an airport operator licensed by CASA, Perth Airport was responsible for the safety of the aerodrome in accordance with those requirements.

The MOS section 6.3.3 Taxiway Curves defined the minimum curve radius required for taxiway design speeds, which are listed in Table 1. For taxiway J2, with a curve radius of 200 m, the taxiway design speed was about 31 kt. VH-XZM’s turn from the runway onto the taxiway was made at an average speed of 34 kt.

Table 1: Taxiway design speed for minimum radius of curve

Runway holding point markings

Perth Airport runway holding points (or runway-holding positions) were equipped with signage and ground markings to provide flight crews with visual cues indicating their position and proximity to a runway. Those markings identified the location where an aircraft was required to stop when it did not have an ATC clearance to proceed onto or to cross a runway.

For flight crew vacating runway 03 on taxiway J2, the holding point for runway 06/24 was marked with red and white ground markings identifying the runway ahead,^[12] taxi-holding point signs and location signs. The runway holding point was also equipped with unidirectional^[13] runway guard lights, which flashed continuously, and a stop bar (Figure 7).

Figure 7: View of the runway 06/24 holding point on taxiway J2

The central panoramic image was taken from the entrance to taxiway J2 from runway 03/21. The other images were taken from close to the runway holding point. All images were taken at a height lower than that of the flight crew of a Boeing 737.

Source: ATSB

Stop bars

Stop bars were intended to provide additional protection of runway/taxiway intersections to prevent runway incursions. They were a series of unidirectional lights at right angles to a taxiway centreline (Figure 8). The lights were spaced 3 m apart and located 0.3 m before a holding point. Stop bars showed red in the direction of approach to the stop bar. They were controlled by ATC and were independent of the runway guard lights. Additional raised lights at each end of the stop bar were not installed, nor were they required to be.^[14]

Figure 8: Runway identifier (red and white markings) and stop bar (red lights) installed on taxiway J2

Source: ATSB

When seated in the normal position, the flight crew of a Boeing 737-800 cannot see the ground that is less than 11.5 m ahead of the aircraft’s nose (due to the obstruction of the flight deck glareshield). Consequently, the VH-XZM flight crew’s last opportunity to see the stop bar on taxiway J2 was at 1442:00, about 5 seconds after completing the turn onto the taxiway and 1 second prior to crossing the stop bar (Figure 9).

Figure 9: Last point when stop bar was visible from flight deck of VH-XZM

Source: Google Earth, modified by ATSB.

The AIP required flight crew to stop and hold their aircraft at all illuminated stop bars. Flight crew could only proceed to taxi an aircraft further once an ATC clearance to enter or cross a runway had been received and the stop bar lights had been switched off.

Stop bars were implemented at Perth on 30 March 2018. At the time of the occurrence (28 April 2018), all stop bars were reported to be operating correctly.

Other taxiways

In terms of the other taxiways off runway 03 (see Figure 2):

• Most taxiways intersected at 90° with a curve radius of about 100 m.
• Taxiway D intersected at 80° with a curve radius of about 60 m.
• Taxiways P intersected at 45° with a turn radius of 100 m, with 318 m between the edge of runway 03 and the next (taxiway) holding point.
• Taxiway N intersected at 45° with a turn radius of 100 m. In addition to taxiway J2, it was the only taxiway at Perth with a single holding point and a relatively short distance between the two runways. It led to a somewhat complicated four-way intersection. Two of the taxiways crossed runway 06/24 and shared a single holding point from taxiway N, set back about 120 m from the runway 06/24 flight strip. Both required a turn after the holding point to cross the other runway. The distance between the edge of runway 03 and the runway 06/24 holding point was about 350 m (with the first 280 m being a straight line).

Flight data analysed by Qantas indicated that the average exit speed of Qantas aircraft onto taxiway J2 over a 2-year period was 28 kt, compared with the average exit speed of 17 kt onto the tighter, near-right angle exit at taxiway D. The exit speed of VH-XZM was about 35 kt, and about 20 per cent of the landings over the 2-year period had an exit speed of 35 kt or higher (and about 5 per cent having an exit speed of over 40 kt).

Qantas reported that the distance between the runway 03 exit and the holding point for runway 06 on J2 at Perth was much shorter than any other runway exit taxiway leading directly to another runway on its 737 route network. The next shortest was about 397 m at Sydney Airport (for taxiway A2 off runway 34L that led to runway 25).

Rapid exit taxiway information

Requirements for rapid exit taxiways

As noted in The occurrence, the captain of VH-XZM thought that, when approaching taxiway J2 during the landing roll, the taxiway was a rapid exit taxiway (RET). Accordingly, the ATSB considered the design requirements for RETs.

The MOS defined a rapid exit taxiway (RET) as:

A taxiway connected to a runway at an acute angle, designed and intended to allow landing aeroplanes to turn off the runway at higher speeds than are achieved on exit taxiways, thereby minimizing runway occupancy times.

It additionally noted:

The provision of rapid exit taxiways is a financial decision for the aerodrome operator. The aerodrome operator should seek specialist advice on the geometric design of rapid exit taxiways.

The International Civil Aviation Organization (ICAO) specified standards and recommended practices (SARPs) for international aviation operations in a series of Annexes. ICAO Annex 14 (Aerodromes, Volume 1 Aerodrome Design and Operations) defined a taxiway as:

A defined path on a land aerodrome established for the taxiing of aircraft and intended to provide a link between one part of the aerodrome and another, including:

…c) Rapid exit taxiway. A taxiway connected to a runway at an acute angle and designed to allow landing aeroplanes to turn off at higher speeds than are achieved on other exit taxiways thereby minimizing runway occupancy times.

Annex 14 recommended that a RET should be designed with a curve radius of at least 550 m for certain types of runway (including those in Perth) to enable 93 km/h (50 kt) taxi under wet conditions. It also recommended that a RET should have a straight distance after the turn-off curve sufficient for an exiting aircraft to come to a full stop clear of any intersecting runway. There was no guidance regarding appropriate taxiway lengths, turn angles or curve radii.

ICAO also published other guidance about aerodrome taxiways. ICAO document 9157 (Aerodrome Design Manual Part 2 Taxiways, Aprons and Holding Bays) stated that the intersection angle of a RET with the runway should not be greater than 45° and preferably be 30°.

Neither the CASA MOS nor ICAO's Annex 14 provided restrictions or recommendations on direct access from one runway to another without an intermediate, transitional taxiway. The European Organisation for the Safety of Air Navigation (EUROCONTROL) in its November 2017 version of the European Action Plan for the Prevention of Runway Incursions, recommended:

A RET should meet with a parallel taxiway, and never end directly onto another active runway (that is used for take-off/landing).

Similarly, the United States Federal Aviation Administration (FAA) Advisory Circular 150/5300 stated:

Do not provide direct access from a high speed exit to another runway.

The Airports Council International Runway Safety Handbook First Edition 2014 identified key elements to eliminate runway incursions, including:

•  Rapid Exit Taxiways should be designed in such a way that crossing another runway via a rapid exit taxiway is not possible. A rapid exit taxiway should never be used for entry to a runway; and

•  Complicated Taxiway Layouts linking adjacent runways – such as multi-taxiway intersections, Y-shaped taxiways, taxiways crossing high speed exits and taxiways connecting to V-shaped runways – should be avoided in the design. If any of these are unavoidable, mitigation measures for runway incursion should be included in the design.

Rapid exit taxiway identification

At airports equipped with RETs, aerodrome charts provided flight crews with information such as RET location, maximum design exit speed and lighting systems, if fitted. This information was included in text in the airport efficiency procedures section rather than annotated on a map of the aerodrome.

ICAO Annex 14 recommended aerodrome operators install rapid exit taxiway indicator lights (RETILs). RETILs consisted of six yellow lights adjacent to the runway centreline and configured in a three/two/one pattern spaced 100 m apart; the single light was 100 m from the start of the turn for the RET.

The Australian AIP detailed differences between Australian national aviation legislation and those specified by ICAO as SARPs. With regard to RETILs, Australia notified ICAO of a difference to the SARPs under the level of ‘less protective, partially implemented or not implemented’. Accordingly, at the time of this occurrence, CASR Part 139 and the MOS did not require or recommend aerodrome operators to install RETILs.

Rapid exit taxiways in Australia

Taxiway J2 was not designated as a rapid exit taxiway (RET) and it did not meet the design requirements of CASA MOS or ICAO Annex 14 for a RET. There were no RETs at Perth.

RETs were provided at several other airports in Australia, including Brisbane, Melbourne and Sydney. None of these RETS had RETILs.

Runway incursion hot spots

Recommended practices for identification of hot spots on aerodrome charts

ICAO defined a runway incursion as ‘any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take-off of aircraft’.

ICAO document 9870 (Manual on the Prevention of Runway Incursions) defined a hot spot as:

A location on an aerodrome movement area with a history or potential risk of collision or runway incursion, and where heightened attention by pilots/drivers is necessary.

The document stated that, once hot spots have been identified, suitable strategies should be implemented to either remove the hazard or to manage and mitigate the risk to be as low as reasonably practicable.

ICAO recommended that the local generation of AIP aerodrome charts show runway hot spots (see for example Figure 2). The criteria used to establish a hot spot on an aerodrome chart and the symbols to be used were contained in ICAO Annex 4 (Aeronautical charts), with more guidance provided in Annex 14 and document 9870.

Aerodrome charts for Perth

Aerodrome charts were published by Airservices Australia in the AIP. Jeppesen charts, used by Qantas, provided details similar to the AIP about the airport and taxiway layout and associated information, such as warnings and runway incursion hot spots.

Jeppesen charts identified the location of hot spots and marked the area of risk with a magenta box in accordance with the ICAO recommendation. Text on the aerodrome chart stated ‘HS2 – Caution Runway Incursion Hot Spot’. No text or specific information was provided to explain the risk and reasons why previous runway incursions had occurred at those locations (in either the Airservices Australia or the Jeppesen charts).

Study of aerodrome chart effectiveness

In 2016, EUROCONTROL published a safety study report that examined how AIP hot spot information was transposed to commercially-produced aerodrome charts and promoted practices to help improve the accessibility, visibility and quality of the information. The study collected samples of AIP and commercial aerodrome diagrams for 64 European airports and a small number of samples from Australia, China and the United States for comparison purposes. It stated:

Of those airports that did have Hot Spot information on their AIP charts, only 39% were judged to be effective or very effective. Effectiveness, in this case, being a combination of presentational clarity and usefulness of the information. However 45% of airport AIP charts were judged to be of no or low effectiveness.

The Australian samples included Adelaide, Darwin, Sydney and Perth. The report judged all of these AIP charts to be of low effectiveness, stating:

The expanded graphic of the runway incursion Hot Spots are useful, but there is no text to enhance the pilot’s understanding other than to use caution. Since it is not unreasonable to assume that pilots do exercise caution when taxying, the effectiveness of the Hot Spot information is low.

The report noted that in many countries, including Australia, there was variation in the manner in which hot spot information was presented at different airports.

The report also noted the following presentation styles that ‘seemed to provide clarity and effectiveness’ of hot spot information to flight crew:

•  Each Hot Spot depicted by a clear bright red circle and joined to a red label box e.g. HS1

•  Large tabulated textual information elaborating the action required of pilots in and around the Hot Spot. This may be on the main aerodrome diagram or on the obverse page if clarity is best served.

•  The use of additional graphical boxes depicting the Hot Spots in greater detail. These additional boxes should be physically linked by lines or arrows to the Hot spot on the main diagram, if possible.

•  Where the aerodrome diagram would otherwise be too cluttered to present Hot Spots effectively, the use of specific Hot Spot pages can be effective.

•  The use of a colour-coded format which assists the depiction of runways, Hot Spot areas and normal taxiways.

In 2017, the FAA issued Safety Alert for Operators 17012 (High collision risk during runway crossing) that warned pilots of high-risk runway incursions and potential collisions in the first two-thirds of an active runway (with many such events occurring in the first third of the active runway). At Perth, the junction between taxiway J2 and runway 06 was within the first third of runway 06.

Runway incursions at Perth Airport

Airservices Australia recorded 44 runway incursions at Perth Airport between July 2015 and the day of the occurrence (Table 2). That equated to a rate of 11.6 incursions per 100,000 movements – higher than other major airports in Australia, including Sydney (2.0) and Melbourne (0.3).

Table 2: ICAO classification of the severity of runway incursions at Perth Airport, 1 July 2015 to 28 April 2018

[a] Including the investigation occurrence.

Source: Airservices Australia

Of the 44 incursions, 16 involved taxiway J2 on both runway 03/21 and runway 06/24. For that reason, the taxiway intersection of J2, J1 and A with runway 06/24 was marked as a runway incursion hot spot on aerodrome charts.

The ATSB’s occurrence database recorded 52 runway incursions at Perth involving turbine-engined aircraft (not under tow) over a 5-year period up to and including the 28 April 2018 occurrence. Exposure data was not available. Of these 52 incursions, the following types of incursion were excluded:

• 14 incursions that involved apparent ATC clearance errors (mostly not turning off stop bars after clearance was issued)
• 5 incursions involving a closed runway
• 2 incursions due to aircraft not departing the runway fully after landing.

Of the remaining 31 incursions, there were:

• 14 incursions on the cross runway via a taxiway immediately after landing (similar to the 28 April 2018 occurrence)
• 9 incursions that involved aircraft turning onto the cross runway instead of a taxiway
• 8 other incursions (general taxiing incursions).

Figure 10 shows the approximate location of incursions in these three groups, with most of the incursions on a cross runway via a taxiway happening near taxiway J2.

Figure 10: Selected types of runway incursion at Perth in a 5-year period

Source: Airservices, annotated by ATSB

Runway safety activities

ICAO have recognised runway safety as one of its highest priorities given it is currently one of the most significant threats to global aviation safety. In response, in 2011 the ICAO Runway Safety Programme (RSP) promoted the establishment of runway safety teams (RSTs) at airports as an effective means to reduce runway related accidents and serious incidents.

As part of Australia’s State Safety Programme, a National Runway Safety Group (NRSG) was established to perform a national advisory and coordination role, and promote the establishment and effectiveness of local runway safety teams (LRSTs). It utilised intelligence from these forums and other sources to develop and implement national strategies to improve runway safety and reduce runway related accidents and incidents.

An LRST consisted of local representatives addressing local runway safety issues. The purpose of an LRST was to identify current and potentially emerging issues related to runway safety and implement initiatives to assure the continuing safety of operations at their aerodrome.

Perth Airport had an LRST which met biannually and included the aerodrome operator, Airservices Australia, airline operators and other stakeholders operating at the airport.

Air traffic control information

Air traffic control at Perth Airport

Airservices Australia provided a 24-hour air traffic service at Perth Airport. The controllers responsible for all aircraft and vehicle movements on taxiways, runways and in the immediate vicinity of the airport were located in a tower on the eastern side of runway 03/21 (Figure 2).

The distance from the tower to the runway 06/24 holding point on taxiway J2 was about 1,200 m, and from the tower to the runway 06 threshold was about 3,000 m.

At the time of the occurrence the airport traffic flow was operating in a North flow. This permitted the most efficiency and therefore achieved the most operating capacity at Perth. A North flow traffic pattern had departures from both runway 03 and 06 and arrivals on runway 03.

Runway crossing procedures

The Australian AIP provided flight crew of domestic aircraft with procedures to follow when taxiing after landing. It stated:

2.16.2  After landing, unless specified otherwise by ATC, an aircraft must comply with the following:

a. Promptly vacate the runway without backtracking.

b. Change from the aerodrome frequency to the SMC frequency (where established) when vacating the runway strip and obtain an ATC taxi instruction.

c. Not cross any runway that intersects the taxi route unless in receipt of a taxi instruction and a “CROSS RUNWAY (number)” instruction from ATC…

The ICAO Manual on the Prevention of Runway Incursions outlined best practice for radio transmission guidelines and techniques. It stated:

Communication with any aircraft using the runway for the purpose of taxiing should be transferred from the ground controller to the aerodrome controller prior to the aircraft entering/crossing a runway.

The requirement for domestic aircraft to automatically^[15] transfer to the SMC frequency when vacating the runway strip had been in place since prior to 2003. In June 2010 Airservices Australia commenced a trial of aircraft and vehicles being on the ADC frequency when crossing runways in line with the ICAO recommendation. The trial was conducted at Sydney, Cairns, Brisbane, Coolangatta, Perth, Adelaide and Broome.^[16]

A post implementation review found no evidence that the trial procedures reduced the risk associated with runway incursions. It also identified a number of safety issues and concerns, including the reduction in ADC and SMC situational awareness at airports where crossing of active runways was required (including crossing runway configurations such as at Perth). Airlines involved in the trial agreed at that time that the trial should be ceased. Consequently, Airservices Australia returned the procedures to the pre-trial requirements of the AIP (as stated above).

Qantas advised that the ICAO-recommended approach to runway crossings, with the crossing aircraft on the ADC frequency, was used overseas in countries such as the United Kingdom and the United States. The ATSB identified that other countries such as New Zealand used a similar approach to that specified in the Australian AIP, with aircraft required to automatically transfer to the SMC frequency after landing.

Integrated tower automation suite

Tower controllers were responsible for separating aircraft visually but used a range of systems at their workstations to assist with performing that task. Each station in Perth tower was fitted with the integrated tower automation suite (INTAS), which included the advanced surface movement guidance and control system (A-SMGCS).

The INTAS provided controllers with electronic flight and operational information to enhance airport efficiency. The system combined flight and operational data, surveillance and voice communications into a single integrated, control tower-specific layout. Controller workstations were equipped with four customisable touch screens that displayed electronic flight strips, operational information, weather, terminal area radar displays, and, where available, surface surveillance data through the A-SMGCS.

The A-SMGCS provided automatic identification of all aircraft and transponder-equipped vehicles at Perth Airport. Using the collection of that surveillance data from multiple sources, the system provided controllers with an electronic picture of what was happening on the ground at any time. Additionally, the system added to a controller’s situational awareness by predicting potential conflicts between vehicles and aircraft, and multiple aircraft movements, before they could occur. Those protections included runway incursions by aircraft or vehicles. Visual and aural alarms alerted controllers to potential problems, enabling them to take early corrective action.

During the implementation of INTAS in the Perth tower, the system was configured with associated alert settings assigned to each controller’s position. The selection of a role (including combined position roles) by the tower shift manager automatically triggered the associated system alert settings that were assigned to each role in the INTAS adaptation settings.

At the time of the occurrence, due to the configuration of the Perth tower INTAS, when an SMC was operating the combined workstation roles of SMC, airways clearance delivery (ACD) and shift manager, the A‑SMGCS alerts were off. This inhibited the SMC from receiving an aural and visual stop bar violation alert (and runway occupied alert) at their workstation.

Emergency response actions

The Australian Manual of Air Traffic Standards (MATS) defined a safety alert as:

The provision of advice to an aircraft when an ATS Officer becomes aware that an aircraft is in a position which is considered to place it in unsafe proximity to terrain, obstructions or another aircraft.

The manual also stated:

Unless the pilot has advised that action is being taken to resolve the situation or that the other aircraft is in sight, issue a Safety Alert prefixed by the phrase ‘SAFETY ALERT’ when you become aware that an aircraft is in a situation that places it in unsafe proximity to:

a) terrain;
b) obstruction;
c) active restricted or prohibited areas; or
d) other aircraft.

In addition, the manual stated:

Do not assume that because another Controller has responsibility for an aircraft that an unsafe situation has been observed and a Safety Alert or avoidance advice has been issue.

The MATS procedures for aerodrome controllers stated that, for cancelling a take-off clearance:

Only cancel a take-off clearance once an aircraft has commenced take-off roll in circumstances where an aircraft is in imminent danger e.g. ‘STOP IMMEDIATELY (repeat aircraft callsign) STOP IMMEDIATELY (reason)’. Accompany any instruction to cancel take-off with a description of the nature of the emergency.

Compromised separation recovery training

Separation between aircraft is considered to be compromised when separation standards have been infringed, or where separation assurance is absent to the extent that a breakdown of separation is imminent.

In order to help ensure controllers provided effective response actions when separation is compromised, they undertook compromised separation recovery (CRT) training. The ATSB has previously noted limitations with the provision of such training by Airservices Australia and the Department of Defence to their controllers in several investigation reports. In 2014 and in 2016, Airservices undertook a series of actions to improve its CRT training.^[17]

The ATS Training Operations Manual stated in 2014:

Compromised separation recovery training must be included in all ATC endorsement training courses, and in particular, skills-based training in the simulator. The training must be assessed for competency…

EGM [Executive General Manager] ATC has determined that all operational staff must successfully complete annual training and assessment in compromised separation recovery training. It is a mandatory requirement that all controllers are assessed in skills-based simulator Compromised Separation Recovery training at intervals not exceeding three years.

In September 2020, Airservices Australia confirmed that, since 2012, all endorsed controllers were required to complete the knowledge-based component of compromised separation recovery training as part of the annual refresher training program. It also advised:

The skills-based component [of CRT training] only applies to tower controllers that hold the ADC endorsement. Given the role and responsibilities of a surface movement controller this continues to be appropriate. Separation on the manoeuvring area is a joint pilot controller responsibility and there are no defined separation standards.

The skills based compromised separation training scenarios do not align with the responsibilities of an SMC. All SMC endorsed controllers are trained and assessed at recognising ground conflicts and taking action as required commensurate with the risk of the situation using standard phraseology and taking into consideration aspects of the local operational context. The records of such training is maintained in individual training files.

In addition, all controllers that complete a tower course do destination specific CSR exercises as a part of the aerodrome control course element.

… all SMC endorsed controllers are trained and assessed at recognising ground conflicts and taking action as required commensurate with the risk of the situation using standard phraseology, as such no further rationale is required.

As noted in Air traffic controllers, both of the controllers involved in the 28 April 2018 occurrence sequence held an ADC endorsement, and therefore had undertaken skills-based as well as knowledge-based CRT training. The ADC reported the most recent training included a stop bar violation and runway incursion at Perth.

__________

7. Eastern Standard Time (EST) was Coordinated Universal Time (UTC) + 10 hours, or Western Standard Time (WST) + 2 hours.
8. Ceiling and visibility okay (CAVOK): visibility, cloud and present weather are better than prescribed conditions. For anaerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, nocumulonimbus cloud and no other significant weather.
9. Civil Aviation Order 82.5 (Conditions on Air Operators’ Certificates authorising regular public transport operations in high capacity aircraft) required operators to preserve a CVR in the case of an immediately reportable matter.
10. The flight strip was an area surrounding the runway provided to reduce the risk of damage to aircraft running off a runway; it was not available for use by vehicles or aircraft.
11. The preferred taxiways for different runways were agreed by the joint Airservices Australia and Perth Airport Capacity Enhancement group.
12. Painted runway identifier markings (see Figure 8) were included in the ICAO standards and recommended practices but were not standard markings in the CASA MOS Part 139. The airport operator advised it sought CASA approval to install these markings as a runway incursion reduction measure.
13. Unidirectional lights are only visible in the direction of travel
14. Raised lights at the ends of stop bars were installed at other airports in Australia, such as Brisbane, Sydney and Canberra.
15. In this context, automatically means that the controllers do not instruct the flight crews to change frequency.
16. The trial procedures required a flight crew to automatically switch to the SMC frequency when vacating a runway after landing (unless the ADC advised otherwise). They would then be asked to change back to the ADC frequency before being cleared to cross the runway.
17. These safety actions are summarised in ATSB AO-2014-074, Loss of separation assurance involving A330 9V-STQ and A320, VH-VFH, near Tindal, Northern Territory, 24 April 2014. Available at www.atsb.gov.au.

Safety analysis

Introduction

After landing on runway 03, VH-XZM vacated onto taxiway J2 and crossed the runway 06 holding point, with an illuminated stop bar, without an air traffic control (ATC) clearance. The aircraft continued to taxi toward runway 06. The aerodrome controller (ADC) received aural and visual alerts and instructed the crew of another aircraft (VH-VZL) taking off from runway 06 to stop immediately. The flight crew of the departing aircraft rejected their take-off, preventing further escalation of the occurrence.

This analysis will firstly discuss flight crew situational awareness, mental models and approach briefings associated with VH-XZM’s incursion onto runway 06. It will then discuss the design characteristics of taxiway J2 that increased the risk of incursion into runway 06/24. Finally, it will discuss a range of other safety factors identified during the investigation.

Flight crew situational awareness and mental model

The captain’s mental model of the expected taxi route from landing on runway 03 to the parking bay was incorrect. Instead of having to cross runway 06 on taxiway J2, the captain expected to be on a taxiway that connected straight to the apron and did not have cross the other active runway.

This incorrect mental model developed due to a combination of factors:

• The captain’s prior experiences landing at Perth had not used taxiway J2, instead generally landing on runway 03 and vacating at taxiway D or, more commonly, landing on runway 24 and vacating at taxiway J1. Both of these taxiways led directly onto the apron area with no runway crossing.
• The captain’s intention on this occasion was to use taxiway D, expecting they would be using taxiway D up until after they landed on runway 03.
• When taxiways were discussed during the approach briefing, the captain was referring to the apron chart rather than the full aerodrome chart, and this smaller chart did not include runway 03 or the full length of taxiway J2. When the first officer (FO) briefed that taxiway J2 needed to cross runway 06, the captain believed the FO was referring to crossing runway 06 while still on runway 03 and did not discuss this different (and incorrect) understanding with the FO.
• The approach briefing did not include a discussion of the airport’s known hot spots, including the hot spot associated with taxiway J2 (see also Approach briefing).

After landing, the captain realised that the request for taxiway D had not been made and quickly re-planned an exit onto taxiway J2, although continuing to have the same expectation that they not need to cross an active runway to reach the apron.

The runway holding point markings and warning lights would normally provide enough cues that an aircraft was approaching a runway holding point. In this case these cues were also supplemented by the very salient illuminated stop bar. However, although the captain saw the stop bar, it was not identified as a problem and no revision was made to the mental model of the taxiways, instead rationalising in a time-compressed situation that the stop bar had been installed incorrectly.

This behaviour is consistent with confirmation bias, or the tendency for people to seek information that confirms their hypotheses, interpret ambiguous evidence as supporting their hypotheses, and either discount or not seek information that contradicts their hypotheses (Wickens and others 2013). Confirmation bias is an inherent aspect of human decision-making and has been demonstrated to occur in a wide range of contexts.

Workload and distraction

High workload and time pressure lead to a reduction in the number of information sources a person will search, and the frequency or amount of time these sources are checked (Staal 2004). They also result in people conducting tasks with simpler strategies, relying on responses or strategies with which they are familiar, and persevering with a response or strategy even when it has proven to be unsuccessful (Staal 2004, Wickens and others 2013). In addition, people are likely to miss important cues and experience difficulty integrating disparate pieces of information and making sense of them (Burian and others 2005). Associated with the reduced search of information sources and increased perseverance, the influence of confirmation bias will be enhanced (Wickens and others 2013).

The flight crew’s overall workload during the approach and landing was not abnormally high. However, workload and distraction at key points in time combined together to result in a situation where the problem with the captain’s mental model was not detected and corrected.

During the approach phase, the captain's workload as pilot monitoring was increased due to the FO’s low level of experience and air traffic control's (ATC’s) request for a high-speed descent. This workload contributed to an omission of routine secondary tasks prior to landing, such as requesting a taxiway D exit from the tower and pre-setting the surface movement control (SMC) frequency in the radio’s standby frequency position.

These omissions were examples of prospective memory errors. Prospective memory relates to an intention to perform an action at a later time, and a delay between forming the intention and acting on it. It is known to be vulnerable to failure and has been associated with many aviation accidents and incidents (Dismukes 2006). Conditions that increase this vulnerability include the delay between the intention to do a task and the execution of the task being filled with other activities, an interruption to a task sequence, and the cues or prompts to retrieve the intention from memory not being explicit. Neither of these tasks was associated with a specific checklist item (and by themselves were not important enough to be checklist items), and their omission was not detected until after landing.

After landing, when the captain realised the omission in not requesting taxiway D, the normal workload associated with landing was increased, associated with replanning the exit onto taxiway J2 while taking over control of the aircraft.

During the taxi phase, there was less time than would normally be the case to detect the problem. As the aircraft was crossing the runway edge, the runway 06 holding point was only about 176 m away. The captain’s delayed realisation that they needed to exit on taxiway J2, and misidentification of taxiway J2 as a rapid exit taxiway (RET), meant the aircraft entered J2 at a higher groundspeed than usual. The relatively high exit speed and relatively short distance to the runway 06 holding point meant that the flight crew only had limited time after leaving runway 03 to identify the problem before reaching the holding point.

During this period, a series of distractions occurred. More specifically:

• After vacating runway 03, the FO focussed attention inside the flight deck for a period of time to select the SMC frequency, instead of performing the more safety critical task of monitoring the aircraft's taxi path as it approached a known runway incursion hot spot. The FO assumed the captain would be stopping at the holding point and, focused on changing frequency and contacting the SMC, did not see that they had passed the holding point until about the time the captain was braking to stop.
• When approaching the holding point, the captain briefly went heads down to gain an understanding for the delay in changing to the SMC frequency and then advised the FO of the applicable SMC frequency. This reduced the time available to notice and comprehend the holding point signs, warning lights and stop bar lights ahead.

After passing the holding point, the presence of runway 06 ahead still provided an indication of a potential problem. However, the captain was distracted by the presence of another aircraft on the apron. This focused attention on the distant apron area and reduced the ability to visually identify the runway immediately in front of the aircraft. The FO was still primarily focused inside the flight deck during this period.

Approach briefing and approach briefing guidance

The approach briefing was the best opportunity for the flight crew to have established a shared and correct understanding of the requirements for the remainder of the flight, including the taxiway options. However, as already noted, they did not specifically discuss the taxiway J2 hot spot during the approach briefing, even though the FO had identified it on the aerodrome chart. Had the topic of the hot spot been raised and discussed in the briefing, as well as the main reason why it was a hot spot (that it led to another runway), the captain’s mental model of the taxiway J1/J2 layout would probably have been enhanced.

The International Civil Aviation Organization (ICAO) has emphasised that flight crews should prepare well in advance for departure and arrival at any airport, including reviewing hot spots before taxiing from the gate and prior to beginning descent. Accordingly, departure and approach briefings should contain a complete review of not just the expected taxi routes but potential routes as well, with special attention to any hot spots.

Qantas provided detailed guidance to flight crews on the content of approach briefings. Hot spots should have been considered a threat under the threat and error management section of the briefing guidance. However, since that briefing guidance contained no specific requirement to brief hot spots or runway incursion threats, it is likely that the presence of hot spots on a taxi route would not always be noted by a flight crew.

Although the aerodrome chart for Perth identified that the area around taxiway J2 was a runway incursion hot spot, it did not provide specific information about the nature of the threat or why it was a hot spot. Such information would better enable flight crews to understand how the hot spot may affect them. If flight crews are to effectively identify and plan mitigating actions to avoid runway incursions, they should be provided with detailed information to assist their understanding of the common reasons why previous flight crews have incurred a runway at particular locations.

Taxiway location and design

Airservices Australia data identified that the rate of runway incursions at Perth Airport was significantly higher than other major airports across Australia. A significant proportion of the Perth incursions occurred on taxiway J2 and, accordingly, it was designated as a hot spot. To assist with minimising the risk of incursions, stop bars and CASA approved runway identifier markings (in addition to other holding point markings and lights) had recently been introduced.

In addition to providing salient or conspicuous markings and cues about the position of a holding point, it is also important to ensure flight crews are provided sufficient time during a high workload period after landing to identify and comprehend runway holding point visual cues and to allow for ATC to intervene, if required, before an aircraft incurs a runway.

Taxiway J2 was not a rapid exit taxiway (RET), but it had some similar qualities: a relatively shallow intersection angle and a relatively wide curve radius. These characteristics led some pilots to use higher speeds when exiting runway 03. Although the intersection angle was not acute enough to actually be a RET, the angle would be difficult to judge while approaching it from the runway.

Flight data showed VH-XZM entered taxiway J2 at about 35 kt, which was slightly higher than the taxiway design limit of 31 kt. Flight data analysis of other flights provided by Qantas showed its aircraft commonly vacated runway 03 onto taxiway J2 at a relatively high speed.

In addition, taxiway J2 had a relatively short distance from the exit from runway 03 to the runway 06 holding point. This meant that flight crews had less time to see the holding point markings and an illuminated stop bar, especially if taxiing at higher speeds.

Taxiway J2 also led to a relatively complicated runway crossing point, with other taxiways intersecting at the same point. A complicated intersection can be difficult for crews to navigate and can draw their attention.

Overall, the location and design of taxiway J2 significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. In particular, the following features made taxiway J2 problematic:

• a relatively shallow intersection angle from runway 03
• a wider than usual entry curve radius
• a relatively short distance from the turn to the runway 06 holding point
• the next intersection leading directly to a runway rather than a parallel taxiway
• the next intersection being relatively complicated
• the intersection adjoining the first two-thirds of runway 06.

In addition, the risk associated with taxiway J2, and runway incursions was exacerbated by it being made the preferred exit for landing off runway 03. Although many flight crews elected to use taxiway D instead, this required the crew to proactively make that request.

The introduction of stop bars in March 2018 would certainly have reduced the risk but, depending on the situation, not eliminated the risk. Although the exact sequence of events associated with this particular occurrence would have been difficult to predict beforehand, there was undoubtedly an increased risk of runway incursions that needed to be managed, and a range of scenarios that could have resulted in a high-risk runway incursion given the inherent limitations of the taxiway J2 location and design.

As previously noted, taxiway J2 had some features that would have made it appear similar to a RET. Flight crews would normally become aware of the existence of a RET from tables of information about an airport in the aerodrome charts. However, a flight crew may forget or may not brief the existence or absence of a RET among the potential taxiways that could be used. At the time of the occurrence there was no requirement in Australia for airports to use indicator lights at RETs to distinguish them from other taxiways, so there was no immediate way to identify a taxiway as a RET or otherwise during the landing. However, unless all RETs were equipped with the appropriate indicator lights, the absence of indicator lights at a particular taxiway may not be that effective as a cue. Overall, unless briefed otherwise, it would be generally safer for a flight crew to assume that a taxiway was not a RET and adjust the aircraft’s speed appropriately.

Air traffic control response

The ADC became aware of the problem on receipt of the first integrated tower automation suite (INTAS) alert. The ADC considered that, as VH-XZM had vacated and was clear of runway 03, the flight crew would most likely have changed over to the SMC frequency and therefore would have been unable to hear any safety alert instructions on the ADC frequency. Instead, an instruction was issued to VH-VZL to stop immediately.

A research study showed that the average time for tower controllers to act in response to a system alert was 4.6 seconds with a mean response duration of 2.3 seconds, with maximum response times being 8.1 seconds and 5.3 seconds respectively (Sanchez and others 2009). In this occurrence, the ADC transmitted the stop immediately instruction to the flight crew of VH-VZL about 7 seconds after the first alert, a time which included a period of blocked frequency from another aircraft transmitting.

The ADC’s action was effective in mitigating the consequence of the runway incursion. The ‘stop immediately’ instruction was simple and easily comprehended by the captain of VH-VZL, who was actively monitoring the developing situation and responded promptly to the ADC’s instruction.

However, although VH-VZL’s flight crew received a timely and clear instruction from ATC, VH‑XZM’s flight crew did not receive any communication from ATC during the period after the first INTAS alert (1442:04) until 1442:26, when the SMC asked the flight crew if they were on the SMC frequency. This was after the captain had commenced braking (1442:19), and 10 seconds after the FO made initial contact with the SMC (when the FO was unaware of the problem).

The exact reasons why the SMC did not issue an alert and instruction to the flight crew of VH‑XZM are unclear. In response to the first INTAS alert, the SMC was aware of the developing problem. However, at that stage there may have been some doubt regarding whether the flight crew had switched over to the SMC frequency. In addition, the SMC was in the progress of providing a pushback clearance to another aircraft. The SMC had received training in issuing stop instructions as well as compromised separation recovery training.

The second INTAS alert at 1442:16 was broadcast on the ADC workstation’s speaker at the same time as the VH-XZM FO’s first transmission on the SMC frequency, to which the SMC did not reply. The SMC may have focussed on the more relevant event—the second INTAS alert—at this time and as a result did not process VH-XZM’s transmission. Nevertheless, even after hearing the ADC provide the other aircraft with a stop instruction (1442:11), a prompt instruction to VH-XZM was warranted to further minimise any potential collision risk. A stop immediately instruction over any frequency that the flight crew might be using would have led to a more rapid response from that flight crew.

Although not directly related to this occurrence, the investigation identified some limitations with ATC processes that increased the potential risk of other occurrences:

• Due to the way INTAS was configured at Perth, the SMC’s workstation did not directly receive INTAS alerts if the SMC position was combined with other positions. This meant that an SMC may not have received a salient warning that an aircraft under their control was at risk of collision. In this case, the SMC’s awareness of the runway incursion was raised as a result of the INTAS aural alert played through a speaker on the ADC’s workstation, but in other situations an SMC may not identify such an alert.
• Communication practices for runway crossings at Australian airports differed from those recommended by ICAO and used in some countries overseas. According to ICAO, runway crossings should be managed by the ADC, which ensured that flight crews of aircraft crossing a runway were aware of any instructions being issued to aircraft using that runway. In Australia (and some other countries), runway crossings were handled by the SMC and not the ADC. Having two aircraft on a runway at the same time but not requiring them to be on the same frequency does create the potential for flight crews not to be aware of the presence of the other aircraft at a critical point in time. However, Airservices Australia reported that it trialled a version of the ICAO-recommended approach and determined it did not reduce the risk of runway incursions and instead it introduced new safety issues and concerns in the Australian environment, including a potential reduction in controller situational awareness.
• Depending on how it was implemented, the ICAO-based approach could have required a flight crew to transfer to the SMC frequency, before the SMC then transferred them back to the ADC frequency prior to crossing the runway, which would have increased the complexity of communications at a location such as Perth Airport for aircraft landing on runway 03 and exiting on taxiway J2. One option that could have assisted with managing the unique problems associated with taxiway J2 was for the ADC to require flight crews landing on runway 03 and vacating on taxiway J2 to remain on the ADC frequency until after they crossed runway 06. However, introducing a unique approach to managing radio frequencies at one specific location in Australia could also increase risk. Alternatively, local procedures could have included advising a flight crew landing on runway 03 and exiting at taxiway J2 of the crossing runway hazard ahead.

Findings

From the evidence available, the following findings are made with respect to the runway incursion involving a Boeing 737, registered VH-XZM, which resulted in a rejected take-off involving a Boeing 737, registered VH-VZL, at Perth Airport, Western Australia on 28 April 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The captain developed an incorrect mental model of the exit taxiways off runway 03, believing the aircraft would not have to cross runway 06 after exiting on either of the potential taxiways (J2 or D). As a result, the captain did not expect to cross a runway holding point or stop bar and, upon seeing the stop bar was illuminated, incorrectly thought that it must only apply to aircraft coming from the other direction.
• During the approach phase, the captain's workload as pilot monitoring was increased due to the first officer's low level of experience and air traffic control's request for a high-speed descent. This workload contributed to the omission of routine secondary tasks, such as requesting a taxiway D exit from the tower and pre-setting the surface movement control frequency.
• After vacating runway 03, the first officer focused inside the flight deck for a period of time to select the surface movement control frequency, instead of performing the more safety critical task of monitoring the aircraft's taxi path as it approached a known runway incursion hot spot.
• When approaching the holding point for runway 06, the captain briefly focused inside the flight deck to gain an understanding for the delay in changing to the next frequency. This reduced the time available to notice the holding point signs and lights ahead.
• The captain taxied passed the runway 06 holding point (with an illuminated stop bar) without an air traffic control clearance.
• After taxiing passed the illuminated stop bar, the captain was distracted by the presence of another aircraft on the apron. This focused the captain’s attention on the distant apron area, reducing the likelihood of visually identifying the runway immediately in front of the aircraft.
• During the approach briefing, the flight crew discussed taxiway J2 and taxiway D, but the flight crew did not discuss the potential threat of the hot spot associated with taxiway J2.
• Although Qantas provided detailed guidance to flight crews about the content of departure and approach briefings, it did not specifically require aerodrome hot spots to be briefed. [Safety issue]
• Although some aerodrome navigational charts in Australia had identified hot spot locations, they generally provided limited explanatory information to enhance flight crew understanding or awareness of why the hot spot was there and what actions they could take to mitigate the associated risk.
• The location and design of taxiway J2 at Perth Airport significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. Taxiway J2 was published as the preferred exit taxiway for jet aircraft and, although mitigation controls were in place, they were not sufficient to effectively reduce the risk of a runway incursion. [Safety issue]
• Although the flight crew of VH-VZL taking off on runway 06 were provided with an instruction to stop immediately to reject their take-off, no safety alert or instruction was provided to the flight crew of VH-XZM during the period between when the controllers received a stop bar violation alert (1442:04) and the captain applied the brakes at 1442:19.

Other factors that increased risk

• Airservices Australia’s configuration of the integrated tower automation suite (INTAS) at Perth Airport had resulted in a situation where controllers performing some combined roles had the INTAS aural and visual alerts inhibited at their workstation. As a result, controllers performing such combined roles would not receive a stop bar violation alert or runway incursion alert at their workstation. [Safety issue]

Other findings

• The stop bar alert and the aerodrome controller’s high level of situational awareness led to a timely instruction to the flight crew of VH-VZL to stop immediately.
• The high level of situational awareness of the VH-VZL flight crew significantly aided their immediate action to reject their take-off on runway 06 following the controller’s instruction.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties are provided with a draft report and invited to provide submissions. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
 

Operator guidance for flight crew briefing of aerodrome hot spots

Safety issue number: AO-2018-032-SI-01

Safety issue description: Although Qantas provided detailed guidance to flight crews about the content of departure and approach briefings, it did not specifically require aerodrome hot spots to be briefed.

Location and design of taxiway J2 at Perth Airport

Safety issue number: AO-2018-032-SI-02

Safety issue description: The location and design of taxiway J2 at Perth Airport significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. Taxiway J2 was published as the preferred exit taxiway for jet aircraft and, although mitigation controls were in place, they were not sufficient to effectively reduce the risk of a runway incursion.

Inhibition of safety alerts for combined air traffic control roles

Safety issue number: AO-2018-032-SI-03

Safety issue description: Airservices Australia’s configuration of the integrated tower automation suite (INTAS) at Perth Airport had resulted in a situation where controllers performing some combined roles had the INTAS aural and visual alerts inhibited at their workstation. As a result, controllers performing such combined roles would not receive a stop bar violation alert or runway incursion alert at their workstation.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Qantas Airways advised that on 17 September 2019, following a runway incursion subsequent to this occurrence, it published a safety information notice to all pilots, which contained information about failure to comply with taxi clearances and details of the recent runway incursion occurrence. It also contained safety educational information related to influencing factors, mitigation techniques and strategies to avoid non-compliance with air traffic control ground clearances.

Airservices Australia and Qantas Airways advised they were in discussions to ascertain if there was merit in the conduct of a new trial of the ICAO-recommended approach to runway crossings, with the crossing aircraft on the ADC frequency,

The Civil Aviation Safety Authority (CASA) advised that in September 2019, CASR Part 139 (Aerodromes) Manual of Standards introduced guidance for rapid exit taxiway indicator lights (RETILs). The guidance stated ‘RETIL may be provided on a runway intended for use in RVR conditions less than 350 m or where the traffic density is heavy’. CASA advised the ‘optional’ application of subsection 9.89 (1) was consistent with ICAO SARPs (see Annex 14 volume I para 5.3.15.1), which set the application of RETIL as a Recommendation.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew of VH-XZM
• the captain of VH-VZL
• the aerodrome controller
• the surface movement controller
• flight data recordings from VH-XZM and VH-VZL
• closed-circuit television recordings
• Qantas Airways Limited
• Airservices Australia
• Perth Airport Pty Ltd.

References

Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2005-213462.

Dismukes, K 2006. ‘Concurrent task management and prospective memory: pilot error as a model for the vulnerability of experts’. Proceedings of the Human Factors and Ergonomics Society 50th Annual Meeting, pp. 909–913.

Sanchez J, Smith EC & Chong RS 2009, Controller and Pilot Response Times to Runway Safety Alerts, MTR090237, The MITRE Corporation, McLean, VA.

Staal MA 2004, Stress, cognition, and human performance: A literature review and conceptual framework, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2004-212824.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew of VH-XZM, the captain of VH-VZL, Qantas Airways Limited, the aerodrome controller, the surface movement controller, Airservices Australia, Perth Airport and the Civil Aviation Safety Authority.

Submissions were received from the captain of VH-XZM, Qantas Airways Limited, the aerodrome controller, Airservices Australia, Perth Airport and the Civil Aviation Safety Authority. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 20–21 April 2018, Pacific National intermodal freight train 6MP4 was travelling from Melbourne, Victoria via Adelaide, South Australia to Perth, Western Australia. A short time after commencing the downhill grade from Mount Lofty to Belair, South Australia, there was a structural failure in the underframe of platform 2 of wagon RRYY01X. Soon after, the shared bogie between platform 2 and 3 of the wagon derailed. The train continued down the grade until it separated (between platform 2 and platform 3), with both portions of the train coming to a stop near Glenalta.

What the ATSB found

The investigation found that a pre-existing structural crack in the underframe of platform 2 of wagon RRYY01X likely expanded due to in-train forces (compression and tension), causing the platform’s deck to bend and change the deck angle at the coupling to platform 3 (supported over a common bogie). As train 6MP4 negotiated a series of tight curves on the descending grade, the combination of wheel unloading (due to compressive forces and coupling angle on a light wagon) combined with increased lateral forces (due to compressive forces and a tight curve), resulted in flange climb (possibly complete wheel lift) and subsequent derailment.

The ATSB found that multiple train examinations and maintenance inspections did not identify the crack in platform 2 of wagon RRYY01X. In addition, Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of the cracks being detected.

Additionally, the ATSB found that the train separation at Glenalta did not activate the locomotives’ emergency braking systems, although this did not increase the risk associated with this accident.

What has been done as a result

Immediately following this accident, Pacific National issued a Rolling Stock Notice requiring immediate inspections of all RRYY class wagons for underframe cracking, with wagons exhibiting cracking around the underframe removed from service for repairs. Magnetic particle inspection or dye penetrant inspection of welded connections were also added to the scheduled preventative maintenance requirements.

Following the initial response, Pacific National undertook a fleet assessment of RRYY class wagons to ensure that they were safe to return to revenue service and developed a long-term repair methodology for RRYY wagons with identified cracks.

Safety message

Rolling stock managers should consider the key structural risk areas of their rolling stock and establish guidance methods for ensuring that these risk areas are given an appropriate level of priority when undertaking inspections.

The occurrence

Overview

On 20–21 April, Pacific National intermodal freight train 6MP4 was travelling from Melbourne, Victoria via Adelaide, South Australia to Perth, Western Australia. At about 0003^[1] on 21 April 2018, a short time after commencing the downhill grade from Mount Lofty to Belair, South Australia, there was a structural failure in the underframe of platform 2 of wagon RRYY01X. Soon after, the shared bogie between platform 2 and 3 of the wagon derailed. The train continued down the grade until the train separated (between platform 2 and platform 3 of wagon RRYY01X) and came to a stop near Glenalta.

Wagon RRYY01X was a multi-platform 5-pack^[2] wagon. The wagon’s position behind the locomotives placed it about the centre in the train consist, and platform 2 was the only one not loaded with a container.

Prior to derailment

The train crew of 6MP4 involved in this accident commenced their shift at Dimboola (Victoria), departing at about 1854 on 20 April 2018. They did not pass or cross any trains between Dimboola and Glenalta. The train crew reported that, apart from a level crossing near miss with a road vehicle forcing an emergency stop near Lillimur (Victoria), the journey towards Mount Lofty was uneventful.

A third locomotive (8223) was added to train 6MP4 at Tailem Bend (88 km before Mount Lofty). At about 2342, the train began an 11 km steep climb up to Mount Lofty (Figure 1). The three locomotives were operating almost continuously in throttle notch 8 (maximum tractive effort), only easing off slightly at a couple of short sections of level track. At about 2358, 6MP4 passed Mount Lofty and commenced travel on the downhill grade^[3] towards Belair (Figure 1).

Mount Lofty is located at the top of a cresting grade.^[4] As the train passed over the cresting grade, the weight and resistance of the train’s rear portion still on the ascending grade (1,485 t trailing behind wagon RRYY01X) was opposed by the combined tractive effort and weight of the front portion of train now on the descending grade (1,368 t ahead of wagon RRYY01X).

As more weight moved onto the descending grade, the driver gradually decreased tractive effort and began applying braking effort using the locomotives’ dynamic brakes. The driver progressively increased braking effort until the locomotives were applying full dynamic brake, with the train transitioned to a compressed state.

Figure 1: ARTC track from Mount Lofty station to Glenalta station, including derailment information

Image shows ARTC track from Mount Lofty station to Glenalta station in grey, with red indicators showing kilometre markers. Location of key events indicated with orange markers.

Source: Google Earth annotated by the ATSB, and inset ARA Railways of Australia Map 2014 annotated by the ATSB

At some point during the train’s descent, the underframe of wagon RRYY01X’s platform 2 experienced a structural failure, which led to the deck of platform 2 dropping or sagging (Figure 2). This resulted in the deck angle of platform 2 rising towards the coupling to platform 3. The compressive forces acting on the angled deck of the empty platform 2 reduced the weight acting on the trailing axle from the bogie/wheels shared between platform 2 and 3.

Figure 2: Structural failure in underframe of platform 2 of RRYY01X

Image shows the structural failure in the underframe of wagon RRYY01X (platform 2) and its respective location to the derailed shared bogie between platforms 2 and 3.

Source: Pacific National and ATSB, annotated by the ATSB

Derailment

At about 0003 on 21 April, as the wagon negotiated a series of tight curves, the lightened axle between platform 2 and platform 3 climbed or lifted over the rail and subsequently derailed.

The first evidence of derailment was subsequently observed at the 28.6 km mark (about 2.4 km past Mount Lofty station). Wheel witness marks were identified on the exposed upper surface of the resilient track fastenings through a right curve (Figure 3).

Figure 3: Initial evidence of derailment between Mount Lofty and Belair

Image shows the location of the initial wheel witness marks on the upper surface of the resilient track fastenings at the 28.6 km mark.

Source: ATSB

The combination of a sagging deck and derailed wheels allowed the underframe to start rubbing on the leading axle of the bogie shared between platform 2 and 3 (Figure 4).

Figure 4: Contact abrasion damage to wheelset axle and platform 2 of 5-pack wagon RRYY01X

Image shows leading wheelset axle abrasion marks from the shared bogie between platform 2 and 3 of 5-pack wagon RRYY01X.

Source: ATSB

The trailing axle continued in a derailed state for a further 1.58 km, making intermittent contact with the ground, track fastenings and sleepers. At about 0005, when passing the 27.02 km point, bogie components collided heavily with a concrete sleeper, dislodging the constant-contact side-bearer pads at this location and breaking the bogie centre-pin (Figure 5).^[5]

The failed centre-pin allowed the bogie to dislodge from its centre-bowl and move back towards the rear of the train, fouling with the leading end structure of platform 3. Over the next 3.9 km, the derailed rear axle made more frequent contact with the ground, track fastenings and sleepers.

Figure 5: Wagon coupler-pin and bogie centre-pin from RRYY class wagon

Image shows an intact combined wagon coupler-pin and bogie centre-pin from a RRYY class wagon, alongside the wagon coupler-pin from wagon RRYY01X with missing bogie centre-pin.
Source: ATSB

At about 0011, as the derailed bogie of wagon RRYY01X passed through 20 Points at the entrance to the Belair crossing loop (23.081 km point, Figure 1), bogie components collided with the point components. About 25 m later, the derailed axle re-railed at the V-crossing^[6] for the crossing loop. The train continued, with the bogie between platforms 2 and 3 running on the rails, but dislodged from its centre-bowl and fouling with platform 3.

Train separation

Train 6MP4 gradually slowed as it descended the grade. At about 0014, as the lead locomotive passed about the 20.36 km mark, there was a slight increase in train speed. This coincided with wagon RRYY01X uncoupling and separating between platforms 2 and 3.

Separation of the two platforms resulted in the breaking of the train’s brake air pipe and exhausting of brake pipe air to the atmosphere. The driver observed a high reading on the locomotive’s brake pipe airflow gauge and, expecting an emergency application of the automatic brake (train-line emergency brake), they commenced bailing or holding off the locomotives’ brakes.

The reduction in brake pipe air pressure to the rear portion of train 6MP4 resulted in the automatic application of the wagon brakes, bringing the 1,485 t rear portion of train 6MP4 to a stop in about 212 m. The breaking of the train’s brake pipe also exhausted air from the front portion of train 6MP4, causing the wagon brakes to apply, though the locomotives’ emergency brake systems did not activate.

At about 0015, the driver allowed the front portion of train 6MP4 to come to a stop using a combination of wagon braking effort (from the brake pipe rupture and pressure reduction), and an increase in the locomotive dynamic braking effort. The driver applied the locomotives’ brakes to stop the front portion of the train in the final 4 seconds of movement. The front portion of train 6MP4 was bought to a stop in about 662 m. After coming to a stop, the front and rear portions of the split train 6MP4 were separated by approximately 450 m (Figure 6).

The drivers recalled that when the front portion of the train came to a stop, there had been no bumping or crashing in the train. As such, neither of the drivers were expecting that the train had separated.

Figure 6: The stopped location of both portions of 6MP4 after the train separated

Image shows ARTC track in grey, with red markers showing kilometre markers, and 6MP4 stopped position of both portions in orange.
Source: Google Earth annotated by ATSB

The previously derailed bogie was found lodged outside of its normal location under the leading end of RRYY01X platform 3, and the trailing end of platform 2 was found on the ground. There was substantial damage to the bogie and two platforms from the 5-pack wagon RRYY01X (Figure 7), plus minor damage to rail infrastructure (Location and infrastructure). There were no injuries.

Figure 7: Platform 2 and 3 from 5-pack wagon RRYY01X in their stopped locations

Image shows the final position of the bogie involved in derailment with platform 2 and 3, after train 6MP4 came to a stop near Glenalta.

Source: Pacific National annotated by the ATSB

_________

1. All time reference in this report are in local time (Central Standard Time).
2. 5-pack wagon: an articulated wagon comprising five platforms, with the adjacent ends of individual units being supported on a common bogie and permanently connected by a device, which permits free rotation in all planes.
3. The downhill grade between Mount Lofty and Belair varies between 1:45 and 1:48.
4. Cresting grade: a long ascending grade that changes to a long descending grade, both grades being of sufficient magnitude to require a change in train handling procedures as the grade is topped.
5. Bogie centre-pin: in the case of a RRYY class 5-pack wagon, the pin used to locate the bogie within the centre-bowl and secure the bogie to the wagon structure. Note: the bogie centre-pin and platform coupler-pin are joined to each other in a RRYY class wagon.
6. V-crossing: a track component that enables a wheel travelling along one rail to pass through the rail of a track which crosses its path.

Context

Location and infrastructure

The accident occurred over an 8.9 km section of standard gauge track between Mount Lofty and Glenalta, located in the Adelaide Hills approximately 31 to 19 track kilometres from Adelaide respectively (Figure 8). This section of track forms part of the interstate line between Melbourne and Adelaide, and is managed by the Australian Rail Track Corporation (ARTC).

The ARTC standard gauge track from Belair towards Adelaide is adjacent to the broad gauge track, part of the Adelaide Metropolitan Passenger Rail Network, managed by the Government of South Australia, Rail Commissioner.

Figure 8: Location of derailment site, between Mount Lofty and Glenalta

Image shows location of derailment site within South Australia, and inset image shows ARTC track in greater detail from Mount Lofty Railway Station to Glenalta Railway Station.
Source: ARA Railways of Australia Map 2014 and Australian Government National Map, both annotated by the ATSB

The standard gauge track consists of continuously welded rail secured to concrete sleepers by resilient fasteners and supported on ballast. The configuration is typical of the standard used for the interstate line in South Australia.

From Mount Lofty, the track exhibits a 1 in 45 down gradient (Figure 9), with multiple tight curves. This section of track consists of both left and right curves varying in radius between 195 m and 700 m. A standard gauge crossing loop is located at Belair, about 8 km from Mount Lofty. The crossing loop provides 1,543 m of standing room^[7] over an almost level straight section of track.

The Belair railway station is located approximately 200 m within the Adelaide end of the Belair crossing loop. The track continues to descend at a 1 in 47 down gradient (Figure 9), through multiple tight curves, towards Glenalta. Although each of the railway stations (from Belair) are active for passenger services, the platforms facing the standard gauge track are unused.

Figure 9: Mount Lofty to Glenalta track layout and gradient information

Image shows rail infrastructure layout, gradient and elevation information for section of ARTC track between Mount Lofty and Glenalta. Source: ATSB

The condition of the rail infrastructure including rail lubrication equipment between Mount Lofty and Belair was observed by the ATSB. The ATSB found no evidence to suggest that the condition of the rail infrastructure contributed to the derailment.

Approximately 5 km of standard gauge track sustained intermittent damage from the derailment, with about 50 concrete sleepers requiring replacement. At the Mount Lofty end of the Belair Station crossing loop, timber sleepers and associated points turnout components, rods and bars required replacement. Damage was also sustained to automatic rail lubricators between Belair and Mount Lofty.

There was no damage caused to the adjacent Adelaide Metropolitan Passenger Rail Network, or road bridges within the area.

Environmental conditions

Information obtained from the Bureau of Meteorology (BoM) established that the weather near Mount Lofty was mild, with light rain and relatively light winds in the period leading up to the accident. During the previous day, the BoM weather stations at Mount Lofty recorded a minimum temperature of 17.9 °C and a maximum of 25.6 °C. At the time of the accident, the temperature was about 18 °C.

Given these conditions, the ATSB determined that environmental factors were unlikely to have contributed either directly or indirectly to the accident.

Train information

Pacific National was the owner and operator of freight train 6MP4. The train consisted of two locomotives (NR62 and NR58) hauling 26 wagons (both single and multi-platform wagons) from Melbourne, with a third locomotive (8223) added at Tailem Bend (88 km before Mount Lofty). The total train length was about 1,499 m, and weighed about 2,853 t.

Although train 6MP4 was transporting dangerous goods in some containers, these were located on wagons further back in the train consist and were not associated with the derailed wagon. There was no release or spillage of dangerous/toxic goods from containers or wagon loads as a result of the accident.

Train crew information

Two Pacific National locomotive drivers were crewing train 6MP4. The driver operating train 6MP4 and the second driver had about 24 and 12 years’ experience (respectively) as locomotive drivers for Pacific National. Both held current driver competencies, route knowledge and rail safety worker health assessments.

The driver of train 6MP4 used dynamic brake alone to control train speed on the steep descending gradient from Mount Lofty. The locomotive event recordings indicate that the driver made gradual changes to dynamic braking effort, maintaining train speed between a minimum of 28 km/h and a maximum of 51 km/h, while also keeping in-train forces as constant as possible.

Although this approach to train handling has a number of benefits, the use of dynamic braking as the sole means of controlling train speed on a descending grade can generate significant in-train longitudinal compressive forces. However, this method of train handling is common practice for freight trains traversing the steep gradients in this location and is consistent with the handling instructions documented in Pacific National standard PN-STD-SAF - Train Handling.

In summary, the available evidence indicated that the driver handled train 6MP4 appropriately in the period leading up to the accident.

Consistent with Pacific National procedures, both drivers were requested to undertake drug and alcohol tests following the incident. The tests returned a negative result for each driver. A review of available evidence did not identify any concerns regarding the drivers’ fitness for duty in the period leading up to the accident.

Train braking systems

Dynamic brake

The dynamic brake, independent brake, and automatic brake are sub-systems of the train’s overall braking system.

Dynamic braking is a locomotive braking function present in diesel-electric and electric drive locomotives. It is not a substitute for the train’s air braking, but is a supplementary system that provides an additional means of speed control. A benefit of dynamic braking is to reduce the wear and heat generated by the friction style train braking equipment used by the independent and automatic braking sub-systems.

Dynamic braking uses the locomotive electrical traction motors as generators, converting the kinetic energy of a moving train into electrical energy. The electrical energy generated is dissipated into fan cooled electrical resistor banks. Increasing or decreasing the amount of electrical resistance in the resistor banks varies the load on the traction motor generator, which applies a corresponding resistance/braking effect on the rotating locomotive wheels.

Independent brake

The independent brake solely controls air brakes within the locomotive(s) and works independently of a train’s other braking control systems. The locomotive brakes are applied when the locomotive brake cylinder pressure is increased. This pressure can be increased or decreased via the driver’s independent brake control handle.

Automatic brake

The automatic brake controls the air brakes in the entire train, including the locomotive(s). An application of the automatic brake applies the locomotive(s) brakes by increasing locomotive brake cylinder pressure (similar to control via the independent brake system). The automatic brake simultaneously triggers the application of the train’s wagon brakes by reducing the air pressure within the train’s brake pipe. Maximum wagon braking effort is achieved when the brake pipe pressure is reduced to about 350 kPa, and wagon brakes are released when the brake pipe is charged to about 500 kPa.

The driver can vary the train’s braking effort, by operating the locomotive’s automatic brake control handle. Brake pipe air pressure is reduced at the service rate for normal braking applications, or at the greater emergency rate when an emergency brake application is made. The driver also has a ‘bail-off’ feature whereby they can suppress the braking action of the locomotive(s) following an automatic brake application, therefore enabling only the wagon brakes to stop the train.

Train-line emergency brake application

In the event that the train’s brake pipe is broken or ruptured following a train separation, the train’s wagon and locomotive brakes are automatically applied at the emergency rate. This safety feature of the automatic brake is also known as a train-line emergency brake application.

The Australian Standard AS7510.6:2014 (Braking Systems – Part 6 – Train), specified the minimum standards for brake performance, features, and compatibility for the braking systems of trains. This standard specified that:

In the event of train separation, the brake application provided by the stopping brake^[8] shall be an emergency application of the stopping brake on every vehicle of the train.

That is, the rapid reduction in a train’s brake pipe pressure, caused by a train and brake pipe separation, must apply brakes at the emergency rate within every vehicle within the train, including locomotives. Although the locomotives of 6MP4 had the ability to comply with this requirement, practical application of the requirement can be influenced by the compliance of the connected wagons’ braking systems. In this case, the wagons which made up 6MP4 were manufactured before the standard was released, and there was no requirement to retrospectively apply this standard to these wagons.

Operationally, the driver has the option to prevent the automatic emergency application of the locomotive brake by using the bail-off feature. This is usually done in order to prevent a collision between two separated portions of a train, caused by the front portion of the train slowing faster than the rear portion. Despite this, there remains an initial automatic requirement for the braking systems in each vehicle of the train to respond to the train separation.

To detect train separations, locomotives are fitted with braking control systems designed (among other control purposes) to detect the rapid reduction of the train’s brake pipe pressure. In the event that a rapid reduction of brake pipe pressure is detected, the braking control systems enable the locomotive(s) emergency braking systems to remove the locomotive drive and provide a faster braking response to bring the train to a stop. These additional emergency braking system actions can include:

• faster exhaustion of brake pipe air pressure via the locomotive’s brake control valves
• removal of the brake pipe charging source (compressor output) from attempting to re-charge the train’s brake pipe
• application of the locomotive brake
• de-energization of the locomotive traction power via the pneumatic control switch/power knockout switch (PCS)
• application of emergency adhesion sanding.^[9]

Automatic braking of train 6MP4

In this case, as the lead locomotive of 6MP4 passed the 20.362 km mark, wagon RRYY01X uncoupled between platforms 2 and 3. This resulted in the separation of the train’s brake air pipe, which exhausted the brake pipe air to the atmosphere.

Following the accident, the train’s brake pipe connections between platform 2 and 3 of RRYY01X were examined. This examination confirmed that the brake pipe had been cleanly broken in the train separation sequence (Figure 10). The brake pipe was not crimped or partially restricted during the train separation, allowing for unrestricted exhausting of brake pipe air.

Figure 10: Broken train brake pipe in platform 2 of 5-pack wagon RRYY01X

Image shows the broken brake pipe on platform 2 of 5-pack wagon RRYY01X.

Source: Pacific National and ARTC, annotated by the ATSB

The rear portion of train 6MP4 stopped due to the reduction in brake pipe air pressure and automatic application of the wagon brakes. Although the wagon brakes also applied on the front portion of 6MP4, the emergency brake systems on the three locomotives did not activate.

Examination of the locomotive event recording verified the absence of emergency brake application. More specifically:

• Emergency brake application would normally trigger adhesion sanding in NR class locomotives, but this was not evident after the train separation in this instance (Figure 11).
• Emergency brake application would normally trigger automatic application of a locomotive’s brakes. The locomotive brakes did not apply, though in this instance the driver reported bailing or holding off the locomotives’ brake after they observed the high brake pipe flow rate.
• Emergency brake application would normally trigger complete evacuation of brake pipe air pressure. In this instance, brake pipe pressure appeared to remain just above 300 kPa (Figure 11).

Figure 11: Graph derived from extract of locomotive NR62 event recorder data

Image shows recorded locomotive NR62 data of the automatic brake pipe pressure, train speed, and sanding status from the front portion of the separated train. The NR62 recordings from the derailment sequence is not displayed in this graph.

Source: Data source Pacific National, graphed by the ATSB

Rolling stock – Wagon RRYY01X

General details

Wagon RRYY01X was one of 52 built in three tranches in 2004–05. The RRYY class wagon is a 5-pack skeletal container wagon (Table 1). This style of wagon consists of five individual wagons referred to as ‘platforms 1 to 5’, permanently coupled over common bogies (Figure 12).

Table 1: Summary details for Pacific National RRYY class wagons

Source: Pacific National Wagon Details Manual WDM-RRYY_04, Issued 28 July 2010

Figure 12: Pacific National RRYY class wagon

Image shows platform and shared bogie configuration of RRYY class wagon.

Source: Pacific National, annotated by the ATSB

The RRYY class wagons were a non-typical low deck wagon design, incorporating a light underframe that was intended to carry car containers. The low deck level was achieved by a combination of smaller diameter wheels, and large low depth gooseneck sections extending from the platform coupling and bogie centres to the larger platform main centre-sill section (Figure 13). Near the junction of this gooseneck and the main centre-sill section of the platform, an outrigger provided support for the container load via its connection to the main centre-sill and goose neck sections. The outrigger featured a large boxed opening for the wagon’s brake pull rod (Figure 13).

Figure 13: RRYY class wagon platform structure

Image shows the low depth platform gooseneck section which extends from the platform coupling and bogie centre to the larger main centre sill section of the platform, as well as the boxed outrigger section.

Source: Pacific National, and ATSB annotated by the ATSB

Post-accident examination

Platform 2 of wagon RRYY01X was recovered to the Adelaide Freight Terminal, allowing for a more detailed examination of the underframe failure. The failure originated from a crack between the join of the bottom centre sill plate and pull rod boxed opening in the wagon’s container loading outrigger (Figure 14).

Figure 14: Underframe cracks in platform 2 of 5-pack wagon RRYY01X

Image shows underframe cracks and their location in platform 2 of 5-pack wagon RRYY01X. The underframe cracks and derailed bogie were located at the trailing end of platform 2 of 5-pack wagon RRYY01X.

Source: Wagon drawing - Pacific National annotated by the ATSB; photos – ATSB

An examination of the crack surface on platform 2 suggested the initial propagation had occurred over a long period of time. This was followed by a rapid propagation shortly prior to and during the derailment. Although the exact period of time the initial crack was evident could not be determined, the crack surface condition suggested it existed weeks to months before, and most certainly was present prior to 6MP4’s departure from Melbourne (Figure 15).

Figure 15: Underframe crack fracture surfaces in platform 2 of 5-pack wagon RRYY01X

Image recorded on 27 April 2018, 6 days after derailment. Image shows the corrosion differences on the underframe crack fracture surface in platform 2 of 5-pack wagon RRYY01X.

Source: ATSB

Wagon RRYY01X loading

Pacific National documented specific freight loading and marshalling requirements for RRYY class wagons in its train inspection and freight loading manuals. In respect of train 6MP4 on 20–21 April 2018, four platforms of wagon RRYY01X were loaded with one container each. No container was loaded on platform 2 (Table 2).

Table 2: Loading of wagon RRYY01X

Wagon RRYY01X was positioned about 660 m behind the lead locomotive and about 750 m from the end of the train. There was about 1,405 t trailing^[10] wagon RRYY01X.

Train 6MP4 and wagon RRYY01X were loaded in compliance with the Pacific National train inspection and freight loading manuals.

Wagon RRYY01X loading history

The maximum loading for each RRYY class wagon platform was 28 t. A review of the loading records for wagon RRYY01X indicated that platform 2 had exceeded its maximum loading on six occasions between 2005 and 2013. Since 2013, there had been no recorded overloading of this platform.

In summary, although wagon RRYY01X had some history of overloading, there was no recent history to suggest that wagon overloading contributed to its structural failure on 21 April 2018.

Rolling stock maintenance inspections

As per Pacific National Wagon Maintenance Manual (WMM), all standard gauge intermodal and steel wagon maintenance was based on time or kilometres travelled. The inspection frequency and assigned maintenance schedule was also dependant on the type of wagon. However, where a defect was detected by a safety inspection, roll-by inspection^[11] or other means, the wagon could be scheduled for repairs and maintainer inspections outside of the schedule.

For the RRYY class wagons, the maintenance instruction assigned an IM3^[12] maintenance schedule, based on distance travelled (Table 3).

Table 3: IM3 maintenance schedule for RRYY class wagons

The maintenance controls included a visual inspection to manage the risks associated with structural failure of wagons. Visual inspections were applicable during safety inspections and maintainer inspections, which included both scheduled inspections and anticipated inspections when wagons received out-of-course repairs.

Safety inspections

Train examination

The Pacific National Train Inspection Manual (TIM) required that all trains undergo a train examination prior to departing a yard or terminal location. Although, there were some exceptions to this requirement, these were not relevant to the operations related to this accident and wagon RRYY01X. Train examinations were normally conducted by train examination personnel.

Train examinations included inspections and tests on the train’s braking systems and visual inspections of the train’s loading and its rolling stock. The rolling stock inspection component included visual inspection of each wagon in the train in respect to the adjustment, condition and/or security of the wagon body. With potential relevance to this accident, this included structural damage and/or failure of components.

In respect to wagon underframes, the Pacific National TIM provided generic guidance on how to handle any identified longitudinal or transverse cracks in wagon underframes, cracks in component supports or mounting brackets, and cracks in body centre plates. However, there was no specific guidance requiring visual inspections of key structural points of RRYY class wagons, which might be susceptible to cracking.

It was reported by Pacific National train examination staff that the ability to visually inspect all areas during a train examination can be limited due to wagons being loaded, ambient lighting, shadows cast from adjacent wagons, cleanliness of wagons, and other obstructions.

The results of train examinations were required to be recorded within the Pacific National Train Inspection Certificate – Intermodal (TIM 01-04 Appendix B). The certificate related to train 6MP4 was completed on 20 April 2020 at 1240 and did not include any recorded issues related to wagon body inspections.

In the preceding 3-month period, wagon RRYY01X had been used on about 30 intermodal train services and undergone train examinations at Pacific National freight terminals in Melbourne, Adelaide, Perth, and Brisbane. These inspections, involving a wide group of train examination personnel, did not report any structural cracks in wagon RRYY01X.

Roll-by inspection

The Pacific National TIM required that all trains, excluding coal trains, undergo a roll-by inspection when departing or arriving at a yard or terminal location. They were normally conducted by train examiners, but could also be undertaken by other qualified rail safety workers.

Roll-by inspections included visual inspections, and these visual inspections were aimed at detecting air leaks, wheel flat spots, unreleased handbrakes, correct wheel rotation, axle bearing irregularities and dragging equipment, as well as a catch-all requirement to report any other observable defects. Roll-by inspections were generally concluded with a message to the train crew that the train has been inspected and whether it was complete (all wagons attached) or required action.

Although not directly intended as a method to inspect the wagon’s body for cracking, if the structure of the wagon had been compromised, this may be an observable defect during a roll-by inspection. In respect of train 6MP4, there was no evidence available to suggest that a defect had been identified in the roll-by inspection when 6MP4 departed Melbourne Freight Terminal on 20 April 2018.

In addition to arrival and departure from yards and terminals, additional roll-by inspections were also undertaken when a train was en-route. These roll-by inspections were undertaken by train crews of passing trains, incoming/outgoing train crews, and other qualified rail safety workers where applicable. These inspections were intended to observe the general security of loading, overall train integrity, and correct operation of the end of train marker. They were generally concluded with a message to the train crew that the train has been inspected and whether or not it is complete or requires action.

Figure 16: ARTC Adelaide to Melbourne corridor, with 6MP4 roll-by inspection locations

Image shows the location of the roll-by inspections undertaken on 6MP4 on its journey between Melbourne and Mount Lofty, noting roll-by location labels shown in orange.

Source: ARA annotated by the ATSB

Train 6MP4 passed other train services at Tooli Loop, Wingeel, and Deep Lead Loop, Victoria (Figure 16). A roll-by inspection was reported by the departing train crew at Dimboola, and the 6MP4 train crew reported that a roll-by was provided by the station assistant at Tailem Bend, South Australia (Figure 16). There was no evidence to suggest that a defect was identified from these inspections.

Maintainer inspections

Programmed maintenance inspection

The Pacific National Wagon Maintenance Manual (WMM) required that all RRYY class wagons undergo a ‘P’ inspection every 350,000 km with a tolerance of 50,000 km. ‘P’ inspections were also undertaken in combination with ‘A’ and ‘B’ inspections when the wagon had travelled the applicable threshold distances. The inspections were conducted by wagon maintenance personnel.

The wagon ‘P’ inspections included inspections, servicing, adjustments, and measurement/gauge checks of various wagon body, bogie, brake, and coupler components. With potential relevance to this accident, there was a requirement to check the wagon underframe for structural cracks in compliance with a specific Underframes, Body Work and Load Supports procedure.

The Pacific National WMM Underframes, Body Work and Load Supports procedure provided broad generic guidance on what to look for, and where to look, with respect to a typical wagon underframe. The procedure did not specifically guide wagon maintenance staff to key structural points on an RRYY class wagon or emphasise the areas susceptible to cracking.

It was reported by Pacific National wagon maintenance staff that wagons were normally delivered to maintenance facilities empty for the scheduled ‘P’, ‘A’ and ‘B’ inspections. As such, the limitations identified previously for train examiners were usually not a factor (for example, wagon loading, ambient lighting, and other obstructions). However, wagon cleanliness (build-up of grease, dirt or similar) could still limit visual inspections.

In relation to the scheduled maintenance inspections on wagon RRYY01X (Table 4), the last maintenance inspection was recorded as being undertaken on 24 October 2016 at the Perth Freight Terminal. There was no evidence available to suggest that this maintenance inspection identified any structural cracks in wagon RRYY01X. At the time of the accident on 21 April 2018, wagon RRYY01X was nearing the scheduled distance for its next ‘A’ Maintainer Inspection.

Table 4: Scheduled inspections of RRYY01X for previous 7 years

The maintenance personnel conducting maintainer inspections were required to report any significant structural cracks or hairline cracks in inaccessible locations to their maintenance manager, with the provision for minor hairline cracks to be gouged and welded on site.

Pacific National maintenance and engineering representatives advised that they had no recollection of reports or observations about any significant structural cracking on RRYY wagons in the area where wagon RRYY01X had failed.

A review of previous ATSB investigation reports and available notifiable occurrence records did not identify any previous structural failures of RRYY class wagons.

Out-of-course maintenance inspection

Out-of-course maintenance inspection relates to ad-hoc maintainer visual inspections outside of the scheduled maintenance cycle. For example, Pacific National maintenance and engineering representatives advised of an expectation that a maintainer visual inspection would occur prior to the release of a repaired wagon. These ad-hoc maintainer visual inspections were also guided by the Pacific National WMM Underframes, Body Work and Load Supports procedure.

Wagon RRYY01X had been submitted for repair about 24 times since the last scheduled inspection (24 October 2016), with three of these within 3 months of the accident (Table 5). None of the repairs were specifically related to underframe cracking, and six instances were simply identified as ‘vehicle inspection’ (Table 5). There was no evidence available to suggest that any of these vehicle inspections, or maintainer repair opportunities, had identified any structural cracks in wagon RRYY01X.

Table 5: Out-of-course vehicle inspections of RRYY01X since scheduled inspection including out-of-course repairs undertaken in the 3 months prior to the accident

Personnel information

Pacific National had documented its competence requirements for its rolling stock maintainers, train examination staff and train crew. The Pacific National personnel involved in the operation and pre-departure train examination of 6MP4, as well as the maintainers who had undertaken the last scheduled ‘P’ Maintainer Inspection, held current competencies for their tasks.

Post-accident RRYY fleet inspections

After the accident, Pacific National published and distributed a Rolling Stock Notice^[15] to its terminal managers, maintenance planners, maintainers, train examiners and engineering representatives. The notice identified the location where the structural cracks within wagon RRYY01X had commenced and focussed post-accident inspections onto these specific stress areas of Pacific National’s RRYY class wagon fleet.

Staff in Adelaide, Melbourne, Perth, Sydney and Brisbane inspected the RRYY class fleet. Focussing on the structural areas specified within the Rolling Stock Notice, over half of the remaining 50 RRYY class wagon fleet were found to exhibit cracks of varying lengths.

Pacific National train examination, maintenance, and engineering representatives advised the ATSB that the extent of structural cracking on RRYY class wagons had not been observed previously. As a precaution, Pacific National ‘red carded’^[16] the cracked RRYY class wagons until a long-term solution was formulated.

__________

7. Standing room: the distance along the track between points of minimum allowable clearance where rolling stock is permitted to stand.
8. Stopping brake: braking equipment used for stopping a train in running.
9. Sanding is used in train operations to improve adhesion or traction in both braking and traction.
10. Train weight located behind all platforms in wagon RRYY01X.
11. Roll-by inspection: a visual inspection of a train to identify equipment, loading, security or other defects or failure whilst the train is moving.
12. IM3 is a Pacific National maintenance code specifying the distance to be travelled between scheduled maintenance inspections. In the case of IM3, maintenance inspections are scheduled every 350,000 km.
13. Full train examination (FX): performed by examining staff after final marshalling of non-tested loading, prior to commencement of journey consisting of full mechanical examination; complete air brake test; brake pipe leakage test; and issue of train examiners’ certificate for interstate freight trains.
14. General train examination (GX): an examination conducted by appropriately qualified employees (normally locomotive drivers) at those times and locations where other staff qualified to conduct an FX inspection are not available.
15. Ad-hoc Pacific National instruction to staff relating to rolling stock.
16. Defect card: a red card is placed in the waybill clip of a wagon to notify all concerned that that particular vehicle is NOT fit for traffic and must be repaired prior to returning to traffic.

Safety analysis

Structural failure

During freight train 6MP4’s descent from Mount Lofty, there was a structural failure in platform 2 of wagon RRYY01X. This resulted in one of the axles of the bogey between platform 2 and platform 3 derailing, and ultimately the train parting between these two platforms.

Post-accident observations found a crack in the underframe of platform 2 had propagated over time, most likely in the weeks and months prior to the derailment. The steep climb up to Mount Lofty under maximum tractive effort would have placed significant longitudinal tension through the wagon structure. This would have the effect of opening and encouraging growth of any pre-existing crack in the wagon underframe.

Mount Lofty is located at the top of a cresting grade. As a train passes over a cresting grade, the weight and resistance of the train’s rear portion still on the ascending grade is opposed by the combined tractive effort and weight of the front portion of train now on the descending grade. If a train is not handled appropriately, these conditions can cause in-train forces to exceed coupler strength with subsequent failure resulting in a train separation at the crest. In this case, the driver handled train 6MP4 appropriately. However, it is likely that the weakened structure of RRYY01X-platform 2 was unable to accommodate the high in-train forces, causing the underframe to fail and the crack to open significantly.

For the RRYY class wagon, the junction of the wagon’s bottom centre sill plate with the container loading outrigger included a pull-rod boxed opening within the outrigger (Figure 13). The loading and unloading of containers on the RRYY class wagons, accompanied by dynamic loading during normal operations, likely exposed this junction to cyclic strain and, as such, it would be susceptible to fatigue.

In support of this, the specific stress areas of the RRYY class wagon fleet that were a feature of this accident were, post-accident, inspected by Pacific National. These inspections identified that over half of the RRYY class wagon fleet were exhibiting cracks of varying lengths in the same areas.

Derailment

Failure of the underframe caused the deck of platform 2 to bend, changing the deck angle at the coupling to platform 3 (supported over a common bogie). Variations to drawbar or coupling angle, combined with large compressive longitudinal forces, are known to cause wheel unloading on empty wagons.^[17]

In addition, high compressive longitudinal forces are known to increase lateral forces towards the outside of tight curves. For example, Pacific National’s train handling standard (PN-STD-SAF - Train Handling) noted the increased potential for derailment when under concentrated compressive force:

The presence of light wagons in the consist, or long wagons coupled to short wagons, or a coupler misalignment will increase the possibility of derailment.

As train 6MP4 negotiated a series of tight curves, the combination of wheel unloading (due to compressive forces and coupling angle on a light wagon) with increased lateral forces (due to compressive forces and a tight curve) resulted in flange climb (possibly complete wheel lift) and subsequent derailment.

Ultimately, the bogie re-railed about 5.5 km after it derailed. However, during this period, the derailed bogie had caused minor damage to rail lubricators, sleepers and points turnout components. In addition, the consequences could have been more serious if more bogies had derailed.

Rolling stock inspections

Pacific National had an established process of visual inspections for its rolling stock, including among other purposes, identifying cracks in wagons. These visual inspections were required to be undertaken within programmed and out-of-course maintenance inspections by maintenance staff, as well as within terminal arrival and departure train safety inspections by train examination staff.

A number of inspections were undertaken during the time that the crack likely existed in the underframe of wagon RRYY01X. More specifically:

• In the 3 months prior to the derailment there had been one out-of-course maintenance inspection recorded on 29 January 2018, as well as two other out-of-course maintenance repairs on 12 February 2018 and 16 April 2018.
• Wagon RRYY01X had performed about 30 train services, including train 6MP4, in the 3 months prior to the derailment. This involved train safety inspections from a wide group of train examination personnel at Pacific National Terminals in Melbourne, Brisbane, Adelaide and Perth.

There was no evidence that these inspections had identified any cracks in wagon RRYY01X. Similarly, it was evident that previous maintenance inspections had not detected cracks of varying lengths in more than half the 50 RRYY class wagon fleet.

Requirements and guidance for rolling stock inspections

As already noted, post-accident examinations found over half the RRYY class wagon fleet exhibited cracks in the junction of the bottom centre sill plate and the container loading outrigger. This junction was likely exposed to cyclic strain and fatigue, due to loading and unloading of containers and dynamic loading during normal operations. Although this was potentially predictable, it had not been considered and identified as a focus point for inspections by Pacific National.

Further to this, the Pacific National WMM Underframes, Body Work and Load Supports procedure provided broad generic guidance to wagon maintenance staff about what to look for and where to look, with respect to a typical wagon underframe. However, this procedure was generic and did not guide visual inspections to key structural points of an RRYY class wagon that had a reasonably predictable susceptibility to cracking.

Additionally, the Pacific National Train Inspection Manual provided generic guidance to train examination staff on how to handle any identified longitudinal or transverse cracks in wagon underframes, cracks in component supports or mounting brackets, and body centre plates. Similarly, this information also did not provide specific guidance on where to focus visual inspections with respect to key structural points of an RRYY class wagon that had a predictable susceptibility to cracking.

A large number of factors can influence visual inspection performance, such as the nature and salience of the defect, the use of inspection aids, environmental factors, duration of tasks and training and experience (See, 2012). Research across a number of visual search tasks has shown that experts are better than novices because they know from experience the most likely locations that relevant targets (or defects or hazards) are most likely to be located (Wickens and others, 2015). Accordingly, providing inspectors with information about locations most likely to contain defects (of feedforward information) improves defect detection performance.

In this case, Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This probably reduced the likelihood of the crack in wagon RRYY01X being detected prior to the accident.

Train separation and subsequent braking

Wagon RRYY01X uncoupled between platforms 2 and 3, resulting in the subsequent separation of the train’s brake air pipe, which exhausted the brake pipe air to the atmosphere. It was evident that the brake pipe had broken cleanly, allowing for unrestricted exhausting of brake pipe air.

Although air was exhausting from the front portion of the train via the separated brake pipe (wagon RRYY01X), it is likely the air production from the three locomotive compressors was sufficient to maintain the train’s brake pipe at a pressure high enough to inhibit the locomotives’ emergency braking system response. This effect meant that, although the wagon brakes on the front portion of the train applied, the locomotives continued to pump air into the broken brake pipe instead of exhausting the remaining brake pipe pressure. Overall, the brakes on the front portion did not slow the train at the emergency rate. The front portion of the train came to a stop about 450 m ahead of the rear portion.

The absence of the locomotives’ emergency braking systems was not contributory to the derailment, and did not increase risk associated with this accident. However, the automatic activation of the locomotives’ brakes at the emergency rate is a requirement of the Australian Standard and failure to do so may increase risk in different circumstances.

__________

17. Refer to ATSB investigation report 2004008, Derailment of Pacific National Train 7MP5, Glenalta, South Australia, 21 November 2004.

Findings

From the evidence available, the following findings are made with respect to the derailment of train 6MP4 near Glenalta, South Australia, on 21 April 2018.

Contributing factors

• A fatigue crack initiated in the bottom centre sill plate of wagon RRYY01X’s platform 2 underframe, which led to structural failure of the wagon and subsequent derailment of train 6MP4.
• Multiple train examinations and maintenance inspections undertaken on wagon RRYY01X did not identify the crack in the wagon’s underframe.
• Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of cracks being detected. (Safety issue)

Other factors that increased risk

• The train’s brake pipe between platforms 2 and 3 was broken when wagon RRYY01X separated. Although this allowed air to exhaust from the brake pipe, enabling the train brakes on the wagons to bring the front and rear portions of the train to a stop, this loss of air on the front portion of the train did not activate the emergency braking system response of the locomotives.

Safety issues and actions

Inspection processes

Safety issue number: RO-2018-009-SI-01

Safety issue description: Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of cracks being detected.

Safety action not associated with an identified safety issue

Additional safety action by Pacific National

Pacific National advised that all new wagons and locomotives procured by Pacific National will meet the Australian Standard AS7510.6 for braking systems.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Pacific National
• the Australia Rail Track Corporation (ARTC)
• the Office of the National Rail Safety Regulator (ONRSR)
• the train crew of train 6MP4
• Pacific National examination, maintenance and engineering personnel.

References

Pacific National, Train Inspection Manual, as current 21 April 2018.

Pacific National, Wagon Maintenance Manual, as current 21 April 2018.

Pacific National, Freight Loading Manual, as current 21 April 2018.

Pacific National, Train Handling Standard (PN-STD-SAF), version 5.0 issued 22 May 2017.

Rail Industry Safety and Standards Board (RISSB) AS7510.6:2014, Braking Systems – Part 6 – Train.

See JE 2012, Visual inspection: A review of the literature, Sandia Report SAND2012-8590, Sandia National Laboratories.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Pacific National
• the Australian Rail Track Corporation (ARTC)
• the Office of the National Rail Safety Regulator (ONRSR)
• the train crew of train 6MP4
• selected Pacific National examination, maintenance and engineering personnel.

Submissions were received from:

• Pacific National
• the Office of the National Rail Safety Regulator (ONRSR).

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 24 February 2018, the yacht Finistere capsized south of Perth, Western Australia, with the loss of two lives.

The Western Australian Department of Transport (WA-DoT) is responsible for investigating this accident. As part of its investigation, WA-DoT requested technical assistance from the Australian Transport Safety Bureau (ATSB), involving the examination of an electronic device.

To protect the information supplied by WA-DoT to the ATSB, as well as the ATSB’s investigative work to assist WA-DoT, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003.

The ATSB completed its technical assistance and provided a report to the WA-DoT. Any enquires in relation to the accident investigation should be directed to WA-DoT at marine.investigations@transport.wa.gov.au