On 28 July 2019, the pilot of a Van’s RV-6A aircraft, registered VH-ANU, conducted a private flight from Coober Pedy to William Creek aircraft landing area, South Australia. After touching down with the main gear first, the nose gear touched the runway momentarily. The pilot noted that although the nose gear lifted off after touchdown, the main gear stayed on the runway.
When the nose wheel made contact with the runway surface for the second time, the nose gear bent under the aircraft. The propeller struck the runway and the aircraft skidded on its nose, then flipped over and came to rest inverted.
The pilot sustained serious injuries and the passenger minor injuries. The aircraft was substantially damaged.
What the ATSB found
The ATSB found that during the landing sequence, the ground clearance of the nose gear fork or strut was reduced sufficiently to allow them to contact the runway surface. This initiated the damage to the nose gear and resulted in the aircraft becoming inverted.
Safety message
A reduction in the nose gear ground clearance during landing can result in the nose gear strut or fork impacting the runway and affect the structural integrity of the nose gear. In the tricycle variants of Van’s aircraft, the factors that can affect nose gear ground clearance include the dynamics of the landing, tyre pressure, weight over the nose gear, and runway condition and characteristics.
After-market devices fitted to this aircraft aimed at reducing the risk of a nose-gear collapse and aircraft inversion, did not prevent the accident.
The occurrence
What happened
On 28 July 2019, the pilot of a Van’s RV-6A aircraft, registered VH-ANU, conducted a private flight from Coober Pedy to William Creek aircraft landing area, South Australia. Due to the prevailing northerly winds of around 20 knots, the pilot elected to land on runway 03. That runway was unsealed, with a sand and gravel surface and was dry and in good condition on the day, with no significant imperfections.
At 1525 Central Standard Time (CST), the aircraft commenced its final approach. Based on the recorded data, the aircraft crossed the threshold at the recommended approach speed of 70 knots indicated airspeed (IAS) and slowed to 60[1] knots just before touching down with a rate of descent of about 140 feet per minute. This was consistent with the pilot’s recollection of the event.
The pilot reported and the recorded data confirmed that the main gear touched down first. Shortly afterwards, the nose gear touched the runway momentarily. The pilot noted that although the nose gear lifted off the runway, the main gear stayed down.
When the nose gear made contact with the runway surface for the second time, it bent under the aircraft. The propeller struck the runway and the aircraft skidded on its nose, then flipped over and came to rest inverted (Figure 1).
The pilot sustained serious injuries and the passenger minor injuries. The aircraft was substantially damaged.
During the accident sequence, no fractures were sustained by the nose gear strut or the fork. The principal deformation was the bending in the aft direction at the top of the strut, near the engine mount (Figure 2).
Figure 1: Accident site of VH-ANU
Source: South Australia Police
Figure 2: Damage sustained by the nose gear
Source: South Australia Police
Nose gear information
On 12 August 2005 in Alaska USA, a Van’s RV-9A aircraft nosed over during the landing roll and sustained substantial damage. In response, the US National Transportation Safety Board (NTSB) conducted an examination of the nose gear strut and fork from the Van’s Aircraft series RV-6A, -7A, -8A and -9A. The study examined data from 18 previous accidents and one incident, in which Van’s aircraft became inverted during landing. Several involved hard landings such as hard touchdowns, bounced landings (six), or landing in a slip. Several others involved off-field landings in rough terrain, hitting a ditch, or going down an embankment.
The study examined the strength of the nose gear and the possible effects of tyre pressure, engine weight, runway condition and some dynamic considerations that could affect nose gear clearance. The conclusions of the study were:
The nose gear strut had sufficient strength to perform its intended function.
In all cases examined, the landing gear struts and forks made contact with the runway surface, initiating the damage sequence.
Tyre pressure, engine weight over the nose gear, runway condition and the dynamics of the landing (including washboarding[2]) can affect the ground clearance and therefore the likelihood of the strut or fork contacting the runway surface.
In 2007, prior to the release of the NTSB Study, Van’s issued a mandatory Service Bulletin with a redesigned nose gear that provided greater ground clearance. VH-ANU was compliant with the Van’s Service Bulletin.
VH-ANU was also fitted with two after-market devices to the nose gear. One device was intended to increase the rigidity of the strut and transfer landing forces to the top of the strut near the engine mount. The second was a device intended to minimise the chances of the gear digging into the runway surface in the event that the strut came in contact with the runway.
Previous Australian Occurrences
A review of the ATSB occurrence database identified 49 nose gear collapses in Australian-registered, single-engine, piston-powered, fixed-wing aircraft between 2009 and 2018. Four of these occurrences involved Van’s Aircraft. Of the four, one resulted in serious injuries and was investigated by the ATSB (AO-2017-001). Due to the date range used, the current occurrence was not included.
Safety analysis
The ATSB reviewed the damage to the aircraft and found that the nose gear did not sustain a fracture through any of the major structural components (i.e. the nose gear strut or fork), but had deformed rearwards, under the aircraft. For this to have occurred, the ground clearance must have been sufficiently reduced so that the nose gear strut or fork made contact with the runway, imparting significant forces on the gear assembly and initiating the damage sequence.
The factors that affect the ground clearance during landing include the tyre pressure, engine weight, runway condition and dynamics of the landing. In this accident, the exact mechanism by which the gear made contact with the runway was not determined.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
During the landing sequence the nose gear fork or strut made contact with the runway surface and bent underneath the aircraft, causing it to become inverted.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 30 July 2019, a British Aerospace BAe146-RJ85 aircraft, registered VH-NJW and operated by National Jet Express (Cobham), was being prepared for a charter flight from Perth Airport to Granny Smith, Western Australia. During the pre-flight checks, the flight crew did not identify that there was no pressure in the braking system and did not pressurise this system prior to engine start.
Around the time of the start of the final engine in the starting sequence, the aircraft began to roll forward.
The dispatcher noticed the aircraft rolling and alerted the crew. The crew attempted to use their foot brakes and the park-brake, however, there was no brake pressure. Around 18 seconds after the aircraft started to roll, it collided with objects at the edge of the apron.
What the ATSB found
The ATSB found that the flight crew did not effectively check the brake pressure during pre-flight checks. Procedures required that the captain check brake pressure during two separate checklists, which provided two opportunities to pressurise the hydraulic system before engine start. There was also a shared responsibility for the first officer to monitor and cross-check. These checks were not done effectively and as a result, the crew did not identify that there was no available pressure prior to engine start.
The operator's dispatch practices did not involve placing chocks on the nose-wheel once the main wheel chocks were removed for engine start. At engine start, there was no brake pressure restraining the aircraft, nor was there any chock to prevent an inadvertent roll forward. The combined thrust of the four aircraft engines at idle and the slight apron slope caused the aircraft to inadvertently roll forward.
The absence of braking pressure also meant that the crew were not able to stop the aircraft with the aircraft brakes. The crew had a very limited opportunity to take corrective action before the aircraft collided with infrastructure. It is likely that the short distance to the terminal and the influence of surprise combined to reduce the pilots' ability to respond.
What's been done as a result
Cobham have sent a notice to check and training captains reminding them of the importance of vigilance during checklists.
Cobham have also reported that they plan to revise procedures to include the requirement to use nose-wheel chocks when dispatching from stand-off bays and to align all applicable procedures to capture this requirement.
Safety message
This investigation highlights the importance of ensuring all checklist items are addressed.
As highlighted in this accident, individuals can be vulnerable to omit checklist items and this can lead to accidents. Aviation safety relies on a resilient safety system involving multiple defences. In the context of multi-crew operations, one of the key defences against this type of accident is the other pilot. Monitoring and cross-checking can provide a last line of defence to trap individual errors.
Although safety systems should seek to reduce the development of errors, where possible engineering defences should also be used to reduce error consequences. Simple mechanical barriers, such as chocks, can be an effective defence.
The occurrence
What happened
Aircraft preparation
On 30 July 2019, a British Aerospace AVRO 146-RJ85, registration VH-NJW (NJW), operated by National Jet Express (Cobham) was being prepared on Cobham bay NJ1, Perth Airport, for a charter flight to Granny Smith, Western Australia. The flight crew comprised the captain and the first officer (FO). In addition, there were 62 passengers and two cabin crew on board.
The flight crew signed on for duty at around 1330[1] for a scheduled departure time of 1430. The captain and the FO arrived at the aircraft and commenced pre-flight duties at around 1345.
While the captain and the FO completed the pre-flight checks, they remarked that the apron and the hangar were busy. A new aircraft was arriving later that afternoon and there were many people positioned around the apron to observe its arrival.
At around 1415, the dispatching engineer took position at the right side of the aircraft to operate the aircraft headset. He contacted the flight crew and requested clearance to remove chocks, which were at that stage installed on the outboard wheels of the left and right main landing gear.
After the captain gave the engineer clearance to remove the chocks, the engineer proceeded to walk around the outside of the aircraft, removing the left and right main wheel chocks. At around 1416, the engineer dragged both chocks away from the aircraft, off to an equipment bin at the edge of the apron.
Around this time, as part of the pre-start preparations, the flight crew conducted the originating checklist.
Engine start
At 1419, the engineer returned to the headset position on the side of NJW. The captain called the engineer, who confirmed that the chocks had been removed and the doors and panels had been secured, and that the crew were clear to start all engines. The engineer remained plugged in to the headset while he observed the engine starts.
After receiving the clearance from the engineer, the crew conducted the starting checklist.
After completing the starting checklist, the captain commenced starting the aircraft’s four engines, in the normal 4-3-2-1 sequence, from right outboard engine to left outboard engine. The captain and the FO monitored engine indications to confirm the stable start of each engine. The FO monitored the engine light for each engine to confirm when the starter motor had disengaged and called ‘starter cut-out’ for each of engines four, three and two, as each completed a stable start.
NJW rolls forward
At about 1424, NJW started moving forward. The engineer, who was still connected to the aircraft via the headset, noticed that NJW was moving and alerted the crew. The engineer alerted the crew at about the time the FO called ‘starter cut-out’ for the stable start of engine one.
The crew said that they were confused and alarmed when they heard the engineer and took a moment to confirm that they were in fact moving forward. The crew recalled that their actions following this were:
The captain’s first action was to apply his foot brakes, only to observe that they had no brake-line pressure. The FO tried his foot brakes at around this time, which was also ineffective.
The captain also recalled that he tried using the park-brake, which was ineffective.
The FO heard a loud bang, which he said was consistent with the sound of the park-brake releasing upon application of the foot brakes. The FO recalled this was shortly after he tried using the foot brakes.
With the aircraft rolling towards objects at the edge of the apron, the captain reached up to the overhead panel where the hydraulic pump switches are located. The captain said he could not recall what his intention was for this action, but said that he did not complete whatever that action was supposed to be.
About 18 seconds after the start of the roll-forward, NJW collided with movable aircraft stairs, which were in front of the Cobham terminal. The stairs struck the front of the aircraft, beneath the right pilot seat. Shortly after, NJW collided with a bollard in front of a light pole, then with the light pole itself. The roll-forward and collision with airport infrastructure was captured on Cobham CCTV (images shown in Figure 1).
Figure 1: CCTV showing start of roll-forward (top) and collision with infrastructure (bottom)
Source: Cobham, Original image cropped and annotated by ATSB
The aircraft was substantially damaged by the accident (see Figure 2). One cabin crew member was thrown from a standing position into a door handle during the collision with the light pole, but was not injured. There were no injuries to the other crew or the passengers.
Figure 2: VH-NJW following collision with airport infrastructure
The accident occurred on the Cobham apron at Perth Airport. VH-NJW was parked at bay NJ1, which is directly in front of the Cobham terminal buildings in the north-west corner of that apron.
Bay NJ1 is close to the edge of the apron with a slight slope from the parking position towards the terminal. Documentation supplied by Perth Airport indicated that the apron and aircraft parking positions were designed and approved in accordance with the Civil Aviation Safety Authority (CASA) Manual of Standards (MOS) part 139, Aerodromes.
Aircraft information
The BAe 146 is a four-engine turbofan aircraft, manufactured by British Aerospace (BAe). NJW was an Avro RJ85, a variant of the BAe 146. Because NJW routinely operated on gravel runways, metal deflectors (gravel kits) had been fitted to the aft of the nose landing gear.
A detailed mechanical inspection was conducted of the aircraft’s braking systems after the accident. There was no indication that any defects or anomalies were contributory to the collision.
BAe 146/ RJ85 braking system
The braking system consists of the foot brakes and a park-brake. The brakes are powered by the aircraft hydraulic system which has two subsystems: yellow and green. Only the yellow system powers the parking brake while both systems power the foot brakes. A selector switch on the centre console controls which system (yellow or green) supplies power to the wheel brakes.
Two reservoirs store fluid, one for each system. Pumps draw fluid from the reservoirs, pressurise that fluid and in doing so provide power to operate the brakes. Accumulators store fluid under pressure and provide reserves of hydraulic power. A schematic diagram of the hydraulic system is provided in Figure 3 below.
Figure 3: BAe 146/RJ85 hydraulic system schematic
Source: BAe
Systems for supplying brake pressure
The main pumps for providing hydraulic power are the engine driven pumps (EDPs). These pumps require engine power to operate. Without engine power, the yellow system can be pressurised by an AC electrical pump. When the AC pump is activated, it supplies pressure to the brake system almost instantaneously.
During a normal pre-flight sequence, the yellow system would only be pressurised using the AC pump. This would be done on an as-needs basis following the check of the park-brake during the originating checklist and of the brake pressure during the before start checklist. The EDPs will only supply pressure after they are selected on during the After start checks.
Power for the green system is primarily supplied by the number 3 engine EDP. Without engine power, the green system is pressurised by Power Transfer Unit, which is mechanically powered by the yellow system. Therefore, prior to engine start, without accumulated pressure or yellow system power, the green system will not be pressurised.
Yellow system brake accumulator
The brake accumulator is a secondary reservoir in the yellow system that supplies emergency and park-brake pressure. No pump is needed to supply pressure to the yellow system if the brake accumulator has been charged. The brake accumulator can be charged through the AC pump or using the emergency DC pump.
The accumulator, once charged, stores pressure. The pressure stored in the accumulator decays, however, the decay rate is normally low enough to ensure adequate park-brake pressure for around 150 minutes. The rate of decay increases if the park-brake valves are in poor condition.
A specific inspection was conducted on the pressure decay rate of the brake accumulator from NJW, which complied within the manufacturer’s specification of 150 minutes. Prior to the scheduled flight to Granny Smith, the aircraft had returned at 0847. Therefore, it had been well over 150 minutes since the aircraft was powered.
Controls and Instruments
Gauges on the captain’s instrument panel indicate the pressure available in the yellow and green hydraulic systems (hydraulic pressure). Gauges in front of the left-side (captain’s) control column indicate the level of pressure being supplied by the yellow and green systems (brake pressure).
The foot brakes are located in front of each pilot, as they sit in their flight seats.
The park-brake handle is located on the centre console. The park-brake can be released by depressing the right-hand seat brake pedal or by moving the handle. Disengagement of the park-brake on the RJ85 tends to produce a ‘bang’ sound, unless the park-brake handle is guided down to the un-activated position.
Low accumulator pressure warnings
When the brake accumulator pressure is less than 2500 psi, a BRK ACC LO PRESS annunciator light illuminates on the hydraulics panel, overhead the left-hand seat. The activation of the warning on the hydraulics panel triggers the illumination of the HYD↑ caption on the Master Warning Panel (MWP), which will cause amber attention-getting lamps on the glare-shield to flash and a single chime sound.
By pressing the attention-getting lamps on the glare-shield, pilots can acknowledge the warning light on the hydraulics panel, which will have the effect of dimming the light. Acknowledging warnings means that existing warnings are no longer displayed at full brightness, however, if triggered, new warnings will be displayed at full brightness.
The MWP also has a Test and Ground Operation switch. The BAe 146 Aircraft Maintenance Manual describes the function of this switch, when pulled into the ground operation (mute) position:
the light intensity on the MWP is set to a level sufficient to have seen under average daylight conditions, the bright-up function, the triple and single-chime inputs to the audible warning system and the red warning and amber caution lamp flasher circuits are inhibited. The switch has an integral red warning light to indicate that the mute system is in operation.
The pilots reported that they did not recall seeing or hearing any alerts or warnings during the accident sequence. The FO stated that the Test and Ground Operation switch had been pulled (to ground operation) prior to power on. This switch had been pushed in (to the normal position) prior to engine start, as per the operator’s Power-on Checklist procedures. The FO also stated that it was normal practice to see the hydraulic caption on the MWP activated prior to engine start.
Pre-flight procedures
The ATSB examined the pre-flight procedures used by Cobham crews, particularly as they relate to setting and pressurising the aircraft brake system. The primary document for these procedures was the Cobham manual OM-B2-146, BAe146 Aircraft Operating Manual (The operating manual). The other source was the British Aerospace Flight Crew Operating Manual (FCOM) for the BAe146/RJ series aircraft. The operating manual states that it takes precedence over the FCOM.
In terms of the use of checklists, the operating manual states:
The Checklists allow the development of ‘scans’ which can be accomplished before the checklist is read… The checklist then becomes the means to verify that items have not been forgotten…
The ‘Challenge and Response’ method shall be used, which requires the pilot reading the checklist to call the ‘Challenge’, after which both pilots shall, if physically possible, visually verify that the required action has been completed, and then the pilot nominated on the checklist as the respondent (usually the pilot who completed the action) shall reply with the required response.
Regarding the guidance for both pilots to visually verify each response item, the FO said that he found this difficult. The FO reported that he found it challenging to provide an additional verification of the captain’s checks since he was focussed on performing the duties allocated to him as the first officer. The FO said he thought verifying all of the captain’s actions would result in delays to getting the aircraft away on time.
Originating checklist
The flight crew conduct the Originating checklist (or the equivalent Transiting checklist) prior to engine start for all flights. The originating checklist contained the following checks:
Park-brake. Captain’s responsibility. Select the park brake on and check that the pressure is not less than 1,500 psi.
This checklist item provided an opportunity to check that there was sufficient brake pressure being applied, and to charge the brake accumulators, if required. The captain reported that it was normal to charge the hydraulics using the AC pump during the originating checklist.
The flight crew performed the originating checklist during the pre-flight sequence. The first officer called the item ‘park-brake’ and the captain responded ‘on, pressure checked’.
The captain reported to the ATSB that he recalled performing the originating checklist, but did not have a recollection of performing the check of the park-brake or the pressure gauge. The FO said he could not recall if he looked at the pressure gauge during the originating checklist, to cross-check the captain’s responses.
Starting checklist
The flight crew conduct the Starting checklist after receiving clearance to start the engines from the dispatcher. The first checklist item is ‘Brake Pressure’. The operating manual described this check as ‘ensure the brake pressure is at least 2500 psi immediately before push back or start.’
The crew conducted the starting checklist. For the brake pressure item, the first officer called ‘brake pressure’ and the captain responded ‘check’.
The captain stated he could not recall checking the brake pressure gauge during the starting checklist. The FO reported he could not recall whether he looked at the pressure gauge during the starting checklist.
After start scan
During the start of each engine, the FO monitors the starter operating light and calls ‘starter cut-out’ when the light extinguishes, to indicate stable start. The after-start scans are performed after stable start is confirmed for the final engine in the starting sequence (engine 1). Item 2 of the after-start scan is completed by the captain and included the following:
Select ENG 2 PUMP and ENG 3 PUMP ON and observe YELLOW and GREEN system pressures increase to normal (3100 +/- 50psi). Select PTU on only after GREEN system pressure has been checked.
The crew did not perform the after-start scans because of the development of the accident. This is described in the analysis section following.
Cobham procedures for chocking aircraft
Chocks are routinely fitted fore and aft of aircraft wheels to reduce the risk of the aircraft inadvertently rolling forwards or backwards. The following summarises Cobham procedures for chocking 146/RJ85 aircraft.
Cobham Ground Operations manual, OM-A6
Manual OM-A6 contained higher-level procedures for Cobham ground operations personnel, not specific to aircraft type. These procedures stated that prior to dispatch, ground handling personnel were to remove all chocks from the main landing gear and ensure that a chock was repositioned 150 mm ahead of the nose-wheel. The procedure did not specify any specific requirement, related to nose-wheel chocks, for gravel-kitted aircraft.
Cobham BAe 146 Ground Operations manual, OM-B6
Manual OM-B6 provided type-specific instructions for ground operations on BAe 146/RJ85 aircraft. The manual stated that chocks should be placed fore and aft all wheels, including nose-wheels. The procedures further stated that nose-wheel chocks should be used in windy conditions, or when the parking area was on a slope.
The manual provided limited instructions for the removal and repositioning of chocks in the section describing dispatch duties for aircraft on standoff bays using the intercom. The manual described the sequence of communications that should be made between the captain and the ground, being:
Captain: ‘Brakes parked, clear to remove chocks’
Ground: ‘Chocks removed’
This procedure indicated ground personnel removed all chocks at this stage. It did not specify the requirement to reposition chocks ahead of the nose-wheel, as stated in manual OM-A6.
Cobham BAe 146/RJ85 dispatch training
Cobham dispatch training materials described the steps involved in preparing a 146/RJ85 aircraft for dispatch as including the following:
Remove chocks from the main outboard wheels.
There was no step relating to repositioning chocks to the nose-wheel.
Procedures ‘as done’
The ATSB sought to determine the ‘as-done’ and ‘as-taught’ procedures for using chocks by Cobham dispatchers, to see if there was any variance from the ‘as-written’ procedures. A senior ground handler at Cobham, who was responsible for training dispatchers, advised that normal practice was for dispatchers to remove chocks during dispatch and not reposition chocks to the nose-wheel of any aircraft. Dispatchers were taught to remove chocks in a manner consistent with the dispatch training materials.
The dispatching engineer for NJW indicated he understood the procedures to be that chocks were not fitted to the nose-wheels of gravel-kitted aircraft.
Recorded data
Personnel from Cobham secured a copy of the quick access recorder (QAR) data for analysis and provision to the ATSB. The flight data recorder (FDR) and cockpit voice recorder (CVR) were also removed and dispatched to the ATSB laboratory in Canberra for analysis.
The QAR file provided a record of the entire pre-flight sequence. It shows the engines powering up in sequence (4-3-2-1). Soon after engine 1 began to power-up, the QAR shows an increase in longitudinal acceleration, consistent with the aircraft beginning to move forward. About 18 seconds later, a spike in longitudinal acceleration likely indicates the collision with objects at the end of the apron. All four engines are then shut-down. The QAR shows that there was insufficient hydraulic pressure available in the brake system to provide effective braking throughout the entire pre-flight sequence.
The FDR started recording about 7 seconds before the collision, after which it then stops recording. An examination of FDR data from a previous NJW flight indicated the FDR began recording after all engines had been started and the park-brake was released for taxiing. This would suggest that for this accident, the start of FDR data coincided with the release of the park-brake handle. This is consistent with the FO’s recollection of hearing the park-brake handle release (loud bang) during the rolling sequence.
The ATSB concluded that the park-brake was likely set to ON prior to engine start. However, without sufficient hydraulic pressure, the brakes were not effective.
Ground-cockpit communications
The ATSB considered what each crew member and the dispatcher recalled about what they heard and what they said during the time the aircraft was rolling towards the terminal. The following summarises these recollections:
The dispatcher recalled that when he saw the aircraft was moving, he said words to the effect of ‘brakes parked’ into his headset. He repeated this several times, with an increasingly urgent tone. The dispatcher said the flight crew did not acknowledge any of these messages.
The captain recalled hearing the dispatcher say the aircraft was moving via intercom. The captain reported hearing one such alert from the dispatcher and that the dispatcher’s tone was urgent.
The FO recalled he heard the dispatcher say ‘brakes, brakes’ on his headset, at around the time he (the FO) called ‘starter cut-out’ for engine one. The FO recalled then saying ‘brakes’ himself.
The CVR captured audio relating to the communications between the cockpit and the dispatching engineer. The following table summarises relevant communication:
Dispatcher: BRAKES BRAKES BRAKES! GROUND TO COCKPIT! BRAKES PARKED!
The recorded audio is generally consistent with the dispatcher’s recollection. The combined evidence suggests that the crew may not have heard the dispatcher’s initial warning about the aircraft rolling. It also indicates that the flight crew were not aware that the aircraft was rolling until four seconds after the initial warning and around ten seconds prior to the eventual impact.
The flight crew did not effectively check the brake system pressure during the originating checklist or the starting checklist. The captain did not identify that the pressure was less than required and consequently, did not pressurise the system prior to engine start. This was contrary to the checking requirements during these checklists.
Due to the low pressure, it is very likely that the BRK ACC LO PRES warning was current throughout the pre-flight sequence. However, the flight crew reported they had pulled the test and Ground Operation into the ground operation (mute) position, which would mean no attention-getting glare-shield lamps would flash and no aural chime would sound.
Furthermore, it is likely that this warning was generated at an early stage of the pre-flight. It would be common for flight crews to receive a low accumulator pressure warning at aircraft power-on since accumulator pressure would likely have decayed and pumps not yet activated. Consequently, flight crew would likely acknowledge the warning with the expectation that normal procedures would subsequently pressurise the accumulator. In such circumstances, the warning would not be effective at alerting the crew that the hydraulic system was not pressurised prior to engine start. The implication is that the safety system is reliant on effective checking by the operating crew.
Research has found that checklist deviations occur relatively frequently, compared to other forms of procedural deviation. Common forms of checklist deviation include responding without checking and performing flow-check procedures as read-do (Dismukes and Berman, 2010).
Flight crews are particularly vulnerable to checklist errors during the pre-flight sequence. During pre-flight, flight crews are faced with many competing requirements and can experience perceived or explicit pressure to make on-time departure requirements. Line observation research has found that the pre-flight stage of flight presented many and varied events that distracted and interrupted flight crews (Loukopoulos, Dismukes and Barshi, 2001).
None of the factors identified in the research were particularly prevalent in the development of this accident. The flight crew were not experiencing significant time pressure and there were no identifiable disruptions during the pre-flight checklists. Although the busyness of the airport due to the impending arrival of a new aircraft was consistent with there being a distraction for the crew, there was no evidence that the crew were distracted in a way that affected their performance of the checklists. On board recorders showed that the crew did not have any non-pertinent conversations while completing the checklists.
Overall, the missed pre-flight checks in this accident are indicative of the general vulnerability to omissions during checklists, particularly in the pre-flight sequence. Checklist performance is imperfect, and as such, resilient systems utilise redundant defences in order to reduce the likelihood of error and to minimise error consequence. The ATSB notes that the development of this accident required two separate omissions from checklist procedures. The safety system therefore did have some redundant controls, but these relied on vigilant checklist performance.
In multi-crew flight operations, one defence against individual checklist failures is the role of the other pilot. Monitoring and cross-checking is a key recovery defence in the multi-crew safety system and deficiencies in cross-checking has been implicated in the development of major accidents (Sumwalt, Thomas and Dismukes, 2002). Dismukes and Berman (2010) suggest that captains should explicitly brief the FO that they (the captain) will make mistakes and it is the job of the FO to detect mistakes and point them out.
While it may be challenging to monitor the other pilot for the entirety of flight preparation and into the flight, it is critical that this monitoring does occur during checklists. The design of checklist procedures reflects the criticality of the checklist items for ensuring safe flight. Checklists are limited to only those items that are critical and checklist procedures are designed so that flight crews have no other tasks to perform while doing the checklist.
In the development of this accident, the initial and primary missed checks related to the captain not performing the checklist items as required to identify no brake pressure. However, there was also a shared responsibility for the FO to monitor and cross-check. The FO did not monitor the checking actions of the captain and did not independently check the pressure systems. Because neither crew member effectively checked the pressure system, there was no braking pressure available during engine start.
Chocking procedures
The dispatcher’s decision to not reposition chocks to the nose-wheel of NJW was consistent with the training provided to ground handling personnel and the normative practice at Cobham. The training provided to dispatchers did not mention a requirement to reposition chocks to the nose-wheel. Prior to the accident, Cobham personnel were not repositioning chocks to the nose-wheel of departing aircraft.
Cobham procedures and training materials did not provide clear instructions regarding the use of nose-wheel chocks during dispatch. One of the manuals did state that dispatchers should reposition a chock to the nose-wheel, while another manual did not specify this requirement.
The absence of a clear requirement to reposition a chock to the nose-wheel of departing aircraft prior to engine start reduced the available defences against uncontrolled roll-forward.
Roll-forward and response
The combined forces of idle thrust from the four engines, and the slight slope of the apron, acted to overcome the inertia of the parked VH-NJW. In the absence of chocks, NJW rolled forward from its parking position. While it is likely that the park-brake was set prior to the start-up sequence, the lack of brake pressure would have made braking ineffective. Similarly, the crew’s attempt to use the foot brakes and the park-brake after the aircraft was rolling had no effect since there was no brake pressure.
After the confirmed stable start of the final engine (engine one), the next step in the normal pre-flight sequence included activating the engine driven pumps as part of the after-start scans. However, the ground handler alerting the crew, and the observation that the aircraft was rolling, meant that the pilots’ attention was diverted away from the normal pre-flight sequence, and toward responding to the perceived emergency situation. As such, the development of the accident meant that the pilots did not conduct the after-start scans.
The parking position NJ1 was close to the edge of the apron. It took around 18 seconds from when the aircraft started to roll to when it struck objects at the edge of the apron. Consequently, there was limited time to identify the problem and take action to recover from the unintended roll-forward.
The dispatcher attempted to alert the crew that the aircraft was rolling shortly after the roll commenced. However, the crew did not hear the initial alert and did not identify that the aircraft was rolling until around four seconds after that alert. It is possible that this delayed alert was associated with the crew listening to the ATIS. The delay in the crew identifying that the aircraft was rolling may have reduced the likelihood of them taking effective recovery actions to pressurise the hydraulic system.
In this case, the crew had around 10 seconds from the time they were alerted that the aircraft was rolling, to when the aircraft struck objects at the edge of apron. In that time, the crew had to confirm that the aircraft was rolling, attempt to use the braking system, identify that there was no pressure, pressurise and then apply the brakes. Time would also be required for the brakes to arrest the movement of the aircraft. The ATSB concluded that there was a very limited opportunity for the crew to take action to avoid the collision.
The crew were surprised when they heard that the aircraft was rolling, which further reduced their ability to respond. Research has shown that responses to unexpected and surprising situations are slower and more variable. For example, simulator research with experienced pilots has shown that upset recovery performance is much worse when pilots are surprised by the onset of the upset (Landman, 2017).
The nature of the crew’s response to the rolling aircraft is consistent with the effects of surprise. The crew reported that they were shocked and confused when they heard the aircraft was rolling and took steps to confirm that themselves. The psychological effects of surprise can include freezing, a loss of situational awareness and not remembering appropriate operating procedures (Rivera, Talone, Jentsch and Yeh, 2014; Burki-Cohen, 2010); the captain’s action of reaching to the overhead panel, then not completing this action, is also consistent with him being surprised by the unfolding accident.
As the crew did not take the necessary steps to pressurise the hydraulic system, they were not able to stop the aircraft rolling forward. As a result of the roll-forward, the aircraft collided with the objects at the edge of the apron.
Findings
From the evidence available, the following findings are made with respect to the Ground collision with airport infrastructure involving British Aerospace AVRO 146-RJ85, VH-NJW at Perth Airport, Western Australia on 30 July 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The crew did not effectively check the brake system pressure during either the originating checklist or the starting checklist. As a result, the crew did not identify that there was no brake pressure prior to engine start.
After engine start, the aircraft inadvertently rolled forward and collided with objects at the edge of the apron. The absence of brake pressure, the slope of the apron and the absence of a nose-wheel chock were contributory to the aircraft rolling forward.
The operator's dispatch practices did not involve placing chocks on the nose-wheel for engine start. Although some ground handling procedures indicated nose-wheel chocks should be used, the operator’s training did not involve a step to place chocks on aircraft nose-wheels. The absence of a nose-wheel chock fore of the aircraft reduced the defences against the aircraft rolling forward.
The crew had a very limited opportunity to take corrective action before the aircraft collided with objects at the edge of the apron. It is likely that the short distance to the edge of the apron and the influence of surprise combined to reduce the crew’s ability to respond.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Cobham reported that following this accident, the internal safety team reminded Check and Training captains that there is a responsibility to observe and verify responses to checklist items, that it is not acceptable to take a checklist response as given. The head of training and checking also sent a notice to check and training pilots which highlighted the requirement of vigilance during checklists. This notice also directed check and training pilots to threat and error management guidelines. As additional actions, Cobham reported that the occurrence will be incorporated into the Cobham Human Factors Training, and that there has been an enhanced focus placed on Line Operations and Safety Auditors to monitor checklist performance.
Cobham reported that they are undertaking several actions related to chocking procedures. This includes updating the procedures OM-A6 and OM-B6 to include the use of nose-wheel chocks for dispatches from stand-off bays. Cobham reported that they are reviewing other procedures relating to chocking and will align all procedures to include the use of nose-wheel chocks. Cobham also reported they have commenced spot checks of chocking during aircraft start, and that these spot checks are ongoing.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew, the engineer, Cobham Aviation Services, BAe Systems via the accredited representative the UK Air Accidents Investigation Branch, the Civil Aviation Safety Authority,
Submissions were received from Cobham Aviation Services, BAe Systems, and the first officer. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 13 June 2019, a BRM Aero Bristell NG5, registered G-OJCS, departed Kilrush Airfield, County Kildare, Ireland, for a local flight. Subsequently, recovered data showed that, after a series turns, the engine power was reduced as the aircraft maintained about 3,200 ft, with a reducing airspeed. The aircraft rapidly lost height, and impacted terrain about 30 seconds later. Both occupants were fatally injured and the aircraft was destroyed. There was no fire.
To assist with evidence collection, the Air Accident Investigation Unit (AAIU) Ireland requested an Accredited Representative from the Australian Transport Safety Bureau (ATSB) be appointed. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.
The AAIU has completed its investigation and the final report is available on its website.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the AAIU’s investigation of the occurrence.
In the early hours of 28 June 2019, a fully loaded coal train TM94, travelling in New South Wales from Tahmoor colliery to Port Kembla, derailed one wheelset near Moss Vale. The train crew, initially unaware of the derailment, were notified by train control to stop and inspect the train. A member of the public, who had witnessed a problem with the train, had phoned train control to alert them of an issue. Once the train was stopped, a train crew member discovered that one wheelset on the trailing bogie of the 14th wagon had derailed. The derailed wheelset had travelled approximately 2.6 km past the point of derailment at 150.067 km. This caused damage to the track infrastructure, including approximately 4,350 concrete sleepers.
What the ATSB found
The ATSB investigation found that the derailment was caused by a through-axle failure, on a 7E5S-type axle. The axle failure occurred at the start of a radius transition, approximately 250 mm from the left-hand end of the axle. The fracture of the axle in the No. 1 wheelset led the No. 2 wheelset on the same bogie to derail.
A metallurgical analysis conducted after the derailment found that the axle had corrosion pitting on the axle surface adjacent to the likely fracture initiation point. The fracture surface featured a discoloured area of corrosion, which extended 16 mm into the axle cross section. This was evidence of a crack which existed prior to the final complete brittle failure of the remaining axle section.
An examination of maintenance records found that non-destructive testing had not been carried out on this wheelset during the last two maintenance activities in January and November 2016. Testing, if conducted, would likely have detected the initiation of the axle crack, which probably existed at that time.
What's been done as a result
As a result of this derailment, Pacific National commenced and completed a program of non-destructive testing of axles, in-situ, to ensure that no axles pose an immediate risk of failure. This included all 7E5S axles and involved ultrasonic testing.
A Rolling Stock Notice was also issued, to reinforce to Pacific National’s wheel set overhaul contractors of the requirement to inspect and test the fillet radius for all axles where bearing removal is mandated.
Safety message
Rolling stock operators and maintainers should ensure that axle maintenance and inspection procedures include non-destructive testing of known defect areas as part of the regular maintenance program. Records of these inspections should be kept for the life of the asset within their asset management system.
The occurrence
What happened
On 27 June 2019, at 1730,[1] a Pacific National train crew signed on at the Illawarra Bulk Terminal, Port Kembla, New South Wales to operate an empty coal train, TM93, to the Tahmoor colliery. The train arrived at the colliery at 2133 without incident, and the 45 wagons were loaded with coal.
At 2258, the train (now designated as TM94), operated by the same four-person train crew, departed Tahmoor colliery to return to the Illawarra Bulk Terminal at Port Kembla (Figure 1).
Figure 1: Location map
Source: Geoscience Australia, annotated by OTSI
TM94 operated normally as it travelled in the Down[2] direction on the Main South line towards Moss Vale.
The following morning, on 28 June 2019, at 0025, there was an emergency brake application caused by a vigilance penalty[3] in the rear locomotive. TM94 stopped for a short time in the Mittagong to Burradoo section while a reset occurred. The train resumed the journey, passing through Berrima at 0036. At 0041, TM94 was travelling at 21 km/h, and accelerating gradually as it crossed onto the North Fork. The track speed for this section of track is 60 km/h. There were no additional speed restrictions in place at the time. The driver sounded the locomotive’s horn as the train approached the Suttor Rd active level crossing at Moss Vale (Figure 2).
Figure 2: Track configuration at derailment location
Source: ARTC, annotated by OTSI
At 0041, the 14th wagon in the train’s consist (NHSH 42774Q) passed the 128A catchpoints, and the L1 axle journal separated from the rest of the axle. This created unloading of the R2 wheel, which resulted in the R2 wheel climbing the Down rail and the L2 wheel moving into the four foot[4] and derailing. The train continued with the broken axle and the No. 2 wheelset derailed, there was no loss of brake pipe pressure. Approximately 80 m past the point of derailment, at 150.067 km, the axle box and suspension elements were found later on the Up side of the track (Figure 3).
Figure 3: Parts found on Up side of track near derailment location
Source: OTSI
At 0042, the front of train TM94 passed the Suttor Road crossing. A member of the public, a railway enthusiast, was at the level crossing filming the passing coal train. The member of public identified that there was a problem with the train from the sound and sparks coming from a wheelset, and phoned Network Control Centre South at Junee to inform them of the problem.
At 0044, the area controller at Junee called the train crew of TM94 and said that an issue had been reported. They requested that the train crew stop and check the train.
At 0046, the front driver brought TM94 to a stand at 147.550 km. The second driver from the front locomotive then left the cabin and inspected the train. They found the train had derailed one wheelset (R2/L2) of the 14th wagon in the consist (Figure 4 and 5). A short time later, the driver reported to Junee network control details of the derailment. The train crew were instructed to wait on site and at 0309, they were tested for drugs and alcohol. The results of these tests were negative.
Following the derailment, investigators from ARTC, OTSI and Pacific National attended the site. On-site evidence identified the location of the derailment at 150.152 km. The likely point of drop-off was identified from a mark on the Up Rail gauge face and the start of sleeper damage. The track sustained damage beyond this point for approximately 2.6 km. Following the incident, 4,350 concrete sleepers were replaced. The 128B turnout had damage to multiple areas, which required repair and replacement. There was also damage to the concrete pad at the Suttor Road level crossing (Figure 6). The significant damage to the concrete pad at the level crossing was almost entirely on the Down side, having been caused by the L2 wheel. The R2 wheel caused minimal damage to the concrete pad.
The derailment occurred on the North Fork, which is a short section of curved track, approximately 336 m long. It joins the Main South line with the Moss Vale to Unanderra branch line. TM94 was travelling in the Down direction on the Down Main before it crossed to the North Fork, through the Suttor Road level crossing, and onto the single track bi-directional Moss Vale to Unanderra line.
This standard gauge railway line provides a direct route linking Wollongong and Port Kembla to the Main South line. It carries freight services (intermodal, coal and grain) and occasionally passenger services. The route includes a long steep descent when travelling in the Down direction.
The track at the derailment location was maintained by the Australian Rail Track Corporation (ARTC) and consisted of 53 kg/m rail. The sleepers on the approach to the derailment site were mostly concrete sleepers fastened with resilient clips. There were wooden sleepers with sleeper plates and dog fastenings supporting the points in the immediate area around the 128A catchpoints and stockrail.
Post-accident inspection of the track recorded the following track information:
Sleepers were mostly concrete and with timber sleepers through the points.
The rail profile was worn but within limits.
Ballast was in good condition.
Drainage was fair.
Track gauge measured 1435 mm to 1457 mm.
The 1457 mm-wide gauge was measured at the switch tip with 5-10 mm rail play.
Track twist at the point of derailment did not exceed 19 mm as measured over 14 m.
A left-hand curve existed from the main line onto the North Fork.[5]
All track at the site was within ARTC maintenance standards and met the requirements of ARTC class 1 track.
Train control information
Train movements on the Main South line from Goulburn to Moss Vale, and then between Moss Vale and Unanderra, at 91.080 km, are controlled from the ARTC Network Control Centre South at Junee. This is done under network rule ANSY 500 Rail Vehicle Detection System.
Train crew information
The four-person crew had two crew members located in the leading locomotive and two crew members in the trailing locomotive. Radio communication was maintained between the crew to coordinate actions. The train crew were appropriately qualified and held the required route qualifications. All members of the train crew said the train was operating as expected until Network Control Centre South at Junee notified them of the derailment.
Train information
Train TM94 was a coal service operated by Pacific National. This push/pull train was powered by three 82-class locomotives, consisting of one leading locomotive (8238) and two propelling locomotives (8209 and 8225) (Figure 7).
The train was 822 m in length and the gross mass was 4896 t. There were 45 loaded coal wagons in the consist, 36 were NHSH-type wagons and remaining nine were NHJF-type wagons (Figure 8). The train complied with all applicable operating standards regarding rolling stock and marshalling of wagons.
Figure 7: Two locomotives at rear of train TM94
Source: OTSI
Figure 8: Wagon (NHSH42774Q) with derailed wheelset
Source: OTSI
The wagon, which had the broken axle, was an NHSH-type wagon. Built by EPT Pty Ltd in 1983, these stainless steel-bodied coal hoppers have three large longitudinal bottom discharge doors. These wagons have a length of 16.7 m, a tare mass of 23.8 t and a gross mass of 100 t. The wagon was approved to operate at this mass as confirmed by the track owner’s documentation. Initially single wagons, they were converted to operate as 3-pack sets with a permanent solid drawbar between wagons and an automatic coupler at both ends of the set. This wagon, NHSH42774Q, was the middle wagon in the 3-pack.
This wagon class was fitted from new with DCA-type rigid-framed bogies located at each end of the NHSH wagon. These bogies were formed by welded box sections and have a variably damped primary suspension. Each bogie has two wheelsets. The wheelset was made up of a solid axle, a wheel disc (920 mm diameter) pressed onto the axle, and an E-class package unit bearing at each end of the axle.
The failed axle was identified as 831444, it was a 7E5S-type axle. This axle was manufactured in 1983 and since 2002, has only been fitted to NHSH coal wagons. It was fitted to wagon NHSH42774Q in April 2018. The wheels were changed on this axle in November 2010 during a wheelset maintenance activity.
Environmental information
The overnight minimum temperature at Moss Vale on 28 June 2019 was 7.2°C, as recorded at a nearby weather station. The maximum temperature recorded that day was 15°C. There was a trace amount of rainfall recorded (0.2 mm) on the day of the incident. It was still dark when the incident occurred at 0042, sunrise was at 0706. There was localised fog reported at the derailment site. It was determined environmental conditions did not contribute to the incident.
Related incidents
According to records kept by Pacific National, including this failure, there have been three failures on this type of axle in the past 20 years. The other two failures have occurred near the centre of the axle barrel. One of these failures was the subject of an OTSI investigation and is outlined below.
On 23 November 2011, Pacific National coal service MC92 derailed eight wagons at Clifton, New South Wales. MC92, a 45-wagon train, was fully loaded with coal and was travelling south from Helensburgh to Inner Harbour at Port Kembla where it was to be unloaded. The investigation revealed that the barrel of the No. 3 axle of the eighth position wagon (NHFF 42702K) had broken and parted, causing both wheels to derail. The failure occurred approximately mid-way along the axle barrel. The investigation established that the break in the axle was attributable to the propagation of metal fatigue at the site of the fracture. The axle was the same type of axle as occurred at Moss Vale.
The analysis section of the report explores the likely reasons for the fracture, axle maintenance and inspection measures.
The following areas were excluded from further analysis as there was no evidence to show that they contributed to the axle failure:
train’s braking and control system
signalling and train control issues
track and infrastructure
the actions of the train crew.
Metallurgical aspects of the axle failure
All parts of the derailed bogie, wheelset, and the available associated parts recovered from site were examined and photographed by technical analysts at a Pacific National workshop at Port Waratah. This included investigators from OTSI and the Office of the National Rail Safety Regulator (ONRSR). Testing requirements were discussed with personnel from OTSI, Bureau Veritas, the ONRSR and Pacific National. Pacific National engaged the technical services of Bureau Veritas to conduct a metallurgical analysis of the axle.[6]
The scope and steps for the metallurgical investigation was agreed upon by these specialists before the axle was taken to the Bureau Veritas testing facility in Newcastle.
The evidence from the metallurgical inspection has identified the following:
the axle complied with industry specification requirements
the composition of the axle met the chemical requirements of the standard
the mechanical testing conducted on the axle showed it met the mechanical requirements of the standard.
The metallurgical report concluded that the position of the fracture face was approximately 250 mm from the end of the axle. This was at the start of a radius transition where the axle diameter increased from the 144.5 mm to 177.8 mm (Figure 9).
After examination of the fracture face, Bureau Veritas metallurgists concluded that the axle failure was the result of the propagation of a fatigue crack that extended over 60% of the axle cross section. Although no clear initiation point was visible, a discoloured area, which extended 16 mm into the section, likely represented the position of the initiation of the fatigue crack (Figure 10). There was a line of surface corrosion pits next to the fracture face that was likely to have provided the stress concentration for fatigue initiation (Figure 11).
At the other end of the axle, no cracking or pitting was evident; however, there was a line of grease around the same location at the start of the radius transition. Due to post-incident events, it was not possible to determine if the broken end of the axle had the same treatment with grease.
Analysis conducted on the crack propagation found it likely that the axle was defect-free in November 2010, when the wheel change maintenance activity took place. The period between this event and the fracture was 8.5 years. It is likely that the fatigue crack was present at the January and November 2016 wheel maintenance events where wheel bearings were replaced, but was undetected.
Figure 9: Cross section of fracture area
Source: Pacific National, annotated by OTSI
Figure 10: Fracture surface face of axle remaining within bogie
Source: OTSI
Figure 11: Corrosion pitting on axle surface next to fracture ignition point
Source: Bureau Veritas
Axle inspection and maintenance
Pacific National has in place a number of measures to monitor and manage the condition of its rolling stock. Train inspection standards and procedures are described in the Pacific National Train Inspection Manual. Wagon maintenance standards and procedures are described in the Pacific National Wagon Maintenance Manual. A number of visual and audible examinations are carried out regularly. These include but are not limited to the following:
Terminal departure and arrival examinations. These are conducted at a low speed, usually about 10km/h. A terminal operator stands near the track and looks and listens for any abnormalities as the train passes.
Roll-by examinations. These are conducted by train crew on one train as another train passes by. One train might be stationary or both might be operating at track speed. After the roll-by inspection, radio communication occurs between crews to verify that no defect was present. Roll-by examinations were also carried out by staff standing trackside at unloading points. There was no requirement to undertake these inspections at loading locations. Therefore, no roll-by inspection had been conducted at Tahmoor before the train departed for Port Kembla.
Full examination (FX). These full inspections are conducted while the train is stationary at a maintenance facility or terminal by examining staff at regular intervals (for coal trains operating in the south-west area, these are at 7-day intervals). Note that the previous inspection for this train was on 21 June 2019, 7 days before the derailment.
Unit Train Maintenance (UTM). A more structured static full examination is conducted during UTM at a maintenance facility at regular intervals (for coal trains operating on the south-west area, these are at 42-day intervals). This train had its last UTM on 30 May 2019, within the 42-day requirement.
Scheduled Maintenance. During scheduled maintenance, wagons are lifted off their bogie. This allows for a visual inspection of the wheelset and barrel of an axle to take place. The required period for scheduled maintenance on coal wagons is three years. Bogie NDCA 295 had a scheduled maintenance completed on 19 April 2018. An inspection of the bogie following the derailment found it in a good operating condition with low wheel wear. There was no defects found with any other part of the journal bearing, suspension, adjacent wheelset or bogie frame.
Although used to detect wheel defects not axle defects, a review of ARTC trackside Wheel Impact Load Detector (WILD) data was undertaken by Pacific National. A review of the data from February 2016 revealed that this wheelset had no recorded wheel impacts during its operation. In addition, there was no record of wayside alarms for high wheelset temperature for the wagon or wheelset during TM94’s journey from Tahmoor to Moss Vale.
Axles are designed to be highly reliable with an infinite service life if manufactured, operated and maintained within their prescribed design conditions. For this axle, the peak in-service stress loadings were below the endurance limit of the axle material. In the absence of a crack initiation event, which may increase the localised stress level, such as damage or corrosion, fatigue cracking should not occur.
Identifying an axle defect can be difficult, especially in the early stages of crack propagation and in locations obscured by other items. ‘The axle inspection process relies on human performance for preparation, inspection and re-installation. The non-destructive testing of axles relies to a great extent on the professional judgement of the inspection staff in interpreting equipment readings.’[7]
The three most recent wheelset maintenance events for axle 7E5S 831444 are shown in Figure 12.
Figure 12: Maintenance history for axle 7E5S 831444
Date
Event
Comment
Wagon
16/11/2010
Wheel shop maintenance, wheel change.
Documentation inspection records not available.
NHSH42668Y
14/01/2016
Wheel shop maintenance, bearing change and lathe turn.
The Wagon Maintenance Manual applicable in November 2010 required that:
2.2.1 All wheels and axles that enter the workshop shall be inspected for defects in compliance with the procedures and limits below. Axles shall be inspected and tested in accordance with the standards whenever bearings are removed during reconditioning of the wheelset.
2.4.2.1 Axles shall be tested for the presence of flaws and failures as specified hereafter by using ultrasonic and/or magnetic particle (wet or dry) procedures. Workshops undertaking the rework of axles and wheelsets shall develop and implement accredited procedures for the performance of these tests.[8]
Evidence shows that the requirements of the Wagon Maintenance Manual were not followed by the maintenance contractor, and this was not detected in subsequent audits conducted by Pacific National. Not conducting non-destructive testing on the axle when the wheels were changed during wheel shop maintenance in 2010 was a deviation proven industry practice and the specified requirements by Pacific National.
No specific documentation was available for the wheelset maintenance activity in November 2010. The Wagon Maintenance Manual states that electronic records should be kept for a minimum of 12 years.
2.4.4.1 An electronic record is to be kept by the service provider of axle inspection and testing including axle number, date of inspection, type of tests carried out and the results of each axle for a minimum period of 12 years. Axle records shall incorporate previous test results. [9]
The maintenance records also indicate that non-destructive testing was not carried out during wheelset maintenance activities in January and November 2016 as ‘no crack inspection was mandated’. The Pacific National Wagon Maintenance Manual 09-03_08 Axles specifies that non-destructive testing should have been carried out.
In 2012, the NSW Independent Transport Safety Regulator (ITSR),[10] conducted compliance inspections on a number of wagons in service. This was following a derailment at Clifton, NSW which was also caused by a broken 7E5S axle on a Pacific National NHFF-type coal wagon. Approximately 80 axles were inspected for evidence of defects. Three of these axles, which had all been recently inspected at a major overhaul maintenance centre, were found to have significant defects. These axles were removed from service. As a result of these inspections, ITSR issued a transport safety alert on 12 April 2012.[11] The alert requested owners of rolling stock, maintainers, overhaulers and transporters of bogies and wheelsets to reassess:
‘the coverage of this matter (includes both surface and sub-surface defects) in their standards, operating practices, risk registers, asset management systems and other relevant documentation,
the maintenance and inspection procedures that manage the possibility of defective (includes manufacturing defects), abused or poorly maintained axles and/or other risk control measures, such as ultrasonic testing and dye penetrant inspection, to verify that axle barrels are fit for the defined purpose. This should also include an appropriate final visual inspection process (of the axle barrel area) just prior to fitment to a wagon,
the training, competency and assessment of personnel who inspect, handle, transport and assemble wheelsets or bogies, and
the adequacy of processes for monitoring compliance with the relevant in-field and preventative maintenance instructions and procedures.’[12]
Remedial actions
Since the axle failure at Moss Vale, Pacific National have engaged a number of independent entities to undertake investigations assessing the failure mode of this 7E5S axle failure and the fatigue life of both 7E5S and 7E3S axle types.
Pacific National commenced and completed a program of non-destructive testing of axles in-situ to ensure that no axles pose an immediate risk of failure. This included all 7E5S axles and involved ultrasonic testing. During wheel shop maintenance activities, Pacific National requires the removal of bearings from axles at workshops to allow magnetic particle testing, with the exception of K and G Class which do not necessarily require removal. This allows more accurate detection of initial indications of cracking in the radius transition area of the axle.
A Rolling Stock Notice (RSN) was also issued, to reinforce to Pacific National’s wheel set overhaul contractors of the requirement. Pacific National have included a new check to the wheel shop audit checklist, requiring confirmation that the specified corrosion inhibition is being applied to the axle.[13]
Pacific National have implemented a process with some wheel shops to machine the fillet radius of axles in order to restore the fillet radius to a defect-free state. Pacific National have also purchased a quantity of new axles to replace any found to have cracking or corrosion pitting.
From the evidence available, the following findings are made with respect to the derailment of train TM94 near Moss Vale, New South Wales, on 28 June 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The derailment occurred due to an axle fracturing inboard of the L1 bearing journal on the 14th wagon in the consist (NHSH 42774Q). The fracture occurred on wheelset number 7E5S 831444, approximately 250 mm from end of the axle.
The axle failed due to the initiation and propagation of a crack at the beginning of a radius transition curve at the end of the bearing journal. There were a series of surface corrosion pits next to the fracture face that may have provided the stress concentration for fatigue initiation. A discoloured area which extended 16 mm into the section likely represented the position of the initiation of the fatigue crack; this had progressed approximately across 60% of the axle cross-section before brittle failure occurred.
Axle testing on wheelset number 7E5S 831444 was not carried out during the two most recent wheelset maintenance events in January 2016 and November 2016. It is likely the axle crack existed at the time of these maintenance activities. [Safety issue]
Other factors that increased risk
Inspection records for the December 2010 wheelset maintenance activity and wheel change on wheelset number 7E5S 831444 were not available. It is a requirement specified in Pacific National's Wagon Maintenance Manual that records be retained for a period of 12 years. [Safety issue]
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Axle testing on wheelset number 7E5S 831444 was not carried out during the two most recent wheelset maintenance events in January 2016 and November 2016. It is likely the axle crack existed at the time of these maintenance activities.
Safety issue description: Inspection records for the December 2010 wheelset maintenance activity and wheel change on wheelset number 7E5S 831444 were not available. It is a requirement specified in Pacific National's Wagon Maintenance Manual that records be retained for a period of 12 years.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Australian Rail Track Corporation
The Office of National Rail Safety Regulator
Pacific National.
References
Independent Transport Safety Regulator 2012, Transport Safety Alert – Catastrophic failure of freight axles in the barrel area, TSA no. 40, issued 12 April 2012.
Pacific National 2009, Wagon Maintenance Manual Axles WMM 09-03 08, Version 29 September 2009.
Pacific National 2020, Rolling Stock Notice Axle Inspection Requirements, RSN E 19-065v4 issued 1 June 2020.
UK Rail Safety and Standards Board 2012, Research into the effects of human factors in axle inspection T774.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties: Australian Rail Track Corporation, Office of National Rail Safety Regulator, Pacific National and Transport for NSW.
Submissions were received from:
Office of National Rail Safety Regulator
Pacific National.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On July 14 2019, a GippsAero, GA8 Airvan registered SE-MES, departed Umeå Airport, Sweden for parachuting operations with a pilot and eight passengers on board. The aircraft subsequently collided with terrain north of the airport, fatally injuring the nine occupants..
Investigation
The Swedish Accident Investigation Authority (SHK), conducted an investigation into this accident. As Australia is the State of Manufacture of the aircraft, the SHK requested an Accredited Representative from the ATSB be appointed.
To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.
Findings
The SHK investigation revealed that the in-flight break up was attributed to the aircraft being flown beyond its design and structural limitations following loss of control by the pilot. Pilot inexperience, aircraft loading, weather and hypoxia were offered as probable causes for the accident.
Recommendations with respect to parachuting operations were made to the Swedish Transport Agency and to EASA for the introduction of formal pilot training and improvements related to mass and balance approval procedures, and awareness and knowledge for those involved.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the SHK investigation of the occurrence.
On 22 June 2019, a Robinson Helicopter Company R22, registered VH-HHQ, departed Kutchera Station, Queensland to perform mustering operations. During mustering, as the pilot was manoeuvring the helicopter, the right tail rotor (or anti-torque) pedal cracked and became stuck. The pilot was unable to dislodge the pedal and prepared for an immediate landing in accordance with the stuck pedal procedure. Just prior to landing, the helicopter struck a tree and became uncontrollable. The aircraft impacted the ground and although the pilot was uninjured, the helicopter was substantially damaged.
What the ATSB found
Following examination of the helicopter by the maintenance organisation, a significant fracture was noted at a weld located on a right angle join between two sections of tube. The right pedal was removed from the helicopter and sent to the ATSB for further examination and testing. The ATSB found that the pedal had fractured as a result of a fatigue failure, which had initiated at the welded joint, and progressed until the remaining section of the tube could no longer sustain the in‑service loads. It was considered likely that a pre-existing crack had initiated at the highest stress part of the component, and had opened up following the load applied during the manoeuvre described by pilot, rendering the pedal unserviceable.
The tail rotor pedal had been recently inspected as part of routine maintenance and while it was considered likely that the developing crack was present, it was not detected at that inspection. However, it was considered that this was due to the inherent difficulties associated with inspections at the location of the cracking.
What has been done as a result
While not required as part of the routine inspections, the maintenance organisation has added the tail rotor pedals to the list of components that undergo magnetic particle inspection at each 2,200‑hour overall.
Safety message
The location of the fatigue crack in this accident highlighted the need to be vigilant when performing inspections in difficult or hard to reach places. In the case of the tail rotor pedal, the inspection was made difficult due to the location, and required a torch and mirror to inspect a matte black surface.
Additionally, the quick thinking actions of the pilot following the failure resulted in a good outcome, with no injuries reported.
The investigation
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.
The occurrence
On 22 June 2019, the pilot of a Robinson Helicopter Company R22 helicopter, registered VH‑HHQ, departed Kutchera Station, Queensland to perform mustering operations. While mustering, the pilot applied a small amount of right tail rotor (or anti-torque) pedal[1] to manoeuvre the helicopter to turn back in the opposite direction. During this time, and as the pilot reported repositioning in the seat, the right pedal cracked, which caused it to bend forward and become stuck. The pilot grabbed the right pedal in an attempt to free it and allow the use of the left pedal, but was unable to do so. The pilot continued the flight to the nearest safe cleared area to land and commenced the jammed pedal procedure.[2]
When about 50 ft above ground level, as the pilot was preparing to perform a running landing,[3] it was reported that a gust of wind hit the helicopter from an angle, causing it to spin. The helicopter then hit a tree and then became uncontrollable before coming to rest on the ground. The pilot shutdown the helicopter and exited. There were no reported injuries, however, the helicopter was substantially damaged.
Following examination of the helicopter by the maintenance organisation, a significant fracture was noted on the right tail rotor pedal assembly at a weld located on a right angle join between two sections of thin walled tube (Figure 1). This join was between the vertical section of tube where the pilot places their foot, and the horizontal tube connecting to the tail rotor controls, and sits slightly below the cabin floor. The pedal was removed from the helicopter and sent to the ATSB’s technical facilities in Canberra for further examination and testing.
Figure 1: Fractured right tail rotor pedal as installed on VH-HHQ
Source: Operator, annotated by the ATSB
Context
Tail rotor pedal examination
The ATSB’s initial examination of the right tail rotor pedal (part number A330-1), which had a matte black surface, found that:
The weld had fractured on the side of the pedal closest to the pilot seat (Figure 2).
While the fracture was not through the entire section of the tube, the pedal assembly was no longer capable of maintaining loads and transferring pilot inputs.
The pedal did not show any evidence of dints, scratches or other signs of mechanical damage.
Wear, in the form of missing paint and a shiny smooth surface, was observed on the pedal surface in contact with the pilot’s foot.
Some evidence of corrosion product was observed within the tubes. Robinson advised that this was the first known occurrence of internal corrosion. As part of the manufacturing process, to ensure the removal of any residual moisture, a small breather hole was left open, and the entire assembly heated to remove any internal moisture, before the breather hole was welded shut. Robinson also advised that the amount of corrosion observed appeared to be more than residual moisture from manufacture. They stated that, as the tubes were completely sealed, there was no inspection to detect internal corrosion.
Figure 2: Right tail rotor pedal as received by the ATSB, showing the location of the fracture
Source: ATSB
Following the initial examination, the pedal was fractured in the ATSB laboratory to separate and expose the two fracture surfaces. The majority of the fracture surface was discoloured and exhibited evidence of pre-existing cracking consistent with a fatigue failure (Figure 3). While the surface features were difficult to distinguish, the discolouration was indicative that the crack had been present for some period of time prior to the failure. While it appeared that the crack had initiated along the edge of the weld, no exact origin could be identified. However, the location of cracking was coincident with the location where the pilot input on the vertical tube was transferred to the horizontal tube, which is connected to the tail rotor push-pull tube assembly. As such, this area was subject to the largest torsional bending stress.
Figure 3: Right tail rotor pedal fracture surface following fracture by the ATSB
Source: ATSB
Following the examination of the fracture surface, it was then sectioned in the region adjacent to the likely origin for further inspection. The general fracture surface profile was consistent with a fatigue fracture. While the internal surface of the tube exhibited some evidence of pitting and general corrosion, there was no evidence that the crack initiated at one of these locations. Additionally, as the tubes were completely sealed, it was more likely that the corrosion product was the result of moisture ingress following the initiation of the fatigue crack.
The microstructure of the weld and tube was consistent with a low alloy steel in the heat-treated condition. A microhardness traverse test was conducted from the fracture surface through the weld heat affected zone into the parent metal and was consistent with the material type in the heat-treated condition. These observations complied with the information provided by the manufacturer.
Maintenance history
The helicopter (serial number 4071) had accumulated 5,828.4 hours total time-in-service at the time of the accident. Inspection of the tail rotor pedals was performed at both the 100-hourly inspection and 2,200-hour overhaul. The most recent 100-hourly inspection was performed 37.2 hours prior to the failure, while the 2,200-hour overhaul was completed in February 2017. At the 100-hourly inspection, the maintenance manual task for the pedals stated:
Inspect condition. Verify no cracks. Verify security and operating clearance.
There was no requirement to remove the bearing block cover plates, an access cover on the floor of the cabin, covering the horizontal portion of the rail rotor pedal. While the location of cracking in this occurrence was slightly under the cabin floor, Robinson advised that the affected weld would normally be visible using a torch and a mirror during the inspection. They also advised that the pedal needed to be moved forward and backward to see both sides. In addition to the 100-hourly inspections, at each 2,200-hour overhaul the pedals were removed for closer inspection.
The manufacturer further advised that, where maintenance was undertaken at a field service centre, as was the case for VH-HHQ, the pedals were subject to visual inspection only. However, if the overhaul was performed at the Robinson factory (not available in Australia), the pedals would be examined using a magnetic particle inspection (MPI).[4] This technique would be more likely to identify surface defects, as the paint would be removed prior to the testing, and the contrasting nature of the test medium would mean that cracks would be highly visible.
Similar failures
Robinson advised that they were aware of previous in-service fractures near the weld, however, the cause was either attributed to a modification to the assembly which involved some type of pedal extension (one case) or impact/mechanical damage. A search of the Civil Aviation Safety Authority’s defect report service and ATSB occurrence databases for the previous 10 years did not identify any other similar failures.
Safety analysis
While manoeuvring during mustering operations, the right tail rotor pedal failed and became stuck. The pilot elected to land immediately, but during this, the helicopter struck a tree. The helicopter became uncontrollable and impacted the ground, resulting in substantial damage.
The tail rotor pedal failed as a result of a fatigue failure at a right angle welded joint between two sections of thin walled tube. While the ATSB’s examination identified that the fatigue failure had initiated adjacent to the weld line, the exact origin could not be determined. This location of the cracking was also coincident with the point of maximum torsional bending stress in normal operation. The microstructure and hardness of the tube and weld were consistent with the requirements as specified by the manufacturer.
The pedal had undergone a visual examination at the most recent 100-hourly inspection. While it was likely the crack was present at this inspection, the nature and location of the crack would have made it inherently difficult to detect. The developing fatigue crack would have initially presented as a hairline feature, and it was located on a matte black surface, at a change in section slightly below the level of the cabin floor.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the tail rotor pedal failure and collision with terrain involving Robinson R22 helicopter, VH HHQ near Kutchera Station, Queensland, on 22 June 2019.
Contributing factors
While conducting mustering operations, the right tail rotor pedal failed due to fatigue cracking. During the subsequent emergency landing, the helicopter struck a tree and became uncontrollable, before coming to rest on the ground.
Due to undetermined reasons, a fatigue crack had initiated adjacent to a weld at a high stress location on the pedal. It was likely that the crack had been present at the most recent maintenance inspection, but the location of the weld may have made it difficult to detect in-situ.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.
Increased maintenance inspections
As a result of this accident, the maintenance provider has advised that, although not required by the maintenance manual, the tail rotor pedal assembly will now be included with other components that are sent for magnetic particle inspection at every 2,200-hourly overhaul.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
the pilot
Robinson Helicopter Company
the helicopter owner and maintainer.
References
United States Federal Aviation Administration (2019), Helicopter Flying Handbook, FAA-H-8083-21B.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the pilot
the helicopter owner
the helicopter maintainer
Robinson Helicopter Company
National Transportation Safety Board
Civil Aviation Safety Authority.
Any submissions from those parties were reviewed and, where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 9 July 2019, a Fokker F100 aircraft, registered VH-FWI, was being operated by Virgin Australia Regional Airlines (VARA) as regular public transport flight VA1788 from Geraldton to Perth, Western Australia.
During climb at about 13,000 ft, the left engine flamed out. Due to a pre-existing fault with the autothrottle system the pilot was required to manually select climb thrust on the remaining (right) engine. The crew elected to maintain the incidental speed (250 knots). Due to a desire not to ‘strain’ the right engine the pilot flying also elected not to increase thrust from climb to maximum continuous, and/or reduce the aircraft’s speed towards the recommended single engine climb speed (155–170 knots). Consequently, the crew adopted a cruise level about 6,500 ft below the maximum engine out altitude.
The crew maintained their cleared track to Perth and conducted an approach and landing via the runway 21 instrument landing system, using single engine procedures. The aircraft was accompanied from the touchdown point to the domestic terminal by airport emergency vehicles.
What the ATSB found
The ATSB found that at about 11,500 ft during initial climb the left engine fuel flow regulator (FFR) malfunctioned, resulting in over-regulation of fuel. The left engine autothrottle system attempted to reduce the thrust. Due to a pre-existing and admissible fault within the right engine autothrottle system and the action of an associated ‘clutch-tie’ mechanism, the right engine thrust lever retarded progressively reducing fuel flow demand to the right engine. At about 13,000 ft, as the right engine thrust approached flight idle, the left engine FFR ceased regulating fuel, which caused the immediate flameout of the left engine. Failure of the FFR was found to have resulted from wear related to the component’s service life.
The ATSB also identified that the failure of the FFR resulted in engine 1 thrust variation for about 45 seconds prior to the engine flame out. That went undetected by the crew due to the effects of automation, focused attention on other cockpit tasks and the absence of any alert prior to the engine failure.
The decision to continue to Perth following the engine failure resulted in a longer exposure to one engine inoperative flight risks, compared to a return to the nearest suitable airport (Geraldton).
Finally, by electing not to increase thrust on the right engine or adopt the aircraft’s recommended single engine climb speed, the pilot flying reduced the available climb performance of the aircraft, resulting in a lower cruise altitude than the maximum available. This, coupled with the decision to continue to Perth on the original indirect track, increased the duration of flight and the time that the aircraft was outside the glide range of emergency airports and controlled airspace, in the unlikely event that the situation degraded further.
What has been done as a result
Following this incident and a review of the global failure rate specific to the FFR unit utilised by the VARA F100 fleet, the engine manufacturer, Rolls-Royce, amended the applicable component management plan to revise the recommended FFR maximum overhaul interval (full-life) down from 16,000 to 10,000 hours.
Additionally, the operator provided several internal safety communiqués to all flight crew reiterating the importance of effective failure management and inflight decision making.
Safety message
This incident highlights that the initial indications of component failure/malfunction may be subtle. Automation can obscure significant changes in aircraft system status, including engine health.
The occurrence also illustrates the numerous factors to be considered when managing the initial and subsequent aspects of power loss in a complex aircraft.
The occurrence
Precursor events
On the early afternoon of 9 July 2019, a Fokker F28 Mark 0100 (F100) aircraft, registered VH‑FWI, was being operated by Virgin Australia Regional Airlines (VARA) as regular public transport flight VA1788 from Geraldton to Perth, Western Australia (WA). A captain, first officer, two cabin crew and 24 passengers were on board. The crew were based in Perth (see the section titled General details).
Prior to departing on the previous sector (Perth to Geraldton) the operating crew transferred from another aircraft to VH-FWI. Pre-flight preparations, including a review of the aircraft’s maintenance documentation, highlighted the right engine (engine 2) autothrottle system (ATS)[1] was unserviceable. To facilitate dispatch, the minimum equipment list (MEL)[2] maintenance procedures had been applied. This included disabling the associated ATS switch, the application of a ‘caution’ placard for the crew’s awareness beside the ATS control button on the flight mode panel, and activation of a mechanical clutch-tie[3] between the two thrust levers (see section titled Thrust control).
For the return flight to Perth (incident sector), the crew’s fourth and final leg of their flight duty for that day, the captain was pilot flying (PF), and the first officer was pilot monitoring (PM).[4]
Take-off and initial climb
In accordance with standard procedure for this sector, primarily to avoid active military airspace, the crew had planned the cruise phase at flight level (FL)[5] 330, via waypoint IRWIN then airway Z41 to waypoint HINDS (Figure 1).
After a short time at the terminal in Geraldton, the aircraft taxied for departure and at about 1246 hours Western Standard Time,[6] VA1788 commenced take-off for Perth. The PF elected to climb using the autopilot level change (LVLCH) and the autothrottle climb (CLB) modes (see the section titled Thrust control). During the departure the crew noted a ‘slight deterioration’ in the actual weather compared to the forecast, with a scattered cloud[7] base at the minimum sector altitude (MSA)[8] of 2,300 ft.
At about 1250 the aircraft was identified by the Melbourne centre controller who provided a revised clearance to Perth via waypoint CALIG. The amended route was slightly shorter yet still remained clear of military restricted areas immediately west of the aircraft’s revised track (see the section titled Airspace information and considerations).
Figure 1: Actual verses direct route to destination (Perth) following the engine failure
Source: Google Earth (including ATSB annotations)
Right engine rollback and left engine failure
At 1251:10 the left engine (engine 1) thrust started gradually increasing beyond what was commanded by the flight augmentation computer and the ATS, which was not noticed by the flight crew (see the section titled Recorded engine data and appendices A and B). The PF reported that, at about this time, while still climbing and just prior to entering the transition layer,[] both thrust levers began to move abnormally without crew input. Due to minor ‘play’ characteristic of the clutch-tie mechanism the PF observed a minor split between the two thrust levers during this movement.[10] The PF reported that throughout this time, there was no indication of engine vibrations and that the engine 2 indications displayed on the multi-function display unit (MFDU)[11] all remained ‘in the green’ (normal). However, during interview the PF could not recall what any of the actual engine indications were (Figure 2).
Figure 2: Fokker F100 VH-FWI – MFDU and standby engine indications to flight crew.
Source: Jetphotos.net – Paul Hill (with ATSB annotations)
The PF also reported at about this time the aircraft’s nose started to drop slightly, accompanied by a ‘very minor yaw’ to the right. The PM reported being preoccupied with support duties and not detecting either the abnormal thrust lever movement or the engine status.
About 45 seconds after the initial engine 1 thrust increase, and sometime after the PF detected the abnormal thrust lever movement, the engine 1 fuel flow regulator (FFR) ceased to effectively meter fuel (see the section titled Thrust control). This caused the engine 1 rotation to decay and thrust to reduce. As designed, the combined action of the flight augmentation computer and the ATS compensated by increasing engine 2 thrust. This was accompanied by the return of both thrust levers towards about the maximum continuous thrust (MCT)[12] position. About 30 seconds later, due to lack of fuel, engine 1 flamed out.[13] The crew received a ‘triple chime’ and a master warning alert,[14] immediately followed by an ENG 1 FAIL message on the MFDU.
Due to the pre-existing engine 2 autothrottle system unserviceability, the engine failure resulted in immediate reversion to manual thrust control. Consequently, the PF manually realigned the thrust levers towards the ‘upright’ (normal climb) position on the thrust lever quadrant. The PF elected to maintain the incidental two-engine cruise climb speed of 250 knots, which was above the recommended single‑engine climb speed or ‘green dot’ speed (see the section titled Single engine procedures).
At the time of engine failure, VA1788 was about 41 km south‑east of Geraldton (the nearest suitable airport).[15] The PF verbalised ‘flying the aircraft’ which was the initial step of the operator’s ‘failure management model’ (see the section titled Decision making‑VARA failure management model). The PF then re-confirmed the active autopilot modes via the flight mode annunciators displayed on the primary flight display (PFD).[16]
At about this time the crew perceived the aircraft was ‘struggling to climb’. Consequently, the PF elected to arrest the climb at FL 150. The crew then discussed and agreed on an ‘immediate plan’, including continuing on their cleared track towards Perth.
The PM reported that in accordance with the operator’s procedures, failure of the left engine was identified based on the ENG 1 FAIL alert on the MFDU and illumination of the engine 1 fuel control lever. The PF then confirmed the PM diagnosis by crosschecking key engine parameters with the corresponding standby engine instrument (SEI)[17]
The PF then instructed the PM to initiate the next step in the operator’s failure management model (‘take action’) by initiating the ENG 1 FAIL non-normal checklist (single-engine procedure) displayed on the MFDU. The procedure included attempting an engine 1 restart. Initially the PF thought the engine had restarted, however after discussion with the PM it was agreed the relight had been unsuccessful. As there were several indications of continued engine rotation, the crew assessed the engine was not mechanically damaged and therefore, in accordance with the QRH, did not activate the engine 1 fire suppression system.
Continuation to Perth
By 1254 the crew had secured engine 1. The PM reported the flight management system (FMS) calculated engine-out maximum (ENG OUT MAX) altitude displayed at the time was FL 205 (see the section titled Single engine procedures). At about the same time the crew discussed and agreed to not ‘strain the good engine’. This resulted in a collective decision to descend back to FL 140, 6,500 ft below the recommended ENG OUT MAX altitude.
At 1255:10, approximately 3 minutes after the engine failure and following completion of the MFDU checklist, the PM made a PAN-PAN call[18] to air traffic control (ATC) and advising of the aircraft’s revised altitude. The Melbourne centre controller acknowledged the call.
Following the required adjustment of the traffic collision avoidance system (TCAS) functionality (see the section titled Traffic collision avoidance system), the crew discussed the availability and the aircraft’s glide capability with reference to the various airfields (Jurien Bay, RAAF Pearce and Gingin) to the west of their planned route, should the remaining engine fail (Figure 1 and Figure 3, see the section titled Airport information).
Figure 3: Plan view – Restricted areas R155 and R156 north of Perth
Source: CASA - Airspace Review within 50 NM of Perth Airport, March 2017, page 25 (ATSB annotations)
The crew reported that en route, the cloud was scattered above and below their selected cruise level (FL 140). The PM reported being ‘comfortable’ with the PF’s assessment of glide performance, because the emergency aerodromes discussed were all visible from the aircraft.
At 1303, about 11 minutes after the engine failure, the crew communicated to ATC further details of the situation and their decision to continue to Perth. On receipt of this information, ATC offered a more direct track to Perth through RAAF Pearce airspace. The crew discussed and then declined the track shortening. They later explained that their reasoning was based primarily on workload reduction; specifically, having more time to complete the company’s required procedural steps before conducting a single‑engine approach into Perth.
At this point, the captain transferred aircraft control (PF duties) to the first officer. The captain then briefed the two cabin crew members and made a short announcement to the passengers. The flight crew then completed their outstanding non-normal management items, including reconfirming their initial decision to maintain their cleared track and continue to Perth. The PF reported that the crew were prepared for an approach by about 130 km north‑west of Perth.
From CALIG, the aircraft tracked via a standard terminal arrival route. The crew conducted an approach via the runway 21 instrument landing system (ILS), using single‑engine procedures. Due to the disabled autothrottle system the crew used the autopilot during the descent to about 500 ft. The crew reported that during their approach to Perth the cloud base in the vicinity of the airport was about 3,000 ft, slightly more favourable than during their departure from Geraldton. The aircraft landed at about 1335:10 and was accompanied by airport emergency vehicles from the touchdown point to the domestic terminal.
Post incident maintenance action
Once the passengers deplaned the operator’s maintenance engineering team attempted to restart engine 1. An engine re-light occurred, however the engine would not accelerate beyond ground idle. Troubleshooting resulted in removal of the engine 1 FFR unit ‑ also known as a combined acceleration and speed control (CASC).
The unit was subsequently examined by Rolls-Royce, who found that the internal gear within the drive end assembly was significantly worn (see the section titled Fuel flow regulator and Figure 5). The FFR was replaced, however this unit was also found to be faulty. Another FFR was then fitted and the aircraft was successfully returned to service.
Virgin Australia Regional Airlines (VARA) is based in Perth, Western Australia (WA) and operated under an air operator’s certificate issued by the Civil Aviation Safety Authority (CASA). The airline operates high-capacity regular public transport and charter flights throughout WA and to a number of major cities including Adelaide, Darwin, Melbourne and Alice Springs. VARA operate a fleet of six Airbus A320 and 14 Fokker F100 aircraft.
Flight crew information
The captain held an air transport pilot (aeroplane) licence (ATPL-A), a multi-engine command instrument rating and a class 1 aviation medical certificate. The captain had about 8,100 hours flying experience, of which over 2,300 hours were accrued on the F100, and had been operating as an F50/F100 pilot, based in Perth, for over 11 years.
The first officer (FO) held an ATPL-A, a multi-engine command instrument rating and a class 1 aviation medical certificate. The FO had about 5,700 hours flying experience, of which about 730 hours were accrued on the F100. The FO had completed the F100 type qualification facilitated by the operator in September 2017.
Both flight crew signed on for duty at Perth airport at 0530, and then operated a flight from Perth to Kalgoorlie, and return to Perth. They then transferred to VH-FWI and operated the third sector of their duty day from Perth to Geraldton. Their return flight to Perth (incident sector) was their fourth and final sector for the day.
Both flight crew reported that they had achieved a reasonable amount and quality of sleep the night before and did not feel tired or fatigued at the time of the occurrence. The captain conducted two flights the previous day and had completed office‑based work in the four days prior to that. The FO had been on standby duty the day prior and had operated two flights the day prior to that. The FO did not report any problems with sleep prior to those duties.
Aircraft and engine information
General
Production of the F100 ceased in early 1997. The Australian F100 fleet is the largest in the world comprising about 66 aircraft operated by four high capacity or charter operators. The majority of the national fleet service the fly-in fly-out mining and resource industry.
Powerplant
The F100 is powered by two Rolls-Royce RB 183 Tay Mark 650-15 (Tay 650) engines mounted on the aft fuselage. Each engine is an axial flow, two shaft medium by-pass turbo-fan design rated at 15,100 pounds of thrust (Figure 4).
Figure 4: Rolls-Royce Tay 650-15 cutaway drawing
Source: Rolls-Royce
Thrust control
F100 thrust is controlled by thrust levers mounted in the cockpit centre aisle stand, which (through cables) move fuel control mechanisms via an engine-specific FFR unit mounted within each engine nacelle. The management of forward thrust can be augmented by the autothrottle system (ATS), which automatically moves the thrust levers, based on commands from one of two channels within the automatic flight control and augmentation system (AFCAS).[19] Each ATS channel drives the corresponding thrust lever. The ATS can be used as long as one channel is operative. During normal operations in the autopilot level change (LVLCH) mode, the AFCAS, via the ATS, controls the fuel flow rate to maintain climb (CLB) engine pressure ratio (EPR).[20]> There are two motor-and-clutch systems installed in the aisle stand below the thrust levers. A selectable clutch-tie joins the two and if one ATS channel fails the clutch tie will permit the remaining channel to drive both levers.
Existing thrust control defects
Multiple VARA flight crew had reported various autothrottle faults on VH-FWI in the days leading up to the incident (Table 1). The MEL allowed for the unserviceability of one autothrottle channel as a category C (Cat C)[21] maintenance item, which allowed continued operation for 10 calendar days before repair or replacement was required.
Table 1: Relevant maintenance history of VH-FWI Autothrottle System (5-9 July 2019)
Date
Maintenance Log Entry
Maintenance Action
5 Jul 2019
Autothrottle System (ATS) 2 – Fault in Cruise, disarmed via MFDU procedure
Pilot reported on arrival Adelaide. MEL 22-10-03 applied, Category (Cat) C system expired 15 Jul 19.
5 Jul 2019
ATS 2 – Fault in Cruise, disarmed via MFDU procedure
Pilot reported on arrival Perth. AFCAS interrogated. ATS switch fault. MEL 22-10-03 removed.
8 Jul 2019
ATS 2 – Fault in Cruise, disarmed via MFDU procedure. Reset not successful.
Pilot reported on arrival Broome. MEL 22-10-03 reapplied, Cat C system expired 18 Jul 19.
8 Jul 2019
ATS 2 - Fault in Cruise, disarmed via MFDU procedure. Reset not successful.
Pilot reported on arrival Perth. MEL 22-10-03 reapplied, Cat C system expired 18 Jul 19.
9 Jul 2019
Aircraft released for Perth-Geraldton return with ATS 2 unserviceable and MEL 22-10-03 applied.
Source: ATSB in consultation with VARA Engineering and airworthiness department
Manual thrust reversion
Modern aircraft are designed to be capable of safe operations, despite malfunctions, through designed redundancy. The ongoing single channel autothrottle unserviceability would normally have permitted continued automatic thrust control, however, when combined with an engine failure on the opposite engine, the aircraft systems reverted to manual thrust control. The captain reported that during his last cyclic assessment in the simulator he had been required to demonstrate an ILS approach using manual thrust.
Single engine procedures
The Fokker F100 aircraft operating manual (AOM)[22] provided the following guidance regarding the conduct of single‑engine operations:
After confirming the engine out condition, the PROG [FMS CDU[23] ‘progress page’] may be used to identify the MAX ENG OUT altitude. Maximum altitude [engine out] is that altitude maintained with one engine operating at maximum continuous thrust and the other wind milling.
The MAX ENG OUT altitude enables the highest terrain clearance possible and the maximum glide capability in the event of a second engine failure. Immediately following the engine failure, using the aircraft’s weight and environmental conditions, the FMC calculated the MAX ENG OUT altitude to be FL 205 (20,500 ft).
The manual also noted:
For all single engine accelerations, climbs and drift down descents, operation is accomplished at maximum continuous thrust and VFTO speeds [green dot].
The calculated maximum flight level is restricted by a 1.2G (1.2 x gravity) buffet margin (from stall) and the capability of climbing with a 300 ft per minute rate of climb. The maximum flight level is therefore slightly higher than the ENG OUT MAX altitude as displayed on the FMC progress (PROG) page. The AOM defined green dot speed as the final take-off climb speed (VFTO). It is displayed as a green ‘O’ at the PFD speed scale. Green dot speed is used for various computations and limits, including drift-down and maximum angle climb.
Given the aircraft weight, altitude and environmental conditions at the time, the green dot speed (VFTO) was in the range of 155–170 knots.
Glide performance
One of the design improvements over the original Fokker F.28 Mark 100, in creating the more efficient F100, was a more aerodynamic wing. This resulted in an increase to the aircraft specific lift/drag ratio to 16.8:1[24] that, in nil wind, translates to a glide distance of about 16.8 NM (31 km) for every 1 NM (1.85 km), or 6,076 ft of altitude.
The FMC-calculated, single-engine optimum altitude of FL 205, equated to a glide distance (nil wind) of about 57 NM (106 km). However, at the altitude the crew adopted (FL 140), the glide distance (nil wind) reduced to about 39 NM (72 km).
Figure 1 illustrates the glide ranges from FL 140 and FL 205 respectively. At the time of the engine failure, the forecast wind at FL 140 was south‑westerly at 15–20 knots. This would have reduced the glide range if/when the aircraft was turned west towards any of the available alternate airports.
Recorded data
Analysis of flight data recorder (FDR) information showed that early in the climb phase the engine 1 FFR began to malfunction. Initially this led to over-regulation of fuel to engine 1, resulting in increased EPR. To maintain constant EPR, ATS 1 retarded the engine 1 thrust lever. As a consequence of the clutch tied thrust levers, the engine 2 thrust lever also rolled back from MCT towards flight idle.[25]
Coincident to engine 2 thrust approaching flight idle, the engine 1 FFR ceased delivering adequate fuel to engine 1, leading to a reduction in thrust and eventual flameout (engine failure). As designed, during the initial drop in engine 1 thrust, engine 2 resumed delivering the thrust commanded by the crew via the AFCAS (see Appendix A and B). Due to the pre-existing fault with ATS 2, when the aircraft systems detected failure of engine 1 control of engine 2 thrust reverted to manual control. FDR data indicated that the time from when the engine 1 FFR began to significantly over-regulate fuel, to the engine failure was approximately 45 seconds.
Following arrival in Perth, the aircraft remained powered to facilitate maintenance action including an engine ground run. Consequently, the cockpit voice recorder data was overwritten and not available for this investigation.[26]
Fuel flow regulator
A fuel flow regulator (FFR) is a device that controls the flow rate of fuel supplied to the injectors within the combustion chamber of an engine. In effect, an FFR is used to regulate the thrust produced by a gas turbine engine. The FFR (Part No: CASC509, S/N L1660) had been overhauled in March 2011 by Goodrich Control Systems, including the renewal of all seals, testing and recalibration. On 20 August 2013 it was fitted to engine S/N 17268 with 2,349.9 total hours/1,406 cycles. At that time, this engine was fitted to another VARA aircraft, VH‑FSQ.
On 18 June 2019 engine S/N 17268 (incident engine) was removed from VH-FSQ and fitted to VH-FWI. At the time of the engine failure (9 July 2019), key aspects regarding the FFR service history (time/cycles) included the following time since:
installation on incident aircraft (VH-FWI) - 77.4 hours/47 cycles.
Following the engine failure, the FFR (S/N L1660) was removed and sent to an approved overhaul facility (Rolls‑Royce) for detailed examination. Their report found that the internal planetary and sun gears within the FFR had worn, which would have contributed to the loss of drive, leading to the in-flight shutdown event (Figure 5).
Figure 5: Internal damage to drive, planetary and transfer gear within the FFR
Source: Rolls-Royce
The CASA‑approved system of maintenance[27] for the Tay 650-15 engine and its accessories at the time of the occurrence was derived from the Rolls-Royce engine management plan (EMP). The EMP allowed two options to establish FFR service life (time since overhaul, TSO). The first option required management in accordance with the FFR component management program (CMP)[28] that permitted a maximum service life of 16,000 hours (full life). The alternative option required a mid-life overhaul between 8,000–12,000 hours (mid-life). At the time of the incident VARA was operating under the first option. In addition, the CMP permitted the FFR to be maintained independently of the engine.
Between about August 2010 and August 2015, Rolls-Royce identified a number of in‑flight engine shutdowns and operational disruptions due to failure of internal components of the CASC509 FFR. Therefore, on 21 August 2015 Rolls-Royce issued a Notice to Operators which stated that the failures were due to the FFR being operated beyond the recommended in-service life.[29] The notice recommended that operators manage Tay engine accessories in accordance with intervals published in the Tay 650 generic EMP.
Appendix D highlights the reported CASC509 FFD failures within the Australian F100 fleet between 2011–2019, noting that the most recent three failures (including the subject occurrence) had accrued over 12,000 hours in service.[30]
Route knowledge
Regular public transport pilots often operate the same routes between familiar airports. Civil Aviation Regulation 218 – Route qualifications of pilot in command of a regular public transport flight requires they develop and maintain knowledge and understanding regarding important route characteristics including:
surrounding terrain (lowest safe altitudes)
adjacent airport information (runway orientation, lighting, local conditions)
nearby airspace information (location of non-controlled and controlled areas)
seasonal weather phenomena unique to the route
typical traffic (other aircraft operations) along the route and at each airport.
Additionally, the operator’s Flight Operations Policy and Procedures Manual indicated that:
Flight crew must maintain an appropriate knowledge of airports located on or next to air routes that may be used in an emergency…
Route knowledge assists decision making in both normal and non-normal situations, particularly during the management of events such as engine malfunctions or failures.
Airport information
Geraldton Airport
Geraldton Airport is located about 11 km east of Geraldton. It is a non-controlled, common traffic advisory (CTAF)[31] airport and a base for a number of charter and general aviation operators. The facility has a number of runways, though the F100 could only use runway 03/21, with a length of 2,400 m (7,874 ft) and width of 45 m. VARA designated Geraldton as an approved (main) airport [32] (regular destination). However, Geraldton was not equipped with aviation rescue and firefighting (ARFF) services (see appendix E).
Perth Airport
Perth Airport is a major international facility, a main airport and the home base for VARA, which provided maintenance capabilities. The facility is serviced by two runways and three separate instrument landing systems (ILS). All runways could be used by the F100. Flying operations are supported by continuous (24 hour) category 9 ARFF services.
Perth primary radar has range of 50 NM (93 km). The secondary surveillance radar has range of about 250 NM (463 km). The Australian automatic dependent surveillance – broadcast system (ADS-B)[33] provides radar-like coverage above 5,000 ft throughout most of Western Australia.
Emergency airports
The operator‑approved emergency airports between Geraldton and Perth were RAAF Bases Pearce and Gingin (Figure 1 and Figure 3). This permitted them to be utilised when an ‘immediate risk’ to the aircraft and occupants exists. That is, for time-critical emergencies only, such as an aircraft fire and/or a dual engine failure. RAAF base Pearce is serviced by two runways that are F100 capable.[34] By day, RAAF Pearce was equipped with category 5 ARFF services and Gingin was equipped with category 4 ARFF services.
Jurien Bay Airport
Jurien Bay Airport is located about 100 NM (185 km) south of Geraldton Airport. The airport is primarily used for sky-diving and general aviation (recreational) flying. The main runway (02/20) is 1,300 m long and 18 m wide. The secondary runway is significantly shorter. The main runway did not satisfy the operator’s guidance to crew regarding the ‘physical characteristics’ of emergency airports (runway length > 1,500 m and runway width > 30m).
Airspace information and considerations
In accordance with Annex 11 to the Convention on International Civil Aviation, Australian airspace is classified as either class A, C, D, E or G (Figure 6). The classification determines the category of flights permitted and the level of air traffic services provided.
Class G airspace is not controlled and the primary defences against aircraft collisions are radio‑alerted procedural separation for instrument flight rules (IFR)[35] flights and/or see-and-avoid procedures for visual flight rules (VFR)[36] aircraft.
In class E airspace, IFR are separated from other IFR flights and ‘receive traffic information on VFR flights as far as is practicable’. As with class G airspace, VFR flights separate using the ‘see and avoid’ principle. While class E provides additional defences for IFR aircraft over class G, it does not provide the same level of protection as classes A, C or D.
By direct track, the airspace within about 110 NM (204 km) of Geraldton is class G, from the surface to FL 180. Between FL 180 and FL 245 the airspace is class E. Airspace in this region above FL 245 is class A. From about 110 NM to 135 NM from Geraldton class E airspace is established from 8,500 ft to FL 180.
Analysis of the flight path (indirect track combined with adopted single engine cruise at FL 140 showed that, following the engine failure, the aircraft remained outside controlled airspace (class G) for about 95 NM (176 km). At the aircraft’s adopted speed (250 knots), this distance equated to about 23 minutes flight time outside of controlled airspace. The aircraft then entered class E airspace at about 35 NM north-west of CALIG and class C airspace (Perth terminal area) about 6 NM prior to CALIG at FL 140. This equated to about 8 minutes flight time in class E airspace. That is, about 30 minutes in airspace in which risk was increased marginally, versus class A or C airspace. By way of comparison, the flight planned track combined with either; the original cruise FL 330 altitude or the single engine optimum altitude (FL 205) would have resulted in the aircraft being outside controlled airspace for a total of about 8 minutes while departing Geraldton and climbing to that altitude.
Figure 6: Cross section - airspace between Geraldton and Perth (Surface to FL600)
Source: ATSB (derived from Australian aeronautical information package en route low and high charts for WA)
Traffic collision and avoidance system
High‑capacity transport aircraft such as the F100 are required to be equipped with an advanced traffic alert and collision avoidance system (TCAS).[37] TCAS is designed to prevent mid‑air collisions between aircraft. TCAS operates independently of ATC by using an on-board surveillance capability[38] to detect other transponder equipped traffic and provides:
Traffic display including proximate traffic[39] and traffic advisories (TA)[40] for situational awareness of relatively close aircraft.
Resolution advisories (RA)[41] for very close aircraft with vertical guidance to resolve the threat.
Both TA and RA alerts are generated according to the projected closest point of approach (CPA) or miss distance and the time to co-altitude (TAU). In general, the thresholds (time and distance) for CPA and TAU increase as altitude increases.[42]
In the event of an engine failure, flight crew are procedurally required to degrade the functionality of the TCAS to prevent generation of a climb RA that cannot be achieved due to the associated reduction in aircraft’s climb ability due to the OEI condition.
Regulatory information
Conditions for flight continuation
Civil Aviation Order (CAO) 20.6 Continuation of flight with 1 or more engines inoperative defined important conditions on the pilot-in-command (PIC) of all Australian registered multi-engine aircraft, where an engine has failed, or its rotation has stopped. This included the requirement to notify ATC immediately[43], giving all relevant information and stating intended action in regard to conduct of the flight. It also identified relevant factors that the PIC ‘must’ practically consider prior to a decision to continue beyond the nearest suitable airport, including:
the nature of the malfunction and the possible mechanical difficulties which maybe encountered if flight is continued
the nature and extent of any city, town or populous area over which the aircraft is likely to fly
availability of the inoperative engine to be used
weather conditions en route and at possible landing airports
air traffic congestion
the type of terrain (overflight), including whether the flight is likely to be over water
the distance to be flown coupled with the performance availability should another (remaining) engine fail
relative characteristics of the aerodromes available for landing
aircraft altitude, weight and useable fuel at the time of the failure or shutdown
familiarity of the pilot with the aerodrome to be used.
Multi-engine flight review requirements
Part 61 of the Civil Aviation Safety Regulations requires high‑capacity aeroplane pilots to complete annual proficiency checks and, if the aircraft is multi‑engine, the pilot must also hold a multi-engine aeroplane instrument endorsement. Further, such pilots are usually required to complete an instrument proficiency check (IPC)[44] in either an aircraft or simulator of the same category, within the preceding 90 days. The IPC also includes a check of medical certification, licence documentation and a knowledge assessment.
The associated Part 61 Manual of Standards described the standards for a multi-engine aeroplane type rating renewal, including the following categories:
conduct flight
aircraft systems
navigation
airspace
instrument flying
manage non-normal and emergency conditions
non-technical skills, and
management of passengers and cargo.
The category of ‘manage non-normal and emergency conditions’ specified four aspects that must be assessed:
simulated engine failure in the take-off segment
partial engine failure
simulated complete engine failure and execute a simulated asymmetric approach and landing
other aircraft system malfunctions.
The operator’s flight crew cyclic simulator program for the preceding 24 months (six cyclic exercises) focussed on these aspects and each cyclic session included management of an engine failure in the take-off segment (below 1,500 ft), initial climb, climb and cruise (see appendix F).
Threat and error management
According to Endsley (1996), achieving and maintaining situational awareness is one of the most challenging aspects for flight crew. Civil aviation advisory publication (CAAP) 5.23-1(2): Multi-engine aeroplane operations and training outlined the considerations for flight crew following an en route engine or system failure, which included:
maintaining situational awareness
understanding aeroplane specific systems
applying correct drills and procedures
declaring the appropriate level of emergency
positively managing the subsequent flight profile
utilising contingency plans determined prior to flight.
The CAAP also summarised the manner in which threat and error management should be applied within the operational context, including:
anticipation of potential threats and errors associated with each flight, that is contingency planning which necessitates planning and execution countermeasures
comprehensive briefing of planned procedures prior to departure, including anticipated threats
continuous monitoring and verification of visual and instrument indications to maintain awareness of energy state
Decision making
General
Aeronautical decision making is defined by the Federal Aviation Administration (FAA)[45] as:
A systematic approach to the mental process used by aircraft pilots to consistently determine the best course of action in response to a given set of circumstances.
Flying a high-technology aircraft requires both skilled psychomotor performance and real-time decision making – reliant on situational awareness, educated choice among alternatives and an accurate assessment of risk within a limited time-frame.[46]
The operator’s periodic (cyclic) training and assessment program consisted of a rolling four-month testing period. That is, each flight crew member would be assessed within a flight simulator three times per year. Different elements of decision making were examined in each of the cyclic simulator sessions.
Supporting procedures
To assist crew in the decision-making process, the operator utilised a standard mnemonic:
S – State the problem
A – Analyse the options
F – Fix the problem
E – Evaluate the result.
Further, as part of the ongoing ‘evaluation phase’ crew were expected to assess the following items:
Is the current situation still the most appropriate?
How can we improve the current solution?
What other options are now available?
Risk mitigation
Risk management feeds into decision making in two ways: during the assessment of the precipitating (perceived) threats and in accurately evaluating potential courses of action. In general, if there is limited time, the pilot will tend to implement the course of action that experience dictates is most likely to be successful.
In the February 2018 issue of FAA Safety Briefing[47], the concept of ‘risk mitigation’ (mitigate) was proposed versus ‘administrate’. That is, the FAA now hold that the task of ‘administrate’ after an event should focus on the mitigation of residual risk through the optimisation of the planned (original) path, or the ‘recovery path’ following a non-normal event. An initial urgency call, notifying the controller and other aircraft in the immediate vicinity regarding the nature of a non-normal situation would very likely assist the crew in mitigating subsequent risk.
VARA failure management model
To support sound decision making the operator’s procedures included a generic failure (non‑normal) management framework. This was used by the crew to provide structure to the way they responded to emergency situations and to facilitate safe continuation of flight. The stages of the operator’s failure management model were, in priority sequence:
Fly the aircraft
Confirm the failure - PM should call the failure and PF confirms
Immediate plan – to ensure flight path (PF should state intentions, PM should inform ATS)
Take Action – carry out appropriate recall and checklist items
Circuit breakers – check the status of relevant CBs in accordance with procedures
Normal checklists
Long Term Plan – gather information, choose best alternative, periodically re-evaluate.
The procedures also reiterated the requirements of CAO 20.6 including (not limited to):
Following an in-flight engine shutdown, it is a requirement to notify the nearest Air Traffic Services unit immediately, giving all relevant information, stating the action the Pilot-in-Command intends taking in regard to the conduct of the flight.
VARA flight crew training
Evidence based training (EBT) aims to identify, develop and evaluate the competencies required to operate safely, effectively and efficiently in a commercial air transport environment while addressing the most relevant threats according to evidence collected in accidents, incidents, flight operations and training.[48] EBT takes the concepts of these programs further by structuring recurrent assessment and training according to evidence-based priorities based on a comprehensive analysis of safety and training data from a wide variety of sources.[49]
The International Air Transport Association (IATA) document; Evidence based training implementation guide, a tripartite document comprised between the IATA, ICAO and the international federation of airline pilots’ associations (IFALPA) recommends that an engine failure during the climb should be assessed every three years.
The PM had completed a co-pilot F100 type qualification, facilitated by the operator (VARA), in September 2017. The type qualification included a simulator session that specifically assessed the crew’s actions following an engine flameout. The session also included the procedures for an attempted relight progressing to the remaining engine also failing (dual engine flameout). As part of the training, the instructor also facilitated a discussion regarding F100 glide performance (range) and forced landing considerations, specifically those associated with ditching.
The operator’s EBT framework had not included specific assessment of engine malfunctions or failures during the climb phase of flight for the preceding six assessment cycles[50] or 24 months. However, both the PF and PM had been exposed to a multitude of non-normal scenarios as part of the EBT based periodic training and assessment program during the preceding few years. All assessments had included an examination of their ability to manage the aircraft following an engine failure after take-off.
The number 1 engine failed (flameout) due to failure of the associated fuel flow regulator (FFR) and resultant lack of fuel supply to the engine. This analysis will explore the circumstances of the component failure.
Additionally, while the flight crew’s management of the occurrence resulted in a safe landing, aspects of their response to the engine failure will also be considered, including the:
decision to not return to the nearest suitable airport (Geraldton), instead continue to Perth
execution of the recovery (diversion)
benefits of flight crew training.
Engine failure
About five minutes after take-off, the engine 1 FFR seized due to internal gearing wear that was associated with the unit’s high time since overhaul (14,334.1 hours). This resulted in failure of the FFR to regulate fuel to engine 1, which then consequently flamed out.
As a result of previous, similar occurrences, Rolls-Royce was aware, and had advised operators of the potential for wear related FFR failure due to extended service life. Despite this, the subject FFR failed while being maintained within the service life limits of the Rolls-Royce engine management programme. Since this occurrence, Rolls-Royce have introduced a 10,000-hour midlife inspection and rework requirement for the FFR maintenance option selected by VARA (see the section titled Safety action). This requirement, which includes replacement of the sun and planet gear assemblies, would likely have prevented the subject failure and should reduce the future frequency of this failure type.
Presentation of the failure
In complex multiengine aircraft, one engine can rollback unnoticed by the flight crew, due to the autopilot and autothrottle masking the thrust asymmetry created. In this case, the PF noticed unusual thrust lever movement (due, in part, to the clutch tie), but did not associate that movement with the uncommanded increase in engine 1 thrust (due malfunctioning FFR). Further, although the PF noticed the movement of thrust lever 2, the progressively significant reduction in thrust (rollback) of engine 2 was not detected.
It is likely that the deteriorating health of engine 1 went undetected by the crew due to the effect of the automation/clutch tie and the absence of any cockpit alert. Additionally, at the time, the PF reported being focussed on the unusual (slightly decoupled) and uncommanded movement of the thrust levers due to the action of the clutch-tie mechanism. The PM was preoccupied with various support duties including cabin crew coordination, communicating with air traffic control and the completion of transition procedures.
Single engine operation
The operator’s F100 aircraft operations manual, provided clear guidance on the management of an engine failure throughout the varying phases of flight. These procedures were designed to maximise the aircraft’s single‑engine climb performance in order to ensure terrain clearance, allow flight in controlled (higher) airspace, avoid low level weather, and to optimise glide range should the remaining engine fail. In a limited fuel situation, these procedures also served to maximise single‑engine range and/or endurance.
For this event, at the point of engine flameout, fuel remaining, and terrain clearance were not limiting factors. However, by not slowing the aircraft towards the best angle of climb (green dot) speed, and by not increasing engine 2 thrust from CLB towards MCT the aircraft’s single‑engine climb performance was degraded, resulting in the crew’s decision to descend to FL 140. The crew recalled this collective decision was due to concern with ‘straining the good engine’ associated with any attempt to increase altitude, being ‘well above the lower safe altitude, with clear skies’ and ATC coverage. That is, they couldn’t see any advantage to going higher.
That the aircraft was only capable of manual thrust control was significant for the crew, as the autothrottle system provides automatic speed and gust protection, inputs to the angle of attack (alpha)[1] mode protection, and windshear protection. If required, a missed approach, regardless of landing point (Perth or Geraldton), would need to be carefully executed manually to prevent exceeding any engine limitations. Both flight crew reported that they had practiced a manual thrust approach in the operator’s preceding cyclic (simulator) assessment session, and this assisted their conduct during the single‑engine recovery into Perth.
Post incident - course of action
Decision to continue to Perth
Regardless of experience, flight crew require time to initially identify a non‑normal condition (engine failure) and consider their ‘immediate plan’. Once the aircraft was in the vicinity of waypoint IRWIN (Figure 1), the crew had a number of options:
return to the point of departure and the nearest suitable airport (Geraldton)
maintain their incidental altitude (FL 140) and original track continuing to avoid active military airspace, or
optimise their recovery path to Perth.
The decision to continue, divert or return can be complex and requires crew to have a comprehensive understanding of the characteristics of the route, including the suitability of proximate airports, the forecast and actual weather, airspace factors and their respective aircraft’s systems.
The operator’s procedures in the event of an engine failure or shutdown required the crew to land as soon as practicable[52] Notionally, the concept of ‘land as soon as practicable’ versus land as soon as possible[53] is predicated on the crew considering the existence and/or risk of further complications such as a fuel leak, fuel contamination and/or engine fire.
With respect to the relevant factors outlined in CAO 20.6 for continuation of the flight to Perth, the crew reported considering the following:
although above alternate minima, a deteriorating cloud base on return to Geraldton may have necessitated a non-precision approach, at least for the initial segment
anticipation of increased workload at Geraldton due to local traffic (two aircraft)
the aircraft’s thrust control system had reverted to manual thrust only
Perth runway 21 was ILS capable and significantly longer than the runway 21 in Geraldton
Perth airport was supported by category 9 ARFF services.
These factors supported their course of action to continue to Perth. However, the ATSB considered that the following factors supported returning to Geraldton Airport following the engine power loss, consistent with the operator’s procedural requirement to ‘land as soon as practicable’:
it was the nearest suitable airport
as a regularly used VARA port, the crew were thoroughly familiar with it
the weather at the time would probably have permitted an approach in visual flight conditions.
While continuation to Perth was a permitted option, it also resulted in longer exposure to one engine inoperative flight risks, compared to a return to the nearby Geraldton Airport.
Additionally, the route selected, combined with the decision to adopt a cruise altitude 6,500 ft below the recommended (FMS generated ENG OUT MAX) single engine altitude, resulted in the aircraft remaining outside of:
controlled airspace, or in class E airspace until about 167 km (90 NM) north of Perth
glide range to Perth Airport or an emergency airport for about 222km (120 NM) track miles, or about 30 minutes flight time.
In accordance with the operator’s single engine procedures, the crew also degraded the functionality of the TCAS to prevent the production of unachievable climb advisories (RA) when operating on one engine. This reduced the mechanisms by which the crew could avoid conflicting traffic.
Recovery execution
Technically, the continuation to the planned destination (Perth) was also a ‘recovery’, as the aircraft was operating under a non-normal (single‑engine) condition. The PF reported that the crew’s key priorities for the recovery included maintaining a safe aircraft configuration, availing the crew planning time and managing the increased workload associated with single‑engine and manual thrust operations.
Although the recovery track to Perth remained unaltered, the adopted cruise level (FL 140), below the recommended single engine altitude, limited the aircraft’s potential glide distance by about a third. Continuing the climb closer to, or at the green dot speed with increased engine 2 thrust would have availed the crew more time and glide distance in the exceptionally unlikely[54] event that remaining engine also failed.
The crew recalled being confident that in the event of the failure of their remaining (right) engine they could have recovered to either RAAF Pearce or Gingin, ATSB analysis found that this would not have been possible for a further 30 minutes after the initial engine failure. Prior to this point, the crew discussed the option of Jurien Bay Airport. While Jurien Bay did not meet the operator’s requirements as an emergency airport for flight continuation decision making, once the decision to continue to Perth had been made, it would have provided a viable option in preference to an off‑field landing in the event of a second engine failure. However, by maintaining their diverging (as cleared) track away from the coastline and around military airspace, the aircraft actually tracked away from Jurien Bay and Gingin (Figure 1) for a period.
Following the application of the operator’s failure management procedures, the crew were required to reassess (evaluate) their understanding of the evolved risk profile of continued flight via the SAFE model. The crew probably assessed that the likelihood of a second engine failure was remote but may not have fully contemplated the operational risks associated with continued single-engine flight at the lower altitude. Consequently, opportunities were missed to further mitigate operational risk via repositioning the aircraft into controlled airspace, more expeditious (direct) tracking to Perth and the optimisation of their glide range. The crew reported their overriding concern was workload management. Naturally, due to the abnormal situation, workload was increased. However, a direct track to Perth Airport or the runway 21 ILS initial approach fix could have further reduced their workload (given visual conditions).
In any event, a prompt landing is a key precaution against the risk associated with failure of the second engine, or further issues arising from the original engine failure, including effects on other aircraft systems. Should it occur, the resulting consequence (a forced landing on an unprepared area or a short runway) could be significant. Therefore, when faced with a one engine inoperative situation, consideration should be given to minimising the remaining flight time through track shortening and maximising the glide range of the aircraft. In this case the recovery path selected did not mitigate risk to as low as reasonably practical (ALARP).[55]
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the engine failure involving the F100 registered VH-FWI and continuation of the flight from about 41 km south of Geraldton. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
About 5 minutes after take-off, while climbing away from Geraldton, the engine 1 fuel flow regulator failed, resulting in fuel starvation to the engine and the total loss of thrust (flameout).
The fuel flow regulator seized due to internal gearing wear, despite being maintained within the recommended service life limits of the Rolls-Royce Tay 650-15 engine management programme.
Other factors that increased risk
Following the failure of engine 1 the crew did not adjust the aircraft speed or thrust, electing to maintain the aircraft’s incidental (cruise climb) speed of 250 knots. This degraded the single‑engine climb performance resulting in increasing the time that the aircraft was outside controlled airspace and the glide range of an emergency airport.
The decision to continue to Perth following the engine failure resulted in a longer exposure to one engine inoperative flight risks, compared to a return to the nearest suitable airport (Geraldton).
Other findings
Thrust variation from engine 1 (over about 45 seconds) due to the failing fuel flow regulator went undetected by the crew due to the effects of automation/clutch tie, focused attention on other cockpit tasks and the absence of any alert prior to the engine failure.
Flight crew competency regarding execution of a manual thrust approach had recently been assessed as part of the operator’s F100 cyclic training and assessment program and was found to have assisted during the approach to land.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the flight crew
Air Accidents Investigation Branch, United Kingdom
Airservices Australia
Australian Bureau of Meteorology
Civil Aviation Safety Authority (CASA)
Fokker Services
Rolls-Royce (United Kingdom)
Virgin Australia Regional Airlines (VARA)
References
Airservices Australia - Safety Bulletin – what happens when I declare an emergency? 18 July 2016.
Civil Aviation Safety Authority (CASA), Airspace review within 50 NM of Perth Airport, May 2017.
Civil Aviation Advisory Publication (CAAP) 215-1(3.2) Guide to the preparation of Operations Manuals, March 2020.
Dos Santos Marques, G, Engine condition monitoring as a route to savings, November 2010.
Endsley, M (1996), Automation and situational awareness in R. Parasuraman and M. Mouloua (Eds.) Automation and human performance: Theory and applications (pp 163-181) Mahwah, N.J., Lawrence Erlbaum.
Eurocontrol Publication: Guidelines for controller training in the handling of unusual/emergency situations, 2nd Edition, 31 July 2003.
Federal Aviation Administration (FAA) Safety Briefing- Back to Basics, 29 Jan 2018.
International Air Transport Association; Evidence-based training implementation guide, 1st Edition, July 2013 (triparted guidance document: IATA, ICAO and IFALPA).
Innes-Jones, G, & Scandpower L.R, Complacency as a causal factor in accidents – fact or fallacy? 2012.
International Civil Aviation Organisation (ICAO) Doc: 9137-AN/898 Airport Services Manual, Part 1 – Rescue and Firefighting, 4th Edition, 2015.
Orasanu, Judith & Martin, Lynne. (2008). HESSD ’98 100 Errors in Aviation Decision Making: A Factor in Accidents and Incidents.
Ross, S Prof, Introduction to Probability and Statistics for Engineers and Scientists, 5th Edition, 14 Aug 2014.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the flight crew (captain and first officer)
the operator’s (VARA):
- head of flying operations
- head of airworthiness
- head of safety
an accredited representative of the Aviation Accident Investigation Board (AAIB)
Rolls-Royce
CASA
The ATSB received submissions from CASA, Rolls-Royce, the operator (VARA) and the aircraft captain. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A - Fuel flow regulator malfunction and engine failure
Failure sequence:
A detailed review of the recorded data (see also Appendix B) identified that:
The application of the minimum equipment list (MEL) provisions regarding channel 2 of the autothrottle (ATS) had the following effects:
- the engine 2 thrust lever was mechanically clutch-tied to the engine 1 thrust lever. Therefore, ATS 1 via the engine 1 thrust lever was driving both engine thrust levers. That is, the ATS had no ability to command engine 2 thrust directly.
- The automatic engine pressure ratio (EPR)[57] synchronisation capability was unavailable to the crew. Instead the PF was required to synchronise the thrust of the engines manually via manipulation of the associated levers. This explains the minor EPR split from take-off through to about 1248:40 (see parameters at 0448:40 above).
As the PF was using LVLCH mode in climb (CLB), ATS 2 was commanding climb EPR.
From about 1248:40 to 1250:00 the EPR appears to have been synchronised by the PF. However, from that point EPR synchronisation ceased. As designed, the engine 2 fuel flow continued to gradually reduce as altitude increased. This is normal as engine performance increases with altitude due to decreasing total air temperature.
Engine 1 thrust increase - At about 1251:10 (about 5 minutes after take-off) the engine 1 FFR unit began to malfunction and was unable to provide the required reduction in fuel flow as altitude increased. This resulted in a higher engine 1 engine pressure ratio (EPR) and associated increasing EPR split between the two engines from about 1251:10 onwards.
Engine 2 thrust decrease - Due to the action of the autothrottle system (channel 1) and the clutch-tie mechanism, the engine 2 thrust lever followed the engine 1 thrust lever resulting in gradually reducing engine 2 EPR (thrust). .
Consequentially, the tie clutched engine 2 thrust lever was dragged back with the engine 1 thrust lever. This presented to the pilot flying (PF) as a gradual roll-back of both thrust levers. The EPR on the MFDU during this time indicated a marginal increase in engine 1 EPR and a reducing engine 2 EPR.
At 1251:17 engine 2 fuel flow decreased at a higher rate due to increasing thrust from engine 1. At this point the EPR split was 0.03 (engine 1 EPR of 1.62, engine 2 EPR of 1.59). The engine 1 fuel flow continued to increase to produce a maximum EPR of 1.69.
At about this point, the PF reported observing abnormal thrust lever movement. The PF recalled thrust lever engine 1 retarding while engine 2 thrust lever followed, albeit more slowly. The ATSB was unable to clarify the degree of thrust lever movement throughout the failure sequence as the FDR data did not include parameters associated with thrust lever position.
This discrepancy between the thrust lever positions (both rolling back together), and the indicated thrust (asymmetric), with absence of any aircraft warning system alerts, is likely to have contributed to the late identification of the failure by the crew during transition (high workload period).
Engine 2 rollback - At 1252:03, engine 1 parameters reached their maximum values. As designed, the AFCAS continued to reduce engine 2 fuel flow towards flight idle, producing the engine 2 rollback.
Engine 1 FFR failure - As engine 2 parameters reach their minimum values the engine 1 FFR ceased to effectively meter fuel.
At 1252:04 engine 1 fuel flow decreased sharply. The split between each engine EPR was 0.45 (engine 1 EPR of 1.69, engine 2 EPR of 1.24). As designed, the AFCAS detected the decay in engine 1 rotation (refer to N1 and N2) and commanded a rapid increase in engine 2 thrust to restore the total commanded thrust.
At 1252:07 engine 2 fuel flow started rising sharply, followed by the engine 2 EPR. Other associated engine 2 parameters increased rapidly. This corresponded to the PF observation that the thrust levers returned to the ‘wedges’.[58] At this point ATS1 was still engaged and the thrust lever movement was due to ATS1 inputs.
Engine failure and manual thrust reversion - At 1252:29 engine 1 flamed out and the ENG1 FAIL, and master warning alerts were generated by the aircraft’s warning system. Immediately following this, as designed, the engine 1 ATS disconnected resulting in reversion to manual thrust control.
Appendix B - Recorded flight data: Flight overview
Appendix C - Probability of dual engine failure specific to the Australian F100 fleet
If p is the probability of an engine failing or requiring an inflight shutdown per hour flown, then the following is approximately true:
2p is the probability of a failure or inflight shutdown of one engine on a twin‑engine aircraft
2p2 is the probability that both engines have an engine failure or inflight shutdown on a twin‑engine aircraft
Importantly, this assumes that the failures were not related to each other (mutually exclusive) and that the probability of a second engine failing is not changed after the first engine fails. That is, that thrust is not increased above MCT, which would further ‘strain’ the engine. There are similar relationships for more engines.
For the period 2008 to 2012, the Australian specific F100 fleet reported 11 engine related occurrences, of which 5 occurred during take-off and 4 during the climb phase.
This data highlights a combined engine failure and inflight shutdown (IFSD)[59] rate of about 3.63 per 10,000 hours[60] (3.63 x 10-4).
Therefore, for the period, 2p ≈ 3.63/10,000 and p ≈ 1.82/10,000.
This equates to a probability of both engines failing of 2p2≈ 2 x (1.82/10,000)2≈ 6.6/100,000,000 hours (6.6 x 10-8). Which suggests it is exceptionally unlikely[61] that both engines fail or have inflight shutdowns (assuming there is no common cause).
Appendix D - Historical data related to FFR CASC509 (Australian F100 fleet)
Date
Defect Number (DR)
Operator
Aircraft Registration:
FFR (CASC509) Serial No:
Effect (Failure Summary)
FFR hours at time of failure
6 Feb 20
Rolls-Royce ‘Service Letter’ revising maximum time between overhaul down from 16,000 10,000 hrs.
Appendix E - Australian Aviation Rescue Fire Fighting (ARFF) Categories
The principal objective of an ARFF service is to save lives in the event of an aircraft accident or incident occurring at or in the immediate vicinity of an airport. The ARFF service is provided to create and maintain survivable conditions, to facilitate egress routes for occupants and initiate rescue of those occupants unable to make their own escape without direct aid.
Source: ICAO Annex 14, Table 9-1 and 9-2 and ICAO Airport Service Manual, Part 1.
Notes:
Category 4 ARFF: a specialised albeit relatively limited emergency response capability specific to aviation operations.
Category 9 ARFF: refers to significant capability including large amounts of stored water, foam discharge rate/capability and dry chemical availability. In Australia, Category 9 ARFF is available at Adelaide, Brisbane and Perth airports. (Source: Part 139H CASA Manual of Standards Chapter 2).
Appendix F - Summary of engine malfunctions – VARA cyclic program (Jul 16 - Aug 20)
Cyclic No.
Assessment Period
Simulated environment
Engine failure after take-off (EFATO)
Engine failure IFSD and/or single engine operations (SEO) by phase of flight
Note: The PM (First Officer) completed engine failure training during the climb phase as part of an initial aircraft type (F100) qualification (Training simulator session #8) in late September 2017
Incident date: 9 July 2019 (41 km south of Geraldton, WA)
14
Sep-Dec 2019
Coondewanna TMA & Coondewanna-Broome
V1 cut
15
Jan-Apr 2020
Melbourne TMA & Melbourne-Adelaide
After take-off
16
May-Aug 2020
Adelaide TMA & Adelaide to Mildura
Wet runway V1 cut at 50 ft. AGL
Source: VARA flight operations training – F100 flight crew training cyclic simulator instructor guides
Notes:
This summary does not include all cyclic matrix (assessment) items. Each simulator session is time limited. Engine failure after take-off (EFATO) is assessed for every cyclic assessment. V1 refers to the decision speed to continue with the take-of that is, if an engine fails at or after V1 you are trained to continue with the take-off. V1 cut refers to a simulated engine failure in very close proximity to the aircraft achieving the V1 speed during the take-off roll (manoeuvre).
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 4 July 2019, while conducting a demonstration flight of an Alauda Airspeeder prototype unmanned aircraft system at Goodwood Aerodrome, United Kingdom (UK), the remote pilot lost control of the aircraft. In response, the pilot activated the safety ‘kill switch’ intended to immediately terminate the flight, but it had no effect.
The unmanned aircraft then climbed, to approximately 8,000 ft and entered controlled airspace at a holding point for flights arriving at Gatwick Airport, before its battery depleted and it fell to the ground. It collided with terrain in a field of crops approximately 40 m from occupied houses, outside of its designated operating area. There were no injuries.
Investigation
The UK Air Accident Investigation Branch (AAIB) investigated this occurrence. As Australia was the State of Manufacture of the aircraft, the AAIB requested appointment of an Accredited Representative from the ATSB.
To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act2003.
Conclusion
The AAIB found that the Alauda Airspeeder Mk II was not designed, built or tested to any recognisable standards and that its design and build quality were poor. In addition, the operator’s operating safety case, which formed the basis for gaining an exemption from the UK Civil Aviation Authority, contained several statements that were shown to be incorrect.
The Civil Aviation Authority’s Unmanned Aircraft Systems unit had assessed the operator’s application and, after clarification and amendment of some aspects, issued an exemption to the Air Navigation Order to allow flights in accordance with the operators Operational Safety Case. The Civil Aviation Authority did not meet the operator or inspect the Alauda Airspeeder Mk II before the accident flight.
There have been many other similar events where control of an unmanned aircraft has been lost, resulting in either it falling to the ground or flying away. The AAIB also identified that, even a small unmanned aircraft falling from a few metres could cause a fatal injury if it struck a person.
The AAIB investigation report made several Safety Recommendations and the final investigation report can be found at www.aaib.gov.uk.
Any further information regarding this investigation should be directed to the AAIB via: enquiries@aaib.gov.uk
_____________
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the AAIB investigation of the occurrence.
Occurrence summary
Investigation number
AE-2019-032
Occurrence date
04/07/2019
Location
near Goodwood Aerodrome, West Sussex, United Kingdom
State
International
Report release date
24/02/2021
Report status
Final
Investigation level
Short
Investigation type
External Investigation
Investigation phase
Final report: Dissemination
Investigation status
Completed
Mode of transport
Aviation
Aviation occurrence category
Loss of control
Occurrence class
Accident
Highest injury level
None
Aircraft details
Model
Alauda Airspeeder prototype unmanned aircraft system (UAS)
On 6 July 2019, the pilot of a Robinson Helicopter Company R44 helicopter, registered VH-KCH, was conducting a private flight from a property near Mansfield, Victoria, with one passenger on board. Shortly after take-off, the helicopter struck a powerline and subsequently collided with terrain resulting in serious injuries to the passenger and minor injuries to the pilot.
What the ATSB found
The pilot obtained some information from the landowner about powerlines on the property from where the helicopter took off, and a neighbouring property. However, he did not identify the presence of powerlines during the flight planning process and he did not see the wires or the associated poles during the shallow departure. The wires were strung across a valley with a span of 560 m, which the helicopter struck 158 ft above the ground. The wire did not have aircraft warning markers and did not require marking in accordance with Australian Standard 3891.
The ATSB also identified that, unlike other states of Australia, electricity network information was not readily available in Victoria to aid pilots during the flight planning process.
Safety message
The ability of pilots to detect powerlines depends on physical characteristics such as the spacing of power poles, the orientation of the wire, and the effect of weather conditions. Depending on the environmental conditions, powerlines may not be contrasted against the surrounding environment. In addition, the size of the wire and limitations of the eye can mean that it is actually impossible to see the wire.
watch for power poles and fly directly over them when crossing powerlines
constantly scan the terrain on either side of your flight path for poles/towers
always maintain at least 500 feet above ground level except during take-off and landing.
The Aerial Application Association of Australia Powerline Safety Program aims to encourage and facilitate power companies to improve aviation safety. The program involves the provision of mapping information of powerline networks and the marking of powerlines by network operators wherever it is requested by a pilot, aviation company or landholder.
In summary, effective wire avoidance can be achieved using a combination of:
available wire location information
wire marking
avoidance of unnecessary low flying, especially flight below the height of surrounding higher terrain where wire spans may be present.
The occurrence
What happened
At 1259 Eastern Standard Time[1] on 6 July 2019, a Robinson R44 Raven 1 helicopter departed Moorabbin Airport, Victoria, for a private flight to a rural property near Mansfield, Victoria. The 128 km flight was conducted under the visual flight rules[2] with the pilot and one passenger on board.
At about 1400, the helicopter landed at the property in a westerly direction.
After spending about 1 hour at the property, the pilot and passenger boarded the helicopter for the planned return flight to Moorabbin. The pilot assessed there was a light breeze and elected to depart in a north-westerly direction, over different ground to that overflown during the arrival.
Shortly after 1505, the helicopter lifted off and climbed gradually. The pilot reported that he focused on clearing two trees on the departure path, and that he did not notice a powerline pole on the nearby hilltop (Figure 1). The helicopter accelerated to an airspeed of at least 50 kt and travelled about 400 m from the take-off site.
Figure 1: Helicopter shortly after take-off (hilltop pole visible from that location)
Source: Provided to the ATSB
At 1506, the helicopter struck a two-wire powerline, 158 ft above ground level (Figure 2). The pilot reported that he did not see the wires, but felt a jolt and observed that the windscreen had cracked. He did not identify that the helicopter had struck a powerline, and focused on controlling the helicopter to a run-on landing. The helicopter descended rapidly, travelling about 400 m after the wirestrike, in which time the pilot felt another jolt. The aircraft collided with the ground in an upright position before it spun around and rolled over. The pilot sustained minor injuries and the passenger was seriously injured. The helicopter was substantially damaged (Figure 3).
Figure 2: Overview of the accident location
Source: Victoria Police, annotated by ATSB
Figure 3: Accident site showing wire tangled in the wreckage
Source: Victoria Police, annotated by ATSB
A witness standing under the powerline heard and saw the helicopter take‑off. He reported that the powerline was ‘very hard to see’ and that he saw a flash (arcing) when it was struck by the helicopter.
Pre-flight planning
The pilot contacted the property owner prior to the flight and was advised that the property had solar power and no powerlines. The property owner did not know the contacted powerline ran across the valley and he could not see the wires from his property.
The pilot had visited the property and the neighbouring one many times by car and knew of powerlines and poles at the neighbouring property, which were about 26 ft (8 m) high. However, he was not aware of the distribution powerline that the helicopter struck and stated that he had not expected to encounter powerlines more than 150 ft above the ground.
Powerline
The single phase, two wire (conductor) 22 kV powerline was strung across the spur line. It traversed a valley from a pole on the top of a hill to a pole located near the main road. The span ran perpendicular to a line of poles leading to a neighbour’s house. The span length was 559 m between poles and the maximum clearance above the valley was 48.1 m (158 ft).
Following the wirestrike, the helicopter pulled the two wires off the pole, which then parted and fell to the ground. Some of the wire remained attached to the helicopter (Figure 3) with the rest of the span on the ground and resting in trees.
Mapping
Energy companies in New South Wales and Queensland provide general aviation pilots (including those conducting authorised low-level operations) with access to network maps of high voltage electricity transmission lines and lower voltage distribution lines. The information is provided with a caveat that it may not be current and accurate.
Similar access to network maps is not provided by Victorian energy companies although the Victorian Department of Environment, Land, Water and Planning has a Spatial Datamart, which includes high-voltage transmission network information. The data does not contain information on the lower voltage distribution network. Additionally, use of the data for flight planning purposes requires extraction of the powerline information from a large dataset and processing to present it in a readily usable format such a map overlay.
conducting a pre-flight briefing and reconnaissance
applying appropriate flying techniques
reading the physical structure indicators, e.g. poles and insulators
knowing the location of powerlines on and around the property or the area you are flying in.
Marking
Wire markings enhance the visibility of wires. The requirements for marking powerlines and their supporting structures were published in Australian Standard AS 3891 Part 1, Permanent marking of overhead cables and their supporting structures for other than planned low-level flying and Part 2, Low levelaviation operations.
The powerline associated with this accident was not considered to be in an area involved in planned low-flying operations as described in AS 3891.2, although it was reported that aerial agricultural operations had previously occurred in the vicinity of the powerline. Additionally, the helicopter landing site was not an authorised landing area as defined in Part 1, nor did the cable height exceed 90 m or span exceed 1.5 km. The powerline therefore did not require marking in accordance with either Australian Standard.
The ATSB publication Avoidable Accidents No. 2 - Wirestrikes involving known wires: A manageable aerial agriculture hazard states that ‘even in cases where the criteria of AS 3891.1 do not apply, there may be an obligation on the owner of the wire to mark the wire. This could be the case if there is a high level of risk in the particular circumstances associated with the visibility of the wire. If you consider that a wire creates an unacceptable level of risk you should tell the owner of the wire (and the property owner if they are not the same person).’
After this accident, local landowners advised the ATSB that the powerline was erected in the 1970s, and that an aircraft conducting aerial agriculture had struck it in the 1980s. They reported that following that past incident, orange plastic marker balls had been fitted to the wires, however, they had perished over time and not been replaced.
No other wirestrikes involving this powerline were known to have occurred, and the energy transmission company had no record of any wirestrikes.
Weather
Footage of the take-off showed a sunny day with clear sky with some scattered high-level clouds, no wind and visibility greater than 10 km.
The United States Federal Aviation Administration (FAA) Safety Study of Wire Strike Devices Installed on Civil and Military Helicopters found from 1970-1979 and 1986-1996 clear skies and unlimited visibility conditions during most reported wire strikes and from 1994-2004, 86 per cent of the fatal wirestrike accidents occurred in day visual meteorological conditions.[3]
Pilot experience
The pilot had 73.8 hours total aeronautical experience and attained his Private Pilot (Helicopter) Licence in April 2019. The pilot had completed 5.2 hours in an R44 helicopter in the 90 days prior to the accident flight.
The FAA study referenced above found that most of the helicopter wirestrikes occurred with experienced pilots. The study found that in the United States, between 1994 and 2004, there were 124 wirestrike accidents involving civil helicopters, of which 41 were fatal. About 60 per cent were general aviation operations, while agricultural operations accounted for about 27 per cent of the accidents. The average rotorcraft flying experience of the pilots was about 4,000 hours.
Previous occurrences
Between July 2003 and June 2011, a total of 166 aircraft wirestrikes were reported to the ATSB. Electricity distribution and transmission companies identified an additional 101 wirestrikes that occurred during the same period that were not reported to the ATSB. Further information is in ATSB report from 2011, Under reporting of aviation wirestrikes.
According to ATSB publication Wire-strike Accidents in General Aviation: Data Analysis 1994 to 2004, 15 per cent of wirestrike accidents occurred in aircraft conducting private operations. Of those accidents, 61 per cent occurred in the vicinity of the landing area. These included take-off, approach, landing and conducting an aerial inspection of the landing area.
Safety analysis
As part of his pre-flight planning, the pilot sought and obtained some information about hazards, including powerlines, from the property owner. However, the owner was not aware of the distribution powerline strung across the valley. Additionally, and unlike other states, readily usable electricity network maps were not available to assist the pilot’s planning. Such maps provide valuable safety information to aid pilots in planning flights, and assist the visual identification of hazards, such as wires and poles. From past visits to the property by road, he knew of some low powerlines at a neighbouring property however that knowledge did not assist identification of the airborne wire hazard.
The pilot elected to depart in the same direction as the helicopter landed. Therefore, he had not overflown the powerline when arriving, depriving him of an opportunity to visually identify it. Additionally, he did not conduct aerial reconnaissance of the take-off and departure track that might have helped identify the powerline’s poles and wires. Consequently, when the pilot departed from the property he was unaware of the presence of the distribution powerline across his intended flight path.
Powerlines at significant heights above the ground can be expected in valleys as they are often strung across them to use the terrain to reduce the number of poles and the need to clear vegetation below the wires. However, the pilot reported that he did not expect any powerline at a height of more than 150 ft above the ground. The pole on the hill was visible from the take-off site, but the pilot did not see it. Nor did he see (or expect) the powerline wires, which are inherently difficult to sight and had no markers to increase their visibility. Consequently, as the pilot conducted a shallow departure climb down the valley the helicopter struck the powerline about 400 m from the take‑off site.
The circumstances of this accident highlight that the most effective means of preventing wirestrike can be achieved using a combination of:
available wire location information
wire marking
avoidance of unnecessary low flying, especially flight below the height of surrounding higher terrain where wire spans may be present.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The helicopter’s track down the valley and a shallow climb gradient resulted in controlled flight into the unseen powerline that was not fitted with visual markers.
The pilot’s pre-flight planning had not identified the powerline that was unknown to the property owner of the take-off site, and detail of the powerline network was not available to the pilot.
Acknowledgements
The ATSB acknowledges the assistance provided by Victoria Police during this investigation.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 22 June 2019, the airboat Gale Force was operating on a wetlands tour. The tour involved sections of at-speed driving through Sweets Lagoon, 55 km to the south-west of Darwin, Northern Territory. The tour was along a well-defined, at times shallow, muddy and vegetation-covered watercourse through open swampland. While negotiating a turn, control of the airboat was lost, resulting in collision with a tree. The airboat driver and the four passengers on board were injured. The airboat was damaged and disabled, requiring removal ashore for repair. The passengers and the airboat driver received first aid and were evacuated to Darwin for further treatment. The airboat driver and two of the four passengers were taken to Darwin hospital for treatment and were discharged later that day. The remaining two passengers only required first aid.
What the ATSB found
While negotiating a turn to starboard, the airboat was slightly off-track with insufficient reserve engine power to drive the boat safely through the turn. The stern likely rode up and skipped over the mud and plant surface, control was lost, leading to the airboat spinning and impacting the tree stern-first on the starboard side. The ATSB also identified that operational limitations, such as safe speed, which would have reduced the likelihood of the collision and reduced the injury consequences, had not been fully identified and implemented.
What's been done as a result
Outback Floatplane Adventures have updated safety management system procedures and requirements to better reflect the company’s focus away from ‘adrenaline-based’, toward ‘nature-based’ tours. Specific airboat training, guidance and competency requirements have been implemented along with updated emergency procedures. Prior to taking command, airboat skippers are to be competent in operating the designated airboat in specific tour areas.
Safety message
All business operations should be carefully and regularly assessed for risk. Such assessments should include specific, targeted appraisal of vessel operations as well as the suitability of passengers to undertake tours. In addition to responding to an emergency situation, particular attention should be paid to identifying and implementing safety controls to reduce the likelihood and consequence of an incident.
The occurrence
What happened
At about 0630 Central Standard Time[1] on 22 June 2019, eight guests arrived at the Outback Floatplane Adventures (OFA) office at Darwin Airport, Northern Territory. They had all booked on the OFA ‘half day ultimate adventure tour’ and had been transported to the OFA office to complete formalities and commence the tour. At the office, the passengers signed documentation to acknowledge that they had read, understood and agreed to conditions on an indemnity form. This form provided the passengers with some awareness of the risks involved in the tour and advised them to listen to and obey all OFA directions. The passengers were also shown a short aviation safety video prior to boarding the flight from Darwin to Sweets Lagoon, the site of the tour.
Sweets Lagoon is about 55 km south-west of Darwin and the flight, in OFA’s float plane, took about 20 minutes. The eight passengers and pilot arrived at the Sweets Lagoon pontoon at about 0730 and were greeted by the airboat skipper and the site host. A helicopter pilot who was also qualified to drive airboats was also at the lagoon.
The tour activities proceeded as planned. Initially, all guests were taken on a one-hour breakfast cruise of Sweets Lagoon on board the custom house boat Cyclone Creek. This was followed by a one-hour rainforest cruise on board the airboat Gale Force (Figure 1).
Figure 1: Gale Force
Source: Outback Floatplane Adventures
Prior to boarding the airboat, a safety briefing was conducted during which passengers were instructed to remain seated unless advised otherwise by the skipper and to remain within the airboat at all times. The locations of emergency equipment (fire extinguisher, life ring, radio, satellite phone and first aid kit) were pointed out and passengers informed that the tour would remain within mobile phone range at all times. All passengers donned life jackets and were provided with hearing protection against the noise of the airboat engine and fan. Finally, passengers were advised to hold on to the seat in front in the event of a need to brace. However, no specific advice was given to occupants of the front row regarding how to brace.
The rainforest tour was held in a watercourse off the southern end of the lagoon. It was a slow‑paced tour winding along confined tracks through the surrounding forest. The tour included regular stops to view the wildlife and scenery. Once completed, the tour returned to the pontoon.
At the pontoon, the tour party was separated into two groups of four. One group remained at the pontoon while the other group were taken on a ‘hot lap’ wetlands tour in Gale Force. The passengers could not recall any specific notice of what this tour would involve. The tour progressed without incident and the four guests remaining at the pontoon could clearly hear the airboat. The impression gained was that this tour would be more fast-paced than the earlier rainforest tour and would be more exhilarating.
The first tour group returned about 15 minutes later. The passengers appeared impressed and happy with the ride. The second group of four, consisting of two couples, then boarded. The skipper directed them to sit in the front row of seats. The tour departed and the airboat proceeded at low speed, away from the pontoon, off the lagoon and into a nearby watercourse. The tour passed through a narrow, winding, treed area, along a clearly defined channel, and entered a more open swampland area. From here, the airboat speed was increased.
A few minutes into the ride, the airboat was at speed when the track into a turn to starboard was slightly misjudged and control was lost. The airboat’s stern swung to port and left the channel. The starboard aft corner of the airboat swung round and made contact with a tree a few metres from the water’s edge (Figure 2).
Figure 2: Location of the collision
Source: Outback Floatplane Adventures; annotated by the ATSB
The impact threw the occupants backwards and then, as momentum swung the bow round, they were propelled forward, out of their seats. The skipper was injured and dazed from being thrown against the airboat side cage. The passengers sustained varying degrees of injury, including cuts and bruising, depending on where they were seated.
The skipper stopped the airboat engine, and gathered the first aid kit and passed it to the passengers. The skipper then telephoned the staff at the pontoon, reported that the collision had occurred and that the airboat was disabled. Immediate assistance was requested including pick‑up using the stand-by airboat stationed at the pontoon.
About 15 minutes later, the skipper and passengers were transferred to the second airboat and returned to the pontoon. A short time later, all eight guests and Gale Force’s skipper boarded the float plane for return to Darwin. OFA staff arranged medical transport to meet the aircraft upon its arrival and the skipper and two of the passengers were taken to Darwin hospital for further assessment and treatment. All three were released from the hospital later that day. The other two passengers only required first aid.
Gale Force was retrieved from the site and taken ashore for inspection and repair. The airboat had damage to the fan, the protective cage and the hull and the transom had been pushed to port by the impact (Figure 3).
The airboat was stripped and the hull repaired. New components were obtained and fitted and the airboat was inspected, surveyed and approved prior to returning to service.
Figure 3: Gale Force stern damage
Source: Outback Floatplane Adventures
Regulation
The regulatory requirements for vessels such as Gale Force were set out in in the Marine Safety (Domestic Commercial Vessel - DCV) National Law Act 2012[2],[3] and associated standards and regulations. Specific requirements were dependent upon factors such as the category of vessel, its date of construction, its size, and its intended operation. While there was no definition of ‘airboat’ in the National Law, the Australian Maritime Safety Authority (AMSA) advised that they were considered to be a novel, or special, vessel.[4]
Certificate of operation
The key mechanism in the National Law relating to safe operations was the certificate of operation. The certificate of operation sets out the conditions under which a domestic commercial vessel, or fleet of vessels, must operate. These included details of the vessels used, how and where the vessels could operate, and other conditions AMSA considered necessary due to the nature of either a vessel or an operation.
Safety management system
One requirement of the National Law was that the vessel must have a safety management system that complied with the requirements in marine order 504.[5] A safety management system (SMS) is the key way that vessel owners are expected to manage the risks of their operation and the regulations require that all operations are covered by a SMS.[6]
With regard to the operation of airboats in particular, AMSA expected that the SMS would include:
a comprehensive risk assessment which addressed (identified and controlled) organisational and operational risks including risks to people, the vessel, the business, and the environment
detailed information on:
passenger management and passenger safety including briefings
emergency management, including how to deal with incidents in remote, difficult to access locations
communications
training, including that specific to airboat operation.
To fulfil the requirements of the National Law Act, OFA held a certificate of operation and maintained a system of safety.
Outback Floatplane Adventures
Outback Floatplane Adventures (OFA) offered seasonal tours of the Northern Territory’s natural and wildlife sights from its base in Darwin.
OFA had implemented a safety management system which addressed the operational requirements specified in marine order 504. This included the following documents:
a safety management system—updated September 2018
a standard operations manual
an employee handbook—updated March 2018.
OFA required that the minimum competency as airboat skipper was to hold a Coxswain grade 1[7] near coastal qualification. Since assuming control of the company, the current management focus had shifted from one of promoting the adrenaline/thrill side of company tours, to emphasising the natural aspects (scenery and wildlife). The guests interviewed as part of this investigation confirmed that the appeal of the airboat tour experience did not require the adrenaline component. This shift in approach included updating of company promotional products in conjunction with changes in operating procedures and verbal instruction to staff. Airboat operating speeds were reduced and previous airboat coxswain guidance regarding spins and fast laps was removed from procedures. These changes were implemented prior to this occurrence.
Airboat skipper-coxswain
Gale Force’s skipper had worked in various positions within the tourism industry for more than 10 years. The skipper had obtained a Coxswain grade 1 certificate of competency in 2015 while working on board a dive boat. Since that time, the skipper had continued in the tourism industry commanding a variety of different small tourism vessels in northern Australia waters. In 2018, the skipper drove a five‑person airboat conducting private tours of a buffalo station in the Northern Territory, and after about six months moved to Darwin and commenced with OFA. Under the supervision of OFA’s experienced airboat skipper, this skipper commenced conducting tours on Gale Force, starting with the rainforest tour, for the final few weeks of the 2018 season.
The OFA 2019 tour season commenced in March. Gale Force’s skipper was assessed by the OFA representative as competent and assigned full operation of the airboat for both tours. Prior to the collision, Gale Force’s skipper had a total of almost 500 hours experience as an airboat driver.
At the time of the incident, new airboat drivers worked in a ‘buddy’ system with an experienced OFA airboat driver. Once considered competent, the candidate was given command of the airboats and ultimately the responsibility as tour manager for the Sweets Lagoon airboat operations.
Gale Force
Gale Force met the requirements applying to Australian DCVs which included having a unique identifier, a certificate of survey, a certificate of operation and was crewed by suitably qualified persons. Gale Force was an Australian-registered domestic commercial vessel in survey as a class 2E vessel—certified to carry 12 unberthed passengers and 1 crewmember on smooth waters in daylight hours only. It is square-bowed, 7.5 m long with a 2.5 m beam and hull depth of 0.870 m aft tapering to 0.575 m at the bow. Freeboard was about 0.5 m, fully loaded, measured three-quarters of the length from the bow. The hull bottom was fitted with a 12 mm-thick nylon sheet as a protective and lower friction surface for driving over vegetation or mud.
On board, the passengers were accommodated in three rows of bench seats, separated by a centre aisle into port and starboard seats each able to hold two people. The rows were step‑mounted from the bow to aft—the first row was below the gunwale, the second level with it and the third above it. The driver’s seat was mounted on the centreline behind and above the third row of passenger seats. Behind the driver, mounted within a protective cage, were the 415 kW engine, fan and rudders.
Gale Force was built by Diamondback Airboats, Florida, United States in 2013. The vessel passed survey in Australia in 2013, and entered service with OFA soon after. The airboat was delivered with passenger seatbelts which were removed after discussions between the owner and the regulator. The operating conditions were to be in smooth, shallow waters at low speed, and it was thought the restraints would increase the risks to passengers should the airboat turn over.
However, Gale Force was fitted with minimal other forms of passenger restraint—low backed bench seats with end rails only and side fences extending well above seat height. Occupants of the second and third rows could hold on to the seat in front but the front row passengers were essentially unrestrained in the case of a sudden stop.
Furthermore, the risk of injury to airboat occupants in the event of a sudden stop, such as collision, was not specifically assessed. Even at slow speeds, it is possible for people and equipment to be thrown about in an unsafe manner. Protection measures, such as some form of restraint or additional grab bars, were not available to all passengers, resulting in injuries during the collision.
Previous incident
In 2016, Gale Force was involved in a collision on Sweets Lagoon with another airboat operated by OFA. As a result of that incident, operating procedures were updated and track signage was improved. At the time of this occurrence, the Sweets Lagoon tour operations had changed to operating only one airboat at a time in the area.
Airboats
Airboats are unlike other craft in design, operation and capability. They are suited to specialised types of work in shallow, vegetation-choked, or muddy conditions where conventional craft cannot travel. Generally, airboats have shallow draught, are flat-bottomed, and have a high centre of gravity and low freeboard. They often have large amounts of engine power. Weight distribution, surface conditions (including the presence of mud and vegetation) and power significantly affect their stability and handling.
Airboat handling/manoeuvrability
Power is required for both control and propulsion. Engine power is necessary to force air over the rudder to initiate and complete turns. The combination of power and speed are used to force the rear of the boat to ride up onto the surface of the water and slide through a turn. However, when the operator reduces power, significant steering ability is lost. Essentially, a good operating speed is the slowest speed that will maintain the boat on the plane. This provides control with minimal draught yet is slow enough to stop or to take evasive action if needed.
Although the most basic operator instructions are relatively simple, the subtleties and skills required for safe operation are quite complex. Sufficient experience and good judgement of the operator are essential for safe airboat use.
Safety analysis
The incident
As the airboat was being driven through a confined swampland watercourse on the second wetlands tour, it was at or near full throttle when going into a turn to starboard. In contrast to the earlier tour, the approach into the turn was misjudged and the airboat was slightly off track to port. In this area, the channel narrowed and the surface of the water was broken by grass, water plant and mud patches (Figure 2).
As the airboat crossed this surface, it rode up onto the material and control was lost. The airboat engine was at full throttle and there was insufficient reserve power available to drive the boat forward and through the turn. Consequently, the stern swung to port, through about 120°, and left the channel. The stern swung round until the starboard quarter impacted a tree a few metres from the water’s edge.
Risk assessment
The Outback Floatplane Adventures safety management system documents contained several risk tables, principally concerned with business, environmental and personnel risk. The change in management focus had reduced operational risk through lowering airboat speeds and it would be reasonable to expect that the new airboat operating conditions, while driving within constricted and changeable waterways, would also have been assessed and documented. However, at the time of the incident, the risks associated with the airboat operations, such as a collision (which still existed), were not explicitly documented.
Therefore, measures to prevent such an occurrence and to limit the consequences were not shown to have been considered or implemented. Such measures would include detailed airboat operational guidance and assessment of occupant restraint arrangements.
While the company had changed the tourism focus away from adrenaline/thrill activities, the amended tour operations had not been assessed in sufficient depth. Consequently, lingering risks associated with the ways the tours were conducted, and in which the airboat was operated, were not fully identified and implemented.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Gale Force was being driven, at speed, through a confined swampland watercourse when the track and engine power into a turn were misjudged. During the turn, the stern likely rode over the changing water surface, spun round and impacted a tree.
Operational limitations, which would have reduced the likelihood of the collision and reduced the injury consequences, had not been fully identified and implemented.
Proactive safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Outback Floatplane Adventures
Outback Floatplane Adventures has advised the ATSB that they have taken the following proactive safety actions:
reduced the speed of operation of the airboats
updated the safety management system documents, procedures and processes
implemented specific airboat training, operational guidance and competency requirements, relating to airboat stability and driving
introduced updated and expanded procedures for emergency preparedness.
The future assessment of suitably qualified airboat skippers will be conducted by an independent and experienced airboat operator. The assessment will ensure that, prior to taking command, the skipper is competent in airboat operations in the tour areas and on the specific vessel they will be in charge of.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
