Safety summary

What happened

On 15 May 2018, at 1903 Eastern Standard Time, a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.

What the ATSB found

The ATSB found that the pilot, who was conducting his first night training flight, likely became spatially disorientated during a go-around manoeuvre, which resulted in a loss of control at low level and collision with terrain.

The flight instructor did not intervene to take control of the aircraft during the go-around manoeuvre, because she was not aware the pilot had become spatially disorientated and was accustomed to directing the pilot to correct control problems. Inconsistent with Civil Aviation Safety Authority guidance, the instructor, who had previously instructed the pilot for his private instrument rating, did not provide a night flying demonstration before directing the pilot around the circuit.

Safety message

It is important for flight instructors to provide a demonstration when introducing a pilot to a new flight sequence or new flight environment. Time spent demonstrating the key points of a new sequence or environment will usually improve the learning process by ensuring that the development of a new skill is supported and preceded by knowledge and understanding from experience.

The flight instructor reported that for the delivery of future initial night flying training, she would conduct either a separate session of daytime flying training circuits prior to night, or deliver the training as day-into-night circuit training. She also commented that, prior to teaching night flying, flying training organisations should consider conducting refresher training in unusual attitude recoveries, irrespective of a pilot’s level of experience and qualifications.

The occurrence

On 15 May 2018, at 1903 Eastern Standard Time,^[1] a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.

The pilot held a private instrument rating and the accident flight was the pilot’s first training flight for a night endorsement to be added to his rating.^[2] The instructor arrived at the hangar in the evening, just as the pilot was completing his pre-flight inspection of the aircraft. They completed the inspection together and then the instructor delivered a night flying brief to the pilot. The briefing included the physiological effects of the night environment, procedural differences for the night circuit, and the instrument and visual sections of the night circuit, which included the need to transition onto instruments on rotation during take-off.

The pilot and instructor boarded the aircraft and completed all the checklist items on the multi‑function display (MFD). The wind appeared to be light and variable and they selected runway 11 for the circuits. The pilot activated the runway lighting while taxiing,^[3] which also provided precision approach path indicator (PAPI) lighting.^[4]

The instructor directed^[5] the pilot throughout the first touch-and-go^[6] circuit to runway 11, which she considered was flown to a good standard with the pilot responding to her direction. On the second circuit, at about 500 ft above ground level on approach to land, the pilot and instructor noted the approach was too steep. The pilot, with direction from the instructor, corrected the approach and they both observed two‑white and two-red PAPI lights on short final approach, which indicated they were on the correct approach path. The pilot flared the aircraft a ‘little high’ for the touchdown, and the aircraft bounced twice. The pilot elected to go-around and applied full power before touching down again.

When full power was applied, the aircraft pitched^[7] up. As the pilot was attempting to transition his scan onto the instruments, the instructor, whose attention was on the attitude indicator,^[8] directed him repeatedly to level the wings—‘wings level’. The pilot observed the runway lights disappear off to the right and felt the aircraft was in a roll^[9] as he was trying to focus his attention on the attitude indicator.^[10] Following a review of the ATSB’s draft investigation report, the pilot also reported that he manipulated the flight controls in an attempt to recover the aircraft. Shortly after, the aircraft collided with the ground, struck a fence and came to rest inverted.

The pilot reported that he ‘kicked the pilot’s door window out’ to exit the aircraft, at which stage the wings were alight and a grass fire had started.^[11] He then pulled the instructor out of the wreckage, who had lost consciousness after becoming disorientated while looking for the emergency egress hammer.^[12] Emergency services located at the airport immediately responded to the accident. Figure 1 shows the wreckage site with reference to runway 11. Weather conditions were not considered a contributing factor to the accident.

Figure 1: VH-PDC wreckage

Source: ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. A pilot who has a private instrument rating is authorised to operate at night under the instrument flight rules only if that pilot holds a night private instrument endorsement.
3. Pilot activated lighting (PAL) is activated by a pilot keying a series of transmissions, within a specified timeframe, on a specified radio frequency.
4. PAPI is a visual aid that provides pilots with guidance on acquiring and maintaining the correct approach path to a runway. The system consists of four side-by-side lights positioned next to the runway. When the aircraft is on the desired approach path (3°), two red and two white lights will be visible. More than two red lights indicates the aircraft is low on approach, and more than two white lights indicates the aircraft is high.
5. Airborne instruction is based on a building block approach using demonstrate, direct then monitor. The instructor flies the sequence in demonstrate, provides verbal commands to the student in direct and observes the student’s progress in monitor.
6. A procedure whereby an aircraft lands and takes off without coming to a stop.
7. Pitching: the motion of an aircraft about its lateral (wingtip-to-wingtip) axis. Increased thrust over the tailplane will increase the tailplane down force and pitch the nose upward.
8. Attitude indicator is a primary flight instrument, which displays the aircraft pitch and roll against an artificial horizon.
9. Rolling: the motion of an aircraft about its longitudinal axis.
10. The Cirrus SR22 aircraft’s propeller rotates clockwise, as viewed from the pilot’s seat. Therefore, an increase in power will increase the engine torque reaction and propeller slipstream. Without pilot input, the natural response from the aircraft is to roll and yaw (motion of an aircraft about its normal axis) to the left.
11. The fence was electrified, but it was not determined if the fence or the engine was the ignition source for the fire.
12. An eight-ounce ball-peen type hammer is located in the centre armrest. If the cabin doors are jammed or inoperable, the hammer may be used to break through the acrylic windows.

Context

Pilot information

The flight instructor held a valid Commercial Pilot Licence (Aeroplane), a Grade 1 flight instructor rating, an instrument rating and a night visual flight rules rating. She had a total flying experience of about 4,200 hours and last completed a flight review on 3 December 2017.

The pilot held a valid Private Pilot Licence (Aeroplane) and a private instrument flight rules rating. He last completed a flight review on 11 March 2017 (private instrument rating), had accrued about 500 hours on Cirrus aircraft, and about 50 hours of instrument flight time. The pilot had conducted the majority of his training and subsequent flying from Orange Airport, where his aircraft had been hangered.

Closed-circuit television footage

Closed-circuit television footage from Orange Airport depicted the aircraft rolling left at a low height above runway 11 before impacting the ground on the north-east side of the runway at 1903. A small fire ensued after impact, followed by deflagration of the fuel vapour about 7 seconds later. About 9 minutes later, the CAPS^[13] rocket fired. Figures 2, 3 and 4 depict the initial roll of the aircraft, deflagration of the aircraft fuel vapour and firing of the CAPS rocket.

Figure 2: VH-PDC in left roll

Source:  Orange City Council, annotated by the ATSB

Figure 3: Deflagration of fuel vapour

Source:  Orange City Council

Figure 4: CAPS rocket

Source:  Orange City Council, annotated by the ATSB

Aircraft information

Electronic stability and protection

Before take-off, the pilot checked the aircraft’s autopilot and then switched it off. When the autopilot is switched off, the aircraft’s electronic stability and protection (ESP) system is operational. The ESP system automatically activates the autopilot servos to recover the aircraft from excessive roll and pitch attitudes.

The ESP roll protection activates at 45° roll angle, reaches a maximum stick force at 50°, and disengages when the roll angle reduces to 30°. The ESP pitch protection engages at 17.5° nose up, reaches a maximum stick force at 22.5° and disengages at 12.5°. Although the ESP uses the autopilot servos to drive the controls, the pilot retains the ability to override the system.

Recorded data

VH-PDC carried a Garmin G1000 avionics package, and a Recoverable Data Module (RDM). The G1000 is capable of recording various parameters to a secure digital (SD) card, installed on the upper slot of the MFD. The same information is recorded to the RDM, which is an impact and fire resistant unit,^[14] installed on the vertical fin spar. The RDM and MFD modules were removed from the aircraft for examination by the ATSB.

The RDM was recovered from the severely fire damaged fin. The rear portion of the module was exposed to a high temperature and showed external heat damage. Disassembly of the crash hardened enclosure to access the data storage components revealed extensive fire damage to the memory devices. No data was recovered from this device.

Initial observations of the MFD SD card slots revealed they were substantially fire damaged and retained two SD cards; the top slot contained the data logging card, the bottom slot contained the Garmin database card. To access the cards, the MFD was disassembled, and the circuit board holding the two cards was removed. The data logging card was found to be substantially damaged (Figure 5). The encapsulated memory device was removed from the data logging card and cleaned. The data logs were then extracted with a modified SD card reader. A total of 241 flight logs were recovered, including the accident flight (Figure 6).

Figure 5: Data logging SD card

Left: Removed MFD slot with data logging SD card. Right: removed data logging card with card memory identified. 
Source:  ATSB

Figure 6: Recovered accident flight data

Source:  ATSB

The recovered flight data indicated that after touchdown, power was initially increased to about 45 per cent (19:02:15) and a slight left roll initiated. Power was then advanced to about 90 per cent (19:02:18) and the left roll developed to a peak value of -52° (19:02:23) with a pitch attitude of +20° (nose-up)^[15] and airspeed varying from 56–69 kt.^[16] The pitch attitude then increased to a peak value of +29° before lowering to +7° as the aircraft rolled right to a peak value of +27° at a height of about 100 ft above the runway (19:02:25).

The aircraft collided with the ground followed by the airport boundary fence and came to rest inverted during the period 19:02:26–30.^[17] The final track at initial impact was about 60° left of the runway centreline. During the accident sequence, the rate of heading change to the left developed commensurate with the angle of left roll, and the recorded normal and lateral G‑accelerations^[18] were minimal.^[19]

Wreckage information

With the exception of the right rudder cable, no mechanical defect was found that could have prevented the normal operation of the aircraft. The right rudder cable was found attached to the rudder, but the forward end was found with a failure near the connection to the rudder pedals. The cable was removed from the wreckage for examination by the ATSB. A preliminary examination determined it did not fail from fatigue. The aircraft’s flight data demonstrated the rudder was operational during the accident sequence. On that basis, it was concluded that the rudder failure observed was a result of the impact, and no further examinations were conducted on the rudder cable assembly.

Survival factors

The aircraft was fitted with a composite roll cage within the fuselage structure to provide roll protection for the occupants. The front seats were each fitted with a four-point inflatable restraint system with an inertia reel lock. Despite coming to rest inverted after striking the ground at about 60–70 kt, the pilot and instructor reported that they found themselves uninjured, but could not open the doors with the aircraft inverted.^[20] The inflatable restraints (air bag style system) did not activate, but this was considered likely to be due to the gradual level of deceleration.

The iBrace Survivor Questionnaire^[21] was completed for the pilot and instructor with the following results:

• The pilot was able to evacuate unassisted from the aircraft while it was filling with smoke by kicking out a window. He then pulled the instructor out of the burning wreckage after seeing her collapsed inside. He suffered from third-degree burns to 7 per cent of his body.
• The instructor was unable to evacuate unassisted from the aircraft after she became disorientated in the dark, smoke filled environment, which led to a loss of consciousness. She suffered from first and second-degree burns and smoke inhalation injuries, which required her to be intubated.

Closed-circuit television footage identified an ambulance crossing the runway towards the accident site about 3 minutes after impact. In addition, an emergency medical service helicopter was located at the airport with the crew on duty at the time of the accident. They transported the pilot and instructor to Sydney for treatment.

Additional information

Spatial disorientation

The pilot reported that the aircraft pitched up when he applied power for the go-around and that he observed the runway lights disappear off to the right. He felt that the aircraft was in a roll while he was trying to focus his eyes on the attitude indicator as the instructor was directing him to level the wings. He commented that without enough right rudder the aircraft will ‘pull to the left’ [when applying additional power] and that it is normal to apply right rudder, but that ‘it was pitch black’.

There is a small village, Spring Hill, located upwind of runway 11, but the instructor reported that it was not large enough to produce an illuminated horizon below about 200 ft above ground level. She reported that on the night of the accident, at low level with the runway lights obscured, it was ‘pitch black’, and that [for a pilot looking outside] the environment would have been ‘totally disorientating’.^[22]

Benson (1988; as cited in Gibb et al., 2011) defined spatial disorientation as:

The pilot fails to sense correctly the position, motion, or attitude of his [or her] aircraft or of himself [or herself] within the fixed coordinate system provided by the surface of the earth and the gravitational vertical.

The three sensory systems for determining orientation of the human body in space are the visual, vestibular,^[23] and somatosensory^[24] systems. Newman (2007) and others have reported that the visual system provides 80 per cent of the orientation information in normal conditions. However, in the absence of visual cues, orientation and motion information are divided between the vestibular and somatosensory systems. These systems can easily produce false information for a pilot due to local accelerations of the aircraft about the pitch, roll and yaw axes.

The vestibular system responds to head position and movement, which may lead to an incorrect perception of body motion if not supported by a visual reference. For example, an upward pitch (head backward) may be detected as a forward acceleration, and a roll as a lateral (sideways) acceleration. The somatosensory system detects local accelerations on the body, but if the pitching and rolling motions occur at close to +1G flight, such as during the accident sequence, the somatosensory system may not be able to resolve ambiguities generated by the vestibular system.

It was noted by Newman (2007) and Gibb et al. (2011) that spatial disorientation is likely an under‑reported phenomena in aviation. They suggested that this may be due to it resulting in one of two likely outcomes; either the pilot recovers the aircraft with no harm or damage done, and therefore does not perceive the need to report; or it results in a fatal accident and the investigation cannot verify from the evidence available that spatial disorientation contributed to the event.

Flight instruction

Instrument flying proficiency

The Civil Aviation Safety Authority’s (2007) Flight Instructor Manual: Aeroplane, chapter 18: Night Flying, states the following:

Before students undertake night solo circuit operations they must have received sufficient instrument flight training to enable them [to] carry out the following manoeuvres solely by reference to instruments: a) climb and climbing turns, b) straight and level flight and level turns, c) descent and descending turns, d) unusual attitude recovery full panel.

As the pilot already held a private instrument rating, the above training exercises were not required to be conducted as lead-in to his night flying training.

Demonstration

The Flight Instructor Manual stated that ‘airborne sequences must follow an acceptable method of teaching like: demonstrate, direct then monitor. However, the pilot acted as flying pilot for his first night flying training flight without a prior demonstration.^[25] The instructor explained that there were several reasons for this as follows:

• When the pilot first approached the instructor for his private instrument rating training, he was already a qualified pilot [private pilot licence] who owned his own aircraft and was capable of flying it competently. The instructor considered him an advanced student for the instrument training as he had already accumulated several hundred flying hours experience.
• The instructor used the direct method to deliver the pilot’s instrument training. This was about 40 hours of dedicated instrument flying training.
• At the time of the accident flight, the instructor and pilot had accumulated about 50 hours flying together without the need for the instructor to demonstrate a flying sequence or intervene to correct an improperly flown sequence. The pilot’s instrument flying training ensured he had accumulated sufficient minimum instrument flying prior to his first night flying training flight.

Benefit of demonstration

The benefit of demonstration as an instructional technique is that it permits the student to focus their attentional resources on key learning points for new sequences, without the diversion of those resources to managing the flight path. Studies have noted that observational experience, in addition to physical practice, can provide a more effective learning experience than physical practice alone.

In 2000, Shea et al. compared the performance of a physical practice group with a combined observation and physical practice group on a motor learning test. The physical practice group outperformed the combined practice group under the practice test conditions, but when the test conditions were varied from the practice conditions, the combined practice group ‘performed significantly better’ than the physical practice group.

Intervention

After the go-around was commenced, the instructor reported that the aircraft entered an unusual attitude. Both the instructor and pilot reported that the instructor was repeatedly directing the pilot to level the wings. The instructor commented that at the time, she was thinking ‘get that left wing up’, but directing ‘wings level’. At the time, her eyes were focused on the pilot’s attitude indicator^[26] and she was expecting the pilot to recover the aircraft. However, the pilot had become spatially disorientated, which she was not aware of. It was only a matter of seconds between the instructor’s comprehension that the aircraft was not responding and the impact with the ground. The instructor considered that it ‘happened very fast’, and that as she was not in the habit of taking over the controls from the pilot, her natural reaction was to direct what was needed. The pilot also reported that it ‘happened very quickly’, with ‘no height to recover’.

The Cirrus SR22 is fitted with two single-handed side control yokes mounted beneath the instrument panel on the left and right side of the cockpit, and the instructor reported that it is not an easy aircraft for an instructor to take over control from a student. She commented that the single-handed yokes are sensitive in their response, which can lead to ‘fighting over the controls’ if the instructor attempts to follow-through on the controls^[27] while a student is flying. Therefore, she was not following through on the controls during the touch-and-go sequence.

Previous similar accidents

Spatial disorientation

Spatial disorientation presents a danger to pilots as the resulting confusion can often lead to incorrect control inputs and resultant loss of aircraft control. Gibb and others (2010) state that spatial disorientation accidents have a fatality rate of about 90 per cent, indicating how compelling the misperceptions can be. A search of contributing safety factors in the ATSB aviation occurrence database revealed that of the investigated accidents where spatial disorientation was found to be a factor (about one per year), nearly all resulted in fatal injuries.

The United States National Transportation Safety Board’s database was searched for previous accidents involving spatial disorientation. A search of all aircraft categories returned 710 results. Cirrus SR20 and SR22 aircraft returned 18 results for spatial disorientation as a finding between 2003 and 2017, 13 of which were fatal accidents (four of the non-fatal accidents involved use of the Cirrus Airframe Parachute System for recovery). The conditions for all of the accidents were instrument meteorological or night, or combination of both. Of the 18 accidents for Cirrus aircraft, 10 were for instrument-rated pilots and four occurred during take-off.

The ATSB education booklet Avoidable Accidents No. 7, Visual flight at night accidents: What you can’t see can still hurt you (AR-2012-122) outlines a number of night-time accidents that have been a result of spatial disorientation due to dark night conditions.

Loss of control during go-around

A search of the ATSB database for previous SR22 accidents involving a loss of control during a go-around manoeuvre found one result of interest:^[28]

• During a touch-and-go training exercise, the aircraft veered off the runway to the left while under full power for take-off. The pilot reported that his attention may have been diverted to the flap control lever at the time (ATSB reference number 201006782).

The United States National Transportation Safety Board’s database was searched for previous similar accidents. The search criteria were Cirrus SR22, instructional flight, and accident. The search results were then filtered for loss of control events during an attempted go-around. The following results of interest were reviewed:

• Report ERA12FA540: Loss of control in-flight. ‘During the final approach, witnesses saw the airplane drifting to the left while descending at a relatively high sink rate. Witnesses heard the power being adjusted, and, close to the ground, the engine went to high power. The airplane’s nose rose, and the airplane veered to the left. The airplane touched down left wing down off the runway in grass, heading about 40 degrees left of the runway centreline. It then entered woods, where it hit numerous trees and came to rest upside down and on fire…Examination of the wreckage revealed no pre-existing mechanical anomalies that would have precluded normal operation’.
• Report ERA13CA222: Landing area overshoot. ‘According to the instructor, he and the student pilot were practicing short field landings. When the airplane was about 20 feet above the ground on approach to the runway, the airspeed suddenly decreased. The student pilot applied full engine power, the airplane yawed to the left, and the airplane impacted the ground before it reached the runway. The flight instructor reported no pre-impact mechanical malfunctions or failures with the airplane that would have precluded normal operation’.
• Report NYC07CA010. ‘As the pilot of the SR-22 was performing a flare for landing, the airplane’s airspeed “became too slow,” and the pilot applied full power and announced “go-around.” The airplane veered left, and continued approximately 100 yards, before it struck a tree and came to rest upright. The pilot reported no mechanical anomalies with the airplane’.

__________

13. The aircraft was fitted with the Cirrus Airframe Parachute System (CAPS), which is a ballistic parachute recovery system. When the pilot activates the CAPS system, a rocket in the aft fuselage ignites and dislodges the CAPS cover. The rocket then extracts a deployment bag containing the parachute from the aircraft.
14. As advertised by the manufacturer - Heads Up Technologies.
15. The nose-up pitch attitude on take-off and the first touch-and-go circuit was 7–9°. When the aircraft is trimmed for a low power and low airspeed approach, an increase in thrust over the tailplane will increase the down force produced by the tailplane, pitching the tailplane down and the nose up.
16. An approximate stall speed of 73 kt was calculated. Conditions were: full flap, full fuel, two occupants, 20° pitchup, 52° roll, density altitude 2,600 ft and idle power. The use of high power would reduce the stall speed.
17. The airport camera footage timings are about 30 seconds in advance of the aircraft recorded data for reasons undetermined.
18. G load: the nominal value for acceleration. In flight, g load represent the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value.
19. The peak variation in normal and lateral accelerations were +0.24 and -0.07 respectively (datum = 0.0).
20. The aircraft doors open upwards and forwards relative to the cabin with the aircraft in the upright position.
21. Davies J.M., Wallace W.A., Colton C.L. & Yoo K.I. (in press). Two aviation accident investigation questionnaires for passenger & crew survival factors & injuries. Aviation Medicine and Human Performance.
22. The instructor reported that the township of Orange, to the north of the extended centreline for runway 29, provided more lighting than Spring Hill, but was partially masked by the surrounding terrain and would not have provided any significant light had that runway been used at the height at which this event occurred.
23. The vestibular system consists of the semi-circular canals and otolith organs in the inner ear, which detect angular and linear accelerations of the head.
24. The somatosensory system uses nerves to detect external forces on the body.
25. The accident flight was the instructor and pilot’s first dedicated circuit flying training session together – the instructor was not involved in the pilot’s basic flying training.
26. Although the aircraft was fitted with two MFDs, the primary flight display with the attitude indicator is only displayed on the left MFD, except in the case of a failure of that MFD, in which case the primary flight display will be displayed on the right MFD.
27. For an instructor, ‘follow-through on the controls’ is the practice of holding the controls while the student is flying. This permits the instructor to feel the student’s control inputs and override incorrect control inputs to prevent the development of an unsafe situation.
28. There were other results of loss of control during go-around manoeuvres with full power for the SR22, but these included strong gusting wind conditions as contributing factors.

Safety analysis

Introduction

During a night training flight, a go-around from runway 11 at Orange Airport, New South Wales was commenced. Shortly after, the Cirrus SR22 aircraft, registered VH-PDC, collided with the ground. The flight instructor and pilot received serious injuries and the aircraft was destroyed.

As mentioned above, the presence of a fractured rudder cable in the wreckage was not considered a contributing factor. This was because the rate of heading change during the accident sequence followed the angle of roll, rather than the application of power, and there was no significant lateral acceleration associated with the application of power.

The data logging card did not record pilot control inputs or movement of the autopilot servos. Therefore, it could not be determined if the reversal of the initial rolling and pitching motion was the result of the actions of the pilot, or flight instructor, or the aircraft’s electronic stability and protection system. However, the thresholds for activation of the aircraft’s pitch and roll protection were reached during the accident sequence, and the reversal of the pitch and roll were consistent with the operation of the system. While the system was designed to mitigate an unusual attitude from developing, the act of recovering from a high pitch angle at slow speed will inevitably result in a loss of height.

The final approach on the accident flight was steep at 500 ft. While this was corrected before the landing, it would have increased the pilot’s workload during the approach. Using this as a trigger to conduct a go‑around would have provided the pilot with the opportunity to set up for a more stable approach on the next circuit.

This analysis will examine the conduct of flight demonstrations, and the pilot experiencing spatial disorientation and the flight instructor’s awareness of such.

Flight demonstration

The pilot was undergoing his first night flying training flight for the addition of a night endorsement to his private instrument rating. The flight instructor had previously instructed the pilot for his instrument rating, and considered him an advanced student. His instrument flying training was delivered by the instructor using the instructional method of direct, without the need to demonstrate any sequence or intervene to correct an incorrectly flown sequence. Because of this earlier experience, the instructor elected to use the instructional method of direct without first demonstrating any of the key learning points for the night flying environment.

Night circuits involve a unique runway environment for assessing the approach path and landing, and require a unique procedure for combining visual and instrument flying sequences. The Civil Aviation Safety Authority’s flight instructor manual emphasised that the ‘acceptable delivery rate of new information to the student [pilot] needs to be combined with good demonstrations and adequate student practice’. Consistent with this guidance, best practice is to ensure that the student [pilot] is introduced to a new environment in a gradual way. The lack of demonstration for the pilot’s introduction to night flying likely increased the risk of the pilot not having an adequate opportunity to attend to, and absorb, the key learning points before attempting to practice the sequences as the pilot flying.

Spatial disorientation

The flight instructor reported that the pilot’s first night circuit was flown to a reasonable standard with the pilot responding to her direction. At the end of the second circuit, the aircraft bounced twice during the attempted touchdown and the pilot applied full power to perform a go-around. In response to the application of full power, the aircraft pitched nose-up and started to roll to the left. The pilot reported that he lost all external visual references as the runway lighting disappeared from view underneath the aircraft, and was attempting to focus his attention on the attitude indicator as the aircraft continued to pitch up and roll left.

The pitching and rolling motion of the aircraft, in addition to the pilot and instructor reports that the external environment was ‘pitch black’, were all consistent with the pilot experiencing spatial disorientation. The nose up pitching motion and left rolling motion were consistent with the natural response of the aircraft without corrective pilot control input.

Flight instructor awareness

During the accident sequence, the flight instructor repeatedly directed the pilot ‘wings level’, but her attention was focused on the primary flight display and she was not aware the pilot had become spatially disorientated. Therefore, she did not immediately intervene to recover control of the aircraft during the accident sequence, which only lasted about 7 seconds from the decision to go-around to initial impact.

Findings

From the evidence available, the following findings are made with respect to the spatial disorientation and collision with terrain involving Cirrus SR22, registered VH-PDC, at Orange Airport, New South Wales, on 15 May 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• While attempting a go-around manoeuvre from an aborted touch-and-go, the pilot did not immediately transition his scan onto the attitude indicator and became spatially disorientated, which resulted in loss of control of the aircraft and collision with terrain.
• The flight instructor was not aware the pilot had become spatially disorientated, which resulted in her providing direction rather than intervention during the loss of control.

Other factors that increased risk

• Contrary to best practice, the flight instructor elected to direct the pilot for his first night flight without a demonstration. This decision was influenced by the pilots' experience, private instrument rating, and previous instructional method.

General details

Flight Instructor details

Pilot details

Aircraft details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Cirrus Aircraft
• Civil Aviation Safety Authority
• flight instructor
• Orange City Council
• pilot
• United States National Transportation Safety Board.

References

Civil Aviation Safety Authority 2007, Flight instructor manual: aeroplane, issue 2, CASA, Canberra.

Gibb R, Ercoline B & Scharff L 2011, ‘Spatial disorientation: decades of pilot fatalities’, Aviation, space, and environmental medicine, vol. 82, no. 7.

Newman DG 2007, An overview of spatial disorientation as a factor in aviation accidents and incidents, Australian Transport Safety Bureau, Canberra. Aviation research and analysis report – B2007/0063.

Shea C, Wright D, Wulf G & Whitacre C 2000, ‘Physical and observational practice afford unique learning opportunities’, Journal of motor behavior, vol. 32, pp. 27–36

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Cirrus Aircraft, Civil Aviation Safety Authority, flight instructor, pilot and United States National Transportation Safety Board.

The submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Terminology used in this report

Occurrence: accident or incident.

Safety factor: an event or condition that increases safety risk. In other words, it is something that, if it occurred in the future, would increase the likelihood of an occurrence, and/or the severity of the adverse consequences associated with an occurrence. Safety factors include the occurrence events (e.g. engine failure, signal passed at danger, grounding), individual actions (e.g. errors and violations), local conditions, current risk controls and organisational influences.

Contributing factor: a safety factor that, had it not occurred or existed at the time of an occurrence, then either: (a) the occurrence would probably not have occurred; or (b) the adverse consequences associated with the occurrence would probably not have occurred or have been as serious, or (c) another contributing factor would probably not have occurred or existed.

Other factors that increased risk: a safety factor identified during an occurrence investigation, which did not meet the definition of contributing factor but was still considered to be important to communicate in an investigation report in the interests of improved transport safety.

Other findings: any finding, other than that associated with safety factors, considered important to include in an investigation report. Such findings may resolve ambiguity or controversy, describe possible scenarios or safety factors when firm safety factor findings were not able to be made, or note events or conditions which ‘saved the day’ or played an important role in reducing the risk associated with an occurrence.

Safety issue: a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operational environment at a specific point in time.

Safety action: the steps taken or proposed to be taken by a person, organisation or agency in response to a safety issue.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On the morning of 9 May 2018, there were five controllers on duty in the Air Traffic Control (ATC) tower operated by Airservices Australia (Airservices) at Perth Airport, Western Australia (WA). One controller was acting as the surface movement controller (SMC)^[1]. One controller, who was being trained in air traffic control, was acting as the aerodrome controller (ADC)^[2] under the supervision of another controller. The other controllers on duty were in airways clearance delivery and tower supervisor roles.

At 0841 local time, the crew of a Regional Express SAAB 340 aircraft operating a passenger service, call-sign RXA2113, were at their departure bay. The crew contacted the airways clearance delivery controller who issued an airways clearance for the planned flight from Perth to Albany, WA. This clearance authorised the crew to track to Albany via SOLUS and flight-planned route. The crew was cleared to depart Perth in accordance with the SOLUS THREE standard instrument departure (SID) and climb to 5,000 ft. Figure 1 shows SOLUS THREE SIDs from runway 03 and runway 06.

Figure 1: Perth Airport SOLUS THREE SIDs from runway 03 (red highlight) and runway 06 (blue highlight)

Source: Adapted from Airservices Australia

The Automated Terminal Information Service (ATIS) that was available to pilots between 0852 and 0908 included the following information:

Runway 03 for all arrivals and for departures via [various waypoints including] SOLUS. Runway 06 for all other departures.

Based on the airways clearance and ATIS, the RXA2113 crew programmed the aircraft flight management system (FMS) for a departure from runway 03 direct to MIDLA followed by a left turn to track as specified by the SID to SOLUS, followed by the flight-planned route (Figure 1: red highlight).

The controller acting as SMC took control of this position at 0830. Between 0847 and 0901, the SMC had managed the taxi transit of five aircraft that all departed from runway 06.

At 0905, the RXA2113 crew contacted the SMC to request taxi clearance. The SMC recalled that he referred to the flight data record on his display and perceived that the aircraft was departing off runway 06. Accordingly, the SMC issued instructions for RXA2113 to taxi via taxiway ‘Charlie Six’ (C6) and hold short of runway 03 (Figure 2). At the same time, the SMC selected the intermediate hold point as the clearance limit on the ATS graphical display.

Figure 2: Perth Airport taxiway map with RXA2113 route highlighted in blue

Source: Adapted from Airservices Australia, annotated by ATSB

As required to ensure there was no conflicting traffic, the SMC coordinated a runway crossing for RXA2113 with the ADC. The SMC then issued onwards clearance for RXA2113 to ‘cross runway 03, taxi hold point Victor (V), runway 06’ and selected the hold point on the graphical display. Once the SMC was satisfied that the crew was complying with the instruction, he transferred the flight data record to the ADC screen as per standard procedure.

By now it was apparent to the RXA2113 crew that ATC intended for them to depart from runway 06 rather than runway 03 as nominated on the ATIS for SOLUS departures. At the time, the captain considered this and determined that they would still be compliant with the airways clearance as the runway was not part of the clearance and the SID was applicable to both runways. Given that key aspect and crew member experience of similar departures, the crew did not query ATC about the variation to the expected departure runway.

At hold point V the RXA2113 crew reprogrammed the FMS for the SOLUS THREE SID for runway 06. The captain recalled that this process did not present any problems to the crew and they were not aware of any safety implications.

In the tower, the trainee ADC was in the controlling position and the supervising ADC was seated behind and adjacent to the trainee. The trainee had full vision and control of the monitors and controls. The supervising ADC reported that although his view of the display was incomplete he remained vigilant of arriving and departing aircraft.

When the opportunity arose, the supervisor was asking the trainee questions about ATS policy and procedure as an ad hoc training activity. This was taking place while the RXA2113 crew prepared for take-off at the hold point. Although the flight data record for RXA2113 was displayed on the ADC display after the SMC had transferred it, there was no requirement for the ADC to pay attention to RXA2113 until the crew was ready for take-off.

At 0910, the RXA2113 crew contacted the ADC to advise they were ready to depart.

The supervising ADC recalled that the trainee ADC followed standard procedure to ensure that the runways and initial departure track were free of conflicting traffic. The supervisor did not have a clear view of the flight data record on the ATS display and it was unclear if the trainee ADC referred to it. Departures^[3] were being conducted in accordance with auto-release procedures so no coordination was required with the departures controller.

The supervising ADC related that during departures, the focus of both his and the trainee ADC’s attention was on monitoring for incoming and outgoing traffic, and checking that the runways were clear. At Perth Airport, the ADC controls arrivals and departures off all runways. This means that when an ADC issues a take-off clearance from one runway, he or she will also be aware of any aircraft arriving or departing from other runways.

The presence of the aircraft at hold point V indicated to the ADC that RXA2113 was scheduled to depart from runway 06, and the ADC issued a take-off clearance from that runway. The trainee ADC instructed the RXA2113 crew to line up, then at 0911 cleared the crew to take-off from runway 06 with instructions to contact ‘departures’ when airborne.

From the perspective of the crew and controllers in the tower, the take-off and departure was uneventful. However, the departures controller was expecting the aircraft to be on a northward track to MIDLA rather than tracking initially to the north-east before turning left to MIDLA (runway 03 departure, Figure 1). The aircraft was soon on the flight planned track and there was no reported loss of separation with any other aircraft.

The controllers in the tower were unaware of the discrepancy between the clearances issued to the crew of RXA2113 and the flight data record until advised by the departure controller.

Contextual information

The controllers described the traffic situation as quiet by 0840 because the number of aircraft movements had decreased from the earlier morning period. The weather at Perth Airport was not operationally significant, the visibility was good, and the wind was light and variable.

Personnel information

Surface movement controller

The controller who was performing the role of SMC held ATC certification and had about three years’ experience with Airservices. Prior to that, the controller had been trained by, and operated for, another ATC agency.

Prior to the day of the occurrence, the controller had three rostered days off. He reported having slept well the night before. Although the controller was concerned about the health of a close family member, he did not consider that his performance would be affected. There was no evidence to indicate that stress affected the actions of the SMC on the day of the occurrence.

Aerodrome controllers

The trainee controller who was performing the role of ADC under supervision had previous experience with another ATC agency. It was reported that the trainee controller had demonstrated competence at the console but needed further familiarity with Airservices’ policy and procedures.

On the day of the occurrence, both controllers in the ADC position started work at 0530, and had been working for approximately three and a half hours. They were in the second shift of their rotation, having come off rostered days off the day prior to the occurrence. It is not known what sleep either controller had prior to the occurrence.

Consideration of controller rostering and fatigue

The ATSB reviewed the actual hours worked and known sleep history of the SMC and ADCs for indications of fatigue on the day of the occurrence. Based on the available evidence, there is no indication that fatigue contributed to this occurrence.

ATC systems

Flight Data Record

The air traffic system automatically generated the departure runway for RXA2113 into the flight data record. This displayed the departure runway as 03 in the fourth column of the top row (Figure 3). The ATC system allowed the controllers to change the departure runway recorded for each flight. The system would notify other users that this change had occurred.

Figure 3: The Flight Data Record for RXA2113

Source: Adapted from Airservices Australia

Hold point selection panel

Immediately after the SMC instructed the RXA2113 crew to taxi to hold point V, he recorded that hold point in the ATC system. The SMC called up the ‘RWY03 Hold Points’ selection panel within the ATC system. The SMC used this panel to record the taxi clearance for RXA2113 to hold point V (Figure 4).

This panel presented all valid hold points for runway 03 departures. Although the hold point options on the graphical display were delimited to those associated with the system-assigned runway, hold point V was available to facilitate traffic flow from terminals 3 and 4.

Figure 4: Hold point selection panel in ATC system for runway 03 departures (Hold point V highlighted by ATSB)

Source: Adapted from Airservices Australia, annotated by ATSB

The ATSB noted that the ATS system did not provide any specific inhibitions to prevent or alert the controllers to the taxi of aircraft to non-conforming hold-points.

Safety analysis

Taxi clearance RXA2113

The surface movement controller issued taxi instructions to the crew of RXA2113 which directed them to runway 06. This was contrary to the departure runway (runway 03) recorded by the air traffic system and shown on the ATC flight data record.

When an aircraft crew requests a taxi clearance, the SMC would normally provide instructions based on the flight data record.

The ATSB considered the factors that might have adversely influenced the SMC’s attention and perception at the time. Based on the available information, there were no indications that fatigue, workload, expectancy, or stress from personal circumstances were contributory.

The ATSB also considered the presentation of the departure runway information on the flight data record. That information was presented clearly and saliently and there was a high level of contrast between the text and the background. No one reported that the flight data record was difficult to read or interpret. Therefore the runway information was readily accessible.

Therefore, as the SMC issued taxi instructions that were inconsistent with the flight data record, it is likely that he did not attend to the flight data record.

After the SMC issued the taxi instructions to hold point V, runway 06, there were no prompts for a reassessment of those instructions. Although they were not required to, if the crew of RXA2113 had requested confirmation that the departure runway was different to that expected, this would have prompted the SMC to check the flight data record. In this occurrence, the flight crew had identified the instructions were inconsistent with the information provided by the ATIS, as such this was a missed opportunity to identify and resolve this inconsistency. Although the ATC system limited the taxiway selections to those associated with the assigned departure runway, hold point V was necessarily available for use in conjunction with both runways 03 and 06.

Although the SMC instructed the crew of RXA2113 to taxi to a runway contrary to the flight data record, the ATSB did not identify any broader risk to safety posed by this action. There is no evidence that the taxi instructions issued to the crew reduced the safety of the aircraft or other traffic while it was taxiing and holding. The arrival of the aircraft at the hold point of runway 06 did have an effect on the ADC function.

Take-off clearance RXA2113

The trainee ADC issued a take-off clearance to the crew of RXA2113, which cleared them to depart from runway 06. Like the taxi clearance, this was also contrary to the departure runway recorded by the air traffic system and displayed on the flight data record.

The ATSB considered whether the training activity the ADCs were engaged in prior to issuing the take-off clearance affected their attention to and perception of the departure runway on the flight data record. The ADC supervisor related that the focus of attention of both ADCs during the take-off clearance was on monitoring incoming and outgoing traffic, and checking that the runway was clear and that in these circumstances the ADC would not normally focus on the flight strip of a taxiing or departing aircraft.

The ATSB also identified that the position of RXA2113, at hold point V, was a strong indicator to the ADC that aircraft was scheduled to depart from runway 06. Given the position of the aircraft at the hold point to runway 06 and crew report that RXA2113 was ready at that position, it is likely that both controllers engaged in the ADC function had an expectation that RXA2113 should depart from runway 06.

In this context it is unlikely that the training activity affected the likelihood of the ADC detecting the departure. The focus of the ADCs on traffic, and the expectation associated with the presence of the aircraft at runway 06, meant that the controller was unlikely to detect that the aircraft had been taxied to the incorrect runway, whether they were engaged in training or not. This expectation likely resulted in the two ADCs either not attending to the flight data record or misperceiving the runway information on the record.

Safety considerations

The departure of RXA2113 from runway 06 meant that the initial track of the aircraft was different to that expected by the departures controller. The departures controller used the air traffic system to identify which runway aircraft would depart from, in order to predict their track after departure.

Based on the information current in the air traffic system, the departures controller had expected RXA2113 to depart from runway 03 and commence on a northward track to MIDLA. Because RXA2113 departed from runway 06 and initially tracked to the north-east, this may have affected the departures controller’s understanding and awareness of the position of the aircraft.

The departure of RXA2113 from runway 06 was primarily the result of the taxi instructions provided by the SMC. After the SMC had issued these instructions, there were limited opportunities to identify the deviation in departure runway, or to update this information within the air traffic system.

The ATC system contains limited defences to prevent or identify deviations from the operational detail of the departure runway. The departure runway is recorded on the flight data record, and the system primarily relies on each controller attending to that record to ensure departures accord with the planned runway. In addition, aircraft separation relies on both controller and flight crew, and there is a role for flight crew to identify any perceived inconsistencies or errors to ATC.

The ATC system has comprehensive defences to ensure the separation of aircraft while taxiing, and during and after take-off. The ATSB did not identify any evidence that separation was affected at any stage during this occurrence.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The Perth SMC issued taxi instructions to the flight crew of a departing aircraft that directed them to the holding point of runway 06 rather than runway 03, which was assigned by the air traffic system and shown in the flight strip details.
• The aerodrome controllers cleared the crew of the departing aircraft to take-off from runway 06, which was contrary to the runway assigned by the air traffic system and shown in the flight strip details. As a result, the initial track of the aircraft was different to that expected by the departures controller.
• There was no broader safety risk identified as a result of either the taxi or take-off clearances. The taxi clearance provided to the crew of the departing aircraft did not reduce the safety of the aircraft while it was taxiing and holding. The take-off clearance did not reduce the separation of the aircraft during take-off or departure from the airport.

Safety action

Airservices reported that as a result of this incident, they have conducted a check assessment with the SMC. Airservices have developed a training and performance improvement plan for the SMC, to address several performance issues identified in their review.

Safety message

This occurrence highlights how deviations from flight details, as presented in the air traffic system, affect the ability of controllers and flight crews to understand and predict the behaviour of aircraft. Furthermore, limited defences exist to identify when instructions have deviated from the information recorded in the system. Although in this occasion the ATSB has not identified any significant risk to the safety of taxiing or departing aircraft, controllers are reminded that they play an important role in remaining vigilant to the content of displayed data, and updating the system when deviations do occur.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The surface movement controller (SMC) is responsible for controlling the movement of aircraft around the Aerodrome movement area. The SMC issues taxi instructions to aircraft to route them across the aerodrome surface.
2. The aerodrome controller (ADC) issues line up and take off clearances to the crew of departing aircraft, and landing clearances to the crew of arriving aircraft. The purpose of these instructions is to ensure that aircraft depart from and arrive on runways clear of obstructions, and that prescribed separation standards exist once aircraft take off.
3. The departures controller works in a separate location to the control tower at Perth airport.

What happened

On the evening of 9 May 2018, an Airbus A320, registration VH-VQL, was being operated on a regular public transport flight by Jetstar Airways Pty. Ltd. The flight departed Avalon Airport, Victoria, at about 1800 Eastern Standard Time,^[1] for Sydney, New South Wales.

Approaching Sydney Airport, air traffic control (ATC) cleared the aircraft for a high-speed descent from flight level FL 250^[2] for the RIVET TWO Standard Instrument Arrival (STAR).^[3] At about 1846, the first officer (FO), who was the pilot flying, commenced the descent via the published waypoints for the STAR (Figure 1).

Figure 1: Departure and approach chart – Sydney Airport

Source: Airservices Australia, modified by ATSB.

After passing DUDOK, ATC provided clearance to conduct the runway 34L^[4] Independent Visual Approach (IVA) and provided radar vectors for a final approach intercept (Figure 2 and red line on Figure 1). Crossing the coast, the aircraft was about 2,000 ft high on profile compared with other similar approaches (see the section titled Approach profiles) Figure 1.

After passing BOOGI on descent, the captain commented to the FO on the possibility of track shortening^[5] due to the only preceding traffic being on final approach for runway 34L.

Observing the aircraft was high, the flight crew selected ‘open descent mode’^[6] in order to increase the aircraft’s rate of descent. They then deployed speed brakes in an attempt to intercept the runway 34L glideslope.

After intercepting the final approach course, the flight crew selected landing gear down and disengaged the autopilot. The FO reported manually flying the aircraft to intercept the glideslope from above. At about 2,850 ft, which was 300 ft above glideslope, the flight crew selected the first flap setting for landing.

Figure 2: VH-VQL approach path to runway 34L Sydney

Source: Google earth, modified by ATSB

Prior to configuring for ‘flaps 2’, the flight crew selected the missed approach altitude of 3,000 ft in the altitude window of the flight control unit (FCU). The recorded data indicated that the altitude selector was also pulled, which changed the aircraft’s vertical flight mode from open descent to open climb. In response to the mode change, the auto-thrust system, which was active at the time, increased thrust to climb the aircraft to 3,000 ft. Unaware of the thrust increase, the flight crew continued configuring for the approach by selecting ‘flaps 2’.

The increase in thrust increased the aircraft’s airspeed. This led to the FO reducing the aircraft’s descent rate in an attempt to manage the acceleration and prevent flap overspeed. Despite this, the aircraft’s airspeed continued to increase, leading to a 2 kt flap overspeed. Reducing the rate of descent also resulted in the aircraft diverging further from the approach glide path.

The recorded data showed that a thrust lever reduction to idle occurred just prior to exceeding the ‘flaps 2’ extension speed. A few seconds later, the airspeed decreased back below the maximum ‘flaps 2’ extension speed. Observing that the approach was not stable, the captain commanded the FO to go around.^[7]

In response, the FO increased the thrust levers to the take-off/go-around setting (TOGA) however, recorded data showed that the aircraft was not pitched to the required 15° nose-up attitude. Consequently, the aircraft continued to accelerate. The captain reported that he announced ‘pitch’ and ‘speed’ to draw the FO’s attention to the under rotation. However, the aircraft’s airspeed exceeded the maximum ‘flaps 2’ extension speed by 8 kt. The FO reported identifying that as the aircraft was going to exceed the ‘flaps 2’ speed, he selected ‘flaps 1’, which was not in accordance with the standard operating procedures. However, the aircraft also accelerated through the maximum ‘flaps 1’ extension speed of 230 kt by about 8 kt and by the time the flap had fully retracted, the exceedance had increased to 24 kt.

Due to the aircraft’s acceleration the FO also ordered the retraction of the landing gear. By the time the landing gear had retracted fully, the aircraft had exceeded the maximum landing gear transition speed by 13 kt.

As the ‘flaps 1’ extension speed was exceeded, the captain advised the FO that he was taking control of the aircraft. Recorded data showed that the captain reduced the thrust, pitched the aircraft to 15° nose-up, and climbed to the missed approach altitude. The captain assumed the pilot flying role for the remainder of the flight, and an approach and landing was made on runway 34L.

Approach profile

A number of ATSB investigations have identified the importance of the management of the aircraft energy state and profile during the approach and landing phases of flight. They are known to be high workload periods for flight crew, especially during high-speed descents. This requires a high level of attention to ensure the aircraft meets the stabilised approach criteria prior to the required altitude.

The approach profile for VH-VQL, between DUDOK and final approach to runway 34L, was comparably higher and faster than previous flights (Table 1 and Figure 3).

Table 1: Comparative descent profiles for VH-VQL on the RIVET 2 STAR, Sydney

Source: ATSB

Despite being cleared for a high-speed descent during the initial phase of the arrival, the aircraft was recorded to have arrived at BOOGI slightly high on profile, with an airspeed reduced to 250 kt, which was required by the standard operating procedures (SOP). However, between DUDOK and NASHO the aircraft’s descent shallowed until crossing the coast prior to NASHO. This positioned the aircraft about 2,000 ft high on profile in comparison to other flights that were flown in the same aircraft type by different flight crews.

Figure 3: VH-VQL comparative approach to Sydney Airport, RIVET TWO STAR 34L

Source: Google earth, modified by ATSB

Recorded data indicated that the descent rate of the aircraft increased after crossing the coast, which corresponded to the ATC clearance for the commencement of the IVA. Further, the data showed the aircraft’s selected speed target remained set at 250 kt prior to intercepting the final approach track. The flight crew continued to use various speed targets for the remainder of the approach in an attempt to slow/configure the aircraft and capture the glideslope profile.

The data also indicated that the aircraft turned onto final approach at about 9.8 NM from the runway threshold, at about 3,400 ft. The aircraft’s speed turning final was about 223 kt. This resulted in delays with aircraft configuration and achieving a stabilised approach.

Stabilised approach criteria

The company Operations Manual detailed that an approach to land is stabilised when all of the following criteria are met by no later than 1,000 ft height above the aerodrome (HAA):

1. The aircraft is on the correct nominated flight path and only small changes to required bank angle and pitch are needed to maintain the correct flight path

2. The aircraft speed is not more than speed target +10 kt and not less than speed target -5 kt (refer Note immediately below);

Note: Reference (2) above: In VMC ONLY the approach may be continued below 1000 ft HAA provided the PIC is confident the speed target will be achieved by no later than 500 ft HAA.

3. The aircraft is in the correct landing configuration

4. Sink rate is no greater than 1000 ft per minute below 1000 ft above the aerodrome

5. Thrust setting is appropriate for the aircraft configuration and is not below the minimum power for the approach as defined in the aircraft’s operating manual

6. All briefings are completed.

Go-around procedure

In the event of an unstable approach, the company procedure detailed that the pilot flying (PF) should apply three initial actions simultaneously;

• Advance thrust levers to take‑off/go‑around (TOGA) thrust
• Rotate the aircraft to 15° of pitch, if all engines are operating
• Announce go‑around to the pilot monitoring (PM).

Subsequent assistance is then provided by the pilot monitoring (PM) to retract one setting on the flaps and the PF announces the flight mode readout. The PM then checks the modes on the flight mode annunciator and announces positive climb. The PF then commands landing gear up, the PM would then select the landing gear up and the rest of the procedure is actioned.

Flight Crew

The Jetstar operations manual required a minimum of two flight crew for the operation of the A320. Additionally, pilots must also meet the minimum experience and qualification requirements outlined in the company SOPs. To ensure that each member of the flight crew can demonstrate sufficient role competency, newly‑appointed captains and FOs operated on a restricted basis, after clearance to line, for a period of six and three months respectively. Jetstar also requires that no more than one pilot may operate under restriction on the flight deck of the A320 at any one time. The captain had just completed his initial command restriction period and all flight crew met the company requirements prior to the flight. Both flight crew were appropriately licenced, qualified and experienced on the aircraft type and held valid Class 1 medicals.

The captain had a total of about 20,000 hours flying experience, of which about 2,600 hours was on A320 aircraft. He had logged over 600 hours and over six months as captain on the A320 prior to the incident. His last flight check was conducted in an A320, on 22 February 2018, and he was familiar with runway 34L as he had been based in Sydney since 2012. He did not have any health issues and advised being well rested prior to the flight.

The FO joined the company in 2011 with significant civil and foreign military flying experience, and had logged over 8,700 flight hours total time, of which over 3,300 hours were on the A320. His last flight check was conducted in an A320 on 9 January 2018 and was familiar with runway 34L as he had been based in Sydney since 2016. The FO reported feeling well rested prior to the flight, and in good health.

Except for the previous sector, both pilots had not flown together in their respective roles on the A320. However, they had flown briefly together about five years prior on the A330 and were aware of each other’s experience and aviation background. In reflecting on the occurrence, the captain reported that his knowledge of the FO’s background created a performance expectation that reduced the cockpit gradient^[8] during the flight and delayed his intervention during the occurrence. The FO reported that his relationship with the captain was good.

Safety analysis

Management of the approach

The arrival to DUDOK was comparatively similar to other flights. However, after DUDOK, insufficient descent rate resulted in the aircraft being high on profile. Additionally, the flight crew maintained a selected speed of 250 kt prior to turning onto final, which positioned the aircraft in a high-energy state and led to delays configuring the aircraft. The high speed and profile required an irregular intercept of the glideslope from above, on final approach. It was likely that, at this time, the flight crew’s focus of attention was primarily on configuring the aircraft, reducing its speed and capturing the glideslope. In addition, the flight crew elected to descend manually using the flight directors, increasing their workload as they approached 1,800 ft.

Prior to 1,800 ft, the missed approach altitude of 3,000 ft was selected in the altitude window of the flight control unit (FCU). At this time, the altitude selector was also pulled which initiated a mode change to open climb. This change had the effect of increasing thrust, as the auto-thrust system was still active. This went unnoticed by the crew despite the annunciation and resulted in increasing airspeed.

Without the automated thrust increase the crew may have been able to stabilise the approach in accordance with the operator’s required criteria. However, the undetected thrust further destabilised the approach and subsequently led to the initial flap overspeed. Had the flight crew identified the flight mode annunciator (FMA) change, appropriate and timely action may have prevented the flap overspeed and prompted an earlier go-around.

The go-around

Having assessed that the aircraft was unlikely to meet the stable approach criteria, the captain appropriately initiated the go‑around.

A go-around requires a methodical sequence of many actions by both the pilot flying and the pilot monitoring. During a go-around, the aircraft transitions quickly from descending at relatively low thrust, to climbing at high thrust with a changing configuration. The tempo of the sequence is relatively rapid compared to other normal in-flight manoeuvres.

At the initiation of the go-around, the flight crew did not conduct the sequence in accordance with the required standard operating procedures. This led to the normal go-around flight crew actions being delayed, omitted, and out of sequence. Further, the nature of the two-engine, high-energy go-around is such that there is a rapid acceleration of the aircraft. When the FO did not increase the pitch to the expected nose up attitude, the aircraft accelerated more quickly than the flight crew expected. This limited the time available to complete the required actions of retracting flap and landing gear before exceeding the operational limitations of the aircraft.

As the pilot monitoring, the captain had good opportunity to observe the rapidly accelerating aircraft, and that the FO had not pitched the aircraft as expected. This, combined with the non‑standard flap selection made by the FO, were cues to the captain to formally intervene and reduce the risk of the flap and landing gear overspeed.

Cockpit gradient

The captain reported that he had high regard for the FO’s experience and that influenced the performance he expected from him. Consideration of the FO’s background also influenced the point at which the captain felt it necessary to intervene during the flight. In hindsight, the captain felt that the cockpit gradient contributed to the occurrence by delaying the required intervention.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• While descending through 1,800 ft, the crew inadvertently activated open climb mode with the selection of the assigned altitude selector to 3,000 ft. This resulted in an undetected increase in thrust, which destabilised the approach, and led to the flap overspeed.
• The use of a non-standard go-around procedure, including a lower than required pitch attitude, resulted in increased acceleration and exceedance of the flap and gear limitations.
• The captain's perception of the first officer's level of experience likely led to a shallow cockpit gradient. This influenced the captain's level of intervention during the approach and go-around.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The operator conducted an internal investigation which highlighted the importance of situational awareness of flight crews and reiterated the operational guidelines in the ‘Airbus ‘Golden Rules for Pilots’, which included rule 3 ‘Understand the FMA at all times’ and included expectations for the crew to monitor, announce, confirm, and understand FMA changes and annunciations.

Safety message

Handling of approach to land is one of the ATSB’s SafetyWatch priorities. Unexpected events during the approach and landing can substantially increase what is often a high workload period. Adherence to standard operating procedures and correctly monitoring the aircraft and approach parameters provides assurance that an independent visual approach can be safely completed. The selection of inappropriate auto-flight modes, unexpected developments, or any confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.

A go-around should be immediately carried out if the approach becomes unstable or the landing runway cannot be identified from the minimum descent altitude or missed approach point.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
3. Standard terminal arrival route.
4. Runway number: the number 34 represents the magnetic heading of the runway, 340°. The runway identification may include L, R or C as required for left, right or centre.
5. Track shortening occurs when air traffic controllers direct an aircraft to turn earlier than usual, to land in a shorter time frame, which assists with sequencing aircraft for landing and take-off.
6. The open descent mode is a selected mode where the aircraft uses target values set by the flight crew using the flight control unit (FCU) selections, while disregarding any constraints contained within the prepared vertical flight path loaded in the flight management guidance computer.
7. To abandon the landing and make a fresh approach.
8. The term ‘cockpit gradient’ can variously refer to the difference between involved pilots in terms of age, experience levels and position held in the organisation.

The occurrence

What happened

On 14 May 2018, a Gippsland Aeronautics GA-8 Airvan (Airvan) aircraft, registered VH‑BFL, departed Kununurra, Western Australia (WA) on a scenic charter flight. The pilot and three passengers were on board.

After about one hour and fifteen minutes, the aircraft landed at Bellburn Airstrip (Bellburn), 202 km SSW from Kununurra, and picked up four more passengers. The aircraft departed at about 1600 Western Standard Time^[1], to continue the scenic flight. A second company aircraft was utilised to carry the passengers’ baggage.

About 12 minutes after departure, the pilot commenced a planned climb from 2,500 ft to 3,500 ft above mean sea level, during which he felt the aircraft performance was a bit ‘sluggish’. The pilot reported that the climb rate was lower than expected with the aircraft’s speed between 85–100 kt. The pilot also observed the fuel flow was about 55–60 litres per hour (l/hr), which was less than expected for the full rich mixture setting selected.

The pilot reported that he then completed a check of the engine settings and physically confirmed, through touching the controls, that the mixture was full rich, the throttle control was set to 25 inches of manifold pressure, and the propeller lever was set to 2,500 revolutions per minute. The pilot turned the fuel pump on, which made no difference to the aircraft performance. He then notified the company chief pilot, who was flying the other aircraft.

The pilot decided to divert and commenced a turn back to Bellburn maintaining 3,500 ft. The pilot left climb power set and briefed the passengers that they were diverting to Bellburn. The fuel flow had now reduced to about 50–55 l/hr, however, airspeed and height were maintained. The pilot checked if there were any other abnormal indications but all gauges were indicating normally, with both fuel tanks indicating three quarters full and no warning lights illuminated.

During the transit back to Bellburn, the pilot performed some troubleshooting by gently moving the throttle back and forward. There was a noticeable deceleration when the throttle was moved back so the pilot returned it, to its original position for the transit back to Bellburn.

The pilot reported that about 18 km from Bellburn, without further pilot intervention, the power slowly started to decrease. To maintain height, the pilot increased the aircraft’s pitch, resulting in a decrease in airspeed. When the airspeed reached 80 kt, the best glide speed for the aircraft, the pilot commenced a shallow descent, maintaining 80 kt. The pilot reported fuel flow was reading approximately 45 l/hr in the turn. The pilot contacted the chief pilot to advise him of the descent and asked for further assistance. On suggestion from the chief pilot, the pilot moved the mixture control a few millimetres back and then forward again. Immediately the engine started to run very roughly. The fuel flow then dropped to 35 l/hr and the engine started to cough and splutter. The pilot estimated that they lost about 90 per cent of the power that had been available prior to adjusting the mixture setting.

At this point, the pilot determined that a forced landing was required and turned into wind. The pilot maintained 80 kt, and confirmed the fuel pump was on, the mixture control was set to full rich, the ignition was on both magnetos, and the throttle was pushed forward. The pilot advised the passengers that he was performing a forced landing and briefed them on the process for evacuating the aircraft after landing. During the descent, the pilot tried pushing the manual prime button, which produced no increase in engine performance.

The pilot selected a forced landing area and turned towards it. During the descent, at approximately 150 ft above ground level, the pilot secured the engine and turned off the aircraft’s electrical system. During the landing roll, the wings hit some small trees. Towards the end of the landing roll, the aircraft went into a ditch and tore off the nose landing gear.

The chief pilot reported that he notified air traffic control of VH‑BFL’s situation and position as the aircraft landed.

After the aircraft came to rest, the pilot directed the passengers out and away from the wreckage. The pilot checked everyone for injuries and provided assistance where required. The pilot returned to the aircraft, activated the emergency locator transmitter, and contacted the chief pilot in the company aircraft, which was circling overhead.

The pilot visually checked the fuel level in the left wing, and found it was close to full. There was a noticeable fuel leak from the right wing where a small tree had struck the wing, so the pilot turned off the master and avionics switches and went back to wait with the passengers.

After about ten minutes, two helicopters from Bellburn arrived and transferred the passengers and pilot back to Bellburn. The operator then utilised other aircraft in its fleet to ferry the pilot and passengers back to Kununurra where the pilot and three passengers attended the local hospital with minor injuries.

Figure 1: VH-BFL forced landing site

Source: Operator

The operator carried out a visual inspection of the aircraft at the accident site and noted that the number six cylinder air intake pipe was missing from the engine. Due to difficulties accessing the remote site, there was a delay in recovery and further examination of the wreckage by the operator.

The aircraft’s records indicated that a 110 hourly inspection was carried out three weeks prior to the accident. This included an inspection of the induction system and no defects were noted. The last engine overhaul was performed in April 2016, and no scheduled or unscheduled maintenance requiring the removal of the engine’s number six cylinder air intake pipe had been recorded since.

Records obtained from the fuel supplier indicated that checks were performed when the fuel was received, in addition to the subsequent daily inspections and a post-occurrence check following this occurrence. These checks all indicated the fuel was clear, bright, and contaminate-free.

Operator comments

The chief pilot provided the following comments:

• When visiting the forced landing site, several days after the event, a search of the forced landing site was performed however, the missing intake pipe was not found (Figures 2 and 3).
• The pilot had recently completed the company induction training package, which included several practice forced landings.

The chief engineer provided the following comments:

• A ’spanner check’ was carried out immediately after the accident on all Lycoming engines in the operator’s fleet. The same check was also carried out on engines from other manufacturers that had been recently overhauled and fitted. No deficiencies were found.
• Engineering staff were reminded to remain vigilant when refitting engine components.

Figure 2: Image of engine with number six cylinder air intake pipe missing

Figure 3: Lower (left image) and upper (right image) air intake pipe attachments points highlighted in red. Air intake pipe, bolts and flange are missing.

Source: Operator

Pilot comment

The pilot provided the following comments:

• On the day of the incident, the pilot had flown VH‑BFL from Kununurra to Bellburn and taken off again without any issues.
• The aircraft had sufficient fuel for the flight and was within weight and balance limits.
• Prior to the flight, the pilot conducted fuel drains on VH-BFL. No water or other contaminants were found in the fuel.
• Recent forced landing practice in the Airvan helped the pilot to feel more comfortable with the emergency. In particular, the recent practice gave the pilot a good appreciation for the Airvan’s glide ratio, which helped when selecting a suitable landing site.

Engine manufacturer comment

The engine manufacturer advised that detachment of an induction pipe will cause a loss of power and likely engine flame out. They further stated that:

The fuel injector measures the total induction airflow and meters fuel to the correct mixture ratio. An induction leak reduces the airflow through the injector, so there is less fuel metered, however the actual airflow to the cylinders is increased due to the leak, which results in an overall Lean mixture for all cylinders.

Previous occurrence

A review of the ATSB database identified a similar occurrence, involving the same aircraft type, which occurred on 21 October 2015, AO-2015-123. On that occasion the aircraft experienced a power loss shortly after take‑off however, sufficient power remained to permit a return to the departure airport. Prior to commencing operations that day a pre‑flight inspection of the aircraft had been conducted, with no defects found.

Examination of the aircraft after landing identified that the intake tube on the number four cylinder was loose. Maintenance, involving removal of the intake tube, had been conducted on 10 October 2019, however it was reported that the tube was securely re-fitted and that all other similar securing bolts were also checked. The circumstances that led to the fasteners loosening could not be established.

Safety analysis

During the flight from Kununurra to Bellburn and the subsequent departure from Bellburn, the pilot reported the aircraft was performing normally. From the start of the emergency, there was a gradual degradation in performance until a forced landing was required. The pilot noted that throughout the emergency, the fuel flow was indicating below normal and that all other engine indications were normal.

The reported performance of the aircraft was consistent with the likely symptoms resulting from the air intake pipe to number six engine cylinder becoming lose and then detaching in flight. Consequently, the ATSB concluded that the missing intake pipe was the cause of the loss of power however, consistent with the previous occurrence in 2015, the reason for the air intake pipe coming loose could not be determined.

The pilot made the decision to turn back to Bellburn Airfield early in this emergency and when the situation developed, he quickly recognised the need for a forced landing. By turning into wind and using the best glide speed for the aircraft, the pilot maximised the time available to deal with the emergency and his landing options. In addition, the pilot made good use of the supporting aircraft with the chief pilot on board for troubleshooting advice.

Although it could not be determined as to what extent the pilot’s recent forced landing practice influenced the accident sequence, it is likely that the practice reduced the risk of mishandling the emergency and may have prevented further injury to the occupants of the aircraft.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The air intake pipe to engine cylinder number six probably detached in flight, leading to the loss of engine performance. There was insufficient evidence to determine why the intake pipe detached from the engine.
• Recent forced landing practice performed by the pilot as part of the operator’s joining procedures likely reduced the risk of mishandling the emergency and may have prevented more serious injuries being received by the pilot and passengers during the forced landing.

Safety message

This accident highlights the importance of frequent emergency procedures training. The pilot’s handling of the forced landing contributed positively to the survivability of this accident in difficult terrain. Although, as a minimum, flight reviews are required every two years, pilots and operators are reminded of the benefits of more frequent practice of emergency procedures.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours

Safety summary

What happened

On 15 April 2018, a Qantas Airways Airbus A330, registered VH-EBR, departed Brisbane Airport, Queensland, for a regular public transport flight to Auckland, New Zealand. Shortly after departure, the crew received an advisory notification indicating excessive vibration from the left engine.

The crew reduced thrust on the left engine to idle, and the noise and vibrations ceased. The crew elected to return to Brisbane, and landed uneventfully. The thrust on the left engine remained at idle during the air turn back.

What the ATSB found

The General Electric CF6‑80E1 engine utilises rows of variable stator vanes (VSV) between each of its high-pressure compressor (HPC) stages for optimal airflow. Worn bushings led to fretting damage on a lever arm in the fourth-stage VSV system. The lever arm fractured, allowing the VSV to become off‑schedule (misaligned), affecting the airflow entering the stage four HPC.

The airflow disturbance resulted in abnormal aerodynamic loading and ultimately, fatigue failure of a fourth stage compressor blade. The downstream turbomachinery was then damaged due to the progression of blade debris through the engine.

Three non-mandatory VSV lever arm inspections were carried out prior to the occurrence but were not effective in detecting the bushing wear.

General Electric intended that replacement of the complete set of bushings was required when more than half of the accessible bushings were worn. However, the operator had proactively replaced worn bushings individually when found during maintenance. As a result, the threshold to replace the complete set would not be reached and inaccessible bushings would not be replaced.

What's been done as a result

As a result of this occurrence, Qantas inspected all CF6‑80E1 engines in the A330 fleet for similar defects. No defects were identified. Additionally, Qantas issued a maintenance memo to service personnel, highlighting the maintenance actions for the VSV system and precautions to be aware of when carrying out work in this area.

Safety message

When maintenance organisations carry out additional activities to what is required, they should consider checking with the manufacturer to confirm that no unintended consequences could be introduced.

The occurrence

At about 0905 Eastern Standard Time^[1] on 15 April 2018, Qantas Airways flight QF123, an Airbus A330-202 aircraft registered VH-EBR, departed Brisbane Airport, Queensland, for a regular public transport flight to Auckland, New Zealand.

About 4 minutes later, while climbing through 9,000 ft, the electronic centralised aircraft monitor displayed an ENG 1 N2 VIBRATION^[2] advisory notification, indicating excessive vibration on the left engine. The crew carried out actions in accordance with the abnormal and emergency procedures checklist, reducing thrust on the left engine. The aircraft continued its climb at reduced thrust.

After several minutes, while climbing through flight level 190,^[3] two loud bangs occurred and continuous airframe vibrations commenced. The crew reduced thrust on the left engine to idle and the noise and vibrations ceased. The thrust on the left engine remained at idle for the remainder of the flight. The crew declared a PAN PAN^[4] and returned to Brisbane, landing safely at about 0945.

__________

1. Eastern Standard Time: Coordinated Universal Time (UTC) + 10 hours.
2. N2: the rotational speed of the high-pressure compressor in a turbine engine.
3. Flight level: at altitudes above 10,000 ft. in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 190 equates to 19,000 ft.
4. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Context

Aircraft description

The Airbus A330 range of aircraft is a twin-engine, wide-body airliner. It is available with three different engine installation options. VH-EBR was fitted with General Electric (GE) CF6-80E1 (CF6) engines. Other engine options available for the A330 were the Pratt & Whitney PW4000, or the Rolls-Royce Trent 700 engines.

Recorded data

Figure 1 shows a plot of the data that was obtained from the quick access recorder (QAR). During the take-off roll, the left engine vibrations (black line) increased to a higher-than-normal level for the CF6. The vibrations continued to increase, resulting in the ENG 1 N2 VIBRATION message displaying on the electronic centralised aircraft monitor (ECAM) at about 0909. The left engine thrust was reduced in response. About 5 minutes later, two left engine vibration spikes were recorded, consistent with the loud bangs and airframe vibration reported by the crew. The left thrust lever was then reduced to idle.

The ATSB also downloaded data from the previous five flights. The recorded data showed that on each of those flights, the vibration level of the left engine was higher than normal but had not reached the limit to trigger the ECAM notification.

Figure 1: Plotted data from QAR showing vibration levels and thrust lever positions during the occurrence flight

Source: ATSB

Engine information

Post-flight engineering examination

A post-flight engineering inspection of the left engine identified metal fragments in the tail pipe and two missing fourth stage high-pressure compressor (HPC) blades. Figure 2 shows a cross‑section of the GE CF6 engine, with the location of stage four of the HPC highlighted.

The inspection also identified that several variable stator vane (VSV) lever arms were bent, and one was broken (Figure 3). The engine was subsequently shipped to an overhaul facility, where it was disassembled and inspected under the supervision of the engine manufacturer.

Figure 2: GE CF6 cross-section showing a detailed view of the HPC

Source: General Electric, annotated by ATSB

Figure 3: Section of the fourth stage variable stator vanes showing the fractured number 24 lever arm and resulting off-schedule vane. Inset shows location on engine at 3 o’clock position.

Source: Evergreen Aviation Technologies Corporation, annotated by ATSB

Engine disassembly and inspection

The engine disassembly and inspection revealed:

• there was no damage to the first three HPC stages
• two of the fourth stage HPC blade assemblies, number 3 and number 5, had separated at the dovetail-mounting portion of the blade root (Figure 4)
• of the 50 fourth stage VSV lever arms, eight were distorted and the number 24 position was completely fractured
• the separated blades had damaged the rear face of the fourth stage vanes with the distorted lever arms
• the compressor and turbine sections downstream of the separated HPC blades were damaged from progression of the blade debris through the gas path.

All of the fourth stage compressor blades, variable stator vanes and lever arms were sent to the engine manufacturer’s materials examination laboratory for analysis.

Figure 4: Disassembled engine showing fractured dovetails within fourth stage

Source: Evergreen Aviation Technologies Corporation annotated by ATSB

Component failure analysis

Fourth stage blades

A laboratory examination by GE found that the blade fitted to the number 3 position failed due to the propagation of a high-cycle fatigue^[5] crack that initiated in the blade root at the forward edge (in the direction of rotation). Other failures of the stage 4 blades have been reported previously, where the deterioration of the blade coating was identified as an important factor.  There was no significant deterioration of the blade coating on this engine.

The blade in the number 5 position failed as a result of more rapid fatigue crack progression cracking (Figure 5). The examination found that this was due to secondary damage, likely from impact by the released number 3 blade. One other fourth stage blade was cracked.

Figure 5: Detailed view of fractured blades

Source: General Electric, annotated by ATSB

Variable stator vane lever arm

The VSV lever arm fractured as a result of fatigue crack progression that originated at an area of fretting^[6] wear between the lever arm and washer (Figure 6 and Figure 7). The fretting on the lever arm was determined to have resulted from wear to the composite bushings fitted under the VSV lever arm. As the bushing wore, the VSV was allowed to tilt, placing a bending and twisting moment into the lever arm.

Figure 6: VSV design and component locations, highlighting outer bushing and lever arm

Source: General Electric, annotated by ATSB

Figure 7: Fractured VSV lever arm, its location and a close-up picture of the fracture surface showing fretting damage and high-cycle fatigue cracking

Source: General Electric, annotated by ATSB

Once the lever arm was broken, the vane rotated freely, which disrupted airflow into the fourth stage compressor. This created vibratory aerodynamic loading of the blades, which resulted in the fatigue cracking.

The bending damage in the nine VSV lever arms was determined to be secondary damage from contact with the separated compressor blades.

Engine maintenance history

The engine involved in this incident had accumulated 43,635 hours, 7,815 cycles since new and 13,047 hours, 3,352 cycles since its last overhaul. Since the last lever arm inspection, the engine had accumulated 2,474.46 hours and 551 cycles.

During the last engine overhaul, a number of fourth-stage compressor blades, including blade 3, were inspected, assessed as being serviceable and refitted. Others, including blade 5, were installed new at that time.

Variable stator vane inspections

Aircraft maintenance manual

VSV lever arm inspections were recommended by the engine manufacturer, but not mandatory. The inspection had an interval of 1,000 cycles between inspections. Qantas had opted to conduct this inspection, although in a modified form, due to a history of broken fifth stage lever arms experienced by other operators (see Related).

The aircraft maintenance manual (AMM) required inspection of the VSV:

stages 1, 2, 3 and 4 for vane trunnion metal touches stator case metal (MTM - metal-to-metal)

The manufacturer and operator both stated that lever arm looseness was identified through a wiggle check, which would indicate worn outer bushings. The AMM went on to state that if the engine had:

greater than 50% of the vanes in the stage with MTM

then the maintainer must:

replace outer bushings with new flanged outer bushings (this repair returns these parts to a serviceable condition).

This rectifying work could either be performed at the time of the initial inspection or postponed for a period, based on flight hours or cycles. The permitted extension was in place to allow time for maintenance action to be scheduled at the earliest opportunity.

Inspection accessibility

The ATSB examined a different CF6 engine fitted to an A330 undergoing maintenance and found that access to some VSV lever arms, at all stages of the compressor, was difficult.

About 75 per cent of the fourth stage VSV arms could be examined without engine removal and further disassembly of engine ancillary components. The remainder were not accessible due to the fitment of a large external gearbox covering the six to nine o’clock^[7] position of the engine. The number 24 lever arm was situated at the three o’clock position and was therefore accessible.

The ATSB asked the engine manufacturer how a maintainer could determine when 50 per cent of the lever arms were worn, if a quarter of them were not able to be accessed. The engine manufacturer advised that the determination was 50 per cent of the number accessible. The engine manufacturer also advised that the intent of the rectification requirements was that when the 50 per cent threshold was met, the bushings were to be replaced as a complete set on that compressor stage.

The engine manufacturer surveyed five other A330 operators on current inspection practices and common findings. Some operators did not carry out bushing inspections on-wing, due to the inspection being non-mandatory. They were only inspected during shop visits or if found during other maintenance. The operators did not report that the lever arm bushings wore preferentially in any location around each compressor stage.

Operator inspections

The operator proactively replaced any VSV bushing that was found worn, prior to the engine reaching the 50 per cent limit. Stage four bushings had been replaced on other engines where, a portion were replaced at any one time. They advised this was to improve the overall condition of the vane stages. They sought clarification from the engine manufacturer prior to the occurrence, regarding the suitability of individual replacement, but reported they had not received a response.

The engine involved in this incident had undergone three inspections of the VSV system since its last overhaul. No defects resulting from these inspections were noted, and no bushings had been replaced.

Related occurrences

In November 2017, a Qantas A330 experienced similar inflight vibrations. The flight continued to its destination, where an inspection found that number 24 lever arm was fractured and one HPC blade had separated. GE reported that there had been no other fourth stage lever arm occurrences of this type in over 23 million flight hours and 4.7 million flight cycles accumulated by the CF6-80E1 world fleet as at March 2018. There were a number of failures of HPC stage 5 lever arms prior to 2002, however that issue was resolved through redesigned lever arms and bushings.

The manufacturer analysed the November event and determined the lever arm and blade had failed in the same manner as the subject occurrence. There were no commonalities found with engine hours or cycles, and no indication that the event engines had been operated significantly differently from the fleet. The manufacturer therefore determined that the two events were most probably related to maintenance in the area.

The ATSB reviewed the maintenance work packages for the engines involved and considered, for example, whether the lever arms at the number 24 position had been unintentionally damaged during a particular maintenance practice, causing accelerated bushing wear. However, there were no aspects identified with respect to personnel or work practices that may have linked the two occurrences.

__________

5. High-cycle fatigue develops from repeated elastic (non-permanent) deformation of the material and is associated with a very high number of low-stress cycles.
6. High frequency, low amplitude relative motion between surfaces in contact.
7. O’clock: the clock code is used to denote the direction of, or the location on an aircraft relative to the observer’s position. In the case of an engine, when viewed from the rear.

Safety analysis

Engine vibration

The combination of worn outer bushings and fretting wear on a fourth stage high-pressure compressor (HPC) variable stator vane (VSV) lever arm resulted in a fatigue crack, leading to a fracture of the lever arm. The associated stator vane rotated into an off-schedule position and created turbulent airflow that acted like a cyclic pulse on the fourth stage HPC blades, as they passed the off-schedule vane. This aerodynamic cyclic loading resulted in initiation of a high-cycle fatigue crack in at least two compressor blades, until one blade separated at its root, causing damage to the downstream engine components and a noticeable increase in measured engine vibration.

Periodic maintenance

Qantas inspected the VSV system in accordance with the manufacturer’s non-mandatory inspection, with the exception of the individual replacement of worn bushings, as they were discovered. The inspections were generally effective in that assemblies accessible for inspection had previously been found to be loose and were replaced. However, while the failed (number 24) VSV lever arm was also accessible, no issues were found in the most recent inspections. Noting that the engine was approximately halfway between the 1,000 cycle inspections, it was possible that the looseness was not apparent at that time. Nevertheless, the inspections, as conducted, were not effective in detecting the worn bushing and thereby preventing this occurrence.

A consequence of the individual replacement of worn bushings, as opposed replacement of the entire set on a threshold of 50 per cent worn bushings, was that the inaccessible bushings would not be replaced while the engine was in service. While this would not have affected the outcome in this occurrence, modifying the replacement criteria reduced the overall effectiveness of the inspection.

Previous occurrences

This was only the second engine failure of its type on CF6‑80E1 engines. The occurrences were within five months of each other, involved the same operator and failure of the VSV arm in the same position. In the absence of commonalities in engine hours, cycles or service history, the engine manufacturer determined that the failures were most probably related to maintenance in the area of the VSV arm. The ATSB review of the associated maintenance work packages did not find any evidence to positively link the occurrences.

Findings

From the evidence available, the following findings are made with respect to the engine surge and high vibration involving an Airbus A330, registered VH-EBR, 44 km north-east of Gold Coast Airport, Queensland, on 15 April 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• A worn stator lever arm bushing resulted in fretting damage, initiation of a fatigue crack, and fracture of the lever arm.
• The fracture of the lever arm led to an off-schedule variable stator vane, which created turbulent airflow within the engine compressor section. This turbulent airflow led to the failure of a compressor blade at the blade root, due to high-cycle fatigue.
• The operator had conducted three non-mandatory inspections of the variable stator vane system since the engine's last overhaul. Despite these inspections being conducted, the outer bushing and lever arm at the number 24 position was able to wear, undetected.

Other findings

• The engine issue was one of two identified worldwide. Both occurred within 5 months of each other, in the same operator’s fleet and in the same number 24 position, and both on the left engine. The engine manufacturer, operator and the ATSB were unable to establish fully the reason for the timing, fleet, and position commonalities in the context of worldwide historical data.

Safety actions

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Qantas Airways

Qantas has taken proactive safety actions, including performing a once-through fleet inspection of variable stator vane (VSV) lever arms in the number 24 position, across the A330 fleet. No defects were identified as a result of this inspection.

Qantas also issued a VSV system awareness maintenance memo to engineering staff. The purpose of this memo was to highlight the importance of the inspection of VSV lever arm system for worn bushings and precautions to be aware of when carrying out work in this area.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Qantas Airways
• General Electric Aviation
• aircraft Quick Access Recorder.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Qantas Airways, General Electric Aviation, National Transportation Safety Board, Bureau d’Enquêtes et d’Analyses and the Civil Aviation Safety Authority.

Submissions were received from General Electric Aviation. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

At about 0600 Western Standard Time^[1] on 20 April 2018, the 103 m livestock carrier Angus Express (Cover) arrived at the Broome, Western Australia, pilot boarding ground. The ship had just completed a voyage from Singapore, and was expected to load cattle at berths 4 and 5.

A pilot boarded Angus Express and was escorted to the ship’s navigation bridge. The bridge team consisted of the master, chief mate (under supervision as trainee master), and a seaman as the helmsman. The chief mate, master and pilot then commenced the master-pilot information exchange (MPX). During the exchange, they discussed the ship’s characteristics, the inward passage and the berthing plan.

When booking the pilotage on 16 April 2018, the master had advised that the ship’s bow thruster was inoperable. The port’s handbook^[2] recommended that a ship of Angus Express’s length with no thruster utilise two tugs for arrival and departure. The tugs were booked in advance, but at about 1845 on 19 April, the pilot became aware that only one of the port’s two tugs would be available as the other tug was out of service for a week for repairs. He informed the harbour master who advised that provided there were no strong winds and the ship berthed within an hour or less of slack water,^[3] the pilot could make the decision whether to continue with the berthing. The pilot then conducted a risk assessment and discussed it with the harbour master. They determined that the ship could berth with the use of only one tug.

The pilot explained the plan to the ship’s chief mate and master during the MPX and they agreed with the plan. The pilotage into Broome continued with a tug in attendance from 0636 (Figure 1), and went as planned and without incident.

Figure 1: Angus Express’s arrival into Broome and the approach to berth 4 & 5

Source: Australian Hydrographic Service, annotated by ATSB

The pilot swung the ship to port and approached the wharf, to berth starboard side alongside. By 0710, the ship was alongside the wharf, with two Yokohama fenders^[4] positioned forward and aft, between the ship and wharf’s vertical fender posts (low water was at 0711 (1.55 m)).

The ship was about 8 m aft of its berthing position at berth 4 and 5, when mooring lines were run to the wharf. The pilot then tried to use the mooring winches to heave in the mooring lines to move the ship forward into position. However, by this time, the slack tide was starting to change and the pilot estimated there was a current working against the bow and the mooring winches were ineffective. The pilot then instructed the tug, in position about amidships, to push forwards at a 45° angle using minimum power, to assist repositioning the ship.

At 0712, the weight of the ship against the forward Yokohama fender forced it to pass under the fender posts, which resulted in the ship’s bow moving towards the wharf (Figure 2). Shortly after, an overhanging scupper^[5] protrusion made contact with the fender post (about 30 m from the ship’s bow).

Figure 2: Damage to the Angus Express’s starboard scupper protrusion

Source: Kimberley Ports Authority, annotated by ATSB

The pilot thought that the ship had pivoted on the Yokohama fender and instructed the tug to stop pushing. The ship moved slightly off the fender posts and the fender cleared the post.

At 0714, the pilot instructed the tug to push minimum forward again, resulting in the forward Yokohama fender once again passing underneath the fender posts. The ship’s bow again moved towards the wharf, and the scupper protrusion again made contact with the fender post (Figure 2). The pilot instructed the tug to stop, and the ship came away from the vertical fender posts.

The pilot then advised the master to use the ship’s engines to reposition the ship. At 0718, the ship was in position as intended and all fast^[6] with the height of tide now at 1.65 m.

The pilot reported the incident to the harbour master who subsequently attended the ship and found minor damage to the ship’s superstructure.

Yokohama fenders in Broome

The Yokohama fender system in the Port of Broome consisted of large floating cylindrical rubber fenders, secured to vertical fender posts, which allowed vertical movement as the tide changed. The tyres fitted with chain to the outside of the fenders for protection also increased their width. The use of fenders kept the ship’s side clear of the wharf, protecting both, and allowed longer loading windows (Figure 3). The added clearance from the wharf also reduced the steepness of the gangway in the large tidal range at Broome.

Figure 3: Berthing plan showing the position of the Yokohama fenders at berth 4 & 5

Source: Kimberley Port Authority, annotated by ATSB

After the incident, inquiries by Angus Express’s pilot resulted in a pilot who had worked in the port until 2015 providing relevant information about the Yokohama fender system. That pilot’s personal pilotage log indicated that a height of tide of less than 2.5 m was considered a significant factor with respect to the fenders at berth 5. When the water level fell below this height, the fenders could be forced under the vertical fender posts by a ship.

Post-incident investigations by Kimberley Ports Authority (KPA) and the pilotage provider, West Coast Pilots (WCP) confirmed that the fender posts at berths 4 and 5 were shorter than at others. No evidence was found to indicate that these shorter posts or the potential for fenders to be forced under them when water levels fell had been documented or otherwise promulgated to pilots through training or instruction.

Safety analysis

Yokohama Fenders

The height of tide at the time of the incident was 1.62 m, which was low enough to expose the base of the fender posts (Figure 3). When the pilot attempted to manoeuvre Angus Express forward using the tug, the force exerted on the Yokohama fender by the ship, allowed it squash and roll under the fender post. Consequently, the ship moved closer to the wharf and the scupper protrusion contacted the post.

Risk assessment

The reason for changing Angus Express’s berthing plan was a possible 1-week delay due to tug unavailability. Such a delay could have resulted in stranding a large number of cattle in holding yards for a long period with only about 8 hours of loading fodder available. Therefore, the reason to change the berthing plan (subject to a risk assessment) were valid.

However, at that time, neither the pilot nor the management of both WCP and KPA were aware of the shorter fender posts at berths 4 and 5, and the potential for Yokohama fenders to be forced under them. Had this information been known and effectively disseminated, it would have been considered during the risk assessment and the incident could have been avoided.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The height of tide when Angus Express was berthing was low enough to expose the base of the wharf’s fender posts. Consequently, when the tug pushed to move the ship, the forward Yokohama fender was forced under the post, which allowed the ship's starboard scupper protrusion to contact the post with resulting damage.
• The harbour master and pilot were unaware of any height of tide limitations associated with berthing ships alongside Yokohama fenders at berths 4 and 5. Therefore, the risk assessment did not include any mitigating factors for berthing alongside at a height of tide less than 2.5 m.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Kimberley Ports Authority

As a result of this occurrence Kimberley Ports Authority advised the ATSB that it had taken the following actions.

Berthing with Yokohama style fenders

Guidelines for berthing and being alongside when using Yokohama style fenders have been implemented for times of limiting low water levels. Also, the risk evaluation process between harbour master and pilot has been extended to include focussed quick risk assessment for circumstances such as tug shortages, vessel manoeuvring issues and tidal levels.

A memorandum has been issued to all pilots and port users advising of these changes.

Safety message

This incident highlights the fact that marine pilots may encounter operational parameters outside normal limits. Whenever this occurs and learning opportunities are identified, it is important to ensure these are captured through proper reporting processes. This information can then be shared through training and awareness to reduce risk and avoid incidents.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. Marine pilotage is one of the safety concerns, with further information available from the ATSB’s website.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Kimberley Ports Authority, Port of Broome, Port and Terminal Handbook.
3. The period between a flood steam and ebb stream, when there is little or no flow.
4. Yokohama fenders are pneumatic fenders used to avoid damage to the ship and the wharf, jetty or dock.
5. An opening in the side of a ship at or just below the level of the main deck, to allow water to run off.
6. The running of three head and stern lines and two forward and aft spring lines, to hold the ship alongside the wharf.

Safety summary

What happened

On 28 April 2018, a Qantas Boeing 737 (VH-XZM) landed on runway 03 at Perth, Western Australia. The aircraft exited the runway onto taxiway J2, which led to a holding point for crossing runway 06. The aircraft did not stop at the holding point and crossed an illuminated stop bar without an air traffic control clearance.

At that time, a second Qantas Boeing 737 (VH-VZL) had commenced take-off from runway 06. An automated warning alerted the aerodrome controller (ADC) of the stop bar violation and the controller issued an instruction for the departing 737 to stop immediately. Soon after, the flight crew of VH‑XZM became situationally aware of their position and stopped just before crossing the edge of runway 06. VH-VZL’s wingtip passed about 15 m from VH-XZM’s nose at low speed.

What the ATSB found

The captain of VH-XZM developed an incorrect mental model of the exit taxiways off runway 03, believing the aircraft would not have to cross runway 06 after exiting onto either of the potential taxiways (J2 or D). Due to this incorrect mental model, and a combination of workload and distractions at key times, the flight crew did not detect the runway crossing issue until their aircraft had almost reached the edge of runway 06.

Taxiway J2 was the preferred runway exit for jet aircraft landing on runway 03. However, the location and design of the taxiway significantly increased the risk of a runway incursion onto runway 06/24. In particular, it had a relatively shallow intersection angle with the runway and a relatively wide turn radius, leading to higher taxi speeds, and a short distance to the holding point for runway 06/24.

Although the junction around taxiway J2 was identified as a ‘hot spot’, there was no detailed information about the reasons why it was a hot spot on aerodrome charts, and Qantas did not specifically require pilots to brief hot spots during departure and approach briefings.

What's been done as a result

In response to the runway incursion, Airservices Australia made taxiway J2 unavailable for use. Subsequently, Perth Airport removed taxiway J2 from aerodrome charts.

In addition, Airservices Australia changed the settings of an alerting system to ensure tower controllers at Perth Airport performing multiple roles received appropriate aural and visual alerts at their workstation.

Qantas published a safety information notice to all pilots containing information about the background of runway incursions, details of two recent runway incursion occurrences and safety educational information related to influencing factors, stop bar techniques and strategies to avoid a runway incursion. Qantas also updated its Flight Administration Manual to include a requirement for pilots to brief relevant airport hot spots and their contingency planning to mitigate against the possibility of collision or runway incursion.

Safety message

Runway incursions are one of the most significant risks to safe aviation operations and a key global safety priority. Airport operators and local runway safety teams are strongly encouraged to identify and mitigate the risk of hot spots, especially those that involve short distances between runways, complicated junctions, and the potential for higher taxi speeds.

Pilots are strongly encouraged to identify runway hot spots during departure and approach briefings, and discuss the actions they will take to reduce the risk of a runway incursion at such hot spots.

Air traffic controllers are strongly encouraged to provide safety alerts and/or clear instructions (such as ‘stop immediately’) to the flight crews of all aircraft involved in runway incursions and related occurrences.

The occurrence

Overview

On 28 April 2018, a Boeing 737-838 (737) aircraft, registered VH-XZM, was being operated by Qantas Airways Limited (Qantas) on a regular public transport flight from Sydney, New South Wales to Perth, Western Australia. The aircraft landed on runway 03 and exited using taxiway J2 (Figure 1). The aircraft did not stop at the runway 06 holding point and crossed an illuminated stop bar without an air traffic control (ATC) clearance.

VH-XZM’s incursion into the flight strip of runway 06 resulted in a rejected take-off of another Qantas Boeing 737 aircraft (VH-VZL), which was taking off from runway 06. VH-VZL’s wingtip passed about 15 m from the nose of VH-XZM at low speed before stopping.

Figure 1: Overview of the runway incursion

Source: Google Earth, modified by ATSB

Events prior to the occurrence

VH-XZM departed Sydney at 1033 Western Standard Time^[1] on the scheduled flight to Perth. During their review of NOTAMs,^[2] the flight crew noted the recent installation of stop bars at Perth Airport.

On this sector the captain was pilot monitoring and the first officer (FO) was pilot flying.^[3] Prior to descent, the approach controller cleared the flight crew for an area navigation (RNAV-X) runway 03^[4] approach. Weather conditions for the descent and approach were good.

Prior to descent, the FO conducted an approach briefing, noting taxiway J2 (Figure 2) was the preferred exit and they would need to get an ATC clearance to cross runway 06. The FO recalled being aware that taxiway J2 was a designated ‘hot spot’ but did not brief it as a hot spot or state that runway incursions happened there. The captain expressed a preference to request taxiway D, which was closer to the terminal building. At the completion of the briefing, the FO believed that the captain understood they would vacate runway 03 onto taxiway J2 unless they had a clearance to exit at taxiway D.

The captain recalled the briefing as professional and very thorough, but did not fully absorb all of the FO’s briefing points (due to the level of detail in the briefing). The captain also recalled, that when discussing the taxi route to their assigned parking bay (13), being mainly focussed on vacating onto taxiway D, which led directly onto the apron, with taxiway J2 being the secondary plan. Having referenced the smaller apron chart (Figure 3) and not the larger aerodrome chart, the captain’s mental model of the taxiway J layout was that if they used taxiway J2 they would vacate the landing runway 03 directly on taxiway J1, which led directly to the apron area. The captain interpreted the FO’s point about a requirement to cross runway 06 as being during the landing roll on runway 03.

During the approach phase, another aircraft, also on approach to land on Perth runway 03, was following VH-XZM. It had been slowed down by ATC to coordinate the two arriving aircraft. ATC requested the flight crew of VH-XZM to maintain a high speed descent, which they accepted.

Figure 2: Perth aerodrome chart

Source: Airservices Australia, annotated by ATSB

Figure 3: Perth apron chart showing captain’s mental model of taxi routes to bay 13

Source: Qantas, annotated by ATSB

Final approach and landing

The RNAV-X runway 03 approach required a descending right turn from about 2,180 ft to 790 ft. The FO recalled the captain commenting that, when flying the RNAV-X runway 03 approach, it could be difficult to slow the aircraft down and they would need to conservatively configure the aircraft for the arrival.

At 1438:55, the captain made first contact with the aerodrome controller (ADC) on the Perth ADC (tower) frequency. The captain recalled that the radio call was made during a period of high workload while closely monitoring the FO, the aircraft speed and the approach profile, and that the aircraft was not slowing down as quickly as desired.

The aircraft descended through 1,600 ft, configured with gear down and flaps 15 set, and the airspeed about 175 kt. As that speed was the flaps extension limit speed for flaps 30 (the intended flaps setting for landing), the captain suggested to the FO they select flaps 25 (a non-normal setting) to decelerate to enable selection of flaps 30, which they did once the aircraft slowed.

The captain recalled being ‘totally focused’ on the FO flying an accurate approach profile and descending turn. Due to this high workload, the request to take taxiway D after landing was forgotten. The captain also forgot to pre-set the Perth ground frequency in the radio’s standby frequency position, a routinely performed task.

The captain started actioning the landing checklist. At 1439:28, that process was interrupted by the ADC issuing them a clearance to land on runway 03. At that time the aircraft was passing approximately 1,100 ft and still in a descending right turn to final approach. The flight crew completed the landing checklist and continued the approach within the requirements of the Qantas stabilised approach criteria.

During this time, VH-VZL was taxiing to runway 06 for departure and its flight crew were monitoring the Perth surface movement controller (SMC/ground) frequency. At 1440:59, that flight crew changed to the ADC frequency and advised the ADC they were ready. At 1441:02, the ADC cleared them to line up and wait on runway 06.

At 1441:21, VH-XZM landed on runway 03 and the FO selected idle reverse thrust. While the aircraft was decelerating, the captain realised that an egress onto taxiway D had not been requested from the ADC and believed they were now committed to vacate via taxiway J2. At about 60 kt, the captain took control of the aircraft from the FO (consistent with normal procedures)^[5] and applied heavier braking so the aircraft could make taxiway J2.

Approaching taxiway J2 for the first time, the captain thought it appeared to be a rapid exit taxiway (RET). The aircraft’s groundspeed was about 53 kt when, at 1441:42, the captain started to turn off the runway centreline towards taxiway J2, continuing to slow throughout the turn and passing over the left edge of runway 03 at 1441:47 at 35 kt.

Taxi and runway incursion

At 1441:51, once certain that VH-XZM would vacate runway 03 onto taxiway J2, the ADC issued VH‑VZL’s flight crew a take-off clearance on runway 06, which was then read back by the crew of VH-VZL. At 1441:59, another aircraft, which had been following VH-XZM and was now on final approach to runway 03, also made a transmission on the ADC frequency.

The captain of VH-XZM recalled hearing the ADC issue a take-off clearance to another Qantas aircraft but did not recall hearing the words ‘runway 06’ and did not associate it with a potential threat at the time. The FO did not recall hearing any ATC transmission at that time.

The SMC reported being aware that VH-XZM was on taxiway J2, and the flight crew would soon be calling on the SMC frequency to report they were at the holding point. However, when the ADC gave VH-VZL a take-off clearance, the SMC switched attention to other aircraft on the apron area, knowing that VH-XZM would not be able to cross runway 06 for a while.

Figure 4 shows the relative positions of VH-XZM and VH-VZL during the remainder of the occurrence sequence.

Figure 4: Overview of the runway incursion

White aircraft symbols show the aircraft positions at 5-second intervals. White lines show the angle between the two aircraft at some of those times. Labels show events that occur within 1 second of the aircraft’s position illustrated.

Source: Google Earth, modified by ATSB

At 1441:55, VH-XZM passed over the holding point for runway 03 at a groundspeed of about 22 kt. At about this time, the FO assessed that the captain was still slowing the aircraft at a rate to stop at the runway 06 holding point; the FO was aware that they needed an ATC clearance to cross runway 06 and assumed that the captain would stop.

The FO then refocused their attention inside the flight deck and noticed that the Perth SMC frequency had not been pre‑set as the radio’s standby frequency. As a result, reference was made to the aerodrome chart to find the frequency to set. This led to a delay in contacting the SMC to receive taxi instructions. The captain recalled also briefly looking down to understand the reason for the delay and telling the FO the required frequency.

Although being aware that stop bars had recently been installed at Perth, the captain recalled being surprised to see an illuminated stop bar ahead on the taxiway and thought it strange that a stop bar would be positioned at that location. The captain believed they were on taxiway J1, which did not require a runway crossing, and rationalised that the stop bar had been mistakenly constructed with omnidirectional lighting^[6] and that it was for aircraft taxiing from the opposite direction entering runway 03. The captain also thought that, given their current taxi speed and how quickly it appeared after exiting the runway, the stop bar could not be meant for their aircraft. The captain did not recall noticing any markings that identified runway 06. Consequently, they taxied over the illuminated stop bar and through the runway 06 holding point.

At 1442:01, the nose of VH-XZM passed the runway 06 holding point (with an illuminated stop bar) at a groundspeed of 17 kt. At 1442:04, in the tower, the integrated tower automation suite (INTAS) made the first of two aural and text alerts on the ADC’s workstation. The aural alert comprised a synthetic voice stating ‘warning runway zero six stop bar violation’. The alert was designed to trigger when the aircraft was registered to be 8 m past the stop bar. At this time, the aircraft was travelling at about 14 kt.

Due to default settings within INTAS, no aural or text alert was provided on the SMC’s workstation. The SMC later reported hearing the aural alert through a speaker on the ADC’s workstation, and then saw VH-XZM entering the runway and VH-VZL rolling for take-off. At this time the SMC was part way through providing a pushback clearance to another aircraft and the flight crew of that aircraft then read back the clearance details on the SMC frequency.

At the time of the first INTAS alert, the flight crew of VH-VZL had just commenced rolling for take-off on runway 06 and were setting engine thrust. The ADC recalled having communication with VH-VZL and considered that, as VH-XZM had vacated runway 03, it should have transferred to the SMC frequency. Initially, a radio transmission from another aircraft prevented the ADC from transmitting on the ADC frequency. As soon as it stopped, at 1442:11, the ADC instructed VH-VZL’s flight crew to ‘stop immediately, stop immediately, runway incursion ahead’.

The captain of VH-VZL subsequently reported being aware of the other aircraft when it was taxiing on taxiway J2. When the stop instruction from the ADC was received, the captain was just starting to have an element of doubt as to whether the other aircraft would stop, and during the instruction initiated a rejected take-off by bringing the thrust levers back and braking. At that time the aircraft’s groundspeed was 58 kt.

As VH-XZM’s flight crew had transferred to the SMC frequency at some point before 1442:11, they did not hear the stop instruction issued to VH-VZL and were unaware of that aircraft’s presence and proximity. The captain continued taxiing towards runway 06 at about 10 kt, and then observed another aircraft (a Boeing 787) ahead on the apron (Figure 5). It had recently pushed back and was now blocking taxiway J1. The captain reported being distracted by the aircraft on the apron as it blocked their intended route on taxiway J1 and now required their aircraft to turn onto taxiway A.

Figure 5: Aircraft on the apron as XZM taxis toward runway 06

Source: Perth Airport

At 1442:16, the second INTAS aural (‘warning runway zero six occupied’) and text alert activated while the flight crew of VH-VZL was rejecting the take-off. As with the previous alert, the second alert was not presented at the SMC’s workstation. As the first INTAS alert was still active, the controllers now had multiple warnings sounding, which increased the noise level in the tower.

At the same time as the second INTAS alert, VH-XZM’s FO contacted the SMC advising they were taxiing for bay 13. The SMC did not respond to that transmission, and subsequently could not recall whether that transmission was heard.

The captain of VH-XZM recalled seeing (in peripheral vision) an aircraft (VH-VZL) going faster than would be expected on a taxiway, then applying the brakes to stop the aircraft. The FO recalled that, when looking up, probably about the time the captain began braking, they realised they were in a different position to that expected and called ‘stop, stop, stop’.

The captain applied VH-XZM’s brakes at 1442:19, when the speed was 9 kt, and the aircraft came to a full stop at 1442:25. At 1442:29, VH-VZL came to a stop on runway 06, having just passed ahead of VH-XZM. The wingtip of VH-VZL passed about 15 m from the nose of VH-XZM at low speed.

At 1442:26, just before VH-VZL stopped, the SMC asked if VH-XZM was ‘on this frequency’ and the FO responded with ‘affirm’, their callsign, and the intended bay. The SMC advised VH-XZM’s crew that they had crossed a stop bar and had a runway incursion, and to hold position. The flight crew of VH-VZL were subsequently cleared to taxi back to runway 06 for departure. The flight crew of VH-XZM were cleared to taxi to bay 13.

__________

1. Western Standard Time (WST) was Coordinated Universal Time (UTC) + 8 hours. All times in this report are WST unless otherwise stated.
2. NOTAM: notice to airmen, which alerts pilots to any potential safety hazards along a flight route.
3. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
4. Runways are numbered in relation to their magnetic direction rounded off to the nearest 10°. This is the runway designation.
5. It is standard operating procedure on the Boeing 737 for the captain to take control of the aircraft after landing. The 737 has a single steering tiller located on the captain’s side of the flight deck. The tiller provides nose wheel steering control while the aircraft is taxiing.
6. Omnidirectional lighting is visible from all directions. Stop bar lighting is unidirectional (only visible from one direction).

Context

Personnel information

Flight crew of VH-XZM

The captain held an Airline Transport Pilot (Aeroplane) Licence (ATPL) and was appropriately qualified to conduct the flight. Having flown 737s since 2007, the captain had operated into Perth Airport many times, including three to four times in the last 4–5 months. Most of the landings at Perth were on runway 21 or 24, using taxiway J1 from runway 24. The captain had rarely landed on runway 03 and only recalled using taxiway D off that runway and had not previously used taxiway J2. Although aware that stop bars had been installed at Perth Airport, and having encountered them at other airports, the captain had not previously encountered them at Perth.

The first officer (FO) held an ATPL and was appropriately qualified to conduct the flight. The occurrence flight was the third set of flights since completing FO training on the 737, having previously operated as an Airbus A330 second officer. The FO had landed at Perth on five previous occasions, including two landings on runway 03 (which had exited on taxiway D). The occurrence flight was the first time the FO had landed on runway 03 and vacated via taxiway J2.

Both flight crew were based in Brisbane. They both had 3 days off duty during 24–26 April 2018, then on 27 April they commenced a 3-day trip together. On 27 April they signed on at 0530 Eastern Standard Time (EST)^[7] and flew a series of flights, ending their duty time at about 1530 EST. On 28 April, they signed on for duty at Gold Coast Airport about 0725 EST, then operated a flight from the Gold Coast to Sydney. Following a transit in Sydney they then commenced the flight to Perth. At the time of the occurrence both of them had been on duty for 10.3 hours. They described the workload during the day as not being significant or unusual. They departed Sydney about 1 hour behind schedule due to connecting aircraft and reported not feeling any commercial pressure.

The flight crew’s roster provided both flight crew with sufficient sleep opportunity in the nights prior to the occurrence. The captain reported having about 7 hours sleep the night before the occurrence and normal sleep in the nights before. The FO reported having a normal amount of sleep the night before the occurrence and the nights before that. Both flight crew reported being a little tired at the time of the occurrence. However, given the other available information, there was insufficient evidence to suggest they were experiencing a level of fatigue that has been demonstrated to adversely influence performance.

Air traffic controllers

At the time of the occurrence, Perth tower was staffed by two air traffic controllers:

• the aerodrome controller (ADC), who was responsible for controlling all aircraft and vehicle movements on all runways
• the surface movement controller (SMC), who was performing the combined duties of SMC (responsible for controlling all aircraft and vehicle movements on the airport aprons and other manoeuvring areas) and airways clearance delivery controller (responsible for issuing airways clearances to departing aircraft).

Both controllers were correctly endorsed for their roles. The ADC on duty at the time of the occurrence had over 30 years’ experience and was fully endorsed for all roles in the Perth tower. The SMC had 3 years’ experience at Perth tower (and prior experience overseas) and was endorsed for all roles in the Perth tower.

The controllers reported that aircraft movements had been ‘quiet’ in the period leading up to the occurrence, with only 4 or 5 aircraft movements occurring at intermittent times.

The ADC reported having about 8 hours sleep the night before the occurrence and normal sleep in the nights before. On 28 April, the ADC signed on for duty at 0730 WST and had several rest periods during the shift. At the time of the occurrence, the ADC had been on duty for 7.2 hours, due to sign off at 1530.

The SMC reported having a normal sleep the night before the occurrence and normal sleep in the nights before. On 28 April, the SMC signed on for duty at 1345, and had been performing the role for about 45 minutes prior to the occurrence.

Both of the controllers recalled feeling alert at the time of the occurrence and had sufficient sleep opportunity in the nights prior to the occurrence. There was no evidence to suggest they were experiencing a level of fatigue that has been demonstrated to adversely influence performance.

Meteorological information

At the time of the occurrence, the Perth automatic terminal information service (ATIS) broadcast the wind was variable at 5 kt with a maximum tailwind on runway 03 of 5 kt. The conditions were CAVOK^[8] and the temperature was 28 °C. The ATIS also advised that stop bars were active at all runway holding points.

The flight crew of VH-XZM reported the weather conditions as fine with light winds and good visibility. The captain stated there was no tailwind during landing on runway 03. There were no reported concerns with sun glare or other factors affecting visibility for the flight crew of VH‑XZM. The controllers stated the weather conditions were fine with no restrictions on visibility from the tower.

Closed-circuit television footage at the terminal verified all recollections of weather and visibility conditions made by flight crews and controllers.

Recorded information

On-board recordings

Both 737 aircraft involved in the occurrence (VH-XZM and VH-VZL) were fitted with a flight data recorder (FDR) and cockpit voice recorder (CVR) as required by the applicable legislation.

Qantas downloaded both FDRs and sent the digital files to the ATSB. Both FDRs included data over the period of the occurrence. This information has been included in this report where relevant.

Each CVR was capable of recording 2 hours of data, which would have included communications between the flight crew, communications with air traffic control and various flight deck sounds, alerts and warnings. The CVR for VH-XZM was not preserved before being overwritten during ground activities.^[9]

There were no reported defects associated with VH-XZM.

Air traffic control recordings

Air traffic control (ATC) audio recordings and integrated tower automation suite (INTAS) data records were obtained from Airservices Australia. The audio recordings provided all relevant radio communications between controllers and flight crews, and the synthetic voice INTAS warnings. INTAS data records provided aircraft position information that could be compared with other sources of recorded data.

Flight crew briefing requirements

Operator information

The Qantas Flight Administration Manual (FAM) outlined standard operating procedures and detailed guidance to flight crew on the conduct of briefings.

The FAM stated:

The objective of a briefing is to ensure all Flight Crew understand and share a common mental model for the proposed plan of action.

Furthermore, it stated that for the briefings to remain effective they should be:

Interactive – engaging all Flight Crew members and ensuring a practical understanding of what is proposed.

Threat and Error Management Based – briefing points should include identification and assessment of threats. Plans for dealing with identified threat should be discussed. The depth of the briefing content should be commensurate with the assessed threat environment.

Concise and Relevant – content must serve to refresh knowledge considered necessary for crew coordination. It is unnecessary to reiterate standard operating procedures or discuss every detail of published procedures as each Flight Crew member must review pertinent information and FMS [flight management system] setup in preparation for the briefing.

Briefing emphasis should be directed to plans or requirements which vary from those routinely used.

On a multi-sector tour of duty involving Australian ports, there is no requirement for repetition of items previously briefed for the same departure or arrival, provided that the Pilot In Command is satisfied that the pertinent information is understood by all Flight Crew.

Timely and Logical – to assist delivery and understanding, briefings must be scheduled so as not to interfere with operational tasks and the content should follow a logical sequence based on phase of flight. The briefing framework must conform to the following structure and sequence:

– Considerations with emphasis on threat identification, assessment and implementation of management strategies.

– Normal operations with emphasis on sharing plans of action.

– Contingency and non-normal aspects with emphasis on contingency planning.

For approach and arrivals at an airport, it was standard practice for the briefing to be completed prior to commencing the descent.

The FAM section 21.2.4.4 gave flight crew the following guidance:

Considerations – identify and assess the threats and considerations that may affect the arrival plan which may include but not necessarily be limited to terrain, adverse weather, airport conditions, NOTAMs, aircraft maintenance status, RMS [route manual supplement] or specific state requirements, traffic, ATC, ground support and fuel conservation opportunities.

Normal Operations

– Arrival and Approach – brief chart page number, together with relevant charted requirements. For runways where there is no published instrument procedure the anticipated arrival plan should be briefed. Nominate planned approach procedures.

– Navigation and Altimetry – brief the relevant navigation and altimetry requirements.

– Automation – brief the planned level of automation to be used and the transition to manual flight.

– Landing – brief landing flap configuration, level of reverse thrust and auto-brake setting for planned runway exit.

– Contingency Planning – brief contingency plans for all threats assessed as requiring crew management.

The FAM guidance did not specifically require flight crews to brief hot spot locations or describe how runway incursion threats would be mitigated.

Other guidance for flight crew briefings

International Civil Aviation Organization (ICAO) document 9870 Manual on the Prevention of Runway Incursions stated:

The “before start” and “descent” briefings should also contain a complete review of the expected taxi routes with special attention to the hot spots.

Guidance from the United States Federal Aviation Administration (FAA) in 2012 called for operators to develop and implement specific procedures to prevent runway incursions. The FAA advisory circular AC 120-74B (Parts 91, 121, 125, and 135 Flight crew procedures during taxi operations) emphasised that a thorough taxi briefing should include a review of the airport diagram and identify critical locations on a taxi route, including, but not limited to, hot spots, complex taxiway intersections and runway crossing points. In addition, the circular called for procedures that would require flight crews to describe how runway incursion threats would be mitigated: by briefing the timing and execution of checklists and communications, so that no flight crew member was preoccupied or head-down when approaching an active runway.

There was no CASA guidance regarding the inclusion of runway hot spots or incursion threats in pre-flight or in-flight briefings. The ATSB reviewed the documentation of two other Australian airlines and found that one specified a mandatory requirement for flight crews to verbally brief runway hot spots, and the other provided detailed guidance material regarding runway hot spots and recommended that flight crews verbally brief them.

Airport information

General information

Perth Airport had two runways. The main runway was oriented 03/21 and the cross runway 06/24 (Figure 2). Both were 45 m wide and had a 150-m wide flight strip.^[10]

Preferred taxiway

Since 2014, the Aeronautical Information Publication (AIP) entry for Perth Airport stated the preferred exit taxiways for arriving aircraft on each runway and for different types of aircraft. The preferred taxiway for jet aircraft landing on runway 03 was J2 and for turboprop aircraft it was A6. The AIP stated that the preferred taxiways were to ‘ensure minimum runway occupancy time and support optimum spacing on final [approach]’.^[11]

Data provided by Airservices Australia indicated that, from May 2017 to April 2018, about 24 per cent of all aircraft landing on runway 03 exited via J2. Data provided by Qantas showed that, of its 737 fleet landings on runway 03, about 44 per cent vacated runway 03 at taxiway J2. Qantas noted that its pilots preferred to exit runway 03 at taxiway D as it resulted in a shorter and more direct route to the terminal.

The AIP stated that, unless specified otherwise by ATC, an aircraft must promptly vacate the runway after landing without backtracking. There was no requirement under the AIP for an aircraft to use the first available taxiway.

Taxiway J2

Arrangement

Taxiway J2 was located approximately 1,911 m from the threshold of runway 03. It led to a 6-way intersection comprising runway 06/24 and three other taxiways (Figure 6).

Taxiway J2 intersected runway 03 at a 60° angle. The straight distance from the edge of runway 03 to the runway 06 holding point was approximately 176 m, and the distance from the runway 03 holding point and the runway 06 holding point was about 70 m. The distance from the runway 06 holding point to the edge of runway 06 was about 102 m.

Figure 6: Taxiway J2 in relation to runways and other taxiways

All annotations are approximate and for illustration purposes only.

Source: Google earth annotated by ATSB

The Civil Aviation Safety Authority (CASA) outlined Australian requirements for aerodromes in Civil Aviation Safety Regulation (CASR) Part 139 and the associated Manual of Standards (MOS). As an airport operator licensed by CASA, Perth Airport was responsible for the safety of the aerodrome in accordance with those requirements.

The MOS section 6.3.3 Taxiway Curves defined the minimum curve radius required for taxiway design speeds, which are listed in Table 1. For taxiway J2, with a curve radius of 200 m, the taxiway design speed was about 31 kt. VH-XZM’s turn from the runway onto the taxiway was made at an average speed of 34 kt.

Table 1: Taxiway design speed for minimum radius of curve

Runway holding point markings

Perth Airport runway holding points (or runway-holding positions) were equipped with signage and ground markings to provide flight crews with visual cues indicating their position and proximity to a runway. Those markings identified the location where an aircraft was required to stop when it did not have an ATC clearance to proceed onto or to cross a runway.

For flight crew vacating runway 03 on taxiway J2, the holding point for runway 06/24 was marked with red and white ground markings identifying the runway ahead,^[12] taxi-holding point signs and location signs. The runway holding point was also equipped with unidirectional^[13] runway guard lights, which flashed continuously, and a stop bar (Figure 7).

Figure 7: View of the runway 06/24 holding point on taxiway J2

The central panoramic image was taken from the entrance to taxiway J2 from runway 03/21. The other images were taken from close to the runway holding point. All images were taken at a height lower than that of the flight crew of a Boeing 737.

Source: ATSB

Stop bars

Stop bars were intended to provide additional protection of runway/taxiway intersections to prevent runway incursions. They were a series of unidirectional lights at right angles to a taxiway centreline (Figure 8). The lights were spaced 3 m apart and located 0.3 m before a holding point. Stop bars showed red in the direction of approach to the stop bar. They were controlled by ATC and were independent of the runway guard lights. Additional raised lights at each end of the stop bar were not installed, nor were they required to be.^[14]

Figure 8: Runway identifier (red and white markings) and stop bar (red lights) installed on taxiway J2

Source: ATSB

When seated in the normal position, the flight crew of a Boeing 737-800 cannot see the ground that is less than 11.5 m ahead of the aircraft’s nose (due to the obstruction of the flight deck glareshield). Consequently, the VH-XZM flight crew’s last opportunity to see the stop bar on taxiway J2 was at 1442:00, about 5 seconds after completing the turn onto the taxiway and 1 second prior to crossing the stop bar (Figure 9).

Figure 9: Last point when stop bar was visible from flight deck of VH-XZM

Source: Google Earth, modified by ATSB.

The AIP required flight crew to stop and hold their aircraft at all illuminated stop bars. Flight crew could only proceed to taxi an aircraft further once an ATC clearance to enter or cross a runway had been received and the stop bar lights had been switched off.

Stop bars were implemented at Perth on 30 March 2018. At the time of the occurrence (28 April 2018), all stop bars were reported to be operating correctly.

Other taxiways

In terms of the other taxiways off runway 03 (see Figure 2):

• Most taxiways intersected at 90° with a curve radius of about 100 m.
• Taxiway D intersected at 80° with a curve radius of about 60 m.
• Taxiways P intersected at 45° with a turn radius of 100 m, with 318 m between the edge of runway 03 and the next (taxiway) holding point.
• Taxiway N intersected at 45° with a turn radius of 100 m. In addition to taxiway J2, it was the only taxiway at Perth with a single holding point and a relatively short distance between the two runways. It led to a somewhat complicated four-way intersection. Two of the taxiways crossed runway 06/24 and shared a single holding point from taxiway N, set back about 120 m from the runway 06/24 flight strip. Both required a turn after the holding point to cross the other runway. The distance between the edge of runway 03 and the runway 06/24 holding point was about 350 m (with the first 280 m being a straight line).

Flight data analysed by Qantas indicated that the average exit speed of Qantas aircraft onto taxiway J2 over a 2-year period was 28 kt, compared with the average exit speed of 17 kt onto the tighter, near-right angle exit at taxiway D. The exit speed of VH-XZM was about 35 kt, and about 20 per cent of the landings over the 2-year period had an exit speed of 35 kt or higher (and about 5 per cent having an exit speed of over 40 kt).

Qantas reported that the distance between the runway 03 exit and the holding point for runway 06 on J2 at Perth was much shorter than any other runway exit taxiway leading directly to another runway on its 737 route network. The next shortest was about 397 m at Sydney Airport (for taxiway A2 off runway 34L that led to runway 25).

Rapid exit taxiway information

Requirements for rapid exit taxiways

As noted in The occurrence, the captain of VH-XZM thought that, when approaching taxiway J2 during the landing roll, the taxiway was a rapid exit taxiway (RET). Accordingly, the ATSB considered the design requirements for RETs.

The MOS defined a rapid exit taxiway (RET) as:

A taxiway connected to a runway at an acute angle, designed and intended to allow landing aeroplanes to turn off the runway at higher speeds than are achieved on exit taxiways, thereby minimizing runway occupancy times.

It additionally noted:

The provision of rapid exit taxiways is a financial decision for the aerodrome operator. The aerodrome operator should seek specialist advice on the geometric design of rapid exit taxiways.

The International Civil Aviation Organization (ICAO) specified standards and recommended practices (SARPs) for international aviation operations in a series of Annexes. ICAO Annex 14 (Aerodromes, Volume 1 Aerodrome Design and Operations) defined a taxiway as:

A defined path on a land aerodrome established for the taxiing of aircraft and intended to provide a link between one part of the aerodrome and another, including:

…c) Rapid exit taxiway. A taxiway connected to a runway at an acute angle and designed to allow landing aeroplanes to turn off at higher speeds than are achieved on other exit taxiways thereby minimizing runway occupancy times.

Annex 14 recommended that a RET should be designed with a curve radius of at least 550 m for certain types of runway (including those in Perth) to enable 93 km/h (50 kt) taxi under wet conditions. It also recommended that a RET should have a straight distance after the turn-off curve sufficient for an exiting aircraft to come to a full stop clear of any intersecting runway. There was no guidance regarding appropriate taxiway lengths, turn angles or curve radii.

ICAO also published other guidance about aerodrome taxiways. ICAO document 9157 (Aerodrome Design Manual Part 2 Taxiways, Aprons and Holding Bays) stated that the intersection angle of a RET with the runway should not be greater than 45° and preferably be 30°.

Neither the CASA MOS nor ICAO's Annex 14 provided restrictions or recommendations on direct access from one runway to another without an intermediate, transitional taxiway. The European Organisation for the Safety of Air Navigation (EUROCONTROL) in its November 2017 version of the European Action Plan for the Prevention of Runway Incursions, recommended:

A RET should meet with a parallel taxiway, and never end directly onto another active runway (that is used for take-off/landing).

Similarly, the United States Federal Aviation Administration (FAA) Advisory Circular 150/5300 stated:

Do not provide direct access from a high speed exit to another runway.

The Airports Council International Runway Safety Handbook First Edition 2014 identified key elements to eliminate runway incursions, including:

•  Rapid Exit Taxiways should be designed in such a way that crossing another runway via a rapid exit taxiway is not possible. A rapid exit taxiway should never be used for entry to a runway; and

•  Complicated Taxiway Layouts linking adjacent runways – such as multi-taxiway intersections, Y-shaped taxiways, taxiways crossing high speed exits and taxiways connecting to V-shaped runways – should be avoided in the design. If any of these are unavoidable, mitigation measures for runway incursion should be included in the design.

Rapid exit taxiway identification

At airports equipped with RETs, aerodrome charts provided flight crews with information such as RET location, maximum design exit speed and lighting systems, if fitted. This information was included in text in the airport efficiency procedures section rather than annotated on a map of the aerodrome.

ICAO Annex 14 recommended aerodrome operators install rapid exit taxiway indicator lights (RETILs). RETILs consisted of six yellow lights adjacent to the runway centreline and configured in a three/two/one pattern spaced 100 m apart; the single light was 100 m from the start of the turn for the RET.

The Australian AIP detailed differences between Australian national aviation legislation and those specified by ICAO as SARPs. With regard to RETILs, Australia notified ICAO of a difference to the SARPs under the level of ‘less protective, partially implemented or not implemented’. Accordingly, at the time of this occurrence, CASR Part 139 and the MOS did not require or recommend aerodrome operators to install RETILs.

Rapid exit taxiways in Australia

Taxiway J2 was not designated as a rapid exit taxiway (RET) and it did not meet the design requirements of CASA MOS or ICAO Annex 14 for a RET. There were no RETs at Perth.

RETs were provided at several other airports in Australia, including Brisbane, Melbourne and Sydney. None of these RETS had RETILs.

Runway incursion hot spots

Recommended practices for identification of hot spots on aerodrome charts

ICAO defined a runway incursion as ‘any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take-off of aircraft’.

ICAO document 9870 (Manual on the Prevention of Runway Incursions) defined a hot spot as:

A location on an aerodrome movement area with a history or potential risk of collision or runway incursion, and where heightened attention by pilots/drivers is necessary.

The document stated that, once hot spots have been identified, suitable strategies should be implemented to either remove the hazard or to manage and mitigate the risk to be as low as reasonably practicable.

ICAO recommended that the local generation of AIP aerodrome charts show runway hot spots (see for example Figure 2). The criteria used to establish a hot spot on an aerodrome chart and the symbols to be used were contained in ICAO Annex 4 (Aeronautical charts), with more guidance provided in Annex 14 and document 9870.

Aerodrome charts for Perth

Aerodrome charts were published by Airservices Australia in the AIP. Jeppesen charts, used by Qantas, provided details similar to the AIP about the airport and taxiway layout and associated information, such as warnings and runway incursion hot spots.

Jeppesen charts identified the location of hot spots and marked the area of risk with a magenta box in accordance with the ICAO recommendation. Text on the aerodrome chart stated ‘HS2 – Caution Runway Incursion Hot Spot’. No text or specific information was provided to explain the risk and reasons why previous runway incursions had occurred at those locations (in either the Airservices Australia or the Jeppesen charts).

Study of aerodrome chart effectiveness

In 2016, EUROCONTROL published a safety study report that examined how AIP hot spot information was transposed to commercially-produced aerodrome charts and promoted practices to help improve the accessibility, visibility and quality of the information. The study collected samples of AIP and commercial aerodrome diagrams for 64 European airports and a small number of samples from Australia, China and the United States for comparison purposes. It stated:

Of those airports that did have Hot Spot information on their AIP charts, only 39% were judged to be effective or very effective. Effectiveness, in this case, being a combination of presentational clarity and usefulness of the information. However 45% of airport AIP charts were judged to be of no or low effectiveness.

The Australian samples included Adelaide, Darwin, Sydney and Perth. The report judged all of these AIP charts to be of low effectiveness, stating:

The expanded graphic of the runway incursion Hot Spots are useful, but there is no text to enhance the pilot’s understanding other than to use caution. Since it is not unreasonable to assume that pilots do exercise caution when taxying, the effectiveness of the Hot Spot information is low.

The report noted that in many countries, including Australia, there was variation in the manner in which hot spot information was presented at different airports.

The report also noted the following presentation styles that ‘seemed to provide clarity and effectiveness’ of hot spot information to flight crew:

•  Each Hot Spot depicted by a clear bright red circle and joined to a red label box e.g. HS1

•  Large tabulated textual information elaborating the action required of pilots in and around the Hot Spot. This may be on the main aerodrome diagram or on the obverse page if clarity is best served.

•  The use of additional graphical boxes depicting the Hot Spots in greater detail. These additional boxes should be physically linked by lines or arrows to the Hot spot on the main diagram, if possible.

•  Where the aerodrome diagram would otherwise be too cluttered to present Hot Spots effectively, the use of specific Hot Spot pages can be effective.

•  The use of a colour-coded format which assists the depiction of runways, Hot Spot areas and normal taxiways.

In 2017, the FAA issued Safety Alert for Operators 17012 (High collision risk during runway crossing) that warned pilots of high-risk runway incursions and potential collisions in the first two-thirds of an active runway (with many such events occurring in the first third of the active runway). At Perth, the junction between taxiway J2 and runway 06 was within the first third of runway 06.

Runway incursions at Perth Airport

Airservices Australia recorded 44 runway incursions at Perth Airport between July 2015 and the day of the occurrence (Table 2). That equated to a rate of 11.6 incursions per 100,000 movements – higher than other major airports in Australia, including Sydney (2.0) and Melbourne (0.3).

Table 2: ICAO classification of the severity of runway incursions at Perth Airport, 1 July 2015 to 28 April 2018

[a] Including the investigation occurrence.

Source: Airservices Australia

Of the 44 incursions, 16 involved taxiway J2 on both runway 03/21 and runway 06/24. For that reason, the taxiway intersection of J2, J1 and A with runway 06/24 was marked as a runway incursion hot spot on aerodrome charts.

The ATSB’s occurrence database recorded 52 runway incursions at Perth involving turbine-engined aircraft (not under tow) over a 5-year period up to and including the 28 April 2018 occurrence. Exposure data was not available. Of these 52 incursions, the following types of incursion were excluded:

• 14 incursions that involved apparent ATC clearance errors (mostly not turning off stop bars after clearance was issued)
• 5 incursions involving a closed runway
• 2 incursions due to aircraft not departing the runway fully after landing.

Of the remaining 31 incursions, there were:

• 14 incursions on the cross runway via a taxiway immediately after landing (similar to the 28 April 2018 occurrence)
• 9 incursions that involved aircraft turning onto the cross runway instead of a taxiway
• 8 other incursions (general taxiing incursions).

Figure 10 shows the approximate location of incursions in these three groups, with most of the incursions on a cross runway via a taxiway happening near taxiway J2.

Figure 10: Selected types of runway incursion at Perth in a 5-year period

Source: Airservices, annotated by ATSB

Runway safety activities

ICAO have recognised runway safety as one of its highest priorities given it is currently one of the most significant threats to global aviation safety. In response, in 2011 the ICAO Runway Safety Programme (RSP) promoted the establishment of runway safety teams (RSTs) at airports as an effective means to reduce runway related accidents and serious incidents.

As part of Australia’s State Safety Programme, a National Runway Safety Group (NRSG) was established to perform a national advisory and coordination role, and promote the establishment and effectiveness of local runway safety teams (LRSTs). It utilised intelligence from these forums and other sources to develop and implement national strategies to improve runway safety and reduce runway related accidents and incidents.

An LRST consisted of local representatives addressing local runway safety issues. The purpose of an LRST was to identify current and potentially emerging issues related to runway safety and implement initiatives to assure the continuing safety of operations at their aerodrome.

Perth Airport had an LRST which met biannually and included the aerodrome operator, Airservices Australia, airline operators and other stakeholders operating at the airport.

Air traffic control information

Air traffic control at Perth Airport

Airservices Australia provided a 24-hour air traffic service at Perth Airport. The controllers responsible for all aircraft and vehicle movements on taxiways, runways and in the immediate vicinity of the airport were located in a tower on the eastern side of runway 03/21 (Figure 2).

The distance from the tower to the runway 06/24 holding point on taxiway J2 was about 1,200 m, and from the tower to the runway 06 threshold was about 3,000 m.

At the time of the occurrence the airport traffic flow was operating in a North flow. This permitted the most efficiency and therefore achieved the most operating capacity at Perth. A North flow traffic pattern had departures from both runway 03 and 06 and arrivals on runway 03.

Runway crossing procedures

The Australian AIP provided flight crew of domestic aircraft with procedures to follow when taxiing after landing. It stated:

2.16.2  After landing, unless specified otherwise by ATC, an aircraft must comply with the following:

a. Promptly vacate the runway without backtracking.

b. Change from the aerodrome frequency to the SMC frequency (where established) when vacating the runway strip and obtain an ATC taxi instruction.

c. Not cross any runway that intersects the taxi route unless in receipt of a taxi instruction and a “CROSS RUNWAY (number)” instruction from ATC…

The ICAO Manual on the Prevention of Runway Incursions outlined best practice for radio transmission guidelines and techniques. It stated:

Communication with any aircraft using the runway for the purpose of taxiing should be transferred from the ground controller to the aerodrome controller prior to the aircraft entering/crossing a runway.

The requirement for domestic aircraft to automatically^[15] transfer to the SMC frequency when vacating the runway strip had been in place since prior to 2003. In June 2010 Airservices Australia commenced a trial of aircraft and vehicles being on the ADC frequency when crossing runways in line with the ICAO recommendation. The trial was conducted at Sydney, Cairns, Brisbane, Coolangatta, Perth, Adelaide and Broome.^[16]

A post implementation review found no evidence that the trial procedures reduced the risk associated with runway incursions. It also identified a number of safety issues and concerns, including the reduction in ADC and SMC situational awareness at airports where crossing of active runways was required (including crossing runway configurations such as at Perth). Airlines involved in the trial agreed at that time that the trial should be ceased. Consequently, Airservices Australia returned the procedures to the pre-trial requirements of the AIP (as stated above).

Qantas advised that the ICAO-recommended approach to runway crossings, with the crossing aircraft on the ADC frequency, was used overseas in countries such as the United Kingdom and the United States. The ATSB identified that other countries such as New Zealand used a similar approach to that specified in the Australian AIP, with aircraft required to automatically transfer to the SMC frequency after landing.

Integrated tower automation suite

Tower controllers were responsible for separating aircraft visually but used a range of systems at their workstations to assist with performing that task. Each station in Perth tower was fitted with the integrated tower automation suite (INTAS), which included the advanced surface movement guidance and control system (A-SMGCS).

The INTAS provided controllers with electronic flight and operational information to enhance airport efficiency. The system combined flight and operational data, surveillance and voice communications into a single integrated, control tower-specific layout. Controller workstations were equipped with four customisable touch screens that displayed electronic flight strips, operational information, weather, terminal area radar displays, and, where available, surface surveillance data through the A-SMGCS.

The A-SMGCS provided automatic identification of all aircraft and transponder-equipped vehicles at Perth Airport. Using the collection of that surveillance data from multiple sources, the system provided controllers with an electronic picture of what was happening on the ground at any time. Additionally, the system added to a controller’s situational awareness by predicting potential conflicts between vehicles and aircraft, and multiple aircraft movements, before they could occur. Those protections included runway incursions by aircraft or vehicles. Visual and aural alarms alerted controllers to potential problems, enabling them to take early corrective action.

During the implementation of INTAS in the Perth tower, the system was configured with associated alert settings assigned to each controller’s position. The selection of a role (including combined position roles) by the tower shift manager automatically triggered the associated system alert settings that were assigned to each role in the INTAS adaptation settings.

At the time of the occurrence, due to the configuration of the Perth tower INTAS, when an SMC was operating the combined workstation roles of SMC, airways clearance delivery (ACD) and shift manager, the A‑SMGCS alerts were off. This inhibited the SMC from receiving an aural and visual stop bar violation alert (and runway occupied alert) at their workstation.

Emergency response actions

The Australian Manual of Air Traffic Standards (MATS) defined a safety alert as:

The provision of advice to an aircraft when an ATS Officer becomes aware that an aircraft is in a position which is considered to place it in unsafe proximity to terrain, obstructions or another aircraft.

The manual also stated:

Unless the pilot has advised that action is being taken to resolve the situation or that the other aircraft is in sight, issue a Safety Alert prefixed by the phrase ‘SAFETY ALERT’ when you become aware that an aircraft is in a situation that places it in unsafe proximity to:

a) terrain;
b) obstruction;
c) active restricted or prohibited areas; or
d) other aircraft.

In addition, the manual stated:

Do not assume that because another Controller has responsibility for an aircraft that an unsafe situation has been observed and a Safety Alert or avoidance advice has been issue.

The MATS procedures for aerodrome controllers stated that, for cancelling a take-off clearance:

Only cancel a take-off clearance once an aircraft has commenced take-off roll in circumstances where an aircraft is in imminent danger e.g. ‘STOP IMMEDIATELY (repeat aircraft callsign) STOP IMMEDIATELY (reason)’. Accompany any instruction to cancel take-off with a description of the nature of the emergency.

Compromised separation recovery training

Separation between aircraft is considered to be compromised when separation standards have been infringed, or where separation assurance is absent to the extent that a breakdown of separation is imminent.

In order to help ensure controllers provided effective response actions when separation is compromised, they undertook compromised separation recovery (CRT) training. The ATSB has previously noted limitations with the provision of such training by Airservices Australia and the Department of Defence to their controllers in several investigation reports. In 2014 and in 2016, Airservices undertook a series of actions to improve its CRT training.^[17]

The ATS Training Operations Manual stated in 2014:

Compromised separation recovery training must be included in all ATC endorsement training courses, and in particular, skills-based training in the simulator. The training must be assessed for competency…

EGM [Executive General Manager] ATC has determined that all operational staff must successfully complete annual training and assessment in compromised separation recovery training. It is a mandatory requirement that all controllers are assessed in skills-based simulator Compromised Separation Recovery training at intervals not exceeding three years.

In September 2020, Airservices Australia confirmed that, since 2012, all endorsed controllers were required to complete the knowledge-based component of compromised separation recovery training as part of the annual refresher training program. It also advised:

The skills-based component [of CRT training] only applies to tower controllers that hold the ADC endorsement. Given the role and responsibilities of a surface movement controller this continues to be appropriate. Separation on the manoeuvring area is a joint pilot controller responsibility and there are no defined separation standards.

The skills based compromised separation training scenarios do not align with the responsibilities of an SMC. All SMC endorsed controllers are trained and assessed at recognising ground conflicts and taking action as required commensurate with the risk of the situation using standard phraseology and taking into consideration aspects of the local operational context. The records of such training is maintained in individual training files.

In addition, all controllers that complete a tower course do destination specific CSR exercises as a part of the aerodrome control course element.

… all SMC endorsed controllers are trained and assessed at recognising ground conflicts and taking action as required commensurate with the risk of the situation using standard phraseology, as such no further rationale is required.

As noted in Air traffic controllers, both of the controllers involved in the 28 April 2018 occurrence sequence held an ADC endorsement, and therefore had undertaken skills-based as well as knowledge-based CRT training. The ADC reported the most recent training included a stop bar violation and runway incursion at Perth.

__________

7. Eastern Standard Time (EST) was Coordinated Universal Time (UTC) + 10 hours, or Western Standard Time (WST) + 2 hours.
8. Ceiling and visibility okay (CAVOK): visibility, cloud and present weather are better than prescribed conditions. For anaerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, nocumulonimbus cloud and no other significant weather.
9. Civil Aviation Order 82.5 (Conditions on Air Operators’ Certificates authorising regular public transport operations in high capacity aircraft) required operators to preserve a CVR in the case of an immediately reportable matter.
10. The flight strip was an area surrounding the runway provided to reduce the risk of damage to aircraft running off a runway; it was not available for use by vehicles or aircraft.
11. The preferred taxiways for different runways were agreed by the joint Airservices Australia and Perth Airport Capacity Enhancement group.
12. Painted runway identifier markings (see Figure 8) were included in the ICAO standards and recommended practices but were not standard markings in the CASA MOS Part 139. The airport operator advised it sought CASA approval to install these markings as a runway incursion reduction measure.
13. Unidirectional lights are only visible in the direction of travel
14. Raised lights at the ends of stop bars were installed at other airports in Australia, such as Brisbane, Sydney and Canberra.
15. In this context, automatically means that the controllers do not instruct the flight crews to change frequency.
16. The trial procedures required a flight crew to automatically switch to the SMC frequency when vacating a runway after landing (unless the ADC advised otherwise). They would then be asked to change back to the ADC frequency before being cleared to cross the runway.
17. These safety actions are summarised in ATSB AO-2014-074, Loss of separation assurance involving A330 9V-STQ and A320, VH-VFH, near Tindal, Northern Territory, 24 April 2014. Available at www.atsb.gov.au.

Safety analysis

Introduction

After landing on runway 03, VH-XZM vacated onto taxiway J2 and crossed the runway 06 holding point, with an illuminated stop bar, without an air traffic control (ATC) clearance. The aircraft continued to taxi toward runway 06. The aerodrome controller (ADC) received aural and visual alerts and instructed the crew of another aircraft (VH-VZL) taking off from runway 06 to stop immediately. The flight crew of the departing aircraft rejected their take-off, preventing further escalation of the occurrence.

This analysis will firstly discuss flight crew situational awareness, mental models and approach briefings associated with VH-XZM’s incursion onto runway 06. It will then discuss the design characteristics of taxiway J2 that increased the risk of incursion into runway 06/24. Finally, it will discuss a range of other safety factors identified during the investigation.

Flight crew situational awareness and mental model

The captain’s mental model of the expected taxi route from landing on runway 03 to the parking bay was incorrect. Instead of having to cross runway 06 on taxiway J2, the captain expected to be on a taxiway that connected straight to the apron and did not have cross the other active runway.

This incorrect mental model developed due to a combination of factors:

• The captain’s prior experiences landing at Perth had not used taxiway J2, instead generally landing on runway 03 and vacating at taxiway D or, more commonly, landing on runway 24 and vacating at taxiway J1. Both of these taxiways led directly onto the apron area with no runway crossing.
• The captain’s intention on this occasion was to use taxiway D, expecting they would be using taxiway D up until after they landed on runway 03.
• When taxiways were discussed during the approach briefing, the captain was referring to the apron chart rather than the full aerodrome chart, and this smaller chart did not include runway 03 or the full length of taxiway J2. When the first officer (FO) briefed that taxiway J2 needed to cross runway 06, the captain believed the FO was referring to crossing runway 06 while still on runway 03 and did not discuss this different (and incorrect) understanding with the FO.
• The approach briefing did not include a discussion of the airport’s known hot spots, including the hot spot associated with taxiway J2 (see also Approach briefing).

After landing, the captain realised that the request for taxiway D had not been made and quickly re-planned an exit onto taxiway J2, although continuing to have the same expectation that they not need to cross an active runway to reach the apron.

The runway holding point markings and warning lights would normally provide enough cues that an aircraft was approaching a runway holding point. In this case these cues were also supplemented by the very salient illuminated stop bar. However, although the captain saw the stop bar, it was not identified as a problem and no revision was made to the mental model of the taxiways, instead rationalising in a time-compressed situation that the stop bar had been installed incorrectly.

This behaviour is consistent with confirmation bias, or the tendency for people to seek information that confirms their hypotheses, interpret ambiguous evidence as supporting their hypotheses, and either discount or not seek information that contradicts their hypotheses (Wickens and others 2013). Confirmation bias is an inherent aspect of human decision-making and has been demonstrated to occur in a wide range of contexts.

Workload and distraction

High workload and time pressure lead to a reduction in the number of information sources a person will search, and the frequency or amount of time these sources are checked (Staal 2004). They also result in people conducting tasks with simpler strategies, relying on responses or strategies with which they are familiar, and persevering with a response or strategy even when it has proven to be unsuccessful (Staal 2004, Wickens and others 2013). In addition, people are likely to miss important cues and experience difficulty integrating disparate pieces of information and making sense of them (Burian and others 2005). Associated with the reduced search of information sources and increased perseverance, the influence of confirmation bias will be enhanced (Wickens and others 2013).

The flight crew’s overall workload during the approach and landing was not abnormally high. However, workload and distraction at key points in time combined together to result in a situation where the problem with the captain’s mental model was not detected and corrected.

During the approach phase, the captain's workload as pilot monitoring was increased due to the FO’s low level of experience and air traffic control's (ATC’s) request for a high-speed descent. This workload contributed to an omission of routine secondary tasks prior to landing, such as requesting a taxiway D exit from the tower and pre-setting the surface movement control (SMC) frequency in the radio’s standby frequency position.

These omissions were examples of prospective memory errors. Prospective memory relates to an intention to perform an action at a later time, and a delay between forming the intention and acting on it. It is known to be vulnerable to failure and has been associated with many aviation accidents and incidents (Dismukes 2006). Conditions that increase this vulnerability include the delay between the intention to do a task and the execution of the task being filled with other activities, an interruption to a task sequence, and the cues or prompts to retrieve the intention from memory not being explicit. Neither of these tasks was associated with a specific checklist item (and by themselves were not important enough to be checklist items), and their omission was not detected until after landing.

After landing, when the captain realised the omission in not requesting taxiway D, the normal workload associated with landing was increased, associated with replanning the exit onto taxiway J2 while taking over control of the aircraft.

During the taxi phase, there was less time than would normally be the case to detect the problem. As the aircraft was crossing the runway edge, the runway 06 holding point was only about 176 m away. The captain’s delayed realisation that they needed to exit on taxiway J2, and misidentification of taxiway J2 as a rapid exit taxiway (RET), meant the aircraft entered J2 at a higher groundspeed than usual. The relatively high exit speed and relatively short distance to the runway 06 holding point meant that the flight crew only had limited time after leaving runway 03 to identify the problem before reaching the holding point.

During this period, a series of distractions occurred. More specifically:

• After vacating runway 03, the FO focussed attention inside the flight deck for a period of time to select the SMC frequency, instead of performing the more safety critical task of monitoring the aircraft's taxi path as it approached a known runway incursion hot spot. The FO assumed the captain would be stopping at the holding point and, focused on changing frequency and contacting the SMC, did not see that they had passed the holding point until about the time the captain was braking to stop.
• When approaching the holding point, the captain briefly went heads down to gain an understanding for the delay in changing to the SMC frequency and then advised the FO of the applicable SMC frequency. This reduced the time available to notice and comprehend the holding point signs, warning lights and stop bar lights ahead.

After passing the holding point, the presence of runway 06 ahead still provided an indication of a potential problem. However, the captain was distracted by the presence of another aircraft on the apron. This focused attention on the distant apron area and reduced the ability to visually identify the runway immediately in front of the aircraft. The FO was still primarily focused inside the flight deck during this period.

Approach briefing and approach briefing guidance

The approach briefing was the best opportunity for the flight crew to have established a shared and correct understanding of the requirements for the remainder of the flight, including the taxiway options. However, as already noted, they did not specifically discuss the taxiway J2 hot spot during the approach briefing, even though the FO had identified it on the aerodrome chart. Had the topic of the hot spot been raised and discussed in the briefing, as well as the main reason why it was a hot spot (that it led to another runway), the captain’s mental model of the taxiway J1/J2 layout would probably have been enhanced.

The International Civil Aviation Organization (ICAO) has emphasised that flight crews should prepare well in advance for departure and arrival at any airport, including reviewing hot spots before taxiing from the gate and prior to beginning descent. Accordingly, departure and approach briefings should contain a complete review of not just the expected taxi routes but potential routes as well, with special attention to any hot spots.

Qantas provided detailed guidance to flight crews on the content of approach briefings. Hot spots should have been considered a threat under the threat and error management section of the briefing guidance. However, since that briefing guidance contained no specific requirement to brief hot spots or runway incursion threats, it is likely that the presence of hot spots on a taxi route would not always be noted by a flight crew.

Although the aerodrome chart for Perth identified that the area around taxiway J2 was a runway incursion hot spot, it did not provide specific information about the nature of the threat or why it was a hot spot. Such information would better enable flight crews to understand how the hot spot may affect them. If flight crews are to effectively identify and plan mitigating actions to avoid runway incursions, they should be provided with detailed information to assist their understanding of the common reasons why previous flight crews have incurred a runway at particular locations.

Taxiway location and design

Airservices Australia data identified that the rate of runway incursions at Perth Airport was significantly higher than other major airports across Australia. A significant proportion of the Perth incursions occurred on taxiway J2 and, accordingly, it was designated as a hot spot. To assist with minimising the risk of incursions, stop bars and CASA approved runway identifier markings (in addition to other holding point markings and lights) had recently been introduced.

In addition to providing salient or conspicuous markings and cues about the position of a holding point, it is also important to ensure flight crews are provided sufficient time during a high workload period after landing to identify and comprehend runway holding point visual cues and to allow for ATC to intervene, if required, before an aircraft incurs a runway.

Taxiway J2 was not a rapid exit taxiway (RET), but it had some similar qualities: a relatively shallow intersection angle and a relatively wide curve radius. These characteristics led some pilots to use higher speeds when exiting runway 03. Although the intersection angle was not acute enough to actually be a RET, the angle would be difficult to judge while approaching it from the runway.

Flight data showed VH-XZM entered taxiway J2 at about 35 kt, which was slightly higher than the taxiway design limit of 31 kt. Flight data analysis of other flights provided by Qantas showed its aircraft commonly vacated runway 03 onto taxiway J2 at a relatively high speed.

In addition, taxiway J2 had a relatively short distance from the exit from runway 03 to the runway 06 holding point. This meant that flight crews had less time to see the holding point markings and an illuminated stop bar, especially if taxiing at higher speeds.

Taxiway J2 also led to a relatively complicated runway crossing point, with other taxiways intersecting at the same point. A complicated intersection can be difficult for crews to navigate and can draw their attention.

Overall, the location and design of taxiway J2 significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. In particular, the following features made taxiway J2 problematic:

• a relatively shallow intersection angle from runway 03
• a wider than usual entry curve radius
• a relatively short distance from the turn to the runway 06 holding point
• the next intersection leading directly to a runway rather than a parallel taxiway
• the next intersection being relatively complicated
• the intersection adjoining the first two-thirds of runway 06.

In addition, the risk associated with taxiway J2, and runway incursions was exacerbated by it being made the preferred exit for landing off runway 03. Although many flight crews elected to use taxiway D instead, this required the crew to proactively make that request.

The introduction of stop bars in March 2018 would certainly have reduced the risk but, depending on the situation, not eliminated the risk. Although the exact sequence of events associated with this particular occurrence would have been difficult to predict beforehand, there was undoubtedly an increased risk of runway incursions that needed to be managed, and a range of scenarios that could have resulted in a high-risk runway incursion given the inherent limitations of the taxiway J2 location and design.

As previously noted, taxiway J2 had some features that would have made it appear similar to a RET. Flight crews would normally become aware of the existence of a RET from tables of information about an airport in the aerodrome charts. However, a flight crew may forget or may not brief the existence or absence of a RET among the potential taxiways that could be used. At the time of the occurrence there was no requirement in Australia for airports to use indicator lights at RETs to distinguish them from other taxiways, so there was no immediate way to identify a taxiway as a RET or otherwise during the landing. However, unless all RETs were equipped with the appropriate indicator lights, the absence of indicator lights at a particular taxiway may not be that effective as a cue. Overall, unless briefed otherwise, it would be generally safer for a flight crew to assume that a taxiway was not a RET and adjust the aircraft’s speed appropriately.

Air traffic control response

The ADC became aware of the problem on receipt of the first integrated tower automation suite (INTAS) alert. The ADC considered that, as VH-XZM had vacated and was clear of runway 03, the flight crew would most likely have changed over to the SMC frequency and therefore would have been unable to hear any safety alert instructions on the ADC frequency. Instead, an instruction was issued to VH-VZL to stop immediately.

A research study showed that the average time for tower controllers to act in response to a system alert was 4.6 seconds with a mean response duration of 2.3 seconds, with maximum response times being 8.1 seconds and 5.3 seconds respectively (Sanchez and others 2009). In this occurrence, the ADC transmitted the stop immediately instruction to the flight crew of VH-VZL about 7 seconds after the first alert, a time which included a period of blocked frequency from another aircraft transmitting.

The ADC’s action was effective in mitigating the consequence of the runway incursion. The ‘stop immediately’ instruction was simple and easily comprehended by the captain of VH-VZL, who was actively monitoring the developing situation and responded promptly to the ADC’s instruction.

However, although VH-VZL’s flight crew received a timely and clear instruction from ATC, VH‑XZM’s flight crew did not receive any communication from ATC during the period after the first INTAS alert (1442:04) until 1442:26, when the SMC asked the flight crew if they were on the SMC frequency. This was after the captain had commenced braking (1442:19), and 10 seconds after the FO made initial contact with the SMC (when the FO was unaware of the problem).

The exact reasons why the SMC did not issue an alert and instruction to the flight crew of VH‑XZM are unclear. In response to the first INTAS alert, the SMC was aware of the developing problem. However, at that stage there may have been some doubt regarding whether the flight crew had switched over to the SMC frequency. In addition, the SMC was in the progress of providing a pushback clearance to another aircraft. The SMC had received training in issuing stop instructions as well as compromised separation recovery training.

The second INTAS alert at 1442:16 was broadcast on the ADC workstation’s speaker at the same time as the VH-XZM FO’s first transmission on the SMC frequency, to which the SMC did not reply. The SMC may have focussed on the more relevant event—the second INTAS alert—at this time and as a result did not process VH-XZM’s transmission. Nevertheless, even after hearing the ADC provide the other aircraft with a stop instruction (1442:11), a prompt instruction to VH-XZM was warranted to further minimise any potential collision risk. A stop immediately instruction over any frequency that the flight crew might be using would have led to a more rapid response from that flight crew.

Although not directly related to this occurrence, the investigation identified some limitations with ATC processes that increased the potential risk of other occurrences:

• Due to the way INTAS was configured at Perth, the SMC’s workstation did not directly receive INTAS alerts if the SMC position was combined with other positions. This meant that an SMC may not have received a salient warning that an aircraft under their control was at risk of collision. In this case, the SMC’s awareness of the runway incursion was raised as a result of the INTAS aural alert played through a speaker on the ADC’s workstation, but in other situations an SMC may not identify such an alert.
• Communication practices for runway crossings at Australian airports differed from those recommended by ICAO and used in some countries overseas. According to ICAO, runway crossings should be managed by the ADC, which ensured that flight crews of aircraft crossing a runway were aware of any instructions being issued to aircraft using that runway. In Australia (and some other countries), runway crossings were handled by the SMC and not the ADC. Having two aircraft on a runway at the same time but not requiring them to be on the same frequency does create the potential for flight crews not to be aware of the presence of the other aircraft at a critical point in time. However, Airservices Australia reported that it trialled a version of the ICAO-recommended approach and determined it did not reduce the risk of runway incursions and instead it introduced new safety issues and concerns in the Australian environment, including a potential reduction in controller situational awareness.
• Depending on how it was implemented, the ICAO-based approach could have required a flight crew to transfer to the SMC frequency, before the SMC then transferred them back to the ADC frequency prior to crossing the runway, which would have increased the complexity of communications at a location such as Perth Airport for aircraft landing on runway 03 and exiting on taxiway J2. One option that could have assisted with managing the unique problems associated with taxiway J2 was for the ADC to require flight crews landing on runway 03 and vacating on taxiway J2 to remain on the ADC frequency until after they crossed runway 06. However, introducing a unique approach to managing radio frequencies at one specific location in Australia could also increase risk. Alternatively, local procedures could have included advising a flight crew landing on runway 03 and exiting at taxiway J2 of the crossing runway hazard ahead.

Findings

From the evidence available, the following findings are made with respect to the runway incursion involving a Boeing 737, registered VH-XZM, which resulted in a rejected take-off involving a Boeing 737, registered VH-VZL, at Perth Airport, Western Australia on 28 April 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The captain developed an incorrect mental model of the exit taxiways off runway 03, believing the aircraft would not have to cross runway 06 after exiting on either of the potential taxiways (J2 or D). As a result, the captain did not expect to cross a runway holding point or stop bar and, upon seeing the stop bar was illuminated, incorrectly thought that it must only apply to aircraft coming from the other direction.
• During the approach phase, the captain's workload as pilot monitoring was increased due to the first officer's low level of experience and air traffic control's request for a high-speed descent. This workload contributed to the omission of routine secondary tasks, such as requesting a taxiway D exit from the tower and pre-setting the surface movement control frequency.
• After vacating runway 03, the first officer focused inside the flight deck for a period of time to select the surface movement control frequency, instead of performing the more safety critical task of monitoring the aircraft's taxi path as it approached a known runway incursion hot spot.
• When approaching the holding point for runway 06, the captain briefly focused inside the flight deck to gain an understanding for the delay in changing to the next frequency. This reduced the time available to notice the holding point signs and lights ahead.
• The captain taxied passed the runway 06 holding point (with an illuminated stop bar) without an air traffic control clearance.
• After taxiing passed the illuminated stop bar, the captain was distracted by the presence of another aircraft on the apron. This focused the captain’s attention on the distant apron area, reducing the likelihood of visually identifying the runway immediately in front of the aircraft.
• During the approach briefing, the flight crew discussed taxiway J2 and taxiway D, but the flight crew did not discuss the potential threat of the hot spot associated with taxiway J2.
• Although Qantas provided detailed guidance to flight crews about the content of departure and approach briefings, it did not specifically require aerodrome hot spots to be briefed. [Safety issue]
• Although some aerodrome navigational charts in Australia had identified hot spot locations, they generally provided limited explanatory information to enhance flight crew understanding or awareness of why the hot spot was there and what actions they could take to mitigate the associated risk.
• The location and design of taxiway J2 at Perth Airport significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. Taxiway J2 was published as the preferred exit taxiway for jet aircraft and, although mitigation controls were in place, they were not sufficient to effectively reduce the risk of a runway incursion. [Safety issue]
• Although the flight crew of VH-VZL taking off on runway 06 were provided with an instruction to stop immediately to reject their take-off, no safety alert or instruction was provided to the flight crew of VH-XZM during the period between when the controllers received a stop bar violation alert (1442:04) and the captain applied the brakes at 1442:19.

Other factors that increased risk

• Airservices Australia’s configuration of the integrated tower automation suite (INTAS) at Perth Airport had resulted in a situation where controllers performing some combined roles had the INTAS aural and visual alerts inhibited at their workstation. As a result, controllers performing such combined roles would not receive a stop bar violation alert or runway incursion alert at their workstation. [Safety issue]

Other findings

• The stop bar alert and the aerodrome controller’s high level of situational awareness led to a timely instruction to the flight crew of VH-VZL to stop immediately.
• The high level of situational awareness of the VH-VZL flight crew significantly aided their immediate action to reject their take-off on runway 06 following the controller’s instruction.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties are provided with a draft report and invited to provide submissions. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
 

Operator guidance for flight crew briefing of aerodrome hot spots

Safety issue number: AO-2018-032-SI-01

Safety issue description: Although Qantas provided detailed guidance to flight crews about the content of departure and approach briefings, it did not specifically require aerodrome hot spots to be briefed.

Location and design of taxiway J2 at Perth Airport

Safety issue number: AO-2018-032-SI-02

Safety issue description: The location and design of taxiway J2 at Perth Airport significantly increased the risk of a runway incursion on runway 06/24 for aircraft landing on runway 03. Taxiway J2 was published as the preferred exit taxiway for jet aircraft and, although mitigation controls were in place, they were not sufficient to effectively reduce the risk of a runway incursion.

Inhibition of safety alerts for combined air traffic control roles

Safety issue number: AO-2018-032-SI-03

Safety issue description: Airservices Australia’s configuration of the integrated tower automation suite (INTAS) at Perth Airport had resulted in a situation where controllers performing some combined roles had the INTAS aural and visual alerts inhibited at their workstation. As a result, controllers performing such combined roles would not receive a stop bar violation alert or runway incursion alert at their workstation.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Qantas Airways advised that on 17 September 2019, following a runway incursion subsequent to this occurrence, it published a safety information notice to all pilots, which contained information about failure to comply with taxi clearances and details of the recent runway incursion occurrence. It also contained safety educational information related to influencing factors, mitigation techniques and strategies to avoid non-compliance with air traffic control ground clearances.

Airservices Australia and Qantas Airways advised they were in discussions to ascertain if there was merit in the conduct of a new trial of the ICAO-recommended approach to runway crossings, with the crossing aircraft on the ADC frequency,

The Civil Aviation Safety Authority (CASA) advised that in September 2019, CASR Part 139 (Aerodromes) Manual of Standards introduced guidance for rapid exit taxiway indicator lights (RETILs). The guidance stated ‘RETIL may be provided on a runway intended for use in RVR conditions less than 350 m or where the traffic density is heavy’. CASA advised the ‘optional’ application of subsection 9.89 (1) was consistent with ICAO SARPs (see Annex 14 volume I para 5.3.15.1), which set the application of RETIL as a Recommendation.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew of VH-XZM
• the captain of VH-VZL
• the aerodrome controller
• the surface movement controller
• flight data recordings from VH-XZM and VH-VZL
• closed-circuit television recordings
• Qantas Airways Limited
• Airservices Australia
• Perth Airport Pty Ltd.

References

Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2005-213462.

Dismukes, K 2006. ‘Concurrent task management and prospective memory: pilot error as a model for the vulnerability of experts’. Proceedings of the Human Factors and Ergonomics Society 50th Annual Meeting, pp. 909–913.

Sanchez J, Smith EC & Chong RS 2009, Controller and Pilot Response Times to Runway Safety Alerts, MTR090237, The MITRE Corporation, McLean, VA.

Staal MA 2004, Stress, cognition, and human performance: A literature review and conceptual framework, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2004-212824.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew of VH-XZM, the captain of VH-VZL, Qantas Airways Limited, the aerodrome controller, the surface movement controller, Airservices Australia, Perth Airport and the Civil Aviation Safety Authority.

Submissions were received from the captain of VH-XZM, Qantas Airways Limited, the aerodrome controller, Airservices Australia, Perth Airport and the Civil Aviation Safety Authority. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 20–21 April 2018, Pacific National intermodal freight train 6MP4 was travelling from Melbourne, Victoria via Adelaide, South Australia to Perth, Western Australia. A short time after commencing the downhill grade from Mount Lofty to Belair, South Australia, there was a structural failure in the underframe of platform 2 of wagon RRYY01X. Soon after, the shared bogie between platform 2 and 3 of the wagon derailed. The train continued down the grade until it separated (between platform 2 and platform 3), with both portions of the train coming to a stop near Glenalta.

What the ATSB found

The investigation found that a pre-existing structural crack in the underframe of platform 2 of wagon RRYY01X likely expanded due to in-train forces (compression and tension), causing the platform’s deck to bend and change the deck angle at the coupling to platform 3 (supported over a common bogie). As train 6MP4 negotiated a series of tight curves on the descending grade, the combination of wheel unloading (due to compressive forces and coupling angle on a light wagon) combined with increased lateral forces (due to compressive forces and a tight curve), resulted in flange climb (possibly complete wheel lift) and subsequent derailment.

The ATSB found that multiple train examinations and maintenance inspections did not identify the crack in platform 2 of wagon RRYY01X. In addition, Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of the cracks being detected.

Additionally, the ATSB found that the train separation at Glenalta did not activate the locomotives’ emergency braking systems, although this did not increase the risk associated with this accident.

What has been done as a result

Immediately following this accident, Pacific National issued a Rolling Stock Notice requiring immediate inspections of all RRYY class wagons for underframe cracking, with wagons exhibiting cracking around the underframe removed from service for repairs. Magnetic particle inspection or dye penetrant inspection of welded connections were also added to the scheduled preventative maintenance requirements.

Following the initial response, Pacific National undertook a fleet assessment of RRYY class wagons to ensure that they were safe to return to revenue service and developed a long-term repair methodology for RRYY wagons with identified cracks.

Safety message

Rolling stock managers should consider the key structural risk areas of their rolling stock and establish guidance methods for ensuring that these risk areas are given an appropriate level of priority when undertaking inspections.

The occurrence

Overview

On 20–21 April, Pacific National intermodal freight train 6MP4 was travelling from Melbourne, Victoria via Adelaide, South Australia to Perth, Western Australia. At about 0003^[1] on 21 April 2018, a short time after commencing the downhill grade from Mount Lofty to Belair, South Australia, there was a structural failure in the underframe of platform 2 of wagon RRYY01X. Soon after, the shared bogie between platform 2 and 3 of the wagon derailed. The train continued down the grade until the train separated (between platform 2 and platform 3 of wagon RRYY01X) and came to a stop near Glenalta.

Wagon RRYY01X was a multi-platform 5-pack^[2] wagon. The wagon’s position behind the locomotives placed it about the centre in the train consist, and platform 2 was the only one not loaded with a container.

Prior to derailment

The train crew of 6MP4 involved in this accident commenced their shift at Dimboola (Victoria), departing at about 1854 on 20 April 2018. They did not pass or cross any trains between Dimboola and Glenalta. The train crew reported that, apart from a level crossing near miss with a road vehicle forcing an emergency stop near Lillimur (Victoria), the journey towards Mount Lofty was uneventful.

A third locomotive (8223) was added to train 6MP4 at Tailem Bend (88 km before Mount Lofty). At about 2342, the train began an 11 km steep climb up to Mount Lofty (Figure 1). The three locomotives were operating almost continuously in throttle notch 8 (maximum tractive effort), only easing off slightly at a couple of short sections of level track. At about 2358, 6MP4 passed Mount Lofty and commenced travel on the downhill grade^[3] towards Belair (Figure 1).

Mount Lofty is located at the top of a cresting grade.^[4] As the train passed over the cresting grade, the weight and resistance of the train’s rear portion still on the ascending grade (1,485 t trailing behind wagon RRYY01X) was opposed by the combined tractive effort and weight of the front portion of train now on the descending grade (1,368 t ahead of wagon RRYY01X).

As more weight moved onto the descending grade, the driver gradually decreased tractive effort and began applying braking effort using the locomotives’ dynamic brakes. The driver progressively increased braking effort until the locomotives were applying full dynamic brake, with the train transitioned to a compressed state.

Figure 1: ARTC track from Mount Lofty station to Glenalta station, including derailment information

Image shows ARTC track from Mount Lofty station to Glenalta station in grey, with red indicators showing kilometre markers. Location of key events indicated with orange markers.

Source: Google Earth annotated by the ATSB, and inset ARA Railways of Australia Map 2014 annotated by the ATSB

At some point during the train’s descent, the underframe of wagon RRYY01X’s platform 2 experienced a structural failure, which led to the deck of platform 2 dropping or sagging (Figure 2). This resulted in the deck angle of platform 2 rising towards the coupling to platform 3. The compressive forces acting on the angled deck of the empty platform 2 reduced the weight acting on the trailing axle from the bogie/wheels shared between platform 2 and 3.

Figure 2: Structural failure in underframe of platform 2 of RRYY01X

Image shows the structural failure in the underframe of wagon RRYY01X (platform 2) and its respective location to the derailed shared bogie between platforms 2 and 3.

Source: Pacific National and ATSB, annotated by the ATSB

Derailment

At about 0003 on 21 April, as the wagon negotiated a series of tight curves, the lightened axle between platform 2 and platform 3 climbed or lifted over the rail and subsequently derailed.

The first evidence of derailment was subsequently observed at the 28.6 km mark (about 2.4 km past Mount Lofty station). Wheel witness marks were identified on the exposed upper surface of the resilient track fastenings through a right curve (Figure 3).

Figure 3: Initial evidence of derailment between Mount Lofty and Belair

Image shows the location of the initial wheel witness marks on the upper surface of the resilient track fastenings at the 28.6 km mark.

Source: ATSB

The combination of a sagging deck and derailed wheels allowed the underframe to start rubbing on the leading axle of the bogie shared between platform 2 and 3 (Figure 4).

Figure 4: Contact abrasion damage to wheelset axle and platform 2 of 5-pack wagon RRYY01X

Image shows leading wheelset axle abrasion marks from the shared bogie between platform 2 and 3 of 5-pack wagon RRYY01X.

Source: ATSB

The trailing axle continued in a derailed state for a further 1.58 km, making intermittent contact with the ground, track fastenings and sleepers. At about 0005, when passing the 27.02 km point, bogie components collided heavily with a concrete sleeper, dislodging the constant-contact side-bearer pads at this location and breaking the bogie centre-pin (Figure 5).^[5]

The failed centre-pin allowed the bogie to dislodge from its centre-bowl and move back towards the rear of the train, fouling with the leading end structure of platform 3. Over the next 3.9 km, the derailed rear axle made more frequent contact with the ground, track fastenings and sleepers.

Figure 5: Wagon coupler-pin and bogie centre-pin from RRYY class wagon

Image shows an intact combined wagon coupler-pin and bogie centre-pin from a RRYY class wagon, alongside the wagon coupler-pin from wagon RRYY01X with missing bogie centre-pin.
Source: ATSB

At about 0011, as the derailed bogie of wagon RRYY01X passed through 20 Points at the entrance to the Belair crossing loop (23.081 km point, Figure 1), bogie components collided with the point components. About 25 m later, the derailed axle re-railed at the V-crossing^[6] for the crossing loop. The train continued, with the bogie between platforms 2 and 3 running on the rails, but dislodged from its centre-bowl and fouling with platform 3.

Train separation

Train 6MP4 gradually slowed as it descended the grade. At about 0014, as the lead locomotive passed about the 20.36 km mark, there was a slight increase in train speed. This coincided with wagon RRYY01X uncoupling and separating between platforms 2 and 3.

Separation of the two platforms resulted in the breaking of the train’s brake air pipe and exhausting of brake pipe air to the atmosphere. The driver observed a high reading on the locomotive’s brake pipe airflow gauge and, expecting an emergency application of the automatic brake (train-line emergency brake), they commenced bailing or holding off the locomotives’ brakes.

The reduction in brake pipe air pressure to the rear portion of train 6MP4 resulted in the automatic application of the wagon brakes, bringing the 1,485 t rear portion of train 6MP4 to a stop in about 212 m. The breaking of the train’s brake pipe also exhausted air from the front portion of train 6MP4, causing the wagon brakes to apply, though the locomotives’ emergency brake systems did not activate.

At about 0015, the driver allowed the front portion of train 6MP4 to come to a stop using a combination of wagon braking effort (from the brake pipe rupture and pressure reduction), and an increase in the locomotive dynamic braking effort. The driver applied the locomotives’ brakes to stop the front portion of the train in the final 4 seconds of movement. The front portion of train 6MP4 was bought to a stop in about 662 m. After coming to a stop, the front and rear portions of the split train 6MP4 were separated by approximately 450 m (Figure 6).

The drivers recalled that when the front portion of the train came to a stop, there had been no bumping or crashing in the train. As such, neither of the drivers were expecting that the train had separated.

Figure 6: The stopped location of both portions of 6MP4 after the train separated

Image shows ARTC track in grey, with red markers showing kilometre markers, and 6MP4 stopped position of both portions in orange.
Source: Google Earth annotated by ATSB

The previously derailed bogie was found lodged outside of its normal location under the leading end of RRYY01X platform 3, and the trailing end of platform 2 was found on the ground. There was substantial damage to the bogie and two platforms from the 5-pack wagon RRYY01X (Figure 7), plus minor damage to rail infrastructure (Location and infrastructure). There were no injuries.

Figure 7: Platform 2 and 3 from 5-pack wagon RRYY01X in their stopped locations

Image shows the final position of the bogie involved in derailment with platform 2 and 3, after train 6MP4 came to a stop near Glenalta.

Source: Pacific National annotated by the ATSB

_________

1. All time reference in this report are in local time (Central Standard Time).
2. 5-pack wagon: an articulated wagon comprising five platforms, with the adjacent ends of individual units being supported on a common bogie and permanently connected by a device, which permits free rotation in all planes.
3. The downhill grade between Mount Lofty and Belair varies between 1:45 and 1:48.
4. Cresting grade: a long ascending grade that changes to a long descending grade, both grades being of sufficient magnitude to require a change in train handling procedures as the grade is topped.
5. Bogie centre-pin: in the case of a RRYY class 5-pack wagon, the pin used to locate the bogie within the centre-bowl and secure the bogie to the wagon structure. Note: the bogie centre-pin and platform coupler-pin are joined to each other in a RRYY class wagon.
6. V-crossing: a track component that enables a wheel travelling along one rail to pass through the rail of a track which crosses its path.

Context

Location and infrastructure

The accident occurred over an 8.9 km section of standard gauge track between Mount Lofty and Glenalta, located in the Adelaide Hills approximately 31 to 19 track kilometres from Adelaide respectively (Figure 8). This section of track forms part of the interstate line between Melbourne and Adelaide, and is managed by the Australian Rail Track Corporation (ARTC).

The ARTC standard gauge track from Belair towards Adelaide is adjacent to the broad gauge track, part of the Adelaide Metropolitan Passenger Rail Network, managed by the Government of South Australia, Rail Commissioner.

Figure 8: Location of derailment site, between Mount Lofty and Glenalta

Image shows location of derailment site within South Australia, and inset image shows ARTC track in greater detail from Mount Lofty Railway Station to Glenalta Railway Station.
Source: ARA Railways of Australia Map 2014 and Australian Government National Map, both annotated by the ATSB

The standard gauge track consists of continuously welded rail secured to concrete sleepers by resilient fasteners and supported on ballast. The configuration is typical of the standard used for the interstate line in South Australia.

From Mount Lofty, the track exhibits a 1 in 45 down gradient (Figure 9), with multiple tight curves. This section of track consists of both left and right curves varying in radius between 195 m and 700 m. A standard gauge crossing loop is located at Belair, about 8 km from Mount Lofty. The crossing loop provides 1,543 m of standing room^[7] over an almost level straight section of track.

The Belair railway station is located approximately 200 m within the Adelaide end of the Belair crossing loop. The track continues to descend at a 1 in 47 down gradient (Figure 9), through multiple tight curves, towards Glenalta. Although each of the railway stations (from Belair) are active for passenger services, the platforms facing the standard gauge track are unused.

Figure 9: Mount Lofty to Glenalta track layout and gradient information

Image shows rail infrastructure layout, gradient and elevation information for section of ARTC track between Mount Lofty and Glenalta. Source: ATSB

The condition of the rail infrastructure including rail lubrication equipment between Mount Lofty and Belair was observed by the ATSB. The ATSB found no evidence to suggest that the condition of the rail infrastructure contributed to the derailment.

Approximately 5 km of standard gauge track sustained intermittent damage from the derailment, with about 50 concrete sleepers requiring replacement. At the Mount Lofty end of the Belair Station crossing loop, timber sleepers and associated points turnout components, rods and bars required replacement. Damage was also sustained to automatic rail lubricators between Belair and Mount Lofty.

There was no damage caused to the adjacent Adelaide Metropolitan Passenger Rail Network, or road bridges within the area.

Environmental conditions

Information obtained from the Bureau of Meteorology (BoM) established that the weather near Mount Lofty was mild, with light rain and relatively light winds in the period leading up to the accident. During the previous day, the BoM weather stations at Mount Lofty recorded a minimum temperature of 17.9 °C and a maximum of 25.6 °C. At the time of the accident, the temperature was about 18 °C.

Given these conditions, the ATSB determined that environmental factors were unlikely to have contributed either directly or indirectly to the accident.

Train information

Pacific National was the owner and operator of freight train 6MP4. The train consisted of two locomotives (NR62 and NR58) hauling 26 wagons (both single and multi-platform wagons) from Melbourne, with a third locomotive (8223) added at Tailem Bend (88 km before Mount Lofty). The total train length was about 1,499 m, and weighed about 2,853 t.

Although train 6MP4 was transporting dangerous goods in some containers, these were located on wagons further back in the train consist and were not associated with the derailed wagon. There was no release or spillage of dangerous/toxic goods from containers or wagon loads as a result of the accident.

Train crew information

Two Pacific National locomotive drivers were crewing train 6MP4. The driver operating train 6MP4 and the second driver had about 24 and 12 years’ experience (respectively) as locomotive drivers for Pacific National. Both held current driver competencies, route knowledge and rail safety worker health assessments.

The driver of train 6MP4 used dynamic brake alone to control train speed on the steep descending gradient from Mount Lofty. The locomotive event recordings indicate that the driver made gradual changes to dynamic braking effort, maintaining train speed between a minimum of 28 km/h and a maximum of 51 km/h, while also keeping in-train forces as constant as possible.

Although this approach to train handling has a number of benefits, the use of dynamic braking as the sole means of controlling train speed on a descending grade can generate significant in-train longitudinal compressive forces. However, this method of train handling is common practice for freight trains traversing the steep gradients in this location and is consistent with the handling instructions documented in Pacific National standard PN-STD-SAF - Train Handling.

In summary, the available evidence indicated that the driver handled train 6MP4 appropriately in the period leading up to the accident.

Consistent with Pacific National procedures, both drivers were requested to undertake drug and alcohol tests following the incident. The tests returned a negative result for each driver. A review of available evidence did not identify any concerns regarding the drivers’ fitness for duty in the period leading up to the accident.

Train braking systems

Dynamic brake

The dynamic brake, independent brake, and automatic brake are sub-systems of the train’s overall braking system.

Dynamic braking is a locomotive braking function present in diesel-electric and electric drive locomotives. It is not a substitute for the train’s air braking, but is a supplementary system that provides an additional means of speed control. A benefit of dynamic braking is to reduce the wear and heat generated by the friction style train braking equipment used by the independent and automatic braking sub-systems.

Dynamic braking uses the locomotive electrical traction motors as generators, converting the kinetic energy of a moving train into electrical energy. The electrical energy generated is dissipated into fan cooled electrical resistor banks. Increasing or decreasing the amount of electrical resistance in the resistor banks varies the load on the traction motor generator, which applies a corresponding resistance/braking effect on the rotating locomotive wheels.

Independent brake

The independent brake solely controls air brakes within the locomotive(s) and works independently of a train’s other braking control systems. The locomotive brakes are applied when the locomotive brake cylinder pressure is increased. This pressure can be increased or decreased via the driver’s independent brake control handle.

Automatic brake

The automatic brake controls the air brakes in the entire train, including the locomotive(s). An application of the automatic brake applies the locomotive(s) brakes by increasing locomotive brake cylinder pressure (similar to control via the independent brake system). The automatic brake simultaneously triggers the application of the train’s wagon brakes by reducing the air pressure within the train’s brake pipe. Maximum wagon braking effort is achieved when the brake pipe pressure is reduced to about 350 kPa, and wagon brakes are released when the brake pipe is charged to about 500 kPa.

The driver can vary the train’s braking effort, by operating the locomotive’s automatic brake control handle. Brake pipe air pressure is reduced at the service rate for normal braking applications, or at the greater emergency rate when an emergency brake application is made. The driver also has a ‘bail-off’ feature whereby they can suppress the braking action of the locomotive(s) following an automatic brake application, therefore enabling only the wagon brakes to stop the train.

Train-line emergency brake application

In the event that the train’s brake pipe is broken or ruptured following a train separation, the train’s wagon and locomotive brakes are automatically applied at the emergency rate. This safety feature of the automatic brake is also known as a train-line emergency brake application.

The Australian Standard AS7510.6:2014 (Braking Systems – Part 6 – Train), specified the minimum standards for brake performance, features, and compatibility for the braking systems of trains. This standard specified that:

In the event of train separation, the brake application provided by the stopping brake^[8] shall be an emergency application of the stopping brake on every vehicle of the train.

That is, the rapid reduction in a train’s brake pipe pressure, caused by a train and brake pipe separation, must apply brakes at the emergency rate within every vehicle within the train, including locomotives. Although the locomotives of 6MP4 had the ability to comply with this requirement, practical application of the requirement can be influenced by the compliance of the connected wagons’ braking systems. In this case, the wagons which made up 6MP4 were manufactured before the standard was released, and there was no requirement to retrospectively apply this standard to these wagons.

Operationally, the driver has the option to prevent the automatic emergency application of the locomotive brake by using the bail-off feature. This is usually done in order to prevent a collision between two separated portions of a train, caused by the front portion of the train slowing faster than the rear portion. Despite this, there remains an initial automatic requirement for the braking systems in each vehicle of the train to respond to the train separation.

To detect train separations, locomotives are fitted with braking control systems designed (among other control purposes) to detect the rapid reduction of the train’s brake pipe pressure. In the event that a rapid reduction of brake pipe pressure is detected, the braking control systems enable the locomotive(s) emergency braking systems to remove the locomotive drive and provide a faster braking response to bring the train to a stop. These additional emergency braking system actions can include:

• faster exhaustion of brake pipe air pressure via the locomotive’s brake control valves
• removal of the brake pipe charging source (compressor output) from attempting to re-charge the train’s brake pipe
• application of the locomotive brake
• de-energization of the locomotive traction power via the pneumatic control switch/power knockout switch (PCS)
• application of emergency adhesion sanding.^[9]

Automatic braking of train 6MP4

In this case, as the lead locomotive of 6MP4 passed the 20.362 km mark, wagon RRYY01X uncoupled between platforms 2 and 3. This resulted in the separation of the train’s brake air pipe, which exhausted the brake pipe air to the atmosphere.

Following the accident, the train’s brake pipe connections between platform 2 and 3 of RRYY01X were examined. This examination confirmed that the brake pipe had been cleanly broken in the train separation sequence (Figure 10). The brake pipe was not crimped or partially restricted during the train separation, allowing for unrestricted exhausting of brake pipe air.

Figure 10: Broken train brake pipe in platform 2 of 5-pack wagon RRYY01X

Image shows the broken brake pipe on platform 2 of 5-pack wagon RRYY01X.

Source: Pacific National and ARTC, annotated by the ATSB

The rear portion of train 6MP4 stopped due to the reduction in brake pipe air pressure and automatic application of the wagon brakes. Although the wagon brakes also applied on the front portion of 6MP4, the emergency brake systems on the three locomotives did not activate.

Examination of the locomotive event recording verified the absence of emergency brake application. More specifically:

• Emergency brake application would normally trigger adhesion sanding in NR class locomotives, but this was not evident after the train separation in this instance (Figure 11).
• Emergency brake application would normally trigger automatic application of a locomotive’s brakes. The locomotive brakes did not apply, though in this instance the driver reported bailing or holding off the locomotives’ brake after they observed the high brake pipe flow rate.
• Emergency brake application would normally trigger complete evacuation of brake pipe air pressure. In this instance, brake pipe pressure appeared to remain just above 300 kPa (Figure 11).

Figure 11: Graph derived from extract of locomotive NR62 event recorder data

Image shows recorded locomotive NR62 data of the automatic brake pipe pressure, train speed, and sanding status from the front portion of the separated train. The NR62 recordings from the derailment sequence is not displayed in this graph.

Source: Data source Pacific National, graphed by the ATSB

Rolling stock – Wagon RRYY01X

General details

Wagon RRYY01X was one of 52 built in three tranches in 2004–05. The RRYY class wagon is a 5-pack skeletal container wagon (Table 1). This style of wagon consists of five individual wagons referred to as ‘platforms 1 to 5’, permanently coupled over common bogies (Figure 12).

Table 1: Summary details for Pacific National RRYY class wagons

Source: Pacific National Wagon Details Manual WDM-RRYY_04, Issued 28 July 2010

Figure 12: Pacific National RRYY class wagon

Image shows platform and shared bogie configuration of RRYY class wagon.

Source: Pacific National, annotated by the ATSB

The RRYY class wagons were a non-typical low deck wagon design, incorporating a light underframe that was intended to carry car containers. The low deck level was achieved by a combination of smaller diameter wheels, and large low depth gooseneck sections extending from the platform coupling and bogie centres to the larger platform main centre-sill section (Figure 13). Near the junction of this gooseneck and the main centre-sill section of the platform, an outrigger provided support for the container load via its connection to the main centre-sill and goose neck sections. The outrigger featured a large boxed opening for the wagon’s brake pull rod (Figure 13).

Figure 13: RRYY class wagon platform structure

Image shows the low depth platform gooseneck section which extends from the platform coupling and bogie centre to the larger main centre sill section of the platform, as well as the boxed outrigger section.

Source: Pacific National, and ATSB annotated by the ATSB

Post-accident examination

Platform 2 of wagon RRYY01X was recovered to the Adelaide Freight Terminal, allowing for a more detailed examination of the underframe failure. The failure originated from a crack between the join of the bottom centre sill plate and pull rod boxed opening in the wagon’s container loading outrigger (Figure 14).

Figure 14: Underframe cracks in platform 2 of 5-pack wagon RRYY01X

Image shows underframe cracks and their location in platform 2 of 5-pack wagon RRYY01X. The underframe cracks and derailed bogie were located at the trailing end of platform 2 of 5-pack wagon RRYY01X.

Source: Wagon drawing - Pacific National annotated by the ATSB; photos – ATSB

An examination of the crack surface on platform 2 suggested the initial propagation had occurred over a long period of time. This was followed by a rapid propagation shortly prior to and during the derailment. Although the exact period of time the initial crack was evident could not be determined, the crack surface condition suggested it existed weeks to months before, and most certainly was present prior to 6MP4’s departure from Melbourne (Figure 15).

Figure 15: Underframe crack fracture surfaces in platform 2 of 5-pack wagon RRYY01X

Image recorded on 27 April 2018, 6 days after derailment. Image shows the corrosion differences on the underframe crack fracture surface in platform 2 of 5-pack wagon RRYY01X.

Source: ATSB

Wagon RRYY01X loading

Pacific National documented specific freight loading and marshalling requirements for RRYY class wagons in its train inspection and freight loading manuals. In respect of train 6MP4 on 20–21 April 2018, four platforms of wagon RRYY01X were loaded with one container each. No container was loaded on platform 2 (Table 2).

Table 2: Loading of wagon RRYY01X

Wagon RRYY01X was positioned about 660 m behind the lead locomotive and about 750 m from the end of the train. There was about 1,405 t trailing^[10] wagon RRYY01X.

Train 6MP4 and wagon RRYY01X were loaded in compliance with the Pacific National train inspection and freight loading manuals.

Wagon RRYY01X loading history

The maximum loading for each RRYY class wagon platform was 28 t. A review of the loading records for wagon RRYY01X indicated that platform 2 had exceeded its maximum loading on six occasions between 2005 and 2013. Since 2013, there had been no recorded overloading of this platform.

In summary, although wagon RRYY01X had some history of overloading, there was no recent history to suggest that wagon overloading contributed to its structural failure on 21 April 2018.

Rolling stock maintenance inspections

As per Pacific National Wagon Maintenance Manual (WMM), all standard gauge intermodal and steel wagon maintenance was based on time or kilometres travelled. The inspection frequency and assigned maintenance schedule was also dependant on the type of wagon. However, where a defect was detected by a safety inspection, roll-by inspection^[11] or other means, the wagon could be scheduled for repairs and maintainer inspections outside of the schedule.

For the RRYY class wagons, the maintenance instruction assigned an IM3^[12] maintenance schedule, based on distance travelled (Table 3).

Table 3: IM3 maintenance schedule for RRYY class wagons

The maintenance controls included a visual inspection to manage the risks associated with structural failure of wagons. Visual inspections were applicable during safety inspections and maintainer inspections, which included both scheduled inspections and anticipated inspections when wagons received out-of-course repairs.

Safety inspections

Train examination

The Pacific National Train Inspection Manual (TIM) required that all trains undergo a train examination prior to departing a yard or terminal location. Although, there were some exceptions to this requirement, these were not relevant to the operations related to this accident and wagon RRYY01X. Train examinations were normally conducted by train examination personnel.

Train examinations included inspections and tests on the train’s braking systems and visual inspections of the train’s loading and its rolling stock. The rolling stock inspection component included visual inspection of each wagon in the train in respect to the adjustment, condition and/or security of the wagon body. With potential relevance to this accident, this included structural damage and/or failure of components.

In respect to wagon underframes, the Pacific National TIM provided generic guidance on how to handle any identified longitudinal or transverse cracks in wagon underframes, cracks in component supports or mounting brackets, and cracks in body centre plates. However, there was no specific guidance requiring visual inspections of key structural points of RRYY class wagons, which might be susceptible to cracking.

It was reported by Pacific National train examination staff that the ability to visually inspect all areas during a train examination can be limited due to wagons being loaded, ambient lighting, shadows cast from adjacent wagons, cleanliness of wagons, and other obstructions.

The results of train examinations were required to be recorded within the Pacific National Train Inspection Certificate – Intermodal (TIM 01-04 Appendix B). The certificate related to train 6MP4 was completed on 20 April 2020 at 1240 and did not include any recorded issues related to wagon body inspections.

In the preceding 3-month period, wagon RRYY01X had been used on about 30 intermodal train services and undergone train examinations at Pacific National freight terminals in Melbourne, Adelaide, Perth, and Brisbane. These inspections, involving a wide group of train examination personnel, did not report any structural cracks in wagon RRYY01X.

Roll-by inspection

The Pacific National TIM required that all trains, excluding coal trains, undergo a roll-by inspection when departing or arriving at a yard or terminal location. They were normally conducted by train examiners, but could also be undertaken by other qualified rail safety workers.

Roll-by inspections included visual inspections, and these visual inspections were aimed at detecting air leaks, wheel flat spots, unreleased handbrakes, correct wheel rotation, axle bearing irregularities and dragging equipment, as well as a catch-all requirement to report any other observable defects. Roll-by inspections were generally concluded with a message to the train crew that the train has been inspected and whether it was complete (all wagons attached) or required action.

Although not directly intended as a method to inspect the wagon’s body for cracking, if the structure of the wagon had been compromised, this may be an observable defect during a roll-by inspection. In respect of train 6MP4, there was no evidence available to suggest that a defect had been identified in the roll-by inspection when 6MP4 departed Melbourne Freight Terminal on 20 April 2018.

In addition to arrival and departure from yards and terminals, additional roll-by inspections were also undertaken when a train was en-route. These roll-by inspections were undertaken by train crews of passing trains, incoming/outgoing train crews, and other qualified rail safety workers where applicable. These inspections were intended to observe the general security of loading, overall train integrity, and correct operation of the end of train marker. They were generally concluded with a message to the train crew that the train has been inspected and whether or not it is complete or requires action.

Figure 16: ARTC Adelaide to Melbourne corridor, with 6MP4 roll-by inspection locations

Image shows the location of the roll-by inspections undertaken on 6MP4 on its journey between Melbourne and Mount Lofty, noting roll-by location labels shown in orange.

Source: ARA annotated by the ATSB

Train 6MP4 passed other train services at Tooli Loop, Wingeel, and Deep Lead Loop, Victoria (Figure 16). A roll-by inspection was reported by the departing train crew at Dimboola, and the 6MP4 train crew reported that a roll-by was provided by the station assistant at Tailem Bend, South Australia (Figure 16). There was no evidence to suggest that a defect was identified from these inspections.

Maintainer inspections

Programmed maintenance inspection

The Pacific National Wagon Maintenance Manual (WMM) required that all RRYY class wagons undergo a ‘P’ inspection every 350,000 km with a tolerance of 50,000 km. ‘P’ inspections were also undertaken in combination with ‘A’ and ‘B’ inspections when the wagon had travelled the applicable threshold distances. The inspections were conducted by wagon maintenance personnel.

The wagon ‘P’ inspections included inspections, servicing, adjustments, and measurement/gauge checks of various wagon body, bogie, brake, and coupler components. With potential relevance to this accident, there was a requirement to check the wagon underframe for structural cracks in compliance with a specific Underframes, Body Work and Load Supports procedure.

The Pacific National WMM Underframes, Body Work and Load Supports procedure provided broad generic guidance on what to look for, and where to look, with respect to a typical wagon underframe. The procedure did not specifically guide wagon maintenance staff to key structural points on an RRYY class wagon or emphasise the areas susceptible to cracking.

It was reported by Pacific National wagon maintenance staff that wagons were normally delivered to maintenance facilities empty for the scheduled ‘P’, ‘A’ and ‘B’ inspections. As such, the limitations identified previously for train examiners were usually not a factor (for example, wagon loading, ambient lighting, and other obstructions). However, wagon cleanliness (build-up of grease, dirt or similar) could still limit visual inspections.

In relation to the scheduled maintenance inspections on wagon RRYY01X (Table 4), the last maintenance inspection was recorded as being undertaken on 24 October 2016 at the Perth Freight Terminal. There was no evidence available to suggest that this maintenance inspection identified any structural cracks in wagon RRYY01X. At the time of the accident on 21 April 2018, wagon RRYY01X was nearing the scheduled distance for its next ‘A’ Maintainer Inspection.

Table 4: Scheduled inspections of RRYY01X for previous 7 years

The maintenance personnel conducting maintainer inspections were required to report any significant structural cracks or hairline cracks in inaccessible locations to their maintenance manager, with the provision for minor hairline cracks to be gouged and welded on site.

Pacific National maintenance and engineering representatives advised that they had no recollection of reports or observations about any significant structural cracking on RRYY wagons in the area where wagon RRYY01X had failed.

A review of previous ATSB investigation reports and available notifiable occurrence records did not identify any previous structural failures of RRYY class wagons.

Out-of-course maintenance inspection

Out-of-course maintenance inspection relates to ad-hoc maintainer visual inspections outside of the scheduled maintenance cycle. For example, Pacific National maintenance and engineering representatives advised of an expectation that a maintainer visual inspection would occur prior to the release of a repaired wagon. These ad-hoc maintainer visual inspections were also guided by the Pacific National WMM Underframes, Body Work and Load Supports procedure.

Wagon RRYY01X had been submitted for repair about 24 times since the last scheduled inspection (24 October 2016), with three of these within 3 months of the accident (Table 5). None of the repairs were specifically related to underframe cracking, and six instances were simply identified as ‘vehicle inspection’ (Table 5). There was no evidence available to suggest that any of these vehicle inspections, or maintainer repair opportunities, had identified any structural cracks in wagon RRYY01X.

Table 5: Out-of-course vehicle inspections of RRYY01X since scheduled inspection including out-of-course repairs undertaken in the 3 months prior to the accident

Personnel information

Pacific National had documented its competence requirements for its rolling stock maintainers, train examination staff and train crew. The Pacific National personnel involved in the operation and pre-departure train examination of 6MP4, as well as the maintainers who had undertaken the last scheduled ‘P’ Maintainer Inspection, held current competencies for their tasks.

Post-accident RRYY fleet inspections

After the accident, Pacific National published and distributed a Rolling Stock Notice^[15] to its terminal managers, maintenance planners, maintainers, train examiners and engineering representatives. The notice identified the location where the structural cracks within wagon RRYY01X had commenced and focussed post-accident inspections onto these specific stress areas of Pacific National’s RRYY class wagon fleet.

Staff in Adelaide, Melbourne, Perth, Sydney and Brisbane inspected the RRYY class fleet. Focussing on the structural areas specified within the Rolling Stock Notice, over half of the remaining 50 RRYY class wagon fleet were found to exhibit cracks of varying lengths.

Pacific National train examination, maintenance, and engineering representatives advised the ATSB that the extent of structural cracking on RRYY class wagons had not been observed previously. As a precaution, Pacific National ‘red carded’^[16] the cracked RRYY class wagons until a long-term solution was formulated.

__________

7. Standing room: the distance along the track between points of minimum allowable clearance where rolling stock is permitted to stand.
8. Stopping brake: braking equipment used for stopping a train in running.
9. Sanding is used in train operations to improve adhesion or traction in both braking and traction.
10. Train weight located behind all platforms in wagon RRYY01X.
11. Roll-by inspection: a visual inspection of a train to identify equipment, loading, security or other defects or failure whilst the train is moving.
12. IM3 is a Pacific National maintenance code specifying the distance to be travelled between scheduled maintenance inspections. In the case of IM3, maintenance inspections are scheduled every 350,000 km.
13. Full train examination (FX): performed by examining staff after final marshalling of non-tested loading, prior to commencement of journey consisting of full mechanical examination; complete air brake test; brake pipe leakage test; and issue of train examiners’ certificate for interstate freight trains.
14. General train examination (GX): an examination conducted by appropriately qualified employees (normally locomotive drivers) at those times and locations where other staff qualified to conduct an FX inspection are not available.
15. Ad-hoc Pacific National instruction to staff relating to rolling stock.
16. Defect card: a red card is placed in the waybill clip of a wagon to notify all concerned that that particular vehicle is NOT fit for traffic and must be repaired prior to returning to traffic.

Safety analysis

Structural failure

During freight train 6MP4’s descent from Mount Lofty, there was a structural failure in platform 2 of wagon RRYY01X. This resulted in one of the axles of the bogey between platform 2 and platform 3 derailing, and ultimately the train parting between these two platforms.

Post-accident observations found a crack in the underframe of platform 2 had propagated over time, most likely in the weeks and months prior to the derailment. The steep climb up to Mount Lofty under maximum tractive effort would have placed significant longitudinal tension through the wagon structure. This would have the effect of opening and encouraging growth of any pre-existing crack in the wagon underframe.

Mount Lofty is located at the top of a cresting grade. As a train passes over a cresting grade, the weight and resistance of the train’s rear portion still on the ascending grade is opposed by the combined tractive effort and weight of the front portion of train now on the descending grade. If a train is not handled appropriately, these conditions can cause in-train forces to exceed coupler strength with subsequent failure resulting in a train separation at the crest. In this case, the driver handled train 6MP4 appropriately. However, it is likely that the weakened structure of RRYY01X-platform 2 was unable to accommodate the high in-train forces, causing the underframe to fail and the crack to open significantly.

For the RRYY class wagon, the junction of the wagon’s bottom centre sill plate with the container loading outrigger included a pull-rod boxed opening within the outrigger (Figure 13). The loading and unloading of containers on the RRYY class wagons, accompanied by dynamic loading during normal operations, likely exposed this junction to cyclic strain and, as such, it would be susceptible to fatigue.

In support of this, the specific stress areas of the RRYY class wagon fleet that were a feature of this accident were, post-accident, inspected by Pacific National. These inspections identified that over half of the RRYY class wagon fleet were exhibiting cracks of varying lengths in the same areas.

Derailment

Failure of the underframe caused the deck of platform 2 to bend, changing the deck angle at the coupling to platform 3 (supported over a common bogie). Variations to drawbar or coupling angle, combined with large compressive longitudinal forces, are known to cause wheel unloading on empty wagons.^[17]

In addition, high compressive longitudinal forces are known to increase lateral forces towards the outside of tight curves. For example, Pacific National’s train handling standard (PN-STD-SAF - Train Handling) noted the increased potential for derailment when under concentrated compressive force:

The presence of light wagons in the consist, or long wagons coupled to short wagons, or a coupler misalignment will increase the possibility of derailment.

As train 6MP4 negotiated a series of tight curves, the combination of wheel unloading (due to compressive forces and coupling angle on a light wagon) with increased lateral forces (due to compressive forces and a tight curve) resulted in flange climb (possibly complete wheel lift) and subsequent derailment.

Ultimately, the bogie re-railed about 5.5 km after it derailed. However, during this period, the derailed bogie had caused minor damage to rail lubricators, sleepers and points turnout components. In addition, the consequences could have been more serious if more bogies had derailed.

Rolling stock inspections

Pacific National had an established process of visual inspections for its rolling stock, including among other purposes, identifying cracks in wagons. These visual inspections were required to be undertaken within programmed and out-of-course maintenance inspections by maintenance staff, as well as within terminal arrival and departure train safety inspections by train examination staff.

A number of inspections were undertaken during the time that the crack likely existed in the underframe of wagon RRYY01X. More specifically:

• In the 3 months prior to the derailment there had been one out-of-course maintenance inspection recorded on 29 January 2018, as well as two other out-of-course maintenance repairs on 12 February 2018 and 16 April 2018.
• Wagon RRYY01X had performed about 30 train services, including train 6MP4, in the 3 months prior to the derailment. This involved train safety inspections from a wide group of train examination personnel at Pacific National Terminals in Melbourne, Brisbane, Adelaide and Perth.

There was no evidence that these inspections had identified any cracks in wagon RRYY01X. Similarly, it was evident that previous maintenance inspections had not detected cracks of varying lengths in more than half the 50 RRYY class wagon fleet.

Requirements and guidance for rolling stock inspections

As already noted, post-accident examinations found over half the RRYY class wagon fleet exhibited cracks in the junction of the bottom centre sill plate and the container loading outrigger. This junction was likely exposed to cyclic strain and fatigue, due to loading and unloading of containers and dynamic loading during normal operations. Although this was potentially predictable, it had not been considered and identified as a focus point for inspections by Pacific National.

Further to this, the Pacific National WMM Underframes, Body Work and Load Supports procedure provided broad generic guidance to wagon maintenance staff about what to look for and where to look, with respect to a typical wagon underframe. However, this procedure was generic and did not guide visual inspections to key structural points of an RRYY class wagon that had a reasonably predictable susceptibility to cracking.

Additionally, the Pacific National Train Inspection Manual provided generic guidance to train examination staff on how to handle any identified longitudinal or transverse cracks in wagon underframes, cracks in component supports or mounting brackets, and body centre plates. Similarly, this information also did not provide specific guidance on where to focus visual inspections with respect to key structural points of an RRYY class wagon that had a predictable susceptibility to cracking.

A large number of factors can influence visual inspection performance, such as the nature and salience of the defect, the use of inspection aids, environmental factors, duration of tasks and training and experience (See, 2012). Research across a number of visual search tasks has shown that experts are better than novices because they know from experience the most likely locations that relevant targets (or defects or hazards) are most likely to be located (Wickens and others, 2015). Accordingly, providing inspectors with information about locations most likely to contain defects (of feedforward information) improves defect detection performance.

In this case, Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This probably reduced the likelihood of the crack in wagon RRYY01X being detected prior to the accident.

Train separation and subsequent braking

Wagon RRYY01X uncoupled between platforms 2 and 3, resulting in the subsequent separation of the train’s brake air pipe, which exhausted the brake pipe air to the atmosphere. It was evident that the brake pipe had broken cleanly, allowing for unrestricted exhausting of brake pipe air.

Although air was exhausting from the front portion of the train via the separated brake pipe (wagon RRYY01X), it is likely the air production from the three locomotive compressors was sufficient to maintain the train’s brake pipe at a pressure high enough to inhibit the locomotives’ emergency braking system response. This effect meant that, although the wagon brakes on the front portion of the train applied, the locomotives continued to pump air into the broken brake pipe instead of exhausting the remaining brake pipe pressure. Overall, the brakes on the front portion did not slow the train at the emergency rate. The front portion of the train came to a stop about 450 m ahead of the rear portion.

The absence of the locomotives’ emergency braking systems was not contributory to the derailment, and did not increase risk associated with this accident. However, the automatic activation of the locomotives’ brakes at the emergency rate is a requirement of the Australian Standard and failure to do so may increase risk in different circumstances.

__________

17. Refer to ATSB investigation report 2004008, Derailment of Pacific National Train 7MP5, Glenalta, South Australia, 21 November 2004.

Findings

From the evidence available, the following findings are made with respect to the derailment of train 6MP4 near Glenalta, South Australia, on 21 April 2018.

Contributing factors

• A fatigue crack initiated in the bottom centre sill plate of wagon RRYY01X’s platform 2 underframe, which led to structural failure of the wagon and subsequent derailment of train 6MP4.
• Multiple train examinations and maintenance inspections undertaken on wagon RRYY01X did not identify the crack in the wagon’s underframe.
• Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of cracks being detected. (Safety issue)

Other factors that increased risk

• The train’s brake pipe between platforms 2 and 3 was broken when wagon RRYY01X separated. Although this allowed air to exhaust from the brake pipe, enabling the train brakes on the wagons to bring the front and rear portions of the train to a stop, this loss of air on the front portion of the train did not activate the emergency braking system response of the locomotives.

Safety issues and actions

Inspection processes

Safety issue number: RO-2018-009-SI-01

Safety issue description: Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of cracks being detected.

Safety action not associated with an identified safety issue

Additional safety action by Pacific National

Pacific National advised that all new wagons and locomotives procured by Pacific National will meet the Australian Standard AS7510.6 for braking systems.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Pacific National
• the Australia Rail Track Corporation (ARTC)
• the Office of the National Rail Safety Regulator (ONRSR)
• the train crew of train 6MP4
• Pacific National examination, maintenance and engineering personnel.

References

Pacific National, Train Inspection Manual, as current 21 April 2018.

Pacific National, Wagon Maintenance Manual, as current 21 April 2018.

Pacific National, Freight Loading Manual, as current 21 April 2018.

Pacific National, Train Handling Standard (PN-STD-SAF), version 5.0 issued 22 May 2017.

Rail Industry Safety and Standards Board (RISSB) AS7510.6:2014, Braking Systems – Part 6 – Train.

See JE 2012, Visual inspection: A review of the literature, Sandia Report SAND2012-8590, Sandia National Laboratories.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Pacific National
• the Australian Rail Track Corporation (ARTC)
• the Office of the National Rail Safety Regulator (ONRSR)
• the train crew of train 6MP4
• selected Pacific National examination, maintenance and engineering personnel.

Submissions were received from:

• Pacific National
• the Office of the National Rail Safety Regulator (ONRSR).

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 24 February 2018, the yacht Finistere capsized south of Perth, Western Australia, with the loss of two lives.

The Western Australian Department of Transport (WA-DoT) is responsible for investigating this accident. As part of its investigation, WA-DoT requested technical assistance from the Australian Transport Safety Bureau (ATSB), involving the examination of an electronic device.

To protect the information supplied by WA-DoT to the ATSB, as well as the ATSB’s investigative work to assist WA-DoT, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003.

The ATSB completed its technical assistance and provided a report to the WA-DoT. Any enquires in relation to the accident investigation should be directed to WA-DoT at marine.investigations@transport.wa.gov.au

Safety summary

What happened

On 17 April 2018, the pilot of a Garlick Helicopters UH-1H, registered VH-HUE, was conducting long-line lifting operations near Talbingo in the Snowy Mountains region of New South Wales. While on approach to pick-up a load, the helicopter’s engine failed. During the subsequent forced landing, the helicopter collided with trees and a riverbed. The pilot sustained serious injuries and the helicopter was destroyed.

What the ATSB found

The ATSB found that the inner struts in the exhaust diffuser fractured leading to the engine failure. The fracture was the result of high-cycle metal fatigue, which had not been detected for at least 36 routine maintenance inspections prior to the accident. It was also established that the maintenance practices and processes were likely inadequate to detect the potential impending failure of safety critical components. These practices related to inspections, record keeping and trend monitoring.

Following the engine failure, the pilot had limited assurance that ground support personnel could vacate the clearing directly below the helicopter, necessitating a forced landing to a less suitable location. This was likely the result of a risk assessment for helicopter operations that did not consider the hazard of an emergency landing as the helicopter approached to hook-up a load.

The pilot was not wearing the upper torso restraint fitted to the helicopter during the flight. It was virtually certain that this resulted in the pilot sustaining serious head injuries when the aircraft collided with terrain. It was also identified that upper torso restraints were likely not routinely worn by a notable proportion of pilots conducting vertical reference flying operations in Australia. This was likely due to these restraints not being fit-for-purpose for the operations being conducted. The operations mainly related to aerial firefighting, and to a lesser extent, lifting operations.

Although not contributory, the ATSB also found that a screw-clamp was retrofitted to the firefighting retardant delivery hose, which likely prevented the release of the long-line during the forced landing. While this did not influence the outcome of the accident, this had the potential of becoming snagged in trees and increase the severity of the impact. 

Further, the immediate response of the ground personnel to extinguish a small fire in the engine bay and assist the pilot with exiting the helicopter, likely reduced the risk of more severe injuries to the pilot.

What has been done as a result

Following the accident, the maintenance organisation was acquired by another company. They advised improvements were made to their maintenance procedures and processes. Those improvements included the implementation of a new computer-based maintenance system that was expected to provide greater assurance in maintenance performed and assist with trend monitoring for detecting anomalies. Further, vibration test equipment was purchased to allow greater ease in conducting required checks.

In addition, the company responsible for managing the site ground works convened a hazard assessment workshop with the helicopter operators where they reviewed the hazards and controls for mountain flying and lifting operations. This was to ensure alignment, and a common approach and understanding between all parties. A risk management plan was collated during this workshop for use in similar future operations.

Safety message

Purposeful visual inspections of safety critical components, and the routine review of documented maintenance records for trend monitoring and anomaly detection purposes provide a vital role in preventative aircraft maintenance. These aspects would have likely allowed anomalies to be identified and investigated prior to the engine failure occurring.

Helicopter lifting operations introduce additional risks to personnel working in their vicinity. In circumstances where there may be insufficient time to formulate a plan, such as an emergency landing from a low height and low speed, carefully considered and clearly communicated pre‑flight risk assessments provide an important mechanism to mitigate these risks.

Upper torso restraints provide an important defence to reduce the severity of injuries during an accident. This report highlights an elevated risk to pilots who are unable to effectively wear these restraints during some vertical reference operations, such as aerial firefighting and lifting. Further consideration of engineering innovations for these restraints could reduce the risk associated with this problem.

The occurrence

Preparation for lifting operations

On 17 April 2018, the pilot of a Garlick Helicopters UH-1H, registered VH-HUE (HUE), was to be conducting long-line lifting operations near Talbingo in the Snowy Mountains region of New South Wales. In the morning, the helicopter was prepared for flight at Tumut Airport, about 60 km north of the planned area of operation. Flight preparations involved a discussion between the pilot^[1] and a contracted licenced aircraft maintenance engineer about the maintenance performed since the pilot had last flown the previous day. The pilot conducted a walk-around inspection of the helicopter, signed the maintenance release and conducted an engine run. Nothing abnormal was noted by the pilot or licenced aircraft maintenance engineer.

The helicopter departed Tumut Airport at about 0804 Eastern Standard Time,^[2] for a positioning flight to a clearing 57 km south of Tumut, known as Lobs Hole, arriving at about 0837 (Figure 1). This location was used as the base of operations for the lifting work on the day, referred to as the ‘laydown area’. The operation was part of a proposed expansion of the Snowy Mountains Hydro‑electric Scheme, known as the Snowy 2.0 project. The planned work on the day involved using helicopters to relocate components of a de-constructed drill-rig used for geotechnical survey within the ‘area of operation’ shown in Figure 1.

Figure 1: Map showing morning repositioning flight and area of lifting operation

Source: Google Earth, annotated by the ATSB

The lifting operation involved HUE and two AS350 ‘Squirrel’ helicopters. HUE was to be utilised for heavier loads, and the Squirrels to be utilised for the lighter loads. Supporting the lifting operation on the ground at the drill site (location of the load hook-up) were two loadmasters, who had radio communications with the pilots. Three additional workers were also assisting with drill rig de-construction. Although these workers were not involved in the lifting operation, they remained at the drill site during lifting.

Conduct of lifting operations

Lifting operations involving HUE commenced at 1308. Each run involved lifting drill-rig components from the drill site to the laydown area, before returning for the next lift. Each lift run, and return, was completed in about 5 minutes, with ground personnel preparing the next load between lifts. HUE had completed 11 lift runs (Figure 2), which the pilot reported were ‘uneventful’. At about 1414, the pilot positioned HUE for the twelfth run (Figure 2 red flight path), in order to lift the drill rig motor.  
As the helicopter approached for the twelfth lift, one of the loadmasters advised the pilot that more time was required to prepare the rigging and requested the pilot hold off for a short time. HUE entered a holding circuit about 700 m to the north-east prior to making a very slow approach toward the drill site (Figure 2 red flight path). The pilot recalled that the weather conditions were ideal, with a slight breeze and good visibility.

Figure 2: Map of lifting runs conducted

Source: Google Earth, annotated by the ATSB

While waiting for a radio clearance to lift the drill rig motor, the pilot recalled conducting a full system check, and that all instruments indicated the helicopter was operating in the normal range. At about 1415, the loadmaster requested the pilot approach the site in preparation for lifting the drill rig motor. As HUE approached overhead, the loadmaster informed the pilot that the rigging required re-checking. In order to minimise the rotor downwash on the people below, the pilot raised the collective to climb the helicopter, and the 100-foot long-line, above the tree canopy.

Engine failure and forced landing

At about 1417, as the helicopter started to climb, the pilot heard a loud mechanical ‘screaming’ noise and started planning for a forced landing. Witnesses also reported seeing ‘smoke’ and some advised they heard a ‘bang’ at about the same time. Almost immediately, the pilot also heard an audible alarm, followed by a noticeable yaw and engine power loss. Time-lapse images from a camera mounted at the drill site showed a light-coloured gas or mist near the engine area of the helicopter (Figure 3).

Just prior to the engine failure, HUE was about 200 to 250 ft above ground level, with a forward airspeed of about 20 to 25 kt, based on global positioning system (GPS) data, eye-witness reports, and the pilot reporting flying into a slight headwind. From fuel-burn calculations by the ATSB, the weight of HUE was estimated at 2,900 kg at that time.

Figure 3: Light coloured gas or mist from the helicopter above the drill site

Source: GHD, annotated by the ATSB

The pilot broadcast a ‘Mayday’^[3] call and attempted to conduct the forced landing (autorotation) into the Yarrangobilly riverbed, south-west of the lifting area and the ground personnel. The workers observed the helicopter being turned to the south-west, away from the drill site.^[4] They described the helicopter as appearing to ‘float’ over the trees, before descending quickly. Around this time, the pilot commanded jettison of the long-line and lifting strops. At interview, the pilot advised that the helicopter was flared prior to the impact with the second tree, but could not recall the remainder of the impact sequence until exiting the helicopter. The helicopter subsequently collided with trees and the riverbed (Figures 4 and 5). Ground personnel from the drill site immediately responded to the accident with fire extinguishers. They extinguished a small fire in the engine bay, removed the pilot from the wreckage, and performed first aid until emergency services arrived at 1520. The pilot sustained serious injuries and the helicopter was destroyed.

Figure 4: Forced landing flightpath showing drill site and helicopter wreckage

Source: New South Wales Rural Fire Service, annotated by the ATSB

__________

1. The pilot was also the owner and operator of VH-HUE and is referred to hereafter as ‘the pilot’.
2. Australian eastern standard time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
4. The drill site was a cleared area that included a helipad, and the drill rig to be lifted (at the lifting location).

Context

Pilot information

The pilot held a Commercial Pilot Licence (Helicopter) and current Class 1 Aviation Medical Certificate. In addition, the pilot held a low-level operational rating, with endorsements for helicopter sling-load. The pilot had accumulated more than 9,000 hours total aeronautical experience, predominantly in helicopters. In the previous 30 and 90 days, the pilot had flown 43.4 and 154 hours respectively. The pilot reported being well rested for the day of the accident.

Meteorological information

The meteorological conditions from witness reports and drill site time-lapse camera footage throughout the period of lifting operations indicated clear sky and light winds. The wind conditions recorded by a Bureau of Meteorology automatic weather station about 45 minutes after the accident at Cabramurra (18 km away), were 11 km/h (6 kt) from the west, consistent with reports from the accident pilot.

Helicopter information

General

The UH-1H helicopter was developed by Bell Helicopters as a military utility helicopter for the United States (US) Army. The accident helicopter was manufactured in 1965. The helicopter had a two-blade main rotor and two-blade tail rotor and was powered by a military variant of the Honeywell Aerospace (formally Lycoming Engines) T53-L-13B turboshaft engine. Several organisations were authorised by the US Federal Aviation Administration (FAA) to convert surplus US military helicopters for civilian operations. Garlick Helicopters Inc. was the holder of the type certificate for this helicopter, which was US-registered as N2220Y, when it entered civilian operations.

VH-HUE (HUE) was first registered in Australia in December 2002 and was operated by one owner, until it was purchased by the current owner in January 2011. At entry in Australia, HUE had accumulated 8,017.3 hours and had ‘no record of accident’. In 2006, HUE was transferred to the restricted ‘special purpose’ category, due to the limited ongoing maintenance technical support. This category included agricultural operations, forest and wildlife conservation, and firefighting, and only persons who were ‘directly associated with the special purpose’ could be carried. HUE was issued with a special certificate of airworthiness^[5] in July 2008.

Weight and balance

The ATSB calculated that HUE was very likely below the maximum take-off weight and within centre of gravity limits for all flights on the day of the accident. This included the 11 previous lift runs. Furthermore, fuel-burn calculations and the presence of a considerable amount of fuel at the accident site indicated there was sufficient fuel on board, about 270 kg, to conduct the lifting operations at the time of the accident.

Continued airworthiness

The logbook statement for HUE indicated that it was to be maintained in accordance with the Garlick Helicopters Inc. Instructions for Continued Airworthiness (ICA) Report GH-H13WE-CA1H. which stated:

FAA [Federal Aviation Administration] type certified civil engines and FAA approved civil appliances…must be serviced, maintained, inspected, and repaired in accordance with the applicable manufacturer’s maintenance manuals, or manufacturer’s Instructions for Continued Airworthiness or this TC Holder’s Instructions for Continued Airworthiness.

Therefore, HUE’s engine was to be maintained as per the US Army technical publications.

Wreckage and impact information

Examination of the trees on the side of the river opposite to the drill site revealed multiple broken branches resulting from the tips of the main rotor blades. Based on the path of broken branches and witness accounts, the helicopter’s descent path from this point became much steeper. The helicopter descended with the main rotor blades striking tree branches to the right of the helicopter prior to striking and severing a tree (the main impact tree) about 11 m up from its base, and 30 m from the initial tree strike. Audio analysis by the ATSB of the tree strikes from the phone of an eye‑witness was used to calculate a mean groundspeed of 45 kt, and vertical speed of about 2,000 feet per minute during this phase of flight. The flight path suggested that the pilot probably maintained control of the helicopter until one of the main rotor blades broke apart from impacting the tree.

Examination of the wreckage and ground impact marks indicated that the helicopter had impacted the ground in a nose high, slightly right side down attitude. The tail boom of the helicopter struck the ground during the impact, detaching from the fuselage. The landing gear assembly showed evidence of deflection during the main impact of the fuselage with the ground. The helicopter likely bounced off the skids, leading to the fuselage coming to rest in a nose low, slightly inverted position (Figure 5).  

Figure 5: Helicopter wreckage showing nose of helicopter in Yarrangobilly River

Note: Wreckage of VH-HUE looking upstream toward the drill site, showing the nose of the helicopter and pilot’s seat. 
Source: ATSB

For the lifting operations on the day of the accident, a 100 ft/30 m long-line was being used, with lifting strops attached at the remote hook. The site and wreckage examination revealed that, during the accident sequence, the long-line had detached from the belly hook, and the strops had released from the remote hook. This indicated that the long-line and strops were likely jettisoned during the accident sequence, as per emergency procedures. Although the pilot could not recall jettisoning the load, photographs confirmed that both the long-line and strops were attached to these hooks prior to the emergency, and the long-line did not appear to have snagged on any trees during the accident sequence. However, the long-line remained tethered to the fuselage due to the Sacksafoam hose line, which had failed to separate (refer to section titled Retention of the long-line) (Figure 6).

Figure 6: Failed to detach long line

Source: ATSB

During the examination of the wreckage, the ATSB identified cracking and material loss visible in the exhaust diffuser area (Figure 7 and Figure 8). In addition, the exhaust diffuser cover attachment bolt was not lock-wired, as required by the US Army maintenance manual applicable to HUE (Figure 8). Examination of the engine, including the exhaust diffuser assembly is discussed in the next section.

Figure 7: Visible cracking in the exhaust diffuser area

Source: ATSB

Figure 8: Diffuser area, unsecured cover plate, cracking and missing material

Source: ATSB

Engine examination and maintenance

Examination

Exhaust diffuser strut cracking

The engine was shipped to Honeywell’s facilities in Phoenix, Arizona, in the US and underwent a teardown examination under the supervision of a representative from the US National Transportation Safety Board. The purpose of the examination was to identify the technical failure mechanism, or mechanisms of the engine failure. This included a detailed examination of the exhaust diffuser assembly illustrated in Figure 9.

Figure 9: Exhaust diffuser assembly schematic and photograph (inset)

Source: Honeywell, modified by the ATSB

The Honeywell engine teardown identified extensive fatigue cracking in the exhaust diffuser inner struts (Figure 10 inset). The inner struts were a critical engine component that supported the rear of the power turbine assembly through the number 3 and number 4 bearings (Figure 10). Note for reference that Figure 10 (inset) shows missing material in the exhaust diffuser inner cone also shown in Figure 8. Honeywell identified the location of the cracking for each of the four inner struts:

• two of the four inner struts were separated around the full circumference of the inner strut flange welds
• another strut exhibited cracking around most of the circumference of the inner strut flange welds, although the inner strut remained attached to the inner cone by a small welded section
• one strut was separated through the strut with no visible weld separations.

The analysis by Honeywell determined that the cracking in the inner struts resulted in the complete loss of structural integrity of the four struts. This led to the power turbine assembly moving rearward, indicated by the arrow labelled ‘direction of PT movement’ in Figure 10. The rearward movement was sufficient for the rear tapered section of the power turbine drive shaft (labelled ‘PT drive shaft rear taper’) to contact the adjacent rear shaft of the compressor assembly, highlighted in blue. Due to the compressor and turbine assemblies rotating in opposite directions, the contact resulted in considerable friction, and deformation of the rear compressor shaft. This led to the compressor assembly contacting the walls of the engine case.

Figure 10: Illustration of T53 engine and exhaust diffuser inner cone (inset)

Source: Honeywell, modified by the ATSB

Considering the contact between the tapered section of the drive shaft and the compressor assembly, Honeywell reported that, ‘by design, this was the most critical section for inter-shaft clearance of the counter-rotating components. Rapid frictional heating is imminent once the rub condition is established. All damage, therefore, is considered secondary to the fatigue cracking of the exhaust diffuser struts’.

High-cycle fatigue

Regarding the material analysis of the exhaust diffuser housing, Honeywell identified that:

• the cracking in the strut/inner cone weld joints resulted from high-cycle fatigue emanating from multiple initiation sites along the inner edge of the weld bead, which was likely driven by power turbine vibration
• no material anomalies were observed
• the chemistry of the exhaust diffuser housing was indicative of the manufacturer’s specified material
• the measured hardness of the strut, inner cone, and weld bead indicated that the assembly was heat treated subsequent to welding, as specified.

Honeywell reported that ‘the exact initiation locations [of the fatigue cracks] were unable to be determined due to secondary smearing damage’. Further, due to the post-accident damage to the engine and airframe structure, the ATSB concurred that it was not possible to determine the source of the power turbine vibration.

Visible indications of cracking

Honeywell advised that they have had some previous experience with cracking on exhaust diffuser assemblies. Specifically, they indicated that:

Empirical evidence suggests that the cracking develops and propagates over a considerable period of time, i.e. hundreds of operational hours. Therefore, it is believed that the exhaust diffuser cracking and material loss from the inner cone would have been visible during the most recent Phase Inspection performed 20.8 hours before the accident. Visual indications of cracking were likely present during the preceding phase inspection(s) as well. An investigation to assess and rectify the exhaust diffuser cracking would have necessitated the removal from service of the exhaust diffuser.

This indicated that cracking and missing material on the inner cone of the exhaust diffuser, as observed by the ATSB after the accident, was likely visible during maintenance inspections prior to the accident. Further, Honeywell stated:

During the previous 40 years, this is only the third reported incident of exhaust diffuser strut cracking that developed sufficiently to cause an engine malfunction in Honeywell’s experience with the T53 series engine. Typical experience for the T53 is that removal of the exhaust diffuser for observed cracking will necessitate off-engine inspections and repairs to the inner struts, as required.

This indicated an expectation that if the visible cracking in the exhaust diffuser was identified, removal of the exhaust diffuser would be required. Subsequent inspections would have led to the identification of the cracking in the inner struts.

Maintenance arrangements for VH-HUE

HUE had been maintained by Encore Aviation (Encore) since March 2016. Encore was a CASA‑authorised maintenance organisation established in 2002 and provided maintenance to a variety of fixed and rotary-wing aircraft. Encore incorporated another maintenance organisation in 2017. The chief engineer of Encore at the time of the accident was from the organisation prior to incorporation. Encore was then acquired by another company in March 2019 (1 year after the accident). The role of chief engineer changed to another person at about this time, due to retirement.

Field maintenance

The services provided for HUE included field maintenance, when requested by the operator. The chief engineer at the time of the accident advised that, when a licenced aircraft maintenance engineer (LAME) was providing field maintenance for HUE, the LAME would perform the daily inspection. This arrangement was intended to relieve a pilot of extended duty, outside of their flying requirements.

With respect to daily maintenance performed by the pilot, the pilot reported doing ‘fuel and oils, so walk around doing all the inspections…normal stuff…but I don’t actually do any maintenance because I travel everywhere with an engineer [LAME]’. This included the expectation by the pilot that the daily inspection, which included the requirement for an inspection of the exhaust diffuser housing, was conducted by the LAME. The LAME who provided field support for HUE reported that ‘they generally completed the greasing requirements’^[6] and the pilot conducted the daily inspection. This LAME also advised that they had carried out a daily inspection on occasion, when specifically requested by the pilot. A review of records identified the LAME’s signature on a maintenance release daily inspection for HUE, dated in November 2017. The pilot reported that the LAME had conducted a compressor wash and greasing prior to the flight on the morning of the accident.

Phase inspections

The two most recent phase inspections, in January and April 2018, were conducted in the hangar by different LAMEs at Encore. The chief engineer reported that HUE was maintained in accordance with the US Army technical publication requirements, which were last updated in 2010.

Exhaust diffuser inspections

Inspection requirements

The tailpipe and exhaust diffuser could be readily accessed via a ladder (Figure 11). Inspection of this area was typically carried out with the aid of a bright torch and mirror. A borescope could also be utilised if closer inspection was warranted.

Figure 11: Typical exhaust, showing accessibility for inspection

Source: Honeywell

The US Army technical publications included the following inspection requirements for the exhaust area, including the diffuser (Table 1).

Table 1: US Army exhaust area inspection requirements

Recent exhaust diffuser inspection opportunities

In consideration of Honeywell’s comment that the exhaust diffuser cracking was likely visible at the previous two ‘phase inspections’, the ATSB examined the potential opportunities for detection. In 2018, HUE underwent phase inspections on 11 January and 1 April. Following each of these inspections, a new maintenance release was issued. From 11 January 2018 to the accident flight, a review of the maintenance release records showed 34 daily inspections, certified by four different people. It was permissible for these certifications to be made by the pilot in command, another pilot licenced to fly the helicopter or an appropriately qualified LAME. In addition to the pre-flight and phased maintenance inspections, maintenance records indicated another eight separate maintenance visits to the maintainer had occurred in the 4 months prior to the accident. The helicopter had accumulated 171 flight hours in this period.

Vibration checks

Rotating components, in the airframe and engine, are the primary source of vibration in helicopters. Maintaining vibration levels within manufacturer-specified limits is essential in enabling components to be functional for their projected life limit. If excessive vibration continues over time, the wear on components will increase exponentially to the point of failure. In addition, this vibration can affect the fatigue life of stationary components.

US Army vibration requirements applicable to HUE

The US Army engine maintenance manual required an engine vibration test be conducted following certain maintenance actions, including: 

• any maintenance that required removal and reinstallation of an engine for any reason
• when excessive engine vibration was suspected
• when more than 20 per cent of the total number of compressor blades were repaired to maximum limits.

Vibrations levels at specified engine revolutions per minute (RPMs) were to be recorded on the US Army Engine Vibration Test Data Sheet (vibration data sheet) applicable to the helicopter. The data sheet also detailed the maximum permissible vibration for each parameter. For HUE, a maximum vibration level of 2.5 inches per second applied to the majority of the tested parameters.

Maintenance records on vibration checks

Encore advised that, up to the time of the accident, they did not use the US Army vibration data sheet or keep physical records of vibration test data. Instead, they relied on the vibration test equipment internal memory storage for maintaining a record of the test results. However, during the investigation, Encore reported that their equipment suffered a major failure that required its return to the manufacturer for repair, resulting in a loss of all the stored data.

A review of the maintenance records identified that the engine had been removed from the helicopter for repairs from foreign object damage and re-installed on 12 November 2016, 417 hours prior to the accident. A vibration check had been conducted at that time. The certification indicated the vibration was ‘within limits’, however, no vibration data had been recorded. In addition, associated maintenance worksheets were not available as Encore did not retain these records beyond 24 months.^[7] In accordance with the US Army engine maintenance manual, a re‑check of the vibration was required at 500 and 1,000 hours’ time-in-service. However, the engine had not accumulated 500 hours prior to the accident.

The engine logbook indicated that, on 1 April 2018, the top axial compressor half had been removed from the engine to repair minor foreign object damage to multiple compressor rotor blades. This was recorded as having been conducted in accordance with the US Army maintenance manual. However, there was insufficient information recorded by maintainers in HUE’s maintenance records to determine if a vibration check was required in this instance. Specifically, it was unclear if more than 20 per cent of blades required repair to maximum limits, which would have triggered the US Army requirement for a vibration test. Regardless, the engine logbook did not include any indication that a vibration check had been carried out.

Guidance for record keeping and trend monitoring

Trend monitoring in this investigation refers to the process of evaluating historical data to identify anomalies that may indicate an emerging technical failure of the engine. This process is generally considered to be in-line with industry best practice as a method to identify underlying problems before a safety incident occurs, such as the engine failure of HUE. This is supported by guidance produced by Civil Aviation Advisory Publication 30-04 Certificates of approval – Maintenance organisations, which set out the procedures that CASA would expect an authorised maintenance provider to have in place ‘to ensure that aviation safety is not compromised’. This publication stated that, part of an organisation’s quality system should detail ‘procedures for monitoring the other quality indicators such as facility malfunction reports, incidents, occurrences, maintenance errors, complaints and defects’.

The US Army engine maintenance manual, Section 1-73 General troubleshooting, provided a general statement with respect to identifying the source of failures, referred to as ‘general troubleshooting’, stating:

It is essential to have a thorough knowledge of specified fuel flow, oil pressure, exhaust gas temperature and other important specifications of normal engine operation to discover troubles. Having a record of prior trouble and work performed is essential when troubleshooting.

Although this advice did not specify requirements for vibration trend monitoring, it noted the general importance of recording prior work and ‘trouble’ encountered. In summary, these documents present ‘defect reporting’ and ‘record keeping’ as important sources of information for the effective management of continued airworthiness.

Review of Encore Aviation maintenance practices

VH-HUE replacement of engine related components

HUE’s maintenance records indicated that the power turbine (N2) tachometer generator^[8] had been replaced four times: 29 August 2017 (10,060.0 aircraft hours), 27 November 2017 (10,146.4 hours), 11 January 2018 (10,200.3 hours) and 16 January 2018 (10,204.9 hours). The records did not detail the exact nature of each unserviceability. On 1 March 2018 (10,304.3 hours) the drive assembly for the tachometer generator was replaced, recorded in the maintenance logs as ‘suspect’. Again, there was no indication that further evaluation, such as a vibration check, had been conducted following any of these maintenance actions.

VH-HUE phase inspection documentation

The ATSB reviewed the worksheets and logbook entries for the phase inspections for HUE that were completed on 11 January and 1 April 2018. Inconsistencies were found in certification requirements including inspection items not certified as ‘completed’ or ‘not applicable’, and no indication of reference data. Therefore, it could not be established if these specific inspections were, or were not, performed.

Surveillance findings

From 24 October to 1 November 2018, CASA conducted a surveillance event of Encore and released a report documenting their findings. The surveillance was triggered by CASA becoming aware of a Cessna 172 (C172), maintained by Encore that had: 

…significant defects and corrosion relating to inspections that should have been identified as part of SIDS [supplemental inspection documents] inspections.^[9] The aircraft had been maintained by Encore Aviation and it was clear that significant anomalies related to execution of the mandatory inspections had occurred….

The CASA surveillance report noted that the C172 had been grounded while undergoing maintenance at another maintenance organisation to correct the ‘significant defects and corrosion’. This aircraft was operated by a company offering flight training, and it was expected that it was primarily used for this purpose. As a result of the surveillance, CASA issued three findings, applicable to the C172 and two Cessna 310 (C310) aircraft also maintained by Encore, which identified:

• maintenance releases had been issued for certain aircraft, when all required maintenance had yet to be completed
• tasks had been certified as complete when not all items within that task had been performed as per the maintenance instructions
• various examples of certifications not containing reference data: using a stamp rather than a signature and missing date information.

The certifications identified in the report had been made between June 2016 and April 2018. Findings documented for the C172 aircraft included significant corrosion found in the area of the forward spar of the horizontal stabiliser and trim bracket, with cracking identified in the trim bracket. The horizontal stabiliser is considered a single point of failure for the aircraft, with failure expected to lead to an unrecoverable loss of control. Furthermore, the aircraft maintenance release was issued without a required inspection on the wing root rib being certified in the worksheets or aircraft logbook. This inspection was for the purpose of corrosion detection using non-destructive testing. In addition, CASA identified that the aircraft maintenance release was issued without a required engine mount inspection being performed.

The two C310 aircraft were operated by a company providing charter and aeromedical flights. Findings on these aircraft indicated that inspections on critical aircraft components were not performed, specifically relating to the elevator torque tube, wing lower rear spar carry through, wing lower front spar root, horizontal stabiliser spar attachments and engine support beam. These are all areas representing potential single points of failure leading to loss of control if any of these components failed in-flight.

Alternate options for continuing airworthiness

The Honeywell Aerospace (Honeywell) type-certified equivalent engine is designated the T5313B. The T53-L-13B engine is the military variant, as denoted by the ‘L’ in the model designation. Honeywell advised both engine types are ‘very similar, if not the same. The difference is that Honeywell owns the design and ICA [Instructions for Continued Airworthiness] responsibility for the commercial / type certified version, whereas the US Army is responsible for the design and ICA for the military variant’.

In 2010, Honeywell published a service bulletin T53-0173 R1 to owner/operators, where military variants could be ‘upgraded’ at overhaul, to align with civil standards. Honeywell had identified that ‘maintenance of T53 engines under the US Army and foreign military systems are not equivalent to standards of Honeywell Aerospace. Differences between the maintenance concepts exist in cycle counting, parts procurement, engine assembly tolerances, and general maintenance practices’. While not required by regulations, this ‘upgrade’ would have enabled the engine fitted to HUE to be maintained to Honeywell technical publications, which were routinely updated to represent current best practices. In contrast, the US Army publications had not been updated since 2010, as far as could be determined.^[10]

Honeywell vibration maintenance requirements

The Honeywell T53-L-13B engine maintenance manual required a vibration check to be conducted upon installation into the airframe and after ‘repair/replacement of major components’, including:

• after compressor blade replacement or compressor blade repair or blending
• when excessive engine vibration was suspected.

Honeywell advised that, in 2008, they ‘undertook some actions to ameliorate the risk of exhaust diffuser cracking. Specifically, the power turbine component balance process was enhanced and the vibration limits reduced’. This was initially incorporated at the engine overhaul level (from the factory). These reduced limits were subsequently incorporated in the maintenance manual (T53-L-13B) in 2015. The maximum permissible limits, at specified parameters, were now 1.3 and 1.7 inches per second. In contrast, as noted above, the US Army manual limits were 2.5 inches per second. In addition, the Honeywell maintenance manual required a vibration check after any compressor blade repair, in contrast to the US Army requirement of more than 20 per cent.

Compared to the US Army requirements applicable to HUE, the Honeywell maintenance requirements were more stringent with respect to engine vibration inspections. Although not required, upgrading HUE to this standard may have provided additional opportunities for the detection of emerging engine problems.

Conduct of the forced landing

Height-velocity diagram restrictions

A successful forced landing in a single-engine helicopter can only be achieved if the helicopter has sufficient energy to achieve its required landing deceleration and touch down configuration, and the pilot has sufficient time to initiate a recovery to this configuration. The height-velocity envelope shows the combinations of height above the ground and forward velocity (airspeed), which have been demonstrated by flight test to allow, and which are also predicted to not allow, the pilot to complete a safe landing after an engine failure. These combinations of height and airspeed are primarily for use during the take-off or landing manoeuvre or when manoeuvring at low level, such as in long-line operations.

For single-engine helicopters, the height-velocity envelope for complete power failure must be established by the manufacturer at the time of certification. When constructed in the aircraft flight manual, the height-velocity envelope typically delineates areas that represent safe combinations of airspeed and height, and areas that represent combinations of airspeed and height that should be avoided. The avoid areas are specific to the helicopter design and are normally associated with increasing height and slow or no airspeed flight (hover as is the case with long lining) and low height with high airspeed.

The US Federal Aviation Administration (2019) also stated that:

As the airspeed increases without an increase in height, there comes a point at which the pilot’s reaction time would be insufficient to react with a flare in time to prevent a high speed, and thus probably fatal, ground impact.

Conversely, an increase in height without a corresponding increase in airspeed puts the aircraft above a survivable un-cushioned impact height, and eventually above a height where rotor inertia can be converted to sufficient lift to enable a survivable landing. This occurs abruptly with airspeeds much below the ideal autorotative speed (typically 40–80 knots). The pilot must have enough time to accelerate to autorotation speed in order to autorotate successfully; this directly relates to a requirement for height.

The nature of the long-line operation required HUE to enter the avoid area during the load hook‑up and unhook sequences. Further, comparing the height, airspeed and weight to the height-velocity diagram applicable to HUE established that it was likely within the avoid area at the time of the engine failure. This indicated that the pilot had limited options to manoeuvre following the engine failure.

Pilot decision-making and forced landing

The pilot reported that there were personnel working in and around the drill site when the helicopter was on approach to hook-up the load (the drill site also included a helipad). This was supported by time-lapse images from the drill site, which confirmed ground personnel moving in and around the drill site, including this approach. Consequently, when the engine failed, the pilot attempted to autorotate^[11] the helicopter clear of the drill site and towards the river to keep clear of ground personnel. When asked where the pilot would have conducted the forced landing if the drill site was assured to be clear of personnel, the pilot reported that the drill site (Figure 12) would have been used. Figure 12 also shows the high trees and generally inhospitable terrain surrounding the drill site.

Figure 12: Drill site looking in direction of flight

Source: ATSB

The GPS data, time-lapse images (location shown in Figure 12), supplied camera footage from eyewitnesses and witness statements were evaluated to determine the sequence of events from the engine failure to the collision with terrain. At 1417:33, the helicopter was observed approaching the drill site (indicated by Figure 13 ‘A’). Following the loss of engine power (Figure 13 ‘B’), the aircraft started descending and began to accelerate (Figure 13 ‘C’). As the helicopter approached the line of trees at the end of the clearing, the helicopter had accelerated to about 40 kt and was close to the height of the tree canopy (Figure 13 ‘D’ and ‘E’). Around this time, GPS flight data indicated a notable shallowing of the descent profile.

Figure 13: Time-lapse composite showing helicopter engine failure location and forced landing

Source: GHD, modified by the ATSB

The shallowing descent path was consistent with witness reports describing the helicopter as appearing to ‘float’ over the trees, and that it was not descending quickly until over the trees. Comparison of this glide performance with the published performance charts for HUE revealed this ratio was shallower than the autorotation range performance based on the speed and rate of descent. The pilot reported that, during this time the main rotor speed (RPM) became low. Audio analysis^[12] by the ATSB using witness phone footage established that the main rotor speed was about 214 RPM as the helicopter passed over the first line of trees, about two-thirds below the optimal speed of 314 RPM. This suggested that the pilot increased collective pitch of the rotor system to avoid the line of trees prior to reaching the gap in the canopy created by the river below. The pilot stated during interview that the helicopter’s rotor system carried a lot of inertia, and as a result, elected to fly over the trees, knowing that the rotor speed would decay. The pilot’s response was consistent with guidance in the US Army operator’s manual, which stated that a ‘landing in trees should be made when no other landing area is available’. The reduction in rotor speed is a concern during an autorotation as this equates to energy available in the rotor system. As a result, the energy available to arrest the descent rate during landing or to cut through tree branches was reduced.

Lifting operations

Helicopter lifting operations were utilised to demobilise the drill site due to the remote location of the site and to minimise the environmental impact within the Kosciuszko National Park. Consequently, helicopters involved in the lifting operation were required to operate over terrain that was generally not suitable to make a safe landing.

Organisational information

There were four organisations working together during the lifting operation on the day of the accident. GHD Limited (GHD), another geotechnical company contracted by GHD, Heli Surveys and O’Driscoll Aviation. Ground-based geotechnical survey works at the drill site were coordinated by GHD Limited, in conjunction with the geotechnical company (geotechnical crew). GHD was contractually responsible to Snowy Hydro for the safety management of all works to be conducted at relevant sites.

Helicopter operations were led by Heli Surveys. They had a contractual arrangement with Snowy Hydro to provide helicopter services to support the drilling sites at the direction of GHD. In turn, GHD were contractually responsible for ‘liaison and coordination’ with Heli Surveys. As some loads exceeded the capability of Heli Surveys, they sub-contracted O’Driscoll Aviation (HUE) to lift these heavier loads.

GHD reported to the ATSB that they were responsible for safety management for works on the ground and Snowy Hydro were ultimately responsible for the risk management of all operations, both in the air and on the ground. Snowy Hydro reported that GHD were the principal contractor for all operations and therefore, it was their understanding that GHD were responsible for the risk management activities.

The works on the day of the accident followed the completion of a geotechnical survey at the drill site and involved helicopter lifting of all the main drill rig components to the laydown area. This involved three geotechnical workers deconstructing the drill rig and two load-masters from Heli Surveys, with GHD managing the aviation component of the operation. This included preparation of loads for helicopter lifting, providing direction to the helicopter pilots via radio communications, and hooking up loads.

Lifting operations risk assessment and toolbox talk

The pilot reported attending a meeting, referred to as a ‘toolbox talk’, that involved all ground personnel and pilots prior to the lifting operation. The toolbox talk was led by representatives from GHD and Heli Surveys. This discussion included the loads to be lifted by each helicopter and safety considerations. Heli Surveys reported that part of the safety considerations included discussion of a ‘sterile zone’. This sterile zone was reported as being:

…an area where all personnel on the ground are to avoid at all times. This is usually the area on the opposite side of the aircraft to where the pilot sits. The reason for this “zone” is to give the pilot an area to land in if a forced landing is required. Although the area might not be clear of obstacles, the pilot can be confident it is clear of people on the ground.

Further, as part of these discussions, all crew, including the pilot of HUE, signed a ‘pre‑work assessment’ form indicating attendance at the meeting and compliance with the Safe Work Methods Statement. Part of the purpose of the form was to:

…discuss the planned activities and hazards and modify [Safe Work Method Statements] (SWMSs) if required.

GHD, in consultation with Heli Surveys, developed a ‘helicopter operations hazard identification’ register, referred to hereafter as the ‘risk management plan’. According to GHD, this represented the safe work method statement referred to in the ‘pre-work assessment’ form, that applied on the day of the accident. GHD were reliant on Heli Surveys providing subject matter expertise to identify aviation related hazards, risks and controls. Neither of these documents were provided to the pilot before the day of the accident for review, however, the pilot was aware of the general procedures having previously worked with Heli Surveys. A sample of the risk management plan is reproduced in Table 2, noting that only an extract of one assessment is shown for illustrative purposes only.

Table 2: Reproduced sample from risk management plan

The risk management plan identified hazards that were assigned an ‘initial risk level’ (Table 2). The specific ‘mechanism’ or ‘pathway’ was also recorded. Control measures were then listed, in order of preference, before being assigned a ‘residual risk level’. The risk management plan consisted of key operational activities grouped into a ‘Job step’, which included general site works (shown in Table 2), driving to site, pre-flight actions, passenger embarkation/disembarkation, mountain flying, ground operations and aircraft refuelling. Some of the job steps identified several pathways of harm to ground personnel during load-lifting as:

• Ground operations: ‘Load not slung correctly’, ‘Load not correctly packaged’, and ‘Slung load out of control or not flying correctly’. Controls for this were related to having a lifting plan and ensuring the plan and long-line rigging was correct.
• Mountain flying:
  • ‘Lifting loads over buildings/people and wires’, which involved the pilot ’determining the most appropriate flight path away from obstructions and people etc’. Falling trees/branches caused by downwash were also considered for the load drop-off site. However, these controls related to the helicopter with an attached load or at the drop-off site.
  • ‘Aircraft collision with spectators, objects, animals, during take-off and landing’. This had the associated risk control of ‘spectators are to be kept clear by ground personnel. If no ground personnel are present and spectators cause undue risk, an alternative landing site must be found’.

The hazard of an ‘emergency situation’ was also included in the risk management plan. Controls for this stated:

Each emergency situation is different and requires a unique set of procedures. All procedures set out in the Pilots Operating Handbook and the Flight Manual must be followed.

However, there were no control measures that explicitly addressed the risk to people underneath the helicopter for that hazard.

Despite the above, there was no specific job step for load-lifting operations in the risk management plan. Further, the risk management plan did not consider the risks to ground personnel when the helicopter was on approach to pick-up a load, which was where the engine failure occurred.

Retention of the long-line

In the days prior to the accident flight, the pilot was involved in bush firefighting operations on behalf of the New South Wales Rural Fire Service (NSW RFS). Equipment utilised during firefighting operations consisted of a long-line, connected to the helicopter belly-mounted hook. A Bambi Bucket was connected to the remote hook, at the base of the long-line. The remote hook worked independently to the belly hook and was powered by an electrical cable attached to the long-line (depicted in Figure 6). A Sacksafoam kit, which was used to provide a precise quantity of fire-retardant foam to the Bambi Bucket, was also fitted.

The Sacksafoam kit used in HUE consisted of a case located in the helicopter, which delivered the foam to the bucket via a hose. The kit included a short hose and junction, that reached from the case, around the fuselage, to the aircraft hook area. The helicopter operator then supplied the remaining length of hose required to deliver the foam to the bucket itself. An orange protective sheath held the second length of hose, electrical cables, and long-line together along the length of the line.

It was identified that a screw clamp (Figure 14) and barbed fitting had been utilised at the Sacksafoam-to-operator hose junction, located near the aircraft hook assembly. This was in contrast with the installation manual, which required the hoses to be connected via a barbed connector, without the use of clamps. The purpose of the barbed connector was to allow the hose to disconnect in the event of the long-line and bucket being released by the pilot from the belly hook in an emergency. It was this ‘clamped’ hose that prevented the complete release of the long-line from HUE.

The pilot reported that the screw-clamp had been fitted (Figure 14), in addition to the barbed fitting, to prevent the hose from ‘popping’, and leaking corrosive foam from the hose junction.

Figure 14: Operator hose with screw clamp installed

Source: ATSB and SEI Industries, annotated by the ATSB

Survival aspects

Pilot injuries

The pilot was wearing a helmet and lap-belt on the accident flight. During the impact sequence, the pilot sustained serious injuries, including a fractured right eye socket and nose. In addition, the pilot also suffered ligament damage surrounding the ribs, and ligament and tendon damage around both ankles and left knee.

Post-accident response

After witnessing the accident, video footage showed four of the workers at the drill site gathering fire extinguishers and immediately moving in the direction of the helicopter before the sound of the impact. One of the loadmasters stayed at the drill site and called for help via satellite telephone and radio. Upon arrival at the accident site (Figure 5), the first responders noticed fuel leaking down the outside of the fuselage. Fire was also observed in the area of the engine bay and fire extinguishers were deployed toward this area to extinguish the fire. Meanwhile, two workers assisted the pilot, who was unable to exit the wreckage, with moving safely away from the helicopter before commencing first aid.

The pilot of another helicopter (supporting the Snowy 2.0 project), who heard the Mayday call, flew to the drill site and dropped off three additional workers to assist. These workers gathered additional first aid supplies and assisted with rescue coordination. A third helicopter (also supporting the project) arrived at the site about 24 minutes after the accident, with two medical personnel.  About 2 hours after the accident, the injured pilot was winched from the site and transported to hospital.

Liveable space

Measurements of the floor pan against published dimensions revealed no detectable deformation in the area where the pilot was sitting. This included the area of the floor pan from the position of the rudder pedals to the rear of the pilot’s seat. Furthermore, the wreckage examination did not reveal evidence of any intrusions to the occupied area. Therefore, the area occupied by the pilot did not appear to have been compromised during the accident.

Cockpit interior damage

The left side of the instrument panel and sunshade were damaged, consistent with being pushed forward from within the cabin in front of the pilot’s seat (Figure 15). For comparison, the right-side dash panel was undamaged. Although the windscreen exhibited extensive cracking, a localised concentration of damage was present in front of the left pilot seat, the position occupied by the pilot. The damage to the cockpit and injuries sustained were consistent with the pilot’s upper torso flailing forward during the accident sequence, sufficient for the pilot’s helmet and face to strike the instrument panel sunshade and windscreen.

Figure 15: Interior instrument panel sunshade and windscreen damage adjacent to pilot

Source: ATSB

Occupant protection systems

The pilot’s seat was fitted with a 4-point lap-belt and shoulder harness on an inertia reel. However, the shoulder harness (upper torso restraint (UTR)) was not worn. The pilot stated that, due to the nature of the long-line operations, it was not possible to use the shoulder harness and lean left into the door bubble-window to view the long-line and maintain the helicopter position for load hook-up and unhook operations. The helicopter was not fitted with energy absorbing seats designed to minimise vertical accelerations during impact, although this did not appear to influence the pilot injuries.

Flail analysis

The ATSB estimated the extent of pilot upper torso movement while restrained by the lap-belt worn at the time of the accident. This was focussed on backward horizontal accelerations leading to the pilot flailing forward. Two independent methods were adopted. The first assumed a circular arc traversed by the pilot’s head. The second method, derived from an empirical study by Young, J.W. (1967), was scaled for the sitting height (94 cm) of the accident pilot. The second method also provided an assessment of the probable movement a UTR was worn by the pilot.

Figure 16 shows a head forward flail circular arc, which indicated that the pilot’s head could contact the instrument panel and windscreen if restrained only by the lap-belt. Projections indicated the middle third of the pilot’s head aligned with the instrument panel and sunshade.

Figure 16: Pilot seat and cockpit side view with circular arc based on pilot sitting height

Source: ATSB

Young’s (1967) study compared the effectiveness of lap-belts combined with various UTRs and lap-belt only. This study found that there was a significant difference in forward and downward motion between using any shoulder harness and lap-belt compared to wearing only a lap-belt. This was based on head kinematics recorded in the vertical plane for a dummy weighing 82 kg and a sitting height of 97 cm, on a sled travelling at about 45 km/h prior to impact. Using the results of this study, assessments were performed by the ATSB to indicate the range of forward movement of the accident pilot for two scenarios – with, and without the use of a UTR (Figure 17).

The left diagram of Figure 17 shows the empirical projections of the dummy wearing a lap-belt only (from Figure 4 of Young (1967)) intersecting the approximate location of the instrument panel and sunshade. In contrast, the right diagram shows considerable distance between all dummy projections and the instrument panel (Figure 11 of Young (1967)). These results were consistent with the instrument panel damage and injuries sustained by the pilot.

Figure 17: Comparison of lap-belt and UTR effectiveness, with approximate location of HUE instrument panel and sunshade

Source: Young (1967), annotated by the ATSB

Upper torso restraint use

Benefits of upper torso restraint use

When correctly worn, UTRs form an important part of the occupant protection system in aircraft, and the benefits in reducing the likelihood and severity of injuries is well established. A significant benefit of correctly fitted UTRs is the minimisation of body movement to prevent the body striking the aircraft structure in lateral and longitudinal impacts, as established by Young (1967). There is also evidence to suggest that UTRs may assist to align the spine in an anatomically ideal position during vertical impacts (Laananen, D.H., 1983, as cited in Coltman, 1985).

Research into previous helicopter accidents revealed no serious or fatal injuries in a sample of longitudinal-type impacts where occupants wore a UTR, ‘even at very high velocities’ (Coltman et al., 1985). In comparison, occupants not wearing a UTR were found to consistently sustain severe or fatal injuries at longitudinal impact speeds above 25 km/h, indicating the effectiveness of UTRs in preventing impact injuries to the head and torso. These findings are supported by accidents in fixed-wing aircraft, in which the US National Transportation Safety Board (2011) found that pilots who used lap-belts only were nearly 50 per cent more likely to be seriously or fatally injured compared with those who wore lap-belts with UTRs.

Vertical reference flying in Australia

Long-line operations, as was being conducted in this instance, require the pilot to rotate their upper torso so they can look out and down through a bubble-window, during the load hook-up and unhook stages of the flight. This type of operation is referred to as vertical reference flying.

The most significant proportion of vertical reference flying operations were expected in firefighting operations, with more than 20,000 firefighting flights conducted in Australia in 2018.^[13] Some of these flights may not require vertical reference flying techniques, such as fire spotting, and firefighting using integrated tanks and a snorkel. However, a significant number of these flights are likely to be vertical reference flying. In addition, about three-quarters of firefighting flights were conducted using single-engine helicopters. Firefighting operations were the majority of the flying performed by the pilot of HUE.

Vertical reference flying techniques are also used for construction sling-load work, similar to the accident flight. About 3,000 flights per year were recorded for construction sling-load work in 2018, mostly involving single‑engine helicopters.

Utilisation of upper torso restraints

Investigated occurrences

To identify the state of UTR use during vertical reference flying operations, a review of investigated aviation safety occurrences was conducted. This involved searching the ATSB’s aviation occurrence database and for comparison, the website of the Transportation Safety Board of Canada (TSB). The TSB were selected due to Canada being known to have a considerable amount of vertical reference flying activity. Australian investigations were identified using a regular expressions-based^[14] search for terms commonly indicating the conduct of vertical reference flying. Canadian investigation records were identified by a text search for ‘long line operations’. These records were then manually verified as vertical reference flying operations and reviewed for evidence of UTR use.

At least^[15] 14 Australian and 9 Canadian investigations involved the conduct of vertical reference flying operations between January 2000 and June 2020 (Figure 18). From the 14 Australian investigations it was found that 4 pilots confirmed they did not wear their UTR (recorded as ‘No’ in Figure 18), 1 partially wore it (recorded as ‘Partial’), 1 did wear it, and 8 were unknown. For the partially worn case, it was found that the UTR provided no benefit due to it being incorrectly worn. Therefore, where the use of UTR was determined,^[16] it was found that 67 per cent (4/6) of pilots were not wearing their UTR, and 83 per cent (5/6) when considering cases where the UTR was not effectively worn. This result was consistent with known cases in Canadian investigations. When considering all investigated occurrences (including unknown cases), at least one-third of pilots conducting vertical reference flying were not correctly wearing a UTR.

The confirmation from several pilots in Australian investigations that they were not wearing their UTR was consistent with the physical restriction it would impose on rotating the upper torso for vertical reference flying. This was supported by one of the TSB investigations that stated ‘as is typical with many pilots involved in vertical reference flying, the pilot did not use the shoulder restraint system provided’ (TSB report A08P0265).

Figure 18: Number of pilots in ATSB and TSB investigations involving vertical reference flying by upper torso restraint use, January 2000 to June 2020

Source: ATSB

Industry experiences

The ATSB held a meeting with the Australian Helicopter Industry Association (AHIA) to discuss the issue of UTR use for vertical reference flying in light of investigation findings.

In general, investigations identified factors such as cockpit dimensions and seatbelt design probably contributed to the lack of UTR use by pilots conducting vertical reference operations. For example, ‘Most helicopters are not designed or certified to accommodate vertical reference external load operations; however, these operations are very common and pilots fly in this higher‑risk environment without proper safety-restraint devices’ (TSB report A05P0103). When these findings were reviewed by the AHIA, it was generally agreed that this practice was probably adopted due to the sideways leaning required by the pilot during vertical reference flying, rather than for reasons of comfort.

During the meeting with AHIA, the limitations of the accident helicopter were discussed. Helicopters such as HUE were expected to present greater challenges to vertical reference flying due to the distance between the pilot seat and door, coupled with an older-style seat-belt webbing being fitted. This was despite having a number of modifications to assist leaning into the bubble‑window to look down, such as some of the cockpit instruments being duplicated and mounted on the door. It was reported that, despite these modifications, the design of the harness inertia lock release mechanisms were generally insufficient to allow pilots to lean outside without a work-around, even if fitted with modern harnesses. One such reported work-around was wearing the UTR, but slipping one strap underneath the arm to aid leaning out and prevent the belt pressing into the pilot’s neck.

The consensus from the AHIA representatives was that the previous and current investigation findings were generally consistent with their collective experience. It was agreed that lack of UTR use or wearing the UTR differently to that recommended, was a commonly adopted practice during vertical reference flying. Specifically, due to the UTR impeding a pilot’s ability to effectively conduct vertical reference flying operations. This was expected to affect multiple helicopter types frequently used in long-line operations that were not initially designed for this purpose. However, they also acknowledged there was no readily available market solution.

Solutions for restraint in vertical reference operations

A small number of helicopter models are specifically designed for vertical reference flying. These helicopters allow the pilot to conduct vertical reference flying while being fully restrained. However, these helicopters were expected to form a small proportion of vertical reference operations in Australia.

The ATSB was also aware of a number of innovations to assist in the conduct of vertical reference flying. These innovations were available to be retrofitted to helicopter models not specifically designed for regular vertical reference operations. For example, the fitment of light-weight webbing. It was reported that light weight and low friction webbing of these seatbelts would probably assist with vertical reference flying. However, these seatbelts were generally fitted within the existing guide mechanisms on the helicopter. As a result, it was expected that work‑around solutions, such as tucking the seat-belt under the arm were likely to still be required.

Reports have also been received about tilting seats fitted to some helicopters. These allow the pilot to remained fully harnessed, with the entire seat assembly tilting outside the helicopter structure to allow vertical reference flying. The accident pilot reported that these seats were limited for taller pilots. At the time of writing, it could not be ascertained how many, if any, of these systems were used in Australia.

Injuries associated with damaging vertical reference flying accidents

A short study was conducted by the ATSB to evaluate the possible influence of UTR use on accident-related injuries sustained during vertical reference flying operations. This involved comparing the proportion of accidents with injuries between vertical reference flying and the mean of all other helicopter aerial work, where the helicopter was substantially damaged or destroyed. These accidents were intended to represent scenarios where the flight crew would have experienced significant in-cockpit accelerations.

From the sample, it was found that flight crew were significantly more likely to receive an injury in a vertical reference flying accident where the helicopter was substantially damaged or destroyed compared to the mean of all other helicopter aerial work. It was identified that for two of these, including this accident, head injuries were likely sustained or made more severe due to improper, or lack of UTR use. While it was possible that these injuries contributed to the difference in the proportion of injuries between the two groups, this was unable to be determined as the nature of injuries or UTR usage in other aerial work was not known. This supports the need for further research in this area. Further results, including the methodology for this study can be found in Appendix A – Injuries associated with vertical reference flying compared to other aerial work operations.

__________

5. According to Civil Aviation Safety Authority Advisory Circular AC-21.10 v4.2 (issued March 2019), some special certificates of airworthiness are issued to permit operations of aircraft that do not meet the requirements for a standard certificate of airworthiness, as was the case for VH-HUE, but are capable of safe operations under defined operating conditions and purposes. In recognition of the lack of compliance with some of the airworthiness standards, the aircraft is normally permitted to be operated under more restrictive operating conditions than in the case of a comparable aircraft operating on a standard certificate.
6. ‘Greasing’ referred to the requirements in the maintenance manual of HUE for periodic lubrication of components at nominated time intervals.
7. Civil Aviation Order 100.5 General requirements in respect of maintenance of Australian aircraft, Part 5 ‘retention of aircraft maintenance records’, generally required retention for a period of 1 year.
8. The power turbine (N2) tachometer generator provides engine RPM, as a percentage, to the instrument panel. It is mounted to a drive assembly (shown in red in Figure 8), at the 10 o’clock position on the exterior of the inlet housing and is driven through shafts and gearing from the power turbine shaft.
9. The supplemental inspection documents (SIDS) were developed by Cessna, and required by CASA, to provide additional inspection criteria, to certain aging aircraft. The SIDs identified areas of the aircraft that were most likely to experience a principal structural element component failure under extended life operations.
10. The US Army retired the UH-1 from active service in 2005. Residual aircraft were used for training only and the final UH-1 was retired in 2016.
11. Autorotation is a condition of descending flight where, following engine failure or deliberate disengagement, the rotor blades are driven solely by aerodynamic forces resulting from rate of descent airflow through the rotor. The rate of descent is determined mainly by airspeed.
12. Helicopter RPM was calculated by counting the time between audible ‘beats’ created by the helicopter rotor blades. Comparative analysis was performed with earlier footage confirming nominal RPM during normal operations.
13. Provided to the ATSB by the Bureau of Infrastructure, Transport and Regional Economics (BITRE).
14. Regular expressions methods refer to the use of sequence of characters as a search pattern. These were used to provide a more robust mechanism to identify records than conventional text searches.
15. Due to vertical reference flying not being formally categorised by the ATSB or Canada, it is possible that additional flights were not identified in the selection. This is not expected to impact on these results.
16. Investigations with unknown UTR usage were not considered to impact results because of the focus on the existence of lack of UTR use.

Safety analysis

Introduction

While conducting long-line lifting operations near Talbingo in the Snowy Mountains region of New South Wales, VH-HUE (HUE) experienced an engine failure. During the subsequent forced landing, the helicopter collided with trees and a riverbed. The pilot sustained serious injuries and the helicopter was destroyed.

This analysis will discuss the factors contributing to the engine failure, including the maintenance procedures and practices that were in place at the time and the opportunities to identify the developing engine issue. It will also examine the limited options available for the forced landing, increasing the severity of the impact, and the risk management planning for personnel working near or underneath the helicopter in the event of an emergency landing. The limited ability for pilots to wear an upper torso restraint (UTR) during long-line operations will also be reviewed. Further, the retention of the helicopter long-line during the accident sequence, and the positive influence of ground personnel in recovering the pilot and reducing the potential severity of injuries are also discussed.

Engine exhaust diffuser inner strut fractures

While on approach for the twelfth lifting operation of the day, the pilot heard a mechanical ‘screaming’ noise, followed immediately after by a complete loss of engine power. The ATSB’s wreckage inspection identified cracking and missing material in the engine exhaust diffuser housing. Further examination of the engine by the manufacturer revealed extensive fatigue cracking led to the failure of the exhaust diffuser inner struts, which position the power turbine shaft. The loss of internal support resulted in interference between the power turbine shaft and compressor shaft, and subsequent failure of the engine.

Engine inspections

Following their examination of the engine, the manufacturer concluded that the cracking in the exhaust diffuser area was likely visible in at least the previous two phased maintenance inspections, which was at least 171 flying hours before the accident. Furthermore, 34 daily inspections had also been certified during this period. Another eight separate visits to the helicopter maintainer had also occurred during this time.

The phased maintenance inspections were typically conducted in a hangar by a licenced aircraft maintenance engineer (LAME) and involved a detailed inspection of the engine, where a higher level of scrutiny was expected. The daily inspection could be conducted and certified by a LAME or a pilot. This required a visual examination of the exhaust diffuser area, generally conducted in the field using a ladder, torch and mirror, which should have been sufficient to identify the cracks. However, there was a difference in understanding between the pilot and LAME as to who was responsible for conducting the daily inspections on HUE when in the field. Therefore, it was likely that the exhaust diffuser area daily inspection was not completed for all, or part of the period they were operating together with HUE.

Had the missing material and cracking been identified in any of these inspections, it would be reasonable to expect that further investigation of the exhaust diffuser would have been conducted. This would have typically involved removal of the engine for examination at an overhaul facility. However, for reasons that could not be determined, the missing material and visible cracking in the exhaust diffuser area was likely present, but not identified in either the phased or daily inspections, prior to propagating to the point of failure.

Maintenance practices and processes

The engine manufacturer concluded that the cracking in the exhaust diffuser would have been visible at the last phase inspection about 20 hours prior to the accident and likely visible at the preceding inspection about 171 hours before. These inspections were performed at Encore Aviation by two different LAME’s, neither of whom detected the cracking or the missing material. Similarly, another aircraft maintained by Encore Aviation was found to have significant defects and corrosion in critical components, which were not identified during routine maintenance, but were detected by another organisation. Also, two other aircraft that were used for passenger-carrying operations did not have inspections performed on critical components.

In addition to routine maintenance inspections, trend monitoring provides another mechanism for identifying engine deterioration, and the malfunction of engine components and accessories. In this case, the United States Army technical publication detailed when vibration checks were to be conducted on the engine type fitted to HUE and the maximum permissible limits. When adhered to, these should enable a component to reach its expected service life.

A vibration check had been conducted when the engine was installed in late 2016 and was recorded as being ‘within limits’. However, the actual vibration levels were not documented. Rather, the maintenance organisation’s standard practice was to rely on the internal memory in the test equipment for retaining a record of these values, which were subsequently deleted when the machine failed. While compressor blade repairs were conducted in early 2018, there was insufficient information available in the maintenance documents to establish if a vibration check was required and/or if one was conducted. Irrespective, this data could have been used as a baseline figure for comparison with future vibration checks to assist with trend monitoring. This was particularly relevant in this case given that the cracking resulted from high-cycle fatigue likely from excessive vibration of the power turbine.

The investigation also noted that an engine component associated with the power turbine assembly supported by bearings in the exhaust diffuser was replaced four times over a period of about 150 flying hours. In addition, the drive between the same engine component and the power turbine was also replaced during this time. The maintenance records did not detail the exact nature of each unserviceability, which provided limited information for identifying trends to detect anomalies. Therefore, it could not be established if this was also related to power turbine vibrations. Regardless, the repetitive replacement of a component should be cause for further investigation as trend monitoring has been shown to enable early detection of developing issues.

In addition to the above, the ATSB’s review of the 2018 maintenance records for HUE found inconsistencies in the documentation with regard to certification requirements. Likewise, following an audit in late 2018, the Civil Aviation Safety Authority also identified discrepancies regarding incomplete documentation and tasks being certified as completed although some had not been completely performed, covering the period 2016 to 2018. They subsequently issued three findings to the maintenance organisation.

While the ATSB was unable to review Encore Aviation’s operating procedures, the above demonstrates short comings in their maintenance practices and processes relating to inspections, record keeping and trend monitoring. Therefore, as was the case for HUE, it was unlikely that they were sufficient to detect the potential impending failure of safety critical components.

Forced landing

The lifting operation was being conducted over remote and mountainous terrain, with the drill site, that included a helipad, as the only clear area for a landing. On the day of the accident, ground personnel were observed moving in and around the drill site, including when HUE was on approach for the twelfth load. Therefore, when the engine failed, the pilot was not assured that the drill site was clear of personnel underneath. Consequently, out of concern for these people, the pilot moved HUE away from the drill site towards a river, which required the helicopter to clear a line of trees.

To clear the drill site and trees, the pilot had to reduce the rate of the autorotative descent, which resulted in sacrificing main rotor speed for range. Any loss of rotor speed will reduce the energy available for the rotor blades to cut through trees and arrest the rate of descent before contact with the ground. The helicopter subsequently impacted trees, leading to a complete loss of control before impacting the riverbed about 250 m away from the drill site. The combination of these factors likely contributed to the severity of the impact.

Alternatively, if the pilot was assured that ground personnel were clear of, or able to clear the drill site following the engine failure, the drill site and associated cleared area may have provided a suitable area for a forced landing. The option of a suitable forced landing site within the normal autorotation range profile would have allowed the pilot to use the stored rotor energy to conduct a normal autorotative landing and significantly reduce the risk of serious injuries.

Risk assessment for lifting operations

While the GHD risk management plan considered ground personnel during load lifting and take-off or landing, it did not capture hazards associated with the approach to, and during load hook-up. Consequently, the hazard of personnel being struck by the helicopter was not identified in this plan for the accident phase of flight. Similarly, risk controls in the event of an emergency did not specifically address the risk to personnel working near or underneath the helicopter. This indicated that, following an engine power loss, the documented plan would require the pilot in command to conduct the emergency landing, while also communicating with ground personnel to ensure they were clear of the drill site, which included the load pick-up area.

In this case, the pilot and witness statements, and time-lapse imagery, showed that the situation developed rapidly, with little time for decision-making and coordination. Although, it was reported that ‘sterile zone’ protocols were discussed, these were not documented in the risk management plan, despite other hazards and controls being identified. Therefore, a pre‑established plan detailing the actions and expectations of the pilot and ground personnel in the event of an emergency during this phase of flight would have been more ideal. This could have been achieved during a hazard identification workshop and documented in the risk management plan. This would have provided a prompt for the briefing on the day during the ‘toolbox talk’ and acted as an additional reference to those involved in the lifting operation.

Snowy Hydro contracted several organisations in support of the Snowy 2.0 project for the ground-based survey works and helicopter support. While the roles of each organisation were clear, there appeared to be a misunderstanding as to who was responsible for safely integrating the ground and air operations. This likely resulted in less oversight of the overall operation than was intended. This may have influenced the risk management plan not being sent to the accident pilot prior to the ‘toolbox talk’, which may have provided further opportunity to explicitly capture certain aspects of the load‑lifting operation.

Preplanning for an emergency situation is a critical component of risk management. For HUE, none of the controls in the risk management plan addressed the hazard of an emergency landing when on approach for load pick-up. As a result, this plan did not provide assurance to the pilot that ground personnel would be clear of the area if a forced landing at the drill site was required. This likely resulted in the pilot’s decision to attempt the forced landing away from the drill site to a less suitable location.

Upper torso restraint

The pilot was not wearing a UTR at the time of the accident as it interfered with the vertical reference flying that was being conducted. Consequently, the collision resulted in the pilot flailing forward at the waist and the pilot’s face impacting the instrument panel. The impact with the panel resulted in the pilot sustaining serious facial injuries. Although wearing a helmet probably reduced the potential for non‑facial head injuries, the helmet did not provide facial protection for the impact with the panel.

If the UTR fitted to the helicopter had been worn by the pilot, this would have significantly reduced the forward flailing motion of the pilot’s torso. Flail analysis of the potential torso movement with a UTR revealed it was virtually certain that the pilot’s face would not have struck the panel and therefore, would not have sustained the associated facial injuries. However, the ATSB noted that there appeared to be very limited after-market solutions currently available to the problem of vertical reference flying with a correctly worn UTR.

Upper torso restraints in vertical reference flying

In the last 21 years, from the ATSB investigations in which the use of a UTR was known, it was found that 83 per cent of pilots involved in vertical reference flying accidents were not effectively wearing the UTR, including the accident pilot. This was consistent with investigations from Canada and the experience of local industry members, who reported that it was a common practice for the UTR to be either partially worn or not at all.

In a short study of accidents where the helicopter was substantially damaged or destroyed, it was found to be significantly more likely for injuries to occur during vertical reference flying compared with the mean for other helicopter aerial work. This included two accidents where the head injuries were likely incurred from improper or lack of UTR use. This was consistent with the available literature, where it was found that wearing a lap-belt and UTR considerably reduced the likelihood of a fatal or serious injury to pilots in the event of an accident. In contrast, wearing a lap‑belt only significantly increased the chances of pilots sustaining upper body injuries. Therefore, the lack of use of the UTR was considered to be a large reduction in safety margins. Since most vertical reference flying in Australia is conducted for firefighting activities, this is currently the sector with the greatest exposure.

Therefore, based on investigation findings and reported industry experience, it was likely that UTRs were not routinely worn by a notable proportion of pilots during vertical reference flying. They were considered unlikely fit-for-purpose due to of the pilot’s inability to effectively view the long-line underneath the helicopter. This problem likely extended across the Australian helicopter industry and was not specific to the accident pilot or helicopter type.

Sacksafoam hose attachment

In response to the engine failure, the pilot attempted to jettison the long-line and strops from the helicopter. This opened the airframe mounted belly hook, which released the long-line, and the remote hook at the end of the long-line (via the electrical cable), which jettisoned the lifting strops. However, the wreckage examination established that the long‑line, which remained tethered by the Sacksafoam hose, did not fully detach from the helicopter. The fitment of a screw-clamp, installed by the pilot for firefighting operations in addition to the barbed connector, likely prevented the separation of the operator hose from the Sacksafoam hose. In turn, this prevented the long‑line from completely detaching. Although the retained lifting equipment did not contribute to the collision with terrain in this instance, it presented a snagging hazard, which increased the risk of a higher severity occurrence.

Emergency response

Prior to the sound of the helicopter impact, members of the ground personnel departed the drill site, with fire extinguishers and a first aid kit, and headed in the direction of the accident site. They assisted the pilot out of, and away from the helicopter, where medical aid could be administered. In addition, they extinguished a small fire in the engine bay, mitigating the risk of this, combined with leaking fuel, developing into a fuel-fed fire. These actions likely reduced the risk of more severe injuries to the pilot.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving a Garlick Helicopters UH-1H, VH-HUE, 24 km south-east of Talbingo, New South Wales, on 17 April 2018.

Contributing factors

• On approach for a long-line lifting operation, the inner struts of the engine exhaust diffuser fractured as a result of fatigue cracking, which led to a complete loss of engine power.
• The fatigue cracks in the exhaust diffuser were likely present, but not detected in at least 34 daily and 2 phased maintenance inspections.
• Encore Aviation's maintenance practices and processes related to inspections, record keeping and trend monitoring, were likely inadequate to detect the potential impending failure of safety critical components. (Safety issue)
• The pilot did not have assurance that ground support personnel could vacate the drill site in an emergency. As a result, although the engine failed close to the cleared area, the pilot conducted the forced landing to a less suitable location, increasing the severity of impact forces during the subsequent collision with terrain.
• GHD's documented risk assessment for helicopter operations did not consider the hazard of an emergency landing at the drill site. This increased the risk that ground personnel were not clear of the load pick-up area in the event an emergency landing was required. (Safety issue)
• The upper torso restraint fitted to the pilot's seat was not worn during the long-line operations, which virtually certainly resulted in the pilot sustaining serious head injuries from the collision with terrain.
• Upper torso restraints were likely not routinely worn by a notable proportion of pilots conducting vertical reference flying operations in Australia, as they were likely not fit-for-purpose, increasing the risk of serious injury in the event of an accident.

Other factors that increased risk

• A screw-clamp was retrofitted to the firefighting retardant delivery hose, which prevented the long-line from being released from the helicopter during the emergency.

Other findings

• The immediate response of the ground personnel to extinguish a small fire and assist the pilot to exit the helicopter, likely reduced the risk of more severe injuries to the pilot.

Safety issues and actions

Maintenance practices and processes

Safety issue number: AO-2021-031-SI-01

Safety issue description: Encore Aviation's maintenance practices and processes related to inspections, record keeping and trend monitoring, were likely inadequate to detect the potential impending failure of safety critical components.

Risk assessment for lifting operations

Safety issue number: AO-2021-031-SI-02

Safety issue description: GHD's documented risk assessment for helicopter operations did not consider the hazard of an emergency landing at the drill site. This increased the risk that ground personnel were not clear of the load pick-up area in the event an emergency landing was required.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• accident witnesses
• Airservices Australia
• the Bureau of Meteorology
• the Bureau of Infrastructure, Transport and Regional Economics
• the Civil Aviation Safety Authority
• Encore Aviation
• GHD Limited
• Honeywell Aerospace
• the pilot of the accident flight and another pilot who conducted flights for the operator
• recorded data from the GPS unit on the aircraft
• Snowy Hydro Limited.

References

Civil Aviation Safety Authority (2007). Safety Management Systems: An Aviation Business Guide, Canberra, Australia.

Coltman, J.W. Bolukbasi, A.O. Laananen, D.H. (1985). Analysis of Rotorcraft Crash Dynamics for Development of Improved Crashworthiness Design Criteria, DOT/FAA/CT-85/11, US Department of Transportation, Federal Aviation Administration.

National Transportation Safety Board (2011). Airbag Performance in General Aviation Restraint Systems, Safety Study, NTSB/SS-11/01, Washington, D.C.

Young J.W. (1967). Functional Comparison of Basic Restraint Systems. Federal Aviation Administration, Office of Aviation Medicine Report No. AM 67-13.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Australian Helicopter Industry Association
• Bureau of Infrastructure, Transport and Regional Economics
• Bureau of Meteorology
• chief engineer
• Civil Aviation Safety Authority
• Encore Aviation
• field-based LAME
• Garlick Helicopters
• GHD Limited
• Heli Surveys Pty Limited
• Honeywell Aerospace
• Mulligan Geotechnical Pty Ltd
• pilot
• Snowy Hydro Limited
• United States National Transportation Safety Board.

Submissions were received from:

• Australian Helicopter Industry Association
• Bureau of Infrastructure, Transport and Regional Economics
• Bureau of Meteorology
• Civil Aviation Safety Authority
• Encore Aviation
• Garlick Helicopters
• GHD Limited
• Heli Surveys Pty Limited
• Honeywell Aerospace
• pilot
• Snowy Hydro Limited.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Injuries associated with vertical reference flying compared to other aerial work operations

This Appendix documents a short study conducted by the ATSB to provide further context of the relative exposure to injury during vertical reference flying operations to complement the analysis related to occupant protection systems. The objective of this study was to identify the chances of receiving an injury during an accident when conducting vertical reference flying compared to the mean of all other aerial work operations. To achieve this, statistical assessments comparing proportions of injuries to damage between groups were performed. The characteristics of injuries sustained are also discussed.

Methodology

Records from the ATSB’s occurrence database were extracted for review. Two groups of interest were identified in the study: vertical reference flying operations; and all remaining helicopter aerial work operations. To identify vertical reference flying operations, records were extracted when terms indicating fire control or other sling-load operations were identified. Preliminary results were then manually verified to include only those operations likely to involve long-line operations. The following fire control helicopter operations were excluded from these results: helicopters using integrated tanks drawing water through a snorkel (not using a fire bucket); winching or transporting fire control crews; and reconnaissance and fire spotting.

Only occurrences where the helicopters were substantially damaged or destroyed (accidents) were selected for analysis. These were selected as an indicator of significant whole of airframe accelerations. Consequently, it was expected that people on board were more likely to have experienced significant accelerating forces during impact that may lead to injuries. Accidents where the pilot experienced larger forces were also more likely to require the fitted restraint systems to mitigate injury risk. These accidents typically involved collisions with terrain or hard landings into clear and unsuitable areas.

A small number of vertical reference flying accidents were identified where substantial damage occurred, such as a tail rotor collision with a water bucket on the ground, where minimal accelerations were anticipated. However, these were included in this analysis to allow a fairer comparison with other aerial work operations where the damage was not characterised.

Results

Comparisons of injury proportions with other aerial work

Between 2000 and 2019, 15 accidents^[17] were identified involving vertical reference flying where the helicopter was substantially damaged (13 accidents) or destroyed (2 accidents). Over the same period, 329 damaging accidents were identified for remaining aerial work operations.

The relative likelihood of accidents with injuries is shown in Figure A1 in comparison to the mean of all remaining aerial work operations (percentage of accidents where injuries occurred when the helicopter was substantially damaged or destroyed). Values were calculated based on the highest injury sustained to a flight crew member^[18], meaning that each accident was only counted once.

Figure A1: Percentage of accidents with substantial damage or helicopter destruction by highest crew injury for vertical reference flying and other helicopter aerial work, 2000 to 2019

One fatal, three serious and five minor highest injury accidents with substantial damage or airframe destruction occurred for vertical reference flying, equating to 60 per cent (9/15) for this operation. In contrast, about 35 per cent (114/329) of all other helicopter aerial work accidents with the same damage categories resulted in injuries. The mean for all other helicopter aerial work produced a significantly lower percentage of accidents with injuries in comparison to vertical reference flying.^[19] Considering only serious and minor injury accidents as an indication of known survivable impacts, the difference was also significant between vertical reference operations and all other helicopter aerial work.^[20] This indicated that it was very likely that the chances of an injury were higher during vertical reference flying, than the mean of all other aerial work, in survivable impacts.

Injury characteristics

To identify the possible injury mechanisms, the characteristics of injuries sustained by specific body area were examined for each of the nine injury-related vertical reference flying accidents. This was also compared to known usage of upper torso restraints (UTRs). A limiting factor was that injuries were not known for the remaining all other aerial work operations. As a result, it was not possible to establish if differences existed between injury severity mechanisms, such as lack of UTR use, between the two groups.

Head injuries were identified in four accidents involving vertical reference flying. Upper torso restraints were not worn by two of these pilots: this accident (AO-2018-031) and a non‑survivable accident (AO-2018-057). Another head injury occurred when the UTR was worn loosely (AO-2009-076). In the two survivable accidents, the lack of use, or incorrect use of the UTR probably increased the severity of the injuries leading to facial fractures and hospitalisation.

It was uncertain how the fourth head injury occurred, with investigation (200300011) concluding that this probably resulted from striking the helicopter door frame or being struck in the helmet by the main rotor blade. However, it was unable to be determined if the pilot was wearing a UTR.

The serious injury accident involving spinal fractures (AO-2009-081) likely resulted from vertical acceleration forces through the seat during impact, following descent into trees. In this accident, the utilisation of the UTR was not examined, and it was not recorded if these restraints were worn. However, it was not expected that these would have prevented the serious back injuries sustained by the pilot in this case. Smalls cuts and scratches were reported in two minor injury accidents with one including seatbelt bruising and ligament or tendon damage on the pilot’s left shoulder from the UTR. The nature of the two other minor injuries were not recorded.

In summary, two of the three survivable accidents (including this accident) with head injuries likely resulted from the pilot’s head striking the airframe structure. In these two cases, investigations found that this was related to the lack of use, or incorrect use of UTRs.

Conclusion

In conclusion, it was found to be significantly more likely to receive an injury during vertical reference flying compared to the mean of all other helicopter aerial work activities. Two of the three survivable impacts with head injuries during vertical reference flying accidents were likely made more severe due to limited or no UTR use. Although it was possible that these injuries contributed to the difference between the proportion of injuries between the two groups, this was unable to be determined as the nature of injuries or UTR usage in other aerial work was not known. This supports the need for further research in this area.

__________

17. These numbers differ from the analysis conducted for investigated upper torso restraint usage in the section titled ‘Utilisation of upper torso restraints’ due to the analysis of this Appendix including investigated and non investigated occurrences.
18. A small proportion of accidents with crew injuries (9%) had multiple crew onboard. These included aeromedical flights, fire spotting and operations with a second pilot. These are not expected to impact on results. The remaining accidents with crew injuries involved single pilots.
19. Fisher’s Exact Test (one-tailed): Number of substantially damaging impacts with injuries and without injuries for vertical reference flying vs other helicopter aerial work, p = 0.044, odds ratio 2.8.
20. Fisher’s Exact Test (one-tailed): Number of substantially damaging impacts with minor and serious injuries, and without injuries for vertical reference flying vs other helicopter aerial work, p = 0.023, odds ratio 3.5.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.