Safety summary

What happened

On 19 November 2017, a GIE Avions de Transport Regional ATR 72-212A aircraft, registered VH‑FVZ, was being operated by Virgin Australia Airlines as flight VA646 from Sydney, New South Wales to Canberra, Australian Capital Territory. On board the aircraft were the captain, first officer, a check captain, two cabin crewmembers and 67 passengers.

During the landing approach, the aircraft speed increased above the maximum allowable and the first officer (the pilot flying – the captain was the pilot monitoring) assessed that the aircraft was overshooting the desired approach profile. In response, the first officer reduced engine power to idle at a height of 118 ft above the runway elevation, leading to an increasing descent rate and reducing speed.

The aircraft subsequently landed heavily on the main landing gear, tail skid and underside of the rear fuselage. No persons were injured, however the aircraft sustained substantial damage.

What the ATSB found

During the late stages of the aircraft’s approach to land, the approach became unstable in speed and then in power setting. The flight crew did not recognise the unstable approach, however the pilot monitoring recognised the incorrect power setting and called for an increase in power then physically intervened shortly before touchdown. However, these actions were not effective in preventing the hard landing.

The aircraft also encountered a change in the wind direction and strength immediately before touching down, which increased the descent rate. This, combined with the already high descent rate, increased the amount of damage sustained by the aircraft.

What's been done as a result

Following this occurrence, the operator strengthened its guidance on the effects of sustained low power settings during approach and landing and the importance of avoiding that situation. These aspects are also being reinforced in training.

The operator also added additional criteria to its operational monitoring program to detect instances of low power settings at low level.

Safety message

Unstable approaches continue to be a leading contributor to approach and landing accidents and runway excursions. This occurrence demonstrates the importance of crews adhering to standard operating procedures and conducting a go-around when an approach becomes unstable. It also highlights the risks associated with the incorrect handling of an approach to land and the need for prompt and decisive action as the available time to remedy the situation is limited.

The occurrence

At about midday Eastern Daylight-saving Time ^[1] on 19 November 2017, a GIE Avions de Transport Regional ATR 72-212A aircraft, registered VH‑FVZ, was being operated by Virgin Australia Airlines as flight VA646 from Sydney, New South Wales to Canberra, Australian Capital Territory. A captain, first officer, check captain, two cabin crewmembers and 67 passengers were on board the aircraft.

The first officer was pilot flying (PF), and the captain was pilot monitoring (PM).^[2] The check captain was positioned in the observer seat on the flight deck, conducting an annual line check of the captain along with a six-month line check of the first officer.

Prior to commencing descent for Canberra, the first officer briefed the captain for the approach and landing. The first officer advised that the calculated target approach speed was 113 kt, the expected landing weight was 21,600 kg and that the reported weather indicated a crosswind from the right of 15 kt for a landing on runway 35. He also advised the captain that due to the heavy aircraft weight and the possibility of a tailwind at times during the approach, he would slow the aircraft earlier than normal to ensure the approach commenced at the target speed.

At 1319, the flight crew were conducting a visual approach to runway 35 at Canberra in conditions of light turbulence and with the autopilot engaged. As the aircraft descended through about 400 ft above the airport elevation, the first officer disconnected the autopilot and continued flying the approach manually. Later, as the aircraft descended through 265 ft above runway level in conditions of light turbulence, the aircraft speed reduced. In response, the PF increased power.

As the aircraft descended through 193 ft, the turbulent conditions combined with the increased power setting to increase the speed further. Eight seconds later, the speed had increased to 127 kt – 4 kt above the stabilised approach criteria upper limit (see the section titled Approach and landing). At this time, the aircraft was 118 ft above the airport elevation. The PF did not recognise the stabilised approach criteria exceedance. However, having assessed the presence of overshoot windshear,^[3] he reduced the engine power to idle. The selection of idle power at that stage of the approach also did not comply with a further stabilised approach criteria requirement. As a result of the power reduction, the descent rate increased and the speed reduced. At about this time, the check captain recognised that the power setting was too low, but assessed that input from him would not assist in the recovery of the approach.

At 1320:56, five seconds prior to the touch down, the PM recognised the inappropriate power setting and advised the PF to ‘ease on a bit’ [of power], the PF verbally responded to the advice, but did not increase power.

As the aircraft descended through about 50 ft above the runway, the recorded descent rate increased to 784 feet per minute, above the normal descent rate for the approach of about 575 feet per minute. At 1320:59, at a height of 27 ft and two seconds prior to touch down, the aircraft encountered a wind shift (see the section titled Recorded flight data) which further increased the descent rate. The PF and PM both reported that they felt a sudden increase in descent rate at that point. In response, the PM immediately called more urgently for an increase in power and manually intervened by advancing the power levers slightly, increasing power on both engines from 1.5 per cent torque to 3 per cent torque. Two seconds later, anticipating a bounced landing, the PM instructed the PF to commence a go-around. However, almost immediately the aircraft touched down at a normal pitch attitude, but heavily on the main landing gear, tail skid and underside of the rear fuselage (Figure 1). The aircraft did not bounce and the PM cancelled the go-around, took control and completed the landing roll.

Figure 1: Occurrence touchdown

Source: Aircraft Operator

The flight crew then taxied the aircraft to the gate. After shutting down the engines, the flight crew reviewed the recorded landing data which indicated that a hard landing had occurred, requiring maintenance inspections. The captain also inspected the aircraft and tail skid.

No persons were injured during the hard landing, however the aircraft sustained substantial damage.

__________

1. Eastern Daylight-saving time (EDT): Coordinated Universal Time (UTC) +11 hours.
2. Pilot Flying (PF) and Pilot Monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for upcoming stages of the flight. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. Overshoot windshear: A sudden change in wind direction and/or strength resulting in an increase of headwind.

Context

Flight crew

Captain

The captain held an Air Transport Pilot Licence (Aeroplane), an instrument rating for multi-engine aircraft and a Class 1 Aviation Medical Certificate. He had over 8,160 hours of flying experience, of which over 1,900 hours were on the ATR 72.

The captain also held the role of a training captain with the operator. In that role, he had undertaken operational training of other flight crew, including the first officer. During this training, the captain found the first officer to be a ‘good operator’.

First officer

The first officer held an Air Transport Pilot Licence (Aeroplane), an instrument rating for multi‑engine aircraft and a Class 1 Aviation Medical Certificate. The first officer had over 1320 hours of flying experience, of which over 320 hours were on the ATR 72.

The first officer completed ATR 72 aircraft-type training and began flying the aircraft type 6 months prior to the accident flight.

Fatigue

While prior to the day of the occurrence, the captain had two rostered days off and good sleep opportunities for the two previous nights, he later recalled that at the time of the occurrence he was feeling ‘a bit lethargic and a little tired’.

The ATSB examined the effect of fatigue on the performance of the flight crew and determined that the captain and first officer were not experiencing a level of fatigue known to have a demonstrated effect on performance.

Check flight

The accident flight was the last of four flights on the day comprising a routine annual operational line check of the captain and six-month operational line check of the first officer by a check captain. The check captain was positioned in the observer seat at the rear of the flight deck (Figure 2). The check captain was assessing the competency of the flight crew as part of regular cyclical checks and his role did not include participation in the normal operation of the flight.

Figure 2: Flight deck seating positions

Source: Operator

Prior to the first of the four flights comprising the check, in accordance with the operator’s procedures, the check captain briefed the flight crew of his observation and non-participatory role in the conduct of the flight and to operate the flight ‘as if he wasn’t there’.

The captain later reported that during check flights, he had a tendency to modify his behaviours and allow first officers more margin than normal when correcting deviations in the operation of the aircraft. He did this in order to allow the first officer an opportunity to rectify any deviations. The captain advised that during normal operations, he would intervene more quickly after identifying a deviation from the desired operation of the aircraft.

Check captain intervention

The operator provided the following guidance to check captains acting in an examiner’s role:

When the check is conducted with the examiner on the jump seat the examiner should only intervene to ensure that flight safety/company regulations and/or policies are not breached.

The check captain later stated that he would have intervened in the conduct of the flight if he felt that the safety of the flight was compromised. However, after recognising that the approach had become unstable, the check captain assessed that the landing would be ‘untidy’, but not unsafe. He stated that at that stage, input from him was outside of his role, might distract the flight crew and would not assist in the recovery of the approach.

Post-flight assessment

The check captain’s assessment for the performance of the first officer during the check flight was ‘unsatisfactory’. The check captain assessed that the performance of the captain was ‘satisfactory’. However, the operator required both flight crew to undergo retraining prior to resuming normal flying duties.

Meteorological information

The Canberra Airport automatic terminal information service (ATIS) provided the flight crew with the following weather information:

A north-easterly wind of 12 kt prevailed, which was all crosswind for runway 35 with an occasional tailwind of up to 3 kt. Visibility exceeded 10 km with scattered^[4] cloud at 4,500 ft.

Recorded weather observations at Canberra Airport at the time of the accident were broadly consistent with the ATIS, wind conditions being a north-easterly wind of 12 to 16 kt and scattered cloud at about 7,000 ft.

The approach to runway 35 passes in proximity to undulating ground, which can be a source of mechanical turbulence^[5] and windshear leading to minor excursions in speed from the target speed. The flight crew reported that they regularly experienced turbulence at all stages of approach and landing at Canberra Airport.

Aircraft information

The ATR 72-212A is a twin-engine, high-wing, turboprop regional airliner with a maximum take-off weight of 23,000 kg and maximum landing weight of 22,350 kg. At the time of the landing, the aircraft gross weight was about 21,700 kg

VH-FVZ (Figure 3) was manufactured in 2013 and first registered in Australia in May 2013. The aircraft was configured with 68 passenger seats.

Figure 3: VH-FVZ

Source: ATSB

The twin-engine turboprop configuration of the aircraft was such that a reduction in power to idle during approach would result in a significant increase in drag, as described in the United States Federal Aviation Administration publication, Airplane Flying Handbook Chapter 14: Transition to Turbopropeller-Powered Airplanes:

Landing some turboprop airplanes can result in a hard, premature touchdown if the engines are idled too soon. This is because large propellers spinning rapidly in low pitch create considerable drag.

Landing gear

The ATR 72 landing gear and associated structure is designed to absorb energy equivalent to a maximum descent rate of 600 feet per minute when landing at the aircraft’s maximum landing weight. The landing gear is designed to absorb reserve energy equivalent to a descent rate of up to 720 feet per minute when landing at the maximum landing weight.

Tail skid

The aircraft is equipped with a non-retractable tail skid on the underside of the rear fuselage to avoid fuselage contact with the runway when the take-off or landing pitch angle is 8° or more (Figure 4). Pitch attitudes of 5.5° or more accompanied with a high rate of descent may also result in ground contact.

Figure 4: ATR 72 Tail skid

Source: Operator

On both sides of the tail skid, the fuselage is equipped with red painted limit stroke detectors (Figure 5). The limit stroke detectors deform when the tail skid compression is greater than 112 mm to provide a visual indication of tail skid compression.

Figure 5: Tail skid limit stroke detector

Source: Operator

The flight crew operating manual provides the following guidance to flight crew regarding tail skid inspection:

At each walk around, inspect skid shoe.

If it is stripped, check the red indicator

If this indicator does not show evidence of wear, aircraft can be dispatched.

If this indicator shows evidence of wear, maintenance action is required.

Inspection and damage

Flight crew inspection

After the passengers disembarked, the captain inspected the aircraft and tail skid. He later recalled observing that the red limit stroke detector was visible and that there was no other visible damage to the aircraft. The captain therefore assessed that the rear fuselage had not contacted the runway and did not inspect the underside of the rear fuselage. He then made an entry in the aircraft technical log regarding the hard landing and contacted the operator’s maintenance engineering department to advise them of the occurrence. This entry required maintenance actions prior to any subsequent flight, grounding the aircraft. The subsequent engineering inspection identified the damage to the aircraft.

The check captain and first officer did not inspect the aircraft for damage.

Damage

Technical examination identified that the aircraft sustained impact and abrasion damage to the tail skid and the underside of the rear fuselage forward of the tail skid (Figure 6). Reskinning of sections of the fuselage underside, replacement of the tail skid and a drain deflector mast was required before the aircraft was returned to service.

Figure 6: Damage to the tail skid and underside of the rear fuselage

Source: ATSB

Damage and wear to the tail skid and associated stroke indicator indicated that the tail skid was fully compressed during the landing (Figure 7). After landing, the main landing gear oleos^[6] remained fully compressed, indicating they had lost gas pressure.

Figure 7: Figure showing the limit stroke detector from FVZ (left) and an undamaged stroke indicator (right).

Source: Operator

Analysis of the loads sustained by the nose and left main landing gear determined that these were below certification limits and the assemblies were returned to service. The loads sustained by the right main landing gear were above certification limits, this assembly was subject to a stress analysis and assessment prior to being returned to service.

Approach and landing

Stabilised approach criteria

The operator’s procedures included a stabilised approach criteria, which included the following relevant items:

• Thrust setting is appropriate for the aircraft configuration and trajectory
• Speed within -5 [kt] to +10 [kt] of the speed target.
• The PM should continue to monitor basic flight parameters and ANNOUNCE deviations.
• TRANSIENT exceedances of the stabilised approach criteria associated with changing environmental conditions are permissible providing the stabilised criteria can be quickly recovered.
• The PF must initiate a go-around for sustained or repeated exceedances of the stabilised approach criteria.
• The PM must announce "NOT STABLE" if the PF does not initiate a go-around for a sustained unstable approach.
• If either pilot is unsure about the safe outcome of the landing then a go-around must be initiated or called for.

Technique

After the occurrence, the captain commented that for the aircraft weight at the time of the approach, a typical power setting would have been about 22 per cent torque. The flight crew operations manual instructed that during landing, flight crew should reduce power from the approach power setting to flight idle when passing a height of 20 ft. The check captain also advised the ATSB that reducing power to idle at about 100 ft was the incorrect technique and would lead to an excessive descent rate.

Missed approach guidance

The operator’s standard operating procedures provided the following guidance for the conduct of a missed approach:

A major cause of approach and landing accidents is the failure to recognise the necessity to execute a missed approach. The captain is ultimately responsible for the decision to continue or to discontinue an approach. However, the first officer is expected to take the decision and carry out the manoeuvre if acting as PF, or call a go-around if acting as PM and it becomes necessary.

A missed approach shall be executed if any of the following occur:

An approach is not stabilised.

The approach becomes unstable in altitude, airspeed, glide path, course or configuration.

Unexpected wind shear is encountered.

Flight crew training

The operator provided approach handling training to flight crew during type conversion training and their recurrent operational training in accordance with manufacturer recommendations and as approved by the Civil Aviation Safety Authority. Each flight crewmember had undergone this training on multiple occasions, exposing them to various approach scenarios. The operator also provided intervention training to flight crew during recurrent operational training and rank upgrade training.

Recorded flight data

The ATSB analysed relevant data from the aircraft’s flight data recorder (FDR) and the cockpit voice recorder (CVR).

FDR data

The recorded flight data showed that the aircraft speed fluctuated in the turbulent conditions throughout the approach, and generally exceeded the speed target of 113 kt (Figure 8).

At 13:20:50, speed increased above 123 kt, to a maximum of 127 kt, exceeding the stabilised approach criteria speed limitation by up to 4 kt for a total period of 9 seconds. Engine power then reduced from about 26 per cent torque to flight idle as the aircraft descended through a height of 118 ft. The power remained at flight idle until increasing marginally to 3 per cent, one second before touch down. Over the last six seconds of the approach, the recorded speed reduced from 125 kt to 105 kt.

The data also showed that at touchdown, the aircraft pitch attitude was 6° nose-up.

Figure 8: Graphical representation of flight recorder data

The ATSB also analysed the recorded flight data to determine the wind conditions experienced by the aircraft during the final six seconds of the approach. This analysis showed that during the final seconds of the approach, the aircraft encountered a significant shift in wind direction and strength, as shown in Table 1.

Table 1: Wind conditions for final 6 seconds of approach

Prior to the reduction in power to flight idle, the approach descent rate was in the normal range of 500 to 600 feet per minute. After the power reduced to idle, the descent rate increased from 560 feet per minute at 13:20:53, reaching 784 feet per minute four seconds later as the aircraft encountered the wind shift, and 928 feet per minute at touchdown.

The recorded peak vertical acceleration at touchdown was 2.97 G.^[7]

CVR data

The cockpit voice recorder captured the following relevant items:

Table 2: Cockpit voice recorder key items

Similar occurrences

Portuguese Gabinete de Prevenção e Investigação de Acidentes com Aeronaves e de Acidentes Ferroviários investigation 15/ACCID/2016 (CS‑DJF)

On 22 October 2016, White Airways ATR 72-212A, registered CS-DJF, performed a regular commercial passenger transport flight at night, between Porto Airport, Portugal and Lisbon Airport, Portugal.

Following a continued unstable approach, the aircraft touched down on the nose landing gear and bounced multiple times. This resulted in separation of the wheels and respective axles of the nose landing gear. After a fourth touchdown, the aircraft stabilized and completed the landing with the nose landing gear leg in contact with the runway surface.

ATSB investigation AO-2015-032 (9M-MTA)

On 14 March 2015 Malaysia Airlines Airbus A330, registered 9M-MTA, began its approach to Melbourne Airport, Victoria after a flight from Kuala Lumpur, Malaysia. In the final stages of the approach, the approach became unstable, however the approach was continued. At approximately 50 feet, the captain reported feeling the aircraft sink and manually increased the thrust to the engines in an attempt to slow the rate of descent. Despite this action, the aircraft experienced a hard landing of a magnitude requiring replacement of the aircraft’s main landing gear.

ATSB investigation AO-2008-007 (VH-NXE)

On 7 February 2008, a Boeing Company 717-200 aircraft, registered VH-NXE, was being operated on a scheduled passenger service from Cairns, Queensland via Nhulunbuy (Gove) to Darwin, Northern Territory with six crew and 88 passengers.

The flight crew were conducting a visual approach to runway 29 at Darwin Airport and elected to follow the instrument landing system to the runway. The aircraft was above the glideslope for the majority of its approach and temporarily exceeded the operator's stabilised approach criteria shortly before landing however the approach was continued. The aircraft sustained a hard landing resulting in structural damage.

__________

4. An amount of cloud covering the sky of three or four oktas (eighths).
5. Interaction between flowing air and terrain, in particular irregular terrain and man-made obstacles, causes turbulence known as mechanical turbulence.
6. Oleo strut - a pneumatic air–oil hydraulic shock absorber.
7. G load: the nominal value for acceleration. In flight, g load represent the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value.

Safety analysis

During a check flight of both flight crew members, the aircraft’s approach to runway 35 at Canberra Airport became unstable. The flight crew did not conduct a go-around and the approach continued with an increasing descent rate. The descent rate was not reduced before the aircraft touched down, resulting in a hard landing.

This analysis will examine the reasons for the unstable approach and subsequent hard landing.

Approach and handling

The approach was conducted in conditions of light turbulence leading to minor speed excursions. As the aircraft descended through 265 ft above runway level, the aircraft speed reduced. In response, the PF increased power. Four seconds later, the aircraft encountered a wind change that, in combination with the now higher power setting, increased the airspeed to 127 kt – 4 knots more than the 10 kt limitation stipulated by the operator’s stabilised approach criteria. The airspeed exceedance was not detected by the PF and therefore no corrective action, or initiation of a go‑around, occurred.

While the PF did not identify the stabilised approach criteria exceedance, he assessed the presence of overshoot windshear. In response, he reduced power to flight idle at a height above the runway of 118 ft. The selection of flight idle power was initiated at a point significantly higher than the 20 ft directed by the operator’s procedures. That action was contrary to the operator’s stabilised approach criteria which required a thrust setting appropriate for the aircraft configuration and trajectory. The PM identified the incorrect power setting, but did not detect the further stabilised approach criteria exceedance and did not call for a go‑around at that stage.

The continuation of the approach when a go-around should have been conducted allowed the subsequent conditions to develop, leading to the hard landing.

Pilot monitoring response

After the power was reduced to flight idle, the PM identified that the power was incorrectly set. In an attempt to recover the approach, the PM twice called for an increase in power and then subsequently manually increased power. The first call was acknowledged by the PF, however no corrective action was taken, possibly due to his focus on controlling the aircraft. The second call occurred too late to enable a response from the PF and the physical intervention also occurred too late to alter the aircraft trajectory.

The captain held the first officer in high regard; this may have increased the captain’s confidence the first officer would recover the undesirable aircraft state. The captain also reported that during check flights, he had a tendency to modify his behaviours and allow first officers more margin than normal when correcting deviations in the operation of the aircraft in order to prevent any adverse impact on the check flight assessment of the first officer. These factors may have delayed or reduced the intervention by the captain.

Orasanu (2010) outlines that analytical decision making is difficult if not impossible in high-risk environments (such as aviation) where there is limited time and information and where conditions change unexpectedly.

In this occurrence, the PM needed to make a quick decision on how to recover the approach. Due to the limited time available in the final phase of approach and a perception that the condition of the aircraft would not lead to a significant event, the PM attempted a verbal correction of the aircraft state. The verbal intervention did not result in a correction and the unstable approach continued. Just prior to touchdown, the PM also attempted a physical intervention, but it came too late to prevent the hard landing.

The check captain reported that he recognised the approach was unstable. While the operator’s guidance permitted intervention in some circumstances, the check captain assessed that the approach and landing, while ‘untidy’, would be safe. Additionally, he reported that he did not call for a go‑around as he was not part of the operating crew and had assessed that a call from the rear of the cockpit may have distracted the flight crew in the critical phase of flight.

Wind change

Four seconds prior to touchdown, the aircraft was descending at a rate of 784 ft/min, already greater than the design limit of the undercarriage. At that time, the aircraft was subjected to a change in wind from a 10 kt headwind component to a 2 kt tailwind component. This resulted in a further reduction in lift produced by the aircraft and at this time, the captain felt the aircraft ‘drop out from under him’.

The already high descent rate of 784 ft/min, combined with the wind change, led to the aircraft reaching a recorded 928 feet per minute at touchdown, resulting in the 2.97 G hard landing and substantial damage to the aircraft.

Findings

From the evidence available, the following findings are made with respect to the hard landing involving ATR 72, VH-FVZ at Canberra Airport, Australian Capital Territory on 19 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During the approach, the pilot flying did not identify that the speed had exceeded the stabilised approach criteria, which required immediate correction or initiation of a go-around.
• In response to an assessment of overshoot shear, the pilot flying reduced power to idle at a height greater than that stipulated by operator procedures. This resulted in an abnormally high descent rate that was not reduced prior to touchdown.
• A significant change in the wind direction and strength immediately before the aircraft touched down further increased the aircraft's descent rate and contributed to the resultant damage.
• Verbal and physical intervention by the pilot monitoring did not prevent the hard landing.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence

Training and guidance

The operator, Virgin Australia Airlines, has amended ATR 72 operational documentation to strengthen guidance on the effects of sustained low power settings during approach and landing and the importance of avoiding that situation.

The operator has also reinforced existing training regarding speed management during approach and landing.

Operational monitoring

The operator has added additional criteria to its operational monitoring program to detect low power settings at low heights during normal operations.

General details

Captain details

First officer details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Operator
• Aircraft crew
• Canberra Airport
• Bureau of Meteorology
• Airservices Australia.

References

Federal Aviation Administration of The United States 2016, Airplane Flying Handbook.

Orasanu, J. (2010). Flight Crew Decision-Making. In B. G. Kanki, R. L. Helmreich, & J. Anca (Eds.), Crew Resource Management, (pp. 147-179).

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the operator, flight crew, aircraft manufacturer and French Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) and the Civil Aviation Safety Authority (CASA).

Submissions were received from the operator, flight crew, aircraft manufacturer, BEA and CASA. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 7 November 2017, a chief flying instructor (CFI) and pilot under instruction (PUI) were flying a Eurocopter AS350BA Squirrel, registered VH-BAA. They were conducting practice emergencies under visual flight rules at Hobart Airport, Tasmania. During hydraulic system failure practice, control of the helicopter was lost and the aircraft collided with terrain. The CFI was fatally injured and the PUI was seriously injured.

What the ATSB found

Flight manual emergency procedures stipulate that in order to maintain control following a hydraulic system failure (or simulated failure), a shallow approach should be made into wind and the helicopter should not enter a hover. On this occasion, the aircraft approached crosswind and came to a high hover without hydraulic assistance. Consequently, the helicopter was rendered uncontrollable. A delay in restoration of the hydraulic system prevented the crew from regaining control before collision with terrain.

The ATSB also identified that:

• An intermittent fault in the hydraulic cut-off switch may have delayed restoration of flight control hydraulic pressure.
• A pre‑flight brief was not conducted between the CFI and PUI which may have led to confusion over aircraft control and delayed restoration of the hydraulic system.

Due to a lack of available information, the influence, if any, of these two factors on the accident sequence could not be determined.

What's been done as a result

Following this accident, the operator:

• employed a trained and regulator-approved safety manager
• updated the training school operations manual with stricter controls on performing AS350 sequences as per the flight manual requirements
• installed an electronic system for tracking competencies and currencies.

The operator has also separated key roles of chief executive officer, chief flight instructor and the head of flight operations, which were previously conducted solely by the chief flight instructor.

Safety message

Compliance with the AS350 flight manual requirements following a real or simulated hydraulic failure ensures that the helicopter remains controllable during all phases of flight.

As this, and many other similar accidents illustrate, hovering an AS350 without hydraulic assistance can lead to a rapid, catastrophic loss of control even for highly experienced pilots. The Royal Australian Air Force found in evaluation of the AS350, while hovering without hydraulics, that the AS350 is subject to random perturbations, and reduction in control authority. Additionally the AS350 flight manual notes that without hydraulics the helicopter is subject to rapid changes in control direction and force.

In a training context, the rapid development of this accident, reinforces the need for a clear understanding and coordination between instructor and student when conducting hazardous activities such as simulated system failures.

Summary video

The occurrence

What happened

On 6 November 2017, a commercial helicopter pilot commenced a 2‑day AS350 helicopter endorsement as a pilot under instruction (PUI). The first day was spent with an instructor covering aircraft systems, and pre‑flight inspection. The PUI and instructor also conducted a 1.1-hour flight that afternoon covering the initial flying components of the endorsement.

On 7 November 2017, the PUI studied the aircraft’s electrical system, and theory on handling of in-flight emergencies, including hydraulic system emergencies, with the same instructor. Following the classroom session, the PUI conducted an inspection of the aircraft under the supervision of the instructor.

Flight records showed that at 1002 Eastern Daylight‑saving Time,^[1] the PUI and instructor commenced a training flight of 1.2 hours covering pinnacle approaches and confined areas, followed by run-on landings.^[2] The PUI’s next planned flight was with the chief flying instructor (CFI) at 1500 for the conduct of emergency sequences. The CFI was unable to depart at the pre‑arranged time as he was attending to business matters. The PUI reported that he also took the opportunity to catch up on his own business needs during the delay. The actual takeoff was delayed by 1 hour and 22 minutes.

The instructor advised the ATSB that, prior to the accident flight, the CFI conducted a brief handover with him to ascertain the standard of the PUI’s flying and the sequences briefed. At the aircraft, the PUI explained his requirement for a low-level approval and type endorsement with the CFI however, no pre‑flight brief was conducted.

The PUI and CFI boarded the aircraft and began the flight at 1622. Pre-flight checks included testing of the hydraulic system and switches with no apparent faults identified. The PUI recalled that following the low-level phase of the training flight, the CFI demonstrated some upper air emergencies and had the PUI perform them. After satisfactory completion, they flew back to Hobart Airport for a continuation of practice emergencies.

The PUI recalled that upon joining the circuit at left base for approach to area X-Ray parallel to runway 12 (Figure 1),^[3] the CFI announced a simulated hydraulic failure and activated the hydraulic test (HYD TEST) switch. As expected, a warning light and horn sounded. The PUI slowed from 90 kt to below 60 kt, consistent with the flight manual profile for hydraulic failure (see the sections titled Hydraulic failure training and Hydraulic system). The PUI then activated the hydraulic cut-off (HYD CUTOFF) switch. Following that, it is highly likely that the HYD TEST switch was released, though it is not known specifically when that occurred.

The PUI was to fly a run-on landing at around 10 kt without hydraulic assistance as per the requirements of the flight manual procedure. The PUI said he was comfortable to do so knowing the CFI was there to step in if anything were to go wrong. The PUI had very little further recollection, beyond the initiation of the event.

Table 1 and Figure 1 show the progression of the helicopter through the accident sequence. Paths, angles and rates are inferred from CCTV footage, air traffic control (ATC) data, and airport photographs. Due to limitations in the data available, these are approximate values only.

Table 1: Accident sequence from CCTV

Figure 1: Approximate path of VH-BAA

Source: Hobart Airport, annotated by the ATSB

At the end of the observed flightpath, the front left side of the cabin impacted the ground first. The CFI, seated on the left, was fatally injured, and the PUI in the right seat was seriously injured. The helicopter was destroyed.

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. Run-on landing: Touching down with forward speed with the skids aligned with the direction of travel of the helicopter, and slowing to a full stop while maintaining constant contact with the ground.
3. Runway number: the number represents the magnetic heading of the runway in ten degree increments.

Context

Personnel

Chief flight instructor

The chief flight instructor (CFI) had 30 years of experience flying helicopters and had accumulated 14,200 hours of aeronautical experience. His time on type for the AS350 was over 1,000 hours. He held an Air Transport Pilot License (Helicopter) and an authority to examine pilots for issuance of licences and endorsements. He had accumulated 45.3 hours flight in the previous 28 days.

The CFI was medically fit, qualified for the flight, and had demonstrated proficiency through flight checks in:

• Flight instruction on 3 August 2017
• Single Engine Helicopters on 30 June 2016
• Low level flight on 31 March 2016.

Instructor

The instructor was an experienced helicopter pilot with 4,000 hours’ total aeronautical experience and 1,000 hours of AS350 experience. He had previously flown with the pilot under instruction (PUI) while working for a different operator. The PUI sought out this instructor to conduct his endorsement.

Pilot under instruction

The PUI was a commercial helicopter pilot with over 1,200 hours of rotary wing experience and he was medically fit for the flight. The PUI was also managing director of a local helicopter company. The endorsement was associated with the company’s introduction of AS350 helicopters to their fleet.

Organisational and management information

The operator had been in business for 26 years and established in Tasmania at Hobart International Airport for 17 years. They specialised in charter, aerial work, and flight training operations.

The CFI was also the owner of the business, head of flight operations, chief executive officer, and undertook operational flying.

Flight endorsement training

General information

The Civil Aviation Safety Authority, through Civil Aviation Advisory Publication 5.14‑2(0) Flight Instructor Training (Aeroplane), established the need for two briefings prior to flight: a classroom brief and a pre-flight brief. These two forms of briefing prepare students for learning and performing complex sequences. A long brief in the classroom links theoretical knowledge of emergencies to practical application of those principals in the aircraft. The pre-flight brief establishes procedures and management of the aircraft between the crew. This format was not applied for the accident flight. The first instructor conducted the classroom brief, but there was no pre-flight brief between the CFI and PUI.

Hydraulic failure training

Training for loss of hydraulics in the AS350 required adherence to instructions in two rotorcraft flight manual (RFM) sections: Supplement 7 for the training procedure itself, and Section 3 for emergency procedures for management of the aircraft without hydraulics.

Supplement 7 training procedure

Supplement 7 of the AS350 RFM was incorporated in 2003; it carried specific instructions for hydraulic failure training. The sequence was divided into two distinct phases, and the hydraulic cut-off (HYD CUTOFF) switch and hydraulic test (HYD TEST) switch would not be engaged at the same time. This prevented depletion of tail rotor hydraulic pressure accumulators (not fitted in VH‑BAA) and ensured only one switch would be required to restore hydraulics at any time. Figure 2 illustrates the two phases of the procedure.

Figure 2: AS350 Rotorcraft flight manual hydraulic failure training procedure

Source: ATSB. Flow chart derived from AS350 Rotorcraft Flight Manual

Incorrect sequence taught during endorsement

The instructor and the PUI advised that the flight school taught a different version of the hydraulic failure training procedure during the endorsement and used it during the accident flight.

The procedure used had the student activate the HYD CUTOFF switch before the HYD TEST switch was released. This was a commonly‑used procedure before the release of Supplement 7. An investigation into a similar accident in Canada (A13Q0021) related that flight instructors found this sequence accurately simulated a hydraulic failure. Figure 3 illustrates the procedure.

Figure 3: Hydraulic failure training procedure as taught

Source: ATSB. Flow chart derived from accounts of procedure used by flight school

VH-BAA was not fitted with a yaw load compensator. Using this procedure on an AS350 equipped with a yaw load compensator will cause total loss of tail rotor control hydraulic assistance.

Section 3 hydraulic failure emergency procedure

For completion of the transition to landing referred to in phase 2, the hydraulic failure emergency procedure from Section 3 of the RFM was to be applied. It stated:

Keep the aircraft to a more or less level attitude. Avoid abrupt manoeuvres.

The RFM also carried the following caution:

DO NOT ATTEMPT TO CARRY OUT HOVER FLIGHT OR ANY LOW SPEED MANEUVER. THE INTENSITY AND DIRECTION OF THE CONTROL FEEDBACK FORCES WILL CHANGE RAPIDLY. THIS WILL RESULT IN EXCESSIVE PILOT WORKLOAD. POOR AIRCRAFT CONTROL. AND POSSBILE LOSS OF CONTROL.

RFM Instructions for approach and landing were:

Over a clear and flat area, make a flat final approach, nose into wind.

Perform a no-hover/slow run-on landing around 10 knots.

Do not hover or taxi without hydraulic pressure assistance.

Helicopter details

General information

The Eurocopter AS350BA,^[4] was manufactured in France in 1987 (serial number 2015). It was first registered in Australia on 4 April 2000 and at the time of the accident, had accumulated 5,612 hours total time in service. It was previously registered as VH-RLU and the registration mark was changed to VH-BAA by its current owner on 20 March 2007.

VH-BAA had seating for a pilot and five passengers and was certified for day and night charter operations under the night visual flight rules. The helicopter was powered by one Turbomeca Arriel 1B turboshaft engine.

A review of Maintenance Release entries for maintenance due, showed that a 6-month inspection was required on 7 October 2017, with an over-run tolerance of 60 hours or 18 days. With the tolerance applied, the maintenance would fall due on 25 October 2017. The maintenance related to periodic greasing of the main rotor blade retaining pins.

At the time of the accident, the maintenance had not been certified on the maintenance release as complete and was overdue. No record was found in the aircraft logbook that the maintenance had been completed. While it is a pilot responsibility to ensure that a flight does not commence unless all maintenance has been completed, it is highly unlikely that the non-lubrication of the main rotor blade pins contributed to the accident.

The operator reported that VH-BAA was on temporary hire for the purposes of the endorsement training. Between 5 November and 7 November, the helicopter was operated for about 2.5 hours in the training role. Neither the initial instructor nor the PUI reported problems with the performance of the helicopter or its operation.

Hydraulic system

The aircraft was equipped with a single hydraulic system, energised by a belt-driven hydraulic pump. The hydraulic pump was regulated to provide a constant pressure of 40 bar to four flight control servo actuators. A red warning light will light at hydraulic system pressures of less than 30 bar.

There were three Dunlop servo actuators for control of the main rotor and one Dunlop servo actuator for control of the tail rotor (Figure 4). With hydraulics operating, the input force required to move the rotor blades, at the cyclic,^[5] is less than or equal to 0.3 kgf. For that cyclic input, at 40 bar, the system provides an output of 183.5 kgf.

Because the aircraft exhibits increasing control loads without hydraulics at high speed, and control may be lost without hydraulics in the hover, back-up accumulators are available in the hydraulic system. These accumulators store hydraulic pressure and deliver it to the servo actuators in the event of a hydraulic failure. The accumulators carry enough stored pressure for the pilot to establish the aircraft at the safety speed from cruise or from a high hover to a landing. A safety speed of 40-60 kt was stipulated in the emergency procedures section of the rotorcraft flight manual (RFM).

Figure 4: AS350 servo locations

Source: Airbus Helicopters

A yaw load compensator was fitted to later iterations of the aircraft in order to overcome excessive forces in yaw control in the absence of hydraulic assistance. VH-BAA was not fitted with a yaw load compensator and did not have an accumulator on the yaw control. In the AS350BA, in the absence of hydraulic assistance, yaw control loads are felt directly and immediately.

Hydraulic system switches

The hydraulic system is managed via two switches. The guarded, console-mounted push-button HYD TEST switch, and the recessed, collective-mounted^[6] HYD CUTOFF switch (Figure 5).

The HYD TEST switch exists to test the accumulators for the main rotor servo actuators before flight. The HYD TEST switch is OFF (out) in normal operation. Pressing the HYD TEST switch to TEST (in) creates a bypass in the hydraulic distribution block, routing pressurised fluid from the pump directly to the reservoir. This leaves the back-up accumulators to supply pressure to the main rotor servo actuators.

The HYD CUTOFF switch is ON (out) in normal operation. Pressing the HYD CUTOFF switch OFF (in) bypasses the servos by connecting the pressure inlet and return outlet in each one. The effect is to depressurise the servos and the back-up accumulators of the main rotor servo actuators. It is used in the event of an in‑flight emergency, once the safety speed of 40-60 kt has been established, to ensure that residual accumulator pressure causes no asymmetry in forces across the flight controls.

In emergency procedure training, the HYD TEST switch is used to induce hydraulic failure in flight and the HYD CUTOFF switch is used to conduct hydraulic off landings. If either switch is in, the system will not provide hydraulic pressure to the controls. As previously detailed in the section titled Hydraulic failure training, they should not be activated together in the AS350BA, so hydraulics can be restored with one switch.

Figure 5: HYD TEST switch and HYD CUTOFF switch locations

Source: Airbus Helicopters

Main rotor system

The AS350 was fitted with a starflex hub (Figure 6). This design replaced hinges with elastomeric (rubber type) bearings. Without hydraulic assistance, the pilot must exert significant effort to push or pull the flight controls to deform the elastomeric bearings, change the pitch of the blades, and control the helicopter.

Figure 6: AS350 main rotor pitch change mechanism

Source: Airbus Helicopters

The RFM states in section 3.2 that the expected control input forces without hydraulic pressure are:

• Left-hand cyclic load 4 to 7 kgf
• Forward cyclic load 2 to 4 kgf
• Collective 20 kgf.

The RFM states in section 7.7 that the maximum forces a pilot should have to exert are:

• Lateral cyclic 15.3 kgf
• Longitudinal cyclic 17.3 kgf
• Collective forces were not stated.

Tail rotor system

The AS350 tail rotor is built on one continuous composite spar (Figure 7). Without hydraulic assistance, the pilot must push the pedals and twist the spar to change the pitch of the tail rotor blades. While helicopter weight and speed affect pedal force, the Royal Australian Air Force (RAAF) Aircraft Research and Development Unit (ARDU) (see section titled Research) found that a tail rotor pitch change requires a force of up to 50 kgf. Airbus Helicopters advised they were able to demonstrate significantly lower required forces in flight tests while observing flight manual limitations.

Figure 7: AS350 Tail rotor

Source: Airbus Helicopters

Automatic pilot

The aircraft was fitted with a two-axis automatic pilot system. The installation included two servos in line with the cyclic control’s pitch and roll control rods. The optional collective-to-yaw linkage, that can accompany this equipment, was not a part of this installation. The automatic pilot system was not a component of the endorsement, nor was it used during the endorsement. When the automatic pilot is disengaged, the servos of the automatic pilot system act in the same way as a push/pull rod. There was no evidence to indicate that the automatic pilot system was a factor in the occurrence.

Site and wreckage inspection

Aerodrome information

Hobart Airport is on the south-east coast of Tasmania and has a single north‑west/south‑east runway (Figure 8). Helicopter training area X-Ray was used on the day of the accident.

Area X-Ray was on the western side of, and 60m outside of, the runway. It was under the control of air traffic control (ATC), who provided clearances for all aircraft movements on and around the airport. A clearance was required for helicopters to overfly active taxiways and cross the runway.

Figure 8: Helicopter training area X-ray at Hobart International Airport

Source: Google earth, annotated by the ATSB

Site inspection

As the accident closed the only runway, Tasmania Police assisted the ATSB by documenting the site prior to the arrival of the on‑site investigators. This allowed the wreckage to be removed, and the airport to be reopened, without jeopardising important physical evidence such as ground contact marks. ATSB investigators examined the wreckage in a secure location nearby.

There was evidence that the engine was running for a period of time after the helicopter impacted with terrain, as indicated by burnt grass in the area of the engine exhaust, though there was no fire on site. Figure 9 shows the aircraft before removal.

Figure 9: Accident site image

Source: Tasmania Police

Survivability

Immediately after the accident, ATC activated the emergency response and closed the runway. The aviation rescue and firefighting services (ARFF) stationed at the airport responded immediately to the event, reaching the accident site in 1 minute 40 seconds. The ARFF recovered the CFI from the left seat and assisted the PUI from the right seat.

Damage was indicative of significant impact on the front left side. The flexible steel legs of the skid gear, four-point harnesses, crash-resistant seats and light alloy frame of the cabin floor, all offer protection to occupants during accidents if the helicopter contacts the ground in a level attitude. The polycarbonate construction of the cabin offers very little protection to occupants if the collision involves contact with the canopy.

Investigation of previous AS350 hydraulic failure accidents identified that on initiation of the loss of control event the aircraft often rolled to the left, and initial impact with ground was on the left-hand side. Consequently, the left seat occupant is likely to experience the highest impact forces during a collision. In this accident, the helicopter impacted the ground nose down while rolling to the left. As a result, there was significant disruption to the survivable space on the left side of the helicopter’s cabin.

Both pilots were wearing seatbelts with upper torso restraints, and the seatbelts and seats held during the accident sequence. This kept the right-seat pilot within a disrupted but liveable space within the cabin, contributing to his survival.

Wreckage inspection

The aircraft was inspected at a facility in Hobart.

Engine controls were found connected and secured with all attaching hardware present. The engine oil system was inspected, the oil filter, chip detector and oil were free from debris and discoloration. Fuel was tested for presence of water with no positive indication. The fuel had a clear appearance, the fuel filter was clean, and the bypass indicator was indicating normal operation.

The main rotor transmission had clean oil, the casing was intact, and the chip detector was free of debris. The tail rotor gearbox rotated freely with no binding, and the chip detector and gearbox oil was free of debris. The oil quantity was at the correct level.

Flight control linkages to the main rotor and tail rotor were connected, and securing hardware was in place. The hose supplying the tail rotor servo with pressure was found fractured; detailed examination concluded that was a result of impact damage.

The hydraulic system lines were mounted and connected correctly, and the hydraulic pump and drive belt were intact. The hydraulic fluid had a clear appearance, and the oil, chip-detector and filter were free of debris.

The back-up accumulators fitted to main rotor servos were checked for nitrogen charge and found to be serviceable. All hydraulic system shutoff valves (main and servo-mounted) were present and in place, with the wiring connected. Servo actuators were securely mounted with all electrical plugs and control rods securely in place.

Hydraulic system configuration

The HYD CUTOFF switch and the HYD TEST switch were found in the correct position for restoration of hydraulic pressure at the time of impact (Figure 10). It is possible that one or both switches moved during the impact sequence. The HYD TEST switch unit was found outside of the aircraft, in the off (normal operation) position.

Figure 10: HYD CUTOFF switch and control console as found

Source: ATSB

No pre-existing defects were identified. All damage noted was consistent with impact forces during the accident sequence.

The following items were collected for further assessment:

• Pilot’s collective lever HYD CUTOFF switch
• HYD TEST switch
• Caution and Warning panel.

Hydraulic cut-off switch examination

The HYD CUTOFF switch is an ‘on condition’^[7] component which is tested during pre-take-off checks, prior to every flight. Neither the initial instructor nor the PUI reported any anomaly with the switch prior to the accident flight.

Laboratory examination and comparative analysis of the HYD CUTOFF switch from VH-BAA was conducted with a new switch. They found that the switch fitted to VH-BAA at the time of the accident was susceptible to intermittent operation. The switch had a level of wear, corrosion, contamination and internal damage (Figure 11). Consequently, the mechanical latching and unlatching which cycled the internal contacts to ON or OFF could stick, and require additional effort to latch or unlatch.

Therefore, it was possible to action the HYD CUTOFF switch without restoring hydraulics, inducing a genuine emergency. The system’s normal 3-second activation period could delay diagnosis of a fault.

Additionally, Part 4.3 of section 7.7 of the RFM describes abnormal operations of the hydraulic system. It discusses the possibility that the switch may fail to dump hydraulic pressure from the accumulators in the event of an emergency.

The HYD CUTOFF switch may not be effective in opening all the electro-valves, and dumping all the pressure in the accumulators simultaneously…if the hydraulic cut-off switch is rendered ineffective due to the loss of electrical power, broken wires, or a faulty switch.

The manual made no comment on the opposite case of the switch failing while restoring hydraulics after hydraulic failure training.

It could not be determined if the intermittent operation was due in part to impact‑induced damage.

Figure 11: Corrosion, contamination, and wear in VH-BAA switch

Source: ATSB

Hydraulic warning system light bulb analysis

When the hydraulic system is inoperative, two incandescent bulbs light the red HYD warning light (Figure 12). Both of these bulbs were inspected for impact damage (Figure 13). The left bulb was intact and the right bulb exhibited pole whip damage (Carver, 1987). The pole whip created a brittle fracture between the terminal and the support post. There was some observed filament sag, which is consistent with an aged bulb exposed to high-impact forces. If the bulbs were illuminated at impact, provided the impact forces were sufficient, it is likely that the filaments would show evidence of stretch-type deformation damage. Therefore, it is considered probable that the HYD warning light was not illuminated at the time of impact.

Figure 12: VH-BAA Warning – Caution – Advisory Panel

Source: ATSB

Figure 13: HYD. Warning Light bulbs

Source: ATSB

Meteorological information

The automated weather information service^[8] for Hobart Airport at the time of the accident on 7 November 2017 recorded the following conditions:

• wind from 200°, minimum 15 kt maximum 25 kt
• visibility greater than 10 km
• cloud scattered^[9] at 5,000 ft.
• temperature 15° C
• barometric pressure (QNH) 1019 hPa.

Recorded information

The aircraft did not carry any recording devices, nor was it required to.

Closed circuit television

Closed circuit television (CCTV) from the regular public transport apron of the Hobart Airport captured VH-BAA during approach, loss of control and impact. Figure 14 shows the point of view from the apron CCTV.

Figure 14: Apron CCTV point of view

Source: Hobart Airport, Google Earth, annotated by the ATSB

Related occurrences

The ATSB reviewed 34 investigations of accidents involving AS350 series helicopter’s hydraulic systems worldwide. Figure 15 collates the data from ten of the accidents that occurred prior to the accident in VH-BAA, involving simulated hydraulic failure during flight training. It indicates that loss of control accidents during training do happen to highly experienced pilots. Refer to Appendix A for a synopsis of the reports and the Transport Safety Board of Canada’s report A05F0025 for a list of AS350 loss of control events.

Figure 15: Overview of related hydraulic failure training accidents.

Source: ATSB

Reports of unmovable controls have been a feature of a number of accidents following commanded/uncommanded hydraulic failures in AS350 helicopters. First-hand accounts relate that, as well as the rapid and intense changes in direction and magnitude of control forces described in the flight manual, the controls can become immobile.

The manufacturer is clear on avoidance of loss of control, yet the concern of unmovable controls, which is still reported in contemporary production models of the AS350 (see AAIB report EW/C2017/05/01 page 5), is not accepted by the manufacturer. Airbus Helicopters contends that pilots are surprised by the forces required and that prevents pilots from applying sufficient force to the flight controls.

Research

AS350BA controllability research and recommendations

In 1997, the RAAF ARDU conducted an evaluation of the handling characteristics of the AS350BA, in flight without hydraulic assistance.

ARDU found lateral forces with a 30 kt wind from 30° to the front right (a 15 kt crosswind component) caused lateral cyclic forces to vary continuously and ‘satisfactory lateral control could not be achieved’.

The forces required at the controls without hydraulics recorded during that evaluation were:

• longitudinal cyclic 14.8 kgf forwards at 1,700 kg all up weight while established in a hover
• lateral cyclic 6.8 kgf with a crosswind component of 15 kt
• collective (lifting) 16.2 kgf at 1,950 kg all up weight into wind at 15 kt.

Furthermore, ARDU found that at low speed with hydraulics out, pedal authority was reduced by up to 27 per cent, and that passage through free play in the pedals was required to effect a change in heading. These conditions made control difficult to retain and harder to recover. Right pedal force of 50 kgf was required to maintain a heading into wind at 15 kt.

The ARDU report concluded that with hydraulics out:

• reduced authority, free play, and excessive control forces in primary flight controls were unacceptable
• controllability below 15 kt airspeed was not reliable, and hover flight could lead to loss of control.

Following the evaluation, ARDU recommended that when conducting hydraulic failure training:

• use only one hydraulic switch at a time to simulate failure of the hydraulic system
• maintain over 15 kt during the run-on landing
• do not use over 30° angle of bank
• conduct run-on landings into wind.
   

4. AS350 Squirrel: The AS350 Squirrel was originally designed and manufactured by Aérospatiale in 1975, which became Eurocopter through merger in 1992. Eurocopter was purchased and became Airbus Helicopters in 2014. At the time of writing, the AS350 was manufactured as the H125.
5. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.
6. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
7. On condition: an on condition item has no designated service or replacement schedule. These items would only be replaced when found to be unserviceable.
8. Aerodrome weather information service (AWIS): actual weather conditions, provided via telephone or radio broadcast, from Bureau of Meteorology (BoM) automatic weather stations, or weather stations approved for that purpose by the BoM.
9. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky.

Safety analysis

Introduction

The pilot under instruction (PUI) was unable to recall the majority of the practice hydraulic failure exercise after the accident. As such, there was no firsthand account of the final stages of the accident flight and the sequence of events was largely assembled from closed circuit television (CCTV) footage and wreckage examination.

This analysis will examine the observed aircraft behaviour associated with the simulated hydraulic system failure, instructor intervention, and crew coordination.

Flight manual requirements

In order to safely conclude a practice hydraulic failure sequence, the rotorcraft flight manual (RFM) requires a flat final approach into wind and a no-hover/slow run‑on landing around 10 kt. This is a compromise to keep the helicopter in ground effect and avoid hovering while maintaining a manageable run-on landing speed for potentially unprepared surfaces. Additionally, the requirement to conduct the run-on landing into wind provides a level of consistency in the direction of airflow across the main rotor. This simplifies the pilot’s task by minimising changes to direction and magnitude of cyclic input.

Assurance of control does not require restoration of hydraulics if the helicopter is accelerated into forward flight before the aircraft slows too much. The aircraft becomes easier to control as it is accelerated from 10 kt to the RFM safety speed of 40‑60 kt. If restoration of hydraulics fails at the safety speed, the pilot in command has ample controllability to manage the genuine emergency.

Loss of control

Approaching crosswind

While the RFM requires an into wind approach, the sequence in VH-BAA was planned for approach and landing in a right crosswind of 15-25 kt. Crosswind changes the airflow across the main rotor as the aircraft slows and the crosswind becomes the dominant flow. As detailed in the Royal Australian Air Force Aircraft Research and Development Unit (ARDU) research report, this creates unpredictable changes in direction and magnitude of cyclic input, which are more pronounced when the crosswind is variable, as it was on the day. This significantly increased the pilot’s workload and can render the helicopter uncontrollable.

Analysis of the flight path of VH-BAA from the CCTV footage showed the helicopter to be controlled during the early stages of the approach. As the aircraft slowed, and the crosswind became the dominant airflow the helicopter was observed to drift and vary in pitch and yaw, consistent with the ARDU flight test observations.

Hovering without hydraulic assistance

The PUI recalled feeling a need to prevent the helicopter’s airspeed from decaying late in the approach; CCTV shows he was unable to do so. For a 3-second period, as the helicopter slowed to a hover, there appeared to be no positive control on the aircraft. Despite that, there was no apparent intervention to prevent the helicopter slowing to an out of ground effect (OGE) hover, and the sequence progressed past the boundary of assured control.

The helicopter yawed left, putting the wind behind the helicopter, and facing into an active runway. It is unlikely that this situation was commanded by choice. Instead, it is indicative of the tail rotor returning to a neutral pitch in the absence of hydraulic assistance and reduced, or ineffective, control inputs.

The OGE hover increased the magnitude of control inputs required and induced rapid random changes in intensity and direction of control feedback forces. Due to aerodynamic couplings between controls and lag in control input and response, pilots must anticipate control inputs, and make them before they are required. However, a pilot cannot anticipate the inputs required for an aircraft subject to random perturbations in flight controls.

CCTV showed that after the aircraft came to a hover and yawed left, a positive collective input was made, and the aircraft climbed. It is not known who made that input. Shortly thereafter, control of the aircraft appeared to be lost as it crossed the active runway, with excessive pitch nose down, and left roll developing. Given the nature of the helicopter movement and proximity to the ground, there was little opportunity at that point to restore control.

It is extremely unlikely that the chief flying instructor (CFI) would have entered an active runway without clearance in normal operations. An air traffic controller stated that the CFI had never previously departed area x-ray without announcing his intentions and gaining a clearance. It is therefore virtually certain that entering the runway must have been unavoidable once the aircraft departed controlled flight or considered necessary to regain control of the aircraft.

Deviation from standard operating procedures decrease safety margins and increase opportunity for an accident (Sumwalt and Lemos, 2010). Both the flight manual and the ARDU research paper identified that operating outside of the prescribed procedure would probably result in a loss of control.

Control not restored

Hydraulic system restoration

Light bulb analysis of the hydraulic system fault warning lights indicated that it was probable that the HYD fault light was not illuminated at the time of impact with terrain. Further, both the HYD TEST and the HYD CUTOFF switches were in the normal flight (hydraulic system on) configuration during post-accident examination. While the switch position is less reliable than the light bulb analysis, in combination the ATSB concluded that it was likely that the switches were moved to restore hydraulics prior to impact.

The collective input immediately prior to crossing the runway was 9 seconds prior to collision with terrain. The hydraulic system was likely restored at a point between 9 seconds and 4 seconds before impact. As identified during the investigation of past similar accidents, delays in restoration of the hydraulic system can prevent control recovery.

Restoration of the hydraulic system was potentially delayed due to:

• use of an incorrect hydraulic failure training procedure
• lack of a pre-flight brief to develop common understanding between crew
• a potential intermittent failure of the HYD CUTOFF switch.

The level of contribution, if any, of each factor could not be determined, though each increased risk in the operation.

Incorrect hydraulic failure training procedure

The procedure used to simulate failure of the hydraulic system did not match the requirements of the RFM and overlapped the two phases of the procedure. It released the hydraulic test (HYD TEST) switch after activation of the hydraulic cut-off (HYD CUTOFF) switch. This introduced a hazard into the operation.

Distraction could lead to the HYD TEST switch being forgotten and remaining in. In this configuration, a pilot must activate two switches to restore hydraulics. This would lead to a failure to restore hydraulics when commanded via the HYD CUTOFF switch. Such an event would lead to delayed restoration, due to time taken to diagnose the problem and release the HYD TEST switch. Although as detailed in the section above, it is probable that the HYD TEST switch was released during the occurrence flight, it could not be determined at what point that occurred.

Crew coordination and pre‑flight preparation

Instructing is a complex task and instructors must balance the benefit to the student’s learning and experience with safe margins of operation in a dynamic environment. Instructor intervention is a critical control in flight training. It is often the final opportunity to retain control of the aircraft.

In intervention, an instructor has three time-sensitive options:

• adjust – fix the issue and allow student to continue
• restore – return to normal flight
• complete – take over and complete the sequence.

Intervention is supported by clear assessment, communication, and planning. The PUI received a classroom briefing on emergencies from the original instructor and the CFI received a briefing on the status of the PUI from the same instructor. However, possibly due to the delayed departure, the CFI and PUI did not conduct a pre-flight briefing.

The requirement for a pre-flight brief, especially where non-normal operations are conducted is well-established. Such a briefing reaffirms standard operating procedures, promotes predictable behaviour, and sets expectations among crew (Sumwalt and Lemos, 2010). In this case, the absence of a brief was a missed opportunity to establish correct procedure and generate a common understanding of how the practice emergencies would be conducted.

Once in the aircraft, the CFI advised he would announce practice emergencies and expected the PUI to fly and manage the aircraft. Any unannounced emergencies were to be considered real and the PUI should take immediate essential actions; the CFI would take over if necessary. This is a commonly relied upon arrangement in flight training yet, as an unsafe condition can develop rapidly during the simulation of emergencies, it often requires further definition and understanding between the pilots to be effective.

Additionally, during emergency training, the transition from practice emergency to a genuine emergency is not always clear. Ordinarily available cues for an emergency are defeated, warning lights may already be illuminated, and alarms may or may not sound. The PUI has, by definition, little working knowledge of the aircraft to support diagnosis. Not knowing the aircraft state creates ambiguity, which is known to delay decision-making (Orasanu, and others, 2001).

On this occasion, the absence of a shared mental model of when or how to terminate the sequence may have led to:

• no one controlling the aircraft
• both pilots controlling the aircraft
• a late intervention to prevent hovering
• a delay in restoration of hydraulics.

Due to a lack of available information however, it was not possible to determine to what extent the lack of pre-flight brief contributed to the accident.

Findings

From the evidence available, the following findings are made with respect to the fatal loss of control accident involving Eurocopter AS350BA, registered VH-BAA at Hobart Airport on 7 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The rotorcraft flight manual hydraulic failure emergency procedures were not followed. Specifically, the final approach was flown with a significant right crosswind and the helicopter was allowed to slow to a high hover.
• The hydraulic failure training sequence was allowed to progress to a point where control was no longer assured.
• Hover flight without hydraulic assistance led to loss of control of the aircraft.
• The hydraulic system was restored too late in the sequence to recover control of the aircraft. The reason for late restoration could not be determined.

Other factors that increased risk

• The operator did not follow the hydraulic failure simulation procedure required by the manufacturer. This introduced a hazardous condition with potential to delay restoration of hydraulic assistance.
• The collective mounted hydraulic cut off switch showed signs of excessive wear and intermittent operation. The switch may have required multiple actions to return hydraulic assistance when activated, potentially delaying restoration of the hydraulic system.
• The chief flying instructor and pilot under instruction did not conduct a pre-flight brief, to develop a shared understanding of how the hydraulic failure sequence would be conducted. This may have led to confusion over aircraft control and delayed restoration of the hydraulic system.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft operator
• pilot under instruction
• instructor
• Airservices Australia
• Civil Aviation Safety Authority
• previous accident investigation reports
• ATSB aviation occurrence data
• Airbus Helicopters.

References

Civil Aviation Safety Authority 2012, Civil Aviation Advisory Publication 5.14-2, Flight Instructor Training, on-line, www.casa.gov.au/rules-and-regulations/current-rules/civil-aviation-advisory-publications

Kouabenan, D.R., Ngueutsa, R., Mbaye, S. 2015, Safety climate, perceived risk, and involvement in safety management, Safety Science, 77, 72-29.

Orasanu, J, Martin, L, & Davison, J. (2001). Cognitive and contextual factors in aviation accidents, in E Salas and G Klein (Eds.) Linking expertise and naturalistic decision making, Lawrence Erlbaum Mahwah NJ. 209–226.

Sumwalt, R.L., Lemos, K.A. 2010, The Accident Investigator's Perspective, Crew Resource Management, pp. 399-423.

Weber, E.U., Milliman R.A. 1997, Perceived risk attitudes: Relating risk perception to risky choice, Management Science, 43(2), 123-144.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight-training organisation, pilot under instruction, instructor, Airservices Australia, the Civil Aviation Safety Authority, the Bureau of Meteorology, and the aircraft manufacturer.

Submissions were received from the flight-training organisation, the Civil Aviation Safety Authority, the instructor and the aircraft manufacturer. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A - Synopsis of related occurrences

National Transportation Safety Board (US) LAX92FA025 - 1991

At an airspeed of about 2 knots and a skid height of about 1 foot, the helicopter began an uncommanded turn to the left. The pilot attempted to counter the turn but was unable to move the flight controls. The helicopter's left bank angle, nose down attitude and left turn continued until the main rotor blades struck the ground.

National Transportation Safety Board (US) IAD99GA056 - 1999

The aircraft developed an uncontrollable roll to the left while hovering without hydraulic assistance.

…the helicopter began an uncontrollable roll to the left while at the hover…I tried to level the helicopter by using both hands to attempt to pull the cyclic control to the neutral/level position. The helicopter continued to roll left and subsequently the main rotor blades hit the ground.

Excessive flow rates were detected in all servos and two were rejected in a speed test.

National Transportation Safety Board (US) LAX00LA195 - 2000

The student struggled to control the aircraft towards the end of an approach with hydraulics off. The instructor took over and requested return of hydraulics. The student switched on the hydraulic system. Controls remained stiff and the helicopter impacted terrain.

He reported that just prior to touchdown, the aircraft controls became very stiff. At that point, the flight instructor directed the pilot trainee to re-engage the hydraulics isolation switch on the collective control. The student re-engaged the hydraulics but reported that the controls remained stiff, and he was having difficulty applying forward cyclic. As the instructor got on the controls it started a slow turn to the left. As the instructor attempted to counteract the turn rate increased. The helicopter impacted the ground in a left turn with rear lateral movement.

National Transportation Safety Board (US) ATL02LA097 - 2002

The training and checking captain was unable to control the aircraft while hovering without hydraulic assistance.

The check airman then stated that he would demonstrate the handling characteristics of the helicopter in the hydraulics off configuration. The check airman brought the helicopter to a hover approximately three feet above the ground. At that time the helicopters nose appeared to pitch up dramatically. This attitude was followed by a simultaneous rotation about the yaw axis. As the spin accelerated the check airman instructed the airline transport rated pilot to restore the hydraulics, which was done by depressing the switch on the collective. The rotation of the helicopter continued, and the helicopter impacted the ground coming to rest on the right side of the fuselage.

National Transportation Safety Board (US) ANC02FA029 - 2002

He brought the helicopter to a hover about four feet above the road. According to the pilot, the cyclic was frozen in the full aft left position when he lost control. The helicopter rolled left and struck the ground inverted.

Air Accidents Investigation Branch (UK) EW/C2004/10/05 - 2004

The AAIB found that the instructor did not follow flight manual procedure for hydraulic failure training, leading to the HYD TEST switch being activated at the same time as the HYD CUTOFF switch. The instructor did not attempt to restore hydraulics and was unable to recover the aircraft.

Transportation Safety Board of Canada A05F0025 - 2005

As the pilot gradually descended, and at a height of about 10 feet above ground level, he experienced significant binding in the flight controls. The pilot was unable to rectify the control binding and had considerable difficulty maintaining attitude and altitude control of the helicopter.

It should be noted that the pilot had not received any of the conventional alerts of hydraulic malfunction, such as the klaxon or the warning light.

National Transportation Safety Board (US) LAX07GA217 - 2007

While attempting to regain control at the bottom of a failed hydraulics off approach, the student did not restore hydraulics when requested by the instructor. The student stated that they were told it was dangerous to do so as it could induce over control. The instructor was unable to recover the aircraft.

The CFI [chief flying instructor] noted that the slowest airspeed the helicopter ever reached was a minimum of 8 kts. He added that he was not sure if the cyclic was immobile in any additional direction, aside from the forward-right position, as he did not move it into another direction to prevent possible further loss of control of the helicopter. The CFI estimated that he performs hydraulics-off simulated emergency procedures on a regular basis; he has never experienced any problems or difficulty controlling the helicopter.

A lateral servo was found to be rigged out of limits and mushroom deformation existed on the longitudinal servo.

National Transportation Safety Board (US) LAX08IA042 - 2007

Unlocking pressure on one hydraulic servo was too high and created a control lock. The instructor landed the helicopter by following the emergency procedure from the flight manual.

The CFI immediately noticed that an abnormal force was required on the cyclic control to prevent the helicopter's nose from pitching up and to the left.

The CFI elected to continue the landing with the hydraulics off …. He managed to complete a run-on landing without mishap by maintaining an airspeed of about 10 kts. When the helicopter came to rest, the pressure was released on the cyclic and the second pilot restored the hydraulics via the collective switch. Immediately thereafter, the cyclic began a hard over and displaced to the left against the CFI's leg. He attempted to center the cyclic with both hands, but he was unable to move the control.

National Transportation Safety Board (US) WPR10LA046 - 2009

The student lost control during hydraulic failure training. The instructor’s delayed input and a lack of positive exchange of control contributed to accident.

The instructor told the PUI [pilot under instruction] to turn the hydraulics back on. The helicopter continued in a nose low attitude and in a left bank of about 15-30 degrees. The pilots both stated that they could not move the cyclic in the lateral axis. The helicopter continued the rotation with the nose low attitude until ground impact.

Transportation Safety Board of Canada A13Q0021 - 2013

The TSB found that the instructor did not follow flight manual procedures for flight without hydraulic assistance. The instructor encountered heavy unpredictable control forces and could not recover from a steep left roll.

The flight instructor took off in manual mode and again flew a tight left pattern at low speed and low altitude. At the end of the base leg, at the beginning of the final approach, the helicopter momentarily reached a level attitude. Just before the flight instructor handed the controls to the pilot in training, the helicopter banked slightly to the left and then quickly rolled to the left in a nose-down attitude, and the main rotor struck the runway.

Air Accidents Investigation Branch (UK) EW/C2017/05/01 - 2017

The instructor lost control while flying a tight low-level left-hand circuit without hydraulic assistance and at a high angle of bank.

When interviewed, the instructor stated that he had been unable to move the cyclic control to the right to arrest the roll to the left.

Appendix B

For a full copy of the safety information notice click the hyperlink

Airbus Helicopters Safety Information Notice 3246-S-29 Rev1 2019

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

During the afternoon of 28 October 2017, a Cessna Aircraft Company T310R, registered VH-JMW (JMW) was conducting a return flight from The Lakes airstrip, New South Wales to Toowoomba Airport, Queensland with the pilot and one passenger on board.

On the return flight from Toowoomba, during descent to The Lakes, and while about 8 km from the runway, a witness recalled hearing the sound of what he thought was a single-engine aircraft ‘cough’ and then stop. Shortly afterwards, JMW was seen descending slowly with the landing gear extended. The aircraft then ‘jerked’ suddenly, rolled to the left and descended rapidly to the ground.

The pilot and passenger were fatally injured, and the aircraft was destroyed.

What the ATSB found

The ATSB identified that during the final descent towards The Lakes airstrip runway, the left engine was not producing power and the right engine was operating at low or intermittent power.

Following the loss of engine power a safe flying speed was not maintained resulting in a loss of control and collision with terrain due to either an aerodynamic stall, asymmetric power effects or a combination of both.

The loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Safety message

A loss of power in an aeroplane requires different responses depending on whether the aircraft has single or multiple engines. However, regardless of the configuration, in order to maximise the survivability outcome it is imperative that the pilot retains control of the aircraft and maintains a safe airspeed. Where the aircraft’s performance degrades to the point that continued safe flight is not possible, the pilot must shift focus to conducting a forced landing.

Pilots also need to routinely exercise good fuel-management practices in order to maintain the highest level of safety and avoid fuel exhaustion or starvation events. Civil Aviation Advisory Publication 234-1(2) provides guidance on the current fuel requirements and good fuel-management practices.

The occurrence

What happened

At about 1000 Eastern Daylight-saving Time^[1] on 28 October 2017, a Cessna Aircraft Company^[2] T310R, registered VH-JMW (JMW), departed The Lakes airstrip, New South Wales, for a private flight to Toowoomba Airport, Queensland with the pilot and one passenger on board. The aircraft arrived in Toowoomba at about 1130 and remained on the ground for a few hours.

At about 1437, the pilot and passenger departed for the return flight to The Lakes. The aircraft was not refuelled at Toowoomba and weather forecasts and reports indicated that conditions were suitable for flight under the Visual Flight Rules.^[3] There was a light westerly crosswind at the cruising altitude of 9,500 ft and a light easterly wind at lower altitudes near the destination.

At about 1541, the passenger sent a cheerful text message to a friend, which indicated that all on board the aircraft was normal. A short time later, the pilot began the descent from 9,500 ft and continued tracking towards The Lakes.

At about 1554, a witness located close to JMW’s track heard a low-flying aircraft to the west of his position travelling south (Figure 1, ‘Witness 1’). He described the aircraft as sounding like a single‑engine aircraft and recalled hearing the engine ‘cough’ and then stop as the aircraft flew past him.

Figure 1: Flight path of VH-JMW

Source: Google Earth modified by the ATSB

A minute later, two other witnesses, both driving south along the Pacific Highway, saw JMW to the west of the highway at low altitude (Figure 1, ‘witnesses 2 & 3’). One witness recalled the aircraft was descending slowly at first with the landing gear extended. Soon after, the witness saw the aircraft ‘jerk’ then roll to the left, pitch down and descend rapidly to the ground.

At about 1555, JMW impacted trees and then collided with terrain. The aircraft came to rest in a narrow wooded strip of land between the highway and the main northern railway line (Figure 2). The wreckage was about 800 m (0.4 NM) from The Lakes runway 16 threshold.

One of the witnesses driving on the Pacific Highway was the first to arrive at the accident site. He recalled smelling fuel on arrival, and the ground around the aircraft’s wreckage being wet. He also noticed a momentary wisp of smoke from sparking electrical components behind one of the wings however, there was no fire. Emergency services personnel arrived at the accident site shortly afterwards. A couple of the first responders reported a fuel smell near the aircraft, but others did not recall smelling fuel.

The pilot and the passenger were fatally injured, and the aircraft was destroyed in the accident.

Figure 2: Accident site

Source: ATSB

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. On 29 July 2015, the Type Certificate Holder transferred from the Cessna Aircraft Company to Textron Aviation. All information related to the aircraft manufacturer in this report pre-dates that transfer.
3. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions clear enough to allow the pilot to control and navigate the aircraft visually.

Context

Pilot information

The pilot held a:

• Private Pilot (Aeroplane) Licence issued on 10 October 2000
• current Class 2 aviation medical certificate issued in 2017 without restriction
• Night Visual Flight Rules rating and a Private Instrument Flight Rules rating.^[4]

The pilot had owned a number of single- and multi-engine aircraft and was endorsed for the Cessna 310 in December 2001.

Extracts from the pilot’s logbook showed that he had in excess of 3,200 hours total flying experience on aeroplanes, with more than 300 hours experience on multi-engine aircraft. He last completed a multi-engine flight review with a flight instructor in May 2017. As part of that review, the pilot demonstrated his ability to manage asymmetric power conditions and simulated one‑engine inoperative exercises at various phases of the flight. The instructor recorded the pilot’s response to these exercises as ‘normal’.

Aircraft information

The Cessna Aircraft Company T310R is a low-wing, twin-engine aircraft equipped with retractable landing gear. In 1988, VH-JMW was modified under supplementary type certificates to replace the original Continental IO-520-MB engines with turbocharged engines (TSIO-520-NB) and fit new three-bladed propellers (Figure 3).

Figure 3: VH-JMW – Cessna T310R

Source: Flightaware.com

In December 2016, a periodic inspection was conducted. The maintenance release did not identify any defects. The release was valid for 100 hours or until 14 December 2017. The only scheduled maintenance task carried out during this release period was an engine oil change. Documentation for the aircraft’s prior maintenance history, including fuel gauge calibration, was not available.

At the time of the accident, the aircraft’s optional equipment included:

• a multifunction display
• a digital fuel flow indicator and totaliser (digital fuel system), which had replaced the standard Cessna analogue fuel flow gauge
• an electronic primary navigation display.

Fuel system

The aircraft’s fuel system consisted of two main tanks located on the tip of each wing, two auxiliary tanks and two wing locker tanks. The dual indicating fuel quantity gauge provided a continuous indication of the fuel remaining in the selected tanks based on fuel weight, for both the left and right sides of the aircraft. The aircraft was not equipped with optional low fuel level indicator lights. The total capacity of the main tanks and the auxiliary tanks was 628 L, with 617 L being usable. The total capacity of the wing locker tanks was 155 L with 151 L of usable fuel.

The main tanks were integrally sealed aluminium tanks, which were vented to atmospheric pressure by a flush vent located on the lower aft portion of each main tank. Each auxiliary fuel tank consisted of two interconnected bladder-type fuel cells located between the wing spars in the outboard section of each wing. The wing locker fuel tanks were located in the forward part of each wing locker baggage area and were also bladder-type cells that supplemented the main tank fuel quantity. The wing locker fuel could not be fed directly to the engines; instead, it was transferred to the main tanks by manually‑selected wing locker fuel transfer pumps.

Two fuel selectors, one for each engine, were located on the floor between the pilot and co-pilot seats. The fuel selectors controlled the wing selector valves to enable switching between the main and auxiliary fuel tanks.

The fuel system comprised the following pumps (for each side to the aircraft):

• engine-driven fuel pump (to transfer fuel from the centre sump to the engine)
• auxiliary boost fuel pump (to provide fuel pressure for priming during engine starting, and to supply fuel to the engine in an emergency)
• main fuel tank transfer pump (to transfer fuel from the nose of the main tank to the centre sump and allow steep descent with low fuel quantity)
• wing locker fuel tank transfer pump (to transfer fuel from the wing locker tank to the main tank).

Fuel tank selection

The Cessna T310R Pilot’s Operating Handbook (POH)(Revision 3, 1982) stated:

If auxiliary fuel tanks are to be used, select main fuel for … 90 minutes of flight. This is necessary to provide space in the main tanks for vapour and fuel returned from the engine-driven fuel pumps when operating on auxiliary fuel. If sufficient space is not available in the main tanks for this diverted fuel, the tanks can overflow through the overboard fuel vents.

The POH also stated that in the event of an engine failure, the fuel in the auxiliary tank on the side of the failed engine would become unusable.

The Cessna Aircraft Company’s Pilot Safety and Warning Supplements (1 June 1998) also included this important fuel tank selection sequence. If auxiliary tanks were to be used, this sequence would ensure excess fuel supplied to the engine was collected in the main tanks, and not vented overboard. The incorrect sequence could result in venting fuel, reducing the fuel available to complete the planned flight.

The potential for accidental venting of fuel overboard described above and guidance on correct tank sequence had been widely promulgated for a many years. As such, it was considered unlikely that an experienced pilot would make such an incorrect selection.

Digital fuel system

The aircraft was equipped with a digital fuel system that measured the instantaneous fuel flow to each engine and calculated the aircraft’s endurance based on current fuel flow and the system‑totalised quantity of fuel remaining.

The system did not measure the actual fuel quantity on board the aircraft, instead it relied on a manually entered starting quantity and the system‑calculated quantity of fuel consumed. Additionally, the data presented did not provide the pilot with the quantity of fuel in individual fuel tanks. The pilot had the following manual data entry options:

• input the quantity of fuel added
• update the system’s computation of fuel remaining
• selection of a ‘full’ fuel default.

The ATSB examined the digital fuel system and found that it was correctly configured for the aircraft and operational at the time of the accident. The default ‘full’ value was set to 616 L in the system settings, which closely corresponded with the usable capacity in the main and auxiliary tanks. The system was set to display ‘Lo FUEL’ when the pre-programmed fuel level of 100 L was reached. Once ‘Lo FUEL’ was displayed, the fuel flow information would not display until the pilot acknowledged the warning by pressing ‘enter’.

The system was also configured to display a warning for the flying time remaining (endurance time). When the endurance time reduced below the pre-programmed endurance time of 45 minutes, the data in the right half of the display flashed. This warning required the pilot to acknowledge the warning by pressing ‘enter’.

Operational information

Fuel management

At the time of the accident, the Civil Aviation Advisory Publication, CAAP 234-1(1) Guidelines for Aircraft Fuel Requirements, was in effect.^[5] The CAAP recommended a 45-minute fixed fuel reserve^[6] and that pilots use at least two independent fuel check methods to establish the quantity of fuel.

Fuel quantity

The last known fuel uplift by JMW was recorded on 12 September 2017. The number of flights undertaken between 12 September and the accident flight meant that the aircraft must have been refuelled during that time. However, no records were found to indicate where, when and how much fuel was uplifted. Consequently, it was not possible to determine the fuel quantity on board the aircraft on departure from either The Lakes or Toowoomba.

There was some indication that the pilot considered the runway length at The Lakes was weight limiting on take-off. While this could suggest JMW did not depart from there with full fuel, that could not be verified. The aircraft was not refuelled in Toowoomba prior to the return flight.

The ATSB found the refuelling facility at The Lakes airstrip had appropriate maintenance placards affixed to the bowser indicating that it was in use. The facility’s fuel tank was about one‑third full, and a test of the fuel indicated no fuel quality issues. The facility was not required keep fuel records.

The supplemental type certificate for JMW under which the turbocharged engines were installed did not provide revised fuel consumption rates. No other documents, such as pilot calculations for the aircraft’s fuel consumption or similar records, were found. In the absence of that information, the ATSB used the fuel consumption rates of a Cessna aircraft (of similar size to JMW and fitted with the same engines) to estimate fuel consumption for the accident flight. This calculation indicated that fuel consumption for the round trip from The Lakes to Toowoomba would be in the order of 425 L.

The on-board digital fuel system recorded a consumption of 563 L (based on the pilot’s last entry and system calculations) and displayed 53 L remaining. If the starting fuel quantity was accurate, there should have been 53 L (616 – 563 L) of usable fuel based on calculations remaining at the time of the accident. However, this could not be verified by independent calculations or physical evidence.

Asymmetric operations

The Cessna 310 has two wing-mounted engines that produce symmetrical propeller thrust during normal operation. When one engine is inoperative, the resulting asymmetric forces will cause the aircraft to yaw in the direction of the inoperative engine, which can be countered through the application of rudder and aileron control inputs. The minimum control speed (V_mca^[7]) of 84 KIAS^[8] must be maintained to ensure that the rudder and aileron retain sufficient control authority to maintain directional control of the aircraft. The value of the minimum control speed will vary from the published value with engine power level on the operable engine and aircraft configuration. With the operable engine at low power, the minimum control speed will reduce to a value close to the stall speed.

The intentional one engine inoperative section of the Cessna T310R POH stated that while the aircraft is controllable at V_mca, the performance is so far below optimum that continued flight near the ground is improbable. Therefore, the handbook recommended that a more suitable safe single-engine speed was 92 KIAS. At this speed, altitude could be maintained more easily while the landing gear is being retracted and the propeller is being feathered.^[9]

A single inoperative engine on a twin-engine aircraft may not always result in controllability issues that are immediately obvious to the pilot. This point was highlighted in the United States Federal Aviation Administration (FAA) Airplane Flying Handbook:

An engine failure in a descent or other low power setting can be deceiving. The dramatic yaw and performance loss will be absent. At very low power settings, the pilot may not even be aware of a failure.

Aircraft handling following engine failure

The Cessna 310 POH stated that, following an engine failure, the pilot’s first consideration is to maintain control of the aircraft and ensure the airspeed remains above the minimum control speed. It then stated that the pilot needed to identify the inoperative engine, adjust the operative engine as required, and perform a number of checks relating to fuel flow, tank selection and quantity; engine oil pressure and temperatures; magneto switches and mixture. If the engine could not be re-started, the pilot must ‘secure’ or shutdown the engine, which includes feathering the propeller.

The FAA Airplane Flying Handbook provides further practical guidance for managing such a situation. Importantly, the handbook stated that completely securing a failed engine may not be necessary or even desirable depending upon the failure mode, altitude, and time available.

It is recognised that if both engines lose power, the best gliding range will be achieved when the aircraft is flown at the optimum gliding speed and configured for the minimum aerodynamic drag. Guidance for configuring an aircraft following engine failure is provided in the Multi-Engine Pilot Manual by Jeppesen Sanderson (1992):

It is important that the pilot be familiar with the correct order for drag reduction following an engine failure. Normally, a windmilling propeller contributes the greatest amount of drag, followed by full flaps, extended landing gear, and the control deflections required to stop the airplane from turning. Since it is considered unwise to immediately feather an engine before it has been positively identified, drag is normally reduced by first retracting flaps and gear. Next, the failed engine is identified and the propeller is feathered. However, the specific order of drag reduction may vary between types of twin‑engine airplanes, so the manufacturer’s recommendations should be followed.

Based on the estimated weight of JMW, its best glide speed was about 102 KIAS at a glide angle of 4°. Any variation from that target airspeed would have reduced the gliding range. Shortly before the collision, the aircraft’s airspeed was about 67 kt, 35 kt less than the best glide speed.

Aircraft performance degradation

In relation to a previous Cessna 310 accident, the aircraft manufacturer provided information that an unmodified Cessna 310 at maximum landing weight has a single-engine climb rate of about 375 feet per minute at sea level. However, the drag penalties of an unfeathered windmilling^[10] propeller, extended landing gear and full flap significantly degrade single-engine climb performance. Under these conditions with one engine inoperative, a penalty to the climb rate of about 850 feet per minute could be expected.

In comparison to standard engines for its aircraft type, JMW’s engines were higher performing. At the time of the accident, JMW had its landing gear extended, propellers unfeathered and flaps at 15° (see the section titled Aircraft configuration). In this configuration, the aircraft descended about 1,100 ft during the last minute of its flight (see the section titled Recorded data).

Recorded data

The aircraft was fitted with an electronic primary navigation display. The recorded data on the navigation system included aircraft pitch, roll and ground speed.

ATSB analysis of the recorded data (partly illustrated in Figure 4) determined that:

• About 140 seconds before the collision, the aircraft rolled to the left and then to the right. The aircraft was travelling at about 150 kt at an altitude of 1,600 ft and was approximately 4.5 NM from the The Lakes runway threshold. There was a corresponding heading change to the left of approximately 4° followed by a change to the right of approximately 6°. This sequence could be consistent with asymmetric forces on the aircraft due to the loss of left engine power or a course correction onto the final approach path.
• Shortly after, the speed of the aircraft decreased below the maximum flap extension speed (158 KIAS) and the maximum landing gear extension speed (138 KIAS) indicating the pilot did not configure the aircraft into its final configuration until the last 100 seconds of the flight.
• From about 1554 (60 seconds before control of the aircraft was lost) the pitch of the aircraft trends upwards from -5° (nose down) to a maximum of 6.5° nose up just before the loss of control.
• Just after 1554, the aircraft’s altitude was about 1,100 ft^[11] (last known altitude). The aircraft was approximately 2 NM from the runway threshold.
• About 30 seconds before the collision and again about 10 seconds before the collision, the aircraft rolled to the left and pitched down with a heading change to the left (Figure 4). This sequence was consistent with asymmetric forces on the aircraft due to the loss of left engine power.
• Over the last 30 seconds of the flight, the rate of speed decay increased with the aircraft’s speed reducing to below the published (and likely actual) V_mca, and into the stall speed range (68–74 kt).^[12] Constant variations in pitch and roll were evident throughout this stage of the flight, with a continual upward trend in pitch (Figure 4).
• Just before 1555, the aircraft’s speed decayed to 67 kt^[13] (ground speed). The nose continued to pitch up, attaining a maximum pitch of about 6.5 degrees. Shortly after, the left wing dropped and the nose pitched towards the ground.

Figure 4: Last 280 seconds of recorded flight data

Source: ATSB

Wreckage and impact information

The ATSB’s examination of the accident site confirmed that the aircraft was in a left-wing, nose‑down attitude when it collided with terrain. It came to rest between a railway line and the Pacific Highway in a thicket of gumtrees and coastal scrub. The distribution of the wreckage and the damage to the trees indicated that the aircraft had little forward momentum on impact (Figure 2). The impact forces from the collision destroyed the aircraft.

Aircraft structure

All of the aircraft structure was identified at the accident site. There was no evidence of inflight break-up or post-impact fire. Continuity of the flight control cables and aircraft control surfaces were confirmed as secure or fractured due to overstress, consistent with the ground collision.

There were no pre-existing mechanical defects identified during the examination that would have prevented normal operation of the aircraft. However, there was severe disruption to the aircraft pitot tubes, seats and fuel selector system, making it impossible to determine their serviceability.

The aircraft’s occupant restraint system had been in use during the flight and was working normally.

Aircraft configuration

The wreckage examination showed that the aircraft was configured with the landing gear down and locked, and the flaps extended to 15°. Both the left and right engine propellers were towards the fine pitch, and not feathered.

The position of the flight controls, engine controls and fuel tank selectors immediately prior to the loss of control could not be determined due to the severe disruption of the cockpit and fuselage.

Engines

Continuity of the right engine propeller pitch control was established by visual inspection. The left engine propeller pitch control cable had separated at the governor connecting rod, consistent with overstress failure from impact forces.

The left propeller blades showed no evidence of bending, twisting or chord-wise (that is, across the width of the blade) scratching. This indicated that the left engine was not producing power on impact. On the other hand, one blade of the right propeller showed evidence of forward compound bending, and chord-wise scratching across its face. The spinner and propeller hub were partially buried in the ground with evidence of corkscrewing of the propeller pressure dome cover attached to the spinner. The propeller hub fractured at the crankshaft. Examination of the fracture surface showed that dominant failure load was bending, consistent with no significant power on the right engine at the time of impact with terrain.

An external visual inspection of the left and right engine and engine controls did not identify any pre-existing damage or defects. All of the damage identified (including to the left engine fuel pump and oil sump) was consistent with impact damage from the collision.

The cylinders, sparkplugs, crankcase and external accessories were confirmed secure on both the left and right engine. All of the fuel supply and return lines between the engine firewall and the engine were disconnected and inspected. Negligible fuel was found in the lines (they should contain fuel under normal operating conditions). No blockages in the lines that would have prevented fuel reaching either engine were found.

The left engine oil sump was breached during the impact and a quantity of oil had leaked out and been absorbed in the soil. However, the oil cap was secure and some oil was noted on the graduated dipstick. Oil was also identified in the right engine.

The spark plugs, fuel pump, vacuum pump and all cylinder rocker covers on both engines were removed and inspected. Rotation of the crankshaft on each engine demonstrated continuity of the major engine components. During rotation, the pistons, cylinder rocker arms, vacuum pump drive, fuel pump drive and magneto gears were found to move through their normal range. An endoscope was used to determine that the pistons, valves and cylinders were in normal operational condition.

The left and right engine turbo charger inlet and outlet impellors were inspected and nil damage identified. The absence of damage provided inconclusive evidence to indicate whether the turbo chargers were powered at the time of impact.

There was no evidence found during examination of the engines to indicate that either engine was incapable of normal operation.

The fuel system

Both the left and right main fuel tanks separated from the wings following overstress failure at the spar attachments, and were found between 5 and 10 m from the main wreckage. Impact forces from the accident breached both the tanks, but their fuel caps were found in place and secured.

The left and right auxiliary fuel tanks were holed and crushed during the accident. There was some evidence of discolouration under the left wing resulting from fuel weeping from the left auxiliary tank. This weep was assessed as minor and therefore considered to have had a negligible impact on the usable fuel quantity.

The left- and right-wing locker tanks were intact but the interconnecting pipes had fractured during the accident. There was no evidence of fuel in either tank.

There was no fuel-fed post-impact fire or evidence of fuel tank deformation resulting from a large quantity of fuel impacting the internal walls of the fuel tank during the accident. While the first persons to arrive at the accident site reported smelling fuel, others who arrived shortly afterwards did not smell fuel. This could be indicative of the smell of fuel vapour from ruptured tanks, which then dissipated. Further, ATSB investigators found a negligible quantity of fuel in any of the tanks or around the wreckage. They also observed no dieback of vegetation at the accident site in the days following the accident that is typical of a fuel spill.

The main fuel tank transfer pumps were tested and found to be operational; therefore, even with the aircraft in a steep descent all of the usable fuel in the main fuel tank was available for use. The left engine fuel pump could not be tested due to severe impact damage, while the right engine fuel pump was not tested as it was evident that the right engine was producing some power at the time of the collision. A small amount of fuel was found in each of the fuel distributors, indicating that both of the engine fuel pumps were operational prior to the accident. The small quantity of fuel may have been due to a low fuel volume in the tanks.

Related occurrences

The ATSB research report, Power loss related accidents involving twin-engine aircraft (Research and analysis report B2005/0085), found that:

• Power loss accident rates in twin-engine aircraft were almost half that for single-engine aircraft.^[14] However, a power loss accident in a twin-engine aircraft was more likely to be fatal and overwhelmingly the result of in-flight loss of control.
• Of the 58 accidents identified between 1993 and 2002 that resulted in damage following the power loss, seven occurred during the approach phase of flight. Three of these involved a loss of control, including one fatal accident. When compared to the take-off phase, the approach phase is considered to be equally risky, with low altitude and only a little more energy available than during the take-off phase.
• Just over one-third of power loss accidents in twin-engine aircraft occurred during a non‑asymmetric power loss. The majority of these were related to fuel management, and no benefit was derived from the presence of a second engine.

Another ATSB research report, Starved and Exhausted: Fuel management aviation accidents (AR-2011-112) summarised key occurrences related to fuel management and outlined procedures pilots can use before and during the flight to ensure they land with reserve fuel intact.

This report includes the following key safety messages.

• Accurate fuel management starts with knowing exactly how much fuel is being carried at the commencement of a flight. If the tanks are not filled to a known setting, then a different approach is needed to determine an accurate quantity of usable fuel.
• Keeping fuel supplied to the engines during flight relies on the pilot’s knowledge of the aircraft’s fuel supply system and being familiar and proficient in its use. Adhering to procedures, maintaining a record of the fuel selections during flight, and ensuring the appropriate tank selections are made before descending towards your destination will lessen the likelihood of fuel starvation at what may be a critical stage of the flight.

__________

4. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than flights conducted using the visual flight rules (VFR). Procedures and training are more complex as a pilot must demonstrate competency in IMC conditions while controlling and navigating the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
5. In November 2018, CASA 29/18 – Civil Aviation Fuel Requirement Instrument was released which re-introduced a fixed fuel reserve requirement (30 minutes for daytime VFR pilots) and required pilots to conduct in-flight fuel management with regular fuel quantity checks, and, if required, declare MAYDAY fuel. At the same time, the advisory publication was updated to include the new requirements.
6. For visual flight rules flights in an aircraft with piston engines.
7. V_mca is defined as the indicated airspeed at which it is possible to maintain control of the aeroplane when the critical engine is suddenly made inoperative, and thereafter to maintain straight and level flight at the same speed with an angle of bank of not more than 5° towards the operative engine.
8. Minimum control speed taken from STC.
9. Rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.
10. Windmilling: a rotating propeller being driven by the airflow rather than by engine power; this results in increased drag at normal propeller blade angles.
11. The aircraft’s altitude was sourced from the flightradar24 website.
12. A range for the stall speed has been specified because the stall speed will vary with a number of parameters including weight, which was unknown at the time of the accident. The range has been estimated assuming the aircraft was lightly loaded and had less than 20 degrees angle of bank.
13. The aircraft’s system recorded ground speed of the aircraft. The weather reports for the area around the time of the accident indicate that the winds were light and therefore the groundspeed closely represents what the indicated airspeed would have been.
14. Only aircraft below 5,700 kg maximum take-off weight were included in the analysis.

Safety analysis

Physical evidence at the accident site allowed the ATSB to establish, that VH-JMW (JMW) was operating in a low engine power state when it collided with terrain. Similarly, recorded flight data and witness reports enabled analysis of the sequence of the aircraft’s loss of control in the lead up to the collision. The following analysis details the factors that contributed to the development of the accident.

Engine power loss

Examination of the wreckage identified that the aircraft was configured for a powered approach, in a high‑drag configuration - left and right engine propellers unfeathered, landing gear down and the flaps partially extended. Based on the recorded data, the landing gear and flaps were extended within the last 100 seconds of the flight and the airspeed reduced significantly over the same time period. Maintenance of a high‑drag configuration while the aircraft’s performance declined indicated that either the pilot did not recognise any engine abnormalities until late in the approach, or he assessed that sufficient engine power remained to reach the runway.

The nature, type and extent of damage to the propellers (bending, twisting and scratching to each), and examination of the fractured right propeller flange showed that, at the time of collision:

• the left engine was not producing power
• the right engine was not producing significant power.

No evidence was found to indicate a mechanical defect that would have prevented either engine from developing full power.

The ATSB considered whether the assessed low engine power levels at the time of the collision also existed immediately before the loss of control. While it is possible that the pilot may have reduced the engine power in the final moments, given the significant recorded decline in aircraft performance over the last two minutes of the flight, the low power state probably existed immediately prior to the accident. Distortion of the engine controls during the collision prevented identification of the selected power setting.

The positive nature of the text message sent about 14 minutes before the collision, indicated that the aircraft was performing as expected at that point in the flight. However, about 2 minutes and 20 seconds before the collision, at an altitude of 1,600 ft, the recorded data showed a large deviation in the aircraft roll and heading. Those deviations were consistent with a left engine power loss. Control of the aircraft’s pitch, roll, heading and speed declined from this point on (Figure 4).

In the last minute of flight, JMW’s descent rate was higher than expected for the aircraft type when operating on one engine in a high drag configuration. That indicated that the operative right engine was likely producing reduced power. Based on witness observations, it is possible that the right engine had intermittent power rather than a consistently low output.

In summary, the ATSB assessed that, shortly before the collision, the left engine had stopped producing power and the right engine was operating at low or intermittent power.

Loss of control

From the available evidence, it could not be determined when the pilot became aware of the left engine power loss. Consistent with the guidance in the United States Federal Aviation Administration Airplane Flying Handbook, it is possible that the power loss may not have been obvious as the aircraft was descending. Similarly, apart from extension of the landing gear and flap, it was impossible to determine the pilot’s response to the power loss and his subsequent actions. However, it is relevant to note that he had started an apparently normal descent minutes earlier (soon after 1541). He was also flying over thickly‑wooded terrain, and was very close to the destination before control was lost.

Recorded data enabled the loss of control to be better explained (Figure 4). The low engine power combined with the high-drag configuration meant that the aircraft’s speed and altitude could not be maintained. This in turn led to the airspeed declining to below the published V_mca and into the stall speed range. As the right engine was likely not operating at full power, the actual V_mca was less than the published figure and likely in the region of the aircraft’s stall speed. As the speed continued to decline, the nose was progressively pitched up to about 6.5°. The left wing and nose then dropped towards the ground resulting in a collision with terrain. That flight behaviour with the airspeed in the region of both the stall speed and V_mca, indicated a loss of control due to either a low-speed stall, asymmetric effects or a combination of both.

Fuel-related factors

There was no evidence of a mechanical defect to explain the apparent engine power losses. However, the absence of fuel in the supply and return lines indicated that sufficient fuel was not reaching either engine at the time of the collision. This, and other fuel-related evidence, resulted in the ATSB exploring potential fuel starvation and exhaustion scenarios, and related factors.

As no fuel uplift occurred in Toowoomba before the accident flight, JMW departed The Lakes with a fuel quantity that the pilot considered sufficient for the return flight. However, with no fuel records or other evidence available, that quantity could not be determined. It is possible that there was sufficient fuel for the return flight as anticipated by the pilot and the wreckage examination did not identify any pre-existing fuel tank leaks that could have affected the storage capacity.

After the aircraft began its descent to The Lakes, recorded roll and heading deviations indicated that the left engine lost power first due to insufficient fuel supply. The right engine’s loss of power, some time later, was consistent with the expected slight variation in fuel consumption and tank fuel quantities between the left and right systems.

The on-board digital fuel flow indicator and totaliser indicated there were 53 L of usable fuel in the tanks at the time of the collision. However, this was not a measured quantity but a system‑calculated figure based on consumption, and relied on an accurate starting quantity. While the system was correctly set up, the ATSB could not verify this figure because there were no fuel records or fuel consumption rates. The absence of fuel damage to vegetation at the accident site, no post-impact fire and no strong, persistent fuel smell, supported a conclusion of minimal fuel on board. The ruptured fuel tanks made it impossible to determine (or estimate) the fuel quantity that they had contained.

The investigation considered the possibility of inadvertent venting of fuel overboard due to the incorrect sequence of selecting fuel tanks (auxiliary before main tanks). However, given the pilot’s significant experience and familiarity with the aircraft type, and the well-known tank selection sequence, it is unlikely that he would have made such an error.

The investigation also considered a scenario where the pilot attempted using all usable fuel in the auxiliary tanks before switching the fuel selector to main tanks for landing (to avoid having unusable fuel in the auxiliary tanks in the event of an engine failure on approach). Mis‑timing the switchover could interrupt the fuel supply if the auxiliary tanks were exhausted. This would introduce air into the fuel lines, and manifest as struggling engines, such as observed by the witness. There was insufficient evidence to determine the likelihood that occurred.

In summary, based on the scenarios and fuel-related factors considered, it is possible to state that:

• the fuel quantity when the aircraft departed either The Lakes or Toowoomba could not be determined but may have been sufficient to complete the return flight
• the left engine lost power after its fuel supply was interrupted when approaching The Lakes
• the right engine lost power due to a restriction to its fuel supply (it could not be determined if this was due to control inputs or otherwise)
• at the end of the flight, there was probably less than 53 L usable fuel
• it is unlikely that fuel was vented overboard due to incorrect tank selection sequence
• it is possible that a fuel tank switchover was intended and mis‑timed.

Therefore, the ATSB concluded that the loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving a Cessna Aircraft Company T310R, registered VH-JMW that occurred 40 km south‑south‑west of Port Macquarie, New South Wales on 28 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During the final descent towards The Lakes airstrip runway, the left engine was not producing power and the right engine was operating at low or intermittent power.
• After losing engine power at low altitude, a safe flying speed was not maintained resulting in a loss of control and collision with terrain due to either an aerodynamic stall, asymmetric power effects or a combination of both.
• The loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• a number of witnesses
• the aircraft manufacturer (Cessna)
• aircraft refuellers
• Textron Aviation
• The Civil Aviation Safety Authority
• The United States Federal Aviation Administration.

References

• Jeppesen Sanderson Inc 1992, Multi-Engine Pilot Manual, Jeppesen Sanderson, Colorado.
• ATSB aviation research investigation report B2005/0085, Power loss related accidents involving twin-engine aircraft.
• ATSB aviation research investigation report AR-2011-112, Starved and exhausted: Fuel management aviation accidents.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to representatives of the aircraft’s occupants, the United States National Transportation Safety Board, the Civil Aviation Safety Authority, and the aircraft manufacturer.

Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 27 October 2017, at 1410 Eastern Daylight-savings Time (EDT),^[1] a captain and first officer signed on for flight duty at Brisbane Airport, Queensland. The planned duty was to operate a JetGo Embraer ERJ135 aircraft, registered VH-ZJG, on four scheduled passenger transport sectors: from Brisbane to Dubbo, New South Wales, Dubbo to Essendon, Victoria, Essendon to Dubbo, and Dubbo to Brisbane.

The aircraft was scheduled to depart Brisbane at 1510. However, the flight crew were advised of an engineering delay of up to 45 minutes for unscheduled maintenance to change a main landing gear tyre. A replacement tyre was not immediately available, which resulted in an extended delay that eventually totalled 4 hours 15 minutes.

The aircraft departed Brisbane at 1925 and, after an uneventful flight, departed Dubbo for Essendon at 2116. The first officer was the pilot flying (PF) and the captain was the pilot monitoring (PM) for the sector from Dubbo to Essendon.^[2]

Prior to commencing descent, the flight crew programmed the aircraft’s flight management guidance system and briefed for an instrument landing system^[3] (ILS) approach to runway 26. It was the first time either pilot had operated into Essendon at night, and therefore their preferred approach was a runway 26 ILS approach. The flight crew also discussed the possibility of receiving radar vectors^[4] from air traffic control (ATC).

ATC informed the flight crew that due to aircraft traffic at neighbouring Melbourne Airport, runway 26 was unavailable. Therefore, ATC provided radar vectors for a visual approach to runway 35. As the aircraft passed abeam Melbourne Airport, the captain had Melbourne and Essendon runways in sight.

At 2220:18, ATC advised the flight crew that they would be positioned for a 5 NM (9.3 km) final approach at 2,100 ft above mean sea level (AMSL). This altitude was the radar lowest safe altitude for that sector of airspace. At 2221:48, ATC instructed the flight crew to descend to 2,100 ft.

The first officer recalled setting 2,100 ft on the aircraft’s altitude preselector. This directed the automatic flight control system (AFCS) to continue descent to 2,100 ft. He also recalled confirming the 2,100 ft set altitude on his primary flight display, as well as the flight director modes of heading and vertical speed mode. The captain recalled verifying the assigned altitude being set and flight director modes. Both flight crew recalled the autopilot was engaged at this time.

At 2223:02, as the aircraft passed about 2,300 ft on descent, ATC requested the flight crew to report sighting runway 35. At this time, the captain had lost sight of the runway. Becoming concerned that the captain could not visually identify the runway, the first officer also focused his attention looking outside the aircraft to the left to help locate the airport.

At about 2223:35, when 7.1 NM (13.1 km) from Essendon Airport and on a heading of 080°, the aircraft descended below the assigned altitude of 2,100 ft. Neither flight crew detected the aircraft was now below the radar minimum safe altitude and continuing to descend. When the captain next looked inside the aircraft at his primary flight display, he recalled seeing the altimeter indicating 1,600 ft, and he then called ’height’. The first officer also recalled seeing that they were below the assigned altitude at the same time.

At 2223:52, ATC instructed the flight crew to climb to 2,100 ft. However, that instruction was over transmitted by another aircraft and not heard by the flight crew. At 2223:58, ATC issued another instruction to climb immediately to 2,100 ft, which the flight crew acknowledged.

At 2224:05, a cleared level adherence monitoring (CLAM) alarm^[5] activated (Figure 1), further alerting ATC of a difference between the aircraft’s assigned altitude and its actual altitude. ATC immediately issued a terrain safety alert, advising the flight crew that the lowest safe altitude was 2,100 ft.

Recorded radar data showed the aircraft’s lowest altitude was about 1,500 ft during 2224:05 to 2224:10 (Figure 1).

Figure 1: Image of air traffic controller’s monitoring screen showing CLAM alarm activation following the aircraft’s descent below 2,100 ft

Image shows the aircraft (JG044) with a current altitude of 1,500 ft (‘015’), a cleared altitude of 2,100 ft (‘021’), a radar vectored heading of 070° (‘H070’) and a groundspeed of 160 kt (‘16’).

Source: Airservices Australia

As the aircraft climbed above 2,100 ft, ATC advised the flight crew of their position relative to runway 35 and asked if they had the runway in sight. When they confirmed that they did, ATC asked if they wanted to continue the approach. The flight crew elected to discontinue the approach and ATC subsequently vectored the aircraft for another approach. The aircraft landed without further incident at 2236.

At 2259, the aircraft taxied for departure from Essendon and then completed the service to Dubbo and Brisbane. The flight crew finished duty in Brisbane at 0245.

Airport information

Essendon Airport is located about 8 km south-east of Melbourne Airport. The proximity of the two airports adds complexity to operations at Essendon.

The airport has two runways aligned 17/35 and 08/26, and it is bounded on two sides by freeways with substantial amber lighting and well-lit residential areas. At night, the lights around the airport present a complex picture. The published aerodrome chart had a caution note describing that amber freeway lighting may confuse flight crews when attempting to identify runway 08/26 lighting.

Runway 35 did not have an instrument approach procedure. Instead, pilots were required to conduct visual approaches to this runway. It was equipped with a precision approach path indicator light (PAPI) array to provide pilots with vertical profile guidance during visual approaches.

At the time of the occurrence, visibility was greater than 10 km, and the wind was a northerly at 14 kt.

Essendon Airport had a curfew prohibiting aircraft movements from 2300 until 0600 for all operations other than emergency services. Operators would incur financial penalties for flights arriving or departing during the curfew period.

To continue the service from Essendon to Dubbo (and then Brisbane), the aircraft had to commence taxiing for departure before the curfew. Missing curfew would result in the aircraft being grounded until 0600 the next morning, disrupting the current service and that of the following day.

The aircraft taxied for the return flight from Essendon at 2259, 1 minute before the commencement of the curfew period. Both flight crew reported feeling significant pressure to complete the service and return the aircraft to Brisbane. Both pilots reported being aware of the potential problem with the curfew prior to departing Brisbane, and the first officer reported considering the potential problem with the curfew during the visual approach into Essendon.

Air traffic control information

Airservices Australia provided an ATC service to the aircraft for the entire flight, including the descent to Essendon. The approach controller who provided radar vectors to the flight crew was also responsible for sequencing a large number of aircraft arrivals into Melbourne at the same time.

In an effort to manage the risk that neither pilot had operated at night into Essendon, the captain’s preferred arrival was to runway 26 as it was equipped with an ILS and was the longer runway. However, due to the congestion of arriving and departing aircraft at Melbourne, ATC advised this request was not available. Although the captain maintained the ability to instruct ATC that he required the ILS approach, he was likely aware that doing so would possibly result in ATC needing the aircraft to enter a holding pattern until the controller could sequence the flow of aircraft traffic at both airports.

When conducting a visual approach to a runway, ATC can provide radar vectors to the pilot until the aircraft is aligned with the runway centreline. A pilot is required to report that they have sight of, and can maintain sight of, the landing runway in order for ATC to clear a pilot to conduct the approach.

The flight crew reported that during the radar vectoring towards Essendon, they felt pressure from ATC to sight runway 35. The ATSB reviewed audio recordings between the approach controller and the flight crew. The flight crew first contacted Melbourne Approach at 2213:58. At 2223:02, the approach controller asked them to report Essendon runway 35 in sight. This was the only recorded request made by the approach controller to the flight crew to sight runway 35.

Automatic flight control system

Flight crews normally manage flight of an ERJ135 using the aircraft’s AFCS. This system consists of dual autopilots, a flight guidance controller (FGC) and flight instrument displays.

To manage the aircraft in all flight phases, pilots select various modes on the FGC. Selected descent modes included flight level change, speed hold and vertical speed.

The pilot can engage the autopilot by pressing a button on the FGC. Intentional disengagement of the autopilot by a pilot generates an audible voice AUTOPILOT alert. Failure and disconnection of an autopilot results in the same audible voice alert and generates a warning message illuminated on a separate indicating system.

In the ‘vertical speed’ (VS) selected descent mode, the AFCS will maintain a selected vertical speed. The rate of vertical speed can be changed as needed by the pilot. With the autopilot engaged, the VS mode would automatically change to altitude capture mode as the aircraft approached a preselected altitude.

An ‘altitude preselect’ (ASEL) mode armed automatically if the aircraft climbed or descended towards a preselected altitude. Altitude preselect mode would then automatically capture and cancel any existing mode at an appropriate point based on preselected altitude error and vertical speed. The system would then automatically switch to altitude hold mode after the aircraft had levelled off at the preselected altitude.

The first officer recalled selecting the descent mode to vertical speed at the time ATC commenced issuing radar vectors. The flight crew reported that the autopilot was engaged during the descent and that the AFCS failed to capture the preselected altitude (2,100 ft) as expected. Further, the flight crew recalled that no alert was heard, either for autopilot disconnect or altitude exceedance, which should have sounded when the aircraft was 200 ft below the preselected altitude.

After descending below 2,100 ft, the flight crew reported that the flight director pitch bars, which indicate the direction of the preselected altitude, were providing guidance that the aircraft should climb.

The ATSB requested the aircraft’s flight data recorder. However, at the time of the request, the data for the occurrence flight had been overwritten.

Following the flight, no technical log entry was made regarding a problem with the autopilot capturing the selected altitude. Nevertheless, an engineering inspection of the AFCS was conducted following the aircraft’s arrival back in Brisbane, and no fault was found.

The flight crew advised that they were aware of other recent AFCS problems associated with the aircraft and the operator’s other ERJ135 aircraft. A review of maintenance records for the operator’s ERJ135 fleet identified that several AFCS-related problems had been reported during the period from 3 August. However, none of those problems were similar to what occurred during the occurrence flight. In addition, no subsequent problems that were similar in nature were reported on the occurrence aircraft.

Flight crew information

The captain held an Air Transport (Aeroplane) Pilot Licence (ATPL) and had 10,100 hours total flight experience, including 155 hours on the aircraft type. The first officer held a Commercial (Aeroplane) Pilot Licence and had 2,100 hours total flight experience, including 473 hours on type.

Both flight crew had operated into Essendon on many previous occasions, but neither had operated to that airport at night.

Flight and duty times

The captain had the two previous days (2526 October) rostered off duty, and had conducted administrative work from 10001600 on the 24 October. The first officer had the four previous days rostered off duty.

On the day of the occurrence, both flight crew signed on to commence duty at 1410 EDT. Due to the delay before the first flight, they ultimately signed off duty at 0245, a duty period of 12.6 hours. However, the captain advised that he commenced administrative duties, unrelated to the subsequent flights, at about 1200 EDT. Therefore, his actual duty time was 14.8 hours.

The captain recalled waking up at about 0700 EDT on the day of the occurrence after a ‘normal’ sleep. He therefore had been awake for 15.4 hours at the time of the occurrence, and 18.8 hours at the end of the extended duty period. The first officer recalled waking up at 0630 EDT on the day of the occurrence after a ‘reasonable’ sleep, and was therefore awake for 15.9 hours at the time of the occurrence and 19.3 hours at the end of the extended duty period.

The operator managed its flight crews’ flight and duty times to comply with a standard industry exemption to Civil Aviation Order (CAO) 48.0, which was issued to the operator by the Civil Aviation Safety Authority (CASA). The exemption stated that duty included any task associated with the business of an operator.

The operator’s rostering personnel managed flight crew flight and duty times in order to comply with the exemption. The operator’s procedures required that all work-related activities for the operator be reported and considered as duty time.

The rostered flight duty limit for a pilot signing on after 1300 local time for a four-sector duty was 12 hours. However, a pilot could elect to extend a duty already started for up to 2 hours as long as they felt mentally and physically fit to continue (and they submitted a report upon completing the duty). Although the captain’s recorded duty time did not exceed 14 hours by the end of the trip, the actual duty time did exceed the limit.

During the delay on the ground in Brisbane, the crew were offered an option to stand down as they were now facing a long duty period. The captain reported that he was told his standing down would mean his four scheduled flights that day would be cancelled as there were no replacement captains available. Both pilots reported feeling fit to continue and elected to continue the flights. However, the captain later reported that he felt some pressure to operate the flights. The cabin crewmember stood herself down and was replaced.

Safety analysis

During radar vectoring to runway 35 at Essendon Airport, the aircraft descended below the radar minimum safe altitude of 2,100 ft. The flight crew reported that the autopilot was engaged and the altitude of 2,100 ft was preselected at the time of the occurrence. A subsequent engineering inspection found no fault with the AFCS. Because no flight data was able to be obtained, the ATSB was unable to confirm what the AFCS mode(s) and settings were at the time of the occurrence, or the reason why the aircraft descended below the preselected altitude.

Regardless of the reason for the aircraft descending through the prescribed altitude, flight crew have a vital role in monitoring the aircraft’s flight path, particularly during descent. In this case, the first officer (pilot flying) relied upon automation to capture the assigned altitude and diverted his attention outside of the aircraft to assist the captain (pilot monitoring) in sighting the runway. As a result, neither pilot was monitoring the aircraft’s flight instruments or descent path as it approached and subsequently descended through the assigned level, which was also the minimum safe altitude.

The flight had been significantly delayed from its scheduled time of operation. The flight crew were aware of the reduced time margin for their scheduled return flight to depart Essendon prior to the 2300 curfew. In addition, neither pilot had operated at night into Essendon Airport, and the captain’s requested option of conducting an ILS approach to runway 26 had been declined by ATC due to traffic. The captain’s subsequent difficulty in identifying runway 35 at night, the delayed arrival of the aircraft at Essendon and the proximity of the curfew time probably contributed to the first officer (pilot flying) focussing his attention outside the aircraft at a critical time of flight.

Both flight crew had the previous days off duty and had a reasonable amount of sleep the night before. Although both flight crew had been awake for 1516 hours at the time of the occurrence, there was insufficient evidence to conclude that they were operating at a level of fatigue known to influence performance at the time of the occurrence. Nevertheless, they would probably have been operating at an elevated risk of fatigue during the subsequent two flights.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During radar vectoring to runway 35 at Essendon, the aircraft descended through the radar lowest safe altitude (2,100 ft). The extent to which there was a problem with the functioning of the aircraft’s automatic flight control system could not be determined.
• Due to the captain (pilot monitoring) having difficulty sighting the runway, as well as perceived pressure to complete the flight, the first officer (pilot flying) focussed his attention outside the aircraft at a critical time during the descent.
• The flight crew did not detect that the aircraft had descended through the assigned level (2,100 ft) until the aircraft reached 1,600 ft.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.

Aircraft operator

As a result of this occurrence, JetGo advised the ATSB that they had taken the following safety actions:

• The flight crew involved in the incident were subsequently provided with ground and simulator training for operations into Essendon at night.

Safety message

Flight crew should be mindful that during higher workload phases of flight, such as during approach and landing at an unfamiliar airport, introducing tasks that divert both flight crew members’ attention from monitoring the aircraft’s flight profile and altitude should be minimised. Further, during a visual approach, pilots must ensure that at least one pilot monitors the aircraft’s flight path profile and energy state.

The ATSB SafetyWatch highlights the broad concerns that come out of our investigation findings and from the occurrence data reported to us by industry.

An increasing trend has been identified where pilots do not effectively manage their aircraft’s flightpath when unexpected events arise during the approach to land.

When compared to other phases of flight, the approach and landing has a substantially increased workload and is traditionally the phase of flight associated with the highest accident rate. Flight crews must continuously monitor aircraft and approach parameters, and the external environment, to ensure they maintain a stable approach profile and make appropriate decisions for a safe landing.

The selection of inappropriate autoflight modes, unexpected developments, or any confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.

The ATSB SafetyWatch information on Descending too low on approach provides more resources and information.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours. EDT was the time zone relevant where the occurrence took place and it has been used throughout the report to minimise confusion. The time in Brisbane was Eastern Standard Time, or UTC + 10 hours.
2. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. Instrument Landing System: A landing aid which provides lateral and vertical guidance to flight crew during approach to land.
4. Radar vectoring: ATC provision of track bearings and altitudes used to guide and position an aircraft.
5. System-detected non-conformance alert that checks the conformance of the actual flight level of a surveillance track with respect to the cleared flight level inputted by the controller.

Safety summary

What happened

On 24 October 2017, the owner-pilot of a Cessna 210B, registered VH-DBU, was operating the aircraft on a private flight without passengers from Albany to Bunbury, within Western Australia. Following take-off, the pilot made a radio broadcast at 1033 Western Standard Time, which was the last recorded transmission from the pilot. The pilot did some local flying before tracking to the north-west of Albany in the general direction of the destination.

At about 1100, people on properties about 30 km to the north-west of Albany heard and in some cases saw the aircraft fly over, and shortly afterwards, witnesses heard a loud cracking sound then one witness saw the aircraft in a steep descent until it disappeared out of sight. Smoke indicated a post-impact fire.

Aircraft wreckage was located in Mount Lindesay National Park and it was established that the pilot was deceased. The wreckage was dispersed over an area of approximately 700 m by 250 m and the fuselage, detached from each wing, was significantly fire affected.

What the ATSB found

The ATSB found that for reasons that were not established, abnormal operation of the aircraft produced high levels of unusual aerodynamic loading on the right wing that exceeded the strength of the wing and initiated an in-flight break-up and impact with terrain.

The aircraft did not have a pre-existing structural deficiency or damage that would have contributed to the in-flight break-up and the local meteorological conditions were not conducive to inadvertent aircraft overstress.

The ATSB found that the presence of methylamphetamine in the pilot’s system increased the risk of operational misjudgements and aircraft mishandling, and pilot incapacitation. This did not necessarily contribute to the accident.

The pilot had worked for a number of organisations which had the required risk controls for problematic alcohol and other drug (AOD) use in place. There was no data that indicated a systemic problem with problematic AOD use in Australian aviation.

What's been done as a result

No safety issues were identified and no proactive safety action was reported to the ATSB. Nonetheless, the ATSB considered that there were opportunities for aviation organisations to collect more data and to enhance the extant risk controls for problematic AOD use.

Safety message

The ATSB acknowledges that self-referral by a pilot with problematic AOD use to a Designated Aviation Medical Examiner, a Drug and Alcohol Management Plan, or the Civil Aviation Safety Authority (CASA), may be perceived as a threat to ongoing employment in aviation. However, the risks to pilots associated with self-referral are less than the health, safety, and legal risks of continuing to operate with problematic substance use.

A defined protocol exists within the CASA aviation medical framework for pilots in stable remission from the problematic use of substances to return to work. Employer and independent peer support organisations are becoming more widely available to assist pilots with the safe return to work.

The ATSB suggests that operators and industry associations consider the availability of information and services to pilots and safety sensitive aviation activities within their area of influence.

The occurrence

Sequence of events

On 24 October 2017, the owner-pilot of a Cessna 210B, registered VH-DBU was intending to operate the aircraft on a private flight from Albany to Bunbury, within Western Australia (Figure 1). The pilot was travelling to Bunbury to participate in training and assessment activities in preparation for the forthcoming aerial firefighting season.

Figure 1: Nominal intended flight path

Source: Google Earth (modified by the ATSB)

According to the aviation forecasts, there was no significant weather expected on the intended route at the time of the flight. The lower-level winds were from the west at between 10 and 15 kt, and cloud was broken cumulus or stratocumulus cloud between 2,500 and 7,000 ft. Visibility was reduced to 8 km in smoke. The observed conditions were consistent with the forecast and considered suitable for operation under the Visual Flight Rules.

Information about the pilot’s activities before the flight was limited. The ATSB is aware that on the day of the accident the pilot conversed with three people at different times who recalled that the pilot appeared to be in good spirits. The pilot did not discuss the forthcoming flight with anyone.

It was reported that the pilot kept the aircraft in a hangar at Albany Airport. There is no information about the pilot preparing the aircraft for the flight; however, someone did observe the aircraft near the hangar with the wheels chocked, engine operating, and the pilot outside of the aircraft nearby. No one was observed at the controls and no one has reported being at the controls at that time. This was contrary to safe practice and the regulatory requirement that a pilot needs to be at the controls while an engine is operating and no reason for this action was identified.

The pilot taxied the aircraft to the fuel bowser and was seen to refuel the aircraft. From there, the pilot was observed to taxi for departure.

The pilot made routine transmissions to check his radio and on entering the runway to position for take-off. Then, at 1033 Western Standard Time (WST), the pilot transmitted that he was airborne from runway 14, maintaining runway heading to the south-east, intending to make a right turn at 1,500 ft above mean sea level (AMSL) to track to Bunbury and climb to 6,500 ft AMSL. That was the last recorded radio transmission from the pilot.

People who observed the aircraft start, taxi, and take-off did not notice anything abnormal about the aircraft. From aerial photos of coastal scenery around Albany that the pilot sent to an acquaintance and a report from an Albany resident, it appears that the pilot undertook some local flying before departing the area (Figure 2).

A few people between Albany and the accident site area heard an aircraft that could have been VH-DBU, but there was insufficient information to establish the aircraft’s flight path.

The key witnesses were located between 3 km and 5 km from the accident site in the general direction of Albany. Some witnesses related that prior to any apparent problem with the aircraft, the noise from the aircraft was loud and the aircraft seemed to be lower than was usual for aircraft operating in that area. Some witnesses described the noise as indicative of an aircraft manoeuvring.

With regard to weather, the witnesses reported some cloud but generally clear and calm conditions.

The first sign of a problem with the aircraft was a loud and distinctive noise that witnesses described as a sharp bang, crack of a whip, gunshot, and thunder or lightning. Some witnesses associated the noise with the aircraft they had just seen or heard, drawing their attention and prompting them to look for the aircraft.

Only one of the witnesses, located about 4 km from the accident site, saw the aircraft following the sharp noise. That witness recalled the aircraft was in a nose-down vertical descent rotating to the right and the engine noise was rising and falling. The witness watched the aircraft until it disappeared from sight due to terrain and trees. The witness did not recall seeing anything separate from the aircraft, nor did they recall any smoke or vapour coming from the aircraft.

Other witnesses recalled hearing a series of sounds over an extended period following the initial sharp noise. The sounds, over a period of about 10 to 15 seconds, according to one witness, were described as similar to angle grinding or crashing through trees. Other descriptions were chopping, whirring, striking, whining, and high-pitched. One witness also recalled the engine revving during this time. These irregular noises were reported as stopping suddenly, probably upon impact with the terrain. Smoke was observed in the area shortly afterwards.

These events were reported to the authorities and the pilot of a nearby aircraft was diverted to conduct an aerial search. Aircraft wreckage was located in dense bushland within the Mount Lindesay National Park and the deceased pilot was found in the main wreckage.

Figure 2: Accident site and other locations of interest

Source: Google Earth (annotated by the ATSB)

Accident site information

ATSB investigators gained access to the accident site and located wreckage during ground and air searches with the assistance of Western Australia Police and the Parks and Wildlife Service. A subsequent ground search of the accident site by local State Emergency Service personnel located some more pieces of wreckage.

As the pieces were located and identified, their position was recorded on a GPS receiver. Those positions have been referenced to a Google Earth image (Figure 3) and the icons for the pieces coded according to the following:

• Green – Right wing pieces
• Red – Left wing pieces
• Yellow – Fuselage and tailplane
• White – Nil significant and unidentified pieces
• Small – Fragments and smaller pieces
• Large – Significantly sized assemblies.

For ease of reference and interpretation, three zones were delineated and named according to likely chronology of events from A to C.

Figure 3: Wreckage plot

Source: Google Earth (annotated by the ATSB). Please note that the cleared areas evident near zone C were established in response to the accident.

From examination of the aircraft wreckage at the accident site and interpretation of the wreckage plot, the ATSB has made the following observations about the disposition of the wreckage:

• most but not all of the aircraft parts have been identified and these were found within an area of about 700 m long and 250 m wide that was oriented in a south-westerly direction
• not accounted for are the right cabin door and small sections of the right wing (areas identified in Figure 7)
• the main wreckage, that included the fuselage, engine and propeller, was severely affected by fire (Figure 4)
• the left wing (Figure 5), inboard right wing (Figure 6), tailplane, and fuselage (main wreckage) were grouped in zone C but not structurally contiguous, which is consistent with an in-flight break-up
• the items furthest from the main wreckage were pieces of right wing skin and rear fuselage skin (zone A)
• many of the major parts of the aircraft had been damaged in-flight and during the ground impact
• the right wing outboard of the fuel tank had fragmented in-flight (Figure 6).

Figure 4: Fuselage viewed from front to rear

Source: ATSB

Figure 5: Left wing in as found position

Source: ATSB

Figure 6: Right wing inboard section in as found position (zone C)

Source: ATSB

Wreckage examination

The ATSB recovered the wing, tailplane, and selected fuselage pieces and moved them to a secure storage location for further examination. With the parts loosely reassembled (Figure 7), the ATSB mapped the damage and inspected the fracture surfaces in context. The ATSB summarises the results of that process in the dot points following.

Overall:

• no signs of pre-existing material deficiencies such as corrosion or metal fatigue
• all fractures were consistent with over-stress of the material
• all flight controls were connected or disrupted during the break-up.

The left wing was mostly intact but exhibited the following characteristics:

• separation of the outboard leading edge skin, outboard aileron section and wing tip fairing
• a downward bend near the wing strut attachment and general nose-up twisting of the outboard section. Some distortion was related to post-break-up impact with vegetation and the ground
• overload failure of the wing-fuselage attachments.

The right wing exhibited the following characteristics:

• significant fragmentation and distortion with two primary fracture lines in front to rear orientation
• bending in multiple directions with some torsional effects
• overload failure of the wing-fuselage attachments.

The tail section separated from the rear fuselage as a mostly intact assembly bending in multiple directions; with some distortion related to contact with another object—probably from the right wing.

Figure 7: Wreckage loosely reassembled at storage facility

Source: ATSB

To characterise the break-up sequence, the ATSB considered the observations derived from examination of the wreckage and the disposition of the wreckage at the accident site. Due to the wreckage fragmentation and complexity of wreckage indications, this analysis was constrained.

The ATSB was able to establish that the break-up occurred rapidly with high stresses generated over a large area of the aircraft. The break-up sequence likely began with separation of the right-wing tip and progressed inboard, with some fragments striking the tail section. As the right wing broke up, it was subject to a high level of torsion and reverse—both upward and downward—bending. There was no evidence that the un-located right door and right-wing parts had any primary role in the break-up.

The ATSB notes that the orientation of the wreckage trail on a south-westerly heading was about 90 degrees to the nominal north-westerly track to Bunbury. This was not necessarily significant as the pilot’s intentions and aircraft track immediately before the break-up are unknown and the trajectory of the aircraft during and after the break-up would be unpredictable.

Context

Aircraft information

Cessna 210B design characteristics

The Cessna 210 is a single-engine high-wing aircraft with retractable landing gear. In the earliest models of the aircraft, including the B model manufactured in 1962, the Cessna Aircraft Company^[1] designed and built 210s with strut-braced wings and with ailerons that were comparatively longer in span than the flaps.

Changes introduced (after the manufacture of VH-DBU) for the D model produced in 1964 included a redesign of the wing structure. Although strut-bracing was retained, Cessna changed the type of aileron control surfaces so that the ailerons were comparatively shorter in span and the flaps were correspondingly longer in span. Then, in the G model produced in 1967, Cessna introduced a new cantilever wing design that removed the strut-bracing. This configuration was retained for subsequent models.

The Cessna 210B was certified as a normal category aircraft and was not approved for acrobatics (aerobatics) or spins. The specified limits included:

These airspeed limitations are defined as calibrated airspeeds (CAS) in the Cessna 210B Owner’s Manual. In general, the CAS of a Cessna 210B corresponds closely to the airspeed indicator readings (IAS).^[3] The IAS at any particular point in a flight will vary according to selected engine power, aircraft angle of attack, aircraft configuration, and environmental conditions.

In the Owner’s Manual, manoeuvring speed was described as the maximum airspeed at which abrupt control travel can be used without exceeding the design load factor. The ATSB estimated that the aircraft weight was about 200 kg below the maximum take-off weight (MTOW) of 1,361 kg. At weights below MTOW, the effective Va will be marginally less than the specified limit.

Load factors are defined in terms of G loading, which is a measure of the forces acting on the aircraft structure to produce the accelerations involved in changing speed and direction in flight. One-G is the loading on the aircraft structure in un-accelerated straight and level flight produced by the lift force needed to balance the gravitational force, or the weight of the aircraft.

Given the potential relevance of IAS, the ATSB sought to establish some reference points. In the Owner’s Manual, the top (cruise) speed at sea level was specified as 198 mph (172 kt) and maximum cruise speed at 7,000 ft specified as 189 mph (164 kt). These speeds are true airspeeds (TAS) that correspond to IAS values that diminish as air density reduces with elevation in altitude and/or temperature. For example, a true airspeed of 164 kt at 7,000 ft above mean sea level (AMSL) at a temperature of 10 degrees above standard corresponds to an IAS of 145 kt.

History of VH-DBU pre-2012

The aircraft was registered in Australia as VH-DBU in July 1962. In the first decade of operation, there were no reports of any serious incidents or accidents until the end of that period.

The ATSB database recorded that on 31 March 1972, the aircraft was overstressed when a non-instrument rated pilot became disoriented in cloud near Moruya, New South Wales (NSW). According to the aircraft history file held by the Civil Aviation Safety Authority (CASA), the upper surfaces of both wings sustained stress deformation. Both wings were removed for repair and the aircraft was returned to service later that year.

Details about the wing repair were not available as the original aircraft logbook that would have contained the applicable certifications was reported as lost in the mail in early 1973. The extant aircraft logbook recorded maintenance from December 1972 onwards, when the aircraft total time in service was recorded as 3,800 hours.

During a flight on 26 March 1983, the main landing gear did not extend fully. On landing at Canberra, Australian Capital Territory, the main landing gear folded up completely with consequent damage to the lower surface of the fuselage, landing gear doors, and tailplane. That damage was repaired and other work carried out to both wings before the aircraft was returned to service on 29 July 1983 (aircraft total time in service recorded as 5,708 hours).

The only other recorded incident or accident of any significance was a propeller strike during taxi on 11 December 2004. The engine and propeller were overhauled and the aircraft returned to service on 20 May 2005 (aircraft total time in service recorded as 8,988 hours).

In general, certifications in the aircraft logbook indicated a pattern of periodic and major inspections, including compliance with airworthiness directives and rectification of defects. This was consistent with the maintenance regulations prevailing at the time and with the age and total time in service of the aircraft. It was noted that there was no maintenance recorded in 2006, 2008, 2009, and 2012, which indicates that the aircraft was not operated for some or all of that time.

History of VH-DBU from 2012 onwards

In February 2012, the aircraft was registered to a company owned by the pilot involved in this accident. As the registration holder, the company was required to manage the airworthiness of VH-DBU, which included ensuring that suitably qualified personnel carried out the required maintenance in accordance with approved data (instructions for continuing airworthiness).

The aircraft was initially based in NSW and operated by the new owner, and flown by other pilots in 2012. Other than a landing gear problem that was resolved before landing at Albury there were no reports of any defects or anomalies.

During 2013, the owner-pilot operated the aircraft on a number of flights and there were two periodic inspections carried out. By the end of 2013, the pilot had transferred the aircraft to Albany, Western Australia (WA).

There is no record of the aircraft being operated in 2014 or in 2015 up to December of that year. It was reported that during this period the owner paint-stripped the aircraft and made minor cosmetic repairs.

Cessna have developed a program of Supplemental Inspection Documents (SIDs) to ensure that any damage or defect related to time in service from fatigue, overload, or corrosion is found and rectified. The focus of the SIDs was on principal structural elements and control systems including the wings, wing/strut attachment fittings, and aileron mechanisms. In the 29 supplemental inspections for the Model 200 Series (1960-1965), Cessna specified removal of access panels, fairings, or interior linings and visual inspection of the applicable area. If anomalies were identified and/or aircraft hours exceeded a threshold figure (in some cases 12,000 hours), the applicable area was subject to detailed inspection that could involve disassembly and specialised non-destructive inspection techniques.

CASA ruled that, irrespective of the nominated maintenance schedule, all 200 series aircraft, including the Cessna 210B, were required to be compliant with the applicable SIDs by 31 March 2016.

At the request of the owner, on 14 December 2015, CASA issued a special flight permit for a single flight from Albany, WA to Manjimup, WA, to allow maintenance to be conducted.

On arrival in Manjimup, the aircraft was withdrawn from service for a periodic inspection and compliance with the Cessna SIDs. The ATSB reviewed the aircraft logbooks and maintenance worksheets, which recorded that a CASA-approved maintenance organisation carried out the applicable elements of the CASA maintenance schedule and complied with applicable airworthiness directives and service bulletins.

The approved maintenance organisation recorded compliance with the applicable SIDs in their maintenance worksheets and in the aircraft logbook. These records showed that no significant defects were identified and no specialised non-destructive inspections were carried out. Final certification as to coordination of maintenance was carried out on 20 May 2017 and a maintenance release valid for 12 months or 100 hours of operation was issued for the aircraft. At this time, the aircraft total time in service was recorded as 9,380 hours.

No further maintenance was recorded in the aircraft logbook and the current maintenance release was not recovered. At the time of the accident, the aircraft was within the calendar-time and probably within the time-in-service validity periods of the maintenance release. It is not known if there were any defects endorsed on the maintenance release but no one reported that the pilot had any concerns about the serviceability of the aircraft.

Following the maintenance, the owner-pilot flew the aircraft to a private airstrip east of Perth for it to be painted. The spray painter advised that aviation products were used and the only disassembly carried out during the process was removal of some access panels and fairings for painting. The flight control surfaces were reportedly not painted or otherwise disturbed. Although there were no logbook certifications for the maintenance activities of paint-stripping and repainting, the ATSB considered there was a low risk that those processes had any adverse effect on the continuing airworthiness of the aircraft.

CASA participated in the examination of the aircraft wreckage and reviewed the maintenance records to assess the implications, if any, of this accident for the continuing airworthiness status of the aircraft type and ageing aircraft in general. No concerns were reported to the ATSB.

The ATSB reviewed the records of routine CASA surveillance of the approved maintenance organisation that carried out the recent periodic inspection and SIDs. In the two audits carried out in the 5 years preceding the accident, CASA auditors identified some non-conformances in the control of tooling, storage of aircraft parts, in‑progress tracking of maintenance tasks, and certification protocols. Based on advice and evidence of corrective action, CASA acquitted the non-conformances.

In periodic assessments of the performance of the approved maintenance organisation, CASA did not identify any significant risks. For the type of maintenance carried out on VH-DBU, the ATSB considered there was a low risk that the process conformance deficiencies identified by CASA auditors had any adverse effect on the continuing airworthiness of that aircraft.

Pilot information

The pilot had held a Commercial Pilot (Aeroplane) Licence since 1997. Between January 2002 and November 2003, the pilot operated a Cessna 206 aircraft for a charter company operating in north Queensland. During that period, in May 2003, the pilot qualified for an Instrument Flight Rating applicable to single engine aircraft.

From December 2004 to March 2006, the pilot was engaged in training for aerial agricultural operations and gaining related experience. In March 2006, the pilot added an Agricultural Pilot (Aeroplane) Rating to his licence. After two years of operating piston-engine agricultural aircraft, he progressively gained endorsements on turbine-powered agricultural aircraft. In July 2011, the pilot qualified for a Class 1 Agricultural Pilot Rating and aerial firefighting approval.

Since October 2013, the pilot had been employed on a seasonal basis as a firefighting pilot based at Albany. Each year the pilot completed a pre-season proficiency check with an aerial firefighting operator. This satisfied the requirement for a flight review.

After the 2016-17 firefighting season ended in March 2017, the pilot provided contract flying services to two aerial agricultural operators. The pilot completed employment with one of those operators as pre-arranged the day before the accident.

At the time of the accident, the pilot held a pilot’s licence issued in accordance with Part 61 of the Civil Aviation Safety Regulations 1998. This licence included class ratings for single and multi-engine aircraft and design feature endorsements such as manual propeller control and retractable undercarriage. As such, the pilot was qualified to operate the Cessna 210B.

The pilot’s logbook for the period after 30 January 2012 was not recovered; however, based on CASA and operator records, the ATSB estimated that the pilot’s total aeronautical experience was 6,500 hours, of which 4,200 hours was aerial application.

A search of the ATSB occurrence database did not identify any other occurrences involving the pilot. From other sources, there was a report that the pilot experienced a birdstrike in July 2014 with minor facial injuries and no ongoing health effects. There was also report of a wirestrike in 2010 but no details were available.

The pilot held an aviation medical certificate with Class 1 validity until 16 December 2017. Further information about aviation medical examinations is in a following section.

A general practitioner (GP) reported that while he had not been involved in the pilot’s medical care, the pilot’s family had a history of coronary and cerebro vascular disease with associated events suffered by two close relatives when they were in their sixties. In at least one of those cases, there were no preceding symptoms or events. In addition, a family member advised the GP that the pilot was a long-term smoker and had a poor diet with a high intake of ‘fast food’.

According to the GP:

… given [the pilot’s] significant family history combined with his lifestyle risk factors, the probability of sudden cardiac event leading to in-flight collapse/death resulting in loss of control of the aircraft with the subsequent crash would be within the realm of reasonable possibility.

While the GP suggested the potential for a medical condition, there was no direct evidence that the 40-year-old pilot had been diagnosed with any significant medical condition or had been taking any prescribed medication. No one reported that the pilot was showing signs of ill-health before the accident.

Post mortem examination and toxicology analysis

Toxicology results

Forensic pathologists carried out a post mortem examination at the direction of the coroner. The findings of their report were consistent with injuries characteristic of an aircraft accident. The examiners found no evidence of significant underlying natural disease.

A NATA-accredited^[4] forensic science laboratory also carried out a toxicological examination. It was not possible to conduct screening analysis of blood samples. Analysis of liver samples was possible for some substances and this detected a significant concentration of methylamphetamine and a lower concentration of amphetamine. The toxicology report noted that the sample was in an advanced state of decomposition and that interpretation of results must be made in the context of the entire case details.

Methylamphetamine, commonly known as ‘ice’, is a highly addictive central nervous system stimulant that is administered most commonly by smoking, but may also be administered orally and by intravenous injection. People who use the drug in large doses or frequently, almost always administer it intravenously or by smoking.

Amphetamine is a metabolite of methylamphetamine, and is commonly found in the body when methylamphetamine is present. It has effects similar to methylamphetamine but is less potent.

In Australia, methylamphetamine is not prescribed for pharmaceutical purposes and is only available as an illicit drug. There is no evidence that methylamphetamine is produced naturally in the human body by any biochemical processes (ante or post mortem), and few prescription drugs are known to metabolise to methylamphetamine. In this case, there was no recorded medical evidence that the pilot was taking any prescribed medication, and therefore no legitimate (non-illicit) source for the methylamphetamine.

There was insufficient information for the ATSB to establish the method or timing of administration of methylamphetamine. In the case of intravenous administration, the peak effects occur within a few minutes. When methylamphetamine is smoked or taken orally, the drug is absorbed into the blood and the concentration will gradually rise until a peak concentration is reached after approximately 2.5 to 3 hours. After reaching the peak, the concentration will gradually decline. The decline rate is highly variable between individuals, but the average half-life^[5] is approximately 10 hours.

Methylamphetamine and amphetamine concentrations can vary significantly between individuals and studies show a substantial overlap in methylamphetamine concentration between drug-caused deaths (due to the direct toxic effects of the drug) and drug-related deaths (present but not considered the direct cause – recreational use).^[6] Similarly, the effect on individuals and the duration of those effects can vary significantly, the latter usually over 4-6 hours but may last somewhat longer if administered by smoking or orally.

Analysis of toxicology results

The toxicology results indicated a significant concentration of methylamphetamine and amphetamine in a liver sample showing an advanced state of decomposition.

The ATSB sought the assistance of the Bioaeronautical Sciences Research Branch of the Civil Aerospace Medical Institute within the US Federal Aviation Administration (FAA) to review the methodology and results of the liver tissue toxicology. The FAA expert toxicologist advised that:

• the reported methodology produces a low risk of false positive results
• the presence of methylamphetamine and amphetamine (as metabolite) at their respective concentrations are consistent with the expected ratios
• the concentrations may be falsely elevated by evaporation of tissue fluids due to the fire (post-impact) and decomposition/dehydration of the liver (post mortem)
• the interpretation of effects on an individual at a particular time is not possible from tissue concentrations
• the individual was exposed to the compound.

The ATSB noted the toxicologist advice that drug concentrations may undergo post-mortem changes and interpretation of individual effects during a specific time period was not possible. Nevertheless, since the toxicology review advised that the individual was exposed to the compound, the ATSB considered that there would be a safety investigation benefit to further explore the potential effects on the performance of the pilot.

For this assessment, the ATSB engaged a consultant with a PhD in Psychology and post-doctoral training in pharmacology. The consultant had extensive experience in the treatment of alcohol and drug problems and contributed to publications on topics including the effects of drugs on the brain and behaviour, role of alcohol and drugs in road accidents, and psychopharmacology. This assessment was peer reviewed by two independent consultants specialising in forensic pathology and aviation medicine.

Based on empirical data and the toxicology report, the consultant advised it was reasonable to conclude that at the time of the accident, the concentration of methylamphetamine was at least sufficiently high for the pilot to have been significantly affected by the drug. It is possible that the pilot was very markedly affected and there was potential for lethal effects of the drug, most commonly as a result of effects on cardiac function.

Both the aviation medical specialist and the forensic pathologist agreed that the detected presence of methamphetamine and amphetamine were likely to have significantly affected the performance of the pilot.

Aviation safety considerations

Research^[7] has found that methylamphetamine can have a significant adverse effect on the user. However, the range of dosage and the corresponding effect can vary significantly between individuals. Nonetheless, it is recognised that no dose is considered safe in an aviation context.

From a safety education perspective, the effects can be increased heart rate and subjective feelings of methylamphetamine intoxication. Exaggerated confidence may be associated with risky, impulsive or reckless behaviour as well as impairment of cognitive function. The ability to concentrate on the operation of an aircraft can be impaired and there is a risk of experiencing psychotic symptoms, particularly paranoia. At relatively high concentrations, there is some risk of death due to the cardiac effects of methylamphetamine.

Management of alcohol and other drugs risk in aviation

Introduction

A key objective of ATSB occurrence investigations is to identify the occurrence events, actions, and local conditions that increased risk and those that contributed to the incident/accident. In more complex investigations, the ATSB will also review the risk controls and organisational influences that relate to identified safety factors and are expected to reduce the likelihood or consequences of those factors.

Given the toxicology result and pilot engagement in commercial operations, the ATSB reviewed the alcohol and other drugs risk controls in the aviation industry. The ATSB also sought to inform pilots of the means available to seek treatment and return to flying. Following is an outline of the main elements of the applicable risk control framework.

Regulatory framework

From a regulatory perspective, the risk of alcohol and other drugs in civil aviation was managed through Civil Aviation Safety Regulation (1998) Part 99 (CASR Part 99). This required certain organisations to implement drug and alcohol management plans (DAMPs) covering their personnel, including contractors, who performed safety sensitive aviation activities (SSAA). It also established a program for CASA to conduct no-notice (also known as random) testing for alcohol and other drugs (AOD).

Another regulatory provision that addressed the risk of alcohol and other drugs was Civil Aviation Safety Regulation Part 67 (CASR Part 67). This prescribed the requirements for medical certification of personnel including the appointment of Designated Aviation Medical Examiners (DAMEs) and standards for issue of medical certificates.

Drug and alcohol management plans

For organisations required to have a DAMP, the regulations stipulated that the plan include the following programs:

• drug and alcohol education – initial then refresher every 30 months, satisfied in some cases by CASA eLearning online course
• drug and alcohol testing
• drug and alcohol response – following a non-negative drug test result.

With regard to the testing program, the regulations stipulated that personnel be tested prior to conducting SSAA for the organisation and in the following circumstances:

• after an accident or serious incident involving personnel performing a SSAA
• if the organisation’s DAMP supervisor has reasonable grounds to believe that personnel performing SSAA may be affected by a testable drug or alcohol
• if personnel that would be performing SSAA return to work after a period of exclusion from SSAA due to testable drug use.

Although the regulations specified that DAMP organisations submit a bi-annual report, a post‑implementation review found that the initial data set was incomplete or inconsistent and the cost to DAMP organisations and CASA was not warranted. Consequently, CASA issued successive exemptions that removed the reporting requirement.

Drug and alcohol management plans – related operation

In the 12 months preceding the accident, the pilot contracted to three aerial application operators at different times. As holders of an Air Operators Certificate, each operator had implemented a DAMP that applied to the pilot who was performing SSAA on behalf of the operator. The following is a summary of the pilot’s interaction with each DAMP.

Operator A: The pilot had been employed as a contractor in previous seasons and received AOD education and testing when the pilot was inducted in 2013. Those test results were negative. In subsequent seasons, the operator repeated the AOD education without further AOD testing, consistent with the operator’s DAMP. The operator recalled that the pilot had been tested for drugs in a previous season (possibly 2015) due to a report that the pilot might have been so affected. Those test results were negative and no further action was taken or required.

Operator B: The pilot was a new contractor. The operator arranged AOD testing in June 2017 when the pilot was inducted. Those test results were negative. The operator did not establish the pilot’s history of AOD education and none was arranged. The operator provided records of employee AOD education and testing provided to employees.

Operator C: The pilot was a new contractor. The operator did not establish the pilot’s history of AOD education, or arrange for AOD testing that was required by operator’s DAMP. This was reportedly due to logistical constraints that also applied to other new pilots that season.

The ATSB noted that, consistent with CASR Part 99, the operator DAMPs did not require regular or no-notice/random AOD testing.

Alcohol and other drugs education

The online course provided by CASA for personnel performing SSAA described the effects of alcohol and other drugs, outlined the operation of DAMPs, and advised of CASA testing. It was noted that amphetamines were addressed as a substance within the group of stimulants. The risk of stimulants as a group was summarised as impairment of attention and increased risk taking.

The course material relating to DAMPs was consistent with the regulations and the guidance provided by CASA. It was clear that if DAMP-related testing or CASA no-notice testing produced a non-negative result, the consequences included an immediate stop to SSAA activities and initiation of a strict legal process with limited choices. Alternatively, if someone self-referred and sought help, there was more opportunity for the individual to choose from support and assistance programs. These included public and private health drug and alcohol treatment centres, mental health organisations, the CASA wellbeing webpage, and employee assistance programs.

In response to a request from the ATSB, CASA advised that the pilot had a user account for the CASA Learning Management System but there was no record of the pilot having completed the online AOD/DAMP course. This was qualified by CASA with advice that the third-party provider who hosted the training prior to 2014 did not have any records of completion.

Operator A provided AOD education to pilots during induction in 2013. The course material provided to the ATSB was comprehensive and clear about the AOD testing that would be carried out with serious consequences of a non-negative result. The ATSB noted that the course communicated a zero-tolerance approach and did not provide any guidance about self-referral for treatment or provision of support services.

As adopters of the CASA micro-business DAMP, operators B and C referred employees to the CASA on-line AOD course.

Alcohol and Other Drugs testing by CASA

The ATSB obtained data from CASA regarding no-notice testing carried out in 2015, 2016, and 2017. This data is presented in Table 1.

Table 1: CASA no-notice testing in 2015, 2016, and 2017

Similar drug use levels have been observed in other aviation jurisdictions. In a study published in 2011, it was reported that the US Federal Aviation Administration (FAA) conducted 1.13 million random drug tests between 1995 and 2005.^[8] The FAA found a prevalence rate of drug violations of between 0.61 and 0.65 per cent, and a prevalence of drug violations in flight crew members of 0.05 per cent (position-specific figures limited to 2003–2005). The FAA found that between 1995 and 2005, amphetamine-type drug violations as a proportion of all drug violations increased from 3.4 per cent to 10.3 per cent.

Of note, the FAA data only cover employees of major airlines, commuter air carriers and air taxis, and do not cover individuals engaged in general aviation. The authors of the FAA study note that:

Given the differences in demographic characteristics, flight environments, and regulations between commercial aviation and general aviation, (this research is) unlikely to be applicable to private flights.

Aviation medical certification

In all three aviation medical standards specified in CASR Part 67, the following behavioural characteristic applied: ‘does not engage in any problematic use of substances.’ If there was personal history of such use, the requirements extended to certification of abstinence, no ongoing safety‑relevant effects, and evidence of successful therapy.

It was a requirement that the holder of a class 1 medical certificate and a commercial pilot’s licence tell CASA or a DAME about a medically significant condition that continued for longer than 7 days and impaired their ability to perform the actions authorised by the licence. As defined by CASA, drug addiction and drug dependence were medically significant conditions. CASA did not have any record of a report from the pilot about any medically significant conditions.

Since 1996, the pilot had been subject to regular medical examinations by a DAME and these were conducted annually from 2002. The questionnaire part of the examination includes questions relating to mental health problems and use of alcohol and drugs. In all but one of those examinations, the pilot’s responses are recorded as ‘no’. The exception was in November 2015 when the pilot disclosed an event in 2010 of driving with a low-range blood alcohol content.^[9] The DAME was also required in each examination to assess if there was any clinical evidence of alcohol, drug or other substance abuse. In each case the DAME response was ‘no’.

CASA advised the ATSB that due to variations between the old paper question-set and old medical records system questions-set, non-disclosures were difficult to notice. With the release of the new medical records system in March 2016, these are easier to note and act upon. At the time of the medical records assessment in 2015, the disclosure of the 2010 event was not noted as a previous non-disclosure.

If there are indications of problematic use of alcohol or other drugs by a certificate applicant or holder, CASA will request further information that may include alcohol and drug testing. For confirmed cases, CASA will suspend the certificate until the applicant or holder can demonstrate that they meet the relevant medical standard. CASA advised the ATSB that this process to address suspected or confirmed problematic AOD use was applied to 691 individuals during the period 2015-2017. Of that group, 576 individuals were subsequently issued with a certificate and 115 individuals withdrew their application or were refused a certificate. On average, CASA issues about 42,000 aviation medical certificates per year.

Industry association

The Aerial Application Association of Australia (AAAA) advised that information related to AOD risk management was integrated into a number of resources currently provided to members. This included guidance about general health and alcohol risks for pilots. Alcohol risk was also addressed in a course for chief pilots that was pending CASA approval. The AAAA did not have data related to problematic AOD use by personnel in their industry sector and were under no obligation to gather such data.

Self-referral and support services

In addition to the regulatory provisions of CASR 67 and CASR 99, CASA promoted the wellbeing of pilots on their website. The stated CASA approach was to encourage an environment of trust where pilots feel comfortable reporting any wellbeing issues, so they can receive the help and support they need to continue with their aviation career. In addition to the supports referenced in the on-line AOD course, CASA referred to an external organisation, the Human Intervention Motivation Study (HIMS), which provides peer support to pilots.

HIMS is a structured peer support and accountability process to assist pilots diagnosed with a substance use problem, to navigate the treatment and monitoring requirements. It is modelled on well-established overseas programs that have assisted 6,000 pilots return to work in the US over a 40-year period. Note that HIMS is not a regulatory process or recovery program.

Although the number of pilots that have self-referred to HIMS Australia is relatively small (less than 20), all of those were assisted by pilots within the HIMS network to satisfy the medical standards for return to work. Some of the pilots involved were general aviation pilots. HIMS Australia expects that the long-term success rate for self-referrals and assistance from HIMS will be similar to the US, which is 90 per cent.

Other occurrences and reviews

In-flight break-up

The ATSB identified four other in-flight break-ups involving Cessna 210 series aircraft in Australia. All four break-ups were to cantilever (no strut) wing models (unlike the 210B model) and three of those were associated with severe weather, including an in-flight break-up near Darwin on 23 October 2017, the day before this accident.^[10]

An in-flight break-up not involving severe weather occurred to Cessna 210L, VH-DJT, 26 km east-south-east of Cloncurry, Queensland, on 11 June 1976.^[11] The investigation carried out by a predecessor to the ATSB found that the left wing failed as a result of torsional loading in excess of design limits. That torsional overload resulted from rapid application of a large amount of right-wing-down aileron control when the aircraft was flying at a speed considerably greater than the specified manoeuvring speed. A reason for the critical aileron input was not determined but consideration was given to pilot incapacitation and potential for a birdstrike.

A search of the ATSB database for in-flight break-ups of any aircraft type since 1969 identified 15 occurrences involving certified aeroplanes, including the four involving Cessna 210 aircraft.

• Eight were associated with severe weather or non-visual meteorological conditions.
• Another three were attributed to structural deficiencies such as metal fatigue.
• In the remaining four, the primary factors were related to aircraft handling or were unverified, including one in which tailplane flutter was a possible factor in the break-up of an ex-military Strikemaster aircraft.^[12]

Alcohol and Other Drugs

In June 2006, the ATSB published Accidents and incidents involving alcohol and drugs in Australian civil aviation 1 January 1975 to 31 March 2006 (B2006/0169). This reported that the prevalence of drug and alcohol accidents was very low in Australian civil aviation. However, the author considered that where alcohol and drugs were reported as being involved, there was a very high chance of an accident, especially a fatal one.^[13] The report anticipated the introduction of a mandatory drug and alcohol-testing program with education and training to reduce the risk of pilots attempting to fly while impaired by alcohol or drugs.

Indirectly relevant to this accident is ATSB study Pilot incapacitation occurrences 2010–2014, published by the ATSB in February 2016. In this study, the ATSB found that there was an average of 23 flight crew incapacitation occurrences per year across the 5-year period 2010–2014, with 25 per cent of these affecting low capacity air transport and general aviation. Although this grouping had fewer occurrences than high capacity air transport, there was a wider variation of causes of incapacitation. In this group there was one incapacitation specifically linked to illicit drugs.

The ATSB conducted a search of the database for occurrences involving alcohol and other drug factors since 1 April 2006. This yielded seven occurrences including four fatal accidents. Some of these were occurrences where a drug/alcohol was in the pilot’s body at the time but may not have played a major or any role in the accident. A summary of these occurrences is provided in the table below.

Table 2: Occurrences since April 2006 where alcohol or drug were present

The ATSB notes that pilots engaged in non-commercial flying are generally not subject to mandatory AOD testing following an aircraft incident or accident (non-fatal). Although pilots are required to report occurrences to the ATSB, there was no assurance that pilots would include details of any problematic AOD use in their reporting.

To qualify further the ATSB occurrence data, there was no requirement for DAMP organisations to report the results of post incident or accident AOD testing to the ATSB unless it was specifically requested in accordance with the Transport Safety Investigation Act 2003.

It is probable that AOD use by flight crew involved in incidents and non-fatal accidents was under-reported to the ATSB.

__________

1. The Type Certificate Holder transferred from the Cessna Aircraft Company to Textron Aviation Inc. on 29 July 2015. All of the actions and data relating to the aircraft manufacturer in the report pre-dates the transfer.
2. When the C210B was manufactured in 1962, the Cessna Aircraft Company specified speed in (statute) miles per hour (mph). For operation of the aircraft in Australia, the airspeed indicator was modified to indicate knots (kt), which is nautical miles per hour. The placards on the instrument panel and extant documentation produced by Cessna were unmodified.
3. The airspeed parameters specified as calibrated airspeeds (CAS) are accurate values derived during the aircraft certification process using specialised equipment. On production aircraft, there are known variations between CAS and IAS associated with the position of the sensing devices and calibration of the airspeed indicator instrument. For the Cessna 210B, there was minor variation between CAS and IAS except when flap was extended and at low airspeeds.
4. National Association of Testing Authorities, Australia.
5. Half-life is the time taken for the concentration to decrease by 50 per cent.
6. Logan, Fligner & Haddix (1998) Cause and manner of death in fatalities involving methamphetamine. Journal of Forensic Sciences 43: 28-34
7. Logan, Fligner & Haddix (1998) Cause and manner of death in fatalities involving methamphetamine. Journal of Forensic Sciences 43: 28-34.
8. Li, Baker, Zhao, Brady, Lang, Rebok and Di Maggio. (2011) Drug violations and aviation accidents: findings from the US mandatory drug testing programs. Addiction. 21: 1287-1292.
9. Low-range blood alcohol content (BAC) is between 0.05 mg/L and 0.079 mg/L of breath.
10. ATSB investigation AO-2017-102 In-flight breakup involving Cessna 210, VH-HWY, 22 km E of Darwin Airport, Northern Territory, on 23 October 2017.
11. Investigation number 197600023 Cessna Aircraft Company 210L, VH-DJT, 26 km ESE of Cloncurry, Queensland, 11 June 1976.
12. Investigation number 200605843 In-flight break-up 20 km NE Bathurst, NSW, 5 October 2006 BAC 167 Strikemaster, VH-AKY.
13. This is probably influenced by under-reporting of alcohol and drugs for incidents, and the more thorough testing for substances in fatal accidents via post-mortem toxicology tests.

Safety analysis

Introduction

It was apparent from the distribution of the aircraft wreckage that the Cessna 210B, registered as VH-DBU, had broken up in flight. From analysis of the available evidence, the ATSB was able to discount a number of potential factors commonly associated with in-flight break-ups. The ATSB identified two safety factors that led to a review of the associated risk controls and a general finding.

In-flight break-up scenarios

Contextual information

In the absence of information about the aircraft flight path immediately before the break-up, the ATSB was reliant on interpretation of the accident site and wreckage characteristics in conjunction with witness information to ascertain the likely sequence of events.

It was apparent that substantial aerodynamic stresses were applied to the aircraft and the break‑up likely started with separation of the right-wing tip and progressed rapidly inboard. As that occurred, the aircraft would have immediately become uncontrollable and that would have generated further abnormal aerodynamic loading with consequent disruption.

The break-up of the right wing was notable in terms of the degree of fragmentation and the high level of torsional and reverse bending. This is not characteristic of a simple overstress situation where the excessive aerodynamic forces on the wings are generally symmetric in direction and magnitude. In that case, if the aircraft breaks up in flight, the sequence typically begins with separation of a substantial piece of each outboard wing. The failure characteristics of both wings is likely to be consistent and further in-flight disruption would be variable but not necessarily extensive.

According to the witnesses, the first indication of something wrong with the aircraft was a loud and distinctive noise described by witnesses as a sharp bang, crack of a whip, gunshot or thunder. This is consistent with a sudden structural failure caused by a high degree of aerodynamic stress, which was probably the initial failure of the right wing. The subsequent period of other noises and the witness observation of the aircraft in a steep dive are consistent with abnormal flight and progressive break-up as a consequence of right-wing failure. Witness information was not instructive as to development of the break-up.

Given the break-up likely started with complex and excessive aerodynamic forces on the right wing, the ATSB considered two scenarios in which a high level of torsional and reverse bending could be generated.

Aeroelastic flutter scenario

Aeroelastic flutter is a high-speed phenomenon involving the oscillation of a structure under the combined influence of aerodynamic, inertial and elastic forces. If unchecked, the structure will be subjected to divergent bending and torsion until the structure is overstressed and breaks up.

Certified aircraft are designed so that flutter will not occur during operation within the approved flight envelope. Based on the margins applied to establish the Vne of 196 kt for the Cessna 210B, the aircraft type was demonstrated to be resistant to flutter at airspeeds up to 218 kt.

If, however, an aircraft does not conform to the design standard, the airspeed at which flutter occurs may be lower than designed. Following are examples of airworthiness deficiencies that may reduce the airspeed at which flutter can occur:

• a reduction in structural stiffness
• unbalanced control surfaces
• incorrect control system cable tensions
• changes in the mass distribution of the wings.

The ATSB found that damage to the primary structure was consistent with aerodynamic loading and that structural integrity was not compromised by material fatigue or corrosion. There was no evidence of any defects, non-conforming repairs, or modifications that would have diminished structural strength. This was consistent with the maintenance records that showed the aircraft had been maintained in accordance with the applicable requirements including the Supplementary Inspection Documents.

Although there was no evidence of any airworthiness deficiencies, the ATSB considered the possibility that the major repairs carried out in 1972 following overstress deformation of the wings subtly affected structural stiffness of the right wing. This could not be discounted, in part because of the lack of maintenance records and fragmentation of the wing. Nevertheless, any alteration to structural stiffness was not considered to be significant, given the aircraft was subsequently operated for 5,500 hours over 45 years, including multiple maintenance inspections, without any apparent related problem. Furthermore, the left wing was repaired at the same time but was not similarly affected.

The fragmentation of the aircraft prevented a conclusive finding regarding the balance-state of the control surfaces and control system cable tensions prior to the break-up. There was nothing to indicate these were non-conforming as the recent aircraft repaint did not include the flight control surfaces and the aircraft had recently been returned to service after extensive inspection.

Another consideration in this scenario was that the abnormally high airspeed required for aeroelastic flutter to occur did not disrupt the left wing to the same degree as the right wing. This was not fully reconciled, but the ATSB considered that subtle differences between the wing shape and structure, and a variation of aerodynamic forces from control inputs and manoeuvring, could account for the observed asymmetry of effect. Additionally, as the right wing broke up, the aerodynamic loading of the left wing would be significantly altered with consequent variation in effect.

Based on analysis of the wreckage and consideration of aerodynamic principles, the ATSB found that aeroelastic flutter scenario was a viable explanation for the complex and excessive aerodynamic forces on the right wing. Given there was no metal fatigue or corrosion and no evidence of any airworthiness deficiency, there were probably no conditions that would lower the resistance of the right wing to flutter. The operational implications of this scenario are considered in a following section.

Aileron input scenario

The other scenario considered by the ATSB—aileron input—was identified as a factor in the Cessna 210L occurrence near Cloncurry in 1976 in which the left wing failed in overload. A direct comparison between the Cloncurry event and this event was not feasible because of limited information and VH‑DBU was fitted with a strut-braced wing that was different in structural configuration and aerodynamic properties to the cantilever wing of the Cessna 210L.

Nevertheless, the same scenario could apply in which the pilot rotates the control column which deflects the ailerons differentially, as designed, to create an upward force on one wing (aileron down) and a corresponding downward, or reduced upward, force on the other wing (aileron up). If the control column is rotated rapidly and to a large degree while the airspeed is above the manoeuvring speed, the aerodynamic loading on the outboard section of the wing influenced by the ailerons can exceed the design strength.

The ATSB considered the capacity of the relatively long span ailerons of Cessna 210B models to generate torsional loading over a larger area of the wing than would be the case for later model 210 aircraft with different wing design. It was noted that one area of disruption of the right wing was roughly coincident with the span of the ailerons, which could be related to aileron input but could also be attributed to the span-wise variation in wing strength and stiffness. Even if the wing design did account in part for the pattern of disruption, there is no evidence that the design did not meet the required standard or was problematic in this occurrence.

Another consideration in this scenario was accounting for the variation in magnitude between right- and left-wing damage. Although aileron deflections are differential, the down-going wing (aileron up) in normal manoeuvring flight results in a reduction of lift whereas the up-going wing (aileron down) results in an increase of lift. This produces higher aerodynamic loading on the up‑going wing, which in this scenario would be the right wing.

A single large aileron input would not produce the reverse bending observed in the wreckage. This may be attributable to multiple reverse control inputs, or complex loading of the wing during the break-up sequence.

Aileron inputs also induce torsional loads in the wing, which due to the differential aileron inputs would be in opposite directions on the left and right wings. There was no clear indications of opposing torsional (twisting) deformation in the wings; however, the magnitude of these loads before failure of the structure may not have been sufficient to have left evidence.

Based on analysis of the wreckage and consideration of aerodynamic principles, the ATSB found that there was not strong evidence for the aileron input scenario but it could not be discounted. The operational implications of this scenario are considered in the next section.

Operational considerations

Contextual information

The pilot’s radio transmission after getting airborne at Albany indicated the pilot would track to the north-west towards Bunbury and climb to a cruising altitude of 6,500 ft above mean sea level (AMSL). If the pilot had departed as indicated, the aircraft would have passed over the area 30 km to the north-west of Albany at around 1045, at or close to 6,500 ft.

This, however, did not occur as the pilot did some flying in the local area and was then observed operating to the north-west of Albany before the in-flight break-up occurred at about 1100. The pilot’s intentions regarding this local flying are not known but the apparent variation to the pilot’s departure broadcast was not necessarily significant for operations outside of controlled airspace.

Aircraft limitations and handling

The Cessna 210B airspeed limitations relate to the aerodynamic forces the aircraft could sustain without structural damage. With regard to the flutter scenario, the key limitation was Vne as any airspeed above that figure reduced the margin to onset of divergent and destructive aeroelastic forces.

For the aileron input scenario, the key limitation was maximum manoeuvring speed (Va). Essentially, if the indicated airspeed (IAS) was above 115 kt and the pilot made abrupt or large control inputs, the consequent aerodynamic forces could exceed the design strength of the aircraft. As the IAS increases, the risk of excessive aerodynamic forces from control inputs increases at a disproportionately higher rate according to the square of the airspeed value.

Based on the likely airworthiness of the aircraft and the absence of any significant weather, it follows that for both scenarios, aeroelastic flutter and aileron input, the aircraft was operated outside of the relevant airspeed or handling limitations up to the point of failure of the right wing. This is analysed in terms of the pilot functioning normally and, in the following section, in terms of pilot impairment or incapacitation.

The pilot was qualified for the flight and was reported to be competent and experienced in the challenging field of aerial application operations. No one reported that the pilot was in the habit of handling aircraft aggressively or was inclined to perform aerobatic-type manoeuvres. There was no apparent reason for the pilot to operate outside of the limitations.

It is possible that the pilot of VH-DBU encountered a large bird in the vicinity of the accident and acted instinctively to avoid a collision with excessive control inputs. The pilot reportedly sustained injuries from a birdstrike in July 2014 and that experience might have influenced the pilot to respond differently to any subsequent bird encounters. There was no evidence that a bird hazard was involved in the accident but the ATSB could not rule it out as a possibility.

Given the pilot operated the C210B in the private category on the basis of a class endorsement and flight reviews in other aircraft types, there were no records relating to pilot awareness and understanding of C210B operating limitations. Nevertheless, it is likely that the experienced commercial pilot was aware of limitations such as the Vne (never exceed airspeed) marked on the airspeed indicator and the Va (manoeuvring airspeed) as specified on an instrument panel placard and defined in the Owner’s Manual.

The ATSB notes that the Va was specified as 132 mph which has equivalent value as an airspeed indication of 115 kt. If the pilot had applied large control inputs on the basis that a safe indicated airspeed for that manoeuvring was 132 kt (rather than 132 mph/115 kt), there would have been increased risk of aircraft overstress at indicated airspeeds above 115 kt. It is likely that the experienced commercial pilot was aware of the variation between the two airspeed units and operated accordingly.

In relation to the pilot’s general awareness, the airspeed limitations of other aircraft types flown by the pilot were similar to or lower than the Cessna 210B’s. The aerial application aircraft flown by the pilot are typically certified in the utility category with higher maximum load factors but the difference and the potential effect was not significant.

Normal category aircraft such as the Cessna 210B are not generally equipped with G indication or warning systems so pilots rely on feedback from the flight control systems and physiological indications to ascertain the approximate load factor exerted on the aircraft. Although these methods are imprecise, in normal circumstances a pilot (and especially an experienced pilot) would be expected to recognise development of an abnormally high load factor as it related to the aircraft as a whole, and respond accordingly.

The situation is more complex in the aileron input scenario because flight load factor is not directly related to torsional loading of the wings. If rapid rolling motion is induced during a high-G manoeuvre to produce additional and imperceptible asymmetric loading known as ‘rolling G’, the pilot may not be aware that the cumulative effect exceeds the maximum load factors.

A key factor in both scenarios is airspeed. In the absence of direct information about airspeed, the ATSB considered the cruise airspeed of 145 kts to be a useful reference point. In normal operation of a Cessna 210B, the indicated airspeed will be above the Va of 115 kt once the aircraft is in cruise or descent.

To exceed the Vne of 196 kt, the aircraft would need to be in a steep descent with substantial engine power. There is no direct evidence of this but there is insufficient information about the flight path and engine power to disqualify it as a possibility.

Based on the information available to the ATSB, there was no evidence of any conditions that would dispose the pilot in normal circumstances to exceed the operational limitations of the aircraft. In this context, the ATSB analysis below considers the abnormal circumstances of pilot impairment or incapacitation.

Pilot incapacitation or impairment

Pilot incapacitation or impairment can occur due to a number of reasons, such as a medical condition or the effects of drugs or alcohol.

The medical history of other family members and the reported lifestyle risk factors indicated to the family GP that a sudden cardiac event was a reasonable possibility. However, the postmortem examination did not identify any cardiac disease and the aviation medical examinations did not detect any cardiac condition that would increase susceptibility to incapacitation due to cardiac arrest. Irrespective of whether the pilot was at elevated risk of a cardiac event, the presence of methylamphetamine in this case increased risk of pilot incapacitation.

Based on expert opinion, the ATSB considered that the concentration of methylamphetamine detected in the liver corresponded to a likely concentration in the blood at the time of the accident that exceeded therapeutic levels.

The effects of methylamphetamine at any particular time will vary according to method and timing of administration, substance amount, individual physiology, and history of use. However, methylamphetamine can significantly impair important cognitive and psychomotor functions necessary for safe operation of an aircraft. In this case, details about administration and dosage were not available.

Although the presence of methylamphetamine in the pilot’s system was established, the lack of information about dosage and variability in the effects of methylamphetamine on individuals prevented the ATSB making a finding as to its influence on this accident.

Nevertheless, the ATSB was not able to discount that the presence of methylamphetamine in the pilot’s system had an adverse effect on the accident and found that it increased the risk of operational misjudgements or mishandling due to impairment and involuntary action or inaction due to incapacitation. Examples of involuntary actions are slumping forward with forward pressure on control column, erratic control inputs, and no control inputs in response to developing loss of control.

Management of alcohol and other drugs in aviation

The ATSB acknowledges the complexities and sensitivities of substance use and considers that deliberation of the pilot’s personal circumstances and motivations would not enhance aviation safety. It should be noted, also, that there is no evidence that the pilot operated any flights, other than the accident flight, while under the influence of alcohol or other drugs.

Although the in-flight break-up occurred during a private flight, the pilot held a commercial pilot's licence with a Class 1 aviation medical certificate and was active in the aerial application industry. As such, the ATSB sought to understand how the risk of substance use was being managed by organisations in relation to the pilot and more generally.

As the aviation safety regulator, the Civil Aviation Safety Authority (CASA) had an important role in managing five key activities:

• oversight of organisations to ensure implementation and compliance of Drug and Alcohol Management Plans (DAMP)
• on-line alcohol and other drug (AOD) education
• no-notice AOD testing across the aviation industry
• certification of pilots and other licence holders according to medical standards
• promotion of flight crew wellbeing, self-referral, and treatment.

Based on the sample of three aerial application operators and this pilot, and on 3 years of no-notice test data, there was evidence that CASA was carrying out the regulatory activities as prescribed. It was beyond the scope of this investigation to establish whether the scope, frequency and implementation of no-notice testing was effective in deterrence and detection of drug use.

In general, the aviation medical certification process was identifying individuals at risk of problematic AOD use and for confirmed cases was preventing further operation until the individual demonstrated ongoing conformance with the medical standard. A relatively large proportion of identified individuals were issued with an aviation medical certificate and there was no data to indicate that the process was ineffective. In relation to this accident, the pilot did not disclose relevant information during annual medical examinations and, when the pilot disclosed a driving under the influence of alcohol offence from a previous period, CASA did not identify this as a risk indicator.

The ATSB observes that as a once a year, or less frequent, snapshot of medical status and with reliance in part on pilot disclosure, the aviation medical certification process has limited opportunities to identify problematic AOD use.

The promotion of wellbeing and facilitation of self-referral plays an important part in reducing the risk posed by alcohol and other drugs. This was a developing area of CASA activity. Outside of the regulatory framework, the aerial application industry association provided guidance about AOD to pilots and operators with an emphasis on the risk of alcohol. This did not extend to advisory information about self-referral or support organisations.

Aircraft operators have an important role in implementing DAMPs, as the three operators that employed the pilot in the 12 months prior to the accident had done. In the five-year period before the accident, the pilot had been AOD-tested three times, each with no detection of alcohol or drugs.

The pilot received AOD education in 2013, which informed that the use of substances such as methamphetamine are not compatible with aviation, and that pilots could be tested at any time. This training explained the serious consequences of non-negative test results, but did not identify that self-referral was an option that allowed for a return to employment. It was reported that this AOD education was repeated in following seasons.

As was the case for CASA no-notice testing, the ATSB notes that there are inherent limitations to induction AOD testing and other DAMP testing in the ongoing detection of problematic AOD use. In the case of pilots employed seasonally and as contractors, sometimes in remote locations, there are relatively less opportunities for operators to educate, test and monitor.

As part of the review of AOD risk controls the ATSB reviewed the following studies and data:

• ATSB study of occurrences involving alcohol and other drugs for period 1969–2006
• ATSB study of data for incapacitation 2010-2014
• CASA no-notice testing data for 2015-2017
• CASA Aviation Medicine data for 2015-2017
• research on no-notice testing by the US FAA from 1995-2005
• Australian aviation occurrence data.

Although infrequent, past occurrences have shown that there is potential for alcohol and other drugs to contribute to accidents either through cognitive impairment or incapacitation.

Overall, these studies and data did not indicate that the use of alcohol and other drugs was problematic across the aviation sector. However, the ATSB study of occurrences involving alcohol and other drugs was completed 12 years ago (before implementation of DAMPs) and situational factors may have changed during the intervening period. There was also no aggregate data about DAMP testing results or self-referrals managed through DAMPs.

In summary, the ATSB found that the required risk controls for problematic AOD use were in place and generally operated in a compliant manner. There was no data that indicated AOD use was a systemic problem within aviation.

Nonetheless, the ATSB considered that there were opportunities for organisations to collect more data and to enhance the extant risk controls for problematic AOD use.

The ATSB acknowledges that self-referral by a pilot with problematic AOD use to a Designated Aviation Medical Examiner (DAME), DAMP, or CASA may be perceived as a threat to ongoing employment in aviation. However, problematic AOD use is a clear threat to aviation safety and self-referral initiates a defined process to counter the hazard while providing an opportunity to return to work with support. In other words, the risks to pilots associated with self-referral are less than the health, safety, and legal risks of continuing to operate with problematic substance use.

A defined protocol exists within the CASA aviation medical framework for pilots in stable remission from the problematic use of substances to return to work. Employer and independent peer support organisations, such as the Human Intervention Motivation Study (HIMS), are becoming more widely available to assist pilots with the safe return to work.

The ATSB acknowledges that CASA is providing information to pilots about the self-referral pathway and suggests that operators and industry associations consider the availability of information and services to pilots and safety sensitive aviation activities within their area of influence.

Findings

From the evidence available, the following findings are made with respect to the in-flight break-up involving a Cessna Aircraft Company C210B, registered VH-DBU, 30 km north-west of Albany, Western Australia on 24 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• For reasons that were not established, abnormal operation of the aircraft produced high levels of unusual aerodynamic loading on the right wing that exceeded the strength of the wing and initiated an in-flight break-up that fatally injured the pilot.

Other factors that increased risk

• The presence of methylamphetamine in the pilot’s system increased the risk of operational misjudgements, aircraft mishandling, and incapacitation.

Other findings

• No structural deficiency or damage that would have contributed to the in-flight break-up were identified and the local meteorological conditions were not conducive to inadvertent overstress.
• The required risk controls for problematic alcohol and other drug (AOD) use were in place and generally operated in a compliant manner. In addition, there was no data that indicated a systemic problem with problematic AOD use in aviation.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Civil Aviation Safety Authority
• Textron Aviation (Type Certificate Holder for Cessna Aircraft)
• Aircraft operators
• Aircraft maintenance organisations
• Expert pharmacologist.

The ATSB acknowledges the support of Western Australia Police in Albany, Parks and Wildlife Service (Department of Biodiversity, Conservation and Attractions) personnel in Albany and Walpole, and State Emergency Service personnel in Albany and Denmark.

References

Li, Baker, Zhao, Brady, Lang, Rebok and Di Maggio. (2011) Drug violations and aviation accidents: findings from the US mandatory drug testing programs. Addiction. 21: 1287-1292.

Logan, Fligner & Haddix (1998) Cause and manner of death in fatalities involving methamphetamine. Journal of Forensic Sciences 43: 28-34.

McIntyre, Hamm & Bader (2011) Postmortem methamphetamine distribution. Journal of Forensic Research 2: 122 doi: 10.4172/2157-7145.1000122

Nagata, Kimura, Hara & Kudo (1990) Methamphetamine and amphetamine concentrations in postmortem rabbit tissues. Forensic Science International, 48:39-47

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority and other organisations that provided input to the report. Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.

General details

Pilot details

Aircraft details

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 23 October 2017, a charter flight operated by Air Frontier using a Cessna C210L aircraft, registered VH-HWY (HWY), was tasked to transport a coffin with a deceased person from Darwin Airport to Elcho Island, Northern Territory. There were two pilots on board – the supervising pilot in command in the right seat and the pilot in command under supervision on the left. After departing Darwin at 1307 CST, the left seat pilot requested air traffic control (ATC) for a 5 NM diversion left or right of track to avoid adverse weather. The aircraft was cleared to divert right of track, and to climb to 9,500 ft. After four minutes, ATC asked whether further track diversions were required; first 10 NM, then 20 NM, which were accepted.

At 1332, the aircraft entered an uncontrolled descent before it collided with terrain. The pilots were fatally injured, and the aircraft destroyed.

What the ATSB found

Shortly after VH-HWY diverted to avoid adverse weather, the aircraft entered an area of strong convective activity and rapidly developing precipitating cells, which resulted in it experiencing severe turbulence and possibly reduced visibility for the pilots. While flying in these conditions, a combination of airspeed, turbulence and control inputs probably led to excessive loading on the aircraft’s wings, which separated from the fuselage in-flight before it collided with terrain.

The ATSB found that the pilots had no experience flying in the ‘build-up’ to the wet season in the Darwin area. Although pairing a supervisory pilot with a pilot new to the company was likely to reduce risk in other instances, in this case it did not adequately address the weather-related risks because neither pilot had experience flying in the region during the wet season.

Safety message

Recognising and avoiding tropical weather conditions that present significant hazards to flight can be particularly challenging for pilots without operational experience in the tropics. Knowing how to reduce the risk, including the appropriate distance to keep away from thunderstorms and cumulus clouds predominantly comes through exposure to those conditions. In many cases, deviations of 10 NM to avoid phenomena like towering cumulus clouds may not be sufficient.

Pilots are encouraged to use all available resources to avoid adverse weather, including forecasts and requesting ATC assistance. Awareness of the weather avoidance actions of other pilots in the area can also be useful. There is considerable value in ongoing education and guidance for pilots in recognising and responding to deteriorating weather conditions during flight. This can include additional (cue-based) training, guidance specific to the risks in the region, education initiatives from industry bodies, and learning from the knowledge and experience of peers.

Smaller operators employing pilots with limited exposure to local conditions, such as in the tropics, can better manage related risks by pairing new pilots with ones experienced in those conditions.

VH-HWY in Darwin

Source: Air Frontier

The occurrence

On 23 October 2017, a charter flight operated by Air Frontier using a Cessna C210L aircraft, registered VH-HWY (HWY), was tasked to transport a coffin with a deceased person from Darwin Airport to Elcho Island, Northern Territory. There were two pilots on board: the pilot in command under supervision (ICUS)^[1] in the left seat (the ‘left seat pilot’), and the supervisory pilot in the right seat (the ‘right seat pilot’), the nominated pilot in command (PIC). The flight was operating under visual flight rules (VFR),^[2] and the pilots submitted a flight plan that documented a planned cruising altitude of 7,500 ft to Elcho Island. They also checked the weather and NOTAMs,^[3] and completed their flight planning at about 1045 Central Standard Time.^[4]

At about 1100, a funeral services staff member arrived at Air Frontier’s hangars at the airport with the coffin. The two pilots, the company’s training manager and funeral services staff loaded the coffin into the aircraft’s cabin and secured it. At about 1115, HWY taxied out to the engine run-up bay. During the engine run-up procedure, the pilots identified a drop in the magnetos. They returned to the hangars where the chief engineer identified a fouled spark plug. He resolved the issue by running the engine at a high RPM for a short period.

Shortly after, HWY again taxied out for departure. The pilots requested the VFR route 2 to Elcho Island (Figure 1). At 1304, the left seat pilot called ‘ready’ to air traffic control (ATC)^[5], and was cleared for take-off on runway 29 at 1307.

Figure 1: Darwin Airport and pertinent features on the visual terminal chart

Source: Airservices, annotated by ATSB

As the aircraft climbed through 700 ft, the left seat pilot contacted ATC and was cleared to climb to 7,500 ft and turn onto a heading of 320° (items 1 and 2 in Figure 2). About 5 minutes later, the controller cleared the aircraft to turn right onto a heading of 100° (item 3 in Figure 2).

At 1322, as the aircraft tracked east and climbed through 6,100 ft, the pilot requested diverting 5 NM left or right of track due to weather (item 4 in Figure 2), and to climb to 9,500 ft. Air traffic control advised that diverting left of track was unavailable due to the active restricted airspace nearby (Figure 1), and cleared a diversion up to 5 NM right of track, and a climb to 9,500 ft. At 1325, the controller asked the pilot to advise if further clearance was required. The pilot responded, ‘affirm, request up to 10 miles right of track’.

Soon after, the aircraft turned north-east and continued to climb for 4 minutes to about 10,000 ft. At 1329, the controller recalled observing that the aircraft abruptly turned to the south-west. The controller asked the pilot if they required alternate tracking (item 8 on Figure 2). The pilot replied ‘affirm’ and the controller cleared the aircraft to deviate up to 20 NM right of track. The aircraft continued to track south-west.

Figure 2: Aircraft track with pertinent broadcasts between HWY and ATC

Source: RAAF radar data overlaid on Google Earth, annotated by ATSB

Between 1329 and 1331, ATC radar recorded the aircraft descending and climbing between 9,600 and 10,100 ft (see Recorded data section). At 1332:20, its altitude information (radar mode ‘C’) showed the aircraft descending before it disappeared from the radar display (item 8 in Figure 2). The controllers quickly assessed its disappearance as abnormal.

About 10 seconds later, ATC audio recorded three short transmissions, possibly from separate ‘push-to-talk’ activations from the aircraft’s radio. At 1332:45, the controllers recalled that the aircraft’s altitude (mode C) briefly reappeared (local radar data indicates the aircraft was at approximately 5,000 ft). The controllers reported that the aircraft disappeared from the radar screen 15 seconds later. Over the next 10 minutes, they unsuccessfully attempted to call the pilot. They then declared a ‘distress phase’^[6] and requested an aircraft in the area to assist with looking for the missing aircraft.

Witnesses near Howard Springs (Figure 1) reported sighting the aircraft (HWY) descending rapidly in a relatively flat attitude, possibly rotating, with a portion of each wing missing. One of the witnesses that saw the aircraft impact terrain called emergency services, and then attended the scene.

Emergency services started arriving within 10 minutes of the impact. The main fuselage was located less than 1 NM from the aircraft’s last recorded radar position. Both of its wings were found about 700 m south-east of the fuselage.

The pilots were fatally injured in the accident and the aircraft was destroyed.

__________

1. In command under supervision: according to CASA, ‘a person flies an aircraft as pilot acting in command under supervision if, during flight time in the aircraft, the person performs the duties and functions of the pilot in command while under the supervision of the pilot in command approved for the purpose by the operator of the aircraft’.
2. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
3. A Notice to Airmen (NOTAM): alerts pilots of potential hazards along a flight route or a location that could affect the safety of flight.
4. Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours.
5. The Australian Defence Force provides the air traffic control services associated with Darwin Airport.
6. Distress phase: A situation wherein there is reasonable certainty that an aircraft and its occupants are threatened by grave and imminent danger or require immediate assistance

Context

Pilot information

Right seat pilot

The right seat pilot was the pilot in command of the aircraft and supervising the left seat pilot. He held a commercial pilot licence (aeroplane) issued in March 2016 and a class 1 medical certificate valid until December 2017. At the time of the accident, he had a total of 705.9 hours of aeronautical experience, including about 400 hours in C210 aircraft. He was appropriately endorsed to operate VH-HWY as pilot in command, and held an instrument rating for multi-engine aircraft. In the 7 months prior to the accident, he had not logged any instrument flight time.

After starting with Air Frontier in April 2017, the pilot had completed 415.8 hours of flying. He was based at Maningrida, NT from June 2017 onwards before being transferred to Elcho Island.

On the morning of 23 October before the accident flight, the pilot completed a proficiency check with the training manager to act as a supervisory pilot in single engine aircraft. The 0.9-hour check flight in the circuit at Darwin Airport included proficiency in aircraft handling, handover/takeover procedures and a discussion of aspects such as the potential for parallax error when viewing aircraft instruments, handling high workloads, supervisory pilot responsibilities and wet season operations. The pilot’s training record indicated covering VFR procedures, including cloud separation, maintaining visual meteorological conditions (VMC), cockpit procedures, and airmanship.

Left seat pilot

The left seat pilot was the pilot in command under supervision (ICUS). He held a commercial pilot licence (aeroplane) issued in September 2012 and a class 1 medical certificate valid until May 2018 (with a restriction for distance vision correction). At the time of the accident, the pilot had a total of 381.4 hours of aeronautical experience, including 12.7 hours in the C210 aircraft. He was appropriately endorsed to operate VH-HWY as pilot in command, and held an instrument rating for multi-engine aircraft obtained in 2012. The left seat pilot underwent an instrument proficiency check in May 2017. He had a total of 34.4 instrument hours in flight and 35 hours in a simulator.

The pilot’s first flight in a C210 aircraft was on 15 September 2017. He then logged a total of 5.4 hours dual time.

After moving to Darwin in early October 2017, the pilot conducted a number of observation flights. He started flying as pilot ICUS on October 14 and completed three flights with a total of 7.3 hours. He had not signed Air Frontier’s operations manual or completed what they called a Professional Pilot Development Course agreement in accordance with its procedures for pilots ICUS.

Fatigue

The ATSB obtained available evidence to assess the likelihood of the pilots experiencing fatigue. This included factors that affect the ability to maintain adequate alertness, rostering, other aspects that affect sleep opportunity and sleep obtained. There was insufficient evidence to ascertain whether either pilot was likely experiencing a level of fatigue known to affect performance.

Medical and pathological information

A prescription medication belonging to the left seat pilot was found in the wreckage. The pilot’s toxicology report confirmed the presence of this medication. The medication was not recorded in the pilot’s medical file with Civil Aviation Safety Authority (CASA).

The ATSB followed up available information sources, including the pilot’s DAME, but could not definitively determine why the medication was not recorded in the pilot’s medical files. Civil Aviation Safety Regulations (1998) Part 67 describe the requirements for aviation medicals. One of the criteria for a class 1 medical certificate prohibits the use of ‘any over‑the‑counter or prescribed medication or drug… that causes the person to experience any side effects likely to affect the person to an extent that is safety‑relevant’.

Further, medical certificate applicants are required to answer ‘every question asked by the examiner that the examiner considers necessary to help…CASA decide whether the applicant meets the relevant medical standard’. They are obliged to notify CASA of changes in medical conditions that impair their ability to ‘do an act authorised by the license’.

The following extracts from CASA-developed brochures are particularly relevant to pilot medicals.

DAMEs and pilots together should foster a culture where it is likely that pilots will feel comfortable disclosing medical problems, even if they may impact on their ability to maintain an aviation medical.

Your DAME…will expect you to answer both written and verbal questions, honestly and fully...

Under the clinical practice guidelines for designated aviation medical examiners (DAMEs), certain risk assessment protocols allowed them to take into account the pilot’s need for medication use. That assessment involved reviewing past and current symptoms of certain conditions, an applicant’s compliance with medications and treatments, and any relevant side-effects.

A CASA brochure states ‘only 0.29% of all initial and renewal medical certificates were refused by CASA during 2016-2017’. In the case of prescription medication, once it is declared the safety-relevance of the condition as well as medication can be considered.

Aircraft information

General overview

The Cessna Aircraft Company 210L is a six-seat, high cantilever wing, single-engine aircraft equipped with retractable tricycle landing gear and was designed for general utility purposes.

The accident aircraft, HWY, was manufactured in the United States (US) in 1974. It was first registered in Australia in 1988, with a total time in service of 1,456.1 hours. The aircraft was to operate in the charter category and maintained under a CASA-authorised system of maintenance.

The aircraft was powered by a Teledyne Continental IO-550P engine. The wing construction consisted of a forward spar, main spar, conventional formed sheet-metal ribs and aluminium skin. The inboard section of each wing, forward of the main spar, was sealed to form an integral fuel tank. The fuel system is essentially gravity-flow from the tank outlets to the selector valve, with pump augmentation from the valve to the engine.

The US Federal Aviation Administration’s (FAA) Airworthiness Directive (AD) 2012‑10-04 Wing main spar lower cap inspection applied to HWY. This AD required an inspection of the left and right wing lower main spar caps for cracks. An inspection of HWY conducted in accordance with the AD in June 2012 identified no defects. The aircraft did not fly between November 2014 and March 2016 (with a total time in service of 5,847 hours) and during this time, the wing main spar carry-through was replaced with a serviceable item due to corrosion. Since March 2017, HWY was operated and maintained by Air Frontier under an approved system of maintenance.

A review of the aircraft maintenance records did not identify any evidence of accident-related damage to the aircraft, including its wings. In addition, there was no evidence of overdue scheduled maintenance, including ADs.

On 26 September 2017, following a periodic inspection of the aircraft, a new maintenance release was issued (current at the time of the accident). A scheduled, 50-hourly inspection was conducted on the morning of the accident (6,499.2 airframe hours). There were no reported concerns with aircraft serviceability when it departed Darwin Airport before the accident flight nor did the pilots report any aircraft-related issues to ATC during the flight.

Aircraft load factors

The four forces acting on an aircraft in flight are lift, weight, thrust and drag. The ratio of lift to weight is the load factor (n). In straight and level flight, lift and weight are the same, so n=1 and the pilot experiences a force of 1 g. Lift can be calculated using the following equation.

L = C_L ½ ρ V² S

{that is, lift (L) is equal to the coefficient of lift (CL) x half the density (ρ) x velocity squared x the wing surface area (S)}.

For a given wing design, lift is proportional to the angle of the wing relative to airflow (angle of attack) and proportional to the square of wing velocity (airspeed). The pilot increases or decreases lift either by changing the angle of attack or the airspeed. As the aircraft’s wings produce lift, its structural limit is the strength of the wings. Structural limits are based on the load factor, which is affected by any one or combination of the following:

• full or abrupt control movement above VA
• banking or turning – for example, a 60-degree turn is 2 g^[7]
• windshear, turbulence or gusts – severe turbulence is defined as variations in vertical acceleration greater than 1 g
• disorientation, unusual attitude and/or recovery can result in exceeding load factor limits
• spiral dive and/or recovery.

Before an aircraft is certified, its structures must meet structural design standards. Section 2 of the Pilot Operating Handbook for HWY specified load limits with the flaps up as +3.8 g and -1.52 g, and flaps down as +2.0 g. The handbook stated that the ‘design load factors are 150 per cent of the above, and in all cases the structure meets or exceeds design loads’. Thus, the ultimate load for the aircraft was 5.7 g, and US Federal Aviation Regulation 23 (which governed its design) stipulated that the structure must be able to support ultimate loads without failure for at least 3 seconds.^[8]

The operating flight strength presented in a V-n diagram (Figure 3) shows the flight envelope. The manoeuvring speed (VA) for HWY was 118 kt (at maximum take-off weight)^[9], maximum structural cruise speed (VNO) was 165 kt and never exceed speed (VNE) was 196 kt. An aircraft must be operated within the envelope^[10] to prevent structural damage, or stall.^[11]

An envelope exists for gust loads to outline the aircraft’s limitations to withstand a 30 ft per second gust load. Moderate turbulence, for example, is defined as 20-35 ft per second gusts and severe is 36-49 ft per second.

Exceeding the flight load limit below VA results in a stall, whereas exceeding the flight load limit at a speed above VA has the potential to damage the aircraft’s structure.

Figure 3: Representation of operating flight strength (V-n) diagram

Source: ATSB

Operational information

Planned flight path

The flight plan documented a planned altitude of 7,500 ft and a magnetic track of 082° direct to Elcho Island. The recorded fuel upload was 336 litres, with a planned fuel burn of 55 litres over the estimated flight time of 1 hour 52 minutes. The planned departure time was 1130.

On departure, the pilot of HWY amended the plan to track via the published VFR route 2. Airservices Australia En Route Supplement Australia – Flight plan requirements, stated ‘VFR aircraft departing and arriving [Darwin] DN…are required to plan via a published DN VFR Route,’ VFR route 2 was the published route in the direction of Elcho Island.

Weight and balance

The aircraft was loaded within its weight and centre of gravity limitations for the flight. The recorded weight of the coffin was 95 kg. The estimated aircraft weight at take-off was 1,624 kg, and at its last position was 1,603 kg. There was no evidence to indicate any weight and balance issues, including a possible load shift in flight.

Meteorological information

Weather in the ‘build-up’ to the wet season

Weather conditions in Darwin and surrounding areas are typical of the Australian tropics, and in the wet season (October to April), the prevailing conditions are more hazardous to flying. Among the Bureau of Meteorology’s (BoM) weather advice pamphlets for pilots, Flying the Tropics (2012) is particularly relevant. It describes the wet season as ‘a time of unstable atmospheric conditions due to high humidity and temperatures’. The build-up to the monsoonal part of the wet season (October and November) is typified by a ‘gradual increase of the convective cloud and humidity’.

Thunderstorms and towering cumulus cells

According to BoM, weather conditions in Darwin during the build-up can include thunderstorms with clouds up to 45,000 ft that usually develop in the afternoons, and cells that develop rapidly. As a thunderstorm is growing, updrafts in the range of 15 to 30kts are common with potentially higher speeds. The BoM Flying the Tropics guide (2012) includes the following about thunderstorms in the area.

The peak frequency of thunderstorms is in the vicinity of Darwin with over eighty thunder-days per year…Thunderstorms in the transition periods tend to be more isolated than during the wet season. These frequently have high bases, flying below which may result in strong downdrafts being encountered…These updrafts can exist alongside downdrafts of similar strength…resulting in potential for severe turbulence and loss of aircraft control if flying into such conditions.

With regard to speed of development, BoM indicated that a cell could develop from ‘not much’ to a towering cumulus with a cloud top of 15,000 ft within 15-20 minutes. In the Howard Springs area (near the accident site), cells develop at least once a fortnight in the wet season.

Towering cumulus clouds are more prevalent in the wet season (Figure 4, left). They differ from cumulonimbus clouds (CBs) in that they are not accompanied by lightning and thunder. However, they have powerful updrafts, downdrafts and lateral air movements (Figure 4, right).

Figure 4: A towering cumulus (left) and the typical cycle of up- and down-drafts (right)

Source: namesofclouds.com and kiwi.atmos.colostate.edu

Risks of turbulence

The risks to flying posed during build-up conditions, and thunderstorms lie in the turbulence produced. The BoM’s Hazardous Weather Phenomena: Turbulence guide (2014) describes convective turbulence and its potential impact on flight safety. Although the guide references cumulonimbus clouds, the following information about turbulence is equally relevant to towering cumulus clouds.

Convective turbulence in association with cloud is initiated by surface heating and/or low-level convergence…The convection is enhanced by the release of latent heat during the process of condensation and subsequent warming and destabilisation of the cloud environs. All cumulonimbus clouds should be considered to be turbulent. Hence within an aviation weather forecast the mention of cumulonimbus flags severe turbulence…The most likely turbulent areas in cumulonimbus clouds are:

- the updraft/downdraft boundaries within the cloud
- the leading edge of the gust front
- above the cloud tops
- in any funnel clouds extending from the cloud base...
- in the upper parts of the updraft within the cloud.

Updrafts are generally stronger than downdrafts, and tend to be strongest in the middle and upper parts of the cumulonimbus.

In conditions such as towering cumulus clouds or thunderstorms, the speed of vertical updrafts has the potential to cause severe turbulence, which BoM defined as ‘large abrupt changes in attitude and/or altitude’ with a ‘momentary loss of control’.

Forecast weather

The area forecast for Darwin valid at the time of the accident flight, included winds of 10 kt from the south-east at 3,000 ft above mean sea level (AMSL) and from the south at 10,000 ft AMSL. Isolated cumulonimbus and towering cumulus clouds were forecast, with tops at 45,000 and 25,000 ft AMSL, respectively. The forecast included broken^[12] stratus clouds in thunderstorms and showers of rain and scattered cumulus/stratocumulus. Thunderstorms with rain and visibility reducing to 1 km, and showers with visibility reducing to 2 km were forecast, along with smoke and ‘dust devils’ over land.

The aerodrome forecast (TAF) for Darwin issued at 0843 and valid from 0930 to 1530 included south-easterly wind at 5 kt, visibility greater than 10 km and few cloud at 3,000 ft. The temperature at 1230 was forecast to be 31°C and the QNH^[13] 1009 hPa.

Weather encountered by the aircraft

On the day of the accident, the environment was typical of the start of the Northern Territory wet season known as the ‘build‑up’ period.

A thunderstorm to the north of Darwin, combined with the north-west sea breeze, triggered a convective cell to rapidly develop between 1300 and 1330, about 19 km to the north-east, that is, between Howard Springs and Koolpinyah (Figure 1). The top of the cell was 6,000 to 7,000 ft at 1300, 9,000 ft at 1320, 13,000 to 14,000 ft at 1330, and about 14,000 ft at 1340. The developing cumulus clouds likely produced strong updrafts or downdrafts.

Figure 5 shows the aircraft’s track superimposed on weather radar (showing precipitation) and the satellite images (showing cloud). These images indicate the aircraft tracking in close proximity to a precipitating cell and a rapidly developing towering cumulus cloud.

At about the same time (from 1300 to 1330), ATC data shows that other aircraft to the east of Darwin Airport deviated around the weather. An inbound aircraft from the east that deviated south to avoid a large cell reported it having a cloud top of 14,000 ft. Shortly after, another aircraft reported a large, black cell in the area.

Witnesses saw a large cumulus cell form over the Howard Springs area before the accident, and described it as a regular occurrence in the build-up season. Some recalled the cloud went ‘very black’ at the time of the accident.

The pilots of a number of aircraft arriving into Darwin at about 1300 recalled that the adverse weather in the region was ‘growing’. One pilot reported that the cell over Howard Springs had an anvil shape that was flattening out. This pilot also indicated that he may have had reservations flying at 9,500 ft, and would have requested a deviation of at least 20 NM south of their planned track. Another pilot inbound to Darwin on an IFR flight undertook a deviation around the storm.

Figure 5: Aircraft track superimposed on weather radar (left) and satellite image (right)

Source: Bureau of Meteorology, annotated by ATSB

Air traffic control

The Royal Australian Air Force (RAAF) provides air traffic control (ATC) services for Darwin. The ATSB interviewed a number of controllers on duty at the time of the occurrence. Audio recordings and other relevant information were also obtained.

Pilot requests for weather deviations

Audio data confirms that one of the pilots requested ‘five miles left and right of track due weather’ and ATC cleared HWY to ‘deviate up to five miles right of track only due Restricted airspace’. The Restricted airspace was active due to a military exercise but none of the aircraft involved in it were airborne at the time. Therefore, had the pilot of HWY indicated a need to deviate left of track only (by using the phraseology ‘require’), ATC indicated that it would have facilitated this request.

However, it could not be determined how the pilots perceived the weather to their left. Further, weather radar (Figure 5) also indicated significant cloud and precipitation to the left. The approach controller reported that a deviation right of track allowed HWY to deviate as far south as required, and at their cleared altitude of 9,500 ft, it would remain above incoming traffic. Additionally, the controller said that if the pilots wanted to return to Darwin, they would be able to track them via Lee Point without conflict with other aircraft.

All the RAAF controllers interviewed indicated that if HWY had requested a deviation left of track, this would have been granted. Some Darwin-based pilots said it was not well-known pilots could ‘require’ a specific deviation. During visits to the ATC facility that were sometimes arranged for new pilots in the region, the controllers encouraged pilots to be assertive with any requirements, especially as the pilots always have better visibility of the weather and the track deviations they need than ATC.

Weather avoidance responsibilities

The Airservices Australia Aeronautical Information Publication (AIP) Australia describes the respective responsibilities of pilots, meteorologist and air traffic services (ATS) to avoid hazardous weather as follows.

Pilots, meteorologists and ATS cooperate to ensure accurate information is promulgated to assist pilots in the avoidance of hazardous weather…and phenomena associated with thunderstorms.

The pilot must advise ATS promptly of any hazardous weather encountered, or observed either visually or by radar…Hazardous weather includes, in particular, thunderstorms, severe turbulence, hail, icing, line squalls, and volcanic ash cloud…Pilots are responsible for the safety of their own aircraft using advices and clearances passed by ATS and information obtained from their own visual or airborne radar observations.

In this case, there were no specific pilot reports provided by those in- or out-bound from Darwin.

Limitations of weather radar

The AIP states that ATS is responsible for the following.

…distributing reports of hazardous meteorological conditions to pilots as a part of the Flight Information Service. ATS also makes visual and limited radar weather observations for the information of meteorologists and pilots, and is responsible for relaying pilot weather reports to the BoM. At some locations, ATS may supplement weather advice with weather radar data.

The RAAF controller had only the BoM weather radar (set to 128 km range) displayed on a console screen. In addition to any difficulties monitoring these screens, an accurate understanding of the weather using the radar image is limited as only precipitation is displayed (not cloud) and also due to time delays.

A Federal Aviation Administration (2005) guide for weather planning and decision making, advises pilots to keep abreast of changing weather conditions by noting if other GA aircraft in the area are requesting diversions, and asking ATC for information. The guide also indicates that ATC’s ability to provide this information has the following limitations.

When you ask ATC for weather information, though, you need to be aware that radar – the controller’s primary tool – has limitations, and that operational considerations (e.g., use of settings that reduce the magnitude of precipitation returns) will affect what the controller can see on radar.

Radar “sees” only those entities that reflect energy. These include precipitation, the density of which is indicated by the strength of the return. Radar does not detect or “see” turbulence, but its existence may sometimes be implied by the intensity of a precipitation return: the stronger the return, the more likely the presence of turbulence.

In this case, several other aircraft to the east of Darwin requested track diversions due to weather.

Accident site information and wreckage examination

Wreckage location

The fuselage was located in scrub near Howard Springs, about 22 km east of Darwin Airport and about 700 m north of Gunn Point Road. The wings were located about 24 m apart from each other, and about 740 m south-southeast of the fuselage, consistent with an in-flight breakup (Figure 6). There was no evidence of fire. Various aircraft components were located between the fuselage and an area about 70 m beyond the wings, over 810 m in total.

On-site examination

On-site examination of the severely impact-damaged fuselage (Figure 7), engine and propeller identified no pre‑existing faults or anomalies that could have contributed to the accident. Examination of the wreckage indicated that the aircraft impacted terrain from a vertical descent, right side slightly down, in an almost level attitude.

A number of aircraft components were retained for further examination and testing. The propeller did not exhibit any evidence of rotation at impact, consistent with fuel exhaustion resulting from the integral wing-fuel tanks rupturing with the separation of the wings.

The evidence indicated that both pilots were secured in their seats prior to impact. Notwithstanding the severe disruption to the airframe, examination identified that both pilot seats were about mid-travel with one locator pin on each seat still engaged in the seat rails.

Figure 6: The accident site and location of fuselage and wings

Source: Google Earth, modified by ATSB

Figure 7: The fuselage, left and right wings

Source: Northern Territory Police and ATSB, modified by ATSB

Examination of the aircraft wings

Both wings had separated between 0.5 and 1.5 m outboard from the wing-to-fuselage attachment. Morphology of all fractures within the wing spars indicated that they failed due to overstress, and exhibited bending deformation consistent with forces acting upwards and rearwards on the wings. Examination of the wings showed no evidence of pre-existing defects.

Figure 8: Fractured main spar caps from the right wing

Source: ATSB

The lower spar cap shows significant local deformation in an upwards and rearwards direction. The upper main spar caps had fractured at two points along their length. The left upper spar cap failed at the location shown in Figure 8. Further inboard, the same spar cap had sheared from the webbing that secured it to the rest of the wing spar. The deformation observed was consistent with buckling due to compressive loads, as the wings were bent upwards with forces in excess of the ultimate positive flight load (Figure 9). In short, the left upper main spar cap deformed enough to damage the wing skin, consistent with buckling due to compressive loads.

Figure 9: The left upper main spar cap deformation due to compressive loads

Source: ATSB

Survivability

Survival in an aircraft accident depends on various aspects, including impact forces imparted on the occupants being within human tolerance, occupant/seat restraints and liveable space inside the aircraft. The impact forces alone in this accident meant that it was not survivable.

Recorded information

Track data

The aircraft was not equipped with a flight data recorder or cockpit voice recorder, nor was it required to be. The aircraft’s GPS unit did not record any data. All recorded data to determine the aircraft’s track is based on ATC radar data (local and system) and OzRunways data. Analysis of this data indicated the following.

• There were no apparent aircraft handling problems, up to the recorded point at 1332:28.
• Between 1332:20 and 1332:28, there was a loss in height of 300 ft, and from this point, the speed of the vertical descent increased rapidly.
• The aircraft impacted the ground approximately 30-40 s after it was at about 10,000 ft.
• After the aircraft was below 8,000 ft, its average vertical speed exceeded 10,000 ft/min, with periods above 15,000 ft/min and up to 32,000 ft/min.
• There were no on-board recording devices to accurately determine the aircraft’s actual airspeed. While the forecast winds can be used to estimate airspeed, the actual airspeed cannot be accurately determined given the likelihood of wind shear and turbulence in the air mass.

Manoeuvring speed

The aircraft’s manufacturer specified a manoeuvring speed of 118 kt at its maximum take-off weight. The aircraft’s weight at the time of the breakup was about 1,603 kg, which equates to a manoeuvring speed of 114 kt (calibrated airspeed), as shown in Figure 10.

At airspeeds above the manoeuvring speed, full or abrupt control inputs or turbulence may produce wing loading that can damage the aircraft’s structure. At airspeeds above about 145 kt, this loading can result in failure of the aircraft structure.

The following graph depicts the calibrated airspeed with wind corrections based on the forecast, noting that actual wind conditions were unavailable, and may be significantly different due to the proximity to a rapidly developing cell.

Figure 10: VH-HWY recorded altitude and groundspeed for the last 10 minutes of flight

Company information

Supervisory pilot role

Air Frontier’s new pilots often had limited exposure to the weather conditions of the tropics, and some had relatively low overall flying experience. In order to prepare them for the work and assess their suitability, Air Frontier had developed a line operational training process. In a March 2014 Notice to Aircrew (NOTAC), the chief pilot had outlined the pilot ICUS training, and the role of company appointed supervisory pilots as follows.

ICUS Operations [are when] potential pilot recruits (Trainee Pilots) may gain experience on Company aircraft and operations as Pilot In-Command-Under Supervision (ICUS) whilst under the supervision of an experienced Company-approved ICUS Supervisory pilot...

ICUS supervisory pilots are company-approved pilots for supervising Trainee Pilots while they are undergoing line operational training and suitability assessment…A supervisory pilot is not necessarily a qualified flight instructor and is expected only to provide training in regards to company procedures and routes.

Newly recruited pilots completed ground training first and at least one check flight with the chief pilot before conducting flights with supervisory pilots. Supervisory pilots were responsible for ensuring the ‘trainee’ followed regulatory requirements and the company’s standard operating procedures at all phases of flight. If the aircraft was approaching an ‘unsafe state’ during flight, supervisory pilots were to issue verbal instructions to the trainee but, if required, take over immediately. The supervisory pilot was considered the pilot in command at all times.

Supervisory pilots were selected by the chief pilot and managing director, after reviewing the pilots’ logbooks, proficiency check results, and their ‘standing’ in the company. The operator’s NOTAC outlined minimum requirements for supervisory pilots, and for single engine operations if the pilot had under 1,000 hours (as was the case with the accident flight), to have worked for the company for 6 months, have at least 400 hours as PIC and 50 hours on type. The operator had proactively implemented these minimum (non-mandatory) requirements for supervisory pilot experience and training to improve their capabilities. They then undertook a training and checking flight with the chief pilot or delegate, including a training and proficiency assessment in a take-off, landing and go-around from the right seat, recovery from unusual attitudes in VMC and (simulated) IMC.

Wet season guidance to pilots

Air Frontier provided pilots with policies and guidance relating to conditions experienced in the wet season, and the operations manual included the following.

…thunderstorms, line squalls and other conditions denoting areas of violent turbulence and/or hail must be regarded as extremely dangerous and be positively avoided. Avoid flying within 10 km horizontally of a fully developed cumulonimbus cloud and also directly below the base of the cloud wherever possible.

Vertical air movement capable of producing extremely severe turbulence is often present near the edge of the cloud’s base, or in clear air below the overhang of the top. An early decision to divert around a thunderstorm will need a relatively small heading change and result in minimal distances added to the flight.

About a week before the occurrence, Air Frontier distributed its Wet Season Guide, developed internally to assist pilots understand weather conditions to which they would be regularly exposed. The company aimed to ensure that its many new pilots were prepared to handle various ‘challenging scenarios’.

In its informal style, the Guide included the following topics.

• The importance of planning: encouraged pilots to source forecasts and actual weather conditions from a range of sources including BoM (including their Rain Radar app) and OzRunways.
• Fuel management: advised pilots they should ensure that holding and alternate requirements are met, and take into account additional fuel required to handle conditions indicated by TEMPOs^[14] in the forecast.
• Flying conditions during the wet season: advised pilots to ‘accept either low cloud or low visibility but not both’, and advising that if a cloud base is high, it is preferable to track lower through showers, although with cautions about the risks of lower visibility conditions. It stated that it is better to fly on the upwind side around a storm, and tracking over water if possible. See Figure 11 for an example of the images included in the guide.
• The role of ATC: stated that ATC is there to help pilots, and to not be afraid of requesting left or right of track (by 3, 5, or 10 NM) and specific heights to avoid weather. It mentioned that an area around ‘Jacko’s Junction’ to the east of Darwin was known to have adverse weather.
• Commercial considerations: ‘The decision to fly or not fly can at times be very tough and you have to use every resource available to you to help you make that decision.’

The training manager also mentioned that pilots received ‘extensive verbal training’ about the different weather conditions in NT.

A number of Air Frontier’s staff and pilots, and other operators in the region provided comment on the inherent challenges of the wet season. They knew thunderstorms could form rapidly, were not always easily detectable on weather radar (dependant on precipitation). They also acknowledged that pilots had to experience the conditions to get better at managing them and making ‘good judgements early’ was important.

Figure 11: Large storm cell images illustrated in Air Frontier’s Wet Weather Guide

Source: Operator, with permission

An Air Frontier pilot identified ‘command decision making in high stress environments’ including operating in Arnhem Land among the skills and knowledge that pilots had to develop after joining the company. Other company pilots indicated having an iPad with the OzRunways application installed to see weather radar during flight. They also identified reports from other pilots in the area or from ATC to manage weather conditions.

Comments about managing weather conditions from pilots working for other operators in the region included the following.

One pilot believed a Howard Springs cell was predictable during the wet season as it was an almost-daily occurrence, and recommended avoiding such cells by 20-40 NM.

One pilot noted the importance of carrying additional fuel in the wet season, as diverting to avoid a thunderstorm by 10 NM often was not enough. He had also encountered strong up- and down-drafts in these conditions.

Some pilots indicated that it was unlikely an aircraft such as a C210 could out-climb fast-developing cells that occur in the wet season, and ‘staying low’ was much more preferable.

A few pilots noted that the practice of ‘Territory VFR’ was prevalent amongst pilots in the Top End (a reference to VFR pilots briefly climbing through cloud for less turbulent conditions).

After this accident, Air Frontier’s chief pilot spoke with the pilots about the dangers of flying in the wet season. He encouraged them to inform ATC of their requirements, including the option to fly into Restricted airspace.

Next of kin notification

As part of the investigation, the ATSB was informed of a delay in being able to notify one of the pilot’s family. About 15 minutes after the aircraft’s disappearance from ATC radar, controllers informed Air Frontier’s chief pilot (the emergency point of contact). He called the police, which confirmed it was attending the accident site. The chief pilot next reported the accident to CASA and ATSB. He was then able to provide the police with the next of kin details for one pilot, but found that Air Frontier did not have the same details on file for the other pilot.

Consequently, there was a delay of several hours in informing that pilot’s family while the police worked to obtain information from alternate sources (previous employment history). On-site, ATSB investigators later found the pilot’s completed next of kin details form, which had not been provided to the company.

Regulatory oversight

The ATSB reviewed CASA’s surveillance activities and reports for Air Frontier from about 7 years leading up to this occurrence. These included some relevant findings and observations, mostly pertaining to operational document control, incomplete documentation on roles such as the supervisory pilots, and concerns about chief pilots not fulfilling all aspects of their role (mostly due to workload).

The CASA post-occurrence surveillance report (provided to the operator in November 2017) had 13 findings, and themes including the following.

• Deficiencies in the record keeping for files associated with the new pilot, including flight and duty time information, licenses and qualifications.
• Absence of evidence around the left seat pilot having acknowledged he had read the operations manual, or key NOTACs such as the March 2014 on ICUS and supervisory pilots.
• Not having completed some updates to the operations manual to ensure procedures for cargo loading, ICUS flying, training programs and supervisory pilots were included.
• Perceived deficiencies in the selection and management of supervisory pilots

The report’s summary stated that, based on the findings, there were perceived ‘deficiencies in the appropriateness of the operator’s organisation and the soundness of its management structure’. In its response to this report, Air Frontier raised some questions about the accuracy of observations relating to supervisory pilots but agreed to take all the remedial actions required.

Human performance considerations

The ATSB considered key human factors topics relating to this accident to explore possible influences on the pilots’ in-flight weather-related decision making and physiological effects associated with the adverse weather conditions.

Decision making

Naturalistic decision making

It is important to consider pilot decisions it in the context in which the sequence of events occurred. Orasanu (2000) outlines the concept of naturalistic decision making:

Naturalistic decision-making focuses on understanding how people with domain expertise use their knowledge to make decisions, typically in safety-critical environments (Cannon-Bowers et al., 1996; Zsambok & Klein, 1997).

The basis for recognising situations that requires decisions is knowledge (Orasanu, 2000). This includes ‘determining what information is relevant to the decision, and deciding on an appropriate course of action…in order to manage risk, threats must be perceived and accurately assessed.’

Orasanu asks, ‘how can flight crews be trained and supported to make the best decisions possible, especially under challenging high-risk conditions?’

Weather-related decision making

The ATSB (2005) report, General Aviation Pilot Behaviours in the Face of Adverse Weather, states that ‘weather-related general aviation accidents remain one of the most significant causes for concern in aviation safety’ which requires pilots to continuously evolve their decision making.

Pilots in general aviation often operate in an ‘uncertain and risky operational domain where they are confronted with a range of meteorological phenomena about which a series of in-flight decisions need to be made’ (Hunter, Martinussen and Wiggins, 2003). This information often comes from a range of sources ‘including meteorological briefings, inflight weather reports, visual information from the cockpit, and on-site reports.’

Wiggens and O’Hare (1995) define weather-related decision making as ‘those skills necessary to recognize and avoid meteorological phenomena that present a hazard to the flight.’ It is a skill which is developed ‘gradually through practical experience [but] in developing this type of experience, relatively inexperienced pilots may be exposed to hazardous situations with which they are ill-equipped to cope’.

One of the reasons why pilots may decide to continue a flight into adverse weather is that ‘they make errors when assessing the situation. That is, pilots are seen to engage in VFR flight into [instrument meteorological conditions] because they do not accurately assess the hazard (Wiegmann and Goh, 2000). Risk perception can be influenced by personal experience and ability (Sanders and McCormick, 1993).

The Federal Aviation Administration produced a guide in 2005 called General Aviation Pilot’s Guide to Pre-Flight Weather Planning, Weather Self-Briefings, and Weather Decision Making. They suggest that it is the abundance of weather information that may make it difficult for pilots to focus on key information and ‘correctly evaluate the risk resulting from a given set of circumstances’.

Weather-related cue-based training and guidance

It may be possible to provide pilots with greater knowledge of adverse weather conditions (and how the handle them) through training. Wiggins and O’Hare (2003) discussed the benefits of cue‑based training to help pilots ‘recognise and respond to deteriorating weather conditions during flight.’ Training ‘improved…pilots’ initial response times to deviate around the thunderstorm’ (Ball, 2008).

In recent times, pilots will often use information ascertained from apps on their tablets / iPads, including graphical weather displays based on radar information. However, Ball (2008) outlined that ‘previous research suggested that giving pilots the ability to see accurately the weather they are flying in and around may tempt some pilots to try to fly through small breaks in the convective activity’. Some pilots would attempt to navigate through or very close to the hazardous weather, and there are others that used the graphical information to plan and maintain a safe distance (20 NM or greater) from a storm.

Air Frontier’s chief pilot acknowledged that the wet season can be a very challenging time to fly. He said pilots should ‘never out-climb the weather’ and aim to be at least 10 NM away from the weather. The training manager said that during flights with their pilots, he tested them on their knowledge of weather conditions, and expected they brief on the weather conditions en route.

The CASA-conducted seminars in Darwin address risks of flying in the wet season. The seminars include briefings from BoM staff, and are designed for junior pilots, or those new to the region.

Effect of experience and familiarity

Blickensderfer and others (2018) assessed that ‘the manner in which expert pilots respond to hazardous weather scenarios differs from that of less experienced pilot.’ The NTSB (2005) furthered this by outlining that:

Errors in decision-making, such as plan continuation errors or incorrect assessments of weather-related risk, may be made by pilots who are unfamiliar with the climate of the local area, who lack total and/or recent experience identifying marginal weather conditions, or who lack experience accessing or reading weather reports.

Air Frontier’s training manager commented that many pilots start work with Air Frontier without having previously encountered the weather conditions in Darwin. Other pilots recalled their own encounters with the weather soon after they arrived in Darwin, where they were sometimes unsure of the best action to take when adverse weather was encountered.

Plan continuation bias

It is possible that pilots do not divert (or divert further) as it is perceived as a loss. Ball (2008) outlined that the pilots in their study ‘could see it was going to take longer to fly around the edge of the storm than it would take to cut through the areas of broken activity, which would result in a significant savings of time’.

An NTSB study (2005) outlined that one class of decision making in weather-related occurrences was the presence of plan continuation error, which is defined by Orasanu and others (2001) as ‘‘failure to revise a flight plan despite emerging evidence that suggests it is no longer safe’. Rather than revisiting the intended route by making a decision such as returning to the departure airport, pilots ‘may opt to press on in deteriorating weather’.

Perceived pressures to continue a flight

Pilots may perceive that there are some pressures to continue a flight, as opposed to returning or diverting. In small commercial operations, there can be a risk for pilots ‘balancing the competing demands of safety and productivity [becomes] difficult for many small operators, which places a heavy reliance on the decision making of individuals’ (Bearman and others, 2009). In a survey of pilots working for small Alaskan operators, they reported encountering ‘both explicit and implicit norms and expectations to fly in marginal conditions.

Orasanu (2009) supports this notion:

An organization’s emphasis on productivity may inadvertently set up goal conflicts with safety. Mixed messages, whether explicit or implicit in the norms and organizational culture, create conflicting motives, which can affect pilots’ risk assessment and the course of action they choose.

The owner of Air Frontier said he speaks with individual pilots to explain that there is no pressure to continue a flight, and they would be supported if they decided to return or divert. Likewise, the chief pilot of Air Frontier commented that from his standpoint, no job is worth pushing the limits for’. He felt, ‘if the weather’s no good get them to delay it’. He said they wanted the pilots to stay on the ground rather than try to push it in marginal weather situations.

Increased workload and stress

The ATSB considered whether the pilots likely experienced the effects of increased workload and stress in a situation where they were undertaking weather-related deviations in conditions they had limited (if any) exposure to in the past.

Orlady and Orlady (1999) define workload as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task’. The outline that to understand the effect of workload, it is important to understand the strategies a pilot uses for managing tasks:

An individual has a finite set of mental resources they can assign to a set of tasks (i.e. performing a takeoff). The resources available to an individual can change given the experience and training they have had or the level of stress and fatigue they are experiencing…When workload becomes excessive, the individual must shed tasks.

Orlady and Orlady (1999) also outline that workload varies with ‘training, procedures, experience, and sometimes with stress levels…’. Morris and Leung (2006) build on this idea, outlining that pilots in higher mental workload conditions experience more errors in tracking and communication.

An increased workload can result in an increase in stress experienced. When in stressful situations (such as needing to take actions that are different to those planned), there can be some effect on the ability to consider all of one’s options. Staal (2004) adds that ‘individual judgment and decision making is degraded under stressful conditions’ and that ‘in addition to experiencing greater rigidity, individuals may tend to persist with a method or problem-solving strategy even after it has ceased to be helpful’.

In this case, the ATSB considered whether increased workload resulting from deviating from the track and aircraft handling in turbulence could have resulted in high stress levels, which in turn could have affected the pilots’ decision making. The air traffic controllers reported that they did not detect any signs of stress in the pilot’s voice, although the pilot’s responses became increasingly short in length and word use. However, apart from these considerations and information, there was insufficient evidence to identify to what extent increased workload or stress affected decision making.

Risk of spatial disorientation

Gibb and others (2010) explain that seeing the horizon is ‘crucial for orientation of the pilot’s sense of pitch and bank of the aircraft’. In conditions of low visibility, the horizon may not be visible to the pilot, during which time they can become rapidly disorientated. Newman (2007) found that ‘the major environmental factors [that contribute to spatial disorientation] are related to time of day and the ambient weather conditions. Poor visual cues are a function of most disorientation illusions, so flight…in conditions of bad weather can set a pilot up for a disorientation experience’.

In a discussion of spatial disorientation, Benson (1999) defined the experience as follows:

Spatial disorientation is…[where] the pilot fails to sense correctly the position, motion or attitude of the aircraft or of him/herself [resulting in] errors in perception by the pilot of their position, motion or attitude with respect to their aircraft...

Newman (2007) outlined that spatial disorientation can affect ‘any pilot, any time, any where, in any aircraft, on any flight, depending on the prevailing circumstances’. Extensive research on spatial disorientation indicates that loss of control will likely occur between 60 seconds (Benson, 1983 in Gibb and others, 2010) and 178 seconds (Newman, 2007) after the loss of visual reference. Gibb and others (2010) state that ‘spatial disorientation accidents have fatality rates of 90–91 percent’.

In this case, both pilots involved in this occurrence held a current instrument rating at the time, which may have reduced the risk of experiencing spatial disorientation in low visibility conditions. The ATSB considered whether the pilots were likely to have experienced spatial disorientation in any areas of reduced visibility, leading to either a loss of control and/or an unusual attitude, but there was insufficient evidence to demonstrate that the aircraft likely entered low visibility conditions.

Related occurrences

A review of the ATSB occurrence database found that since 1969 (which corresponds to the availability of electronic data), there had been 45 in-flight breakups, four involving Cessna 210’s, the most commonly-involved aircraft. Of those 45 occurrences, 10 were associated with adverse weather and/or turbulence. In the same period, there have been 47 occurrences reported to the ATSB considered to be ‘VFR into IMC’ occurrences.

As a basis of comparison, the US National Transportation Safety Board investigated seven in-flight breakups of Cessna 210 aircraft since 2000. All those occurrences involved flight into thunderstorms or associated turbulence, a loss of control following inadvertent flight into instrument meteorological conditions or a combination of both.

In one case, a Cessna T210L flew into IMC in 2005, where icing or spatial disorientation likely resulted in a loss of control. Excessive speed then resulted in the aircraft exceeding its design limits, resulting in the breakup. The right wing was found approximately 800 m from the main wreckage. Damage observed on one of the wings was similar to that in the HWY breakup.

Two in-flight break up occurrences investigated by the ATSB are summarised below.

ATSB investigation 199905037

The Cessna Silver Eagle aircraft, a turbine-powered, pressurised Cessna 210, was conducting a private flight from Maroochydore to Bankstown under the instrument flight rules (IFR), cruising at flight level (FL)^[15] 160. The pilot faced adverse weather en route and requested a diversion around the weather, and then subsequent descents from their cleared flight level. The pilot reported an engine failure then a loss of generator power. No further broadcasts were received, and several hours later, the wreckage was found 380 m south-east of its last position.

Onsite investigation revealed that the right wing had failed before impact because of aerodynamic forces that exceeded the wing structural load limits. The empennage had also separated from the fuselage before impact. Interpretation of the en route weather reports suggested that the aircraft might have passed through a line of showers and thunderstorms.

The in-flight breakup resulted from the airframe being stressed beyond its design limit.

ATSB investigation AO-2011-160

On 7 December 2011, the owner-pilot of a Cessna 210M, registered VH-WBZ, was conducting a private flight under the visual flight rules from Roma to Dysart in Queensland. Thunderstorms with associated cloud, rain and severe turbulence were forecast. About 30 minutes into the flight, the outer sections of the wings and parts of the tail separated and the aircraft collided with terrain, fatally injuring the pilot.

The ATSB established that ground-based weather radar showed thunderstorms in the vicinity of the accident site, and recorded engine data showed cruise power setting was maintained until recording ceased. Although the precise circumstances leading up to the accident were not known, a combination of aircraft airspeed with the effects of turbulence and/or control inputs generated stresses that exceeded the design limits of the aircraft structure.

Airspeed is a critical factor in the stress sustained by an aircraft. Pilots need to be aware of the manoeuvring speed (VA) for the aircraft weight, and to control airspeed so as not to exceed that value when full control deflection is required or severe turbulence or wind/gusts are encountered. Severe turbulence and wind gusts are among the hazards associated with thunderstorms.

__________

7. G load: the nominal value for acceleration. In flight, g load represent the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value.
8. Ultimate load: the limit load multiplied by prescribed factors of safety. The aircraft structure must be able to support the ultimate load without failure for at least three seconds.
9. Note that the manoeuvring speed decreases with aircraft weight.
10. Flight envelope: the range of combinations of speed, altitude, angle of attack etc., within which a flying object is aerodynamically stable.
11. Aerodynamic stall: occurs when airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16˚ to 18˚, and results in reduced lift.
12. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘few’ indicates that up to a quarter of the sky is covered, ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky, ‘broken’ indicates that more than half to almost all the sky is covered, and ‘overcast’ indicates that all the sky is covered.
13. QNH: the altimeter barometric pressure subscale setting used to indicate the height above mean seal level.
14. TEMPO: a temporary deterioration in the forecast weather conditions, during which significant variation in prevailing conditions are expected to last for periods of between 30 and 60 minutes.
15. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 370 equates to 37,000 ft.

Safety analysis

Encountering adverse weather and turbulence

When VH-HWY departed Darwin Airport at 1307 on 23 October, the area forecast indicated the presence of thunderstorms and reduced visibility. However, the weather conditions that the aircraft encountered developed rapidly meant that its pilots could not have accurately and easily predicted them before departure.

Fourteen minutes after departure, the left seat pilot requested a diversion left or right of track to avoid weather. The subsequent diversions of 10 and 20 NM were prompted by ATC through their transmission to HWY including ‘advise if you need further right of track’. While it was possible for ATC to clear HWY to divert left instead, there was adverse weather in that area too.

The aircraft’s recorded track during these weather-related diversions, when overlaid on the weather radar and satellite cloud images, showed that HWY tracking in close proximity to both a precipitating cell and a rapidly developing towering cumulus cloud. The last position of the aircraft at 1332 was in the rapidly developing cell, in an area likely to have strong convective activity including up- and down-drafts. The altitude changes in the final minutes indicate that the aircraft was likely experiencing severe convective turbulence.

It is possible the aircraft entered an area of reduced visibility associated with the precipitating cells and other clouds. This would meant an increased risk of the pilots losing visual cues to determine the horizon, and then experiencing spatial disorientation. This could lead to losing, or being unable to regain control of the aircraft in the case of an unusual attitude. Regardless, the load on the airframe could have been increased by any momentary loss of control.

In summary, shortly after VH-HWY diverted to avoid adverse weather, the aircraft entered an area of strong convective activity and rapidly developing precipitating cells, which resulted in it experiencing severe turbulence and possibly reduced visibility for the pilots.

Wing separation from fuselage in-flight

The aircraft’s track data as well as witness reports indicate a very high rate of descent from about 10,000 ft until it impacted terrain. The aircraft wings were found in close proximity to each other, likely tethered to each other until a low altitude or till they impacted trees. The deformation in the fractured wing spars was in an upward and rearward direction. The combination of this evidence indicates that the wings separated from the aircraft in flight, likely due to excessive wing loading beyond the wing loading limits.

In accordance with aircraft design load factors, the wing loading, relative to the airspeed, was too high. The evidence indicates that the aircraft likely encountered severe turbulence. The ATSB could not establish the precise airspeed before or at the point of the uncontrolled descent, nor what control inputs were made by the pilots. However, based on calculations of the calibrated airspeed and the recorded ground speed (albeit without known localised wind), the effects of turbulence, any control inputs (however small) would increase wing loading. Therefore, any control inputs would have increased aerodynamic load and, as such, any attempt by the pilot's to control the aircraft or avoid the cloud increased the load factor.

In summary, a combination of airspeed, turbulence and control inputs probably led to excessive loading on the aircraft’s wings, which separated from the fuselage in-flight before the aircraft collided with terrain.

Crew pairing in the wet season

It is possible that after diverting right of track to avoid weather, the pilots perceived an opportunity to return to the planned track, but then re-diverted south to avoid further hazardous conditions. However, this inadvertently positioned the aircraft in adverse weather that resulted in the separation of the wings. The ATSB considered whether the pilots’ in-flight weather-related decision making was influenced by certain motivational factors such as:

• concern about having departed Darwin later than intended,
• perceived need to deliver the coffin to Elcho Island in a timely manner, and/or:
• perceived implicit pressures to continue, given they were new in their respective roles.

These factors could lead to a plan continuation bias. However, it was not possible to determine if any of these factors influenced their decision making. Nevertheless, a likely influence, supported through extensive research relating to in-flight weather-related decision making, was the level of operational experience the pilots had in the wet season.

The ‘build-up’ period to the wet season in Darwin is known for weather conditions hazardous to flying activities. Pilots in tropical areas need to recognise and respond to these conditions to avoid the hazards including turbulence, windshear and reduced visibility. However, this is more challenging when a pilot has not experienced these conditions, and therefore may not accurately assess the situation or perceive the risks. Ball (2008) states that the lack of hazardous weather flying experience plays ‘a role in the pilot’s ability to make timely and safe decisions about flying in and around hazardous weather’. Many of the pilots that the ATSB spoke with indicated that they only learned how to handle the weather during the wet season through their own exposure to the conditions, particularly the distance to keep from rapidly-developing cells. There were differences in the perception of how much distance to keep from them, ranging from 10 to 40 NM.

In this case, neither pilot had flown during a previous wet season in Darwin. Whilst the ATSB could not determine whether the pilots had ever experienced conditions similar to wet season conditions ever before, there was sufficient evidence to indicate that there were limited opportunities to have done so.

Orasanu (2000) outlined that when flying with other pilots, team members likely expand cognitive resources. For Air Frontier, supervisory pilots were paired with new company pilots to gain experience on their aircraft and operations. However, in this context as a risk mitigation, this can only be effective if one pilot has knowledge the other has not. It cannot be definitively stated that more experienced pilots would have avoided all hazardous weather that day, but there was an increased likelihood others would have recognised the risks posed to the safety of flight, and perhaps decided to take different actions.

In summary, the risk mitigation provided by pairing a supervisory pilot with a trainee did not adequately address the weather-related risks because neither pilot had experience flying in the region during the wet season.

Disclosure of medical history

The investigation identified that medication the left seat pilot was taking was not recorded in his medical file. However, there is no evidence that his performance, including decision making, was influenced by the medication or any medical condition, or otherwise contributed to this occurrence.

Notwithstanding the above, it is important to recognise that the purpose of declaring medical history is to address risks associated with medications or conditions that could affect performance. It is acknowledged that some pilots may often be concerned about not meeting medical certificate requirements if they declare using medications or have a medical condition. However, they then miss the opportunity to have their concerns addressed by a medical professional qualified in aviation medicine.

Documented pathways exist for managing certain medical conditions and medications that do not preclude a pilot from maintaining a medical certificate (including in this case). Both CASA and designated aviation medical examiners (DAME’s) have an important role in increasing pilot awareness about these pathways, and encouraging disclosure of medical history.

Findings

From the evidence available, the following findings are made with respect to the in-flight breakup involving a Cessna 210L, registered VH-HWY, that occurred 12 NM east of Darwin Airport, Northern Territory. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• Shortly after VH-HWY diverted to avoid adverse weather, the aircraft entered an area of strong convective activity and rapidly developing precipitating cells, which resulted in it experiencing severe turbulence and possibly reduced visibility for the pilots.
• A combination of airspeed, turbulence and control inputs probably led to excessive loading on the aircraft’s wings, which separated from the fuselage in-flight before the aircraft collided with terrain.

Other factors that increased risk

• The risk mitigation provided by pairing a supervisory pilot with a pilot new to the company did not adequately address the weather-related risks because neither pilot had experience flying in the region during the wet season.
• While there is no evidence that it contributed to this occurrence, the left seat pilot was taking a medication that was not recorded in his medical file. The disclosure and recording requirements for a pilot’s medical certificate aim to address the risks associated with medications or conditions that could affect performance.

General details

Right seat pilot details – Supervisory pilot

Left seat pilot details – Pilot in command under supervision

Aircraft details

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Air Frontier
• Airservices Australia (Airservices)
• the Bureau of Meteorology (BoM)
• the Civil Aviation Safety Authority (CASA)
• a number of witnesses and other pilots in the region
• Northern Territory Police
• OzRunways
• Royal Australian Air Force
• Textron Aviation.

References

Ball, J., 2008, The Impact of Training on General Aviation Pilots' Ability to Make Strategic Weather-Related Decisions, Civil Aerospace Medical Institute, Oklahoma City, USA

Batt, R. and O'Hare, D., 2005, General aviation pilot behaviours in the face of adverse weather, ATSB Aviation Research Investigation Report B2005/0127, available at www.atsb.gov.au

Bureau of Meteorology, 2012, Weather Advice for your Safety: Flying the Tropics, available at www.bom.gov.au

Bureau of Meteorology, 2012, Hazardous Weather Phenomena: Thunderstorms, available at www.bom.gov.au

Bureau of Meteorology, 2012, Hazardous Weather Phenomena: Turbulence, available at www.bom.gov.au

Bearman, C., Paletz, S., Orasanu, J. and Brooks, B., 2009, Organizational Pressures and Mitigating Strategies in Small Commercial Aviation: Findings from Alaska, Aviat Space Environ Medicine, 80:1055-8

Blickensderfer, B., Lanicci, J., Guinn, T., King, J., Ortiz, Y. and Thomas, R., 2018, Assessing General Aviation Pilots' Understanding of Aviation Weather Products, The International Journal of Aerospace Psychology, Vol. 27

Federal Aviation Administration, 2005, General Aviation Pilot's Guide to Preflight Weather Planning, Weather Self-Briefings, and Weather Decision Making, available at www.faa.gov

Hunter, D., Martinussen, M. and Wiggins, M., 2003, Understanding How Pilots Make Weather-Related Decisions, International Journal of Aviation Psychology

National Transportation Safety Board, 2005, Risk Factors Association with Weather-Related General Aviation Accidents, Washington, D.C, USA

Newman, D., 2007, An overview of spatial disorientation as a factor in aviation accidents and incidents, ATSB Aviation Research and Analysis Report B2007/0063, available at www.atsb.gov.au

Morris, C. and Leung, Y., 2006, Pilot mental workload: how well do pilots really perform?, Ergonomics Journal Vol. 49 pp. 1581-1596.

Orasanu, J., 2010, Flight Crew Decision-Making, in Kanki, B., Helmreich, R. and Anca, J., Crew Resource Management, Elsevier, San Diego, USA

Orlady, H. and Orlady, M., 1999, Human Factors in Multi-Crew Flight Operations, Ashgate Publishing, Vermont, USA

Sanders and McCormack (1993) – Human Factors in Engineering and Design (7th edition)

Staal, M., 2004, Stress, Cognition and Human Performance: A Literature Review and Conceptual Framework, Ames Research Centre, California

Wiegmann, D. and Goh, J., 2000, Visual Flight Rules (VFR) Flight into Adverse Weather: An Empirical Investigation of Factors Affecting Pilot Decision Making, Federal Aviation Administration, Washington DC, USA

Wiggins, M., 2003, Weatherwise: Evaluation of a Cue-Based Training Approach for the Recognition of Deterioration Weather Conditions during Flight, University of Western Sydney, Sydney, Australia

Wiggins, M. and O'Hare, D., 1995, Expertise in Aeronautical Weather-Related Decision Making: A Cross-Sectional Analysis of General Aviation Pilots, Journal of Experimental Psychology: Applied, Vol. 1

Woods, D. and Patterson, E., , How Unexpected Events Produce An Escalation Of Cognitive And Coordinative Demands, Ohio State University, USA

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Air Frontier, the Civil Aviation Safety Authority (CASA), the Bureau of Meteorology (BoM), the Northern Territory Police and the next of kin of both pilots.

Submissions were received from Air Frontier, CASA, BoM, and the next of kin of both pilots. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 14 October 2017, a Boeing 777-300 aircraft, registered A6-ETR and operated by Etihad Airways, was on a scheduled passenger service from Abu Dhabi, United Arab Emirates (UAE) to Sydney, New South Wales. An augmented flight crew, consisting of two pilots in each crew (crew A and crew B) conducted the flight.^[1]

At about 0407 Central Daylight-saving Time,^[2] while in the cruise and with flight crew B flying the aircraft, the flight crew noticed a burning smell coming from an air vent. In an attempt to establish the source of the smell, they requested that cabin crewmembers check the forward galley. The cabin crew confirmed that the forward galley was clear of any burning smells or smoke. The flight crew then requested two other cabin crewmembers enter the flight deck, who confirmed the burning smell. Around this time, the aural fire bell activated, a master warning light illuminated and a warning message ‘FIRE CARGO FWD’ was displayed on the engine-indicating and crew‑alerting system.

In response, the flight crew actioned the non-normal checklist, which included arming the forward cargo fire switches located in the flight compartment overhead panel. This action resulted in numerous mechanical and electrical actions, including de-energising the recirculation fan^[3] and closing the air vents in the forward cargo compartment. The flight crew then selected the cargo fire discharge switch, which discharged the two fire extinguisher bottles located in the forward cargo compartment.^[4] The flight crew declared a MAYDAY^[5] to air traffic control and advised of their intention to divert to Adelaide Airport, South Australia, as it was the nearest suitable airport for the aircraft type.

Flight crew A had just completed their scheduled rest period and entered the flight deck where they were briefed by flight crew B of the situation. Flight crew A assumed control of the aircraft as they were the designated crew for landing. Flight crew B remained on the flight deck to provide assistance. A rapid descent to flight level (FL)^[6] 125 was conducted and the aircraft was diverted to Adelaide.

During the remainder of the flight, the cabin crew, operator and passengers were informed of the situation and the diversion. The flight crew also advised air traffic control that, if smoke or fire from the forward cargo compartment was confirmed by emergency services upon landing, they would evacuate the aircraft on the runway.

At 0455, the aircraft landed uneventfully. The emergency services advised the flight crew that they did not observe any smoke or fire emanating from the aircraft. The aircraft was taxied from the runway to taxiway ‘F6’, where the emergency services inspected the aircraft externally with a thermal imaging camera. They confirmed that there were no identified hot spots indicating an on‑going fire in the forward cargo compartment. Based on this information, as a precaution, the crew decided to conduct a rapid deplane of the passengers through passenger door 5L using mobile boarding stairs. All passengers and crew disembarked in a controlled manner and were transported to the passenger terminal. Nil injuries were reported during the disembarkation.

Initial engineering inspection

Once the forward cargo compartment was emptied of cargo, maintenance engineers inspected the cargo hold for evidence of fire. A small quantity of soot was identified in the cargo ceiling area, between the fiberglass ceiling panel and fiberglass joint sealing tape about aircraft body station (BS) 508 (Figure 1).

Figure 1: Illustration showing aircraft structure in the forward cargo hold in relation to heat damage from electrical arcing about BS 508

Source: The Boeing Company, modified by the ATSB

The ceiling panels were removed where soot was identified in the area between the lower side of the cabin floor and the upper side of the cargo-ceiling panel (Figure 2). Inspection of that area found heat damage and chafed 115-volt electrical wire in wiring loom P/N W5279-3002R-12 (W5279), which supplied power to the right lower recirculation fan. The chafing enabled the wire core to come in contact with a cargo ceiling panel retainer screw where the short circuited wire tracked through the polyetheretherketone resin (PEEK) stand-off brackets and carbon fibre floor beam.

Figure 2: Damaged floor beams, webs and wiring covered in soot with ceiling panel opened

Source: Etihad Airways, modified by the ATSB

In consultation with Boeing and operator’s aviation regulator, the United Arab Emirates General Aviation Authority, the operator temporarily repaired the wiring and the damage to the floor beams were evaluated. The operator conducted a non-revenue flight (nil passengers) where they flew the aircraft back to the UAE for the purpose of further inspections and permanent repairs.

Detailed engineering inspection

A detailed inspection between the forward cargo ceiling and passenger floor was conducted at the operator’s maintenance facility in the UAE. Wire bundle W5279, located at about BS 508 was found to have been incorrectly routed. Consequently, the wires had come into contact with screws and nutplates used to close out the cargo-ceiling panel to the ceiling standoff clips.

Over a prolonged period of time, the 115V recirculation fan wire located within that bundle chafed through the insulation coating, allowing the wire to short circuit. The electrical wiring and fourteen of the cargo ceiling panel standoff clips manufactured from PEEK were heat damaged. Sections of the carbon fibre beam web and beam flange at BS 508 between the left buttock^[7] lines 40 to 60 were also found to be heat damaged and delaminated between 6 and 7 percent in three locations where the current tracked (Figure 3).

Figure 3: Boeing 777 aircraft showing the approximate location of the heat damaged ceiling panel, soot and heat damaged wiring loom

Source: The Boeing Company, modified by the ATSB

Boeing determined that the wiring loom W5279 was likely to have been incorrectly positioned during the aircraft build in 2013. Boeing reported that this was the fifth reported incident involving wire chafing and arcing in the cargo area of a Boeing 777 aircraft. However, this was the first event that triggered the cargo fire warning system and that had been detected in flight. In all of these cases, the wiring loom had been installed incorrectly during manufacture, allowing screws to chafe wires and short circuit.

Recirculation fan wiring protection system

The 115V recirculation fan wiring system is protected by an electrical load control unit (ELCU) that is located in the aircraft’s main equipment centre. The ELCU is designed to protect the electrical circuit from over-current or differential loads by automatically opening (‘tripping’) to remove power. In this incident, despite the damage sustained to recirculation fan wiring it was reported that the ELCU did not open.

The circuit was tested during the repair of the wiring loom where it was identified that the ELCU functioned as designed. Boeing surmised that in this case, it was possible that the chafed wire may have been intermittently shorting to earth through the PEEK stand-off brackets. It is likely that the insulation properties of the PEEK prevented sufficient current draw to trip the ELCU.

Boeing also surmised that it was likely that the crew’s action of arming the forward cargo fire switches de-energised the chafed wire within loom W5279, thereby preventing further current flow and short circuit.

Cargo compartment fire protection

Materials used in the construction of passenger compartment interiors and in the space between the cabin floor and cargo ceiling are required by the United States Federal Aviation Administration to be self-extinguishing (i.e. stop burning after the heat source has been removed) or better. For example, electrical wire and cable insulation must be self-extinguishing. Cargo liners form part of the passive fire protection feature. In addition, the primary purpose of a cargo liner is to prevent a fire, originating in a cargo compartment, from spreading to other parts of the aircraft and to seal the compartment to help contain the suppression agent in that area.

In Class C cargo compartments, which include the lower cargo compartments of all passenger aircraft, the sidewall and ceiling liner panel installations are fire tested to determine flame penetration resistance. All other materials must be self-extinguishing.

Safety analysis

The flight crew identified a burning smell in the flight deck and completed the appropriate actions to manage the situation. By arming the forward cargo fire suppression system, electrical power was removed from the recirculation fans, which prevented further arcing and damage to the structural carbon fibre beam, support brackets and wiring. Even though there was a significant amount of soot and electrical arcing, de-energising the electrical circuit manually before sufficient current went to ground negated the electrical load control unit from tripping. It was likely that, once the electrical current was deactivated by arming the forward cargo fire switches, the smoke had also stopped. Discharging the fire bottles in the forward cargo space, even though procedurally correct, had nil effect on this occasion as the source of the electrical arcing was in the sealed zone between the cargo ceiling panel and the passenger floor compartment, not in in the cargo compartment.

A post-incident inspection of the aircraft found an electrical wiring harness (W5279) was in an incorrect location. Consequently, one of the forward cargo ceiling liner retainer screws chafed on the wires, which resulted in the electrical current from the chafed wire dispersing through the passenger floor carbon fibre beam about body station 508. That electrical current generated significant heat where 14 of the cargo ceiling polyetheretherketone resin standoff brackets were heat damaged and several areas of the structural carbon fibre beam were chafed and delaminated. The smoke generated from the arcing was of a magnitude that it migrated through the forward cargo ceiling liner into the forward cargo compartment and activated the forward cargo fire detection system.

This incident was the fifth reported case where damage to the wire bundles in the forward (and aft) cargo compartment of a Boeing 777 aircraft has occurred from chafing on a ceiling liner screw and/or nutplate. This was the first event that triggered the cargo fire warning and the only event to have been detected in air. A subsequent investigation conducted by Boeing found that the wire bundle W5279 had been incorrectly routed, likely during aircraft manufacture, and had not been installed as per the design drawings. Slight variations of the wire bundle position allowed it to run directly above the screw and nutplate, which chafed the wire bundle over time.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During cruise, a burning smell was detected in the flight deck and the forward cargo compartment fire warning activated. The flight crew armed and set the forward cargo fire suppression system and diverted the aircraft to the nearest airport for a safe landing.
• A wiring loom situated above the forward cargo compartment about body station 508 was incorrectly routed, likely during manufacture of the aircraft. Over several years, wires in that loom chafed against the support structure and short circuited. Electrical arcing created smoke that activated the forward cargo smoke detector.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB was advised of the following proactive safety action in response to this occurrence.

Aircraft manufacturer

As a result of this occurrence, Boeing advised the ATSB that they have taken the following safety actions:

Fleet communication

Boeing issued a ‘Fleet Communication’, 777-FTD-24-18001 to all Boeing 777 aircraft operators informing them of this issue:

Boeing has received reports of five separate in-service events where a ceiling liner screw in the forward cargo compartment was found in contact with a wire bundle, resulting in a short to ground that damaged cargo ceiling standoffs, the wire bundle, and the floor beam in some cases.

Wire installation inspections

Boeing recommend interim action:

Operators can choose to inspect the wire bundle runs in the forward cargo compartment and locate instances where the ceiling liner screws and nutplates are in contact or do not have 0.13 Inch clearance with the wire bundle. Wire harnesses should have a minimum separation distance of 0.13 inch to sharp edges of structure and equipment per SWPM (D6-54446), Sec 20-10-11 Page 39, table 21 ‘Minimum Clearance’. If a riding condition is found, Boeing can provide technical assistance if required to provide corrective action. The wire routing installation drawings can be reviewed to determine the correct routing of wire bundles in the cargo compartment.

In addition, Boeing has issued Service Bulletin 777-24-0157, which would require operators to inspect for and correct similar conditions that led to this occurrence. Service Bulletin 777-24-0157 relate to all Boeing 777-200,777-200LR, 777-300ER aircraft line numbers 1-1527 inclusive.

Boeing Engineering performed an investigation of all cargo ceiling wire bundle installation engineering drawings. Boeing will add additional spacing as a precaution when wire bundles are in close proximity to ceiling liner screws.

…inspect and made changes to wire bundles near ceiling liner nutplate locations, in the forward and aft cargo compartments. If this service bulletin is not done, wire chafing can result in a short circuit and a system failure.

There have been five reports of wire chafing on ceiling liner screws or nutplates. Several ceiling liner support standoffs were damaged by heat which was caused by the grounding path. The floor beam was also damaged. Wire bundles near heat damaged ceiling liner support standoffs have also been damaged. The wire bundles that do not have the correct clearance from the ceiling liner screws, can result in chafing causing exposed conductors and shorting.

Boeing has also taken action in their production line by inspecting aircraft from line number 1529 for correct installation. Boeing are also considering installation and design changes to new production aircraft to alter the position of the effected wiring loom to prevent recurrence.

Safety message

Despite complex systems of design and manufacturing, training, and quality control, errors do occur during manufacturing that may not be apparent for some time. In this case, the aircraft was manufactured 4 years prior to the incident.

While this was a serious incident, the severity of the damage sustained was minimised through regulatory design requirements, material composition, system protections and crew actions. In response to this, and four other incidents, the aircraft manufacturer utilised their system of communication to alert all operators of the issue and took actions in an effort to prevent reoccurrence. Regardless of this, operators and maintenance providers are another line of defence for detecting errors. Due diligence during scheduled aircraft maintenance and defect rectification will assist with ensuring that aircraft systems meet the design intent and function accordingly.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. A crew that comprises more than the minimum number required to operate the aircraft and in which each crew member can leave their assigned position and be replaced by another appropriately qualified crew member for the purpose of inflight rest.
2. Central Daylight-saving Time (CDT): Coordinated Universal Time (UTC) + 10.5 hours.
3. Recirculation fans move air throughout the cabin.
4. After a time delay, the remaining three extinguisher bottles discharge at a reduced flow rate into the selected compartment. If the aircraft lands before all the bottles discharge, one of the remaining bottles discharges into the selected compartment at a reduced rate on touchdown.
5. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
6. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 125 equates to 12,500 ft.
7. Buttock (butt) line is an axis of measurement. Buttock line zero is the theoretical longitudinal line down the centre of a fuselage. In this instance, left buttock line 40 is 40 inches to the left of the centre-line.

What happened

At about 1736 Eastern Standard Time^[1] on 12 October 2017, Queensland Rail (QR) empty suburban passenger train 2552 departed Kippa-Ring Station towards Bowen Hills. The train ran on Proceed signal indications (green) until slowing for a sweeping curve into Petrie Station. The driver of train 2552 recalled slowing the train approaching Petrie platform then following yellow signals. The Automatic Warning System (AWS) ^[2] generated an in-cab alert to the driver of the restricted signal indication ahead on signal PE54 on the departure side of Petrie Station platform 5. The driver acknowledged the AWS, passed signal PE54 (which displayed a restricted indication double yellow aspect)^[3] and continued towards the next signal PE38. The driver did not recall acknowledging the AWS associated with PE54.

Figure 1: Train 2552 passing signal PE54 at 1748:53, travelling at a speed of 41 km/h

Source: Queensland Rail

Approaching signal PE38, the AWS activated again, indicating the next signal PE38 was also displaying a restricted indication (single yellow aspect). The driver acknowledged the AWS, passing signal PE38 at 41 km/h (Figure 2). Again, the driver could not recall acknowledging the AWS.

Figure 2: Train 2552 passing signal PE38 at 17:49:12 travelling at a speed of 41 km/h

Source: Queensland Rail

The train continued towards the next signal, PE28, at a stable speed of about 41 km/h, below the posted speed limits of 60 km/h and 70 km/h respectively.

At about 1750, train 2552 passed signal PE28 at STOP (Figure 3), and continued at a reduced cautious speed. The driver did not recall the red signal or acknowledging the associated AWS alarm. The driver commented that he was focussed on the preceding train and not the signal indication directly in front.

In response to exceedance of the STOP signal, an alarm activated in the QR Rail Management Centre. The network control officer (NCO) managing that sector immediately broadcast an emergency radio message calling for the driver of train 2552 Petrie to stop. The driver of train 2552 heard the emergency broadcast but thought the message was for another train. Specifically, the driver believed that the NCO was calling train 2Y52 at Petrie, not train 2552 that was nearer to Lawnton. The NCO broadcast another emergency message to the driver and guard of train 2552. The driver as a precaution slowed further to about walking pace, but did not completely stop. Due to the slow speed of the train, the guard advised the NCO that the train was stopping. A short time later however, the driver began to move off. In response, the guard opened the brake pipe cock, causing an emergency brake application that brought the train to a complete stop at 1751. The train stopped about 320 m past signal PE28, about 83 m prior to the converging points onto the up main line.

The adjacent up main line route had been set for the passage of passenger train TK74. At the time of the SPAD, when there was the possibility of train 2552 converging onto the main line route, train TK74 was several kilometres away. After the SPAD, the NCO returned protecting signals to STOP to protect the line and the approaching train TK74.

At 1808, train 2552 drove back clear of signal PE28. The NCO verified with the driver of train 2552 that he could continue to Bowen Hills. At 1815, the train continued its planned journey to Bowen Hills. The guard joined the driver in the cab at Lawton, the next station, and travelled until Strathpine. At Strathpine, a train operations inspector joined the train and supervised the driver for the remainder of the journey to Bowen Hills. At Bowen Hills, the train crew were removed from duty. The driver advised the ATSB that he was feeling unwell at the time of the occurrence and that he subsequently was diagnosed with a severe respiratory tract infection.

Figure 3: Train 2552 passing signal PE28 1750:02 travelling at a speed of at 42 km/h

Adjacent signal PE26 cleared (green) for train TK74.

Source: Queensland Rail

Signalling system

The QR signalling system at Petrie comprised of a four aspect signalling system, shown in Table 1.

Table 1: Four aspect signalling system indications

When passing Caution signals, drivers are required to reduce train speed to 75 per cent of the designated track speed. In this instance, the driver reduced speed to negotiate a curve approaching Petrie station, rather than because of the Caution signal. The driver maintained a reduced speed below 75 per cent of designated track speed until stopped.

Risk Triggered Commentary Driving (RTCD)

Risk Triggered Commentary Driving (RTCD) is a Queensland Rail risk mitigation procedure aimed to assist drivers to maintain vigilance and awareness when managing operational risks while driving trains.

Primarily, RTCD was developed to manage risks while running on restricted signals, but may also include managing adverse conditions or managing operational risks. Additionally, RTCD is used to reduce the risk of drivers automatically acknowledging the AWS. The RTCD involved drivers acknowledging the aspect of the restricted signal, and intended actions, by speaking aloud.

The driver of train 2552 reported that, while he was familiar with RTCD practices, he did not verbalise his thoughts about restricted signals encountered during the occurrence journey.

Driver training

Training records for the driver of train 2552 indicated that RTCD training was delivered in July 2012. However, other than periodic maintenance of competency (MoC) line checks, no other RTCD training or refresher had been provided, nor was it required to be. The most recent MoC line check was conducted on 27 July 2017.

The MoC line check involved written and practical components. The written component of the MoC consisted of four questions. Each question involved completing the missing word/s in a statement. The practical assessment consisted of a number of direct observations by an assessor and checked against listed competencies, which included aspects of RTCD and actions verbalised. In each component, the driver of train 2552 was assessed as competent.

SPAD history

Following the commencement of two SPAD-related investigations (RO-2017-012,^[4] and (RO-2017-010)^[5] involving QR operations, the ATSB reviewed past occurrence data to determine if there was an increase in the SPAD rate.

The Kippa-Ring line opened in October 2016. Signal PE28 formed part of the new infrastructure installed as part of the new Kippa-Ring line. Consequently, there was no SPAD history for signal PE28.

Within the QR Brisbane suburban passenger network, there were 17 SPAD events^[6] recorded between 1 July and 30 November 2017. When compared to similar suburban passenger networks, Metro Trains Melbourne and Sydney Trains, the QR SPAD rate is comparable, as shown in Table 2.

Table 2: ONRSR SPAD data

Note: data provided by Office of the National Rail Safety Regulator (ONRSR) based on information provided by rail operators. *Normalisation data for November was not available. Count (Ct) and rate (Rate) per 10⁶ passenger train km.

Source: ATSB

Additional QR Brisbane suburban passenger network SPAD data was provided by the then-rail regulator, the Queensland Department of Transport and Main Roads (TMR),^[7] and the Office of National Rail Safety Regulator (ONRSR). Within the data, the ATSB focused on analysing three types of train driver-related SPADs between January 2012 and December 2017: ‘starting against signal’,^[8] ‘driver misjudged’,^[9] and ‘driver completely missed’.^[10] The results are shown in Figure 4.

Figure 4: Queensland train driver-related SPAD occurrences, 2012 – 2017

Note: data provided by TMR and ONRSR based on information provided by the rail operator.

Source: ATSB

The highest proportion of driver-related SPAD occurrences was ‘driver misjudged’, followed by ‘completely missed’, then ‘starting against signal’. The ‘completely missed’ SPAD occurrence is considered by QR to be a higher risk. As a proportion of all driver-related SPADs, the ‘completely missed’ SPADs represented 9% in 2012, 23% in 2013, 24% in 2014, 46% in 2015, 18% in 2016 and 54% in 2017. Based on the five-year average of completely missed SPADs (2012-2016), the data showed an increasing proportion of ‘completely missed’ SPADs in 2017.

Although the increase in 2017 was higher than previous years, there was insufficient data to conclude whether this was an anomaly or indicative of an increasing trend. Ongoing monitoring of this occurrence type will resolve this.

Office of the National Rail Safety Regulator SPAD categories

From 1 July 2018, the way SPADs are categorised and reported to the Office of the National Rail Safety Regulator (ONRSR) will change. Under the new categorisation, SPADs will be assessed on possible consequence and categorised into eight subcategories.

Additionally, SPAD vulnerability data must be provided for each SPAD, based on consideration of the severity and probability of their actual and possible consequences.^[11]

Under the new categorisation, this occurrence could be categorised as a ‘level H - Minor’:

• H. SPAD rolling stock stopped more than 50 metres in rear of the first potential conflict point by the actions of the Network Control Officer (NCO) prior to incident.
• Minor: significant escalation of SPAD required before incident could occur.

Safety analysis

The driver of train 2552 unknowingly passed signal PE28 at stop. The driver recalled he was planning the train handling with a focus on the movement of the train ahead, rather than the signalling system. He also reported feeling unwell. The extent to which the driver’s reported area of focus and his developing illness influenced the occurrence could not be determined. Both these elements however, had the potential to distract the driver’s attention from the light signals.

The driver was aware of RTCD practices and reported applying them internally.

The driver did not recall acknowledging the AWS alarms. Notwithstanding this, if the alarm was not acknowledged within a certain time, a penalty brake application would be made automatically. The recorded data did not show a penalty brake application. Therefore, the ATSB concluded that the AWS alarms were acknowledged.

In response to the exceedance of the signal, the network control officer broadcast an emergency message for train 2552 to stop. The response to that broadcast was delayed as the driver believed it was directed to the crew of another train. The action of the guard opening the brake pipe cock, causing an emergency brake application, was a positive action that prevented a potentially more serious incident.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The driver of train 2552 did not recall seeing a red light as they approached signal PE28 resulting in that signal being passed at stop. The exceedance may have been influenced by a focus of attention on the preceding train and a developing respiratory illness.
• The network control officer responded to the SPAD by broadcasting an emergency message for train 2552 to stop. The driver did not respond to that call as they believed it was directed to another train, however the guard responded to the broadcast by activating the emergency brakes.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Queensland Rail

Queensland Rail advised the ATSB that as a result of a series of SPAD events, they are:

• Conducting a qualitative analysis of the SPAD scenarios at RS57 using a bowtie model.
• Presenting a health and wellbeing strategic plan to the Executive Leadership Team, which includes an organisational resilience and psychological wellbeing education and awareness program.
• Conducting a human factors review of driver response to AWS audible indications and reaction times for green and restricted signals.
• Facilitating the decrease in volume of the AWS audible indication at a proceed signal (green) and increasing the volume of an AWS audible indication at a restricted signal (double yellow, yellow, and red).
• Seeking expressions of interest from market leaders to partner with Queensland Rail to implement European Train Control System (ETCS) on sections of the Queensland Rail network. ETCS incorporates automatic train protection that provides for monitoring of train speed and limits of authority to ensure trains stay within designated speed limits and authorised safeworking limits.

Safety message

Driving trains is a complex task, particularly during times of critical safety such as restricted signals. The AWS engineered system alerts the driver before a restricted signal indication. Regular activation of any warning system however, increases the risk that it will be acknowledged without consideration of the related hazard. The proposed introduction of ETCS by Queensland Rail removes the human element from the decision making process. If a train approaches a restricted signal too fast, and no or improper action is taken by the driver, the brakes are automatically applied, stopping the train before danger.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. The AWS is part of the signalling system and the in-cab system warns the driver whether the next signal is clear or restricted. The AWS utilises magnets, which are placed in the track generally 80m before the signal, which the AWS repeats.
3. Caution – proceed to find the next signal at caution.
4. Signal RS57 passed at danger involving suburban passenger train 1W33, Roma Street Station, Queensland on 5 September 2017.  www.atsb.gov.au/publications/investigation_reports/2017/rair/ro-2017-012/
5. Signal ME45 passed at danger, involving suburban passenger train 1A21, Bowen Hills, Queensland, on 26 August 2017.  www.atsb.gov.au/publications/investigation_reports/2017/rair/ro-2017-010/
6. Recorded SPAD events are restricted to driver-error related.
7. Queensland TMR was the rail regulator in Queensland until 1 July 2017, after which ONRSR assumed the role.
8. Where a stationary train starts and proceeds beyond a signal at danger without authority. The driver may or may not realise that the train has run past the signal.
9. Where the driver has attempted to stop the train but failed to stop the train before passing the signal.
10. Where no attempt has been made to bring a train to a stand before the stop signal and the train has proceeded into the next section or block without the necessary authority. The driver has not realised that the train has passed a stop signal until a more serious event results; the driver is stopped by train control over the radio or at the next signal or stopped by other external intervention.
11. ONRSR Reporting Requirements for Notifiable Occurrences pages 154 and 155.  www.onrsr.com.au/safety-improvement/signals-passed-at-danger

Discontinuation notice published 27 March 2020

Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the ATSB to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.

Overview of the investigation

As part of the occurrence investigation into the In-flight upset, inadvertent pitch disconnect, and continued operation with serious damage involving ATR 72, VH-FVR (AO-2014-032) investigators explored the operator's safety management system (SMS), and also explored the role of the regulator in oversighting the operator's systems.

The ATSB collected a significant amount of evidence and conducted an in‑depth analysis of these organisational influences. It was determined that the topic appeared to overshadow key safety messages regarding the occurrence itself and therefore on 19 October 2017 a separate Safety Issues investigation was commenced to examine the implementation of an organisation's SMS during a time of rapid expansion, along with ongoing interactions with the regulator.

As part of its investigation, the ATSB:

• interviewed current and former staff members of the operator, regulator and other associated bodies
• examined reports, documents, manuals and correspondence relating to the operator and the methods of oversight used
• reviewed other investigations and references where similar themes have been explored.

ATSB comment

Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues. Additionally, in the context that the investigation examined a time period associated with the early implementation of an SMS, it was also assessed that there was minimal safety learning that was relevant to current safety management practices. Consequently, the ATSB has discontinued this investigation.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation. The ATSB will also continue to examine safety management systems, and their oversight, in other systemic investigations.

Safety summary

What happened

On 15 October 2017, at about 1152 Western Standard Time, the flight crew on board an AirAsia Indonesia Airbus A320-216, registered PK-AXD, initiated an emergency descent from FL 340 to 10,000 ft in response to a malfunction of the aircraft’s pressurisation system. The aircraft returned to Perth Airport, Western Australia, with no reported injuries or damage.

What the ATSB found

The manufacturer of the cabin pressure controllers identified an intermittent rare fault with cabin pressure controller 1 circuit board, which resulted in incorrect control of the outflow valve. This led to the over-pressurisation of the aircraft cabin and activation of the cabin safety valve(s). Following the activation of the safety valve(s), several warnings of excess cabin altitude were generated, which ultimately resulted in the flight crew conducting the emergency descent procedure. The ATSB found that the operator had reviewed and elected not to incorporate the manufacturers recommended, but not mandatory, improvements to the pressurisation system. The improvements were communicated to the airline by service bulletins. Incorporating the bulletins would have likely prevented the emergency descent incident.

In accordance with the manufacturer’s procedure, the flight crew deployed the passenger oxygen masks. However, several units either did not deploy, or deployed but did not provide oxygen. Consequently, several passengers moved around the cabin to secure a spare oxygen mask. As passengers were moving around while the seat belt sign was illuminated, the cabin crew shouted commands such as ‘BRACE’, ‘GET DOWN’ and ‘CRASH POSITION’. This probably increased the level of confusion and panic amongst some passengers.

The ATSB conducted a passenger safety survey following the incident. About half the respondents indicated they were unsure if oxygen was flowing from their oxygen masks, and several responses indicated a misunderstanding of how the equipment operates.

What's been done as a result

The aircraft manufacturer, Airbus, reviewed their A320 emergency procedures related to the circumstances in which it would be appropriate for flight crew to manually change the active cabin pressure controller. Airbus advised they would recommend a manual cabin pressure controller changeover in case of abnormal cabin altitude. This modification was implemented in the A320 Quick Reference Handbook revision March 2019.

The ATSB has issued AirAsia Indonesia with a safety recommendation to review its current passenger pre-flight safety briefing and safety information card to ensure passengers are provided with clear instruction on how to activate the flow of oxygen from the passenger oxygen masks and that the bag may not inflate when oxygen is flowing.

Safety message

An important aspect of managing abnormal passenger responses is the cabin crew’s ability to recall and use the appropriate standard commands. In this case, the passengers generally responded well when appropriate commands were used, but incorrect commands resulted in some confusion and panic among the passengers. Cabin crew emergency procedures training that include role-playing of the full range of expected passenger behaviour, including panic and confusion, can better prepare cabin crew when exposed to more complex real-world scenarios.

The occurrence

On 15 October 2017, at about 1152 Western Standard Time,^[1] the flight crew on board an AirAsia Indonesia Airbus A320-216, registered PK-AXD, initiated an emergency descent from flight level (FL)^[2] 340 to 10,000 ft in response to a malfunction of the aircraft’s pressurisation system.

Earlier, at about 1122, the aircraft departed Perth Airport, Western Australia, for the planned destination of Denpasar Airport (Bali), Indonesia, with two flight crew, four cabin crew and 146 passengers on board. On departure, air traffic control (ATC) issued the flight crew with a clearance to climb to FL 340. Prior to reaching FL 340, and while the aircraft was climbing through FL 250, the crew noticed repeated system 1 (CAB PR SYS 1 FAULT) fault messages for the pressurisation system appear and then disappear on the electronic centralised aircraft monitoring system. The flight crew reported that each time they accessed the flight management system’s pressure page the fault cleared. The captain queried the first officer as to whether a door could be open, and shortly afterwards both flight crew members commented feeling some discomfort, with the first officer indicating ear discomfort.

At about 1148, just after passing FL 300, the master caution activated for the opening of the cabin pressure system safety valve(s)^[3] (CAB PR SAFETY VALVE OPEN). In accordance with the emergency procedures, the flight crew selected manual control (MAN) for the pressurisation system and, noting a high cabin pressure rate of climb^[4] of 1,100 ft/min, they attempted to close the outflow valve to reduce the cabin pressure rate of climb to the target level of 500 ft/min. The first officer noted the cabin differential pressure^[5] was 8.3 pounds per square inch and the cabin altitude was 8,900 ft (the target cabin altitude for FL 300 in manual control was 5,500 ft). Before the checklist actions could be completed the master caution cleared.

Following the flight crew’s selection of manual control of the pressurisation system, the senior cabin crew member (P1) contacted them and together they discussed experiencing ear discomfort. The captain queried P1 about the security of the cabin doors, which she reported as indicating that they were secure. The P1 reported that there were intermittent activations of the cabin seat belt signs, similar to the indications of a depressurisation.

At about 1151, the master warning activated intermittently for a high cabin altitude (CAB PR EXCESS CAB ALT). The warning initially activated intermittently and then remained on until 1209. The flight crew donned their emergency oxygen masks and requested a clearance from ATC to descend to FL 220 due to pressurisation problems.^[6] The clearance request was then amended to an emergency descent to 10,000 ft. The captain then made a public address to announce the emergency descent to the cabin crew and passengers, which was repeated to the passengers by P1.

After securing herself in her seat, P1 noted the passenger emergency oxygen masks had not deployed and reported this to the flight crew. The flight crew manually deployed the passenger oxygen masks as part of the emergency descent procedure. During the descent, ATC first issued the flight crew with a clearance to return to Perth, and then provided them with radar vectors around active restricted airspace on their descent path. After reaching 10,000 ft, the flight crew announced the aircraft was at a safe altitude for oxygen masks to be removed, and informed the cabin crew and passengers of the aircraft’s return to Perth. The aircraft landed safely at Perth Airport at about 1248.

During the emergency descent there was an intermittent activation of the master caution for cabin low differential pressure (CAB PR LO DIFF PR). Figure 1 below depicts the flight data showing the activation of the alerts, and the descent from about FL 340 to 10,000 ft, which was at an average rate of about 2,300 ft/min (maximum of 4,300 ft/min). There were no reported injuries and the aircraft was not damaged. The post-flight maintenance tests identified a fault with the cabin pressure controller 1 (refer to Aircraft information).

Figure 1: Activation of alerts and start of emergency descent

Information from the flight data recorder depicting the activation of alerts and start of the emergency descent in UTC. [7]

Source: ATSB

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 340 equates to 34,000 ft.
3. There are two safety valves fitted, but it only takes one to activate the master caution.
4. The aircraft cabin pressure climbs and descends on a schedule, as the aircraft climbs and descends, to minimise the pressure difference across the cabin wall and to limit the maximum cabin altitude to a level that is acceptable for passenger comfort.
5. Cabin differential pressure is the difference in pressure between inside the aircraft cabin and the local external atmosphere (i.e. across the cabin wall).
6. The flight crew were communicating with air traffic control through their emergency oxygen masks, which, in addition to other radio traffic, contributed to the communications difficulties.
7. Coordinated Universal Time (UTC): the time zone used for aviation. Local time zones around the world can be expressed as positive or negative offsets from UTC. Western Standard Time: UTC + 8.

Context

Personnel information

For flight crew training and experience, refer to General details. For cabin crew training and experience, refer to Cabin safety.

Aircraft information

Throughout the normal operation of an aircraft, the crew and passengers must be kept in comfortable conditions regarding the temperature, humidity and pressure of the cabin air. This is managed by the various environmental control systems. The environmental system of interest to the investigation was the cabin pressurisation system. This system regulates the flow of air through the cabin and pressurises the cabin to an altitude that provides sufficient oxygen for normal human functions.

Pressurisation system

Cabin pressure can be set by the flight crew to operate in automatic, semi-automatic or manual mode. In automatic and semi-automatic mode, pressurisation is maintained by one of two independent cabin pressure controllers (CPCs), which communicate with each other via a discrete connection that indicates which system is in control. One CPC is in operational state while the other is in standby state. The operational CPC controls the cabin outflow valve position by means of its associated motor. This controls the cabin pressure and indirectly controls the difference in pressure between the cabin and external atmosphere (differential pressure).

If there is a problem with the automatic or semi-automatic mode of control, the flight crew can select manual mode and signal the outflow valve to open or close as desired to manage the differential pressure. In addition to the outflow valve, there are two independent pneumatic safety valves to prevent excessive excursions in differential pressure. They operate in the range of positive 8.6 plus or minus 0.10 pounds per square inch (psi) differential pressure.

The CPCs do not control the deployment of the passenger oxygen masks. They are controlled by an independent pressure sensor.

For an explanation of the alert messages provided to the flight crew during the incident, refer to Appendix A - Incident flight faults.

Manufacturer’s investigation

The aircraft’s two CPC’s and outflow valve were sent to the manufacturer, Nord-Micro, for inspections and tests. They isolated the source of the pressurisation system faults to the CPC 1 circuit board after excluding the pressure sensor fitted to CPC 1. The fault with the circuit board likely resulted in the intermittent incorrect calculation of cabin pressure by the CPC, which controlled the position of the outflow valve in automatic mode and produced spurious excessive cabin altitude warnings in the operational and standby state until it recorded a failure.

Cabin pressure controller 2 and the outflow valve were found to be serviceable with the exception of an intermittent fault with the outflow valve when tested in the manual mode. This fault was not associated with the automatic mode of operation and did not reoccur during a repeated test.

For further details about the manufacturer’s investigation and the calculation of cabin pressure values, refer to Appendix B - Manufacturer’s inspections and test results.

Previous related incidents

The Airbus Design Office reported that they had no similar cases of this specific mode of CPC malfunction. However, two previous serious incidents occurred in 2000 and 2006, in which the standby CPC did not take control from the operational CPC during a malfunction. The incidents were investigated by the Switzerland Aircraft Accident Investigation Bureau (AAIB) and the United Kingdom (UK) Air Accidents Investigation Branch (AAIB) respectively.

AAIB Switzerland

Pressurisation emergency, Final Report No. 1820 by the Aircraft Accident Investigation Bureau concerning the serious incident to the aircraft Airbus A321-111, HB-IOA, operated by Swissair under flight number SWR809 on 21 February 2000 during the flight.

According to the investigation report, at FL 330 the aircraft had a rapid increase in cabin altitude. CPC 2 was in control and indicating a malfunction without CPC 1 taking control. Shortly afterward, CPC 1 indicated a failure and the outflow valve remained half-open. An EXCESS CAB ALT warning was triggered, emergency descent initiated, and cabin pressurisation managed in manual mode. A defective cabin pressure sensor was subsequently identified.

AAIB United Kingdom

Serious incident involving an Airbus A320-232, registered G-MIDW, on 8 October 2006.

According to the investigation report, at FL380 the CAB PR EXCESS CAB ALT warning displayed, but the flight crew noted the cabin pressurisation system parameters were normal. Although not experiencing any physiological symptoms of hypoxia, the flight crew donned their oxygen masks. In accordance with their FCOM Pressurization: controls and indicators, the captain changed the operational CPC from 1 to 2.^[8]

Note: If the pilot suspects that the operating pressurization system is not performing properly, he [she] can attempt to select the other system by switching the MODE SEL pushbutton to MAN, for at least 10 seconds, then returning it to AUTO.

After selecting CPC 2, the cabin altitude indicated it was above 10,000 ft. The captain suspected this to be in error and reselected CPC 1. After a few minutes the captain reselected CPC 2 for a cross-check and noted the cabin altitude indicated about 14,000 ft. The captain then reselected CPC 1. The AAIB concluded that the absence of any physiological symptoms of hypoxia, and the expectation of the automatic transfer of control in the event of a malfunction, suggested to the captain the fault was with CPC 2, which led to the decision to reselect CPC 1. The cabin crew then reported to the flight crew that the passenger oxygen masks had deployed. The flight crew declared a MAYDAY^[9] and conducted an emergency descent to 10,000 ft.

Airbus confirmed an unspecified fault within the SYS 1 CPC and advised:

The failure scenario has been reviewed by the Airbus PSC (Product Safety Committee) in Feb 07. This scenario is rare (only one case reported up to now) but the information provided to Crew was confusing. This subject will be therefore further investigated by this Safety Committee to review possible improvement in the current architecture. (Next screening end of May 07).

Pressurisation system product improvements

Following the 2006 incident, investigated by the UK AAIB, several improvements to the system were introduced by Airbus. They included an amendment to the FCOM CAB PR EXCESS CAB ALT emergency procedure; consolidation of the CPC pressure information; and a new memo for the electronic centralised aircraft monitoring (ECAM) system when oxygen masks are deployed in the cabin.

Emergency procedure

The FCOM CAB PR EXCESS CAB ALT emergency procedure was amended to include the following information for the flight crew:

Rely on the CAB PR EXCESS CAB ALT warning even if not confirmed on the CAB PRESS SD [status display] page. The warning can be triggered by a cabin pressure sensor different from the one used to control the pressure and display the cabin altitude on the SD.

Consolidation of pressure information

Consolidation of the CPC pressure information for the A320 aircraft family was embodied through Airbus Service Bulletins (SBs) A320-21-1203 (outflow valve) and A320-21-1204 (CPC), introduced in February 2014. Service Bulletin A320-21-1203 introduced a modified outflow valve, which incorporated a pressure sensor within the Electronic Box (E/Box) to provide a second calculated cabin pressure value for comparison with the CPC calculated cabin pressure value to improve the system built-in-test capability. Service Bulletin A320-21-1204 introduced a modified CPC to communicate with the E/Box and allow the built-in-test-equipment to detect erroneous pressure data acquisition by comparison of the CPC pressure sensor value with the E/Box value (subject to embodiment of A320-21-1203). If the two values of calculated pressure differ too much, the active CPC will indicate a system fail and enable the standby CPC to take control of the pressurisation.

The SBs were recommended and not mandatory. The operator reported that they had reviewed the service bulletins and elected not to incorporate them in PK-AXD as they did not identify the potential consequences. The SBs included the potential consequence of incorrect control of the cabin pressure on their front page.

Electronic centralised aircraft monitoring system update

A further service bulletin, SB 35-1068, allowed the display of an ECAM message when the passenger oxygen masks are deployed in the cabin – OXY PAX ON. This message is displayed in green when both CPCs detect excessive cabin altitude and in amber when one CPC or both CPCs do not detect excessive cabin altitude.^[10] This will alert the flight crew to the condition of the passenger oxygen masks, without the need to rely on a verbal report from a member of the cabin crew. The operator reported that it elected not to incorporate the service bulletin as it was classified as recommended, rather than mandatory. However, the incorporation of SB 35-1068 would probably not have influenced the incident.

ATSB follow-up

In response to an ATSB query whether the circumstances and procedure for flight crew to manually change the operational CPC would be worth considering for inclusion in the CAB PR SYS 1(2) FAULT emergency procedure, Airbus reported that:

A modification of the CAB PR SYS1(2) FAULT procedure to be displayed on the ECAM requires a new Flight Warning Computer (FWC) standard that means development time before all aircraft can be fitted with this standard (retrofit time). A much quicker solution is to reintroduce the philosophy of this old note into the operational documentation. It already exists as a recommended action within the Quick Reference Handbook in the case of abnormal vertical speed. In this event, we know that the CPC1 computed and displayed wrong and excessive cabin altitudes, but without any previous indications of abnormal cabin vertical speed. Therefore, we intend to recommend a manual CPC changeover in case of excessive cabin altitude. This modification will be implemented in the A320 Quick Reference Handbook revision March 2019.

The ATSB noted that although the incident flight fault was isolated to the CPC 1 circuit board, it resulted in incorrect cabin pressure values, and therefore queried whether the embodiment of SBs A320-21-1203 and A320-21-1204 would have affected the performance of CPC 1. In response, Airbus reported that:

The implementation of the two SBs improves the cabin pressure control by modifying (1) the outflow valve with the introduction of a second pressure sensor and (2) the CPC to enable it to detect pressure sensor discrepancies by comparison of the two cabin pressures calculated using the CPC pressure sensor on one side and the outflow valve pressure sensor on the other side. Note: the comparison is done at the level of the calculated cabin pressure and not at pressure sensor level.^[11] It is therefore considered that the implementation of the SBs would have helped to detect the CPC 1 failure earlier and would have enabled an automatic changeover to CPC 2.

Cabin safety

The cabin crew consisted of a senior cabin crew member (P1) and cabin crew member P4, seated at the front of the cabin, and two cabin crew members, P2 and P3, seated at the rear of the cabin.

Events in passenger cabin

Cabin crew recollection of events

The cabin crew were preparing for the food service at the time the CPC 1 malfunctions started. At this time, P1 and P4 experienced some ear discomfort, but not P2 and P3. Before P1 spoke to the flight crew, the cabin emergency lighting, which included the seatbelt signs, activated intermittently. This was reported by P1 to the flight crew as ‘like an indication of depressurisation’. When the seatbelt signs illuminated, P3 checked to see if the passengers had fastened their seatbelts. P2, P3 and P4 reported that they initially believed the seatbelt signs were activated by the flight crew for turbulence.

Following her conversation with the flight crew about the symptoms in the cabin, P1 made a public address (PA) announcement for passengers to fasten their seatbelts, and began checking the passengers. When P1 heard the flight crew PA for the emergency descent, she moved from about row five to her seat at the front of the cabin and repeated the emergency descent PA - ‘EMERGENCY DESCENT, EMERGENCY DESCENT, EMERGENCY, EMERGENCY’ (in English only). She then called the flight deck and reported the oxygen masks had not deployed.

When the masks deployed, she donned her mask and announced three times to the passengers - ‘GRAB MASK, FASTEN SEATBELT, BREATHE NORMALLY’. In addition to her announcement, she used hand signals to demonstrate the instructions. This announcement and the use of hand signals were in accordance with the operator’s standard operating procedures.

At the rear of the cabin, P2 initially announced ‘SIT DOWN’, while waiting for the masks to deploy. When the masks deployed, P2 and P3 noted the passengers at the rear did not appear to know what to do, therefore the crew members announced the instructions, ‘GRAB MASK, FASTEN SEATBELT, BREATHE NORMALLY’, and demonstrated the actions, which appeared to elicit a positive response from the passengers.

Following the emergency descent, P1 heard the announcement that the aircraft was at a safe level and she then checked on the welfare of the other cabin crew members and confirmed there was no damage to the cabin. She instructed the other cabin crew to take the portable oxygen bottles for the passenger welfare checks and then contacted the flight crew to confirm there were no further problems. P1 then assisted the other cabin crew members with their passenger welfare checks and reported that no one needed medical assistance.

After arrival at Perth, P1 noted several passengers had donned their life jackets. During disembarkation she then received several passenger reports of the cabin crew members at the rear panicking, shouting and alarming the children. When P1 followed up with those members, P3 reported that she may have appeared to be panicking because she felt the oxygen mask was not providing sufficient oxygen. P2 and P3, at the rear of the cabin, reported that they were shouting as this was the procedure. P3 reported that she shouted at a passenger who stood up during the descent due to the risk of a fall.

Operator’s emergency announcement

When the passenger oxygen masks were released, an automatic recording was broadcast in seven different languages sequentially (English, Indonesian, Mandarin, Malaysian, Thai, Arabic and Japanese). The English instructions were:

Attention, Attention. There has been a loss of pressure in the cabin. Pull down firmly on the nearest mask, place over your nose and mouth, adjust the headband, and breathe normally. Attend to yourself before helping your child. If you are standing, go to the nearest seat, fasten your seatbelt, put on a mask and breathe normally. The cabin pressure will return to normal in a short time.

Although passengers reported hearing both the cabin crew commands and this automatic recording, it is not clear if they were at different times or at the same time. Given that the automatic recording starts when the oxygen masks drop on a sequential loop through the seven languages, it is probable that the cabin crew commands were given at the same time as the automatic recording was still playing.

Cabin crew procedures and training

Cabin crew depressurisation procedure

The operator’s Safety emergency procedures manual provided instructions for flight crew and cabin crew for a depressurisation. The action for the flight crew to alert the cabin crew of a depressurisation was the PA announcement ‘EMERGENCY DESCENT’. The cabin crew were then required to take the following action:

1. Grab and don nearest oxygen mask. Cabin crew must attend to their own oxygen needs first in order to be able to assist passengers.

2. Sit on nearest seat and fasten seatbelt. If necessary, sit on the floor and hold on to rigid structure.

3. If possible use the PA system or shout command to passengers through oxygen mask twice: ‘GRAB MASK, FASTEN SEATBELT, BREATHE NORMALLY’.

4. If descent not evident after masks drop, the nearest cabin crew to the Flight Deck shall contact the flight crew via interphone…

5. Remain seated until the PIC [pilot-in-command] advises cabin crew via PA that aircraft is at safe level.

After the aircraft has descended to a safe level, the flight crew were required to alert the cabin crew with a PA ‘CABIN CREW, AIRCRAFT AT SAFE LEVEL’, at which stage the cabin crew were required to attend to passengers and inspect the cabin.

Although not published in their emergency procedures manual, AirAsia had additional guidance in their training drills handbook if oxygen masks did not deploy. This included the announcement: ‘KEEP CALM, REMAIN SEATED, FASTEN SEATBELT’ [English and Bahasa].

Cabin crew training

• P1 had been employed by the operator for 12 years and her most recent emergency drills training (including depressurisation drill) was conducted in February 2017.
• P2 and P3 had been employed by the operator for three years and their most recent emergency drills training were in September and October 2017, respectively.
• P4 had been employed by the operator for four years and his previous emergency drills training was in July 2017.

The operator provided their cabin crew with annual emergency training. This was in accordance with the International Civil Aviation Organization (ICAO) Annex 6 requirement for a recurrent training program to be completed annually. Their annual training was either classroom alone, or included the emergency drills module at a maximum interval of 24 months. According to the operator, the drills modules ‘require crew members to actually operate the items of emergency equipment (hands-on)’. The cabin crew members on board the incident flight were current for their emergency drills training at the time of the incident.

The ICAO Cabin crew safety training manual provides further guidance and explanatory material to the requirements of Annex 6. The manual explains that although there is a requirement for annual recurrent training, not all competency elements are required to be covered annually. It is the responsibility of each (ICAO Member) State to determine the cycle (time-period) within which all recurrent training must be completed. The manual provides a 36-month cycle as an example.

The ATSB noted from a review of the regulations from five different jurisdictions that the frequency for cabin crew emergency drills training is generally low when compared with flight crew.^[12] Of those reviewed, the ATSB found the frequency of training for cabin crew emergency drills ranged from between a 12-month cycle to no requirement for recurrent drills training.^[13][14]

The ATSB also noted that the ICAO Cabin crew safety training manual made several recommendations to improve simulated exercises. They included joint flight crew and cabin crew exercises and a solo exercise for cabin crew members, so they could demonstrate their ability to take command of a situation. It also recommended other cabin crew trainees and employees act the role of passengers during the exercises. The intent was to ‘offer an acceptable level of practical experience close to what can be expected in actual occurrences’.

To support the delivery of the depressurisation module of emergency drills training, the operator used a single-aisle cabin trainer with deployable passenger emergency oxygen masks. The training for depressurisation included the physiological symptoms of hypoxia and how to manage the scenario. This included cabin preparation and instructions to passengers. The operator provided the ATSB with a training video of cabin crew depressurisation drills, which included additional personnel acting as compliant passengers.

Within the aviation industry, incorporating scenarios within training has been used extensively with flight crew.^[15] It has been found that crew who complete scenario-based training demonstrate scores higher in team co-ordination dimensions (such as communication) and make fewer errors in tasks compared to the crew who do not complete this type of training.^[16]

Passenger safety information for oxygen masks

Safety information standards

The requirements for passenger safety information on the use of oxygen equipment on international flights are published in ICAO Annex 6. Annex 6 detailed the following:

4.2.12.1 The operator shall ensure that passengers are made familiar with the location and use of:

d) oxygen dispensing equipment, if the provision of oxygen for the use of passengers is prescribed.

To provide guidance material in support of the provisions of Annex 6, in 2018 ICAO published Doc 10086: Manual on information and instructions for passenger safety. Doc 10086 provided the following explanatory material for the safety demonstration of oxygen masks:

2.6.2 The safety demonstration should include information about the following items:

e) location and use of oxygen masks, if applicable, including:

1) The actions to be performed by a passenger to: i) obtain a mask; ii) activate the flow of oxygen; and iii) don and secure the mask; and

2) The requirement for a passenger to don and secure his/her mask before assisting another passenger with his/her mask.

Chapter 3: Passenger safety briefing card, provided the same guidance for the content of the safety briefing card, with respect to oxygen masks, as per the safety demonstration.

In 2003, the United States Federal Aviation Administration published Advisory Circular 121-24C: Passenger safety information briefing and briefing cards. In addition to the need to demonstrate to passengers how to start the flow of oxygen, the circular also advised operators that their safety briefing ‘should include the information that oxygen mask reservoir bags may not inflate, although sufficient oxygen is flowing into the bag’.^[17]

In 2018, the Civil Aviation Safety Authority published version 2 of Civil Aviation Advisory Publication (CAAP) 253-02: Passenger safety information: Guidelines on content and standard of safety information to be provided to passengers by aircraft operators. CAAP 253-02 provided the following information about oxygen equipment for the pre-take-off oral brief:

Oxygen. Crew members must brief passengers on the use of oxygen where applicable:

i. This briefing should include locating, donning and adjusting the equipment, and any action that might be necessary to start the flow of oxygen. Passengers should also be given instructions regarding the automatic appearance of the masks (where applicable) and be advised to don their own oxygen mask before assisting others.

ii. It is suggested that passengers be advised (where applicable) that oxygen will flow through the mask even though the bag may not inflate.

CAAP 253-02 provided the following information for oxygen masks in the content of safety information cards:

Oxygen masks. The card should contain instructions on the location, donning and means for adjusting oxygen masks; any further actions needed to start the flow of oxygen; and instructions to passengers to don their own mask before assisting children.

The Civil Aviation Safety Authority assessed foreign air transport operators with Form 073-C, which was in accordance with the requirements of ICAO Annex 6.

Operator’s passenger safety information

The operator’s safety instructions to the passengers were provided in English and Bahasa before take-off (see Passenger attentiveness to the safety briefing). The announcement for oxygen masks included the following:

Should an OXYGEN MASK like this drop from the compartment above your seat, immediately pull the mask firmly towards you. Place the mask over your nose and mouth with the headband tightly around your head and breathe normally. Place your own mask [on] first, before assisting others under your care.

The operator provided a safety information card to every passenger seat. The operator’s safety information card content included instructions in English and Bahasa with images to demonstrate each of the three steps (Figure 2):

1. Pull the mask down towards you.

2. Place the mask over your nose and mouth, place strap behind your head and breathe normally.

3. Place mask on yourself before helping those under your care.

Figure 2: Passenger safety information card oxygen mask instructions

Source: AirAsia Indonesia, annotated by ATSB.

Passenger attentiveness to the safety briefing

The cabin crew delivered the passenger safety briefing after aircraft pushback from the gate. This was delivered without the support of audio-visual briefing media. The senior cabin crew reported the passenger attentiveness as normal. The cabin crew at the rear of the aircraft reported about 70 per cent of passengers were attentive to the safety briefing. The cabin crew members at the rear and over-wing exit noted several passengers were sleeping and asked some of the passengers to turn off their portable electronic devices, or remove headsets for the safety briefing. The cabin crew member at the front of the aircraft reported that the passengers were attentive.

Passenger oxygen units

Each row of seats in the passenger cabin had an emergency oxygen container installed above it. The container doors open automatically when the cabin altitude reaches 14,000 ft, or manually by flight crew selection. Each container had one chemical^[18] oxygen generator canister, four masks with lanyards and associated supply hoses (Figure 3).

Figure 3: Deployed oxygen unit

Source: ATSB

All four lanyards were attached to one release pin, which, when removed, allowed a spring-loaded firing pin to strike a percussion cap and initiate the chemical reaction (Figure 3 & 4). Only one lanyard was required to be pulled to remove the release pin and drop all four masks for the unit. Oxygen gas was released as a product of the chemical reaction. A thermal indicator on the canister will turn black to indicate the chemical has burned, and a green stripe will appear in the supply hoses to indicate oxygen has flowed (Figure 4).

Figure 4: Release pin and lanyards (top) and hose connection (bottom)

Source: ATSB

There were 180 passenger seats in the aircraft,^[19] and, with four masks for each row of three seats, there were 240 masks provided for the passenger seating. This ensured about a 33 per cent excess in the number of passenger oxygen masks. The certification requirement was for the number of dispensing units and outlets to exceed the seating capacity by 10 per cent, with the extra units distributed as uniformly throughout the cabin as practicable.^[20] In the event that a container door does not open, the aircraft was equipped with a manual release tool, which may be used by the cabin crew to release a unit. This was not used in-flight as the cabin crew remained seated during the emergency descent.

Performance of the passenger oxygen units

The ATSB inspected the cabin of the aircraft, with attention to the performance of the passenger emergency oxygen system, and noted the following:

• two containers did not open at seats 23 FED and 27 FED (Figure 5)
• two canisters had the release pin removed, but did not activate to produce oxygen, at seats 29 CBA and 31 CBA
• two containers were found deployed, but the masks were not pulled to remove the release pin at seats 17 CBA and 25 FED
• all other passenger seat masks were deployed and their associated canister activated
• all cabin crew and toilet masks were deployed
• one portable oxygen unit appeared to have been removed from storage.

Figure 5: Passenger oxygen units

Depiction of the passenger oxygen units, as found by the ATSB after the incident aircraft landed.
Source: ATSB

Airbus reported that incorrect mask packing could result in additional force on the container door which may prevent an automatic release of the door. In addition, there is a clearance limit between each container and adjacent panel, which could obstruct the automatic release of the door if the tolerance was infringed. According to the operator’s passenger manifest, there were passengers allocated to seats 17 BA (lanyards not pulled), 23 DEF and 27 EF (masks did not deploy), and 29 CB and 31 BA (masks did not provide oxygen).

The passenger oxygen system is subject to two separate maintenance checks. An operational check of manual mask release is required every 80 months or 8,500 flight hours. A functional check of the automatic release and detailed inspection of masks and oxygen generators is required every 72 months or 24,000 flight hours. The incident aircraft satisfactorily passed the operational check of the manual release during the last C06 inspection on 15 August 2016, and the functional check of the automatic release during the last C03 inspection on 17 July 2012.

Passenger survey information

The ATSB conducted a voluntary passenger survey about their experiences on the flight, which included the passenger emergency oxygen units. The survey included a section for parents to complete on behalf of their children. From 146 passengers on board, 67 responses were received, comprised of 57 adult and 10 children. The survey was completed within six months of the incident date with a response rate of 46 per cent.^[21]

Analysis of the survey results showed the following information from the adult respondents about the safety information:

• 98 per cent reported that they paid attention to the pre-flight safety demonstration or safety information card, and 74 per cent reported they paid attention to both.
• 81 per cent reported the safety information for the use of the oxygen masks was either ‘easy’ or ‘very easy’ to understand. Seventeen per cent reported it as ‘neutral’ and 2 per cent reported it as ‘hard’.

The following information was received in response to the deployment of the oxygen masks:

• In addition to the finding that the units in rows 23 DEF and 27 DEF did not deploy, it was reported that the units in rows 8 CBA, 10 CBA and 17 CBA did not automatically deploy, and were pulled down by passengers.
• 33 per cent reported the pre-recorded oxygen mask announcement was in a foreign language.
• 72 per cent reported their masks deployed automatically, 19 per cent reported they deployed automatically but had to pull them down, and 9 per cent reported their masks did not deploy.
• 56 per cent reported they were ‘somewhat confident’ in using their oxygen masks, and 32 per cent reported they were ‘very confident’. Twelve per cent reported they were ‘not confident’ due to not knowing if the oxygen was flowing, or feeling panicked, or not realising they had to pull down on the mask to start the flow of oxygen.
• 21 per cent reported oxygen was ‘not flowing’ from their mask, 21 per cent reported it was ‘flowing a little’, 5 per cent reported it was ‘flowing a lot’, and 53 per cent reported they could not tell if oxygen was flowing.
• Six respondents provided comments about the oxygen mask bag, which included that they were uncertain if oxygen was flowing because the bag did not inflate, and that the instructions should include reference to the fact that the bag may not inflate when oxygen is flowing.
• Two respondents reported the oxygen hose was required to be pulled to activate the flow of oxygen (this was a free text response, so it is possible the actual number was higher).

The following information was received in response to the cabin crew announcements and actions after the emergency descent started:

• 53 per cent reported that the cabin crew instructions included ‘emergency’, ‘brace’, ‘get down’ and ‘crash position’.
• 14 per cent reported that the cabin crew provided the instructions ‘sit down, fasten seatbelt, put masks on, and calm down’, repeatedly.
• 56 per cent reported the instructions provided during the emergency descent were not clear due to the cabin crew appearing distressed, which affected their ability to communicate with the passengers, limited English proficiency, the automatic broadcast was in a foreign language and there was no information provided about the reason for the emergency descent.
• 56 per cent reported they either felt panicked themselves, or observed others appearing to be panicking during the incident.
• Several respondents acknowledged that this may have been the first time the cabin crew had experienced such an event. Three considered the cabin crew responded well, given the instructions they provided were in a second language. Seven reported that the flight crew could have provided more information about the situation.

The respondents with children provided the following information:

• One reported there was no mask for their child and they provided their child with oxygen from their own mask.
• One reported the oxygen ceased to flow before the alarm ceased.
• One reported that there was no oxygen flow from the mask deployed for their child.
• Three reported their child experienced emotional distress from the incident.

Previous related safety issue

Following the rapid depressurisation of a Boeing 747, carrying 369 passengers at FL 290 on 25 July 2008, the cabin crew reported that while most passengers began to use the oxygen masks appropriately, some passengers had to be given immediate and direct instruction how to use their masks.^[22] As a result of this observation, the ATSB raised safety issue AO-2008-053-SI-02: Inadequate passenger safety briefing about oxygen masks, on 22 November 2010.

Safety issue

The safety information provided to passengers did not adequately explain that oxygen will flow to the masks without the reservoir bag inflating.

Proactive action by the operator

The operator indicated that the standard pre-flight safety video / briefings provided to passengers have been modified to reinforce the message that users must pull down on the mask firmly to activate oxygen flow, and to include the comment ‘Oxygen will flow without the bag inflating’.

__________

8. This was in the system description section of the FCOM and not in the abnormal and emergency procedures section. The 2006 FCOM procedure suggests to the flight crew the circumstances in which they may wish to consider changing the operational CPC, which was subsequently amended to the procedure at the time of the PK-AXD incident, as described in Appendix A - Incident flight faults.
9. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
10. The passenger oxygen mask system has its own pressure sensor and is not reliant on the CPC pressure sensor module.
11. Refer to Appendix B – Manufacturer’s inspections and test results, for the explanation of raw versus calculated cabin pressure values.
12. ICAO Annex 6 requires flight crew to conduct proficiency checks twice annually, and Mahony et al. (2008) research into cabin crew skills in first aid found that after 12 months they could not perform satisfactorily to manage a cardiac arrest scenario.
13. Where there was no requirement for cabin crew recurrent emergency drills training, there was still a requirement for recurrent annual training in emergency equipment and procedures.
14. The ATSB noted that the Civil Aviation Safety Authority (2015) draft Part 121 Manual of Standards for large aeroplane operations included depressurisation drills for initial cabin crew training only and omitted it as a recurrent training requirement. The Civil Aviation Safety Authority responded that this document is an industry draft document, which is still subject to consultation, and that during development of the final document, the content of the relevant ICAO documents will be considered for inclusion as appropriate.
15. Fowlkes J, Dwyer DJ, Oser RL and Salas E, 1998. Event-based approach to training (EBAT). The International Journal of Aviation Psychology, 8(3), 209-221.
16. Leedom, DK and Simon, R 1995. Improving team co-ordination: A case of behaviour-based training. Military Psychology, 7(2), 109-122.
17. The passenger oxygen is a continuous flow and whether or not the bag inflates will depend on the flow rate and passenger demand.
18. There is a combination of chemicals with the oxygen generator. The main ingredient is sodium chlorate, which produces oxygen gas when it is heated to 300 °C.
19. The aircraft was fitted with 30 rows of seats, but there was no row numbered 13. Therefore the last row was 31.
20. CS 25.1447: Equipment Standards for Oxygen Dispensing Units.
21. There was a delay of three months before the passenger manifest data was received, which may have adversely influenced the response rate and the memories of the respondents.
22. On average, three depressurisation events of high capacity passenger transport aircraft are reported to the ATSB each year.

Safety analysis

Introduction

In response to the pressurisation system malfunctions and emergency descent of AirAsia Indonesia Airbus A320, registered PK-AXD, on 15 October 2017, the ATSB undertook enquiries into the technical failure, performance of the flight crew and cabin safety, which included interviewing cabin crew and conducting a passenger safety survey. While the investigation findings for the technical failure relate to the A320 aircraft operated by AirAsia Indonesia, the cabin safety findings may be relevant to other aircraft types and other airline operators.

Pressurisation system performance and procedures

Emergency descent

At about 1122 local time, the aircraft departed Perth Airport for the destination of Bali, Indonesia, with cabin pressure controller 1 (CPC 1) controlling cabin pressurisation in automatic mode. While on climb, passing FL 250 at about 1141, the flight crew received a series of intermittent cabin pressure system 1 (CPC 1) fault messages. However, each time the flight crew selected the cabin pressure display page, the fault message cleared.

Eight fault messages were generated between 1141 and 1148. At 1148:14 the cabin differential pressure had increased to 8.4 pounds per square inch (psi). Five seconds later at 1148:19 the cabin differential pressure had reduced to 7.8 psi. In that time, CPC 1 (incorrectly) commanded the outflow valve to close from the 6 per cent open position to 2 per cent open. This led to the over-pressurisation of the aircraft cabin and activation of the cabin safety valve(s). It is likely that between the period of 1148:14 and 1148:19, the cabin differential pressure reached 8.5 psi, which was within the tolerance to activate the safety valve(s), but the actual time of opening was not traceable.

At 1148:29 the flight crew selected manual control of the pressurisation system, and noting the high rate of cabin altitude climb of 1,100 ft/min, they attempted to manually set 500 ft/min, which was the published target figure. Between 1151 and 1155, while in manual cabin pressure control, the excess cabin altitude alert triggered three times. As the passenger oxygen masks are automatically deployed in response to a sensor independent of the CPCs, and there were no further excess cabin altitude warnings after CPC 1 generated its failure message, it is likely the cabin altitude never exceeded 14,000 ft (the trigger for passenger oxygen masks) and therefore there was low risk of a hypoxia-related event.

The repeated excess cabin altitude warnings were likely the result of what the manufacturer described as ‘abnormal stepwise changes’ in CPC 1’s calculated cabin pressure values, which deviated from the raw cabin pressure values.

As a result of the excess cabin altitude alerts, the flight crew conducted the emergency descent procedure, starting the descent at about 1152:20. A review of operator’s procedures, A320 emergency procedures, cockpit and flight data recorders, found no significant discrepancies between the flight crew’s actions and published procedures. However, the flight crew reported that they should have stopped the climb when the cabin pressurisation system 1 fault messages started and given more attention to the cabin altitude.

The ATSB concur with the flight crews’ comment and note that if a depressurisation had occurred due to incorrect outflow valve control, in-lieu of over-pressurisation, stopping the climb at a lower level would have increased their time of useful consciousness in order to don their oxygen masks. The time of useful consciousness is considered to be the ‘amount of time an individual is able to perform useful flying duties in an environment of inadequate oxygen’, and, for example, this will decrease from 3–5 minutes at 25,000 ft to 30–60 seconds at 35,000 ft.^[23]

Cabin pressure controller 1 fault

The aircraft’s CPC 1, CPC 2 and outflow valve were sent to the manufacturer for inspections and tests. They found that CPC 1 produced 12 intermittent fault messages between 1141 and 1151, before registering a failure at 1159. They concluded an automatic changeover from CPC 1 to CPC 2 would likely have occurred at 1159, following the CPC 1 failure code. However, the flight crew had already intervened and taken manual control of the system at 1148:29. Bench testing of CPC 1 reproduced the fault with and without the CPC 1 pressure sensor module, which isolated the fault to the CPC 1 main circuit board. The fault could not be isolated any further.

From the test results, the ATSB noted that if the flight crew had selected CPC 2 (manual changeover) during the initial period of cabin pressurisation system 1 fault messages, the subsequent alerts and emergency descent might have been avoided. Airbus have reviewed the incident flight faults and elected to amend the A320 Quick Reference Handbook to provide further instructions to flight crew as to when it would be appropriate to manually change the active the CPC, rather than rely on automatic change (see Safety issues and actions).

Service bulletins

Following a previous related incident, Airbus produced two service bulletins to improve the reliability of cabin pressure control. They required the modification of the cabin pressure controllers and outflow valve. Pre-modification, with only one pressure sensor, the system built-in-test-equipment could not detect incorrect cabin pressure values, used to schedule the position of the outflow valve. The incorporation of both service bulletins provided a second calculated pressure sensor value at the outflow valve, which the built-in-test-equipment could compare with the active CPC calculated pressure sensor value to detect a mismatch in calculated values. The incident aircraft did not have the service bulletins incorporated at the time of the incident.

The component manufacturer’s testing found that on several occasions the calculated cabin pressure deviated from the raw cabin pressure, with the calculated values identified as corrupted values. In addition, the crew reports of ear discomfort, which is a common symptom of pressure changes, and activation of the safety valve(s) suggested that CPC 1 was providing incorrect scheduling information to the outflow valve before the excess cabin altitude alerts. The incorrect scheduling of the outflow valve position suggested CPC 1 was using incorrect calculated pressure values, resulting in a cabin overpressure, before the flight crew had selected manual control of the system. Therefore, the ATSB requested, and received, analysis from Airbus about the likely effect of the incorporation of the service bulletins in this incident scenario. In response, Airbus concluded that the embodiment of the service bulletins by the operator would have helped to detect the CPC 1 failure earlier and that would have enabled an automatic changeover to CPC 2.

In consideration of the likelihood that incorrect calculated pressure values were used by CPC 1 prior to, and after, the flight crew selected manual control, and that incorporation of the service bulletins would have provided the system built-in-test-equipment with a different source of calculated pressure values for comparison, the ATSB concurred with Airbus. It was therefore considered likely that the incorporation of the service bulletins would have facilitated the earlier activation of a CPC 1 system fail, automatic changeover to CPC 2, and prevention of the nuisance warnings and associated emergency descent.

Cabin safety

Passenger oxygen mask instructions

A high percentage of passengers that responded to the survey indicated that they had given their attention to the operator’s safety information card and safety demonstration. They also reported the safety information card was easy to understand. However, despite the generally high positive response to the safety information presented, a number of respondents reported they were not confident in using the oxygen masks and a high number of respondents reported that oxygen was either not flowing, or could not tell if it was flowing (this number was far greater than the number of oxygen units that malfunctioned).

The operator’s safety information included the instruction to ‘Pull the mask down towards you’. This was the required action to start the flow of oxygen, which was consistent with several published standards for passenger safety briefing. However, as it did not state that this action would start the flow of oxygen, there was a risk that passengers would not understand the association. Two survey responses that the ‘oxygen hose’ was required to be pulled to activate the flow of oxygen, suggested a possible misunderstanding amongst some of the passengers.

In addition to the uncertainty surrounding the activation of oxygen flow, a number of passengers reported that the oxygen mask bag did not inflate. This was associated with the comment that they did not feel that there was oxygen flowing, and a significant percentage who reported they could not tell if there was oxygen flowing. The chemical oxygen generator is a constant flow device, which will not respond to passenger demand and therefore the relationship between the rate of flow and demand will determine if the mask bag inflates. Low breathing rates will allow the bag to inflate, whereas higher breathing rates, such as those experienced during an emergency, may result in the bag not inflating.

The International Civil Aviation Organization (ICAO) and various regulatory authorities have recognised that ‘Well-informed, knowledgeable passengers have a better chance of surviving a life-threatening situation that may occur on board an aircraft.’ While the operator’s passenger safety briefing and safety information card met the requirements of ICAO Annex 6 for passenger oxygen masks, the ATSB’s review of various passenger safety briefing standards, and a safety issue from a previous ATSB investigation, led to the conclusion that the oxygen mask information provided to passengers could be improved. In a depressurisation scenario, more specific information about the activation of oxygen flow, and that the oxygen mask bag may not inflate, will improve passenger knowledge and thereby likely reduce passenger anxiety and their susceptibility to a hypoxia-related event.

Passenger oxygen system

After the aircraft landed at Perth Airport, the ATSB inspected the passenger oxygen units and found two units had not deployed (23 FED and 27 FED) and two units had deployed and the release pin removed from the canister, but the firing pin had not activated (29 CBA and 31 CBA). The passenger survey results suggested that there were some additional units that were pulled-down manually by passengers.

Despite the numerous passenger reports of uncertainty about the flow of oxygen, the ATSB found that all canisters, with the exception of 29 CBA and 31 CBA, had activated and oxygen flowed in the hoses. All events where oxygen masks are deployed may experience some failures like this, which is why there is a requirement for a minimum of 10 per cent extra. The aircraft exceeded the certification requirement by providing about 30 per cent extra masks and there were no reported incidents of hypoxia, although some passengers had to move around the cabin to access a spare mask. Regarding the reported and observed malfunctions, the ATSB noted the following:

• Airbus reported that a unit may not deploy if it is incorrectly packed or does not have the minimum separation with adjacent units.
• The two units where the canister firing pin did not activate had their release pin removed, which suggested a possible internal fault with the firing pin spring.

Cabin crew response to the emergency descent

In the event of an emergency situation, the cabin crew are required to perform a safety leadership role for the passengers in the cabin. In a stressful situation, they are the individuals the passengers will turn to for directions. Their ability to effectively direct the passengers will depend on their own knowledge, skills, and composure under increased stress. According to the ICAO Cabin crew safety training manual, cabin crew members play an important proactive role in managing safety and the prevention of accidents. This includes preventing the escalation of risk associated with events in the cabin and informing the flight crew of abnormal situations observed such as pressurisation problems.

Prior to the emergency descent, the senior cabin crew (P1) noticed the intermittent activation of the emergency lighting and seatbelt signs in the cabin and contacted the flight crew to inform them of the indications. In addition to the lighting, P1 also discussed ear discomfort with the flight crew and suggested the indications were like a depressurisation. Following the captain’s announcement of an emergency descent, P1, upon noting the delay in the deployment of passenger oxygen masks, contacted the flight crew and informed them of the problem. These actions were consistent with the role of informing the flight crew of abnormal situations in the cabin, as described by the ICAO Cabin crew safety training manual.

At the time the captain announced the emergency descent, P1 was in the cabin aisle. She immediately returned to her seat at the front of the cabin and repeated the captain’s emergency descent announcement to the passengers. This announcement was not in accordance with the operator’s procedures for a depressurisation, but the passenger oxygen masks had not deployed at that stage. Although her intent may have been to ensure everyone was seated, the manner of its delivery may have increased passenger anxiety.

The cabin crew reported that when the oxygen masks deployed, they shouted at the passengers to ‘GRAB MASK, FASTEN SEATBELT, BREATHE NORMALLY’. However, about half of the passenger survey respondents reported additional commands from the cabin crew members, such as ‘BRACE’, ‘EMERGENCY’, ‘GET DOWN’ and ‘CRASH POSITION’. The CVR recording also included ‘EMERGENCY’ calls from cabin crew. In addition, about half of the respondents reported feeling, or observing other passengers, in a state of panic. Several passengers associated their panic with these additional commands from the cabin crew and that some of the cabin crew members themselves appeared to be distressed.

Following the deployment of the oxygen masks, several passengers reported moving about the cabin to locate a spare mask. They each reported a cabin crew member shouted an instruction at them to sit down when they moved. This included situations where a passenger either changed seats or reached over a row of seats to grasp a spare mask. Therefore, it is likely that some of the additional commands the cabin crew shouted were in response to passengers moving around the cabin.

The ATSB noted that, while the cabin crew were issuing commands in a second language, the use of the words ‘BRACE’ and ‘CRASH POSITION’, during an emergency descent, may have resulted in a misunderstanding by the passengers of the expected outcome. The command ‘BRACE’ is a command used when impact with land or water is imminent. This may have resulted in the misapprehension by some passengers that the aircraft was going to crash, rather than conduct a controlled descent to 10,000 ft. As a result, some passengers donned their life jackets during the emergency.

Passenger panic may result in increased difficulty following instructions at a time the cabin crew can only provide limited assistance. This could be alleviated by the cabin crew providing clear, concise, assertive instructions to the passengers during the emergency; and the flight crew providing a brief explanation of the nature of the problem and intended action as soon as practicable.

Cabin crew training

The cabin crew members were all considered current for their emergency drills training, which included depressurisation. The cabin crew involved reported that the depressurisation training included learning the signs and symptoms of depressurisation and how to manage it. They reported that recurrent training included revising the procedures for managing a depressurisation incident, including the emergency descent, the instructions to passengers and how to prepare the cabin.

The operator’s cabin crew department had published work instructions for their emergency training drills. The assessment criteria was in accordance with their published emergency procedures. According to the work instructions, two cabin crew trainees were assigned to perform the drill and one pilot trainee (if available) was assigned to perform the flight crew alerts to the cabin crew. While their work instructions did not include additional staff members assigned to role-play passengers, a training video showed that there were personnel used for this role. However, the role-playing passengers were compliant throughout the scenario, and the cabin crew may have had limited exposure to abnormal passenger behaviour during their drills. Therefore, the use of role-playing passengers in this instance may not have offered ‘an acceptable level of practical experience close to what can be expected in actual occurrences’ as recommended in the ICAO Cabin crew safety training manual.

During the emergency descent, the cabin crew were confronted with passengers acting in an unexpected manner when they moved about the cabin to obtain spare oxygen masks. This resulted in the cabin crew improvising their instructions to passengers and shouting commands, such as ‘GET DOWN’ and ‘BRACE’, which were appropriate for a crash landing or ditching, but unnecessary for a controlled descent to 10,000 ft. This suggested the operator’s current standard of assessment criteria, strictly against the published procedures, might not be adequate for scenarios that are more complex.

Role-playing abnormal passenger behaviour in emergency drills could offer the operator’s cabin crew assessors with the opportunity to expose their trainees to more complex scenarios, and provide a more realistic assessment of the trainee’s ability to take command of an emergency situation. While it may not be practical to routinely provide this resource during cabin crew emergency drills training, it may be feasible on a rotational basis, thereby providing them with the opportunity to practice their drills in a more realistic environment.

__________

23. Sheffield P and Heimbach R, 1996. Respiratory Physiology, in R DeHart (ed) Fundamentals of Aerospace Medicine, 2nd edn. University of Oklahoma, US; Williams & Wilkens.

Findings

From the evidence available, the following findings are made with respect to the pressurisation event involving AirAsia Indonesia Airbus A320, registered PK-AXD, 160 nautical miles north of Perth, Western Australia, on 15 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• During climb, the active cabin pressure controller produced a series of intermittent faults, which led to the cabin over-pressurising and the safety valve(s) opening. The malfunctioning controller then produced a series of intermittent excess cabin altitude alerts, which resulted in the flight crew performing the emergency descent in accordance with the procedure.
• The source of the cabin pressurisation system faults was isolated to the main circuit board in cabin pressure controller 1, which was the master controller. Cabin pressure controller 1 declared itself in failure after the flight crew had selected manual control of the cabin pressurisation system and therefore cabin pressure controller 2 did not take control.
• The operator had not incorporated two of the aircraft manufacturer's non-mandatory service bulletins for more reliable cabin pressure control, which likely would have facilitated the automatic changeover from cabin pressure controller 1 to cabin pressure controller 2, thereby preventing escalation of the malfunction.

Other factors that increased risk

• The pre-flight safety briefing and safety information card did not include a clear instruction on how to activate the flow of oxygen from the passenger oxygen masks and that the bag may not inflate when oxygen is flowing. This resulted in some passengers not understanding whether or not there was oxygen flowing in the mask [Safety issue].
• The cabin crew provided additional commands to passengers that were inappropriate for a depressurisation, which had the potential to increase confusion in the cabin and likely increased the level of panic experienced by some passengers.
• AirAsia Indonesia’s cabin crew emergency procedures training did not include the role-play of non-compliant passenger behaviour, which likely limited the cabin crew’s opportunity for exposure to more complex real-world scenarios, similar to what they encountered during the incident.

Other findings

• Following activation of the passenger emergency oxygen system, at least two units did not deploy, and two units that did deploy, did not activate to produce oxygen when their release pins were removed. However, as there were about 30 per cent more oxygen masks available than seats, sufficient masks were still available for passengers and cabin crew.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

Passenger oxygen mask instructions 

Safety issue number: AO-2017-098-SI-01

Safety issue description: The pre-flight safety briefing and safety information card did not include a clear instruction on how to activate the flow of oxygen from the passenger oxygen masks and that the bag may not inflate when oxygen is flowing. This resulted in some passengers not understanding whether or not there was oxygen flowing in the mask.

Safety Recommendation description: The ATSB recommends that AirAsia Indonesia take further action to review its current passenger pre-flight safety briefing and safety information card to ensure passengers are provided with clear instruction on how to activate the flow of oxygen from the passenger oxygen masks and that the bag may not inflate when oxygen is flowing.

Other safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Airbus

As a result of this occurrence, Airbus has advised the ATSB that they have taken the following safety action:

Procedures

The Quick Reference Handbook and Flight Crew Operating Manual for the Airbus A320, A330 and A340 aircraft were amended to include abnormal cabin altitude as a circumstance when the manufacturer recommends the flight crew perform a manual changeover of the active cabin pressure controller. The recommended actions include the procedural steps for the flight crew to follow to perform the changeover.

AirAsia Indonesia

As a result of this occurrence, AirAsia Indonesia has advised the ATSB that they have taken the following safety action:

Procedures

The AirAsia Safety Emergency Procedures Manual was amended to include the following announcement for cabin crew:

If oxygen masks do not deploy, ‘KEEP CALM, REMAIN SEATED, FASTEN SEATBELT’ [English and Bahasa].

General details

Pilot details (Captain)

Pilot details (First Officer)

Sources and submissions

Sources of information

The sources of information during the investigation included:

• AirAsia Indonesia
• Airbus
• Civil Aviation Safety Authority
• Nord-Micro (courtesy Airbus)
• Operator’s flight crew and cabin crew
• On-board recorders
• Passengers (survey).

References

Civil Aviation Safety Authority, 2018. CAAP 253-02(2) Passenger safety information: Guidelines on content and standard of safety information to be provided to passengers by aircraft operators. Canberra; CASA.

Civil Aviation Safety Authority, 2015. Draft Part 121 Manual of Standards: Large aeroplane operations. Canberra; CASA.

Fowlkes J, Dwyer DJ, Oser RL and Salas E, 1998. Event-Based Approach to Training (EBAT). The International Journal of Aviation Psychology, 8(3), 209-221.

International Civil Aviation Organization, 2016. Annex 6 - Part I: International Commercial Air Transport – Aeroplanes, 10th edn. Montréal, Canada; ICAO.

International Civil Aviation Organization, 2014. Cabin Crew Safety Training Manual (Doc 10002). Montréal, Canada; ICAO.

International Civil Aviation Organization, 2018. Manual on Information and Instructions for Passenger Safety (Doc 10086). Montréal, Canada; ICAO.

Leedom, DK and Simon, R 1995. Improving team co-ordination: A case of behaviour-based training. Military Psychology, 7(2), 109-122.

Sheffield P and Heimbach R, 1996. Respiratory Physiology, in R DeHart (ed) Fundamentals of Aerospace Medicine, 2nd edn. University of Oklahoma, US; Williams & Wilkens.

United States Federal Aviation Administration, 2003. AC 121-24C: Passenger safety information briefing and briefing cards. US; FAA.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to AirAsia Indonesia, Airbus, Civil Aviation Safety Authority, French Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA), Republic of Indonesia National Transportation Safety Committee (NTSC).

The submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Appendices

Appendix A – Incident flight faults

From the start of the incident flight faults at about FL 250, the flight crew received 18 alerts related to the cabin pressurisation (CAB PR) system between 1141 and 1159 Western Standard Time. The alerts were a mixture of fault messages, cautions and warnings as per the following descriptions.

The CAB PR SYS 1 (or 2) FAULT triggers when the respective CPC has failed. The Flight Crew Operating Manual (FCOM) procedure indicated the alert was for ‘Crew awareness’ only and no action was required. In addition, the operator’s FCOM: Aircraft Systems – Pressurisation – Controls and Indicators, page 1/10, contained the following note:

Switching the MODE SEL pb to MAN [mode select pushbutton to manual], for at least 10 s, then returning it to AUTO will select the other system.

The CAB PR SAFETY VALVE OPEN caution triggers in-flight if either safety valve is not fully closed for more than 1 minute. The FCOM procedure indicated that if differential pressure was above 8.0 psi, then manual control of the outflow valve should be selected to reduce the differential pressure.

The CAB PR EXCESS CAB ALT warning triggers if the cabin altitude is above 9,550 ft. It may be triggered by the active or standby CPC, or, if both CPCs have failed, by an independent cabin pressure sensor. The FCOM procedure indicated that if the aircraft was above 10,000 ft, the flight crew are required to don their oxygen masks and initiate an emergency descent to 10,000 ft. If the cabin altitude exceeds 14,000 ft the flight crew are required to manually deploy the passenger oxygen masks, with the following note:

This action confirms that the passenger oxygen masks are released.

The CAB PR LO DIFF PR caution triggers if the time for the cabin to reach a differential pressure of 0.0 is less than 1.5 minutes and the aircraft is at least 3,000 ft above the landing elevation. The FCOM procedure indicated that vertical speed should be reduced, but with the note:

This line is not displayed in case of Emergency Descent due to Excessive Cabin Altitude.

Appendix B – Manufacturer’s inspections and test results

The two CPCs and outflow valve were sent to the manufacturer, Nord-Micro, for inspections and testing. A visual inspection of the three components did not identify any damage or irregularities which could affect system performance.

The aircraft’s flight data recorder and non-volatile memory of the pressurisation system components revealed the following:

• 0341 UTC first CPC 1 fault message
• 0348:14 cabin differential pressure of 8.4 psi recorded
• CPC 1 commanded the outflow valve to close from 6 per cent to 2 per cent, increasing the cabin differential pressure
• safety valve opened (the exact time of activation is not traceable)^[24]
• 0348:19 cabin pressure differential of 7.8 psi recorded
• 0348:29 pressurisation system changed from automatic control to manual control
• 0359 CPC 1 fault with failure message (PC_SENSOR_FAIL) generated.

The manufacturer’s root cause analysis revealed a rare intermittent fault, in which the CPC 1 non-volatile memory remained in the operational state despite generating multiple fault messages (Figure 6).

Figure 6: Activation and frequency of alerts

The timings and frequency of activation of alerts of the cabin pressurisation system in UTC [GMT]. Blue line refers to Aircraft altitude, Grey line refers to Aircraft climb/descent rate.

Source: Nord-Micro (courtesy Airbus)

Cabin pressure controller 1 fault

As the master controller, CPC 1 stores in non-volatile memory if it is in either the operational or standby state. The CPC 1 non-volatile memory state must change from operational to standby for CPC 2 to take control. The message CAB PR SYS 1 FAULT is only generated if the system status of CPC 1, via ARINC^[25] output label^[26] 057, bit^[27] 12 is set from ‘good’ (bit 12 = 0) to ‘fail’ (bit 12 = 1). According to the software logic, this should occur if the CPC is in fact faulty by the system fail flag (fault code 32_SYSTEM_FAIL). The CPC 1 eventually declared itself as faulty with fault code 61 PC_SENSOR_FAIL at 0359 after the twelfth CAB PR SYS 1 FAULT message.

From the repetitive fault messages it can be inferred that the system status bit 12 changed multiple times between ‘good’ and ‘fail’, without the setting of the system fail flag (no fault code 32_SYSTEM_FAIL). However, the bit 12 can also change to indicate ‘fail’ if the ARINC output label 057 is invalid as a result of an intermittent power interruption. Following a power interruption, CPC 1 will read the non-volatile memory state and maintain control of the pressurisation system if it has remained operational (no ‘fail’ stored in non-volatile memory).

The manufacturer concluded that it was likely that CPC 2 would have taken control at 0359 if the system was still in automatic mode. At this time the CPC 1 non-volatile memory state should have changed from operational to standby, with ‘fail’ recorded, however the flight crew had already selected manual control. The system misbehaviour and wrong information associated with CPC 1 (EXCESS CAB ALT alerts) was able to continue until this time.^[28] Therefore, the manufacturer speculated that the circuit board may have been subjected to multiple power interruptions due to fatigue cracked solder joints or cracks in the conductor path within the circuit board.

Calculated cabin pressure

The CPC pressure sensor module provides a raw cabin pressure value to the main circuit board, which uses calibration data stored in the random-access-memory (RAM) to produce a calculated cabin pressure value. It is the calculated value that is used for system management. The CPC copies the calibration data from read-only-memory (ROM) to the RAM integrated circuits during the initialisation phase of the CPC. The manufacturer noted that several times during the incident flight, and subsequent tests, the ‘calculated cabin pressure values deviated substantially from the raw cabin pressure values and during the system check, the calculated cabin pressure values were recorded with abnormal stepwise changes…’.^[29] This suggested the possibility that the relevant calibration data could not be successfully read from or stored in the CPC RAM, or successfully transferred via the ARINC bus.

Test results

After return to Perth Airport, CPC 1 was removed from slot 1 (Master Slot) and installed in slot 2 (Slave Slot), and subsequently failed with stored fault code 61 PC_SENSOR_FAIL. The raw cabin pressure value of +375 ft and calculated cabin pressure value of -12,841 ft were recorded.

After the components were returned to the manufacturer, several flight test scenarios were performed with CPC 1, using either the CPC 1 pressure sensor module or a simulation box for pressure values. A standard flight profile of take-off, climb to FL 390, cruise, descent and landing was simulated. The CPC 1 fault was reproduced under both pressure sensor input conditions (tests 1 and 3), which isolated the fault to the main circuit board of CPC 1 (excluded the CPC 1 pressure sensor module).

In test 1, CPC 1 transmitted abnormal stepwise changes of the cabin altitude between ‑15,000 ft and +28,000 ft within a few seconds and produced multiple excessive cabin altitude warnings, which were transmitted via ARINC output label 057. The test results also included sporadic changes in the CPC 1 flight mode, initially between the modes of ‘Take-Off’, ‘Climb’ and ‘Descent’. During the descent phase, the flight mode remained in ‘Cruise’, however, the CPC detected the descent and regulated the cabin to the scheduled landing field as expected. The failure of CPC 1 in test 1 included the fault codes 32 SYSTEM_FAIL, 42 PC_CAL_ROM_FAIL (invalid checksum of the RAM copy of the calibration data) and 61 PC_SENSOR_FAIL.

In test 3, a stepwise change from +8,000 ft to +256 ft resulted in an intermittent fault, which produced the command to open the outflow valve position in order to depressurise the cabin. After a power reset, the cabin altitude was initially recorded as +11,936 ft. The failure of CPC 1 in test 3 included the fault codes 32 SYSTEM_FAIL and 61 PC_SENSOR_FAIL.

The manufacturer reported that the outflow valve and CPC 2 passed their tests, with the exception that the outflow valve initially produced an intermittent fault in ‘Manual Motor Operation – Position Feedback Signalling Test’. The second test was passed.^[30]

__________

24. The cabin differential pressure data point of 8.5 psi to trigger the safety valve(s) was not recorded, but the manufacturer concluded that it could be inferred that the minimum threshold was likely reached, given the sequence of events.
25. Common data bus used on civil transport aircraft.
26. Label guidelines are provided as part of the ARINC specification for various types of equipment.
27. Bit: used to indicate a number in the binary system (1 or 0).
28. For activation of flight crew warning messages while in standby mode, refer to: Appendix A - Incident flight faults
29. A stepwise change indicates a non-normal abrupt vertical change in the value of calculated cabin pressure.
30. The fault was within the potentiometer’s manual channel and it was noted that subsequent to the testing, the potentiometer would be replaced.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.