On 13 March 2017, at about 1700 Eastern Standard Time (EST), a de Havilland DHC-2 seaplane, registered VH-AWD, taxied at Hardy Lagoon aircraft landing area (ALA), for a charter flight to Shute Harbour, Queensland. On board the aircraft were the pilot and five passengers.
Hardy Lagoon had four waterways, marked by buoys, for take-off and landing. The company preference for take-off was to use the most into wind waterway. The wind strength was about 8 kt with a low sun, calm to smooth water surface and low tide at 0.6 m. The pilot positioned the aircraft between the northerly and easterly waterways (Figure 1) and started the engine with the water rudders retracted to allow the aircraft to weathercock into wind.
The wind effect on the aircraft indicated to the pilot that the northerly waterway was the most into wind waterway. In order to maximise the take-off distance available the pilot applied power to start the take-off run from a position to the south-east of the northerly waterway, while aiming to join the waterway at buoy F (Figure 1). Shortly after applying full power, and before the aircraft entered the northerly waterway, both floats struck submerged reef, which brought the aircraft to a stop.
Figure 1: Hardy Lagoon (north pointing downwards)
Source: Operator, annotated by ATSB (black, yellow, white and orange lines indicate the dimensions of the waterways)
The pilot shut down the aircraft and assessed the passengers for injuries and the aircraft for damage. The passengers were uninjured, and the aircraft was stuck on the reef at the point of low tide. After relaying a message to their[1] company, via an airborne helicopter, the pilot elected to transfer the passengers to one of the boats used for reef tours in Hardy Lagoon. About 20 minutes after transferring the passengers to the boat, another company aircraft arrived and was able to return the passengers to Shute Harbour before last light.
The following day the aircraft sank in 3 m depth of water after several attempts were made to keep it afloat. The aircraft was subsequently salvaged.
Seaplane take-off
The application of power to start the take-off pushes the centre of buoyancy aft, due to increased hydrodynamic pressure on the bottom of the floats. This places more of the seaplane’s weight towards the rear of the floats which sink deeper into the water. This results in a higher nose attitude, reduced forward visibility, and creates high drag, which requires large amounts of power for a modest gain in speed (Figure 2 left). This phase of the take-off is known as in the plow.
As speed increases, hydrodynamic lift on the floats and the aerodynamic lift of the wings supports the seaplane’s weight instead of the buoyancy of the floats. This allows the pilot to lower the nose attitude, which raises the rear portions of the floats clear of the water (Figure 2 right). This is the planing position, which reduces water drag and permits the seaplane to accelerate to lift-off speed. The pilot reported this was about 25-30 kt for the DHC-2.
Figure 2: Seaplane in the plow (left) and planing (right)
Source: US Federal Aviation Administration
Environmental conditions
The tide was at 0.6 m at the time of the collision, which occurred outside of the waterways. When the tide is above 2.5 m, the aircraft can manoeuvre around Hardy Lagoon outside of the dimensions of the ALA without striking reef. Below the 2.5 m tidemark, it was known that the reef could be struck when manoeuvring the aircraft outside the dimensions of the ALA. However, the pilot believed that their chosen track from buoy I to buoy F, where they would join the northerly waterway, was clear of underwater terrain. There were no hazard marks on the left side of their track towards buoy F, but this was outside the prescribed waterway.
The collision occurred at 1700 and sunset was about 1820, with the associated low sun angle. When the sun angle is low, more light is reflected off the water than refracted through the water and consequently it is more difficult to see objects underneath the surface.
The pilot described the water conditions in the lagoon as smooth to calm. Prior to the accident, and while still on the boat, the pilot received a phone call from the chief pilot to check on conditions. This was in response to light winds affecting an earlier take-off. They both agreed that with an eight-knot northerly wind, take-off could be achieved without the need to reduce weight.
Recent experience
The pilot had extensive flying experience, which included 127 total landings on and take-offs from Hardy Lagoon, 17 under supervision. They had operated at Hardy Lagoon the previous day. At the time of the collision, they were in their ninth-hour of their duty for the day. Earlier in the day, they experienced two unsuccessful take-off attempts in which the aircraft did not get into a planing position, which they attributed to light winds and high aircraft weight.
Safety and survivability
The pilot received annual training from the operator in emergency and life-saving equipment and passenger control in emergencies, in accordance with Civil Aviation Order 20.11. Prior to flight, passengers receive a video briefing on the safety aspects of the aircraft and are required to wear life jackets for the flights. A personal locator beacon and first aid box are carried on board the aircraft.
Search and rescue time (SARTIME) is managed by the operator. On approach to Hardy Lagoon, by about 500 ft above sea level, the pilots notify their operator of their arrival, at which point the operator starts a SARTIME for the aircraft’s departure from Hardy Lagoon of arrival time plus 2.5 hours. The operator has two boats moored at Hardy Lagoon with a mobile phone capable of contacting the mainland.
Previous similar accidents
On 25 June 2015 a de Havilland Canada DHC-2, registered VH-AWI, struck reef while attempting to take-off from Hardy Lagoon. While attempting a take-off manoeuvre to maximise the take-off distance available, the aircraft inadvertently drifted out of the waterway and struck reef.
For further information refer to ATSB report AO-2015-069.
Safety analysis
At the time that the pilot attempted the accident take-off, they had experienced two failed take-off attempts earlier in the day, which they believed were the result of light wind and high aircraft weight. As the wind was still light and the aircraft was relatively heavy, the pilot decided to start the take-off from a position outside the dimensions of the waterway, to increase the take-off distance available.
At the time of the attempted take-off, the tide was close to the low point, but the reef struck by the aircraft was still submerged. The sun angle was low, which increased the amount of sunlight reflected from the water surface. At the speed of the collision, the aircraft nose attitude was at the highest angle for the take-off run, which combined with the sunlight reflection to severely restrict the pilot’s ability to detect submerged reef.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The light wind conditions and aircraft weight led the pilot to initiate the take-off run from outside of the dimensions of the waterway in order to maximise the take-off distance available.
The aircraft struck submerged reef, which was obscured by the sunlight conditions and high nose attitude of the aircraft, before it entered the waterway.
Safety message
The pilot commented that there were a number of factors, specific to their own operation, which could minimise the risk of a similar occurrence. They noted there are too many variables in the operation to identify all possible scenarios when in training. Their most important lesson was the need to ask ‘am I safe’, particularly in ambiguous conditions, and ‘if I continue on this plan, will I remain safe?’
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 2155 Eastern Daylight‑saving Time[1] on 13 March 2017, a Qantas Airways (Qantas) Boeing 737-838 aircraft (B737), registered VH-VZZ (VZZ), was about to start its descent in to Canberra Airport, Australian Capital Territory. The aircraft was on a scheduled passenger flight from Perth Airport, Western Australia, and had two flight crew, five cabin crew, and 177 passengers on board. The first officer was the Pilot Flying (PF) and the Captain was performing the role of the Pilot Monitoring (PM).[2]
Air traffic control (ATC) cleared VZZ to descend and advised its flight crew to expect an arrival on runway 17. The controller also requested that the crew maintain maximum speed. In response, a descent speed of 320 kt was selected, 40 kt above the standard descent speed of 280 kt. The aircraft’s maximum allowable operating speed (VMO) was 340 kt.
At about 2200, the flight crew informed ATC that descent from flight level (FL) 310[3] had commenced and reported some light to moderate turbulence (Figure 1). Shortly after, ATC informed the flight crew that there would be a runway change to 35.
Figure 1: Diagram showing actions, conditions, and events during the aircraft’s descent
Source: ATSB
At about 2204, VZZ was descending past FL 280 when the flight crew made an announcement over the aircraft’s public address system advising the cabin crew to prepare for landing. That announcement provided a cue to the cabin crew that they had about 10 minutes to secure all loose items in the cabin before illumination of the ‘fasten seat belt’ sign. By the time the aircraft passed FL 270, it had accelerated to the flight crew selected speed of 320 kt.
At about 2209, the turbulence began to increase. In response, the flight crew switched on the ‘fasten seat belt’ sign and advised the passengers and crew to be seated with seat belts fastened. The operator’s procedures required cabin crew members to be seated within 1 minute of that announcement.
At that time, a cabin crew member was passing row 22 on her way back to the rear of the cabin (Figure 2). The aircraft’s movement due to the turbulence was such that she needed to hold onto the overhead lockers as she walked along the aisle. About 15 seconds later, she reached the rear galley, closed a stowage latch, and secured a rubbish bin in preparation to be seated in the left cabin crew seat.
Figure 2: Boeing 737-800 VH-VZZ aircraft seat map
Source: Qantas (annotated by the ATSB)
When VZZ descended through FL 220 (about 30 seconds after the ‘fasten seat belt’ sign was switched on), the wind direction changed by about 80 degrees, resulting in a head wind increase from 15 kt to 32 kt. That in turn led to the airspeed increasing through 325 kt, and the PF applying control column backpressure to avoid exceeding VMO. About 1 second after the maximum control column force was applied, the autopilot disengaged and the G‑Load[4] peaked at 2.2 g. The pilot monitoring reported that they were checking the instrument approach, as a result of the change to runway 35, when they heard the autopilot disengage tone and saw the speed of the aircraft increasing toward VMO.
The aircraft’s pitch angle changed by 3.87 degrees in 1 second, and its airspeed reached a maximum of 339.5 kt.
The cabin crew member recalled that, while standing in the rear galley and preparing for arrival, she felt the cabin floor drop and then quickly come up. The force due to the aircraft’s movement resulted in the cabin crew member fracturing her leg. The cabin crew member seated in the right rear seat assisted the injured cabin crew member.
The aircraft movement also resulted in a second cabin crew member in the forward galley falling forward and hitting her head on a trolley. She also received injuries to her knees, back and neck.
The flight crew received an interphone call from the cabin reporting the leg fracture injury. The turbulence subsided and the flight crew turned off the ‘fasten seat belt’ sign and first aid was provided to the injured crew members.
At about 2211, the aircraft’s speed decreased and the flight crew re-engaged the autopilot. The flight crew alerted ATC to the turbulence and were informed that no other turbulence had been reported in the area.
Due to her fractured leg, the injured crew member in the rear galley remained lying on the cabin floor for the landing. The aircraft landed at about 2234, and paramedics met the aircraft to attend to the two injured cabin crew members. Both of them were transferred to a hospital for treatment. The cabin crew member injured in the rear galley was admitted to the hospital. The other crew member was treated and discharged without admission. The aircraft was not damaged and none of the other crew or any of the passengers were injured.
Autopilot
The autopilot of VZZ remained engaged until the control column force reached about 25 lbs.
Qantas advised the ATSB that it was common practice for its B737 flight crews to manage an impending overspeed by applying control column force to override the autopilot. The expected outcome of this action was for the autopilot to revert to ‘control wheel steering-pitch’ (CWS-P)[5] mode, and raise the aircraft’s nose. According to VZZ’s first officer, the technique was part of initial B737 type rating training and line training. The captain also confirmed that this technique was commonly practiced.
Following review of the draft investigation report relating to this occurrence, Boeing advised that they were considering a revision to the overspeed guidance in the 737 flight crew training manual. Specifically, they were considering inclusion of the following preferred response to an impending overspeed:
VMO/MMO is the airplane maximum certified operating speed and should not be exceeded intentionally. However, crews can occasionally experience an inadvertent overspeed. Airplanes have been flight tested beyond VMO/MMO to ensure smooth pilot inputs will return the airplane to the normal flight envelope.
Periodic wind speed or direction changes may lead to overspeed events. Although autothrottle logic provides for more aggressive control of speed as the airplane approaches VMO or MMO, there are some conditions that are beyond the capability of the autothrottle system to prevent short term overspeeds. In these cases, leave the autopilot engaged and deploy partial speedbrakes slowly until a noticeable reduction in airspeed is achieved. Retract speedbrakes slowly when below VMO/MMO.
The autopilot of VZZ had been modified to remove the CWS-P reversion (that is, it would instead disengage when 25 lbs of control column force was applied). Boeing advised that the modification was introduced due to concern ‘…that flight crews may not recognise or correctly interpret the autoflight system automatic transition to the Control Wheel Steering mode…’.
A consequence of the modification was that the autopilot disengagement produced a sharper elevator response than reversion to CWS‑P, as that mode provided a smoothed resistance as a function of the pitch rate. That is, for the same control force input, the elevator deflection and pitch change were significantly larger when the autopilot disconnected compared to reversion to CWS‑P.
Recorded data
Examination of the relevant flight data showed that:
Minor turbulence occurred from 2208:30 to 2209:00 while the rate of descent was steady and the aircraft’s speed was about 320 kt. There were slight variations in the headwind and airspeed in this period.
At 2209:00, ‘level change mode’[6] was engaged and, over the next 20 seconds, the rate of descent increased and peaked at 4,725 ft/min.
Between 2209:30 to 2209:44, the wind direction changed about 80 degrees and the headwind increased from 15 kt to 32 kt.
At 2209:36, as the airspeed began increasing above 325 kt, the control column was pulled back and the autopilot disengaged at 2209:40. About 1 second after maximum control column force, the G-load peaked at 2.2 g and the aircraft pitch angle changed from -1.58° to 2.29°. The aircraft reached a maximum speed of 339.5 kt, 0.5 kt below VMO.
On the 9 May 2015, a Boeing B737-8FE aircraft was making a high-speed descent (320 kt) into Adelaide, South Australia. The crew responded to indications the aircraft was approaching the maximum allowable airspeed by extending the speed brakes. However, the airspeed continued to increase. The autopilot was then overridden by pulling back the control column (the force required was greater than the pilot expected) until the autopilot entered the CWS-P mode. Immediately afterwards, the control column was abruptly released. The subsequent motion of the aircraft resulted in a cabin crew member suffering a minor injury.
Safety analysis
The Qantas internal investigation of this occurrence found that in the past 6 years there had been 47 previous overspeed occurrences involving its Boeing 737-800 aircraft, of which 20 had been managed via manual intervention (that is, overriding the autopilot into CWS-P). The internal investigation also found that it was common practice among its Boeing B737-800 flight crews to descend at 320 kt (20 kt below the VMO) when cleared by ATC to conduct a high-speed descent.
The common practice of flight crews to prevent an overspeed was not a documented Qantas or Boeing procedure. As a result, the potential consequence of this practice was not considered when the autopilot was modified.
Qantas also advised that the flight crew of VZZ had no information that indicated that there would be a risk of turbulence. The wind information provided in the flight plan did not show there would be a significant change in the wind direction during descent. As such, descending at 320 kt was not considered to present an increased risk.
The first officer of VZZ responded to the increase in speed towards the aircraft’s VMO consistent with his training, experience, and observations of other crew members. As VZZ had a modified autopilot, it was not possible to override it into CWS-P. Consequently, when sufficient force was applied to the control column, the autopilot disengaged. That resulted in abrupt elevator deflection and pitch change, which in turn led to the cabin crew injuries.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The increase in headwind while VH-VZZ was making a routine high speed descent at 320 kt resulted in the airspeed increasing towards the aircraft’s maximum allowable speed.
The pilot flying applied a control column input to prevent an overspeed, which resulted in the autopilot unexpectedly disengaging. The consequent change of pitch and g-loading led to two cabin crew suffering injuries.
The aircraft’s autopilot had been modified such that, if sufficient control column back pressure was applied, the autopilot would disengage rather than revert to the Control Wheel Steering (CWS) mode. Autopilot disengagement resulted in larger elevator and pitch responses than those associated with reversion to CWS mode.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
Qantas advised the ATSB that it has taken the following safety action.
Safety information notice
A safety information notice titled Pilot responses during high and low airspeed events has been provided to the flight crew. The notice advised flight crew that:
during an impending or actual overspeed event, it is preferable to keep the autopilot engaged
there is a reasonable buffer on VMO before any significant maintenance actions are required. Disengaging (and/or overriding) the autopilot to avoid an overspeed may result in an abrupt pitch change that could lead to more adverse consequences than the overspeed itself.
Safety message
Although there was no expectation of varying wind conditions during the descent on this occasion, this occurrence highlights the increased risk of overspeed when operating with a reduced margin below VMO.
The intervention by the pilot flying to prevent the impending overspeed was understandable, and consistent with previous responses of other flight crew in similar situations. However, as detailed in the Qantas safety information notice, when faced with an impending overspeed, abrupt pitch changes may have more adverse consequences than an overspeed event. The manufacturer’s preferred use of speedbrakes to manage increasing airspeed, removes the hazard associated with abrupt pitch changes.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 12 February 2017, the fully-laden bulk carrier, Aquadiva, was departing Newcastle Harbour under the conduct of a harbour pilot. At about 2218 Australian Eastern Daylight Time (AEDT), during Aquadiva’s passage through a section of the harbour channel known as The Horse Shoe, insufficient rudder was applied in time to effectively turn the ship. The ship slewed, or moved laterally (sideways), toward the southern edge of the channel, and at 2224 it was over the limits of the marked navigation channel. Additional tugs were required to arrest the ship’s movement and return it to the channel to complete its departure.
What the ATSB found
The ATSB found that bridge resource management (BRM) techniques were not effectively implemented throughout the pilotage. In particular, the harbour pilot’s passage plan was not provided to the ship’s crew prior to his boarding. As a result, the harbour pilot’s passage plan was different to that of the ship’s bridge crew’s. This meant they did not share the same mental model of the planned passage, and were unable to actively monitor the progress of the ship or the actions of the pilot.
As a consequence, the safety net usually provided by effective BRM was removed and the pilotage was exposed to single-person errors. Such errors, when they occurred, were not identified or corrected. When insufficient rudder was applied and the ship did not turn as expected, no-one from the ship’s bridge crew challenged or intervened to draw this error to the attention of the harbour pilot. Consequently, the ship travelled too close to shallow water.
The ATSB also found that ambiguities in the details of the incident (whether the ship touched bottom or not) and in reporting requirements, as understood by relevant responsible persons (as defined by the Transport Safety Investigation Regulations 2003) led to delays in the reporting of the incident to authorities, including the ATSB. These delays meant that evidence available at the time of the incident, such as voyage data recordings, were not collected.
What's been done as a result
As a result of this incident, the Port Authority implemented a training and information process with pilots to discuss the incident and its outcomes and to inform them of their incident reporting obligations. Also, procedures are to be updated to require the use of portable pilotage units on all pilotages, and a project to implement sharing of electronic passages plans is also being undertaken.
Aquadiva’s operator provided targeted training to the ship’s officers. The company also completed an internal investigation and circulated the report and discussed and implemented identified preventive and corrective actions throughout its fleet.
Safety message
Safe and efficient pilotage requires clear, unambiguous, effective communication and information exchange between all active participants. An agreed passage plan, its understanding and the establishment of a ‘shared mental model’ between a harbour pilot and a ship’s crew, forms the basis for a safe voyage. Without this, effective implementation of BRM techniques will be limited, removing the intended safety net provided by BRM and, in this instance, leaving the passage exposed to potential single-person errors.
The occurrence
On 11 February 2017, the dry bulk carrier, Aquadiva (Figure 1), arrived at Kooragang number 8 berth, Port of Newcastle, for cargo loading. At 1209[1] on 12 February, cargo loading was complete and preparations were made for departure on the evening high tide, due at 2250. Aquadiva had departure draughts of 15.24 m fore and aft.
Figure 1: Aquadiva
Source: Australian Transport Safety Bureau
At 2000, the ship’s crew completed pre-departure checks. The ship’s berth-to-berth passage plan for the voyage included nine course alteration positions (waypoints) for the departure pilotage from the berth to the pilot disembarkation point. The passage plan included advice to ‘follow courses laid on the ECDIS (Electronic Chart Display and Information System)’ and ‘monitor the vessel’s position’.
At 2048, a Newcastle harbour pilot boarded the ship. The master and pilot commenced the master-pilot information exchange (MPX) and discussed the pilotage. Tug requirements, position and repositioning were explained during the exchange. Four tugs were to be in attendance: Mayfield on the centre lead forward, Svitzer Hamilton on the centre lead aft, Svitzer Meringa on the port shoulder and Svitzer Myall on the starboard shoulder.
At 2112, at nearby Kooragang berth number 4, a similar sized ship (FPMC B Justice - 300 m long, 50 m beam, 207,000 deadweight tonnes) departed ahead of Aquadiva. The plan of the pilot of Aquadiva was to remain mid-channel, passing through the Newcastle port passage plan waypoints. He was to remain at least 1,000 m behind the ship in front to minimise any hydrodynamic interaction between the two ships.
Passage to the wheel over point for The Horse Shoe
At 2123, with the four tugs in attendance, dead slow ahead was ordered and Aquadiva was under way (Figure 2 and appendix A). The pilot conned Aquadiva south, clear of Kooragang Island, and into the Steelworks Channel at about 3 knots.[2] At 2203, the pilot ordered slow ahead on the main engine and the ship’s speed increased.
Figure 2: Extract from navigational chart Aus 207 showing Aquadiva’s track departing Newcastle; position times and port waypoints (WP) indicated
Source: Australian Hydrographic Service; annotations by ATSB
At 2204, the pilot directed the master of the tug SvitzerMyall to reposition from the starboard shoulder to the port quarter. The tug master experienced some difficulty positioning the tug due to the ship’s stern cut away. The tug was repositioned further forward on the port side but was hampered due to the position of the accommodation ladder, which was not fully housed. By 2212, the tug was in position, forward of the ship’s accommodation, adjacent to the aftermost hatch.
At 2214, as Aquadiva passed waypoint 9 (WP9) at about 4 knots, the pilot ordered half ahead. The ship had a speed of 5.1 knots as it approached the alteration to port through The Horse Shoe. The alteration was more than 90°, from about 153° onto a heading of 056° leading out past Nobbys Head and to sea.
Passage through The Horse Shoe
The pilot’s plan was for a speed of about 4.7 knots as the ship approached the wheel over point (WOP)[3] for the alteration, about 120 m before WP8 (Figure 3). At 2218, at 5.1 knots, the pilot ordered 10° of port rudder followed by 20°. He wanted a rate of turn of about 13°/minute and he closely monitored the ship’s rate of turn indicator, which was mounted overhead in the bridge front. The ship’s bow turned to port while the ship continued to track almost straight ahead. Hard port rudder was ordered and, at 2220, the ship began to slow and turn to port. The pilot reported that he continued to focus on the rate of turn indicator to see if the ship was turning as quickly as desired.[4]
Figure 3: Extract from navigational chart Aus 208 showing Aquadiva’s track through The Horse Shoe
Source: Australian Hydrographic Service; annotations by ATSB
A short time later when he checked the ship’s position by looking out of the windows, the pilot saw that the ship was deeper into The Horse Shoe than expected. It was now south of his intended track and closing on the east cardinal buoy[5] (Birubi buoy). The buoy indicated safe water to the east and the outer limit of the channel, maintained to a depth of 15.2 m. At 2221, the pilot contacted the tugs to assist the turn. He requested SvitzerMeringa (on the port shoulder) to come astern and SvitzerMyall (port quarter) to take the ship’s stern to starboard. Astern of the ship, the master of SvitzerHamilton (centre lead aft) expressed concern that his tug would contact Birubi buoy. The pilot then requested Mayfield (centre lead forward) to take the ship’s bow to port.
Aquadiva’s master was following the progress of the ship and noted that it was deep into the turn. However, the pilot had ordered full rudder and engaged the tugs to assist the turn and the master, having little additional to contribute, did not challenge or intervene.
Nearby, the four tugs, which had assisted FPMC B Justice, were returning along the southern side of the channel. At 2221, the master of one of these tugs, PB Darling, having noticed Aquadiva was too far south in the channel, called the pilot and offered assistance. The pilot accepted the offer.
At this stage, Aquadiva was north of Birubi buoy with a speed of 4.9 knots, on a heading of 116° and course over the ground of 134°. At 2222, the pilot ordered the main engine slowed and then astern. At 2223, now past the buoy (Figure 4) the engine was briefly at full astern before being returned to stop and then dead slow ahead.
Figure 4: Relative positions of Aquadiva and tugs at 2223
Yellow line indicates the track followed by FPMC B Justice. The blue lines join passage plan waypoints.
Source: Australian Maritime Safety Authority and ATSB
At about the same time, Svitzer Hamilton had avoided Birubi buoy and repositioned to apply weight to take the ship’s stern to starboard. PB Darling had also been manoeuvred to push up on the ship’s starboard shoulder to move the bow further to port.
Aquadiva’s speed continued to reduce. At 2224, the speed was 2.6 knots and the ship’s bow continued to swing to port. The ship was now on a heading of 087° and positioned along the southern edge of the channel. The pilot ordered all tugs to stop. The ship continued to swing to port and, at 2225, was on a heading of 068° with a speed of about 2 knots (Figure 5). The pilot then ordered slow ahead, followed by half ahead on the main engine. From this point, the ship was successfully manoeuvred back into the channel.
Figure 5: Aquadiva in its most southerly position at 2225
Source: Australian Maritime Safety Authority and ATSB
At 2228, the additional tugs were released and by 2230 the ship had returned to the intended route. The remainder of the pilotage continued without further incident. By 2242, the pilot had released the four tugs and at 2250 he disembarked the ship by helicopter. At 2330, Aquadiva commenced sea passage, destined for Map Ta Phut, Thailand.
Post occurrence events
Upon returning ashore, the pilot telephoned the Newcastle harbour master and left a message about the incident. He then submitted an incident report to the Port Authority. Over the following days, the harbour master made further inquiries into the circumstances of the incident, including reviewing the automatic identification system replay. The pilot was debriefed and consulted on a number of occasions. On 21 February, the harbour master notified Transport NSW, the state authority for transport services within New South Wales.
On 23 February, the harbour master contacted the ATSB and the Australian Maritime Safety Authority to discuss the incident. An incident report was submitted and, after obtaining further information, on 3 March the ATSB commenced this safety investigation into the incident.
On 12 March, while Aquadiva was at anchor off Map Ta Phut, an underwater inspection was conducted. No serious damage or definitive indication of grounding was discovered and only minor paint scratching and peeling was found.
Subsequent investigations by the Port of Newcastle included a hydrographic survey of the area of The Horseshoe. This survey indicated that Aquadiva had touched bottom although not enough for the ship to have stopped and grounded.
The pilot had worked as a Newcastle harbour pilot for 22 years and completed almost 5,000 pilotages in and out of the port. He had also been a check pilot for 8 years.
The pilot was rostered off duty from 3 to 9 February 2017. He commenced a rostered duty period at 1600 on 10 February and completed two pilotages during that evening. He did not complete any pilotages on 11 February and Aquadiva was the pilot’s first pilotage for 12 February. He stated that he was well rested prior to boarding the ship at 2048.
Each pilot within the Port Authority of New South Wales (nsw) was subject to regular assessments by a check pilot, known as a ‘Pilots Annual Assessment’, while conducting an inbound or outbound pilotage. The pilot had completed an average of two checks per year during the period 2012 to 2016, with no problems noted on any of the checks. The last check was an outbound pilotage conducted on 18 October 2016.
In addition to the annual assessments, each pilot was required to undertake ‘electronic simulation’ training every 3 years. This involved conducting multiple simulated pilotage exercises over 3 days into and out of Newcastle. The scenarios included emergency and contingency situations, with the level of intensity higher than for most real world pilotages. Performance during the simulations was not recorded using a specific type of assessment form. However, if a pilot did not meet the required pilotage criteria, they were debriefed and the exercise conducted again until they were able to demonstrate the required proficiency. The pilot completed his last electronic simulation training in March 2016, and no problems were recorded on the pilot’s file.
The pilot was 58 years old. In accordance with the NSW Marine Pilotage Code, the Port Authority of NSW required each pilot to undergo regular health assessments conducted by an authorised health professional. For a pilot aged between 50 and 60, the code required an assessment to be conducted every 2 years. The pilot was undertaking annual medical assessments, with the last assessment conducted on 10 March 2016. The Port Authority advised that the pilot had been declared fit for work in each assessment during the 5 years prior to the 12 February 2017 occurrence, and no concerns had been reported about his medical fitness or performance during this period.
Following the occurrence, and with the pilot’s agreement, the pilot undertook a triggered medical assessment at the request of the Port Authority of NSW.[6] As part of this process, he undertook a neurological assessment. The assessment identified evidence of subtle difficulties with some cognitive abilities relative to other cognitive abilities, and recommended that further assessment be done in a simulated work environment. This assessment was not conducted. Following an extended period away from work, a subsequent medical assessment concluded that the stress resulting from the occurrence compromised the pilot's ability to safely return to pilotage work.
Overall, the ATSB concluded there was insufficient evidence to conclude that the pilot was experiencing a significant medical or physiological problem at the time of the occurrence that was associated with the occurrence.
Aquadiva crew
Aquadiva had a crew of 20 Greek, Filipino and Romanian nationals. The master had a Greek master’s certificate and had sailed as master since 2003. He had joined the ship 8 months prior to the incident. This was his first visit to Newcastle.
Vessel information
Aquadiva was registered in Greece, operated by Carras (Hellas), owned by Arion Shipping (Panama) and classed with the American Bureau of Shipping (ABS).
The ship is 292.0 m long with a beam of 44.98 m and has a summer deadweight capacity of 182,060 t at a draught of 18.30 m. Propulsion is via a Doosan MAN B&W 6S70 main engine delivering 18,660 kW via a right hand, fixed pitch propeller at 91 rpm. According to the ship’s posted manoeuvring characteristics, dead slow ahead (25 rpm) yielded 4.1 knots in the loaded condition and the minimum speed to maintain course was 3 knots.
Master-pilot information exchange
The pilot’s passage plan for the outbound pilotage was the same as that included on the port’s passage plan chartlets. The chartlets, which included waypoints and cross track errors, were available through the Port Authority of NSW website. The same chartlets were also used by the pilot that conducted the inbound pilotage of Aquadiva on 11 February 2017.
During the master-pilot information exchange (MPX) soon after the pilot boarded for the outbound pilotage, the ship’s master and pilot discussed the ship’s passage plan, the pilot card (appendix B), the Newcastle standard master/pilot information exchange document (appendix C) and the Newcastle pilot passage plans (appendix D).
The ship’s route and speeds down the channel were discussed as per the port passage plans. However, the pilot and master did not compare the ship’s passage plan with the pilot’s plan. There were some differences in the number and location of waypoints between the two plans (Figure 7), and these differences were not identified and corrected. In addition, the MPX did not include details of the passage such as manoeuvres through turns, wheel over points, rates of turn, comfort zones and cross track error.
The ship’s under keel clearance was also discussed. Based upon ship, tide and channel information, the static under keel clearance would be 1.6 m to contend with a vessel squat of about 0.6 m at 6 knots and the high tide (due at 2250) of 1.56 m. The MPX form noted that the wind was 20 knots from the south-south-east.
The MPX form also included additional general pilotage information. This included referring to the Port of Newcastle passage plan chartlets, details of several bridge team requirements,[7] guidance on reducing bridge alarms, pilot disembarkation details and anchor requirements. The master signed the MPX form acknowledging that he had received and understood the information provided, including the passage plan chartlets.
The pilot advised the ATSB that marine pilotage is a specialised skill requiring local knowledge and experience combined with complex, often interrelated, ship-specific and external variables. How an individual pilot conducts a pilotage also varies depending upon the situation at the time and as the pilotage progresses. He therefore noted that it is often difficult to clearly convey to the ship’s master in the timeframe available at the MPX all the information about how a specific pilotage will be conducted.
The pilot also advised that, in his experience, most ships did not input the port passage plan waypoints into their navigation systems prior to the pilot boarding, and the plans that were inputted generally contained fewer waypoints than the port’s plan.
Portable pilotage unit
A portable pilotage unit (PPU) is a portable, computer-based system that pilots bring aboard a vessel to use as a decision-support tool for navigating in confined waters (International Maritime Pilots’ Association). The units carried by Newcastle pilots operated independently of the ship’s equipment. These PPUs provided real-time automated positioning information which vastly enhanced situational awareness through the display of past tracks and predicted ship path on a chart familiar to pilots.
The Port of Newcastle Pilot Portable Units Operational Guidelines identified the PPU ‘as a decision support tool, to aid navigation and conning of the ship in confined waters.’
This equipment could also have been used as a communication tool, to assist in explaining the pilot’s passage plan and intended actions into and through the turn. In this way it could have assisted in building a shared mental model and clarifying the differences between the pilot’s and the ship’s passage plans.
The port’s operational guidelines also noted that since late 2012 the use of PPUs had become accepted practice on the majority of passages in the Port of Newcastle. This document went on to state that the harbour master had determined that a PPU was to be carried on passages involving vessels of 289 m length overall (LOA) and above, entering or departing the port.
Aquadiva is 292 m LOA. However, the pilot of the outbound pilotage did not take a PPU with him. He stated that, in discussion with the pilot of FPMC B Justice (which departed just prior to Aquadiva), they considered the conditions were such that visibility would not be restricted and that it was a good opportunity to practise and maintain visual pilotage skills. He also said that his understanding was that carriage of a PPU was not mandatory.
As Aquadiva was piloted down the Steelworks Channel (Figure 6), the ship was close to the middle of the channel, as per the pilot’s and ship’s passage plans. However, as the ship approached the course alteration to port, insufficient rudder was applied to achieve the necessary rate of turn to successfully make the turn. The pilot was distracted and the ship moved sideways (slewed), wide into the turn, south of the intended route and toward the outer limits of the channel. At 2224, the ship had slowed to 2.6 knots and was atop the deep water channel 15.2 m contour, at risk of grounding. With the assistance of additional tugs, the ship’s sideways movement was controlled and it was subsequently returned to the channel and the intended route.
Figure 6: Extract from navigational chart Aus 207 showing a comparison between ship tracks and the pilot’s passage plan track
Source: Australian Hydrographic Service; annotations by ATSB
This analysis discusses the manoeuvring of Aquadiva through The Horse Shoe and then examines the turn in the context of the use of the available resources to monitor and manage the pilotage. The requirement to report incidents and the ambiguities around these requirements, by the relevant responsible persons, are discussed in relation to pilotage incidents and the effect on safety investigations.
Turning through The Horseshoe
Aquadiva’s pilot intended to follow the port’s passage plan (appendix D), passing through the waypoints. The ship passed through waypoints 9 and 8 as it approached the wheel over point (WOP) for the course alteration through The Horse Shoe (Figure 7). At this point, it was the pilot’s usual practice to apply sufficient rudder to get the ship to turn at about 2½ times the ship’s speed (about 13°/minute). On this occasion, the ship did not turn as expected and the pilot stated that his attention was focussed on the ship’s rate of turn indicator. Shortly after, as the ship passed to the west of WP7, it was turning, but not quickly enough to complete the turn.
The ship continued to turn too slowly despite the application of full port rudder. However, by the time the pilot looked outside the bridge and noticed this, the ship was already significantly off course. At 2225, the ship was about 1 cable (185 m) south of waypoint 5, in a position over the outer limits of the 15.2 m channel, possibly touching bottom.
Figure 7: Extract from navigational chart Aus 208 showing comparison of tracks and waypoints through The Horseshoe
Source: Australian Hydrographic Service; annotations by ATSB
In comparison, FPMC B Justice had taken the turn through The Horse Shoe about 15 minutes before Aquadiva. Its pilot had applied rudder to commence the turn at WP9, about 3 cables before WP8. The ship began turning and, as it passed Aquadiva’s WOP, its rate of turn was greater than 10°/minute and the turn was under control. Figure 7 shows that the ship then tracked close to or through the remaining waypoints in completing the turn. A rate of turn of 19°/minute was achieved between waypoints 6 and 5.
This comparison shows that not enough rudder angle was applied, early enough, to get Aquadiva to turn sufficiently quickly to make the turn. In the critical early stages of the turn, the pilot was distracted from the primary task of monitoring and controlling the turn. This distraction was for a sufficient amount of time for control of the turn to be lost. The situation was not identified and challenged by the ship’s crew.
Through a fortunate coincidence, the tugs returning from the successful departure of FPMC B Justice were nearby and able to lend assistance to Aquadiva. Their assistance aided in preventing the ship from grounding on the southern side of The Horse Shoe.
Situational awareness and shared mental models
Situational awareness can be defined as knowing what is going on around you. In relation to a ship’s passage, it includes knowing what has recently happened (perception), what is currently happening (comprehension) and, based on where the ship is, what is about to happen (projection).
Closely related to situational awareness is the concept of a shared mental model. Each individual member of a group performing a common task will develop a mental model of what they think will occur during the task. Each person’s mental model is based upon the information available to them at the time and their past experience. Ensuring that each member involved in a pilotage (pilot and ship’s bridge team) shares the same mental model of the voyage (passage and pilotage plan) is central to effective bridge resource management (BRM).[8]
Australian Marine Notice 17/2014[9] states that with a pilot embarked:
The bridge team should support the pilot by:
maintaining a good lookout and situational awareness…
continually monitoring the pilot’s actions and promptly seeking clarification as necessary…
discussing, agreeing and communicating to the entire bridge team, any change to the ship’s voyage plan advised by the pilot…
To emphasise this, the Newcastle master-pilot information exchange (MPX) form contained guidance taken from Australian Marine Notice 11/2016[10] with respect to the ship’s bridge team, including the need to:
clearly define and delegate tasks and responsibilities
set and constantly review priorities
continuously monitor the ship’s position, speed and heading
continuously monitor the ship’s navigation against the passage plan and notify the pilot and master should any deviation from the plan or standard operating procedures occur.
The marine notice also stated:
The agreed passage plan, its understanding and the establishment of a ‘shared mental model’ by the entire bridge team forms the basis of a safe voyage under pilotage conditions…
It is essential that the pilot, master and bridge team work together to ensure that errors are detected early and corrected before the ship is put into any danger.
Furthermore, the Port of Newcastle’s pilotage safety guidelines[11] stated:
Efficient Pilotage is chiefly dependent upon the effectiveness of the communications and information exchanges between the pilot, master, bridge personnel and other participants including tug masters and mooring personnel. The mutual understanding each has for the functions and duties of the others is paramount. This is core to Bridge Resource Management and is a required element of the pilot’s task.
In summary, it can be stated that if there is no shared mental model for a complex task such as marine pilotage then BRM will be ineffective.
On board Aquadiva, the pilot had a plan for the pilotage and an intended route for the ship based on the port’s passage plan waypoints and his many years of experience of piloting similar sized ships out of the port. However, the pilot’s passage plan was not communicated to the ship until the pilot boarded and the MPX was conducted.
The ship also had a passage plan for the pilotage. However, the ship’s plan differed to the pilot’s in key areas, significantly in the region of the turn to port through The Horse Shoe (Figure 7). Here, the ship’s plan contained two less waypoints than the pilot’s plan. This meant that, though similar, the ship’s master and bridge crew built their mental model based upon differing information to the pilot. These differences were not identified, and corrected, during the MPX or at any time during the passage to The Horse Shoe.
The port’s passage plan chartlets, including waypoints and cross track errors, were available through the Port Authority of NSW website and they were also used by the pilot conducting the ship’s inbound pilotage. However, there was no procedure to proactively provide the passage plan to a ship prior to a pilotage and ensure that the ship’s crew had included it in the ship’s passage plan prior to the pilot boarding (for example, via inclusion in arrival requirements or through the ship’s agent). This contrasts with the procedure followed in a number of other ports around Australia and overseas, where the pilotage plan is proactively provided to the ship well prior to the arrival of the pilot on board. Such a process helps ensure the ship’s passage plan for the pilotage is the same as the pilot’s.
In Newcastle, the passive availability of the passage plan chartlets meant that it was not uncommon for ships arriving at the port to have not accessed this important information, despite opportunities to do so. On this occasion, had the pilot’s plan been received by the ship at an earlier stage (prior to passage), this plan, including transit parameters and limits, could have been included in the ship’s berth-to-berth passage plan. Any deviation from this plan could then have been explained during the MPX.
Furthermore, the pilot had not taken a portable pilotage unit (PPU) to assist with the pilotage. This equipment could also have been used as a communication tool, to assist in explaining the pilot’s passage plan and intended actions into and through the turn. In this way it could have assisted in building a shared mental model and clarifying the differences between the pilot’s and the ship’s passage plans.
In addition to differing passage plans and not fully explaining and communicating the intended plan, the pilot did not converse and engage frequently or effectively with the ship’s crew. At no time did the master or pilot seek to ensure that all personnel were actively engaged and shared the same detail for the pilotage, especially in the area of the turn to port. The pilot’s intentions were only broadly conveyed, such as the positioning and repositioning of the tugs and the hand drawn track on the passage plan chartlets. Details of the course alterations and any wheel over points, rates of turn, cross track limits or comfort zones were not discussed.
As a consequence of the differing mental models of the pilotage, the safety net around the pilotage, provided by BRM, was significantly compromised. The result was that specific details of how the pilotage was to progress resided only with the pilot, and the pilotage was then exposed to the dangers of single-person errors. As a consequence, the ship’s crew were unable to accurately and actively monitor the ship’s progress or the actions of the pilot against the pilot’s plan. They did not question, challenge or intervene, or otherwise effectively contribute to the safe completion of the pilotage. Any errors which arose, such as the ship not being in a position the pilot was comfortable with, or the rate of turn being too slow, were not identified as errors. Consequently, no action was taken to prevent these errors from escalating into the incident.
In summary, from the outset, neither the pilot nor the master took the opportunity to effectively manage the resources present and available to safely monitor the ship’s progress or the actions of other bridge personnel. Consequently, any opportunity to capture and correct errors which occurred was lost.
Previous incidents
A common thread in pilotage related investigations conducted by the ATSB has been the breakdown in BRM and its implementation. This is particularly apparent in establishing and maintaining a shared mental model for the entirety of the passage. A recent investigation involving contact between the bulk carrier Navios Northern Star and a navigation buoy while under coastal pilotage in the Prince of Wales Channel, Torres Strait, Queensland (ATSB investigation 325-MO-2016-003, report published June 2017) also highlighted these points.
That investigation found that:
BRM techniques were not effectively followed by the ship’s bridge team. This meant that the ship’s personnel did not have the same mental model of the course alteration as the pilot and they did not actively monitor the pilot’s execution of the alteration.
The ship’s voyage plan contained only basic passage information and its bridge team did not know or fully understand the pilot’s planned operational parameters and limits, including WOPs and safety margins.
The pilot was distracted during a critical 2-minute period before the incident. Further, the master’s challenge to the pilot as the ship closed on the buoy was too late.
Amongst other things, the MAIB investigation found:
These findings echo similar findings from many of the pilotage incidents the ATSB has investigated, including the current one.
The rate of turn required to stay within the dredged channel could not be sustained.
The pilotage was not properly planned with key decision points, WOPs and abort options not identified.
The ship’s pilotage plan did not reflect the plan (intentions) of the lead pilot.
Poor information exchange and communication led to the lead pilot and the bridge team not sharing the same mental model.
Differing mental models meant that the ship’s master and bridge team were unable to monitor, challenge or seek to clarify the lead pilot’s actions and the vessel’s progress.
The breakdown of BRM resulted in the lead pilot becoming the sole decision-maker and a single point of failure.
Portable pilotage units were carried but were not effectively used to assist the master / pilot exchange and provide additional situational awareness.
Overall, these investigations highlight the changing requirements and expectations of industry and involved organisations with respect to pilotage. In particular, the desire to use BRM as an effective risk and error management tool is apparent. This is being achieved through emphasis on greater passage plan detail, improved communications, improving the building of a shared mental model and similar strategies.
For example, as a result of the Navios Northern Star investigation and as part of a continuous improvement program, the pilotage organisation involved undertook significant proactive safety action. This included initiating a pilotage workshop facilitated by an external consultant to assess and amend the company’s pilotage safety management system (SMS). Significantly, one aim was to determine and include good pilotage practice guidance in the SMS.
Importantly, the workshop determined that good pilotage practice covered all aspects of the pilotage, from booking to completion, not just the conduct of the ship. Amongst other initiatives, this resulted in the identification of practices and procedures to assist pilots to:
Establish involvement in and agreement to BRM techniques as essential for safe conduction of any pilotage.
Set operational parameters and limits for ship handling and navigation for each of the company’s pilotage areas.
Ensure ships’ personnel have accurate detail of the passage plan the pilot will follow, well in advance of the pilotage. The crew are to be expected to incorporate this information, including transit parameters and limits, into the ship’s berth-to-berth passage plan. Any deviation from this plan is to be explained fully to the master during the MPX phase(s) of the pilotage.
Assign roles and responsibilities to ships’ personnel in support of and as assistance to the pilot.
Use a variety of techniques for engaging and informing ships’ personnel of the pilot’s plans and intentions, so as to establish and maintain a shared mental model and situational awareness. In doing so the ship’s crew can be actively involved and monitor the pilot and the passage and provide challenge/intervention as needed.
Use the PPU not just as a significant navigation tool but as an information, teaching and communication tool for use with the ship’s master and crew. PPUs were identified as being especially useful for developing expectations and explaining impending manoeuvres such as turns and course changes.
Incident reporting
For all ships in Australian waters, the Australian Maritime Safety Authority (AMSA) requires that it be notified within 4 hours of becoming aware of any incident that has affected, or is likely to affect the safety, operation, or seaworthiness of the vessel. The Transport Safety Investigation (TSI) Act 2003 requires a responsible person to report marine accidents and serious incidents to a nominated official as soon as possible. A responsible person is defined by the Transport Safety Investigation Regulations as the master or person in charge of the ship, the owner or operator of the ship, an agent of the owner or operator, or a pilot who has duties on board the ship.
On board Aquadiva, the master was not aware that the ship had contacted the bottom, or had come very close to grounding. He therefore did not report the incident to AMSA until prompted by notice from the ship’s Newcastle agent. The initial report from the master to AMSA was dated 14 February, 2 days after the incident. This report identified the incident as a ‘dangerous occurrence’ and detailed manoeuvring difficulties but did not mention grounding or touching bottom.
The pilot reported the incident to the Newcastle Harbour master and submitted a report to the Port Authority upon his return ashore from the pilotage. The pilot, in reporting the incident to port management, believed he had fulfilled his requirements to report. Some confusion then existed regarding the requirements for subsequent reporting to authorities by port officials not nominated as responsible persons in the legislation.
The combined delays in reporting this incident and initiating the safety investigation meant that valuable evidence available at the time of, and for a short time after, the incident was lost. This is particularly relevant to the voyage data recording information from the ship, which provides valuable, relevant data and recordings to assist in safety investigations. Further, once the safety investigation had commenced, sufficient time had passed to have potentially affected the memories of the people involved in the occurrence.
From the evidence available, the following findings are made with respect to the near grounding, under pilotage, of the bulk carrier Aquadiva in Newcastle on 12 February 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
As Aquadiva commenced the 90° course alteration to port through The Horse Shoe, insufficient rudder was applied, and too late, to achieve the necessary rate of turn to successfully make the turn. As a consequence, the ship went off course, toward the southern limit of the channel, coming very close to grounding.
During the early stages of the turn, the pilot was distracted from the primary task of monitoring and controlling the turn when he was likely focussed on the rate of turn indicator and achieving the desired rate of turn. This short period of time was for sufficient duration at a critical point in the turn that control of the turn was compromised.
A shared mental model for the pilotage was not established between the pilot, Aquadiva’s master and the bridge crewmembers. In particular, techniques such as
ensuring the same plan for the pilotage was shared by the ship’s crew and the pilot prior to the pilot boarding,
utilising equipment such as the portable pilotage unit to assist explanation of the pilotage stages and parameters,
ensuring active monitoring, challenge and response/intervention and error management techniques were used by all personnel involved in the pilotage, were not used. Therefore, bridge resource management was not effectively implemented and practised.
Other key findings
Ambiguities and uncertainties around reporting requirements for port pilotage incidents led to delays in the ATSB being notified of the incident and commencing a safety investigation. These delays meant that volatile evidence such as the voyage data recordings were not able to be collected.
The tugs returning from the successful departure of FPMC B Justice offered assistance to Aquadiva. Their assistance aided in preventing the ship from grounding.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Port Authority of New South Wales
The Port Authority of New South Wales informed that ATSB that it had undertaken the following safety actions:
an external law firm was engaged to conduct an investigation into the incident and report findings and provide recommendations
Port Authority pilots, including those in ports other than Newcastle, were informed of the event and learnings from it
procedures are to be amended to require compulsory carriage of portable pilotage units on all pilotages
pilot passage plans have been located in a more prominent position on its website (since February 2017)
a project to implement sharing of electronic passage plans has been commenced
a training package for pilots informing them of their obligations and requirements to report incidents is to be developed and implemented.
Carras (Hellas), Aquadiva’s operator
Carras (Hellas) notified the ATSB that it had taken the following actions in response to this incident:
conducted an internal investigation into the incident and distributed copies of the internal investigation report throughout the company’s fleet, with direction to masters to be aware of bridge resource management (BRM) procedures associated with pilotage plans and to discuss the incident during ship safety meetings
discussed the incident, investigation and lessons learned during Aquadiva’s safety committee meeting following the incident and provided bridge resource management and safety of navigation training to Aquadiva’s bridge team officers
discussed the incident, investigation and outcomes during a shore-based deck officers forum meeting attended by senior fleet deck officers.
Ship details
Name:
Aquadiva
IMO number:
9469675
Call sign:
SVAN4
Flag:
Greece
Classification society:
American Bureau of Shipping (ABS)
Ship type:
Bulk carrier
Builder:
Odense steel shipyard (Denmark)
Year built:
2010
Owner(s):
Arion Shipping (Panama)
Manager:
Carras (Hellas) (Greece)
Gross tonnage:
93,360
Deadweight (summer):
182,060 t
Summer draught:
18.30 m
Length overall:
292 m
Moulded breadth:
44.98 m
Moulded depth:
24.85 m
Main engine(s):
Doosan-MAN B&W 6s70 C-7
Total power:
18,660 kW at 91 rpm
Speed:
15.0 knots
Damage:
Nil reported
Sources and submissions
Sources of information
The sources of information during the investigation included:
Aquadiva’s master and bridge team members
Carras (Hellas)
the Port Authority of New South Wales - Port of Newcastle, harbour master, vessel traffic information centre and harbour pilots
Svitzer Australia and tug masters
the Australian Maritime Safety Authority (AMSA).
References
Australian Maritime Safety Authority (AMSA) 2016, Marine Notice 11/2016 Bridge Resource Management (BRM) and Expected Actions of Bridge Teams in Australian Pilotage Waters, AMSA, Canberra. Available at www.amsa.gov.au.
Australian Maritime Safety Authority (AMSA), 2014, Marine Notice 17/2014 Sound navigational practices, AMSA, Canberra. Available at www.amsa.gov.au.
Clark, I.C. 2005, Ship Dynamics for Mariners, The Nautical Institute, London.
International Maritime Pilots' Association (IMPA), 2016, Guidelines on the design and use of Portable Pilot Units, IMPA, London. Available at www.impahq.org.
Marine Accident Investigation Branch (MAIB) 2017, Report on the investigation of the grounding of the ultra-large container vessel CMA CGM Vasco de Gama, Thorn Channel, Southampton, England, 22 August 2016, MAIB, Southampton. Available at www.gov.uk/maib.
Rowe, R.W. 1996, The Shiphandler’s Guide, The Nautical Institute, London.
The Nautical Institute 2016, ‘Error Management’, The Navigator, October 2016.
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Port Authority of New South Wales, Newcastle harbour master, Newcastle harbour pilot, the master and bridge team members on board Aquadiva, Carras (Hellas), the Australian Maritime Safety Authority, the Hellenic Bureau for Marine Casualties Investigation (HBMCI) and Svitzer Australia.
Submissions were received from the Newcastle harbour pilot, the master of Aquadiva, the Port Authority of New South Wales (including harbour master), Carras (Hellas) and the Australian Maritime Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Table of selected data for Aquadiva’s departure from Newcastle
Appendix B – Aquadiva’s pilot card and master / pilot information exchange form for departure Newcastle
Source: Master, Aquadiva
Appendix C – Master / pilot information exchange (MPX) document, pilot’s component
Source: Port Authority of New South Wales
Appendix D – Reproduction of the pilot’s Newcastle pilot passage plan chartlets showing the planned track and speeds
These chartlets, including the waypoint and cross track error lists, were available on the Port Authority of New South Wales’ website, Port Authority NSW under Newcastle Harbour). Pilots conducting inbound pilotages also used the same documents.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
RReleased in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 22 February 2017, at 1433 Eastern Daylight-saving Time (EDT), a Virgin Australia ATR 72-212A aircraft, registered VH-VPJ, departed Port Macquarie Airport, New South Wales (NSW) to operate scheduled flight VA1188 to Sydney, NSW. There were four crew and 23 passengers on board.
At 1453:35, during cruise at Flight Level (FL) 180,[1] the Centralized Crew Alerting System (CCAS) alerted the flight crew to a failure of the number one static inverter (Figure 1).[2] The CCAS then displayed multiple messages indicating a loss of power to systems associated with the number one static inverter. The aircraft electrical system power transfer function automatically transferred these systems to the number two static inverter and the CCAS warnings extinguished.
At 1453:43, the cockpit master warning activated and the CCAS displayed an electrical smoke warning. The flight crew immediately donned their oxygen masks and enacted the smoke checklist memory items. As the flight crew fitted the oxygen masks, they detected a strong electrical type burning odour and observed faint wispy smoke within the cockpit. After conducting the memory items, the flight crew then completed the electrical smoke checklist. The checklist included selecting the avionics vent exhaust mode to overboard. After completing this selection, the flight crew reported the smoke quickly dissipated. Flight data shows the electrical smoke warning extinguished at 1454:56.
After completing the electrical smoke checklist, the captain identified Williamtown Airport about 65 km (35 NM) south-east of the aircraft and elected to divert the flight to Williamtown.
At 1455, the captain contacted air traffic control (ATC) and declared a MAYDAY.[3] The captain advised that they intended to divert to Williamtown Airport. ATC cleared the flight to descend and track directly to Williamtown.
After contacting ATC, the captain requested that the senior cabin crew (SCC) report to the aircraft interphone using the cabin public announcement system. The SCC heard the announcement, but due to muffling caused by the captain’s oxygen mask, they did not understand the request. The second cabin crewmember heard the announcement more clearly and communicated the request to the SCC. The SCC contacted the flight deck using the aircraft interphone. The captain advised them of the emergency and that the flight was diverting to Williamtown. The SCC advised the other cabin crewmember of the diversion and commenced securing the cabin.
After securing the cabin, the SCC returned to their seat and contacted the flight deck. The captain provided them with a full briefing, advising the nature of the emergency and to expect a precautionary disembarkation[4] after landing. Recognising the high workload of the flight crew, the SCC advised the captain that they would conduct the passenger briefing tasks on behalf of the flight crew. The captain instructed the SCC to begin the precautionary evacuation once the seat belt sign extinguished after landing.
As the aircraft descended through 10,000 ft, the flight crew removed their oxygen masks. The captain found the remaining odour very strong and elected to refit the oxygen mask. The captain identified that the aircraft was too high to commence an approach to Williamtown and conducted a descending orbit to lose height prior to commencing a visual approach for runway 12. While approaching runway 12, the captain found the oxygen mask blurred their vision. The captain briefly handed control of the aircraft to the first officer and removed the oxygen mask.
At 1512, the aircraft landed on runway 12. After landing, ATC instructed the flight crew to taxi the aircraft to Bay 11. Once the aircraft stopped and the flight crew shut the engines down and extinguished the seat belt sign, the SCC initiated the precautionary disembarkation. The SCC used the cabin public address system to direct passengers to disembark the aircraft using the cabin door. Emergency services personnel met the disembarking passengers and guided them clear of the aircraft to a safe area.
After shutting down the engines, the flight crew noticed the smell intensifying. The captain elected to immediately vacate the flight deck. The flight crew followed the last passenger and the cabin crew in vacating the aircraft through the cabin door.
The aircraft was not damaged, and no persons were injured during the incident.
Figure 1: Number one static inverter
Source: Operator
Captain comments
The captain provided the following comments:
Time was lost due to difficulties with the first officer refitting their headset after donning the oxygen mask. The oxygen mask also created difficulties in communication between the flight crew and cabin crew. Managing these communication difficulties added to the flight crew workload during the emergency.
While the company did not operate the ATR 72 to Williamtown and the captain had not previously operated there, the captain commented that the best place for an aircraft with smoke in the cockpit is on the ground. The long runway, available emergency services and clear weather between their position and the airport enabled the captain to quickly elect to divert to Williamtown.
Senior cabin crew member comments
The senior cabin crew (SCC) provided the following comments:
They had not expected and were not prepared for the communications difficulties caused by the flight crew’s use of oxygen masks. Their voices were heavily distorted which led to difficulty in understanding information. After the initial briefing from the captain, the SCC did not realise there was a smoke issue and believed the aircraft was experiencing an unspecified ‘leak’. After the initial briefing, they began to prepare the cabin for a possible depressurisation.
Due to the communications difficulties caused by the flight crew oxygen masks, the SCC did not realise that they were being requested to contact the flight crew and did not immediately respond.
The aircraft interphone does not allow the flight deck to address all cabin crew at the same time. Therefore, the SCC was required to relay information to the other cabin crewmember. This made it difficult for the other cabin crewmembers to be fully aware of the progress of the incident and increased the SCC’s workload.
Cabin preparation procedures for the precautionary disembarkation require that the SCC use designated Cabin Preparation cards. These cards provide guidance for full and reduced cabin preparation procedures and associated passenger briefings. The cards were located under the SCC’s seat and were inaccessible while seated. As the SCC was unable to leave their seat during the period between receiving the full briefing from the captain and landing, they were unable to access these cards.
Engineering examination
The manufacturer of the static inverter conducted an engineering investigation of the failed static inverter. The investigation found that the failure of the number one static inverter and associated smoke and odour was caused by a failure of a C60x series capacitor within the number one static inverter.
The aircraft manufacturer also noted that the operator experienced two previous static inverter failures in November and December 2016. These failures were also caused by failure of a C60x series capacitor.
Vendor Service Bulletin
On 22 June 2016, the manufacturer of the static inverter released vendor service bulletin SB 1002-0102-2173-24-36.
This service bulletin identified an issue with capacitor C311 which led to instances of reduced reliability and premature failure, sometimes with associated smoke emission. As part of this service bulletin, the C311 capacitor is replaced with a modified capacitor of increased reliability.
The service bulletin recommended that the modification be incorporated at the next shop visit for the static inverter units. After completion of the service bulletin modifications the static inverters are designated as ‘Amendment E’ status.
From October 2016, a retrofit campaign was undertaken by the static inverter manufacturer to refit all in-service static inverters to ‘Amendment E’ standard.
In December 2016, the aircraft manufacturer advised operators of the vendor service bulletin. The bulletin was classified as a minor change and did not imply safety concerns.
Continued static inverter issues
Following reports of failures of ‘Amendment E’ static inverters, the aircraft manufacturer identified an issue with additional capacitors within the static inverter. These capacitors are of the C60x (C601 through C605) series. Failures of these capacitors also led to failure of the static inverter unit and associated smoke emission.
Static inverter failure
In the event of failure of a static inverter, the power transfer function automatically transfers power of the associated electrical systems to the second static inverter.
The operator’s Minimum Equipment List allows dispatch of an aircraft with an unserviceable static inverter for a period of up to two days.
Safety analysis
A C60x series capacitor within the number one static inverter failed in a manner consistent with other C60x series capacitor failures. Failure of the capacitor resulted in failure of the static inverter and smoke being emitted into the cockpit.
Difficulties in communication with the flight deck led the SCC to initially believe the flight crew were managing an unspecified ‘leak’. Therefore, the SCC began preparing for a possible depressurisation. However, as the required actions were similar to those required for the smoke event in progress, the misunderstanding did not impact on the management of the cabin during the incident.
The Cabin Preparation cards were inaccessible during the period that procedures directed the SCC to use them. However, as the SCC was able to complete the required actions without reference to the cards this did not impact on their ability to prepare the cabin for landing and the precautionary disembarkation.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
A C60x series capacitor within the number one static inverter failed leading to failure of the static inverter and associated smoke.
Difficulties in communication caused by oxygen mask use led to misunderstandings between the flight crew and cabin crew and increased flight crew workload.
The Cabin Preparation cards were inaccessible to a seated cabin crewmember.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
Verifying the integrity of the Power Transfer function across the ATR fleet. The operator advised that after completing this campaign no adverse findings were reported.
The operator has initiated a retrofit campaign to route all in-service static inverters to the vendor to have the modification to both the C311A and the C60x capacitors completed (‘Amendment E’ and ‘Amendment F’ (see Aircraft manufacturer) standard).
The operator has initiated a fleet wide inspection and operational test of the oxygen mask integrated microphone.
The operator has undertaken a risk assessment for single and dual static inverter failure.
Aircraft manufacturer
As a result of this occurrence, the aircraft manufacturer has advised the ATSB that they are taking the following safety actions:
Short term actions:
Replacement of C311 capacitor resulting in service units being modified to Amendment E standard. New production units have been modified and the retrofit process is on-going.
Change in the manufacturing process with ‘burn in’ test on C60x capacitors resulting in units being modified to ‘Amendment F’ standard. New production units have been modified. The retrofit process is being prepared.
Mid-term actions:
A design change is under development including the replacement of the C60x capacitors. The redesigned unit will be identified with a new part number. The design change certification expected to be complete before the end of quarter 2, 2017.
Safety message
This incident underlines the value of effective training and procedures. Despite the communications difficulties and the inaccessible cabin preparation cards, the cabin crew were able to effectively prepare the cabin during the diversion and manage the subsequent precautionary disembarkation. This enabled all aircraft occupants to disembark the aircraft quickly and without injury.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 22 February 2017, a Singapore Airlines Boeing 777-212, registered 9V-SRP, operated scheduled flight SQ291 from Singapore Changi Airport, Singapore, to Canberra Airport, Australian Capital Territory (ACT). There were 13 crew and 235 passengers on board. The instrument landing system (ILS) for runway 35 at Canberra was out of service at the expected arrival time.
Prior to descent to Canberra Airport, the flight crew reviewed the weather conditions for Canberra. Canberra weather observations indicated that the visibility was greater than 10 km and wind conditions favoured runway 35 to be used for landing. As the runway 35 ILS was not available, the flight crew prepared to conduct the Standard Arrival Route (STAR)[1] POLLI FOUR PAPA arrival (Figure 1 left) and associated RNAV-Z[2] approach[3] (Figure 2) for runway 35. As the aircraft was arriving from the west, the flight crew elected to commence the RNAV-Z approach from waypoint[4] SCBSG. The captain, acting as pilot monitoring,[5] entered the arrival and approach into the aircraft’s flight management computer (FMC).
As the aircraft descended, air traffic control (ATC) instructed the flight crew to conduct the POLLI FOUR BRAVO arrival (Figure 1 right).
The flight crew had not briefed for this arrival and the first officer, who was pilot flying, identified that the POLLI FOUR BRAVO arrival led to the runway 35 VOR approach.[6] As the POLLI FOUR PAPA and POLLI FOUR BRAVO arrivals were very similar, the flight crew elected to reprogram the POLLI FOUR BRAVO arrival into the FMC while keeping the RNAV-Z approach. The flight crew intended to request the RNAV-Z approach from ATC upon first contact with the Approach controller. As the POLLI FOUR BRAVO arrival did not lead to the RNAV-Z approach, this created a discontinuity[7] in the programmed FMC flight path between the completion of the arrival at waypoint MENZI and the commencement of the approach. To correct this discontinuity, the first officer asked the captain to connect waypoint MENZI to the approach at waypoint SCBSI. In doing so, the waypoint SCBSG was erased from the programmed FMC approach.
Figure 1: POLLI FOUR PAPA (left) and POLLI FOUR BRAVO (right) arrivals
Source: Operator (annotated by ATSB)
At 0905 Eastern Daylight-saving Time (EDT), the aircraft was about 70 km (38 NM) southwest of Canberra at flight level (FL) 120,[8] with the autopilot engaged. ATC instructed the flight crew to contact the Approach controller. After establishing contact with the flight crew, the Approach controller instructed the flight to continue descending to 9,000 ft above mean sea level (AMSL). The controller advised the flight crew to expect the VOR approach to runway 35.
After the flight crew were advised to expect the VOR approach, they immediately requested the RNAV-Z approach. ATC instructed the flight crew to track to the commencement of the RNAV-Z approach at SCBSG and to expect the RNAV-Z approach. Due to high terrain to the south and southwest of Canberra, the RNAV-Z approach via SCBSG must be commenced from an altitude at or above the minimum sector altitude (MSA) of 7,500 ft. This altitude constraint is included in the FMC programmed flight path when selecting an approach using the arrivals/departures page in the FMC.[9]
Figure 2: RNAV-Z Approach
Source: Operator (annotated by ATSB)
After the controller advised the flight crew to expect the RNAV-Z approach, the captain manually re-entered SCBSG into the FMC without detecting that the 7,500 ft MSA constraint was now missing. The captain then manually connected SCBSG to SCBSI for the continuation of the approach.
At 0908, ATC cleared the flight for the RNAV-Z approach. After receiving clearance to conduct the RNAV-Z approach, the first officer entered the final approach fix crossing altitude of 3,900 ft[10] into the autopilot altitude selector. This directed the autopilot to continue descent to 3,900 ft.[11]
At 0909.16 in visual conditions, the aircraft tracked towards SCBSG. About 7.5 NM (13.9 km) prior to SCBSG, the aircraft descended below 7,500 ft (Figure 3). At 0909.37, as the aircraft descended to about 7,000 ft, the controller contacted the flight crew and advised that they were required to maintain 7,500 ft until SCBSG. The flight crew immediately disconnected the autopilot and climbed the aircraft to 7,500 ft. After climbing to 7,500 ft, the first officer reconnected the autopilot with 7,500 ft as the selected altitude.
At 0911:24, after the aircraft passed SCBSG, the first officer selected the final approach fix crossing altitude of 3,900 ft in the autopilot altitude selector and the aircraft commenced descending. The segment minimum safe altitude (SMSA)[12] for the leg of the approach from SCBSG to SCBSI was 5,300 ft.
As the aircraft descended through about 6,000 ft, and before they had passed SCBSI, the first officer sighted the runway. The first officer advised the captain that they wished to manually fly the aircraft and conduct a visual approach to runway 35. The captain agreed and the first officer disconnected the autopilot and commenced a manual visual approach. The flight crew did not advise ATC that they were visual and had sighted the runway, or that they had elected to conduct a visual approach.
At 0912.37, about 2.1 NM (3.9 km) prior to passing SCBSI on the segment between SCBSG and SCBSI, the aircraft descended below 5,300 ft. As the aircraft descended to about 4,600 ft the captain commented that the aircraft approach profile was becoming low. At the same time, the controller contacted the flight crew and advised them that the aircraft was below the SMSA and that they were required to maintain 5,300 ft until passing SCBSI. The first officer immediately levelled the aircraft at about 4,600 ft. The flight crew advised the controller that they had the runway and terrain in sight. The controller then cleared the flight to conduct a visual approach. After being cleared for a visual approach, the first officer commenced a climb to about 5,000 ft and re-established the aircraft on the desired approach profile.
At 0917, the aircraft landed on runway 35. The aircraft was not damaged, and no persons were injured.
Figure 3: Arrival and approach profile
Source: ATSB, derived from Airservices Australia radar data
Captain comments
The captain of 9V-SRP provided the following comments:
The runway 35 ILS was not available, therefore the RNAV-Z approach was selected as this approach provided the lowest available minimum descent altitude (MDA).[13] The captain did not expect to receive, and had not prepared, for the POLLI FOUR BRAVO arrival and associated VOR approach.
After receiving the POLLI FOUR BRAVO arrival, the captain elected to delay requesting the RNAV-Z approach until in contact with the Approach controller. The captain was not sure how the clearances were coordinated between different ATC units in Australia and believed it would be simpler to request the approach directly from the Approach controller.
As the POLLI FOUR BRAVO arrival tracked via MENZI, this presented a smooth transition to the RNAV-Z approach at SCBSI. The captain did not expect ATC to instruct the flight crew to track via SCBSG as this required a left turn from their position to SCBSG, then a right turn to SCBSI, then another left turn onto final approach.
The waypoint SCBSG should have been added to the FMC programmed flight path by selecting the SCBSG transition using the arrivals/departures page of the FMC. This would have ensured the SCBSG 7,500 ft altitude constraint remained programmed into the FMC.
ATC should have been advised when they became visual and elected to conduct a visual approach.
At the time the first officer commenced the visual approach, the runway 35 T-VASIS[14] was not visible.
During the visual approach, the flight crew used runway visual perspective and attitude along with a check of expected altitudes at specified distances from the runway to assess the approach profile.
Operator report
The operator conducted an investigation into the incident which identified the following points:
The flight crew fixated on flying the RNAV-Z approach as the crew had briefed and planned for this approach. The approach briefing did not include reversion to conventional navigation.
Standard operating procedures direct the flight crew to advise ATC when the flight crew have established visual conditions and are flying a visual approach.
The company operations manual states that flight crew must check FMC waypoints against the arrival chart, the navigation display map and the control display unit. This check shall include the verification of any altitude and speed constraints.
The flight crew training manual directs flight crew to avoid making manual entries when an approach or transition is available in the FMC, to prevent input errors or omissions.
Any transition to a visual approach should only be made when the appropriate cues to ascertain vertical profile such as T-VASIS are clearly visible.
Related occurrences
A number of ATSB investigations have examined occurrences relating to deviations in flight path involving foreign crew operating within Australia. Of these, three are summarised below.
At 2019 at night on 24 July 2011, a Boeing Company 777-3D7 aircraft, operated by Thai Airways, was conducting a runway 34 VOR approach to Melbourne Airport, Victoria. During the approach, the tower controller observed that the aircraft was lower than required and asked the flight crew to check their altitude. The tower controller subsequently instructed the crew to conduct a go-around. However, while the crew did arrest the aircraft’s descent, there was a delay of about 50 seconds before they initiated the go-around and commenced a climb to the required altitude.
The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’ when the aircraft pitched up to capture the VOR approach path. As a result, the remainder of the approach was conducted using the autopilot’s flight level change mode. In that mode the aircraft’s rate of descent is unrestricted and therefore may be significantly higher than that required for an instrument approach. In addition, the flight crew inadvertently selected a lower than stipulated descent altitude, resulting in descent below the specified segment minimum safe altitude for that stage of the approach and the approach not being managed in accordance with the prescribed procedure.
On 4 and 29 May 2010, an Airbus A330-343E aircraft, was being operated by AirAsia X to the Gold Coast, Queensland. On both occasions, there was low cloud and reduced visibility on arrival at the Gold Coast.
During VOR approaches conducted at Gold Coast Airport on both days, the flight crews descended the aircraft below the segment minimum safe altitudes. As a result, the aircraft descended to an altitude where there was no longer separation assurance from terrain and aircraft operating outside controlled airspace.
On 17 December 2008, a Boeing Company 737-4MO aircraft, operated by Garuda Indonesia, made a significant diversion around weather at night while en route to Darwin, Northern Territory. The aircraft was cleared to conduct the runway 11 VOR approach via the initial approach fix NASUX. After the weather diversion, it was more convenient for the flight crew to make a pilot intercept of the 285 radial from the VOR but there was a period of misunderstanding as a result of a breakdown in the application of standard radiotelephony readbacks.
The flight crew left the previously cleared altitude of 3,000 ft on descent although they had not been cleared to do so. When this became apparent, no updated clearance for a pilot intercept of the 285 radial was issued by the controller. The aircraft continued to descend on the basis of the runway 11 VOR descent profile, even though it was not conducting the runway 11 VOR approach.
The flight crew used the position calculated by the aircraft's inertial reference system (IRS) to intercept the 285 radial, instead of using the signal from the VOR. The IRS position was not accurate enough for this, and the aircraft tracked to outside of the stipulated 5 degrees tolerance either side of the 285 radial. From then on, the aircraft was no longer 'established' on the 285 radial even though it was below the minimum sector altitude in cloud. When it broke through the cloud, the aircraft was clearly not aligned with the runway and a missed approach was carried out.
ATSB comment
Over recent years, the number of active VORs has reduced as part of the Airservices Australia Navigation Rationalisation Project. Global navigation satellite system (GPS) is now the primary means of navigation for instrument flight rules aircraft, including RNAV approaches where an ILS is not available.
Internationally, the prevalence of VOR approaches is even further reduced. This reduces the exposure of international flight crew to VOR approaches and therefore reduces the familiarity of international flight crew with the conduct of a VOR approach.
This incident, along with the previous occurrences identified above, highlight the importance of familiarity with this approach type. However, this familiarity may be reduced for foreign flight crews operating into Australia.
The air traffic services provider in Australia, Airservices Australia, advised that all of the runway connected STARs have been removed from the VOR approaches at Melbourne, Adelaide and all but one at Perth to discourage their use. While the VOR approaches are still available on request, flight crews are assigned only instrument approach procedures that are connected to STARs.
Safety analysis
The flight crew planned to conduct the POLLI FOUR PAPA arrival and RNAV-Z approach. When ATC issued instructions for the POLLI FOUR BRAVO arrival and VOR approach, the flight crew accepted the POLLI FOUR BRAVO arrival while preparing to conduct the RNAV-Z approach, instead of the associated VOR approach. This led to a discontinuity in the programmed flight path between the arrival and approach. The flight crew did not select the entry to the approach in the FMC and manually entering the waypoint SCBSG. As the waypoint was manually entered, the 7,500 ft altitude constraint was not included into the FMC programmed flight path. This missing altitude constraint was not detected by the flight crew.
The flight crew entered the altitude of 3,900 ft into the autopilot altitude selector prior to commencing the approach. With the autopilot engaged, the aircraft descended through 7,500 ft prior to commencing the approach at SCBSG. The flight crew did not detect that the aircraft had descended through the 7,500 ft MSA. The approach controller identified the error and alerted the flight crew.
Once established visual with the runway, the flight crew elected to conduct a manually flown visual approach without advising ATC and did not receive a clearance to discontinue the RNAV-Z and conduct a visual approach. The aircraft then descended below the standard profile which led to the aircraft descending below the 5,300 ft SMSA prior to passing SCBSI.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The captain manually entered the waypoint SCBSG into the FMC instead of selecting the RNAV-Z approach via waypoint SCBSG. This removed the 7,500 ft altitude constraint.
The crew did not identify the aircraft had descended below the 7,500 ft minimum sector altitude prior to passing SCBSG.
Prior to passing SCBSI, the flight crew elected to conduct a visual approach without advising air traffic control, the flight crew then descended the aircraft below the 5,300 ft segment minimum safe altitude.
The aircraft was in visual conditions at all times.
Safety message
This incident highlights the importance of preparation and communication prior to commencing a phase of flight. Requesting a preferred clearance early allows ATC to ensure that a clearance can be provided, or if not available, allows the flight crew time to prepare for a different clearance.
The Australian air traffic control provider, Airservices Australia, document: Standard Instrument Arrival Routes (STARS) provides further information to assist flight crew in adhering to clearances when conducting arrivals and approaches.
This incident also underlines the importance of adhering to standard operating procedures (SOPs). By deviating from SOPs and manually entering the waypoint, the crew removed a protection which was in place to prevent data input errors.
The ATSB has identified numerous accidents worldwide that were the result of simple human errors in data calculation or entry.
Data input errors-such as the wrong figure being used as well as data being entered incorrectly, not being updated, or being excluded-happen for many different reasons.
The consequences of these errors can range from rejected take-offs through to collisions with the ground. Errors can occur irrespective of pilot experience, operator, aircraft type, location and take-off performance calculation method.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 12 February 2017, a Boeing 747-47UF (freighter) aircraft, registered N416MC, operating from Honolulu, Hawaii, conducted an approach to Sydney Airport, New South Wales. On board the aircraft were two flight crew. The captain was the pilot monitoring (PM) and the first officer was the pilot flying (PF).[1]
The aircraft was cleared by the approach controller for the runway 16R instrument landing system (ILS) approach.[2] The autopilot was engaged[3] and the modes for localiser and approach (glideslope) were armed[4] while the aircraft was flown at 2,200 ft on a heading of 200° to intercept the 16R ILS. The aircraft captured[5] the localiser and the PF turned it left onto the 16R final approach course, while maintaining 2,200 ft, in order to intercept the glideslope from below.
Shortly after the turn onto the final approach, the PF called ‘glideslope captured’ and the aircraft started to descend. However, the PM’s primary flight display[6] was still showing the aircraft below the glideslope. The PM crosschecked the PF’s display and noticed the glideslope was captured, then checked their own display and noticed there was a failure flag displayed for the glideslope. The PM again crosschecked the PF’s display, noticed there was a failure flag for the PF’s glideslope, and instructed the PF to disconnect the autopilot and stop the descent.
As the aircraft descended through 2,100 ft, the approach controller requested confirmation that they were established on the glideslope. The PM responded that they had an interruption on glideslope and would maintain altitude until they could re-intercept. During the response, a minimum safe altitude warning (MSAW) alert appeared on the approach controller’s radar for N416MC at an altitude of 1,800 ft. The approach controller immediately issued the instruction ‘go-around, you are well below the glide-path, go-around’. The PM immediately acknowledged the instruction, and the flight crew initiated the missed approach procedure.
The lowest point on the approach was 1,559 ft from flight data (1,600 ft on radar) at about 8.0 NM (14.8 km) from runway 16R (Figure 1). This resulted in the aircraft descending about 1,000 ft below the nominal 3° glideslope at the time of the incident. The aircraft was flown on the second approach with autopilot engaged. The localiser and glideslope captured and tracked the ILS with no anomalies detected.
Figure 1: Minimum safe altitude warning for N416MC
Source: Airservices, annotated by the ATSB
ILS signal interference
Disturbances to ILS localiser and glideslope courses are caused by fixed structures, such as buildings (static distortion), and moving vehicles or aircraft (dynamic distortion). The total ILS course distortion is determined by the root square summation of static and dynamic distortion, and this is used to define critical areas[7] near each localiser and glideslope antenna (Figure 2).
Figure 2: Runway 16R glideslope antenna and critical area hold point
Source: Google earth, annotated by the ATSB
The critical areas are protected for low visibility approaches. This is when the cloud ceiling is at or below 600 ft, or the visibility is 2000 m or less. In which case, no aircraft or vehicle is permitted to enter the critical areas when an arriving aircraft is within the outer marker, or 4 NM from the threshold if there is no outer marker.
At the time N416MC intercepted the runway 16R localiser, a Boeing 787 was holding on taxiway A1, within the runway 16R glideslope critical area (Figure 3). However, the weather conditions did not require air traffic control to activate the ILS critical area, and N416MC was instructed to go‑around before reaching the outer marker.[8]
Figure 3: Infringement of the 16R glideslope critical area
Source: Airservices, annotated by the ATSB
Receiver characteristics
A moving receiver passing through a distorted ILS signal will produce a guidance error. The error produced will vary depending on the receiver characteristics, its antenna characteristics and the speed of the vehicle carrying the receiver as it passes through the distorted signal.
Similar incidents
Glideslope signal disturbances
On 17 March 2017, a Boeing 747-400 attempted to intercept the runway 16R ILS in instrument meteorological conditions using the autopilot for a coupled approach.[9] When the glideslope was captured, the indications began to oscillate, and the autopilot chased the indications. A high rate of descent developed and a ‘low on profile’ call was made on the flight deck to stop the descent. The descent was stopped at about 1,500 ft, about 7 NM (13 km) from the threshold of runway 16R. An Airbus A380 was lined up for departure on runway 16R from taxiway A1 when the Boeing 747 was about 8 NM (14.8 km) from the threshold of runway 16R.
On 23 March 2017, a Boeing 747-400 attempted to intercept the runway 16R ILS in instrument meteorological conditions using the autopilot for a coupled approach. Approaching 2,000 ft, the glideslope on the captain’s primary flight display disappeared, followed by the glideslope on the first officer’s primary flight display. The aircraft pitched nose down with an associated increased rate of descent. The captain disengaged the autopilot and stopped the descent at about 1,500 ft and 8 NM (14.8 km) on final for 16R. A minimum safety altitude alert activated, and the approach controller instructed the flight crew to conduct a missed approach. An Airbus A380 was holding on taxiway A1 at the time of the incident. A second approach was flown using the autopilot without incident. There were no aircraft in the glideslope critical area during the second approach.
Localiser signal disturbance
On 27 August 2015, a Boeing 787-800 attempted to conduct an autoland[10] to runway 34L at Sydney Airport in visual meteorological conditions. The aircraft experienced a disturbance to the localiser signal at about 100 ft and the flight crew immediately disconnected the autopilot to complete the landing. The flight crew were aware the ILS critical area was not required to be protected at the time and had not notified air traffic control they were conducting an autoland. They were aware that disturbances to the ILS signals were possible and were prepared to intervene. An Airbus A330 departed directly in front of the 34L localiser antenna at the time of the incident.
Manufacturer comments
Boeing, the aircraft manufacturer, reported that they have no reason to believe that the 747 would behave any differently to their other aircraft types. The same antenna system is installed on the 757, 767 and 777. However, there are some differences in the antenna locations. The 747 and 777 receiver antennas are located on the main landing gear doors, while the 757 and 767 antennas are located in the nose of the aircraft. The glideslope incidents might relate to a varying signal strength, rather than a distorted beam.
Aeronautical Information Publication
If a pilot advises air traffic control that an ‘autoland’ or ‘coupled approach’ is to be flown, then air traffic control will either report ‘ILS critical area not protected’ or ‘LVP[11] in force’ if the critical area is protected.[12]
Airservices Australia comments
Airservices Australia, the air traffic services provider, reported that disturbance of the glideslope signal is less for aircraft at the taxiway A holding point (holding point for glideslope critical area) than it is for the same aircraft at the holding point on taxiway A1. Airservices Australia conducted a computer simulation which indicated that an Airbus A380 aircraft stationary at holding point A1 is unlikely to have caused the large ILS signal disturbance observed in this incident.
The simulations and radar recordings indicated the observed disturbance in each case occurred after the holding aircraft was provided with its line up clearance and while taxiing between the holding point and the runway. In this respect, there will always be significant interference to approaching aircraft outside 4 NM regardless of whether the holding point on taxiway A or A1 is used at the same time as runway 16R is used for arrivals.
Safety analysis
N416MC intercepted the final approach, and the autopilot captured the ILS localiser and glideslope at the same time as a Boeing 787 (B787) was holding on taxiway A1, which lies within the critical area for the runway 16R glideslope. The presence of the 787 in the critical area likely resulted in N416MC receiving either a distorted glideslope beam or a beam of varying signal strength. This required flight crew intervention following a glideslope failure indication, which was detected by the captain crosschecking the two primary flight displays. At the time of the incident, the glideslope critical area was not required to be protected, in accordance with the manual of air traffic services.
ATSB comment
It has been previously noted by regulators and manufacturers, that it is common practice for operators to conduct coupled approaches and autoland to satisfy maintenance, training or reliability program requirements. These approaches may be conducted in weather conditions which do not require protection of the ILS signal. There have been incidents reported in which the autopilot has responded to disturbances in the ILS signal when the aircraft was close to landing. Airservices Australia advise that ILS signals may be disturbed with the consequential effect on autoland performance when weather conditions do not require protection of the ILS critical area.
For more information on ILS signal distortion and determination of protected areas following the introduction of the Airbus A380 see Assessment of ILS protection areas impact on large aircraft operations.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The descent below the nominal 3° approach glideslope was probably the result of the aircraft auto-pilot capturing a distorted glideslope beam.
The glideslope beam was probably distorted due to the presence of a Boeing 787 in the glideslope critical area, which was not required to be protected in the weather conditions which prevailed at the time of the incident.
Safety message
This incident highlights the importance of crosschecks on the flight deck and between air traffic control and the flight crew. After detecting unexpected indications on the flight deck, the flight crew intervened to stop the descent, which was then followed by an instruction from air traffic control to initiate a go-around.
The aircraft manufacturer and regulators have recommended that flight crew remain vigilant for ILS disturbances with resulting unexpected flight control movements and be prepared to immediately disconnect the autopilot, particularly during autoland operations.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 21 February 2017, the pilot of a Beechcraft B200 King Air aircraft, registered VH-ZCR was conducting a charter passenger flight from Essendon Airport, Victoria to King Island, Tasmania with four passengers on board.
The aircraft’s take-off roll was longer than expected and a yaw to the left was observed after rotation. The aircraft’s track began diverging to the left of the runway centreline before rotation and the divergence increased as the flight progressed. The aircraft entered a shallow climb followed by a substantial left sideslip with minimal roll. The aircraft then began to descend and the pilot transmitted a Mayday call. The aircraft subsequently collided with a building in the Bulla Road Precinct Retail Outlet Centre of Essendon Airport.
The aircraft was destroyed by the impact and post-impact fire, and all on board were fatally injured. The building was severely damaged and two people on the ground received minor injuries.
What the ATSB found
The ATSB found that the pilot did not detect that the aircraft’s rudder trim was in the full nose-left position prior to take-off. The position of the rudder trim resulted in a loss of directional control and had a significant impact on the aircraft’s climb performance in the latter part of the flight.
At the time of the accident, the operator did not have an appropriate flight check system in place for VH-ZCR. Although this did not contribute to this accident, it increased the risk of incorrect checklists being used, incorrect application of the aircraft's checklists, and checks related to supplemental equipment not being performed.
The aircraft’s cockpit voice recorder did not record the accident flight due to a tripped ‘impact switch’, which was not reset prior to the accident flight. This deprived the investigation of potentially valuable recorded information.
The ATSB determined that the aircraft was operated above its maximum take-off weight on the accident flight. This was not considered to have influenced the accident.
The ATSB also found that the presence of the building struck by the aircraft did not increase the severity of the consequences of this accident. In the absence of that building, the aircraft’s flight path would probably have resulted in an uncontrolled collision with a busy freeway, with the potential for increased ground casualties.
Although not contributing to this accident, the ATSB identified that two other buildings within the retail precinct exceeded the airport’s obstacle limitation surfaces. While those exceedances had been approved by the Civil Aviation Safety Authority, the ATSB identified several issues relating to the building approval process for the precinct.
What's been done as a result
It is beyond the scope of this investigation to consider in detail the issues identified with the Bulla Road Precinct building approval processes. These issues will be addressed in the current ATSB Safety Issues investigation The approval process for the Bulla Road Precinct Retail Outlet CentreAI-2018-010.
Safety message
Cockpit checklists are an essential tool for overcoming limitations with pilot memory, and ensuring that action items are completed in sequence and without omission. The improper or non-use of checklists has been cited as a factor in some aircraft accidents. Research has shown that this may occur for varying reasons and that experienced pilots are not immune to checklist errors. This accident highlights the critical importance of appropriately actioning and completing checklists.
This accident also emphasises the importance of having flight check systems in place that are applicable to specific aircraft in their current modification status. In addition, it emphasises:
the value of cockpit voice recorders
the significance of ensuring aircraft weight and balance limitations are not exceeded
the challenges associated with decision-making in critical stages of a flight such as the take-off ground roll.
Beechcraft B200 King Air aircraft, registered VH-ZCR immediately prior to collision with a building in the Bulla Road Precinct
Source: Supplied
Summary video
The occurrence
On 21 February 2017, the pilot of a Beechcraft B200 King Air aircraft, registered VH-ZCR (ZCR), and operated by Corporate & Leisure Aviation, was conducting a charter passenger flight from Essendon Airport,[1] Victoria to King Island, Tasmania. There were four passengers on board.
ZCR had been removed from a hangar and parked on the apron the previous afternoon in preparation for the flight (Figure 1). The pilot was first seen on the apron at about 0706 Eastern Daylight-saving Time.[2] Closed-circuit television (CCTV)[3] recorded the pilot walking around the aircraft and entering the cabin, consistent with conducting a pre-flight inspection of the aircraft.
Figure 1: Aircraft taxi and flight track from Airservices Australia ADS-B data
Source: Google, annotated by the ATSB
At about 0712, the pilot entered ZCR’s maintenance provider’s hangar. A member of staff working in the hangar reported that the pilot had a conversation with him that was unrelated to the accident flight. The pilot exited the hangar about 0715 and had a conversation with another member of staff who reported that their conversation was also unrelated to the accident flight.
The pilot then returned to ZCR, and over the next 4 minutes he was observed walking around the aircraft. The pilot went into the cabin and re-appeared with an undistinguishable item. The pilot then walked around the aircraft one more time before re-entering the cabin and closing the air stair cabin door. At about 0729, the right engine was started and, shortly after, the left engine was started.
Airservices Australia (Airservices) audio recordings indicated that, at 0736, the pilot requested a clearance from Essendon air traffic control (ATC) to reposition ZCR to the southern end of the passenger terminal. ATC provided the clearance and the pilot commenced taxiing to the terminal.
At the terminal, ZCR was refueled and the pilot was observed on CCTV to walk around the aircraft, stopping at the left and right engines[4] before entering the cabin. The pilot was then observed to leave the aircraft and wait for the passengers at the terminal. The passengers arrived at the terminal at 0841 and were escorted by the pilot directly to the aircraft. At 0849, the left engine was started and, shortly after, the right engine was started.
At 0853, the pilot requested a taxi clearance for King Island, with five persons onboard, under the instrument flight rules.[5] ATC instructed the pilot to taxi to holding point 'TANGO' for runway 17,[6] and provided an airways clearance for the aircraft to King Island with a visual departure. The pilot read back the clearance.
Airservices Automatic Dependent Surveillance Broadcast (ADS-B)[7] data[8] (refer to section titled Air traffic services information - AutomaticDependent Surveillance Broadcast data) indicated that, at 0854, ZCR was taxied from the terminal directly to the holding point. The aircraft did not enter the designated engine run-up bay positioned near holding point TANGO. At 0855, while holding at TANGO, the pilot requested a transponder code. The controller replied that he did not have one to issue yet. Two minutes later the pilot contacted ATC and stated that he was ready and waiting for a transponder code. The controller responded with the transponder code and a clearance to line-up on runway 17. At 0858, ATC cleared ZCR for take-off on runway 17 with departure instructions to turn right onto a heading of 200°. The pilot read back the instruction and commenced the take-off roll.
The aircraft’s take-off roll along runway 17 was longer than expected. Witnesses familiar with the aircraft type observed a noticeable yaw[9] to the left after the aircraft became airborne. The aircraft entered a relatively shallow climb and the landing gear remained down. The shallow climb was followed by a substantial left sideslip[10], while maintaining a roll[11] attitude of less than 10° to the left. Airservices ADS-B data indicated the aircraft reached a maximum height of approximately 160 ft above ground level while tracking in an arc to the left of the runway centreline (Figure 1). The aircraft’s track began diverging to the left of the runway centreline before rotation and the divergence increased as the flight progressed.
Following the sustained left sideslip, the aircraft began to descend and at 0858:48 the pilot transmitted on the Essendon Tower frequency repeating the word ‘MAYDAY’[12] seven times in rapid succession. Approximately 10 seconds after the aircraft became airborne, and 2 seconds after the transmission was completed, the aircraft collided with the roof of a building in the Essendon Airport Bulla Road Precinct - Retail Outlet Centre (outlet centre), coming to rest in a loading area at the rear of the building.
CCTV footage from a camera positioned at the rear of the building showed the final part of the accident sequence with post-impact fire evident; about 2 minutes later, first responders arrived on-site. At about 0905 and 0908 respectively, Victoria Police and the Metropolitan Fire Brigade arrived.
The pilot and passengers were fatally injured, and the aircraft was destroyed. There was significant structural, fire and water damage to the building. Additionally, two people on the ground received minor injuries and a number of parked vehicles were damaged.
The pilot held a Commercial Pilot (Aeroplane) Licence, issued in September 1994, and attained his rating to operate the B200 aircraft in September 2004. He held a valid Class 1 Aviation Medical Certificate issued by the Civil Aviation Safety Authority (CASA) with a requirement to wear distance vision correction.
The pilot’s logbook showed a total flying experience of 7,681 hours to the last recorded flight on 18 February 2017. In the previous 90 days, the pilot had flown 66 hours and in the previous 30 days, he had flown 16 hours. He had a total of 73 hours in VH-ZCR (ZCR) and last flew the aircraft on 3 January 2017. Other records supplied by the operator indicated the pilot had accrued more than 2,400 hours in B200 aircraft.
Proficiency checks and flight reviews
The pilot had last completed a multi-engine flight review on 7 October 2016, valid to 31 October 2017 in ZCR. Records supplied by the operator also showed that the pilot had satisfactorily completed a Civil Aviation Order 20.11 emergency procedures proficiency check on 10 March 2016, valid until 9 March 2017.
The Civil Aviation Regulations 1988 regulation 224(A)(3)(d) stated that a pilot in command who was 65 years of age or older must successfully complete an instrument proficiency check (IPC) or flight review in an aircraft of the same category or an approved flight simulator for the category of aircraft, within 6 months before the date of a flight. The pilot, who was 67 years old at the time of the accident, last completed an IPC on 7 October 2016, about 4 months prior to the accident.
Following an incident[13] involving the pilot at Mount Hotham, Victoria on 3 September 2015, the pilot accepted CASA’s suggestion to undergo an IPC with a CASA flight operations inspector. That check flight was conducted on 19 October 2015. The pilot did not pass this IPC and it was recommended that the pilot conduct simulator training. There was no record in the pilot’s logbook to indicate that simulator training had been conducted, however, the pilot subsequently passed the IPC with the same CASA flight operations inspector on 3 November 2015.
CASA records stated that, other than the two IPC’s conducted with the CASA flight operations inspectors, the majority of the pilot’s flight tests and proficiency checks, including both instrument rating and Civil Aviation order 20.11 checks, were conducted by the same CASA Approved Testing Officer.
In response to the Mount Hotham incident, CASA compiled an audit report in January 2016. In that report, it was also commented that the pilot would benefit from ongoing training opportunities in a B200 simulator. The report indicated the simulator would have provided:
…an opportunity for non-jeopardy training in a variety of areas not possible in the aircraft. The use of a simulator assists in the development and maintenance of decision-making, situational awareness and practical skills, as well as exposing the pilot to real time scenarios and associated flight management practices.
The ATSB was unable to find any evidence to indicate that the pilot attended a B200 simulator after January 2016, however, CASA did not mandate that the pilot conduct the simulator training.
72-hour history
The pilot’s logbook showed the pilot conducted a flight from King Island to Essendon on 18 February 2017. He was reported to have then had two days away from flying duties. The pilot was also an air operator’s certificate (AOC) holder and, as such, was required to manage a business, including ensuring regulatory compliance. It is not known how much time the pilot spent managing his aircraft charter business during his two days away from flying duties.
The pilot was reported to normally go to bed between 2030 and 2100, or earlier if an early flight was scheduled for the next day. Evidence from Airservices indicated that the pilot’s National Aeronautical Information Processing System (NAIPS) user account was accessed at 2356 on the evening of 20 February 2017, to obtain aerodrome forecasts and Notice(s) to Airmen (NOTAM)[14] for Essendon, Victoria and King Island, Tasmania.
The same NAIPS account was accessed again on the morning of the accident, between 0456 and 0458, to obtain aerodrome forecasts and NOTAM for Essendon, King Island, Launceston, and Devonport, Tasmania. The pilot reportedly woke around this time, had breakfast and a beverage before leaving home for the drive to Essendon Airport. Traffic dependent, this drive was estimated to be between 1 hour 15 minutes and 2 hours.
On the above information, it was considered that the pilot had a sleep window of approximately 8 hours, but had a period of wakefulness during the night, when he briefly checked NAIPS. It is not known how long the period of wakefulness was and therefore not possible to assess the potential for it to have resulted in acute fatigue. Fatigue is a function of both sleep obtained and time awake however, and the pilot had been awake for about 4 hours at the time of the accident. That period of wakefulness is unlikely to have aggravated any feelings of fatigue associated with the previous night’s rest period.
The ATSB was also provided with varying accounts of factors that may have increased the pilot’s level of longer‑term fatigue, however, there was insufficient evidence to determine whether fatigue was a contributing factor to this accident.
Aircraft information
ZCR was a twin-engine turboprop aircraft with retractable landing gear, a pressurised cabin and a T-tail horizontal stabiliser (Figure 2). The aircraft was manufactured in the United States by the Raytheon Aircraft Company in 1996 and was issued with serial number BB-1544. At the time of the accident, Textron Aviation Inc. was the Type Certificate holder[15] for the aircraft. Textron Aviation Inc. branded the aircraft as a Beechcraft B200. The aircraft was imported into Australia and registered as ZCR on 9 October 2014.
After arriving in Australia, ZCR was reconfigured with a corporate-style interior and a passenger cabin seating capacity of seven. The aircraft was operated in the charter category. It had accumulated 6,997 flight hours prior to the accident flight.
Figure 2: Beechcraft B200 King Air, VH-ZCR
Source: Courtesy of FlightAware (flightaware.com)
Aircraft records
ZCR had a current Certificate of Registration and Airworthiness. The aircraft’s current maintenance release was destroyed in the accident. A copy of that maintenance release, at issue, was provided to the ATSB by ZCR’s maintainer. The maintenance release was due to expire on 16 December 2017 or upon 7,188 hours total time-in-service, whichever came first. The maintenance release also indicated that ZCR was equipped to be operated under the IFR and in the charter operational category.
Part 1 of the aircraft’s Logbook Statement specified the aircraft was to be maintained in accordance with aircraft manufacturer’s maintenance schedule and applicable Airworthiness Directives. A review of the maintenance documentation did not reveal any anomalies that may have contributed to the accident.
The following summarises the maintenance and activities conducted in ZCR leading up the accident:
16 December 2016 - major maintenance and rectifications were completed. A subsequent post-maintenance check flight was conducted with the accident pilot and a licenced aircraft maintenance engineer.
28 December 2016 - all the main landing gear tyres were replaced.
3 January 2017 - a flight was conducted by the accident pilot and a co-pilot. This was the last flight captured on the aircraft’s cockpit voice recorder.
12-13 January 2017 - the pilot who flew the aircraft reported experiencing a landing gear malfunction.
31 January 2017 - the landing gear power pack and the emergency locator transmitter battery were replaced. This was the last maintenance recorded in the aircraft’s records.
5 February 2017 - the aircraft operated for 6 hours without any reported defects and did not fly again until the accident flight on 21 February 2017.
20 February 2017 - the aircraft was towed out of a hangar adjacent to the maintenance provider and parked on the tarmac.
The ATSB did not identify any maintenance having been performed between 5 February and the accident flight on 21 February.
Operating speeds
The following information details the operating speeds and limitations applicable to ZCR (Table 1).
Table 1: Summary of operating speeds
Aircraft systems information
Flight control overview
The B200 aircraft is fitted with conventional flight controls connected to the aircraft’s primary flight control surfaces. The primary flight controls consist of the rudder, elevators and ailerons, which control the aircraft about the yaw, pitch and roll axes respectively (Figure 3).
The pilot controls an aircraft by manipulating the control wheel and rudder pedals, which deflect the ailerons, elevators and rudder. Deflection of an aircraft’s primary flight control surfaces changes the aerodynamic shape and therefore the amount of lift generated by the associated part of each wing, vertical stabiliser or horizontal stabiliser. These local variations in lift result in changes to the aircraft attitude and consequently flight path.
Any deflection of the primary flight control surfaces into the adjacent airflow produces aerodynamic forces on the surface and corresponding loads on the control wheel or rudder pedals. The magnitude of the aerodynamic force is principally related to the amount of flight control surface deflection, airspeed, and trim tab deflection.
On the B200 aircraft, adjustable trim tabs are attached to the trailing edge of the primary flight controls. These tabs are used to ‘trim’ or counteract the aerodynamic forces felt by the pilot on the control wheel or rudder pedals. During flight, deflection of an aircraft’s trim tab produces an aerodynamic force on the aft part of the associated primary surface. The tabs have the capacity, when adjusted in the opposite direction to the deflection of the primary surface, to modify the aerodynamic force on the surface and correspondingly, reduce the load felt by the pilot on the control wheel or rudder pedals. The effectiveness of a trim tab is principally related to the amount of deflection and the aircraft’s airspeed.
Figure 3: Position of the elevator, aileron and rudder trims on a B200 aircraft and the pitch, roll and yaw axes
Source: ATSB
Trim tab positions were adjusted on ZCR by rotating trim wheels, located on the centre pedestal (Figure 4). Moving the trim wheels transmitted rotary motion to screw jack actuators that positioned each tab. A position indicator for each trim tab was integrated with the respective trim control wheel.
Figure 4: Position of the elevator trim wheel, aileron trim wheel and rudder trim wheel on the centre pedestal of a B200 aircraft
Source: Australasian Jet Pty Ltd, annotated by the ATSB
Rudder trim
The rudder trim was manually controlled using a trim wheel located on the right side of the centre pedestal (Figure 5). Cables extend rearward from the wheel, through the airframe, to the rudder trim tab actuator. Rotating the wheel to the left moved the trim tab to the right, which in turn moved the rudder to the left, resulting in nose-left movement about the aircraft’s yaw axis. Rotating the wheel to the right results in yaw to the right. Operation of the rudder trim control showed that three turns through about 180 degrees were required in order to achieve full deflection either side of neutral.
Figure 5: Rudder trim indicator in the full nose-left, neutral and nose-right positions
Source: ATSB
Rudder boost system
The aircraft was fitted with a rudder boost system that aided the pilot in maintaining directional control in the event of an engine failure. Two pneumatic-boost servos were incorporated into the rudder system, which actuated the rudder control cables. This assisted the pilot by reducing the required rudder pedal force. The rudder boost system is controlled by a toggle switch on the centre pedestal, below the rudder trim wheel labelled RUDDER BOOST – OFF. The switch is to be turned on before flight.
Autopilot control
The aircraft was fitted with a three-axis autopilot and flight director system. The autopilot used a combination of sensors, electrical servos, guidance displays, mode selectors and flight control computers. These systems provide either full autopilot control of the aircraft, with simultaneous flight director monitoring or manual control in response to flight director steering commands.
The autopilot uses electric servos which are connected directly to the primary aileron, elevator and rudder control cables and to the elevator trim system. The autopilot is not connected to the aileron or rudder trim systems. The elevator trim system had an additional electric servo to control pitch trim independently of the autopilot utilising trim switches on the control wheel.
A component of the autopilot which affects aircraft yaw though the rudder system is called the yaw damper. The yaw damper can be operated independently to the rest of the autopilot system. Its function is to assist the pilot in maintaining directional control, and to increase passenger ride comfort. While the system could be used at any altitude and was required above flight level[16] 170, it should be deactivated for take-off and landing. The yaw damper is actuated through the rudder autopilot servo, which is connected directly to the rudder cables and has no connection to the rudder trim cables.
Flap system description
The aircraft had four flaps, one inboard, and one outboard per wing. The flaps are normally in the fully retracted position. They are extended to slow the aircraft and allow it to land at a lower airspeed. They can also be used to aid short field take-off performance in the APPROACH position. The flaps were operated using a sliding selector positioned on the centre pedestal. Flap travel was registered on an indicator above the pedestal, the indicator represents flap position in a percentage. There were three detents in the selector assembly that correspond with:
UP or 0%, representing fully retracted, 0⁰ of travel
APPROACH or 40%, representing 14⁰ of flap down travel
DOWN or 100%, representing full extension, 35⁰ of flap down travel.
The flaps cannot be stopped in-between any of the three positions. If an asymmetric flap condition is detected, power to the electric flap motor is disconnected.
Flight control locks
While parked, the flight and engine controls were mechanically locked by a U-shaped clamp and two pins (Figure 6). The pins lock the control wheel and rudder pedals and the U-shaped collar fits around the engine control levers to prevent movement when the lock is installed. The rudder pin locked the nose wheel steering in the neutral position, making normal ground manoeuvring impossible. The control wheel lock prevents movement of the elevators and ailerons making it unlikely the aircraft could be rotated on take-off. The control lock components were connected together by chain and were to be removed prior to towing the aircraft. The control lock mechanism shown below was consistent with the description of the lock used in ZCR.
Figure 6: Example of the control lock, fitted to a B200 aircraft
Source: Textron Aviation Inc., annotated by the ATSB
Engine controls
The B200 propulsion system is operated using three sets of controls located in the engine controls section of the centre pedestal (Figure 7):
Power levers control engine power from the idle position through to take-off power. When the power levers are lifted and pulled aft over a gate, they control propeller reverse thrust for slowing the aircraft after landing and for taxi operations.
Propeller levers control propeller revolutions per minute (RPM). The propellers can be feathered by moving the levers past detents and back to the full aft position.
Condition levers are used to select high or low idle and to shut the engines down.
Friction locks
Four friction locks were located on the engine control quadrant. One each for the left and right power levers, one for the propeller levers and one for the condition levers (Figure 7). When rotated in an anti-clockwise direction, the propulsion systems controls moved freely. When rotated in a clockwise direction, the levers progressively become resistant to movement, preventing the levers from moving out of position.
Figure 7: Engine control pedestal showing power levers, propeller levers, condition levers and friction locks
Source: Textron Aviation Inc., annotated by the ATSB
Power lever roll back (creep)
Throughout the investigation, the ATSB spoke with numerous B200 pilots who highlighted the importance of ensuring power lever frictions were adequately tightened prior to take-off. In their experience, if inadequate power lever friction was set, the power levers could ‘creep’ back from the full-power position when the pilot removed their hand from the levers after take-off.
If power lever movement is not noticed, the aircraft may not climb and accelerate normally, and rudder force may be required to keep the aircraft straight. In addition, the auto-feather system will be disarmed if either power lever moves back past the ‘90% engine’ speed position (refer to section titled Autofeather system below).
Autofeather system
ZCR was equipped with an auto feathering system, which provided a means for automatically feathering the propellers in the event of an engine failure. Feathering reduces drag by increasing the angle of the propeller blades until they are parallel with the aircraft’s line of flight.
Airport information
Essendon Airport is located about 8 km to the south-east of Melbourne Airport. It provided facilities and services for international and domestic corporate aircraft, aircraft maintenance, airfreight, and aircraft charter. It was also the base for emergency services fixed-wing aircraft and helicopters for police, air ambulance and firefighting aircraft operations.
It has two runways aligned 17/35 and 08/26 (Figure 8). Runway 17/35 was the runway-in-use at the time of the accident and was 1,504 m in length, with a 0.9 per cent slope down to the south. Runway 08/26 was 1,921 m in length. Three windsocks were positioned around the airport, one of which was located adjacent to the northern end of runway 17/35.
Airservices provided air traffic services to the flight crew of aircraft operating at Essendon and in the surrounding airspace. At the time of the accident, the pilot of ZCR was communicating with Essendon Tower.
The Airservices publication En Route Supplement Australia (the ERSA) indicated that a bird hazard existed at the airport. A helicopter pilot who had landed shortly before the accident could not recall observing any bird activity in the area. Similarly, a pilot positioned on the eastern side of runway 17/35, who observed ZCR take off, reported that he did not observe birds in the vicinity off the aircraft during take-off and climb.
Figure 8: Essendon Airport and the location of the ATC tower, windsocks, and proximity of the Bulla Road Precinct
ZCR collided with a building constructed on the south-eastern corner of Essendon Airport (Figure 8). This building was one of four, collectively known as the Bulla Road Precinct – Retail Outlet Centre (outlet centre), proposed by the airport lessee in 2003, approved by the Federal Government in 2004, and completed in 2005.
The ERSA, a component of the Aeronautical Information Publication, publishes information about an airport’s infrastructure and, in particular, runway data and airspace obstructions that may affect operations at the airport. The airport data for Essendon included seven obstacles that breached the airport’s obstacle limitation surfaces (OLS). Four of those obstacles infringed the runway 26 transitional surface component of the OLS and were associated with two buildings within the outlet centre that were not struck by the aircraft. CASA accepted the breaches in 2015 after the airport operator applied lighting and colour to the obstacles to mitigate their risk to aircraft operations.
The OLS are a series of surfaces that set the height limits of objects around an airport. The transitional surface is a component of the OLS that is immediately adjacent to the runway area. The runway area includes the runway itself and an adjacent area that is required to be graded and clear of all obstacles. The intent of the OLS is to provide airspace around an airport that is kept as free as possible from obstacles so as to permit the intended aircraft operations at the airport to be conducted safely, as well as to prevent the airport from becoming unusable as a result of growth of obstacles around it. The airport operator is responsible for establishing an applicable OLS. The surfaces of the OLS are based on a complex set of criteria that include whether the runway is used for departures and/or landings, and the types of approaches attached to that runway.
At the request of the investigation, the airport operator produced an OLS based on runway 17/35 only, and mapped the outlet centre obstacles in relation to this particular OLS. That data identified that the listed obstacles did not penetrate the OLS for runway 17/35. The airport operator also identified a further three obstacles that were not listed in the ERSA as breaching the OLS. They were not listed as they were considered minor breaches of the OLS. These obstacles related to light poles in the area of the outlet centre. The aircraft did not collide with any of the obstacles that breached the OLS.
Meteorological information
The automatic terminal information service (ATIS) information current at the time of the aircraft’s departure indicated that runway 17 was being used for departures and runway 26 for arrivals. The wind was reported as 340° at 5 kt, all tailwind on runway 17, the conditions were CAVOK,[17] and the temperature was 12 °C. Subsequent ATIS information issued after the accident indicated the airport was closed, due to the accident, and the wind was variable[18] at 5 kt.
The Bureau of Meteorology provided the ATSB with one-minute interval data recorded by the Essendon automatic weather station. At 0859, the wind was 322° at 4 kt gusting to 5 kt, which would have resulted in about a 4 kt tailwind on runway 17. The temperature was 14 °C.
The Essendon air traffic controllers indicated that, on the morning of the accident, the windsocks were showing nil wind but the anemometer[19] was indicating winds up to 5 kt. Consequently, using the least favourable scenario, the controllers stipulated on the ATIS that the wind speed was 5 kt, which was the maximum allowable tailwind on the nominated runway-in-use. The controllers also reported that, when the anemometer reading was less than about 7-8 kt, the readings became unreliable due to the siting of the anemometer. The automatic weather station was positioned on the eastern side of runway 17/35. The wind anemometer was located about 10 m south-east of the station.
On 14 September 2017, the Bureau of Meteorology advised the ATSB that the anemometer had been in the same position since 2003. Since the accident, however, a potential issue with the anemometer siting had been raised, which they were investigating.
Two witnesses, both of whom were pilots familiar with the B200 aircraft type, were positioned on the eastern side of runway 17/35 at the time of ZCR’s departure. They recalled that the wind was ‘fairly calm’ and there was no adverse weather present at the time. Images of the smoke plume and video footage of the windsock adjacent to the northern end of runway 17/35 taken shortly after the accident also showed that the wind at ground level was negligible (Figure 9 and Figure 10).
Overall, the wind conditions around the time of the accident were likely to have been calm. However, it could not be ruled out that the wind conditions ranged to a maximum of 5 kt tailwind on runway 17, which was within the aircraft’s limitations.
Figure 9: Photographs of the smoke plume that provided an indication of the wind conditions
Source: Alex Poole (left) and David Bell (right)
Figure 10: Indications of wind from the windsock located adjacent to the northern end of runway 17/35
Source: Victoria Police
Air traffic services information
Flight plan
The pilot’s flight plan submitted to Airservices specified a scheduled departure time of 0830 from Essendon and a total estimated elapsed time of 36 minutes to King Island. The plan also indicated that the flight was a ‘non-scheduled air service’ to be conducted under the instrument flight rules, and there was to be five persons on board.
MAYDAY call
The MAYDAY call broadcast by the pilot of ZCR shortly after take-off was reviewed by the ATSB. No additional information regarding the nature of the emergency was identified. In addition, the ATSB’s assessment of the pilot’s speech characteristics was unable to provide any further information.
Automatic Dependent Surveillance Broadcast data
Automatic Dependent Surveillance Broadcast (ADS-B) data was obtained from Airservices. The ADS-B data was transmitted from the aircraft multiple times per second using the aircraft’s mode‑S transponder.[20] ADS-B parameters include latitude, longitude, groundspeed, track angle, vertical speed and pressure altitude. With the exception of pressure altitude, these parameters were sourced from the aircraft’s GPS. Pressure altitude information was sourced from ZCR’s static system.[21]
The ADS-B pressure altitude data was considered more accurate than the GPS vertical rate data. Following the observed sideslip in the latter part of the flight, however, the pressure data was no longer considered reliable. This was due to the local airflow effects near the static ports induced by the substantial sideslip (refer to section titled Aircraft flight path profile).
The following information was derived from the ADS-B data:
ZCR performed a rolling take-off after turning onto runway 17 from holding point TANGO.
ZCR reached the rotation speed of 94 kt at about 730 m from the threshold of runway 17. The aircraft’s derived acceleration was refined using CCTV footage.
ZCR became airborne about 1,015 m from the threshold of runway 17. The aircraft’s rotation point was confirmed using CCTV footage.
The aircraft began to deviate to the left of the runway centre-line between ADS-B data points A and B (Figure 11). The rate of deviation was initially constant but then increased as the flight progressed (Figure 12).
ZCR became airborne at a groundspeed of about 111 kt.
Using the rate of change in ADS-B pressure altitude data, ZCR’s initial rate of climb was about 1,100 ± 200 feet per minute.
ZCR stopped accelerating about 5 seconds after becoming airborne.
The maximum groundspeed recorded for the flight was 116 kt.
ZCR reached a height, above ground level (AGL), of no more than 160 feet.
The MAYDAY call was initiated about 7 seconds after ZCR became airborne. At this time, ZCR’s airspeed was decreasing, the vertical speed was changing from a climb to a descent and the track was deviating to the left at an increasing rate.
The final ADS-B data point was recorded at 0858:52, about 10 seconds after the aircraft became airborne and about half a second before the collision with the outlet centre building.
Figure 11: ADS-B data showing initiation of ZCR’s divergence from the runway centreline between points A and B
Source: Google, annotated by the ATSB
Figure 12: ADS-B data points showing ZCR’s increasing divergence from the runway centreline as the flight progresses
Source: Google, annotated by the ATSB
Witness observations
A number of witnesses were interviewed by the ATSB and Victoria Police. The following provides a description of the observations by the key witnesses and a combined summary of the other witnesses interviewed.
Key witnesses
Pilots on the eastern side of runway 17
Two B200 pilots were positioned on the eastern side of runway 17, in line with the air traffic control tower (Figure 13). Both witnesses observed the aircraft taxiing past the control tower toward the runway 17 threshold. The witnesses were unable to observe the beginning of the take-off roll; they could, however, hear the aircraft’s engines, which they reported as sounding normal. Shortly after commencing the take-off roll, the aircraft came into view. The witnesses were expecting the aircraft to become airborne around their position, however ZCR continued along the runway. They commented that it appeared that the aircraft became airborne near the runway intersection or about two‑thirds along the runway, which was considered an unusually long take-off roll.
Figure 13: Image showing the key witness positions relative to ZCR’s track
Source: Google, annotated by the ATSB
One of the witnesses reported observing the aircraft in a shallow climb after it became airborne. Immediately after, or possibly several aircraft lengths after, a left turn was observed. The turn was described as a ‘flat’, yawing or skidding turn rather than a rolling turn, with possibly 5-10° angle of bank, at a ‘very slow’ speed. The aircraft then appeared to be at right angles to the runway, heading in an easterly direction. The aircraft was observed climbing no higher than about 100 ft AGL, before descending. The witness stated that he then lost sight of the aircraft behind the buildings. Overall, the witness believed there was something wrong when the aircraft was on the ground as well as when it was airborne.
The other witness reported that, after it became airborne, the aircraft immediately yawed left, similar to that experienced with a strong crosswind. He further reported the aircraft did not climb and the aircraft’s attitude was about 5° nose-up, which was less than half of what he would normally expect. He reported the aircraft’s wings were level and it continued yawing left and climbed to no more than 100-150 ft AGL. The witness then observed the aircraft stop climbing and adopt an almost level attitude, which coincided with the left yaw increasing. The witness stated the aircraft was going ‘extremely slow’ and was almost ‘floating’. The aircraft descended and then disappeared behind the buildings.
Both witnesses reported that the landing gear had remained extended. They further stated that there were no unusual sounds heard during the take-off, such as the propellers trying to stay ‘on speed’, sounds associated with the propellers feathering or changing pitch, and no compressor stall sounds. The aircraft sounded normal.
Refuelling operator
A local refuelling operator had stopped his truck adjacent to runway 17, facing south, to take a phone call. While on the phone, the operator observed ZCR shortly after becoming airborne. The aircraft was at about 30-40 ft AGL and climbing in what he believed to be a normal take-off configuration.
When the aircraft was about over the runway intersection, he saw the aircraft yaw ‘savagely’ left, but stay relatively ‘flat’; the aircraft did not bank. He did not observe any corrections to the yaw. The aircraft climbed to no more than 100-200 ft before it began to descend rapidly. He lost sight of the aircraft as it descended behind the outlet centre buildings.
As the operator remained in his truck with the engine running, he was unable to hear any sounds associated with ZCR. The landing gear was reported to have remained extended.
Air traffic controllers
One of the Essendon Tower air traffic controllers observed ZCR’s take-off roll and reported that the aircraft accelerated as expected and appeared normal. The aircraft appeared to rotate at the correct position. He did not hear any unusual noises from the aircraft as it went past the tower.
After this, the air traffic controller moved his attention to other work-related activities. Shortly after, the controller heard a MAYDAY call, which he recognised as being from ZCR. He was expecting the pilot to continue the MAYDAY call and provide further details. At the same time, he looked at the aircraft and noted that the aircraft was facing east instead of south. The aircraft was in a ‘flat’ orientation and appeared to be travelling ‘very slowly’ compared with what he would expect. The nose then dipped and the aircraft disappeared behind the outlet centre buildings. The controller advised the Melbourne departures controller of the accident, instructed an airport safety vehicle to attend the accident site, and dealt with other aircraft traffic.
Another air traffic controller in the Essendon Tower first sighted ZCR when it was airborne and near the runway intersection, at about 50-100 ft AGL. That controller reported that the aircraft was low, but there was nothing untoward at that time. After hearing the MAYDAY call, the controller observed the aircraft facing east in a nearly level attitude and moving slowly. The aircraft climbed to an estimated 200 ft before descending and disappearing behind the outlet centre buildings.
Helicopter pilot
At the time of the accident, a helicopter pilot had just landed and was positioned on the southern apron, facing in an easterly direction, and preparing to shut down. The pilot saw ZCR shortly after it became airborne and reported that it appeared normal. At that time, he could see the right side of the aircraft. However, when ZCR was around the runway intersection, the aircraft started to yaw left, which the pilot stated was unusual. He was now looking more directly behind the aircraft. He reported the aircraft was possibly rolling left, but only by about 5-10°. The aircraft climbed to about 100-200 ft AGL, before it started to descend. It disappeared behind the outlet centre buildings and seconds later, the pilot saw smoke rising from where the aircraft had disappeared from view. As the helicopter was still running, the pilot was unable to identify any sounds associated with ZCR.
Crane operator
A crane operator was working directly opposite the accident site, on the other side of the Tullamarine Freeway (Figure 14). The crane was facing in a north-westerly direction and the operator had an unobstructed view of Essendon Airport out his right window. The distance between the ground and the operator’s eye level in the cabin was about 24 m.
Figure 14: Position of the crane relative to the accident site, with the crane inset
Source: Victoria Police, annotated by the ATSB
The operator reported hearing the sound of an aircraft’s engines, which sounded loud and in close proximity. The engines appeared to be operating normally and there were no indications of ‘misfiring or distress’. Having been alerted by the sound, the operator looked out the right window and saw the aircraft at about 25-35 m above the ground. Referring to (Figure 15), the aircraft’s initial position was close to being in-line with the hook of the crane at the accident site and the airport building in the background. The operator identified the aircraft as a twin-engine, low‑winged, turboprop aircraft.
The aircraft was described as moving or sliding towards him, but not facing him. The aircraft’s nose was about 10-15° to the left of his position and about 10° or ‘slightly down’. The operator had a view of the right side of the aircraft and believed that the right engine was operating. He was unable to comment if the left engine was also operating or recall if the landing gear was extended.
After this, the aircraft descended to the right over the billboard second from the right. The aircraft yawed further left, possibly an angle of 30-40°, before momentarily disappearing behind the billboard on the far right. The aircraft impacted the roof and parapet wall, and flames ensued immediately after. The aircraft continued moving forward and came to rest in the loading area at the rear of the building.
Figure 15: View of the accident site from the crane operator’s right cabin window
Source: ATSB
General witness observations
Multiple witnesses were interviewed by the ATSB and Victoria Police. These witness observations may have been influenced by the varied physical locations, environmental conditions, and the short time frame within which the accident occurred.
Although there were several inconsistencies, the majority of the witnesses reported that the aircraft was relatively flat with wings level or in a slight bank. They described the aircraft as moving sideways, ‘drifting’ or ‘crabbing’ like in a crosswind or yawing, and that it was low. One witness, who was a pilot, saw the aircraft shortly after becoming airborne. He observed it conduct a 5-10° left bank and veer left, as if ‘full rudder was being applied’. He described the aircraft as initially heading about 150°, but finished facing to the east, with wings level and the landing gear remaining extended.
With regard to the engine sounds, there was some variation in observations between the witnesses. The majority, however, including one familiar with the B200 aircraft, reported that the engine sound was loud and constant.
Aircraft flight path profile
Following witness observations of a significant left yaw, the ATSB attempted to define the aircraft’s sideslip and roll angles at different points along the flight path using video footage from CCTV and a vehicle dashboard camera. Still images were extracted from the CCTV and dashboard camera footage, and the location of the aircraft was determined using ADS-B data at points A through G (Figure 16). ZCR’s track was determined at each point using ADS-B data.
Figure 16: ZCR’s track, location of the cameras and location of ZCR in each analysed image
Source: Google, annotated by the ATSB
The aircraft’s heading was determined at each point by relating the distance between the landing gear wheels to an angular displacement. The height of the aircraft’s tail was measured in pixels to provide a datum for pixel size (Figure 17).
Figure 17: Example of method for estimating sideslip angle, image is from level 1 main apron camera
Left image (a) shows the use of objects in the image to determine the location of the aircraft.
Right image (b) demonstrates measurement of the height of the tail and distance between the left wheel (LW), right wheel (RW) and the nose wheel (NW).
Note: in Figure (a) the smoke has been overlayed on the image to give an approximate location of the accident site in relation to the aircraft.
Source: Essendon Airport, annotated by the ATSB
At points E and F, the aircraft was too far away from the camera to use this method. For these two points, an estimated heading was determined graphically by aligning a scaled diagram of the aircraft with the CCTV image (Figure 18).
Figure 18: Example of graphical method for estimating sideslip angle
Source: Essendon Airport, annotated by the ATSB
The angular difference between the aircraft heading and the aircraft track gives the sideslip angle. The methods used to determine the aircraft’s sideslip angle at each point and the probable accuracy are summarised in (Table 2).
Roll was calculated using the following two methods:
The relative height of each wheel was measured and then related to an angular displacement on the aircraft’s roll axis. This method was used for the Bulla Road dashboard camera.
Drawing lines on the still image that were representative of the wing angle and the height difference in the wheels, then determining the aircraft’s rotation by measuring the angular difference between the representative line and a known level surface in the image.
The methods used to estimate ZCR’s sideslip and roll contained the following assumptions and potential errors:
It was assumed that the aircraft was far enough away from the camera that perspective did not introduce significant error.
The tail was assumed to be in a perpendicular plane to the camera and therefore the viewed height of the tail was its actual height.
There were potential errors in measuring distances and heights in pixels, these errors were cumulative.
The error in the calculations varied depending on ZCR’s distance from the camera, picture quality and viewing angle of the aircraft. The more accurate sideslip angles were about ± 5o, with the least accurate calculation about ± 20o.
The images were examined to determine the amount of distortion from the lens, in particular fisheye distortion. The outlet centre camera had substantial fisheye distortion and therefore some analysis, roll angle in particular, was limited (Figure 19). The ‘Level 1 main apron’ camera appeared to have minimal distortion, despite having a wide-angle lens (Figure 20).
Figure 19: Outlet centre camera 83 still used for analysis, showing significant fisheye distortion in the image
Horizontal green line in inset image represents the distance between the main landing gear and the vertical green line represents the height of the tail as a reference. Source: Essendon Direct Factory Outlet, annotated by the ATSB
Figure 20: Time-lapse image of the aircraft flight path taken from the Essendon Airport Level 1 main apron camera
CCTV frame rate 30 images/minute, screenshots were taken every 2 seconds. Source: Essendon Airport, annotated by the ATSB
Figure 21: Bulla Road dashboard camera footage with zoomed inset depicting measurements used for sideslip and roll calculations
Source: Supplied
In summary, the results below demonstrate a substantial left sideslip between points D and G with minimal left roll. These results were consistent with witness observations and analysis of the accident site roof impact marks.
Table 2: Results of sideslip study
Identifier
Camera location
Aircraft Track (T)
Left sideslip angle and tolerance
Aircraft roll to the left
Comments/limitations
A
Lvl1 main apron (Figure 20)
176°
2° ± 5°
N/A
Aircraft probably still on runway so unlikely to have any sideslip.
B
Outlet centre camera 83 (Figure 19)
170°
5° ± 10°
N/A
Image contained significant fisheye.
C
Lvl1 main apron
160 - 165°
0 ± 10°
4-6°
The estimated location of the aircraft meant the aircraft track could vary by 5°.
D
Lvl1 main apron
155 - 160°
35° ± 15°
6-9°
A graphical method was used to determine the sideslip angle.
A sideslip of 35° is very high so is more likely to be at the lower end of the error band rather than the upper.
E
Lvl1 main apron
142°
50° ± 20°
Too far away to determine
A graphical method was used to determine the sideslip angle. The distance and the viewing angle reduced accuracy.
A sideslip of 50° is extremely high so is more likely to be at the lower end of the error band.
F
Lvl1 main apron
130°
25o ± 10°
Too far away to determine
A graphical method was used to determine the sideslip angle. The distance and the viewing angle reduced accuracy.
G
Bulla Rd (Figure 21)
115°
25° ± 5°
6°
Correlation of ADS-B data and sideslip information
Sideslip information was correlated with Airservices ADS-B data to determine the relationship between the aircraft’s sideslip and performance. This comparison found that the reduction in ZCR’s airspeed, identified by the ADS-B data, correlated with the onset of the sideslip. This was most likely due to the increase in drag from the sideslip (Figure 22).
Similarly, the aircraft’s climb performance also reduced at the same time as the onset of the sideslip. As the ADS-B barometric data was considered unreliable while the aircraft was in a substantial sideslip, a time-lapse image was produced to provide an indicative depiction of the aircraft’s vertical flight path (Figure 23). The substantial sideslip was first observed at point 6 in Figure 23, at this point the image shows the aircraft transitioning from a climb to a descent.
Figure 22: Comparison of groundspeed and sideslip angle against time measured from the beginning of the take-off roll
Source: ATSB
Figure 23: Time-lapse CCTV image of the ZCR’s flight path, with images taken every second
Source: Linfox, annotated by the ATSB
Recorded information
Cockpit voice recorder
ZCR was fitted with a cockpit voice recorder (CVR) as required by Civil Aviation Order 20.18. The aircraft was not fitted with a flight data recorder, nor was it required to be by Australian regulations.
CVR systems provide a record of flight crew conversations. In addition, the CVR can provide a record of the cockpit audio environment, including sounds relating to engine/propeller operation, aural alerts, operation of switches and levers, activation of the landing gear, and the weather such as rain or hail.
The CVR control unit, located in the cockpit, allows a pilot to test the serviceability of the CVR system. The power supply for the CVR unit was fitted with an ‘impact switch’ designed to stop the recorder and prevent any erasure feature from functioning when deceleration forces similar to those expected in an accident are sensed.
ZCR was fitted with a Fairchild model A100S CVR in June 1996, at about the time the aircraft entered service. The fire-damaged CVR was removed from the wreckage and transported to the ATSB’s technical facilities in Canberra for examination. The CVR was successfully downloaded, however, no audio from the accident flight was recorded. The recovered audio related to a previous flight on 3 January 2017. This recording began at the expected time prior to engine start. The recording stopped, however, at about the time the aircraft landed at the arrival aerodrome. The post-landing taxi and engine shutdowns were not recorded. It was likely that the ‘impact switch’ was activated during the landing and power was removed from the CVR.
CVR serviceability checks and maintenance
An applicable CASA airworthiness directive relating to the CVR, AD/REC/1, (www.casa.gov.au) was carried out by ZCR’s maintenance provider in December 2016. The maintenance action included replacing the ‘impact switch’. No defects were logged following the conduct of the inspection.
CVR system operating instructions
Following a CVR installation in an aircraft, supplemental material related to the operation of the CVR must be attached to the Pilots Operating Handbook (POH) or approved Airplane Flight Manual (AFM). A copy of the Raytheon Aircraft Company Beechcraft Super King Air B200/B200C AFM supplement was provided by the aircraft manufacturer. That supplement indicated that a self‑test must be successfully accomplished prior to flight. This was to be achieved following the procedure below (Figure 24). Due to fire damage to the aircraft, the ATSB could not determine if the AFM contained this supplement. (For further information on checklists refer to section titled Organisational information – Flight Check System).
Figure 24: Supplemental procedure for testing CVR serviceability
Source: Aircraft manufacturer
A pilot who regularly flew ZCR was aware that it was fitted with a CVR and he would test the system as described above. He could not recall, however, if there was a specific checklist item for this. He also commented that other B200 aircraft he had operated were not fitted with CVRs. Similarly, another pilot who was aware of the CVR was using another company’s checklist and could not recall if there was a checklist item regarding the CVR. That pilot also stated that he did not operate the CVR in ZCR. A CASA-authorised testing officer who had flown ZCR stated that he had used the checklist in the aircraft, but was not aware that it was fitted with a CVR, suggesting the CVR checklist items were not included in ZCR’s checklist.
It is unknown if the accident pilot was aware that ZCR was fitted with a CVR and the requirement to conduct the self-test prior to flight. Of note, the pilot previously flew another B200 aircraft, which was not fitted with a CVR.
Dashboard camera audio frequency analysis
A witness driving on the Tullamarine Freeway provided dashboard camera footage of the accident to the ATSB. The footage featured a sound consistent with an aircraft passing nearby immediately prior to the collision with the outlet centre.
Frequency analysis determined that the aircraft’s engine power was at a high level, loud enough to drown out background noises such as car, road and airflow noise. Only one propeller frequency was present, meaning that either both propellers were at similar RPM or only one propeller was operating at the identified frequency and the other propeller was not detected in the frequency analysis. While the ATSB could not establish if one or both engines were operating at a high level, the analysis determined that the propeller RPM(s) were at the nominal take-off setting of 2,000 RPM.
Wreckage and impact information
Accident site
The aircraft intially contacted the roof of a building in the outlet centre adjacent to the southern end of runway 17 (Figure 25). A search of the runway and surrounding area did not identify any items related to ZCR. In addition, there was no evidence of a bird strike under the aircraft’s flight path or at the accident site.
After colliding with the building’s roof and parapet wall, the aircraft came to rest in a loading zone at the rear of the building. A post-impact fuel-fed fire severely damaged the wreckage and initiated a fire in the building.
Figure 25: Accident site overview
Source: Metropolitan Fire Brigade (Melbourne), annotated by the ATSB
Impact mark analysis
Marks from the landing gear and slash marks from the left propeller’s blades were identified on the building’s roof. These marks were used to determine the aircraft’s initial impact attitude by aligning a scaled diagram of a B200 aircraft with an image of the marks (Figure 26).
Figure 26: Outlet centre roof impact damage with scaled aircraft aligned with impact marks
Note: Landing gear wheels are offset to the right and apparent wingspan is reduced to allow for a slight left bank. Source: Metropolitan Fire Brigade (Melbourne), annotated by the ATSB
Analysis of the roof impact marks indicated that:
the aircraft had a heading angle of about 86 ⁰ (T)
the ground track was about 114 ⁰ (T)
the aircraft was at a sideslip angle of about 28⁰ left of track
the aircraft was slightly left-wing and nose-low with a shallow angle of descent at the initial roof impact
after the initial impact, the aircraft rotated left on its vertical axis until the fuselage was about parallel with the rear parapet wall of the building.
Propeller slash marks
Nine propeller slash marks were located in the building’s roof (Figure 27). Analysis of those slash marks indicated that they had been created by the left propeller blades cutting through roofing material while rotating.
Figure 27: Left propeller slash marks in roofing material with tape measure showing distance between cuts
Source: ATSB
The last 2 seconds of ADS-B data indicated ZCR’s ground speed was about 108 kt. Allowing for potential aircraft deceleration due to the nose landing gear colliding with the roof, prior to the left propeller blades making contact, the left propeller RPM was calculated as being consistent with ZCR’s nominal take-off setting of 2,000 RPM. This was consistent with the estimated propeller RPM established from the dashboard camera audio frequency analysis (refer to section titled Recorded information -Dashboard camera audio frequency analysis).
An estimate of ZCR’s sideslip angle was also obtained by measuring the angle between the flight path and the slash marks, corrected for aircraft speed and propeller RPM. Using this method, the angle of sideslip at impact was calculated as being about 29° to the left. The results of this method to calculate sideslip at impact was consistent with the impact mark analysis above.
Other damage
After the initial impact, the aircraft collided with a concrete parapet wall before coming to rest in the building’s rear loading area. There was significant structural damage to the building, and the retail business operating in that section of the building incurred significant fire and water damage. Several vehicles parked at the rear of the building were also damaged or destroyed.
Aircraft wreckage
The majority of the aircraft was damaged or destroyed as a result of the collision with the building and subsequent fire. The damage precluded a complete examination of many components and systems (Figure 28). All major parts of the aircraft were accounted for at the accident site. On-site examination of the wreckage did not identify any pre-impact faults with the aircraft that could have contributed to the accident.
Figure 28: Main wreckage
Source: ATSB
The outboard right-wing sections, main landing gear lower sections, both engines, and both propellers separated from the aircraft during the accident sequence and were located at the accident site. The nose gear oleo and wheel assembly came to rest on the Tullamarine Freeway, about 65 m from the main wreckage, in the direction of the flight.
Tyre marks on the building’s roof and damage to the main and nose landing gear assemblies indicated that the landing gear was down during the accident sequence. Dashboard camera footage of the aircraft just prior to impact, along with witness observations, further supported the landing gear being in the down position.
Rudder
The majority of the vertical stabiliser was destroyed by fire (Figure 29). The rudder flight control surface was still attached to what remained of the vertical stabiliser. The rudder control cables, bell cranks, and push-pull tubes were inspected from the cockpit through to the tail with no pre‑impact faults identified.
Figure 29: Remains of the vertical stabilizer on its left side showing position of rudder and trim actuator
Source: ATSB
Rudder trim
The left rudder trim cable had failed at a position towards the rear of the fuselage. Inspection of the cable fracture revealed necking-type failure of individual strands within the cable. That, and the way the cable was splayed, were indicative of an overstress fracture, likely as a result of the collision (Figure 30).
Figure 30: Schematic of rudder trim system showing the approximate cable fracture point (left) and a picture of the left rudder trim cable fracture (right)
Source: Textron Aviation Inc. and ATSB
The rudder trim actuator screw jack was extended 43 mm when measured from the actuator body to the center of the rod end, which equated to the rudder trim being in the full nose-left position. Due to the significant yaw observed by witnesses, the rudder actuator was removed from the wreckage for further detailed examination. This examination determined that the rudder trim tab actuator was likely in the full nose-left position at impact (refer to section titled Appendix B – Rudder trim tab actuator examination).
Abrasion marks and compression damage were present on the right side of the empennage, rudder, and rudder trim tab, indicating that the area had come in contact with a hard flat abrasive surface (Figure 31). Abrasion on the rudder trim tab trailing edge was significantly greater than the corresponding abrasion on the rudder trailing edge, shown in Detail A (Figure 32 and Figure 33). The abrasion damage indicated that the rudder trim tab was positioned to the right of the rudder surface during the impact sequence. The angular displacement of the rudder trim tab could not be determined from the abrasion marks, however the displacement indicated that the rudder trim was in a nose-left position at impact.
Figure 31: Empennage and rudder viewed from the right showing abrasion damage
Source: ATSB
Figure 32: Rudder and rudder trim showing abrasion damage
Source: ATSB
Figure 33: Detail A. Close-up of abrasion damage to rudder and upper surface of rudder trim trailing edge
Source: ATSB
Analysis of the roof impact marks and CCTV footage showed that the aircraft had contacted the concrete parapet wall on the right side of the empennage before exiting the roof of the building. It was likely that the impact with the wall caused the abrasion damage to the empennage and rudder.
Rudder boost system
The rudder boost control system was destroyed by fire, however, sections of the rudder boost actuators were located within ZCR’s empennage. No anomalies were identified in the remaining sections of the actuators.
Elevator trim
Both the left and right elevator trim actuators were found in a position that equated to a full nose‑up trim position. Witnesses, CCTV and ADS-B evidence either opposed or did not support ZCR having full nose-up trim at take-off. It is possible that the elevator trim was moved to this position by the pilot in an attempt to control the aircraft’s flight path or the trim may have moved as a result of impact forces. The ATSB determined however, that it was unlikely that the elevator trim was in the full nose-up position at take-off and did not examine the trim tab actuators any further in order to confirm their position at impact.
Flap system
The left inboard and outboard flap control surfaces were destroyed by fire. The right inboard and outboard flaps had separated from the aircraft and broken into numerous sections during the impact sequence.
All four flap actuators were identified in the wreckage. The left inboard and outboard actuator outer bodies had been fire-damaged, however, their internal shafts and attachment points were present.
Initial on-site examination of the aircraft wreckage indicated the flaps were extended approximately 10°. More detailed analysis of the left inboard and outboard actuators, however, found they were likely in the fully retracted, UP position, when the aircraft collided with the building. An accurate assessment of the right-wing flap positions was not possible due to impact and fire damage.
Flight control locks
Remnants of the flight control locks including the locking pin for the control column, some chain and the ‘remove before flight’ warning sign were located to the rear of the co-pilot seat in the cockpit. In addition, the area surrounding the rudder locking pin receptacle was searched and the pin was not located.
Cockpit instruments and switches
Due to significant fire damage, the cockpit switch positions, instrument settings and cockpit trim indicator positions could not be determined. The available cockpit instruments were inspected and none retained any useful information.
Engine controls
An inspection of the remaining sections of the engine control pedestal and engine control linkages was performed from the cockpit through to the engines. There was significant disruption to the engine controls due to fire and impact damage. For that reason, continuity of the engine controls could not be fully established. No pre-impact defects, however, were identified in the remaining control sections.
The position of the power levers, condition levers, propeller levers and corresponding friction control knobs could not be accurately determined due to the extent of the damage.
The propeller control system was inspected in detail. The control system had fractured in overload in several locations due to propeller and engine separation during the accident sequence. There were no pre-impact defects identified within the propeller control system.
Engines
The left engine had separated from the aircraft and broken into three sections: the accessory drive with the compressor inlet, the compressor and turbine modules, and a forward section of the reduction gearbox which remained attached to the propeller (Figure 34). The engine had sustained significant impact and fire damage. An external inspection did not identify any pre‑impact defects.
Figure 34: Right engine assembly, shown upside down and viewed from its left side
Left propeller with attached forward section of reduction gearbox not shown. Source: ATSB
The right engine had detached from the aircraft and separated into two sections at the reduction gearbox. It sustained significant impact and fire damage (Figure 35). An external inspection of the engine was conducted with no pre-impact defects identified.
The engines were removed from the accident site and taken to a secure facility for further examination.
Figure 35: Right engine assembly, shown upside down and viewed from its left side
Right propeller with attached forward section of reduction gearbox not shown. Source: ATSB
Engine examinations
Both engines were retained by the ATSB for further examination in order to determine:
if there were any defects present which could have contributed to the accident
the engine power outputs at impact.
The PT6A-42 engine utilises a two-stage power turbine to drive the propeller shaft via a reduction gearbox (RGB) that is located at the front of the engine. The propeller shaft transmits torque from the engine’s reduction gearbox to the propeller.
The detailed engine examinations found
no defects that were likely to have prevented normal operation of the engines
there was similar evidence of rotation in both engines
both propeller shafts had fractured at a similar position and the fracture surfaces appeared similar
the left engine’s reduction gearbox planetary gears had indentations and tooth bending.
An accident investigator from the engine manufacturer, Pratt & Whitney Canada, travelled to Australia to assist with the examinations. The engine manufacturer’s report concluded that both engines were producing similar power at impact.
The reduction gearboxes were retained for further examination at the ATSB laboratories in Canberra (refer to section titled Appendix A - Reduction gearbox and propeller shaft assembly examinations).
Both engines’ fuel control units, fuel pumps, propeller governors, overspeed governors and torque limiter units were sent to the engine manufacturer for testing, where possible, followed by disassembly and inspection under the supervision of the Transportation Safety Board of Canada. The examinations did not identify any pre-impact faults that would have prevented normal engine operation.
Propellers
The left propeller was connected to a section of the reduction gearbox that had separated from the engine. The connected section housed the overspeed governor and propeller governor with its reversing lever and control linkage still attached. Inspection of those components and remaining controls did not identify any pre-impact issues.
All four blades remained attached to the propeller assembly (Figure 36). The propeller assembly was heavily sooted and charred, with heat damage to the de-ice boots and wiring. Three of the blades had portions of the tips fractured. All blades exhibited varying amounts of chordwise rotational scoring and leading edge gouging.
The propeller cut through roofing material and the supporting structure during the impact sequence, demonstrating significant rotational energy (Figure 37).
Figure 36: Left propeller viewed from the rear, showing blade-tip fractures, blade gouges and blade bending
Source: ATSB
Figure 37: Left propeller cuts through roof structure
Source: ATSB
The right propeller remained connected to a section of the reduction gearbox section that had separated from the engine. The propeller was located on the roof of the building.
The damage to the right propeller was similar to the left propeller but with less apparent heat damage (Figure 38). All four blades remained attached to the propeller assembly. All blades exhibited varying amounts of chord-wise rotational scoring and leading edge gouging.
Both propellers were retained for further examination by the ATSB.
Figure 38: Front view of the right propeller showing bending, chordwise twisting, and leading edge gouging of the propeller blades
Source: ATSB
Propeller examinations
Both propellers were examined in order to determine the level of power being produced by each engine at impact. An accident investigator from Hartzell Propeller travelled to Australia to assist with the subsequent propeller examination at an approved facility.
The propellers were four-blade Hartzell constant speed propellers Model HC-D4N-3A with D9383K blades installed on the aircraft under Raisbeck Engineering Supplemental Type Certificate SA2698NM. They had a feathering and reverse pitch capability.
Oil pressure from the propeller governor is used to reduce the blades’ pitch angles. A feathering spring and blade counterweight forces are used to move the blades to the high pitch/feather direction in the absence of governor oil pressure. The propeller utilises an aluminium hub with aluminium blades. Rotation is clockwise as viewed from the rear.
Both the left and right propellers exhibited similar damage consistent with high power output at impact. There were no discrepancies noted on either propeller that would have prevented or degraded normal operation prior to the impact. Blade and internal impact damage indicated both propellers impacted at positive blade angles of attack. At an estimated impact speed of 108 kt with the propellers at 2,000 RPM, preload plate impact marks suggest a geometric blade angle that was approximately equal to the engines take-off power of 850 horsepower.
Medical and pathological information
The pilot held a Class 1 Aviation Medical Certificate that was valid until 20 May 2017. The pilot was required to wear distance vision correction and have available reading correction while exercising the privileges of his licence.
The pilot’s CASA medical records indicated that he was diagnosed with Type 2 diabetes in 2007. At the time of the accident, the pilot was reportedly on multiple oral medications to manage his diabetes and was considered to have met the CASA requirements for maintaining his medical certificate. The records also showed that, as part of the pilot’s annual medical requirements, an echocardiogram was performed in 2016, which revealed an abnormal mitral valve. This was repaired in July of that year, with a post-operative follow-up identifying nil issues. CASA subsequently reviewed the pilot’s medical history and he was advised on 4 February 2017 that he could continue exercising the privileges of his licence, but should cease flying if there was a change in his treatment or condition.
The pilot’s post-mortem examination established that the pilot succumbed to injuries sustained during the impact sequence. Mild to moderate coronary artery atherosclerosis[22] was noted, along with signs of mitral valve annuloplasty.[23] There was no evidence, however, of any significant natural disease which may have caused or contributed to the accident. Further, the toxicology results did not identify any substance that could have impaired the pilot’s performance or that were not noted in the pilot’s CASA medical records. While post-mortem results for the passengers were not provided to the ATSB at the time of writing, given the injuries sustained by the pilot and the results of his post-mortem, the accident was not survivable.
The pilot’s family described him as being fit for his age and indicated that he regularly exercised.
Organisational information
Corporate & Leisure Aviation
Corporate & Leisure Aviation was solely operated by the accident pilot. The pilot generally flew the B200 aircraft and Piper Chieftains on charter flights, golf and fishing trips, and some corporate flights. A pilot who had previously worked with the accident pilot reported that he was a ‘one-man show’ and that he did not have many ‘outside influences’ or much checking. The accident flight was booked by a specialty golf tour company who had used Corporate & Leisure Aviation on several previous occasions.
Air operator’s certificate
A CASA AOC was re-issued to the accident pilot (certificate holder) on 17 July 2014, valid until 31 July 2017.[24] The AOC schedule stipulated that the certificate holder was approved to conduct charter operations within Australian territory and was authorised to operate several Australian-registered aircraft types and models, including the B200 aircraft.
The accident pilot was approved as the AOC holder’s Chief Pilot on 17 February 1999. A CASA review following the accident found that the AOC holder had no outstanding non-compliance notices (NCNs) or safety alerts.
CASA surveillance and non-compliance notices
A review of CASA records found they had conducted surveillance on the pilot’s AOC on 43 occasions since initial issue. On 5 November 2015, CASA conducted an audit of the AOC, and identified 11 findings, of which nine were NCNs. Of significance to this investigation was:
NCN 713808: The operator did not have a flight check system approval, which was required for the B200 aircraft.
Flight Check System
A flight check system (FCS) is the combination of a specified operator’s activities, processes and documentation that together provide a system for the safe conduct of flight operations in a specified aircraft. Civil Aviation Regulations 1998 (CAR), regulation 232 Flight check system stated that:
The operator of an aircraft shall establish a flight check system for each type of aircraft, setting out the procedure to be followed by the pilot in command and other flight crew members prior to and on take-off, in flight, on landing and in emergency situations.
A flight check system shall be subject to the prior approval of CASA, and CASA may at any time require the system to be revised in such manner as CASA specifies.
The pilot in command must ensure that the check lists of the procedures are carried in the aircraft and are located where they will be available instantly to the crew member concerned.
CASA further define an aircraft checklist and checklist procedure as:
Aircraft checklist is: The physical presentation of an efficient sequence of checks used to verify that the correct aircraft configuration has been established in specified phases of flight.
Checklist procedure for an aircraft is: The process by which the checks and the checklist are implemented efficiently and effectively.
CASA exempts some operators of the requirement to have a CASA-approved FCS, but they are not exempt from the requirement to establish and use a FCS (EX38/2004). With regard to the accident pilot’s AOC, the only aircraft required to have a CASA-approved FCS was ZCR.
In the case of commercial operations, the operator must ensure that the FCS is outlined in their operations manual. Also, if the information, procedures or instructions are contained in the AFM, then the operator must ensure that the operations manual refers to that AFM.
Non-Compliance Notice 713808
CASA records showed that NCN 713808 was issued to Corporate & Leisure Aviation (the operator) on 3 February 2016 and required an acceptable response to CASA within 30 days. CASA worked with the operator to achieve compliance and in December 2016, they received an updated operations manual with a section addressing checklist requirements for the B200 aircraft. Appendix B0-1 to the operations manual stated that, for ZCR:
The currently approved CASA check lists for both Normal and Emergency Procedures will be used at all times. Copies of checklists are readily accessible to pilots in the cockpit of all company Aircraft, and a copy is also available in the company reference library. Checklists are in a tabbed booklet format suitable for use on the pilot’s knee, and include tabbed emergency procedures at the back for easy access. The currently approved CASA checklist is the manufacturer’s checklist P/N 101‐590010‐157E issued July 1996.
CASA indicated this was an acceptable means of compliance and closed NCN 713808 on 20 December 2016 in their internal tracking system. The operator was not formally advised that the NCN had been closed, and a CAR 232 approval was not issued at this time. CASA correspondence with the operator indicated that they intended to inspect the checklist in the aircraft prior to the approval being issued, however, this did not occur before the accident flight.
The ATSB sought further clarification from CASA regarding the acquittal of NCN 713808 and were advised that a CAR 232 approval had been issued to the operator in 2006, however, the FOI who issued NCN 713808 was not aware of this approval. This approval referenced checklist part number 101-590010-157E.
ZCR checklists
The aircraft manufacturer advised the ATSB that the checklist, referenced by part number 101‑590010-157E, in the CASA CAR 232 approval and the operators manual was the incorrect checklist for ZCR. The manufacturer further advised that that they had no record of a quick reference checklist being purchased for ZCR; it was possible, however, that the operator obtained a checklist from another source.
Due to fire damage to ZCR, the ATSB could not determine which checklist was in the aircraft. The aircraft manufacturer provided a copy of the checklist referenced in the operations manual, a copy of the correct checklist by serial number for ZCR, 101-590010-309F, and a copy of a POH applicable to ZCR. The manufacturer advised that the checklists were unlikely to contain checks related to modifications to the aircraft such as the CVR. The three checklist sources were compared and it was found that, in regard to the rudder trim and weight and balance items, the checklists were identical. None of the checklists contained CVR checks.
A summary of checklist items required to be performed before take-off, related to the rudder trim and the aircraft’s weight and balance is below (Table 3). When followed, the checklists required the position of the rudder trim be checked five times and the weight and balance of the aircraft be checked once before take-off.
Table 3: Checklist item summary
Checklist
Rudder trim
Weight and Balance
PREFLIGHT INSPECTION
Trim Tabs - SET TO “0” UNITS & Rudder, Rudder Tab… - CHECK
-
BEFORE ENGINE STARTING
…Rudder trim controls - SET
Weight and C.G. - CHECKED
ENGINE STARTING
-
-
BEFORE TAXI
-
-
BEFORE TAKEOFF (RUNUP)
Trim Tabs - CONFIRM SET
-
BEFORE TAKEOFF (FINAL ITEMS)
Trim - CONFIRM SET
-
Operational information
Yaw damper and rudder boost operation
The ATSB was unable to determine whether the yaw damper was engaged on the accident flight or when the pilot normally engaged the yaw damper (refer to section titled Aircraft wreckage – Cockpit instruments and switches). There was no evidence found to support a rudder boost malfunction (refer to section titled Aircraft wreckage – Rudder boost system inspection).
Both systems could be disconnected by the pilot and the aircraft manufacturer advised that the pilot should have easily been able to overcome forces generated by the rudder boost and yaw damper systems.
B250 flight simulator
In order to determine the effects of full left rudder trim on take-off and climb performance, a flight was performed in a King Air 250 Level D flight training simulator[25]. The simulator performance was similar, though not identical to ZCR. The accident weather, airport location and maximum take-off weight were used to make the flight conditions as similar as possible to the accident flight. The pilot who performed the flight commented that:
The yaw on take-off was manageable but at the limit of any normal control input. Should have rejected the take-off. After take-off the aircraft was manageable but challenging up to about 140 knots at which time because of aerodynamic flow around the rudder it became uncontrollable. Your leg will give out and then you will lose control. It would take an exceptional human to fly the aircraft for any length of time in this condition. The exercise was repeated 3 times with the same result each time. Bear in mind I had knowledge of the event before performing the take-offs.
The pilot also stated that it could be possible for a pilot to misinterpret the yaw as being caused by an engine power loss rather than from a mis-set rudder trim.
Sideslip effects on performance
An increase in an aircraft’s sideslip angle will decrease aerodynamic efficiency and aircraft performance. It was not possible to quantify the effects on ZCR without flight testing or complex engineering modelling. Both these options were outside the scope of the investigation and this information was not held by the aircraft manufacturer.
A sideslip will affect aircraft performance in a number of ways, including by:
reducing thrust, due to the change in propeller inflow angles
increasing form drag[26] as a greater surface area of the aircraft is facing the relative airflow (Figure 39 and Figure 40)
reducing the amount of wing available to produce lift, due to the fuselage and engine cowls blanking airflow to portions of the wing (Figure 41)
creating a rolling moment (in the case of a nose-left yaw it will create a left wing-down rolling moment).
Opposite aileron input would have been required to keep the wings level during the observed sideslip in this event. This aileron input will have the effect of further increasing drag on the aircraft.
Figure 39: Image of exemplar aircraft taken directly front on showing the profile facing into the relative airflow
Source: ATSB
Figure 40: Image of exemplar aircraft taken at an angle of 30o showing the increase in engine cowl fuselage and vertical tail surface that would be exposed to the relative airflow with a sideslip of 30o
Source: ATSB
Figure 41: Diagram showing sections of the wing that will be blanked by a 30o yaw angle excluding the effect of the propeller wash
Note: As a result of the propeller wash straightening out the airflow over sections of the wings, they will not receive as much blanking as is depicted in the diagram. Source: ATSB
Take-off weight estimations
A copy of the passenger/cargo manifest and load sheet for the accident flight, that was required to be left at the aircraft’s departure airport, was not located. Consequently, the ATSB estimated ZCR’s weight and balance based on a combination of known and estimated weights of the pilot, passengers, baggage, and fuel on board. From this, it was estimated that ZCR’s weight at the beginning of the flight was about 240 kg above the aircraft’s maximum take-off weight of 5,670 kg.
The occupant seating positions were established from information provided by Victoria Police. This information indicated the front right or co-pilot seating position was unoccupied. ZCR’s balance charts did not allow a centre of gravity[27] position to be determined for an aircraft above its maximum take-off weight. The charts were extrapolated, however, and assuming the forward and aft centre of gravity limits remained linear at higher weights, ZCR was determined to probably be within the forward and aft centre of gravity limits.
While the golf tour organiser provided their clients with limitations on baggage weights, they reported that the pilot had previously used scales to weigh bags. The organiser indicated, however, that they were not aware of any further checks conducted by the pilot. CCTV footage of the passengers arriving at the airport did not show their bags being weighed. The ATSB was unable to confirm if the pilot had verified the aircraft’s weight and balance prior to departing.
Take-off performance estimations
The ATSB estimated the ground roll distance and climb performance expected for ZCR on the day of the accident. The following conditions were used to establish these estimates:[28]
The pilot was reported to use ‘APPROACH flap’ for take-off. However, as the flaps were found in the UP position and this setting was recommended by the aircraft manufacturer for this take‑off, ‘flaps UP’ was used for the estimates.
The ATSB’s take-off weight estimate (refer to section titled Operational information - Take-off weight estimations).
While a review of the meteorological information identified that the wind conditions could have ranged from 0 kt to no more than a 5 kt tailwind. The worst-case scenario of a 5 kt tail wind was used.
The figures were manually extracted from the performance charts contained in Section V – Performance of the Raisbeck Engineering B200 POH and AFM supplement (85‑116). As the charts did not account for take-off weights greater than the maximum take-off weight, these figures were extrapolated. The resultant figures should not be considered as absolute, but rather as an estimate due to charting errors and extrapolation.
Based on the worst-case scenario of the higher take-off weight and a 5 kt tailwind, the ground roll should have been about 594 m.[29] This was only 5 per cent more than the distance calculated for ZCR at its maximum take-off weight, however the actual ground roll estimated by the ATSB from ADS-B data and CCTV footage was 71 per cent longer (refer to section titled Air traffic services information – Automatic Dependent Surveillance Broadcast data). These calculations demonstrate that the higher take-off weight alone did not result in the delayed take-off.
With regard to ZCR’s climb performance, the expected best rate of climb performance with both engines operating and the landing gear retracted was estimated as 2,360 feet per minute. Textron Aviation Inc. advised the ATSB that the climb penalty for having the landing gear extended was 630 feet per minute. Consequently, ZCR’s expected climb performance should have been about 1,730 feet per minute. These figures assume that maximum continuous power was set on both engines and the two-engine best rate of climb speed of 121 kt was maintained.
The aircraft manufacturer also provided the ATSB with the aircraft’s expected take-off performance. While some of the variables used to establish these figures differed from that used by the ATSB, most likely as the most up-to-date information was not available at that time, a broad comparison of the results showed that they were reasonably consistent.
Fuel-related information
At 0743 on the morning of the accident, a refuelling agent received a telephone request from the pilot for fuel to be uplifted into ZCR. Between 0750 and 0806, a total of 705 L of JetA1 was uplifted to the main tanks and a total of 401 L was uplifted to the auxiliary tanks. The ATSB determined that after refuelling the main tanks were likely full and the auxiliary tanks contained 401 L.
A complete daily check of the fuel quality was conducted at 0550 and 1210. That check established that the fuel from the fuel truck was ‘clear bright’ in appearance, and there was nil water or sediment present. An additional check was conducted soon after the accident, at 1000, which did not identify any contamination.
There were no reports of aircraft having refuelled at Essendon experiencing fuel-related issues around the time of the accident flight.
Pre-flight inspections and before take-off checks
Cockpit checklists are an essential tool for overcoming limitations of pilot memory, and ensuring that action items are completed in sequence and without omission. According to Degani & Wiener (1990):
The major function of the flight deck checklist is to ensure that the crew will properly configure the airplane for any given segment of flight. It forms the basis of procedural standardization in the cockpit.
Nagano (1975), cited in Degani & Wiener (1990), also stated that another objective of an effective checklist was to promote a positive attitude to the use of checklists. This relied on the checklist not only being ‘well grounded’ in the current operating environment, but also the checklist user understanding the importance of the checklist rather than regarding it as a nuisance task.
Checklist devices have evolved over the years and range from paper to electronic formats. The paper checklist is commonly used and consists of a list of items written on paper card. One of the key disadvantages of the paper checklist is that there is no mechanism for pilots to distinguish between checklist items that have been completed and those that have not. Further, pilots, in particular experienced pilots, may be tempted to memorise the checklist to avoid the burden of reading it from the card (Degani & Wiener, 1990). Irrespective of the device employed, generally, there are two distinct checklist methods:
Challenge-response: Flight-phase related actions are performed by the pilot from memory and the checklist is then used to verify that critical items have been correctly performed. For multi‑crew operations, this may involve the pilot monitoring reading the item to be checked and the pilot flying confirming the status or configuration of that item (Hawkins, 1993).
Read-and-do: A method for leading and directing the pilot in configuring the aircraft using as a ‘step-by-step, cookbook approach’. For multi-crew, this may involve one pilot calling for an item, and the other pilot setting that item and verbalising its status (Degani & Wiener, 1990).
With regard to the use of checklists in this accident, the pilot’s operations manual stated that:
The Pilot in Command shall ensure that the aircraft checklist is carried out in detail for every flight – this includes private, aerial work and charter operations. The method of carrying out the checklist shall be “Read and Do” or “Do and Check” for all flights.
PREFLIGHT INSPECTION checklist
As the accident flight was the first flight of the day, all items on the PREFLIGHT INSPECTION checklist [30] had to be completed. CCTV footage captured ZCR parked outside near the maintenance provider’s hangar on the morning of the accident. The pilot was observed arriving at ZCR and walking around the aircraft and entering the cabin. This suggested that the pilot was conducting a pre-flight inspection. The specific details of that inspection could not be determined, however, due to the aircraft’s distance from the camera.
The PREFLIGHT INSPECTION checklist included setting the trim tabs in the cockpit to ‘0’ units then visually checking the rudder and rudder tab when conducting the external walk-around (Figure 42). An example of a B200 checklist used by an Australian operator called for a ‘function check’ of the manual trim system to be performed, which included the rudder trim. A previous employee of this operator indicated that the function check for the rudder trim involved moving the trim wheel from full left to full right deflection and then back to the centre position. Any subsequent checks of the trim were to confirm that they were correctly set. Another pilot who had operated ZCR also indicated that he would exercise the limits of the trim systems during the pre-flight inspection. The ATSB was unable to determine the accident pilot’s practices with regard to checking the trim positions during the pre-flight inspection.
Figure 42: B200 rudder with rudder trim tab set to the full nose-left position
Images taken while standing at the rear of the aircraft. Source: ATSB
BEFORE ENGINE STARTING and BEFORE TAXI checklists
The BEFORE ENGINE STARTING checklist included;
confirming the rudder trim controls were set
checking the aircraft’s weight and centre of gravity
checking that the flight control locks were removed
checking the rudder boost and elevator trim switches were ON.
The BEFORE TAXI checklist included checking and setting the flaps, and checking the flight controls for freedom of movement and proper direction of travel.
BEFORE TAKEOFF (RUNUP) checklist
Similar to the PREFLIGHT INSPECTION checklist, all items on the BEFORE TAKEOFF (RUNUP) checklist were to be completed for the accident flight. Items on this checklist included;
checking the autopilot and yaw damper
checking the electric elevator trim
confirming the trims tabs were set
checking and testing the functionality of the primary governors, overspeed governors and rudder boost system
checking and arming the autofeather system.
Some of these checks required the aircraft’s engines to be increased to a relatively high power setting to test a number of systems. Consequently, the checks would typically be performed away from any persons and other aircraft.
A number of experienced B200 pilots were consulted regarding the conduct of these checks. Some of these pilots reported that the checks should be performed when the aircraft was stationary, such as in the designated run-up bay. While others indicated that the checks could be done while taxiing or at the holding point. Similarly, the Essendon Tower controllers also stated that they have observed pilots of turboprop aircraft utilise both options. They further commented that it was not unusual for pilots to taxi directly to the holding point and report ready for take-off, without entering the run-up bay.
The CCTV footage of ZCR parked outside showed the left engine being started, followed by the right engine 1 minute later. About 2 minutes after this, the taxi toward the passenger terminal was commenced. A person positioned in an adjacent hangar provided no indications that the BEFORE TAKEOFF (RUNUP) checks were conducted at this time. Similarly, there was no indication from the ATC audio recordings that the pilot had requested a clearance to conduct run-ups either on the apron or in the designated run-up bay. Further, the ADS-B data did not show the aircraft stopping at any stage while taxiing to the terminal or, later, the holding point, which would have been consistent with conducting stationary engine run-ups. A pilot who also observed ZCR taxiing to the holding point, stated that he did not hear any run-ups, but had also considered that they may have been completed prior to that time.
BEFORE TAKEOFF (FINAL ITEMS) checklist
The BEFORE TAKEOFF (FINAL ITEMS) checklist included confirming the autofeather was armed, and the trims and flaps were set as required.
TAKEOFF checklist
After take-off, the TAKEOFF checklist called for the landing gear to be retracted when a positive rate of climb was established and then for the flaps to be raised when at a minimum speed of 121 kt (indicated airspeed). The accident pilot had previously advised the ATSB that it was his standard practice for take‑off to use ‘one stage of flap because it gets me off the ground quicker’. The last recorded flight on the cockpit voice recorder and the pilot’s CASA-Approved Testing Officer also confirmed that he used flap for take-off.
Checklist discipline
When discussing the importance of checklists, Hawkins (1993) stated that:
It is widely accepted that the proper, disciplined use of cockpit checklists is an essential element in flight safety. This reflects the view of the aircraft manufacturer, regulatory agencies, pilot bodies and airlines. It is a concept long accepted in civil aviation…In spite of this general agreement on the significance of the checklist to flight safety, lack of proper checklist discipline remains a major issue.
In previous correspondence between the accident pilot and the ATSB when discussing checklists, the pilot stated that:
…You don’t get complacent as a pilot but you get into a routine. The same as your pre-take-off checks, you get a routine and you don’t need to use a checklist because you are doing it every day, you are flying it every day… I take-off with one stage of flap because it gets me of the ground quicker. And I never change my routine...
Given the above comments previously made by the pilot, the ATSB received information from numerous persons who flew with the pilot in order to establish his use of checklists. A summary of their comments is below:
An engineer who flew with the accident pilot on a post maintenance check flight reported that the pilot elected not to conduct the BEFORE TAKEOFF (RUNUP) checks as they had already been done earlier in the day. The engineer also commented that they took off with the pressurisation system incorrectly set and during the flight he noticed that the right wing locker was open. Reportedly, the pilot did not refer to a checklist throughout the flight.
A previous passenger reported that the pilot did not close the main cabin door until he was prompted by that passenger just prior to take-off. The cabin door is required to be checked in the BEFORE ENGINE STARTING checklist. Further, when the door is open, a red DOOR UNLOCKED warning light will illuminate on the annunciator panel in the cockpit to alert the pilot.
Another pilot reported having a conversation with the accident pilot about the use of checklists when hiring a B200 aircraft. When confirming if there was a checklist in the aircraft, the accident pilot indicated that he did not believe in checklists. He further commented that he felt comfortable with flying the aircraft and did not believe the checklist was necessary. However, the ATSB was unable to establish if the accident pilot was indicating that he would use his own checklist or would rely on memory to perform the checklist items.
The accident pilot’s CASA-approved testing officer advised that the pilot would use a checklist the majority of the time, though he could not recall if the pilot used the aircraft’s checklist or his own.
Another pilot who flew with the accident pilot on occasion indicated that he had observed the pilot using the checklist that was approved in his operations manual at that time.
A pilot (co-pilot) who flew with the accident pilot (captain) on the last flight recorded on ZCR’s cockpit voice recorder also stated that they had used a checklist. A review of that recording also showed the captain and co-pilot appeared to be using the ‘challenge and response’ checklist methodology. The co-pilot read the item to be checked and the captain confirmed the status of the item.
During the conduct of the pilot’s instrument proficiency checks in October and November 2015, the CASA flight operations inspector noted that the pilot was using a laminated checklist with what appeared to contain the abbreviated normal procedures.
While there was variable evidence showing the pilot’s checklist discipline, the ATSB was unable to establish if he was using a checklist on the accident flight or if he relied on memory to action checklist items.
Why checklists are not completed
Checklists are an essential defence against pilot errors, however, this can sometimes fail. Various research studies have provided insights as to why checklist procedures may not always be completed, including:
Attitude: Hawkins (1993) highlighted that, ‘probably the greatest enemy of error-free, disciplined checklist use is attitude – a lack of motivation…to use the checklist in the way it should be used’.
Distractions and interruptions: Distractions and interruptions can result in a disruption to the sequential flow of the checklist. This not only means that the pilot will have to memorise the location of that disruption, but it may also lead to a checklist error or omission (Degani & Wiener, 1990).
Expectation and perception: Degani & Wiener (1990) found that, when the same task is performed repetitively, such as a checklist, the process becomes automatic. The user will create a mental model of that task, and with experience, this model will become more rigid, leading to faster information processing and the ability to divide one’s attention. While this will ultimately reduce the user’s workload, this model may adjust or even override ‘seeing what one is used to seeing’. In the study conducted by Degani & Wiener (1990), many of the pilots interviewed commented that they had seen a checklist item in the improper status, but perceived it to be in the correct status. For example, the flaps were set at zero, but the pilot perceived them to be at the 5° position as this was what they were expecting to see.
Time pressures: The speed of performing the checklist may affect the accuracy of the check. For example, if a pilot scans the item to be checked quickly due to time pressures, the accuracy of the pilot’s perception will degrade and the possibility of error will increase (Degani & Wiener, 1990).
A study was conducted by Dismukes & Berman (2010) to explore why checklists (and monitoring) sometimes fail to catch errors and equipment malfunctions. One of the study’s authors conducted 60 observation flights from the cockpit jumpseat of three airlines. These observations identified 899 deviations, of which 22 per cent were related to checklist use. Checklist deviations were mainly associated with the pre-taxi, taxi-out, descent and approach phases of flight. The identified deviations were categorised into six types and the results are presented below and in Figure 43:
Flow-check performed as read-do: Normal checklist procedures generally require pilots to check and/or set the items in a sequence or flow. After completing this flow, the checklist is performed to confirm that the critical items have been correctly actioned. However, if the flow is not performed and only the checklist is completed, items not on the checklist will be omitted.
Responding without looking: The authors described two situations when this may occur. The first is when a pilot responds from memory of having recently set or checked that item as part of the flow. Basically, the current situation may be confused with the previous situation. Secondly, a pilot may look directly at the item to be checked, but perceive it to be in the correct position when it is not. A pilot may respond without looking due to habit or when under time pressures.
Checklist item omitted, performed incorrectly, or performed incompletely: The pilot’s response is incorrectly worded, one or more elements of a multi-item response are omitted or combined into a single response, or the checklist is not verbalised completely. The research found that, while in some cases the checklist item was deferred and later forgotten, in other instances the checklist was interrupted by external influences and an item was disregarded. In contrast, on many occasions an item was omitted when no external disruption occurred.
Poor timing of checklist: The checklist is conducted at the wrong time or at a time that interfered with higher priority tasks, or it was self-initiated at the incorrect time.
Checklist performed from memory: Similar to that identified by Degani & Wiener (1990), when a pilot has completed a checklist many times, performance becomes mainly automatic, fast and fluid, and requires minimal cognitive effort. Forcing oneself to read each checklist item may be awkward, effortful and time-consuming. Therefore, pilots may be inclined to perform the checklist from memory rather than from the physical checklist.
Failure to initiate checklists: Failing to initiate a checklist may be the result of distractions, other competing demands on the pilot’s attention, or due to circumstances forcing procedures to be performed out of sequence.
Source: Dismukes & Berman (2010), modified by the ATSB
The authors also evaluated the consequence of just more than half of the flights observed. Of these, 89 per cent had no discernible outcome other than a minor reduction in the effectiveness of defences. However, 9 per cent resulted in an undesired aircraft state. These included mis‑configuration of an aircraft system from failing to set a switch correctly during a flow. Some of these items were on checklists and were missed in both the flow and checklist. This shows that experienced pilots are not immune to checklist deviations.
Related occurrences
A review of the ATSB’s occurrence database and the United States’ National Transportation Safety Board’s (NTSB) online database identified three potentially similar accidents that involved an aircraft taking off with the rudder trim not correctly set.
Australian occurrence
Loss of control, 7km west-south-west of Tamworth Airport, New South Wales, on 7 March 2005, VH-FIN (ATSB investigation 200501000)
At about 1326 Eastern Daylight-saving Time on 7 March 2005, the pilot of a Cessna Aircraft Company 310R, registered VH-FIN, took off from runway 30 Right at Tamworth Airport, for Scone, New South Wales. Approximately 1 minute after becoming airborne, the pilot reported flight control difficulties. At about 1329, the aircraft impacted the ground in a cleared paddock about 7 km west-south-west of the airport. The pilot was fatally injured and the aircraft was destroyed by the impact forces and post-impact fire.
Examination of the aircraft's mechanical flight control systems, autopilot and electric trim system did not reveal any evidence of pre-impact malfunction. Those results, however, were inconclusive due to the extensive impact and fire damage.
A periodic maintenance inspection carried out in the days before the flight resulted in the rudder trim tab being set at the full right position and possibly aileron and elevator trim tabs being set at non-neutral positions prior to the flight. There were indications that the pilot was rushed and probably overlooked the rudder and aileron trim tab settings prior to takeoff. The aircraft flight path reported by witnesses was found to be consistent with the effect of abnormal rudder and/or aileron trim tab settings.
United States occurrences
Loss of control in-flight, Hayward, California, 16 September 2009, B200N726CB, (NTSB accident number WPR09LA451)
The aircraft had just undergone routine maintenance and this was planned to be the first flight after the inspection. During the initial climb, the pilot observed that the aircraft was drifting to the left. The pilot attempted to counteract the drift by application of right aileron and right rudder, but the aircraft continued to the left. The pilot reported that, despite having both hands on the control yoke, he could not maintain directional control and the aircraft collided into a building. The aircraft subsequently came to rest on railroad tracks adjacent to the airport perimeter.
A post-accident examination revealed that the elevator trim wheel was located in the 9-degree NOSE-UP position; normal take-off range setting is between 2 and 3 degrees NOSE-UP. The rudder trim control knob was found in the full left position and the right propeller lever was found about one-half inch forward of the FEATHER position; these control inputs both resulted in the airplane yawing to the left.
The pilot did not adequately follow the aircraft manufacturer's checklist during the pre-flight, taxi, and before take-off, which resulted in the aircraft not being configured correctly for take-off. This incorrect configuration led to the loss of directional control immediately after rotation. A post‑accident examination of the airframe, engines, and propellers revealed no anomalies that would have precluded normal operation. The pilot was the only person on-board and he was uninjured.
Runway excursion, Oneida, Tennessee, 25 September 2014, Beech C90, N211PC (NTSB accident number ERA14CA458)
According to the pilot's written statement, he departed runway 05 and the airplane veered ‘sharply’ to the right. The pilot assumed a failure of the right engine and turned to initiate a landing on runway 23. Seconds after the aircraft touched down it began to veer to the left. The pilot applied power to the left engine and right rudder, but the aircraft departed the left side of the runway, the right main and nose landing gear collapsed and the aircraft came to rest resulting in substantial damage to the right wing. The pilot reported that he had failed to configure the rudder trim prior to take-off and that there were no pre-impact mechanical malfunctions or anomalies that would have precluded normal operation. The pilot was the only person on-board and he was uninjured.
After a delayed lift-off from runway 17, VH-ZCR (ZCR), was observed in a substantial sideslip to the left. Control of the aircraft could not be maintained, and shortly after, it collided with the roof of a building in the Essendon Airport, Bulla Road Precinct - Retail Outlet Centre (outlet centre).
The ATSB established that the pilot was appropriately qualified to perform the flight. The ATSB did not find any evidence of pilot incapacitation or a mechanical fault with the aircraft that contributed to the accident. Further, it was unlikely that the weather conditions influenced the development of the accident.
This analysis will examine the possible reasons for the left sideslip and its consequence on aircraft control and performance. It will also discuss the serviceability of the cockpit voice recorder (CVR), the aircraft’s take-off weight, and the operator’s flight check system. The proximity of the outlet centre to Essendon Airport will also be analysed.
The occurrence
Ground roll, flight path and aircraft attitude
Automatic Dependent Surveillance Broadcast (ADS-B) data and closed-circuit television (CCTV) footage revealed ZCR reached the required rotation speed of 94 kt when about 730 meters from the threshold of runway 17. The aircraft then remained on the ground for an additional 285 meters and rotated at 111 kt. The data also showed that, at some point between 470 m and 920 m from the threshold, ZCR’s ground track began to veer left from the runway centreline.
At rotation, a witness familiar with the aircraft type observed a yaw to the left followed by a relatively shallow climb. The ATSB’s analysis of ZCR’s flight path profile and the impact sequence found that, the aircraft had minimal sideslip for the initial climb followed by substantial sideslip for the later part of the flight and at impact. The analysis also found there was minimal left roll, not exceeding 10° for the duration of the flight.
Aircraft performance
ZCR’s actual take-off roll, to the required rotation speed of 94 kt, was about 136 m longer than the ATSB’s estimated distance of 594 m. However, the estimated distance did not account for the rolling take-off conducted by the pilot or possible drag penalties resulting from the mis-set rudder trim. Considering these factors, it was likely that ZCR accelerated as expected, with both engines producing take-off power, to 94 kt.
The ADS-B data indicated that ZCR reached a maximum height of no more than 160 ft. The ADS‑B barometric altitude data became unreliable following the onset of the sideslip at 125 ft, however, CCTV footage and Global Positioning System rate data indicated ZCR maintained a brief and shallow climb after this point. The initial climb rate was broadly consistent with the expected performance of the aircraft with the landing gear down, allowing for a minor out of balance condition, not maintaining the best rate of climb airspeed and tolerances in the data. Following the onset of the sideslip, ZCR began a descent followed by the collision with the outlet centre building.
The data also showed an increased divergence from the runway centreline when airborne and a reduction in aircraft acceleration, rate of climb, and airspeed following the commencement of the sideslip. This was consistent with the theoretical effects of a substantial left sideslip on ZCR’s performance.
Engine power
Asymmetric engine power can result in a yawing moment in a twin-engine aircraft. As a substantial sideslip was observed by witnesses and later confirmed through CCTV footage analysis, the possibility of a left engine power reduction was considered.
A reduction in left engine power would have exacerbated the left yaw, however, this was discounted as the key witnesses reported that the engine/s sounded normal and the ATSB’s dashboard camera audio frequency analysis detected no change in engine sound. In addition, engine and propeller impact evidence support the left engine producing take-off power at impact.
There was no evidence to indicate that the left yaw was the result of an asymmetric engine power condition.
Rudder
Given the substantial left sideslip and no evidence of an asymmetric engine power condition, the ATSB considered various inputs to the rudder system that could induce the sideslip. These included:
the yaw damper system
the rudder boost system
manipulation of the rudder pedals by the pilot
rudder trim position.
There was no evidence to support a yaw damper or rudder boost malfunction. In addition, the aircraft manufacturer advised that these systems could be physically overpowered by the pilot or the respective systems turned off. Application of left rudder by the pilot was also considered unlikely as there was no evidence to support, or plausible reason identified to account for the pilot applying left rudder and maintaining this input until impact.
The on-site and post on-site examinations of the aircraft found that the rudder trim was in the full nose-left position at the time of impact. This was consistent with the substantial sideslip at impact, derived from the roof collision marks. As the ATSB established that ZCR’s engines were capable of normal operation and were operating at similar settings, there was no apparent reason identified, such as an asymmetric power condition that would have required the use of full rudder trim by the pilot.
A malfunction of the rudder trim system resulting in a full nose-left setting was also considered unlikely, as the rudder trim control system is manually operated by the pilot. The system has no connection to the autopilot/yaw damper or electric trim systems.
As it was unlikely that the pilot had set full nose-left trim during or after take-off, the rudder trim was probably mis-set in the full nose-left position prior to take-off.
Mis-set rudder trim
Some previous occurrences have shown that a mis-set trim situation has occurred as a result of maintenance performed on the aircraft immediately prior to the flight. It was considered unlikely in this occurrence, however, as maintenance had not been performed on ZCR since 5 February 2017 and the aircraft had flown in the intervening time.
While the ATSB could not exclude the possibility that the rudder trim had been manipulated by unknown persons prior to the accident flight, the aircraft had been stored in a secure hangar until the previous afternoon. After this, ZCR was parked outside the hangar within the confines of the airport. Consequently, the ATSB considered actions performed by the pilot prior to take-off.
Prior to take-off, there were several opportunities in the pre-flight inspection and before take-off checklists for the pilot to set and confirm the position of the rudder trim. A review of the CCTV footage showed the pilot moving in and around ZCR when parked outside the hangar, consistent with performing a pre-flight inspection. The pre-flight inspection required the rudder trim to be set in the cockpit and the external trim tab to be visually inspected. The ATSB was unable to determine if the rudder trim was in full nose-left prior to the pilot arriving at the aircraft or if the pilot inadvertently left the trim in that position. In any case, the visual inspection of the rudder trim tab was an opportunity to identify the mis-set trim. From the footage, it could not be established if the PRE-FLIGHT INSPECTION checklist was followed completely.
Further, a review of the witness observations, ADS-B data and air traffic control audio recordings found no evidence to suggest that the BEFORE TAKEOFF (RUNUP) checks had been completed by the pilot. However, the ATSB could not discount that they were done while parked at the passenger terminal or during taxi.
The pilot’s practices with regard to setting and confirming the position of the rudder trim, such as performing a function check, could not be established. Further, while there was some evidence to indicate that the pilot may have relied on memory to perform checks rather than reference physical checklists or that he did not always complete checklists, it was unknown if this practice was applied on the accident flight.
Previous findings by Dismukes et al (2007) cited in Dismukes & Berman (2010) have found that accidents very rarely occur due to one single error but rather, from the convergence of task demands, coincidental events, organisational factors and human factors. As research has shown, a diverse range of factors can lead to checklist deviations such as distractions, interruptions, time pressures, expectations, and relying on memory. While the ATSB was unable to establish why the rudder trim on ZCR was in the full nose-left position, a distraction or interruption may have influenced the pilot’s check actions. Despite this, however, there were several opportunities in the pre-flight and before take-off checklists to check and correct the trim position.
Of note, the on-site examination of ZCR also found the flaps in the UP position, though it was the pilot’s normal practice to use APPROACH flaps for take-off. It could not be discounted that the flaps were retracted after take-off, but unlikely given the short time frame from take-off to the accident, and the pilot’s likely focus of attention on attempting to control the aircraft with the mis‑set trim condition. However, the ATSB was unable to establish if the pilot had purposely elected not to use flaps for take-off in this case or if this item was possibly missed or forgotten when performing his checks.
Loss of control
As the aircraft’s airspeed increased during the take-off roll, and airflow over the control surfaces increased, the rudder trim would have become more effective. It is likely this would have resulted in an increasing tendency for the aircraft to veer or yaw to the left. This would have required the pilot to apply right rudder pedal input to maintain the runway centreline using the nose wheel steering. The divergence left of centreline observed on the ADS-B data could support the rudder trim having an influence on ZCR’s heading during the take-off roll.
As previously established, ZCR accelerated as expected to the rotation speed of 94 kt. The aircraft was not rotated at this point, however, but rather at 111 kt and 1,015 m along the runway. For the B200 aircraft, the rotation speed is also the take-off decision speed, by which time any decision to reject a take-off must be made. For example, if an engine failure occurs at or below this speed, the take-off should be rejected. Above this speed, however, the take-off must be continued unless the pilot believes the aircraft will not fly.
It was possible that the pilot expected, either through training or previous experience, that the most likely reason for a yaw on the take-off roll was due to asymmetric engine power rather than a mis-set trim. This would not have been reflected on the cockpit instruments, however, as the engines were likely to have been operating normally. This conflicting information could have confused or distracted the pilot resulting in a delay in rotating while troubleshooting. Diagnosing an unknown issue during a critical phase of flight would have been challenging. As the aircraft approached 111 kt, the pilot may have considered that there was insufficient runway remaining to safely reject the take-off without the risk of a runway overrun. There was insufficient evidence to determine why the pilot delayed rotation from 94 kt to 111 kt or why the take-off was not rejected. This accident highlights the decision-making challenges during critical stages of flight, especially when faced with a novel or unusual problem.
After take-off, it was likely that the pilot was applying right rudder pedal in an attempt to compensate for the yaw induced by the mis-set rudder trim. The mis-set trim would have had a stronger influence on the aircraft’s heading once airborne due to the loss of directional control provided by ZCR’s nose wheel steering. While the ATSB was unable to quantify the rudder pedal forces required to overcome the mis-set rudder trim, when tested in a B250 class-D simulator, the forces could only be countered by the pilot for a short period of time. The pilot who flew the simulator commented that he was able to offset the rudder force ‘until his leg gave out’. This happened on three consecutive attempts.
Given the simulator results, once the pilot of ZCR was no longer able to counteract the rudder forces, the yaw resulting from the mis-set trim likely had a significant effect on the aircraft’s climb performance and controllability. The ATSB’s analysis of the ADS-B data and CCTV footage found a clear correlation between ZCR yawing and a reduction in performance. ZCR’s performance degraded to the point at which control could not be maintained and the aircraft subsequently collided with the outlet centre.
The adverse effect on performance and control of a mis-set rudder trim during take-off has also been shown in previous similar occurrences. While these occurrences varied, they all resulted in significant control difficulties and a loss of performance. This was consistent with the results of the B250 simulator flights, where each flight resulted in a loss of control.
Cockpit voice recorder
The ATSB publication Black box flight recorders highlights the benefits of aircraft flight recorders such as the CVR as an invaluable tool in identifying the factors behind an accident. The CVR not only records the pilot’s voice, it creates a record of the total audio environment in the cockpit area.
Checking the serviceability of the CVR is required before the first flight of the day. ZCR’s CVR did not record the accident flight as a result of the impact switch tripping on a previous flight in January 2017. Consequently, ZCR was operated on multiple flights by several pilots in the intervening period with the CVR unserviceable. The ATSB could not determine why the impact switch was not reset, however, it was likely that the checklist being used in ZCR did not alert the pilots to the requirement to check the CVR. While this had no influence on the accident, ZCR’s CVR being inoperable resulted in a potentially valuable source of information not being available to the investigation.
Aircraft take-off weight
The ATSB estimated ZCR’s maximum take-off weight was exceeded by 240 kilograms. The corresponding ground roll distance for this weight was only 5 per cent more than that calculated for the maximum take-off weight. Similarly, ZCR’s climb performance would have reduced only slightly with the additional weight. Further, while ZCR was estimated to be within the forward and aft centre of gravity limits, the ATSB was unable to determine if the overweight condition affected the pilot’s ability to control the left yaw.
ZCR’s actual take-off roll was significantly more, and its climb performance was significantly less, than performance calculations estimated. Therefore, the overweight condition alone did not result in the longer take-off roll and reduced climb performance.
The ATSB was unable to establish if the pilot had verified the aircraft’s weight and balance prior to departing. However, ZCR’s overweight condition was unlikely to have contributed to the likelihood of the accident occurring or to the severity of the outcome of the accident.
Flight Check System
In late 2015, the Civil Aviation Safety Authority (CASA) had identified that the operator did not have an approved flight check system for ZCR. CASA subsequently issued the operator with a non-compliance notice. In late 2016, CASA closed the notice on the basis that the checklist requirements stipulated in the operator’s amended operations manual met the requirements of a flight check system. However, the checklists to be used in ZCR had not been sighted by CASA at that time and the aircraft manufacturer advised the ATSB that the checklist nominated in the operations manual was not applicable to ZCR. In addition, the nominated checklist did not contain checks for supplemental equipment such as the CVR. Incorporating checks for supplemental equipment in a consolidated and easy‑to‑access cockpit checklist is a key requirement for a flight check system.
Consequently, at the time of the accident, the operator did not have an appropriate flight check system in place for ZCR. The ATSB sought further information from CASA regarding the acquittal of NCN 713808 and was advised that a Civil Aviation Regulation 232 approval was issued to the operator in 2006, however, the checklist part number nominated in the approval was not applicable to ZCR and did not contain required checks for supplemental equipment.
B200 checklists reviewed by the ASTB all included identical checks for setting and confirming trim positions. While the ATSB was unable to establish what checklist was being used by the pilot, an appropriate flight check system was unlikely to have varied the checks related to ZCR’s rudder trim. Therefore, it is unlikely that the inappropriate flight check system influenced the accident. It may, however, have been a missed opportunity to ensure the CVR was operational and would have ensured any other checks required as a result of any modifications to ZCR were included in the checklists used by the pilot.
Bulla Road Precinct – Retail Outlet Centre approval process
Although there were exceedances identified with the Essendon Airport overall obstacle limitation surfaces (OLS), ZCR did not collide with the sections of the outlet centre which breached the OLS. In addition, the outlet centre did not impinge on the required obstacle clearance zones for a departure from runway 17.
It was unlikely that the outlet centre had an influence on the severity of the accident. In the absence of the Retail Outlet Centre buildings, the aircraft’s trajectory would likely have resulted in the aircraft colliding with the Tullamarine freeway, east of the Bulla Road overpass. Dashboard camera footage provided to the ATSB indicated that there was a significant amount of traffic on the Tullamarine Freeway at the time, with potential for casualties on the ground.
The reasons for the OLS breaches were complex and related to the airport operator’s obligation to establish an OLS in accordance with applicable standards and CASA advice to, and oversight of, the airport operator. It is beyond the scope of this investigation to adequately examine the issues found with the outlet centre building approval processes. Consequently, the ATSB has initiated a separate investigation, AI-2018-010. That investigation will examine the building approval process from an aviation safety perspective, including any airspace issues associated with the development, to determine the transport safety impact of the development on aviation operations at Essendon Airport.
Findings
From the evidence available, the following findings are made with respect to the collision with terrain involving Beechcraft B200 King Air, registered VH-ZCR that occurred at Essendon Airport, Victoria on 21 February 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The aircraft's rudder trim was likely in the full nose-left position at the commencement of the take-off.
The aircraft's full nose-left rudder trim setting was not detected by the pilot prior to take-off.
Following a longer than expected ground roll, the pilot took-off with full left rudder trim selected. This configuration adversely affected the aircraft's climb performance and controllability, resulting in a collision with terrain.
Other factors that increased risk
The flight check system approval process did not identify that the incorrect checklist was nominated in the operator’s procedures manual and it did not ensure the required checks, related to the use of the cockpit voice recorder, were incorporated.
The aircraft's cockpit voice recorder did not record the accident flight, resulting in a valuable source of safety related information not being available.
The aircraft's maximum take-off weight was likely exceeded by about 240 kilograms.
Two of the four buildings within the Bulla Road Precinct Retail Outlet Centre exceeded the obstacle limitation surface (OLS) for Essendon Airport, however, the OLS for the departure runway was not infringed and VH-ZCR did not collide with those buildings.
Other findings
The presence of the building struck by the aircraft was unlikely to have increased the severity of the outcome of this accident.
Both of the aircraft’s engines were likely to have been producing high power at impact.
General details
Pilot details
Licence details:
Commercial Pilot (Aeroplane) licence
Ratings:
Multi-engine aeroplane class and instrument ratings
Endorsements:
Manual propeller pitch control, pressurisation system, retractable undercarriage and gas turbine engine; B200 endorsement issued on 8 September 2004
Medical certificate:
Valid and current Class 1
Aeronautical experience:
7,681.8 hours flying experience
Last flight review:
7 October 2016
Aircraft details
Manufacturer and model:
Beechcraft King Air B200
Year of manufacture:
1996
Registration:
VH-ZCR
Serial number:
BB-1544
Total Time In Service
6,996.7 flight hours as of 5 February 2017
Type of operation:
Charter (passenger)
Certificate of registration:
16 Dec 2013 issue date
Certificate of airworthiness:
9 Oct 2014 issue date
Maintenance release:
A 133390
Time since last maintenance:
6 flight hours
Persons on board:
Crew – 1
Passengers – 4
Injuries:
Crew – 1 (fatal)
Passengers – 4 (fatal)
Damage:
Destroyed
Left engine information
Manufacturer:
Pratt & Whitney Canada
Model:
PT6A-42
Type:
Turboprop
Serial number:
PCE- 93132
Time since overhaul:
497.7 flight hours, fitted on 11 Dec 2012
Total time in service:
13,175.3 flight hours
Right engine information
Manufacturer:
Pratt & Whitney Canada
Model:
PT6A-42
Type:
Turboprop
Serial number:
PCE-93904
Time since overhaul:
499.8 flight hours, fitted on 10 Oct 2012
Total time in service:
8,829.8 flight hours
Left propeller information
Manufacturer:
Hartzell
Model:
HC-D4N-3A
Type:
Constant speed, full feathering & reversing
Serial number:
FY-3552
Total time in service:
509.3 flight hours
Right propeller information
Manufacturer:
Hartzell
Model:
HC-D4N-3A
Type:
Constant speed, full feathering and reversing
Serial number:
FY-3554
Total time in service:
501.5 flight hours
Appendices
Appendix A – Reduction gearbox and propeller shaft assembly examinations
On-site examination determined that both engines were rotating at impact and there were no signs of pre-impact failure. During that examination, the propeller shaft fracture surfaces and reduction gear boxes (RGB)s were examined and it was determined that further detailed inspection at the ATSB laboratories might be able to assist in determining the relative power output of each engine at impact.
Propeller shafts
Visual examination of the propeller shafts from the left and right engines revealed that they had fractured at almost identical locations (Figure 44, Figure 45 and Figure 46). The fracture features from both shafts were also near-identical in appearance. Both were inclined at 900 to the shaft axis with a smooth and regular surface texture. A high-magnification examination of the fracture surfaces was completed using a scanning electron microscope (SEM), which confirmed the presence of ductile tearing from overstress associated with the accident sequence. No evidence of pre-existing defects that might have contributed to the propeller shaft fractures were identified. The fracture surfaces were consistent with torsional loads being the dominant load case that led to the failure of the shafts, rather than bending loads from ground impact.
Figure 44: Pratt & Whitney Canada PT6A-42 engine showing the general layout of the RGB in relation to the location of the propeller shaft fracture
Source: Pratt & Whitney Canada, annotated by the ATSB
Figure 45: Left and right propeller shaft fractures
Source: ATSB
Figure 46: Fractured portion of the propeller shaft from the left and right engines
Note the almost identical planar fracture surfaces. Source: ATSB
The ATSB determined that with little difference between the shaft fractures, and torsion being the dominant load case for both shafts, it was unlikely that there was a significant power difference between the two engines at impact. Further, features identified on the fracture surfaces were characteristic of significant torsional loading at the time of impact.
Reduction gearbox examination
A two-stage sun and planetary gear assembly is contained within the reduction assembly to reduce the engine rpm at maximum continuous power from 38,100 rpm at the gas-generator down to 2,000 rpm at the propeller shaft.
Tooth damage was observed on the stage-2 planetary gears from the left RGB. Three of the five gears from the stage-2 carrier displayed similar levels of tooth damage (Figure 47). Indentations and tooth bending along the planet gear tooth profile suggests significant torsional loads were transmitted into the gearbox at the time of the accident.
Scoring was present on the stage-2 carrier housing end surfaces for both the left and right engines. The scoring was the result of rotational contact between the housing and the respective carrier bearing and its bolts. Such damage is indicative of significant RPM at the time of impact.
Figure 47: Left engine RGB stage-2 planetary tooth deformation
Source: ATSB
Appendix B – Rudder trim tab actuator examination
On-site examination of the aircraft wreckage found the rudder trim tab actuator was in the full nose-left position. The actuator was examined at the ATSB laboratories in order to determine its position at impact.
Rudder trim tab actuator operation
The range of movement of the rudder trim tab is 15 degrees either side of neutral. Adjusting the trim wheel position moves the left and right cables, which in turn either extends or retracts the actuator through its range of movement (Figure 48). Tension on the right cable translates the cable forward along the actuator barrel and retracts the actuator. Conversely, tension on the left cable translates the cable rearward along the barrel and extends the actuator (Figure 49).
When the actuator is fully retracted, the rudder trim tab is at 15 degrees to the right, corresponding to an aircraft nose-left yaw. When the actuator is fully extended, the trim tab is at 15 degrees to the left, corresponding to a nose-right yaw. (Refer to the ‘Aircraft systems information’ section of this report for more details on aircraft flight controls).
Figure 48: Schematic of the B200 rudder trim actuator
Source: Beechcraft, annotated by ATSB
Figure 49: Rudder trim actuator showing the cable position along the barrel
Left image shows the actuator fully retracted and set to full nose-left position, right image shows the actuator fully extended and set to full nose-right. Source: ATSB
Initial observations
The actuator had sustained significant heat damage from the post-accident fire (Figure 50). The rod end was retracted and the guide was noted to be in the full nose-left position, and the cable was in the forward position on the drum. Measurements established that the rod end extended 43mm from the end of the housing, which correlated to a rudder trim tab deflection of approximately 15-degrees to the right. The left cable had fractured forward of the actuator. Right cable damage included kinking and wire strand fracture where it entered the actuator housings.
Figure 50: General view of the rudder trim actuator, as received from the accident site
Source: ATSB
Disassembly
Prior to disassembly, a radiographic examination of the actuator was conducted under the supervision of the ATSB. The examination enabled further understanding of the internal structure of the actuator assembly. No internal anomalies were identified.
In order to examine the internal components of the actuator with minimal disturbance to any potential witness marks that had been created during the accident sequence, the housing was sectioned between the guide and the cable drum. Once sectioned, the drum and cable were removed from the housing (Figure 51).
Figure 51: Disassembled and sectioned rudder trim actuator
Source: ATSB
Examination
Following disassembly, the components were examined using a binocular microscope. Abrasion damage was identified within the housing at the location where the right cable exited the housing, as found at the accident site. The cable was kinked and several individual wires had been overstressed, likely from contact with the housing. The location of the abrasion damage was consistent with the final wrap of cable about the drum (Figure 52 and Figure 53).
Figure 52: Actuator housing showing the location of the abrasion damage
Sliding contact from the right cable (left image) produced abrasion damage within the housing (right image). Source: ATSB
Figure 53: Abrasion damage to the housing attributed to sliding contact from the right cable
Source: ATSB
In order to further characterise the damage, the actuator housing was examined at high magnification using a SEM. The examination confirmed that the damage was consistent with abrasion from sliding contact with the cable (Figure 54 and Figure 55). No additional damage or features were observed on the actuator drum housing to indicate the actuator was in any position, other than fully retracted at the time of the accident.
Cable damage supports both the left and right cables being under high tension as a result of impact forces. In addition, the lack of any additional abrasion damage to the housing from cable contact indicates that the cable had not spooled through the actuator drum during the accident sequence.
Figure 54: High magnification SEM image of the abrasion damage
Source: ATSB
Figure 55: Higher magnification SEM image of the abrasion damage
The red lines highlight the abrasion and scoring resulting from sliding contact between the trim cable and the actuator housing. Source: ATSB
Sources and submissions
Sources of information
The sources of information during the investigation included:
Textron Aviation Inc.
Pratt & Whitney Canada
Hartzell Propeller
the Bureau of Meteorology
the Civil Aviation Safety Authority
Airservices Australia
Victoria Police
the Victorian Institute of Forensic Medicine
the Metropolitan Fire Brigade
a number of witnesses
Corporate & Leisure Aviation records
numerous B200 pilots
Essendon Fields Airport
Bulla Road Precinct Retail Outlet Centre
References
CASA (2015), A review of the case for change: Scientific support for CAO 48.1 Instrument 2013. CASA SMS & HF Section – Fatigue Management Standard Division.
Degani, A. & Wiener, E.L. (1990). Human Factors of Flight-Deck Checklists: The Normal Checklist (NASA Contractor Report 177549). Washington, DC: National Aeronautics and Space Administration.
CASA Air Operator’s Certificate Handbook Volume 2 – Flying Operations (February 2018 Version 2.1).
Civil Aviation Regulations 1998 (Cth), Volume 3, regulation 232 - Flight check system (Austl.).Dismukes, K.R. & Berman, B. (2010). Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail (NASA TM 2010-216396). Washington, DC: National Aeronautics and Space Administration.
Hawkins, F.H. (1993). Human factors in flight (2nd Ed.) Aldershot, England: Ashgate Publishing.
House of Representatives Standing Committee on Communication, Transport and the Arts, (1999), Beyond the Midnight Oil: Managing Fatigue in Transport.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the aircraft owner and maintainer, Textron Aviation Inc., Pratt & Whitney Canada, Hartzell Propeller, the Bureau of Meteorology, the Civil Aviation Safety Authority, the Department of Infrastructure, Regional Development and Cities, Essendon Fields Airport, Bulla Road Precinct Retail Outlet Centre, the Victorian Institute of Forensic Medicine, the Transport Safety Board of Canada, the US National Transportation Safety Board and the US Federal Aviation Authority.
Submissions were received from the aircraft owner and maintainer, Textron Aviation Inc., Pratt & Whitney Canada, Hartzell Propeller, the Civil Aviation Safety Authority and Essendon Fields Airport. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 29/03/2017
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
The occurrence
On 21 February 2017, the pilot of a Beechcraft King Air B200, registered VH-ZCR, was conducting a flight from Essendon Airport, Victoria to King Island, Tasmania. On board were the pilot and four passengers. The weather was fine with a recorded wind speed of 5 kt (9 km/h) from the north‑north‑west and a temperature of 12 °C.
Witnesses familiar with the aircraft type reported that the take-off roll along runway 17[1] was longer than normal. After becoming airborne, the aircraft was observed to yaw[2] left. The aircraft performed a shallow climbing left turn while maintaining a relatively level pitch[3] and roll[4] attitude. Airservices Australia Automatic Dependent Surveillance Broadcast (ADS-B) data[5] indicated the aircraft reached a maximum height of approximately 160 ft above ground level while tracking in an arc to the left of the runway centreline (Figure 1). The aircraft subsequently collided with a building in the Essendon Airport retail precinct.
The pilot and passengers were fatally injured, and the aircraft destroyed. Additionally, a number of people on the ground received minor injuries.
Figure 1: Aircraft track from Airservices Australia ADS-B data. All heights above ground level
Source: Google earth, modified by the ATSB
Wreckage and impact information
The aircraft collided with the roof of the building and associated concrete parapet before coming to rest in the building’s rear car park (Figures 2 and 3). Examination of the significantly fire- and impact‑damaged wreckage determined that, at impact the:
aircraft was configured with 10° of flap
landing gear was in the extended and locked position.
Examination of the building roof showed evidence of propeller slash marks and nose and main gear tyre marks (Figure 3). Those marks were consistent with the aircraft having significant left yaw and a slight left roll at initial impact.
Figure 2: Accident site overview
Source: Metropolitan Fire Brigade (Melbourne), modified by the ATSB
On-site examination of the wreckage did not identify any pre-existing faults with the aircraft that could have contributed to the accident.
The left and right engines separated from their mounts during the impact sequence. Both engines had varying degrees of fire and impact damage. The engines were removed from the accident site to a secure facility where they were disassembled and inspected by the ATSB with assistance from the engine manufacturer. That examination found that the cores of both engines were rotating and that there was no evidence of pre-impact failure of either engine’s internal components. However, a number of engine components were retained for further examination and testing.
The propellers separated from the engines during the impact sequence. Both propellers exhibited evidence of rotation and have been retained by the ATSB for detailed examination. The ATSB also retained several airframe components, documents and electronic devices for further examination.
Figure 3: Accident site building roof overview
Source: Metropolitan Fire Brigade (Melbourne), modified by the ATSB
Recorded information
Cockpit voice recorder
A Fairchild model A100S cockpit voice recorder (CVR), part number S100-0080-00 and serial number 01211, was fitted to the aircraft. This model of recorder uses solid-state memory to record cockpit audio and has a recording duration of 30 minutes. CVRs are designed on an ‘endless loop’ principle, where the oldest audio is continuously overwritten by the most recent audio. Apart from pilot speech and radio transmissions, CVRs can record control movements (for example flap and gear levers), switch activations, aural warnings and background sounds such as propeller and engine noise.
The aircraft’s fire‑damaged CVR was recovered from the accident site and transported to the ATSB’s technical facility in Canberra, Australian Capital Territory on 23 February 2017 for examination and download (Figure 4).
Figure 4: Comparison of an undamaged Fairchild model A100S CVR (top) with the CVR from VH-ZCR (bottom)
Source: ATSB
The CVR from VH-ZCR was disassembled and the memory board was removed from inside the crash-protected memory module. The memory board was undamaged (Figure 5).
Figure 5: Memory board (removed from inside the crash-protected module)
Source: ATSB
The CVR was successfully downloaded however, no audio from the accident flight was recorded. All the recovered audio was from a previous flight on 3 January 2017. The ATSB is examining the reasons for the failure of the CVR to operate on the accident flight.
Air traffic control audio
Examination of the recorded air traffic control radio calls for Essendon Tower on 21 February 2017 revealed that, shortly after take-off, the pilot broadcast a MAYDAY call.[6] The pilot repeated the word ‘MAYDAY’ seven times within that transmission. No additional information regarding the nature of the emergency was broadcast.
Further investigation
The investigation is continuing and will include:
examination of both propellers to determine the blade angles at impact, their pre-impact condition and to assess the impact damage
further examination of a number of retained engine and airframe components
further interviews with a number of witnesses and involved parties
further analysis of numerous witness reports
review of the aircraft’s maintenance and operational records
review of the meteorological conditions at the time
review of the approval process for the building that was struck by the aircraft
analysis of aircraft performance and other operational factors
review of the pilot’s medical and flying history
review of the operating processes and approvals
determining the reasons for the failure of the CVR to record during the accident flight
further analysis of recorded information, including: - Automatic Dependent Surveillance Broadcast data - dash camera and other video footage provided by witnesses - closed-circuit television video footage - air traffic control audio recordings.
Identification of safety issues
Should any significant safety issues be identified during the course of the investigation, the ATSB will immediately bring those issues to the attention of the relevant authorities or organisations. This will allow those parties to develop safety action to address the safety issues. Details of such safety issues, and any safety action in response, will be published on the ATSB website at www.atsb.gov.au.
_________ The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 9 February 2017, the passenger cruise ship Norwegian Star departed Melbourne, Australia, on a scheduled cruise to Dunedin, New Zealand. There were 2,113 passengers and 1,017 crew on board. On departure, the starboard propulsion unit was operational following its recent repair, and the port propulsion unit was under repair following its failure on 24 January. This meant that the ship was operating only with the starboard propulsor.
At about 0134 on 10 February, Norwegian Star was about 22 NM south-west of Cape Liptrap, Victoria, Australia, when the starboard propulsion unit failed. Propulsion could not be restored and tugs were deployed from Melbourne to tow the ship back to Melbourne. The ship arrived back without further incident at about midnight on 11 February.
What the ATSB found
The ATSB found that Norwegian Star lost function of its starboard propulsion as a result of the failure of the recently repaired starboard exciter. The configuration of the exciter unit had been modified as part of its repair, and the unit failed as a result of an error in the design of the modification. Insufficient clearance had been provided to allow for movement and thermal expansion of components during the unit’s operation. This error was not detected during the design, installation and trialling of the modified exciter unit.
The need for the repair of the starboard exciter unit had followed its failure on 11 December 2016. The failure of the unit in its original (as-built) configuration, and the subsequent failure of the original port exciter unit on 24 January, were both probably due to a breakdown in electrical insulation. Processes for the monitoring of exciter unit condition were ineffective in detecting deterioration prior to unit failure.
The ship operator’s decision to sail from Melbourne with only the starboard propulsion unit did not breach any regulatory requirement and was based on confidence in the reliability of the repaired starboard unit. While the repaired exciter was of proven design concept, the detailed design specific to this propulsion system application had not previously been used in-service.
What's been done as a result
The ATSB has issued recommendations to the ship operator Norwegian Cruise Line Holdings and the equipment manufacturer ABB Industry Oy to review the processes for monitoring the condition of brushless exciter units in Azipod installations, considering the mechanism of failure of the port and starboard brushless exciter units on Norwegian Star.
Safety message
Operation of newly designed equipment without redundancy increases operational risks. Equipment manufacturers and ship operators must apply extra diligence when designing, installing and operating modified equipment, especially safety critical equipment.
The passenger cruise ship Norwegian Star
The occurrence
Norwegian Star
Norwegian Star was scheduled to cruise South-East Asia towards the end of 2016, moving to the Oceania region in January 2017, and then cruising East Asia from March 2017.
The Norwegian Star was fitted with two electric driven, podded propulsion units[1] (Azipod)[2] giving it a maximum speed of about 25 knots.[3]
Prior to arriving in Melbourne
On 11 December 2016, Norwegian Star (cover photo) was preparing to depart Singapore when the starboard propulsion unit circuit breaker tripped, with the alarm panel indicating an ‘overcurrent earth failure’. Inspection of the exciter unit for the starboard propulsion motor found evidence of flashover marks on the stator winding.
Repair of this exciter unit to its existing configuration would require the ship to be taken out of service. Instead, it was decided to modify the starboard exciter unit from the brushless system to a slipring and brush system. This modification and repair could be done without taking the ship out of service.
While the starboard exciter unit was being repaired, Norwegian Star was capable of operating with one propulsion unit but at a reduced maximum speed of between 13 and 16 knots. The ship’s schedule was amended to allow for the reduced speed and approvals were granted by relevant authorities for the ship to continue in service.
Repair was ongoing whilst the ship continued a program of cruises between Singapore and Hong Kong using its port Azipod. The installation of the modified starboard exciter unit was completed on 14 January 2017 and tested at full load between 14 and 20 January. The starboard Azipod was tested and passed by the Classification Society[4] on 20 January 2017 in Singapore.
On 22 January 2017, Norwegian Star resumed normal operations with both propulsion units operational, departing Singapore for Darwin, Australia, stopping in Indonesia. Then, on 24 January 2017, the port Azipod exciter unit failed. The failure of the port unit appeared similar to that of the starboard unit in December and would also require repair.
The ship was now operating solely with the modified starboard propulsion unit and arrived in Darwin on 29 January 2017. The ship departed Darwin and called at Cairns and Sydney before arriving in Melbourne on 8 February 2017. In Melbourne, technicians from the Azipod manufacturer were on board to repair the port exciter unit using the same modification as had been made to the starboard unit. This repair had not been completed when the ship departed Melbourne.
The incident
Norwegian Star departed Melbourne on the evening of 9 February 2017 bound for Dunedin, New Zealand with 2,113 passengers and 1,017 crew. The ship exited Port Phillip Heads (the Heads) at 2118[5] and at 2133 dropped off the pilot and proceeded into Bass Strait (Figure 1).
At 0134 on 10 February 2017, Norwegian Star was about 22 NM south-west of Cape Liptrap[6] (on the south coast of Victoria) when the starboard propulsion unit failed. Inspection found arcing and pitting damage on the outer slipring of the modified exciter unit, and propulsion could not be restored.
Norwegian Star was disabled and drifting in an approximately north-north-easterly direction in about 75 m depth of water. The wind at that time was from the south-east at about 5 knots, the sea condition was slight and the swell about one metre from the south-west. The current was negligible. The ship’s bow thrusters were used to manoeuvre the ship’s head into the wind, reducing the rate of drift to about one knot.
The recovery
The owners and relevant shore authorities were informed and arrangements made to deploy tugs to tow the ship back to Melbourne. The Australian Maritime Safety Authority (AMSA) coordinated the recovery operation.
Drift modelling predicted that the earliest the ship might run aground was at about 0630 on 11 February near Cape Liptrap. The ship made contingency arrangements to anchor when the depth of water reduced to 50 m at which point the ship would be about 5 NM from the nearest land.
At about 1957 on 10 February, the tug Hastings (50 tonnes bollard pull, 473 gross tonnage) arrived and at about 2048 the tow line was connected. At 2121 Hastings commenced towing Norwegian Star towards Port Phillip Heads at a speed of about 4.5 knots. The tug Tom Tough (46 tonnes bollard pull, 396 gross tonnage) arrived at 2212 and accompanied the tow.
At about 1107 on 11 February 2017, Tom Tough was made fast to the stern and the speed of the tow reduced. At about 1338 Norwegian Star arrived at the pilot boarding ground and two pilots boarded the ship.
Norwegian Star entered Port Phillip Heads at about 1506, at a speed of about 4 knots. The tide was at slack water. At 1528, a third tug, Svitzer Marysville (68 tonnes bollard pull, 250 gross tonnage), was made fast on the port quarter to assist with manoeuvring the ship. The tow then continued in Port Phillip Bay without incident and the ship was berthed at Station Pier at about 2358.
Resumption of cruise operations
The ship remained in Melbourne while both the port and starboard exciter units were repaired, incorporating modifications to the slipring and brush exciter.
Both propulsion units were commissioned and after a series of sea trials within Port Phillip Bay, detention notices were revoked by Port State Control, permitting the ship to resume its voyage. Norwegian Star departed Melbourne for New Zealand on 14 February.
Figure 1: The track of Norwegian Star from Port Phillip Bay until its loss of propulsion, and its drift before being towed back to Melbourne
Source: Australian Hydrographic Office ENC Charts AU 439144 and 439145 [Inset: Google Map of Australia], with annotations by Chief Investigator, Transport Safety
At the time of the incident, Norwegian Star was owned and operated by Norwegian Cruise Line Holdings Ltd (NCLH), headquartered in Miami, Florida, United States of America. The company began operations in 1966 under the name Norwegian Caribbean Line and in 1987 changed to its current name. NCLH operated a fleet of 15 passenger ships and provided passenger cruises throughout the world.
Norwegian Star
Norwegian Star was built in November 2001 at the Meyer Werft shipyard in Papenburg, Germany. It was built in accordance with the DNV[7] Rules for Ships, and complied with the requirements of SOLAS[8] for structural design, navigational equipment and machinery installations. The ship was registered in the Bahamas and classed[9] with DNV GL.[10]
Norwegian Star has a gross tonnage of 91,740, an overall length of 294.13 m, maximum breadth of 38.10 m and a summer draft of 8.60 m. Electric power, including for ship propulsion, was supplied by four diesel generators providing a total output of 58,800 kW.
The propulsion system consisted of two[11] independent electric-driven 5-bladed ABB V02300 Azipods. Each unit delivered 19,500 kW of propulsion power at 137 rpm for a maximum ship speed of about 25 knots. The ship was also fitted with three bow thrusters, having a total output of 7,080 kW.
The ship’s certification was current and all crew were appropriately qualified for the positions they held.
Propulsion
NCLH fleet installations
Ten of the 15 ships in the NCLH fleet were fitted with Azipod propulsion systems, with Norwegian Star having the fleet’s oldest Azipod installation.
Azipod
Norwegian Star was fitted with two Azipods, mounted port and starboard near the stern. The ship could be propelled using either Azipod or both combined. Each Azipod was independent of the other’s operation, and complied with SOLAS and classification society requirements for propulsion and steering. At sea, the propulsion units were normally operated concurrently.
Azipod propulsion is a gearless, steerable propulsion system with the electric motor installed in a submerged pod beneath the ship’s hull. The Azipod can be rotated through 360 degrees, removing the need for a rudder. On the Norwegian Star, propellers were fixed pitch mounted face forward, in a pulling configuration (Figure 2).
Figure 2: Azipod installation
Source: ABB Industry Oy with annotations by Chief Investigator, Transport Safety
Within the submerged pod, key components included the propulsion motor and the exciter unit (Figure 3).
Figure 3: Arrangement of components within the Azipod
Source: ABB Industry Oy with annotations by Chief Investigator, Transport Safety
Propulsion motor and excitation
The propulsion motors were of synchronous[12] type mounted on the same shaft as the propeller. The propeller speed was controlled by varying the motor speed. This was achieved by varying frequency of the motor stator supply. To ensure the motor operated at maximum efficiency, the rotor magnetic field was also varied with the motor speed. A much smaller AC generator (exciter) of 135 kW was mounted co-axially adjacent to the motor, and this provided the field excitation for the synchronous motor through a rotating rectifier (Figure 3). The exciter was brushless, and varying the exciter stator voltage provided control of its rotor voltage and hence the excitation for the motor’s magnetic field. Varying excitation provided the opportunity to optimise the efficiency of the synchronous motor. The advantages of a separate machine providing brushless excitation included reduced maintenance and lower power requirements for motor field control.
Azipod inspection and maintenance
Shipboard maintenance of Azipod equipment was generally carried out when the ship was in port due to restrictions accessing the pod during ship operation.
The ship’s crew undertook a series of regular checks, testing and maintenance of the propulsion systems. These tasks included monitoring bearing vibration, metal scanning of bearing lubrication oil, analysis of oil for water contamination, propeller and thrust bearing filter checks and checking of Azipod electrical and automation systems. Bearing lubrication oil filters were changed every six months. The recorded shipboard maintenance also indicates a fortnightly check of the propulsion system logs and a monthly switchover of the exciter encoder switch.
Due to the specialist nature of the propulsion equipment, part of the inspection and maintenance was undertaken by the equipment manufacturer, ABB Industry Oy (ABB). Insulation resistance of the exciter units was measured at 12 monthly intervals at the same time as the main propulsion motors. Between 26 and 30 August 2016, exciter units were inspected and insulation resistance tested, without any defects or deficiencies identified. During these inspections it was also noted that pod interiors were clean and dry. ABB also conducted acoustic emission measurements of slew bearings, borescope inspections and vibration analysis of Azipod shaft line bearings. All readings were within design limits.
The ship inspection records did not identify any deficiencies or defects with the Azipod units in the lead up to the starboard exciter failure on 11 December 2016. NCLH also reported that the exciters were classed as ‘ship’s life’ and had not been subjected to any major maintenance work since their installation.
Conversion from brushless to slipring exciter
Modification
When the brushless starboard exciter unit failed on 11 December 2016, NCLH (in consultation with ABB) decided to repair the unit by modifying it from a brushless system to a slipring unit with brushes. The modification to a slipring unit involved the installation of two concentrically mounted sliprings on the existing exciter rotor, and diode bridge assemblies, carbon brush assembly and dust removal unit mounted on the stator hub assembly (Figure 4). The effect of the modification was to bypass the defective exciter and supply the field of the synchronous motor directly from a new external variable DC supply.
Figure 4: Modified starboard exciter unit with sliprings and brushes
Source: ABB Industry Oy with annotations by Chief Investigator, Transport Safety
Justification for modification
Repair of the exciter unit to the modified design could be achieved with the ship remaining in service, whereas repairing the unit to its original brushless configuration would require the Norwegian Star to be removed from service.
ABB had already undertaken preparatory, ship non-specific, design work for the modification should it be required. As a result, the design modification could be quickly rolled out for ship-specific implementation. This type of modification had not previously been used on an Azipod, but had been fitted to Fixipod[13] type propulsion systems.
Preparatory design
ABB commenced a project for emergency exciter modification for Azipods on 8 September 2016, and this was completed on 2 December 2016. ABB reported that at that time there was no target ship for installation.
Design modification for Norwegian Star
For application on Norwegian Star following the failure of the starboard unit, the pre-approved generic modification drawings were updated specific to Norwegian Star and approved for installation on 23 December 2016.
ABB had documented processes for design, review and approval of technical documentation. The modification was signed-off in line with these procedural steps.
ABB advised that the configuration could be used for an unlimited period of time, although maintenance would be more demanding. Because of this higher maintenance, ABB had recommended reinstalling the original brushless arrangement at the ship’s next dry docking.
DNV GL
The Classification Society
DNV GL is an international accredited classification society headquartered in Oslo, Norway. It was created in 2013 from a merger between Det Norske Veritas (Norway) and Germanischer Lloyd (Germany).
DNV GL rules are independent standards that consist of technical and procedural requirements adopted by the Society as the basis for classification of ships and offshore structures. Classification is a service which comprises the development and maintenance of Rules, and the verification of compliance with the Rules throughout a vessel’s life. A certificate of classification is issued to confirm compliance with the Society's Rules as applicable at the time of survey.
Permission to sail with one propulsion unit
Following first failure
After the first (starboard) Azipod failure on Norwegian Star in December 2016, NCLH provided DNV GL with documentation (prepared by ABB) confirming that the ship had full manoeuvrability with only the port propulsion unit operating, and a reduced maximum speed.
DNV GL satisfied themselves that the port Azipod was fully functional in accordance with SOLAS and Class requirements and permission was granted to operate with one propulsion unit. In conjunction with this approval, DNV GL imposed a Condition of Class for the starboard Azipod to be returned to operational status by 31 January 2017.
Following second failure
When the port Azipod subsequently failed in January, DNV GL were satisfied that the modified starboard Azipod was capable of providing full manoeuvrability to Norwegian Star. Permission for Norwegian Star to continue operating with just the starboard Azipod was granted and a Condition of Class was again imposed, to have the port exciter unit operational by 31 March 2017.
Exciter unit modification
DNV GL advised that they were required to be informed of the modification to the exciter unit, and performance was to be verified by testing after installation.
Accordingly, NCLH provided DNV GL with the exciter modification drawings and the performance of the modified unit would be tested. DNV GL was satisfied with the manufacturer’s assurances that the modifications were a proven and used method to excite a motor. The earlier imposed Condition of Class (following the starboard unit failure in December) was removed after the modified starboard Azipod was tested at full load.
Bahamas Maritime Authority
The Bahamas Maritime Authority (BMA) is an agency that registers ships under the Bahamas Ship Register. The function of the Authority is to enforce ship safety requirements to ensure that ships under the Bahamian flag comply with international standards as prescribed by the International Maritime Organisation (IMO). Over 50 million Gross Tonnes of shipping flies the Bahamas flag.
The BMA had no objection to Norwegian Star operating with one Azipod while the other was being repaired, provided that the ship could manoeuvre and go astern utilising one Azipod only and subject to the special conditions outlined by DNV GL.
Port State Control
Port State Control (PSC) is an internationally agreed regime for the inspection of foreign ships in other national ports. The remit of these officers is to investigate compliance with the requirements of international conventions of the IMO (for example, SOLAS). Inspections can involve checking that the ship is manned and operated in compliance with applicable international law, and verifying the competency of the ship's master and officers, and the ship's condition and equipment. PSC has the authority to detain a ship until it is satisfied that the ship is in a seaworthy condition and complies with the requirements of the applicable international conventions.
PSC inspections at Singapore and Hong Kong did not record any deficiencies against Norwegian Star sailing with only one operational propulsion unit, other than PSC Hong Kong advising that DNV GL should inform the Flag State.
The Australian Maritime Safety Authority (AMSA) is responsible for PSC in Australia. Norwegian Star was inspected by AMSA on 6 February when it berthed in Sydney. AMSA did not find anything to suggest the ship was unseaworthy. It was noted that the ship could maintain a speed of at least 12 knots with one propulsion unit running and maintain safe steering and navigation. AMSA was satisfied that a Condition of Class was issued to rectify the failed port propulsion unit by the end of March 2017 and that the Flag State had no objection to Norwegian Star operating with one Azipod.
AMSA conducted another PSC inspection when the ship berthed in Melbourne on 9 February. Six minor deficiencies were noted, one of which was that the voyage plan did not document that operating on one Azipod affected ship speed. All six deficiencies were rectified to the satisfaction of AMSA prior to the ship’s departure on 9 February.
When Norwegian Star was towed back to Melbourne, AMSA issued a Detention Notice on the ship. The Notice was revoked once both Azipods had again been repaired and had passed sea trials.
Inspection of the starboard and port exciter units after their first-time failures (on 11 December 2016 and 24 January 2017 respectively) found evidence of flashover marks on the stator windings in both units (Figure 5), suggesting a similar cause of the flashover and failure.
Figure 5: Flashover damage from the port and starboard exciter units
Source: NCLH with annotations by Chief Investigator, Transport Safety
There are a number of factors that can lead to flashover, including insulation breakdown and insulation damage as a result of bearing failure. Post-incident inspection by Norwegian Cruise Line Holdings Ltd (NCLH) found no evidence of bearing failure and therefore this has been discounted as a possible failure mechanism.
A reduction in the effectiveness of the electrical insulation on stator or rotor windings can result from age, heat, moisture, accumulation of dust and dirt or component stress due to excessive voltage. The auxiliary systems installed on Norwegian Star to mitigate the risk of insulation deterioration included ventilation, cooling, space heating and dust extractor systems. They were reportedly operating satisfactorily and routine inspections did not identify any deficiencies with the equipment. Therefore, there was no evidence to indicate that a defect in these auxiliary systems contributed to the exciter unit failures.
Following the flashover incidents on Norwegian Star, NCLH inspected the exciter units on other Azipod installations within their fleet and found surface cracks on the stator insulation on several units. ABB Industry Oy (ABB)expressed the view that these cracks were only in the surface lacquer and so should not compromise electrical insulation.
NCLH advised that further examination of the failed components cannot take place until removal of the units during ship dry docking. Closer examination of the units at that time may provide additional information on the failure mechanism. However, at the time of reporting neither NCLH nor the equipment manufacturer (ABB) has identified the mechanism of failure of the brushless units.
Based on the evidence available, deterioration of the insulation material remains the most probable cause of the failures of the brushless exciter units. Norwegian Star’s Azipods were the oldest in the fleet and had the highest running hours. Age, heat, moisture and contamination are all possible factors that may have contributed to this deterioration.
Monitoring of insulation resistance
Norwegian Star’s planned maintenance system included periodic inspection, testing and maintenance of the Azipod and its auxiliary systems by the ship’s crew and the equipment manufacturer. The manufacturer’s maintenance instructions for the exciter units included the annual measurement of the insulation resistance of the exciter rotor and the stator (500 V DC megger).[14] The most recent annual assessment of the exciter insulation was in August 2016 with results indicating satisfactory insulation.
Notwithstanding this insulation monitoring regime, both Azipod exciter units experienced a flashover failure that was probably the result of a breakdown in electrical insulation. The regime for monitoring exciter condition was therefore ineffective for exciter units of this type, age, running hours and operating environment.
Check of port unit following failure of starboard unit
After the starboard exciter unit failure on 11 December, Norwegian Star remained in port for two days while a suitable repair was arranged and Flag State and classification society permission to sail with one Azipod was obtained. It was reported that neither the ship’s engineers nor the manufacturer’s representatives could ascertain the cause of the flashover immediately after its failure, and an investigation was commenced by ABB.
NCLH reported that the port exciter was inspected by the on-board staff after the failure of the starboard exciter unit. However, no insulation resistance measurements were taken of this unit at the time of the inspection and so an opportunity to identify possible deterioration in insulation was lost. This decision may have been influenced by the expectation of high reliability of these units based on previous experience.
Modified exciter unit
Failure mechanism
On 10 February 2017 while Norwegian Star was transiting Bass Strait, the modified exciter unit installed on the starboard propulsion unit failed, rendering the ship without propulsion. Pitting on the outer slipring was observed (Figure 6). Brush holders were also damaged (Figure 7).
Figure 6: Arcing damage on the outer slipring
Source: ABB Industry Oy with annotations by Chief Investigator, Transport Safety
Figure 7: Arcing damage to brush holders
Source: ABB Industry Oy with annotations by Chief Investigator, Transport Safety
Detailed examination and assessment by ABB found that the damage to and failure of the unit was the result of insufficient clearance between the brush holder and sliprings. It was identified that axial movement and thermal expansion of components was more than had been allowed for in the design.
Design error
It was identified by ABB that there was an error made in the design of the modified exciter unit that was not identified during the design review process. Clearance between the brush holders and the sliprings was less than required to accommodate the axial movement and thermal expansion of components.
Process
ABB advised that a slipring type unit had not been used with the Azipod configuration before, but had been used on their Fixipod propulsion units.
A project to design a modification to their Azipod exciter units was initiated in September 2016. The material developed during this project was used as the basis for the ship-specific application on Norwegian Star. ABB did not provide the reasons for initiating this project.
ABB’s internal quality management system provided for the processing of technical documents through several stages including design, review and approval. Documents received from ABB indicate that they complied with their quality management system. However, the error in the clearance between sliprings and brush holders was not identified during the review and approval stages of the design development.
Post-installation testing and monitoring
ABB’s maintenance instructions for the modified slipring and brush exciter unit specified fortnightly visual inspections that included:
cleaning of carbon dust and other contaminants
ensuring that the carbon brushes were free to move within their holders
measuring brush wear.
The modified starboard exciter was inspected on 29 January 2018 and again on 05 February 2018. During inspections, surface grooving, carbon dust and an oil film forming a ‘carbon grease’ were observed on the sliprings. Actions were initiated to improve dust extraction, but the cause of the grooving was not investigated further. It is probable that the grooving was the result of contact between brush holder and slipring, and an indicator of the inadequate clearance provided in the design.
Classification society approval
DNV GL’s design and installation approval processes for conversions, modifications or alterations of equipment on ships is governed by internal policies and processes that are developed to align with international statutory regulations, conventions and codes. The DNV GL rules specified that some modifications were subject to classification society approval and others were not subject to such approval. Modifications not normally subject to approval but considered to affect safety or main functions were to be considered case-by-case.
DNV GL advised that the design of an excitation system was not subject to any separate requirements, approval or certification and was covered under the certification of the complete electrical machine. The classification society was to be informed of any intended modifications.
Consistent with these provisions, when the brushless starboard exciter failed and the decision was made to replace it with the slipring type, NCLH provided DNV GL the design and installation drawings developed by ABB. DNV GL was satisfied with the design, installation and tests conducted on the modified system.
Permission to sail with one propulsion unit
Continued passenger voyages on one Azipod
Following first failure
Each Azipod on Norwegian Star complied with SOLAS regulations for ship propulsion (manoeuvring and stopping) and steering. Therefore, when the starboard Azipod failed (for the first time), NCLH applied for, and was permitted to sail Norwegian Star with just the port Azipod operational, while the starboard exciter unit was being repaired. The decision to sail with one operational Azipod was probably influenced by past reliability of the port Azipod.
Following second failure
The starboard Azipod was tested after the modification and a trialling and monitoring regime established that satisfied the ship’s classification society. Regulatory authorities also did not object to proceeding with a single propulsion unit that complied with SOLAS requirements. The decision to proceed was therefore consistent with class and regulatory requirements.
The decisions by NCLH and other parties was on the basis that the alternative excitation system was a proven and used method to excite a motor. Whereas the design concept was proven, the detailed design for the Norwegian Star application was not proven in-service. In hindsight, the decision to proceed with normal cruise operations after the second failure, using a single operational pod with a modified exciter installation of unproven operational service was not prudent.
Safe Return to Port regulations
In December 2006, the International Maritime Organisation (IMO) adopted the Safe Return to Port (SRtP) regulations, to place more emphasis on the ability of a ship to safely return to port unsupported after a fire or flooding casualty and for improved survivability in the event of such a casualty. The regulations cover all systems deemed necessary to ensure a safe voyage back to port following a casualty, including propulsion and steering.
The SRtP regulations became mandatory (for new ships) in July 2010 and apply to passenger ships having a length of 120 m or more, or having three or more vertical fire zones. The regulations do not apply to Norwegian Star as it was built prior to 2010.
The application of the regulations into the future will potentially improve passenger ship machinery and system redundancy and ‘get home’ capability. On the matter of whether a post-2010 SRtP compliant ship would be permitted to depart port with compromised propulsive redundancy, DNV GL advised that it is in dialogue with the key passenger ship Flag States and ship owners to establish a common approach. The approach would likely include consideration of the impact of any loss in capability on SRtP compliance, the operational situation (such as the planned route and weather conditions) and countermeasures that may be taken to reduce the operational risk.
From the evidence available, the following findings are made with respect to the loss of propulsion of the passenger cruise ship Norwegian Star that occurred in Bass Strait, about 22 NM south-west of Cape Liptrap on 10 February 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The processes for monitoring the condition of the brushless exciter units’electrical insulation were ineffective in detecting deterioration prior to unit failure. [Safety Issue]
The brushless exciter unit for the starboard Azipod failed on 11 December 2016. The electrical flashover was probably the result of a deterioration in the electrical insulation between the exciter components.
The inspection of the port unit, following the flashover failure of the starboard exciter unit, did not include insulation testing of the exciter stator.
The brushless exciter unit for the port Azipod failed on 24 January 2017. The cause of the failure was similar to that of the starboard unit that failed on 11 December 2016.
There was an error made in the design of the modified exciter unit used in the repair of the starboard propulsion unit. Clearance between the brush holders and the sliprings was less than required.
The cause of grooving found on the sliprings of the modified starboard exciter unit was not explored nor remedied prior to the failure of the unit. The slipring grooving was probably a precursor event to the unit’s failure.
The ship operator decided to continue with passenger voyages using a single propulsion unit with a modified exciter unit that had limited operational service.
The modified exciter unit failed on 10 February 2017 resulting in Norwegian Star being adrift in Bass Strait.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the marine industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
Processes for the monitoring of the exciter unit insulation resistance
Safety issue description: The processes for monitoring the condition of the brushless exciter units’ electrical insulation were ineffective in detecting deterioration prior to unit failure.
Sources and submissions
Sources of information
Investigators from the Chief Investigator, Transport Safety (Victoria) under delegation from the Australian Transport Safety Bureau attended Norwegian Star on 14 February 2017 while the ship was in Melbourne, Victoria, and again on 22 February 2017 while the ship was in Sydney, New South Wales.
The sources of information during the investigation included:
Ship owners, Norwegian Cruise Line Holdings Ltd (NCLH)
Azipod manufacturer, ABB Industry Oy (ABB)
Classification Society, DNV GL
Flag State, The Bahamas Maritime Authority (BMA)
Port State Control, Australian Maritime Safety Authority (AMSA)
Victorian Ports Corporation Melbourne (VPCM).
References
International Maritime Organisation, 2014, The International Convention for the Safety of Life at Sea (SOLAS), 1974, as amended, IMO, London.
International Association of Classification Societies, 2015, Classification Societies – what, why and how?, IACS, London.
Det Norske Veritas, 1997, DNV Rules for Classification of Ships January 1997, Pt.4 Ch.2 Sec.8 Thrusters, Det Norske Veritas, Norway.
Det Norske Veritas, 2003, Rules for Classification of Ships Newbuildings January 2003, Det Norske Veritas, Norway.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to:
NCLH
ABB
DNV GL
BMA
AMSA
Transport Safety Victoria (TSV)
VPCM
Port Phillip Sea Pilots (PPSP)
Submissions were received from NCLH, ABB, DNV GL, BMA, AMSA and TSV. The submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 27/04/2017
The information contained in this Preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the occurrence as outlined in this Preliminary report. As such, no analysis or findings are included in this report.
What happened
On 9 February 2017, the passenger cruise ship Norwegian Star departed Melbourne, Australia, on a scheduled cruise to Dunedin, New Zealand. There were 2113 passengers and 1017 crew on board. On departure, the starboard propulsion unit (Azipod[1]) was operational and the port Azipod was under repair.
At about 0134 on 10 February, the vessel was about 18 nautical miles south-west of Cape Liptrap, Victoria, when the starboard Azipod failed. Propulsion power could not be restored and two tugs were deployed from Melbourne to tow Norwegian Star back to Melbourne. The vessel arrived back without further incident at about midnight on 11 February 2017.
What the ATSB has found so far
Based on the preliminary information, the ATSB found that the Norwegian Star experienced three separate propulsion unit failures over a period of about nine weeks. In each case, the field exciter unit for the main propulsion motor failed. The first two failures (the starboard unit in December and the port unit in January) involved a breakdown of electrical insulation and the third failure (on 10 February 2017) related to a modification made to the starboard Azipod exciter unit during its earlier repair.
Norwegian Star is a passenger cruise ship built in November 2001 and registered in the Bahamas. The vessel is owned and operated by Norwegian Cruise Line Holdings (NCL) Ltd, Miami, and is engaged in round-the-world cruises, predominantly cruising the northern hemisphere ports during the northern summer season and the southern hemisphere ports during the southern summer season.
Figure 1: Norwegian Star
Source: Norwegian Cruise Line Holdings Ltd
The vessel was scheduled to cruise south-east Asia towards the end of 2016, moving to the Oceania region (Australia, New Zealand and Pacific Islands) in January 2017, then far-east Asia in March 2017.
Norwegian Star was built with two electric-driven Azipod[2] propulsion units, manufactured by ABB Industry Oy (ABB), Finland. Each Azipod was constructed with a brushless type exciter unit (see Context).
On 11 December 2016, the vessel was preparing to depart Singapore when the starboard Azipod power breaker tripped and the alarm panel indicated an ‘overcurrent earth failure’. Inspection of the unit confirmed that one of the exciter windings was earthed with visible electrical flashover marks.
Replacement of the brushless type exciter unit could only be achieved if the vessel was taken out of operation. However, the units could be modified from brushless to slip ring (and brush) type with the vessel still in operation. Norwegian Star was capable of operating with one propulsion unit, giving it full manoeuvrability but at a reduced speed of between 13 to 16 knots.[3]
The vessel’s schedule was amended to allow for the reduced propulsion speed. Repair to the starboard Azipod exciter unit continued whilst Norwegian Star cruised the south-east Asia ports between Singapore and Hong Kong. The modified exciter unit was commissioned on 14 January 2017 and tested at full load on 20 January 2017.
Norwegian Star resumed its cruise schedule with both propulsion units operational, departing Singapore on 22 January 2017 for Darwin, Australia, via the Pacific islands. On 24 January 2017, the exciter unit of the port Azipod failed. It was noted that the failure of the port unit was similar to that of the starboard unit. The vessel was now operating solely with the modified starboard propulsion unit.
The vessel called at Bali, Darwin, Cairns and Sydney before arriving in Melbourne on 8 February 2017. ABB technicians were on board to repair the port propulsion by modifying the port exciter unit to slip ring design (similar to the starboard unit). NorwegianStar departed Melbourne on the evening of 9 February 2017 bound for Dunedin, New Zealand. There were 2113 passengers and 1017 crew on board.
The vessel exited Port Phillip Heads (the Heads) at about 2118[4] and at about 2133 dropped off the pilot and commenced its voyage across Bass Strait towards Dunedin. At about 0134 on 10 February 2017, Norwegian Star was about 18 nautical miles south-west of Cape Liptrap (on the south coast of Victoria) when the starboard propulsion unit failed.
Inspection of the modified exciter unit found arcing marks on the outer slip ring, indicating that the brush holders had come into contact with the slip ring.
Norwegian Star was disabled and drifting in an approximately north-north-easterly direction in about 75 metres depth of water. The wind at that time was from the SE at about 5 knots, the sea condition was slight and the swell about one metre. It was partly cloudy and the visibility was good. The current was negligible. The master used the vessel’s bow thrusters to manoeuvre the ship’s head into the wind and reduce the drift from about four knots to about one knot.
The owners and relevant shore authorities were informed and arrangements were made to deploy two tugs to tow the vessel back to Melbourne. At about 1957 the same day, the tug Hastings arrived and at about 2048 the tow line was connected. At 2121 tug Hastings commenced towing Norwegian Star at a controlled speed of about 4.5 knots. The tug Tom Tough arrived at 2212 and followed the tug and tow towards Melbourne.
At about 1107 on 11 February 2017, tug Tom Tough was made fast to the starboard quarter to assist Norwegian Star manoeuvre through the Heads. At about 1338 Norwegian Star arrived at Port Phillip Heads and a pilot boarded the vessel. The vessel entered Port Phillip Bay through the Heads at 1506 and at 1528 a third tug, Marysville, was made fast on the port quarter to assist with the berthing. The vessel berthed at Station Pier at about 2358 without further incident.
Both Azipod units were repaired in Melbourne with further modifications to the slip ring exciter units. On 14 February 2017 both propulsion units were commissioned and Norwegian Star resumed its voyage to New Zealand.
Figure 2: Pictorial of Norwegian Star’s track and drift before being towed back to Melbourne
Norwegian Star is a 294 m long passenger cruise ship built in November 2001 at the Meyer Werft shipyard in Papenburg, Germany. It is owned and operated by Norwegian Cruise Line Holdings (NCL) Ltd, Miami. The vessel is registered in Bahamas and classed with Det Norske Veritas Germanischer Lloyd (DNV GL).
The crew were appropriately qualified for the positions they held and the vessel’s classification certificates were current.
Norwegian Star was built to comply with the requirements of SOLAS (the International Convention for the Safety of Life at Sea 1974, as amended) and the DNV[5] rules for ships (July 1997 edition). The propulsion system of Norwegian Star consisted of two independent ABB V02300 Azipods, each unit producing 19,500 kW of propulsion power at 137 RPM for a maximum ship speed of about 25 knots. Each propulsion unit complied with the class requirements with respect to steering and propulsion.
Norwegian Cruise Line
Norwegian Cruise Line Holdings Ltd. (NCL) is headquartered in Miami, Florida. The company began operations in 1966 under the name Norwegian Caribbean Line and in 1987 changed to its current name. NCL operates as a cruise company, providing cruise itineraries ranging from 1 to 180-days calling on worldwide locations.
At the time of the incident, NCL operated a fleet of 15 passenger vessels worldwide. Ten of those vessels were fitted with the ABB brushless Azipod propulsion systems and Norwegian Star was the oldest in that fleet.
Azipod propulsion system
Azipod propulsion is a gearless steerable propulsion system where the electric drive motor is in a submerged pod under the ship hull. The propeller is a fixed pitch type mounted directly on the motor shaft. The Azipod can rotate 360 degrees, replacing the need for a separate rudder. On the Norwegian Star, the Azipod propellers face forward in a pulling configuration.
Speed and rotational direction control of the propulsion motors is achieved by a frequency converter (cycloconvertor[6]), which consists of selectors, power supply contactors and the control electronics for the main propulsion motor circuits.
Figure 3: Azipod unit
Source: ABB Industry Oy with annotations by Chief Investigator, Transport Safety
Propulsion motor and excitation units
The propulsion motors were of the synchronous type. Synchronous motors require DC current to be supplied to its rotor windings in order to create the excitation for a constant magnetic flux, develop torque and therefore induce rotation. The DC current was supplied to the rotor of the propulsion motor from an exciter unit[7] mounted on the same shaft as the main rotor. There are two methods to provide excitation for field windings, either by sliprings and brushes or by using a brushless excitation machine.
In its original configuration, this propulsion system used the brushless exciter system. The AC generated in the exciter rotor was converted to DC via a rotating diode rectifier unit and supplied to the propulsion rotor. The rectifier is connected to the rotor in the propulsion motor via cables attached to the shaft.
Figure 4: Schematic drawing of motor mechanical and electrical components
Source: ABB Industry Oy with annotations by Chief Investigator, Transport Safety
Conversion from brushless to slip ring
When the brushless starboard exciter unit failed on 11 December 2016, the operating company decided to initiate emergency measures to repair the unit by carrying out a modification of instituting a slipring system with brushes. This decision was made to avoid decommissioning the vessel to carry out permanent repairs to the brushless system.
The modification to a slip ring unit with brushes consisted of the installation of a slip ring assembly, diode bridge assembly, carbon brush assembly and dust removal unit mounted on the existing exciter rotor and stator hub assembly. The transformers for each phase were mounted in the cycloconvertor room and cabling installed from the transformers to the slip ring unit in the pod.
There are two slip rings of the face type located concentrically, mounted on the original exciter rotor. The carbon brush unit and the rectifier unit are mounted with supporting brackets on the original exciter stator frame.
Figure 5: Modified slip ring design exciter unit
Source: ABB Industry Oy with annotations by Chief Investigator, Transport Safety
Investigators from the Chief Investigator, Transport Safety (Victoria) under delegation from the Australian Transport Safety Bureau attended Norwegian Star on 14 February 2017 while the ship was in Melbourne, Victoria, and again on 22 February 2017 while the ship was in Sydney, New South Wales.
The sources of information during the investigation included:
Vessel owners, Norwegian Cruise Line Holdings Ltd
Equipment manufacturer, ABB Oy
Classification Society, Det Norske Veritas Germanischer Lloyd
Australian Maritime Safety Authority
Victorian Ports Corporation (Melbourne).
Investigation direction
The investigation is ongoing and will focus on:
the failures of the propulsion units
vessel operation with one propulsion unit
modifications to the propulsion systems.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 5 February 2017, at about 1639 Eastern Standard Time (EST), a Bell 407 helicopter, registered VH‑VHU (VHU), departed from Cairns Airport, Queensland, on a local scenic charter flight (visual flight rules), tracking towards Green Island (Figure 1). On board were the pilot and six passengers.
Figure 1: Extract of Cairns visual terminal chart showing the Marlin CTAF shaded in green, Green Island and Cape Grafton
Source: Airservices Australia – annotated by ATSB
At that time, a Piper PA-31-350 aircraft, registered VH-FDQ (FDQ), was also conducting a scenic charter flight in the area. At about 1640, the pilot of FDQ contacted the Cairns approach controller and requested clearance to enter the Cairns controlled airspace. The pilot advised that they were at 10 NM and at 1,000 ft and requested to return via either east of Cape Grafton or False Cape.[1] The controller acknowledged FDQ and confirmed that the pilot intended to remain outside controlled airspace and track to Cape Grafton. The pilot confirmed that they would complete an orbit at Green Island and then track to Cape Grafton at 1,000 ft (Figure 1). At about 1641, the approach controller suggested if available that the pilot of FDQ climb to 1,500 ft, as there were multiple helicopters in the area on climb to 1,000 ft (the same altitude as FDQ). Although outside controlled airspace, the controller provided traffic as a helicopter (not VHU) was already at 1,000 ft and about 2 NM W of FDQ. The pilot of FDQ responded that they would climb to 1,500 ft.
At about 1643, the tower controller notified VHU that they were approaching the control boundary and that control services were terminated. The pilot of VHU changed their radio from Cairns Tower to the Marlin common traffic advisory frequency (CTAF),[2] and broadcast that they were at the zone boundary and would track direct to Green Island climbing from 500 ft to 1,000 ft. The pilot did not receive a response and commenced the climb.
About 30 seconds later, the approach controller cleared the pilot of FDQ (then orbiting at Green Island) to track to Cairns via a left base circuit leg for runway 15 at 1,500 ft (Figure 2).
Figure 2: Location of VHU when changed to the Marlin CTAF and approximate location of FDQ when commenced tracking direct to Cairns
Source: Airservices Web Trak, modified by the ATSB
As VHU approached 900 ft on climb, the pilot indicated that their attention was inside the cockpit to ensure they did not climb above 1,000 ft and to set up the helicopter in the cruise. When the pilot subsequently scanned outside, they sighted an aircraft rapidly approaching[3] in the opposite direction (FDQ). The pilot of VHU conducted a rapid descent to increase the separation with FDQ and estimated that the vertical separation between the two aircraft was between 100 to 150 ft. [4] Radar data indicated that the minimum separation between the two aircraft was 400 ft vertically and 500 m horizontally.
Both aircraft subsequently landed without further incident.
Communications
At the time of the incident, the pilot of VHU had Marlin CTAF selected and was flying in an area where the Cairns Approach frequency should be monitored. At the same time, FDQ was on Cairns Approach frequency and flying in an area where the Marlin CTAF should be monitored.
The pilot of VHU commented that they were not aware of the pilot of FDQ’s intentions and did not expect to see an aircraft approaching rapidly in the opposite direction.
The pilot of VHU also commented that although the helicopter was fitted with two radios, they only selected and monitored one frequency at a time, to ensure that communications were not over-transmitted in a very busy airspace. For this flight, the frequency after leaving the Cairns control zone boundary and before the Marlin CTAF boundary was the Cairns Approach frequency.
The operator of FDQ indicated that they also have two radios and maintain an active listening watch on two frequencies.
The operator of VHU commented that immediately outside the Cairns control zone boundary pilots may not be monitoring a common frequency and therefore may not be aware of traffic advisory calls. As such, the operator of VHU believes there can be an elevated risk of a collision, particularly during times of high traffic.
Scenic flight routes
The operator of VHU commented that this incident occurred at one of the busiest times of the year for scenic flights by helicopters and fixed wing aircraft from Cairns to the Great Barrier Reef. The pilot of VHU reported that it would not be uncommon at this time of year to have eight to ten aircraft in the area conducting scenic flights at any one time. To ensure separation they usually fly a set route at a similar altitude and adjust their airspeed so that they follow each other.
At the time of this incident, the Civil Aviation Safety Authority (CASA) was liaising with Airservices and local charter operators to review procedures for possible flight corridors and altitudes to help maintain aircraft separation.
In the interim, on 10 January 2017, the operator of VHU sent an email to the chief pilots of other scenic flight operators with a suggested route for scenic flights (Figure 3). They reported that all helicopter operators agreed to fly in a counter-clockwise direction and that this had decreased the incidence of near collisions between helicopters.
Figure 3: Suggested route for scenic flights
Source: Helicopter operator– annotated by ATSB
Similar incidents
A search of the ATSB database identified one other occurrence in the 2 months before this incident that involved a near collision in the Marlin CTAF. A Cessna 172 was tracking in the Marlin CTAF from Upolu Cay Reef (Figure 1) to False Cape at 1,000 ft. The pilot of an Airbus Helicopters AS350 (AS350) had entered the Marlin CTAF tracking outbound, and broadcast on the Marlin CTAF their intention to track to Green Island and did not receive any response. The AS350 was on climb, passing about 750 ft, when the pilot reported that they had to take evasive action to avoid a collision with the Cessna 172.
In a submission to a draft of this report, CASA provided information about two other relevant near miss incidents, which had not been reported to the ATSB.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
VHU and FDQ were on reciprocal tracks, near the control zone boundary, and the pilots were communicating on different radio frequencies at the time of the separation issue. Neither pilot was aware of the other aircraft prior to the incident.
There are no published routes and procedures for scenic flights in the Cairns/Great Barrier Reef area. FDQ was operating contra to the inbound direction used by the helicopter operator, but in accordance with their air traffic control clearance, and still outside controlled airspace at the time of the incident.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Civil Aviation Safety Authority
As a result of this occurrence, the Civil Aviation Safety Authority has advised the ATSB that they are taking the following safety actions:
CASA are engaged with Airservices and the local operators to find a workable safety outcome to the aircraft separation issues.
Safety message
This incident highlights the importance of effective risk analysis by operators. An effective risk analysis of the scenic routes would probably have highlighted the potential for opposite-direction traffic. This may have led to risk management strategies such as implementation of vertical separation planning.
A search for other traffic is eight times more effective when a radio is used in combination with a visual lookout than when no radio is used. In areas outside controlled airspace, it is the pilot’s responsibility to maintain separation with other aircraft. For this, it is important that pilots use both alerted and un-alerted see-and-avoid principles.
ATSB research has found that accidents and incidents are not always reported to the ATSB when they should be. It is possible that other occurrences related to this incident have not been reported to the ATSB.
While we use a notification to determine whether to investigate an occurrence, looked at as a whole, notifications also provides a bigger picture of aviation safety trends and patterns.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 3 February 2017, a Network Aviation Fokker F28 Mk 0100, registered VH-NHV (NHV), conducted a scheduled passenger flight from Perth to Kalgoorlie, Western Australia (WA). On board the aircraft were two flight crew, three cabin crew and 17 passengers.
The service to Kalgoorlie was originally scheduled in another company F28, registered VH-NHQ (NHQ). However, a fault occurred in NHQ after the aircraft was pushed back from the terminal for departure. The fault resulted in the aircraft returning to the terminal and the operator replacing NHQ with NHV for the service to Kalgoorlie.
The flight crew moved to NHV to start their pre-flight duties and took the certified load instruction sheet (LIS) for NHQ with them. After the flight crew boarded NHV, they received the customer management summary and passenger manifest with the registration NHQ. The crew identified the incorrect registration and rejected the paperwork. Subsequently a person, whom the captain believed was the loading supervisor for the ramp team loading the aircraft, entered the flight deck and inspected what the captain believed was the new LIS, again with the registration NHQ.[1] The captain asked this person if NHV was to be loaded as per NHQ and the response they[2] received satisfied them that that was the case. The captain then pen amended their LIS from NHQ to NHV.
The F28 has two cargo compartments forward of the wing, compartments A and B, and two compartments aft of the wing, compartments E and F. The flight to Kalgoorlie was planned to be loaded with 197 kg of freight and 272 kg of baggage (469 kg in total), distributed between compartments A and B.
The aircraft departed from Perth and landed at Kalgoorlie without incident. However, when the cargo compartments were opened after arrival at Kalgoorlie, there was no load on board the aircraft and the cargo nets were undone. The load was subsequently found to be on board NHQ in Perth, which had been towed into the operator’s hangar for maintenance.
Load instruction sheet
Both of the aircraft involved in this incident, NHQ and NHV, were classified as Group-A F28 aircraft, therefore the same LIS instructions applied to both aircraft for weight and balance purposes. When NHQ developed a fault, the maintenance watch staff in the operations control centre[3] identified NHV as the alternative aircraft for the Kalgoorlie service. The operator’s terminal staff produced an amended LIS for NHV and sent a copy of the LIS to their contracted ground handling service provider. The LIS was marked as edition 1, but should have been marked as edition 2. However, post-incident, the ground handling service provider reported to the operator that they did not receive a copy of the LIS for registration NHV.
The normal process for the LIS is, once it is certified by the loading supervisor that the aircraft is loaded in accordance with the LIS and all cargo compartments inspected, it is passed from the loading supervisor to the flight crew. The incident LIS was certified for NHQ, which the captain amended to NHV after consultation with a person whom they believed was from the loading team. Pen amendments were a permitted practice at the time of the incident. The captain believed it was the correct LIS, but with the incorrect registration.
The LIS was also used by the operator themselves to prepare the offload instruction report for the destination airport. To prepare the offload report, the operator’s ramp personnel would normally contact the contracted ground handling staff to retrieve the details from the final LIS.[4] However, in the absence of a loading team, they could also check the LIS that was on the flight deck.
Management of changes within ground services
The conduit for information within the ground handling service provider is their movement control (MOCO). For ramp loading activities, MOCO contacts the ground resource allocator/coordinator who allocates the ramp loading tasks. Tasks are related to flight numbers and the task for loading flight number 1608 (NHQ) was completed prior to the aircraft change to NHV. Any further loading tasks related to this flight number, were required to be manually generated.
The LIS amended to NHV, sent (faxed) from the operator to their ground handling service provider had edition 1 for flight number 1608, as did the previous LIS for NHQ. The ground handling service provider reported to the operator, after the incident, that they did not receive an LIS for the registration NHV and therefore no team was allocated the task to transfer the freight and baggage from NHQ to NHV.
Weight and balance
The operator reported that the F28 has a ‘very aft’ empty weight centre-of-gravity due to the location of the engines near the tail of the aircraft. However, the majority of the passengers (16 from 17) were seated in the forward rows and therefore the aircraft did not exceed weight and balance limits on the incident flight.
Previous incidents
On the 26 January 2017, the operator experienced an incident in which paperwork with errors were delivered to the flight crew (AO-2017-018). Incorrect cargo weight data was entered by the flight crew, but there was no reported effect on the handling of the aircraft.
Safety analysis
Following the unserviceability of NHQ, the operator re-allocated the Perth to Kalgoorlie service to NHV. The operator’s contracted ground handling service provider was responsible for loading the aircraft in accordance with the operator’s LIS.
The operator verbally notified their ground handling services provider of the unserviceability, but not of the replacement registration. The ground handling service provider allocated tasks with reference to the flight number and the task for flight number 1608 had been completed in their system. The replacement registration was identified on the amended LIS, but the LIS inadvertently indicated that it was edition 1.
It is probable that a team was not allocated to the task of transferring baggage and freight from NHQ to NHV because the LIS sent to the ground handling service provider, marked as edition 1, was for a task recorded as already completed.
The operator was responsible for producing the offload instruction for the destination. It is therefore possible that the person who entered the flight deck of NHV, while the flight crew were preparing for flight, was there only for the purpose of confirming the offload figures from the LIS because they could not make contact with the loading supervisor. The captain was a relatively new employee and had no prior experience of this practice. Consequently, they misunderstood the role of this person and the reason for their inspection of the LIS. The captain then pen amended the aircraft registration on the LIS from NHQ to NHV under the assumption that the LIS was actually for NHV. This was a permitted practice at the time, which resulted in the flight crew believing they had a certified LIS for the loading of NHV.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
After NHQ became unserviceable, the operator sent the ground handling service provider a new load instruction sheet for NHV with the same flight number and edition as NHQ.
NHV was not loaded because no team was allocated to the task of transferring the freight and baggage from NHQ to NHV.
The policy of permitting flight crew to pen amend the load instruction sheet resulted in the aircraft departing with the flight crew believing they had a load instruction sheet certified for the loading of NHQ.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety action:
Advisory bulletin
The operator issued an advisory bulletin to their staff, to communicate the aircraft loading system requirements, including the interface requirements between departments for aircraft dispatch. Note 3 of the bulletin states that ‘after a significant change, such as an aircraft change, a new LIS will be issued with an updated edition number, previous editions should be placed so as not to be referenced in error.’
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
![Figure 1: The track of Norwegian Star from Port Phillip Bay until its loss
of propulsion, and its drift before being towed back to Melbourne. Source: Australian Hydrographic Office ENC Charts AU 439144 and 439145 [Inset: Google Map of Australia], with annotations by Chief Investigator, Transport Safety](/sites/default/files/media/5774319/mo2017003_picture-5.jpeg)
