On 11 November 2016, at about 1546 Central Standard Time (CST), a Cessna 208B (C208B) aircraft,[1] registered VH-TYV (TYV) entered runway 29, at the intersection of taxiway E2 (Figure 1) at Darwin Airport, Northern Territory for an aircraft type re-familiarisation training flight. On board were an instructor and trainee pilot.
Figure 1: Darwin Airport overview showing approximate flight path of TYV
Source: Google Earth, annotated by ATSB
At the beginning of the take-off run, the trainee pilot set take-off power prior to releasing the brakes. After releasing the brakes, the aircraft accelerated to the take-off speed. The trainee pilot rotated[2] the aircraft to 12 degrees nose up, to achieve a best angle of climb speed of 80 kt. The trainee pilot maintained 12 degrees nose up and 80 kt until the aircraft climbed to an altitude of about 500 ft above ground level (AGL).
At about 500 ft, the trainee pilot reduced the flap setting from the take-off setting of 20 degrees to 10 degrees. At this time, the instructor noted the climb speed reducing while the trainee continued to maintain the nose attitude for best angle of climb. At the same time, the instructor heard the engine lose power and a thin film of fuel partially obscured the windscreen. The instructor noted reducing engine torque, fuel flow, inter-turbine temperature and airspeed.
As the airspeed reduced to 60 kt, the instructor took control of TYV. They immediately felt a strong nose down force through the control column and the aircraft pitched significantly nose down. They recovered the aircraft to the glide attitude and could not see a suitable landing area ahead of the aircraft. They identified an area to the left of the aircraft as the most suitable for a forced landing and began a left turn towards that clear area at the target glide speed of 85 kt.
During the left turn, the instructor made a PAN[3] broadcast on the Darwin Tower air traffic control (ATC) frequency advising that the engine had failed and that they intended to turn back to Darwin Airport. As the turn continued, they un-stowed the emergency power lever, in accordance with the engine failure procedures and attempted to recover engine power. The engine did not respond, so they feathered[4] the propeller.
The instructor observed a drainage ditch within the clear area to the left of the aircraft, and initially selected the drainage ditch as the most suitable location for the forced landing. As the aircraft turned, they assessed that sufficient height remained to continue the turn back towards Darwin Airport. At the completion of the turn, they selected 30 degrees of flaps to provide a short climb, which allowed the aircraft to clear two hangars and an area of trees.
After clearing the hangars and trees, the instructor observed taxiway A in line with the aircraft and elected to land on taxiway A. The aircraft landed on taxiway A without further incident.
After landing, the instructor and trainee pilot exited the aircraft. They observed fuel on the canopy and underside of the aircraft along with a significant leak from the engine cowling which had created a large pool of fuel below the aircraft.
The instructor and trainee were not injured, and the aircraft was not damaged in the incident.
Instructor comments
The instructor in TYV provided the following comments:
A pre-flight inspection of the aircraft found no defects and no evidence of fluid leaks in the engine compartment.
The instructor developed the C208B operating procedures for the operator. The instructor regularly practiced and trained pilots on the conduct of these procedures.
The instructor had recently conducted significant multi-engine aircraft training, including engine failures where procedures direct a PAN broadcast. They probably reverted to this behaviour when contacting ATC to advise of the emergency rather than declaring MAYDAY.[5] The ATC response indicated that the emergency situation was understood and further declaration of a MAYDAY was not required.
The operator take-off safety briefing directs a pilot to only attempt a turn-back at altitudes in excess of 700 ft AGL.
The aircraft departed with a 10-15 kt headwind, only two occupants on board and 900 kg of fuel. The light weight of the aircraft and the assisting headwind, which became a tailwind during the turn-back, led the instructor to continue the turn-back despite commencing the procedure at about 500 ft AGL.
Departure from the E2 taxiway intersection on runway 29 provides in excess of 1,600 m of runway for take-off. This is ample for a C208B and more than is available at any other runway the C208B is operated to by the company. Departing from the end of runway 29 requires a significantly further taxi distance.
The initial strong pitch down force, as the instructor took control after the engine failure, was probably due to the loss of thrust along with the drag produced as the propeller pitch initially reduced before the propeller was feathered.
The turn back procedure is not suitable for all aircraft types, piston engine aircraft do not have the same ability to turn back after an engine failure.
Engineering examination
A post-incident examination of the engine found the number eight fuel nozzle locking plate missing (Figure 2). This allowed the fuel transfer tube to migrate out of the number eight fuel nozzle adaptor. There was no damage to the locking plate mounts.
The fuel nozzles had been replaced 86 flight hours prior to the incident, while the aircraft underwent maintenance in the United States, prior to importation into Australia. All other required hardware was found to be correctly installed, including the number eight fuel transfer tube locking plate fasteners.
Figure 2: TYV fuel transfer tubes
Source: Operator, annotated by ATSB
Safety analysis
The lack of damage to the locking plate mounts, along with the locking plate being entirely missing, and the fasteners being found installed indicates the locking plate probably did not fail. The locking plate was probably not reinstalled when the fuel transfer tubes and nozzles were installed after replacement. The missing locking plate allowed the fuel transfer tube to slowly migrate out of the nozzle adaptor over the subsequent 86 flight hours.
On the incident flight, the fuel transfer tube migrated far enough that fuel under pressure was able to escape from the nozzle adaptor (Figure 3).
Figure 3: Fuel under pressure escaping from migrated fuel transfer tube
Source: Operator, annotated by ATSB
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The number eight fuel transfer tube locking plate was likely not installed when the fuel transfer tubes and nozzles were installed after replacement.
The missing locking plate allowed the fuel transfer tube to migrate out of the fuel nozzle adaptor and fuel to escape. This starved the engine of fuel and led to the engine power loss in flight.
Safety message
This incident serves to underline the importance of ensuring all maintenance is completed entirely and correctly. The locking plate was not installed during scheduled maintenance, however, the fuel leak did not develop for a further 86 flight hours. This demonstrates how the effects of incomplete maintenance can take a long period of time to manifest. The ATSB research report: An overview of human factors in aviation maintenance provides information on human factors errors made in the maintenance environment.
This incident also provides an excellent example of the value of regular training and the effective implementation of procedures following engine failure after take-off in a single engine aircraft.
Successful completion of a turn back manoeuvre to land on the departure runway, or other suitable airport area, requires well-developed procedures and good pilot proficiency to ensure procedures are effectively applied. Careful consideration of the characteristics and performance of each aircraft type is required when developing turn back procedures. The impact of wind and weather conditions must also accounted for when electing to conduct the turn back procedure. As demonstrated in this incident, during the turn back the pilot should constantly assess the ability of the aircraft to complete the procedure and be prepared at any time to cease the turn and land ahead.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 1113, Central Daylight-saving Time (CDT) on the 6 November 2016, a Cessna 172S aircraft, registered VH-USL (USL), departed Parafield Airport, South Australia for a local flight in the western training area. The pilot was the only person on board the private flight.
The pilot reported that the aircraft has a ‘glass cockpit’[1] and they had only flown it once before with an instructor. The purpose of this flight was to become more familiar with the ‘glass cockpit’ and specifically the autopilot. Prior to taxi with the engine running, the pilot reviewed the operation of the autopilot. In addition, as preparation the pilot had read the auto pilot manual and watched some videos on the operation of the autopilot.
During the initial climb, the pilot engaged the autopilot. As the aircraft started to climb at a faster rate than expected, the pilot disconnected the autopilot and continued on to St Kilda (Figure 1).
Figure 1: Approximate flight path of USL from Parafield to just past the Lower Light ALA
Source: Google earth, modified by the ATSB
When the aircraft reached 1,000 ft, the pilot again engaged the autopilot and the autopilot again started to change the attitude of the aircraft, not as expected, and the pilot disconnected the autopilot. After passing St. Kilda, the pilot initiated a climb to 2,500 ft and navigated along the VFR route towards Dublin (Figure 2). In the cruise, the pilot continued to attempt to get the autopilot to engage but it did not respond as they expected. The pilot reported that they made regular checks and would look from inside the cockpit to outside to check the aircraft was maintaining a direction to Dublin and that no other aircraft were in the vicinity.
Source: Airservices Australia: Visual Terminal Chart, modified by the ATSB
During this time, a Cessna 206 (C206) aircraft departed Lower Light aircraft landing area (ALA) for parachute operations. They were on climb to flight level (FL) 120 where four parachutists planned to exit the aircraft overhead the Lower Light ALA. The aircraft planned to then continue to climb to FL 140 where two other parachutists in tandem were to exit the aircraft.
The pilot contacted the Adelaide Approach controller and received a clearance to climb initially to FL 120. Approaching FL 120, the pilot received a clearance to drop the first parachutists and then climb to FL 140. The controller also advised them that there was an unverified aircraft (USL) about 3 NM to the south of Lower Light ALA at 2,500 ft. At about 1123, the pilot broadcast on the area frequency advising traffic in the Lower Light area that in about three minutes they would be at FL 120 and would conduct a parachute drop. The pilot of USL reported that they heard this broadcast but no subsequent broadcasts from the aircraft.
The parachute operator’s safety officer was listening on the radio frequencies (parachute operation frequency, area frequency and Adelaide Approach frequency) and was standing in front of the operator’s hangar. The safety officer reported that they heard the broadcast made that the four parachutists had exited the aircraft (this was not recorded on the area or Adelaide approach frequencies). At about the same time, the safety officer saw a Cessna 172 (C172) aircraft (USL) fly directly over the hangar from the south, heading towards where the safety officer expected to see the four parachutes open. The safety officer contacted the C206 pilot on the radio to let the pilot know that there was an aircraft flying directly towards the parachutists. The safety officer observed the parachutes open near the C172 and observed the C172 aircraft turn to the right slightly and then make a left turn away from Lower Light ALA.
At about the same time, the pilot looked out and observed parachutes just below and to the left of the aircraft at a distance of about 200 m. After checking that it was all clear, the pilot turned the aircraft to the left to manoeuvre away from Lower Light ALA.
At about 1126, the C206 pilot broadcast that the traffic adjacent to Lower Light ALA to depart the area immediately, as there were parachutists in the air. However, the pilot heard no response from the pilot of USL. The C206 pilot contacted Adelaide Approach and advised that an aircraft had interfered with the parachutists. The controller replied that the traffic was outside controlled airspace, and they did not have any details on the aircraft. As the C172 was heading away from the area, the controller approved the C206 to drop the remaining parachutes and then descend from FL140.
The pilot of USL disconnected the autopilot, navigated to Dublin, returned to Parafield via the inbound VFR route, and landed without further incident. The six parachutists landed without further incident.
Pilot comment
The pilot reported that they were distracted while trying to operate the autopilot and were not aware that they had flown close to the Lower Light ALA. They heard the broadcast from the C206 pilot, but they did not realise that they were that close to the ALA and did not take any action. When the parachutes were sighted, the pilot checked the area before turning, to ensure they were not about to turn into another parachute which was taking action to avoid his aircraft.
After the incident, the pilot reported they informed the flying school where the pilot hired the aircraft about the incident and that they believed the autopilot had a problem.
The pilot reported that the weather was clear, and the wind was about 8 knots from the west.
Aircraft owner
The maintenance release for USL contained an endorsement that the autopilot roll servo was unserviceable in August 2016 and another roll servo was installed. On 26 October 2016, the autopilot roll servo was replaced with an exchange servo. There were no other endorsements on the maintenance release about the autopilot.
The aircraft owner reported that apart from the replacement of the autopilot servo there had been no defects recorded about the serviceability of the autopilot. Subsequent to the incident, the operator conducted a full test in flight of the autopilot on USL and no fault was found with the autopilot or with any of its functions.
Parachute operator
The parachute operator reported that in the past they have contacted flying schools in the area notifying them of the frequencies that their pilot will use to notify that there are parachute operations. The parachute operator indicated that there have been other ‘close calls’ reported but this was the closest that an aircraft has come to a collision with a parachutist.
A search of the ATSB database confirmed three other notifications from 2006 to 2016 where an aircraft was near parachutists at the Lower Light ALA.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The pilot of the Cessna 172 was distracted by the operation of the aircraft autopilot and as a result, had reduced awareness of the aircraft’s position and flew in close proximity to four parachutists.
Safety message
This incident highlights the importance to maintain situational awareness through active navigation and active listening to radio communications. Ensuring you are listening to the correct frequencies and communicating on the correct frequencies helps to maintain your situational awareness but also that of other pilots flying in your area.
The Civil Aviation Safety Authority (CASA) has developed the Look out! Situational awareness DVD and video for pilots to learn more about the safety-critical skills that makes up situational awareness. There is a strong emphasis on the need to prepare and plan for every flight. The DVD gives a definition of situational awareness as “what’s happened, what’s happening and what might happen”.
The CASA Safety Video - Situational awareness is available from the CASA website and the CASA Look out! Situational awareness DVD is available from the CASA online store.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
A limited-scope, fact-gathering investigation into this occurrence was conducted in order to produce this short summary report and allow for greater industry awareness of potential safety issues and possible safety actions.
What happened
On 30 October morning, the 119 m general cargo ship Searoad Mersey (Cover) arrived off Grassy Harbour, King Island (Figure 1) from Melbourne, Victoria. The ship was operating a 7-day schedule between Melbourne, King Island and Devonport, Tasmania. At about 0700,[1] the ship’s master received a weather report for the harbour. The wind was from the north-west at 25 to 28 knots[2] as per the forecast.
Figure 1: Navigational chart Aus 178 showing Grassy Harbour
Source: Australian Hydrographic Office (annotated by ATSB)
At 0730, the ship approached Grassy Harbour’s outer breakwater at 12 knots. Shortly after, the master manoeuvred the ship into the outer harbour and started a starboard turn to bring the ship onto the inner lead beacons for the inner harbour. Once inside the inner harbour, the ship’s master swung the ship to port to berth the ship starboard side alongside the wharf.
By 0800, Searoad Mersey’s mooring lines were all fast. Shortly after, the ship’s stern ramp was lowered and cargo unloading started. Cargo operations continued throughout the day with several delays. As a consequence, the ship’s scheduled departure time of 1500 was delayed by an hour. The wind was from the west-northwest throughout the day at 27 to 33 knots.
At 1604, the ship’s main engines and bow thruster were on standby and ready for use. The master held a departure brief with the ship’s bridge team detailing the departure plan. The ship’s master and crew were very experienced and familiar with arrivals into and departures from Grassy Harbour. The standard brief detailed using the port engine ahead and full starboard rudder.
Figure 2: Searoad Mersey’s grounding in the Inner Harbour
South Australian Hydrographic Office (annotated by ATSB)
The wind was still from the west-northwest at 27 to 33 knots and the tide was ebbing with low water expected at 1853. The ship’s departure draughts were 5.1 m forward and 5.3 m aft. The master expected an under keel clearance of between 1 and 1.5 m for the departure.
At about 1605, the mooring lines were singled up forward and aft and by 1607, all mooring lines had been let go and recovered. The wind acting on Searoad Mersey’s starboard quarter[3] started to move the ship away the berth.
The ship’s heading[4] while alongside the berth was 155° and the next course was 232°, a 77° alteration to starboard. The master increased the port engine to 60 per cent ahead. The ship moved about 30 m ahead, parallel to the wharf, and the rudder was put hard over to starboard.
At 1608, the ship had moved ahead about 90 m and had started swinging to starboard. Shortly after, the ship grounded on the sandy bottom to the east of the inner breakwater (Figure 2).
The master stopped the port engine and put the bow thruster full to port. He then increased the starboard engine to 70 per cent ahead and the rudder hard to port. However, the ship’s starboard shoulder[5] remained grounded. Shortly after, the master unsuccessfully attempted to move the ship astern using both engines.
Searoad Mersey’s crew sounded the ship’s tanks to check for water ingress and started ballasting the ship’s port tanks to list the ship. However, the port list had no effect and the ship remained grounded forward with the stern swinging freely in deep water. The second mate then started pumping ballast from the fore peak tank to the aft peak tank, to reduce the draught forward.
At 1648, the master reported the grounding to the ship’s managers and the joint rescue coordination centre (JRCC) in Canberra. Shortly after, as the tide was still ebbing, he ordered the starboard anchor lowered to the sea bed.
At 1658, the main engines were stopped. Then, at 1700, the master felt Searoad Mersey roll slightly and immediately started the main engines. At 1705 with the main engines running astern, the ship started to move astern. The crew sounded the tanks again for any water ingress. The anchor was recovered and the rudder and engine tested. The master then manoeuvred the ship out of the inner harbour and continued the voyage to Devonport.
On 31 October, the ship’s flag State authority, the Australian Maritime Safety Authority (AMSA), attended the ship in Devonport. The ballast tanks were inspected and no damage was found.
On 3 November, Searoad Mersey underwent an underwater hull inspection in Melbourne. Minor paint damage near the starboard shoulder was found but there was no structural damage.
ATSB comment
Since the last hydrographic survey in 2015, it is probable that silting had occurred near the inner breakwater. It is likely that the reduction in water depth to the charted depths were the result of the predominant westerly winds blowing sand from the nearby beach into the channel together with the movement of sand within the harbour.
Safety message
Masters, harbour masters and others responsible for ships calling safely at ports need to assure themselves of the reliability of charted depths, particularly in some small, remote ports. A possible reduction in charted depths due to local conditions, reference to the charted zone of confidence diagrams and the date of the last hydrographic survey are among the factors that should be taken into account.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 5 November 2016, the pilot of an Air Tractor AT-502 aircraft, registered VH-LIK, was conducting aerial spraying operations from an airstrip at Cryon, New South Wales. After completing six spray loads, the pilot loaded liquid chemical into the aircraft’s hopper and refuelled the aircraft. At 0953 Eastern Daylight-saving Time,[1] the pilot commenced a take-off to the north.
About 44 seconds after commencing the take-off, the aircraft collided with trees and the ground before coming to rest inverted. The pilot was fatally injured, and the aircraft was destroyed by impact forces and a fuel-fed fire.
What the ATSB found
The flaps were retracted at some point during the take-off, which significantly degraded the take‑off and climb performance. This effect was compounded by the estimated weight of the aircraft, the local temperature and wind conditions at the time of the flight. The combined effect probably resulted in the aircraft having insufficient take-off performance. The reason the flaps were retracted was not able to be determined.
The aircraft reached a height above the ground where the reduced benefit of ground effect further degraded the aircraft’s performance. The low height and airspeed precluded the pilot from turning the aircraft towards a clear area and the aircraft descended into trees.
Recorded data from the aircraft indicated that the pilot attempted to dump the hopper contents after becoming airborne, which would have achieved significant gains in climb performance, however a complete dump was not achieved. The reason for this could not be determined.
What has been done as a result
The aircraft manufacturer is updating the maintenance section of the aircraft owner’s manual to specify that the gatebox and emergency dump controls are to be inspected periodically for condition, function and adjustment.
Safety message
Acknowledging that the pilot was unable to dump the load on this occasion, the performance benefits in quickly and significantly reducing the aircraft weight means that the requirement to dump the hopper load, when the aircraft performance is not as expected, should be at the forefront of the minds of agricultural pilots. As with all emergency procedures, it is essential that pilots have a well-rehearsed plan, appropriate training and recent practice in conducting an emergency hopper load dump in the aircraft they are operating.
Proper functioning of the emergency jettison system is vital as pilots rely on it in case performance is inadequate, particularly when taking off with a heavy load. Therefore, registered operators should ensure adequate ongoing maintenance and regular checks to maintain serviceability of the system.
Pilots are reminded to monitor weather conditions like temperature and wind and anticipate the potential adverse effects of local conditions on aircraft performance. Where performance data is available for an aircraft, pilots should make active use of it to have the best opportunity to assess the expected performance of the aircraft for the given weight and environmental conditions before take‑off.
On 5 November 2016, at about 0641 Eastern Daylight-saving Time,[2] the pilot of an Air Tractor AT‑502 aircraft, registered VH-LIK (LIK), commenced a flight from Wee Waa Airport, New South Wales, to position the aircraft at an agricultural airstrip near Cryon, about 20 minutes flying time away. The aircraft was carrying full fuel (794 L) but the hopper, which had the capacity to carry about 1,892 L of liquid, was empty.
The aircraft landed at Cryon at about 0700 in preparation for aerial spraying of a crop about 5 km north of the airstrip. A loader[3] filled the aircraft’s hopper with between 1,650 L and 1,670 L of liquid chemical, which was a solution of fungicide and insecticide in water.
At about 0721, the pilot commenced the first of seven planned loads of aerial spraying. After the aircraft landed from spraying the fifth load, the loader loaded the aircraft’s hopper for the sixth load. The loader reported that a similar quantity of chemical was loaded on each of those flights.
Following completion of the seventh flight, the intention was to reposition to a property about 50 km away and continue spraying activities. In order to avoid delaying commencement of the next job, the loader mixed the seventh batch of liquid chemical and arranged for the pilot to load the hopper and refuel the aircraft himself. At about 0907, the loader observed the aircraft take off on the sixth load and then left the airstrip to drive to the next property.
Data recorded by the aircraft’s GPS showed that the aircraft landed after completing the sixth load at 0930. About 24 minutes later, the aircraft commenced a take-off run to the north, consistent with previous departures. The last recorded aircraft position was 44 seconds later, 2 km north of the runway threshold.
The aircraft clipped the top of a fence 1,300 m beyond the start of the runway, struck multiple trees about 700 m beyond the fence and subsequently collided with terrain. The aircraft flipped over and came to rest inverted.
The pilot sustained fatal injuries and the aircraft was destroyed by the impact with terrain and a subsequent fuel-fed fire.
Pilot experience
The pilot held a commercial aeroplane pilot licence, was appropriately endorsed for the aircraft, and held aerial application and low-level ratings applicable to operation of the accident flight. At the start of the accident day, the pilot had logged a total of 9,896.8 flying hours. Over 8,000 hours of that time were low-level flying, including survey, firebombing and about 2,500 hours of aerial agricultural operations. The pilot had accrued over 4,600 hours in turbine-engine aircraft and had about 450 hours on AT-502 aircraft.
The pilot had successfully completed a flight review and agricultural flight proficiency check on 7 June 2016.
Medical and pathological information
The pilot held a current Class 1 medical certificate without restriction that was valid to 22 December 2016. The pilot had also passed medical testing for entry into the Australian Defence Force as a military pilot within the previous two months.
The post-mortem examination did not identify any conditions that could have contributed to the accident. Toxicology results were negative for alcohol and commonly-tested drugs.
Aircraft
LIK was an Air Tractor Incorporated AT-502 single-seat agricultural aircraft manufactured in 1990 in the United States (US), (serial number 502-0115). It was powered by a Pratt & Whitney PT6A-15AG turboprop engine that drove a Hartzell HC-B3TN-3D three-bladed constant speed, reversible pitch propeller.
The aircraft was fitted with a fuel tank in each wing and had a total capacity of 817 L, of which 794 L was useable. The aircraft was also fitted with dispersal equipment for spraying and spreading, and a system that allowed the hopper contents to be dumped if required.
Maintenance
The aircraft was maintained under a Civil Aviation Safety Authority (CASA)-approved system of maintenance (SOM) by a CASA-approved maintenance organisation. The last scheduled 75‑hourly was on 16 August 2016 at which time the aircraft had 13,000.4 hours total time in service (TTIS) and 150- and 300-hourly inspections were carried out on 15 October 2016 at 13,150.6 TTIS. The aircraft had flown about 40 hours since the last inspection.
Previous recent maintenance
30 November 2015: the maintenance records stated that a ‘flap system fault caused a take-off accident.’ The flap system was found to be intermittent and a new flap motor was installed and the ‘up’ relay was replaced.
8 April 2016: the flap actuator pivot bearing and right flap middle attachment bracket were identified as unserviceable and replaced.
16 August 2016: the flap motor was replaced in accordance with the operator’s requirement to replace it every 450 hours. The motor had accumulated about 150 hours of operation at the time of the accident.
15 October 2016: the hopper dump door boot was found unserviceable and was replaced.
The SOM specified that the daily pre-flight walk-around inspection was to be conducted in accordance with the AT-502 flight manual. The manual identified various checks relating to the dispersal equipment, however there was no reference to checking the integrity or operation of the hopper dump system.
The SOM specified that the airframe, electrical and instrument categories were to be maintained in accordance with the latest revision of the AT-502 owner’s manual, inspection section. Additionally, agricultural role equipment was to be maintained to the applicable manufacturer’s schedule when installed on aircraft. As with the daily inspection, the Air Tractor inspection information specified a number of checks relating to the dispersal equipment, but no specific reference to maintenance and operation of the hopper dump mechanism.
Registration holders of class B aeroplanes may optionally use the CASA Maintenance Schedule to maintain their aircraft. In contrast to LIK’s SOM, the CASA Maintenance Schedule Daily Inspection included the following items specific to agricultural aeroplanes:
1. Check that the agricultural equipment (e.g. hopper, hopper lid and fasteners, spray tanks, spray pump and lines, booms and boom supports, dump doors, fan and fan brake) is secure.
2. Check that the dump and fan brake mechanisms are free from obstructions and operate correctly.
The CASA Maintenance Schedule for Periodic Inspection – The Airframe specified additional items for agricultural aeroplanes:
1. Inspect the hopper, hopper lid and fasteners, baffles and internal braces.
2. Inspect the spreader, spreader gate and controls.
3. Inspect the spray pump fan, fan mount, fan brake, spray pump lines booms and boom supports.
4. Inspect the emergency dump doors and dump controls.
Agricultural operations
The AT-502 is a specialised aircraft designed for agricultural operations. Liquid or granular chemical for aerial spraying or spreading can be carried in the aircraft’s hopper. With a load in the hopper, a pilot can use the performance benefits of flying the aircraft close to the ground (in ground effect)[4] while it accelerates to a safe airspeed prior to climbing. If the pilot assesses the aircraft’s performance is inadequate, particularly during the take-off, a jettison system enables them to dump the load, which quickly reduces the aircraft’s weight and increases performance.
Regulations
The US Federal Aviation Administration (FAA)-approved Airplane Flight Manual (AFM) for the AT‑502 specified an original maximum agricultural gross take-off weight of 3,296 kg. However, the AFM for LIK had revised weight and balance data, specifying a maximum agricultural gross take‑off weight of 8,000 lb (3,629 kg). Additionally, the AT-502, like most agricultural aircraft, had provision in its Type Certificate Data Sheet (TCDS)[5] for operators to approve a higher maximum (gross take-off) weight. The TCDS applicable to LIK stated that the aircraft type and model had demonstrated satisfactory operation, at a maximum (gross take-off) weight of 9,200 lb (4,173 kg) under the following conditions:
1,300 ft altitude
32 °C outside air temperature
a stall speed of 77 kt calibrated airspeed (CAS) and maximum speed 122 kt (CAS).
Australian Civil Aviation Regulations 1988 (CAR) 138 requires that the pilot must comply with the aircraft’s flight manual. CAR 235(4) prohibits taking off in an aircraft if its gross weight exceeds its maximum take-off weight. However, to facilitate overweight operations in Australia, CASA has issued exemptions against the requirements of CAR 138 and 235. The exemption current at the time of the accident was EX217/15, which allowed operations up to weights where jettisoning the hopper load would reduce the gross weight to below the maximum take-off weight. However, the gross weight at take-off was not permitted to exceed the highest of the weights shown on:
the aircraft TCDS
a placard (with a weight certified by CASA)
the approved flight manual.
Under the exemption, LIK was permitted to operate at the maximum demonstrated weight of 9,200 lb (4,173 kg) specified in the TCDS.
The aircraft operator reported that although the aircraft had capacity to carry 800 L of fuel and 1,800 L of liquid in the hopper, they carried a maximum of 600 L and 1,600 L respectively, in accordance with regulatory requirements. However, they also advised that LIK had successfully operated at its maximum capacity of about 400 kg higher than the demonstrated maximum take‑off weight, with the same engine and propeller combination, for many years under an earlier exemption that did not specify a gross weight limit.
Effect of increased weight
An increase in aircraft weight reduces aircraft performance. In the take-off phase, increased weight for the same power setting:
increases induced drag and rolling resistance
slows acceleration
lengthens the ground run.
An increase in weight also increases the stalling speed and means that the aircraft has to reach a higher groundspeed (for the same configuration and wind conditions) before it can safely fly. That in turn also increases the length of the required ground run.
Induced drag is proportional to the weight of the aircraft squared, so an increase in weight of 10 per cent increases induced drag (in all flight conditions) by about 20 per cent and the power required to overcome that drag increases similarly.
Flaps
To increase lift and aid in overcoming the increased induced drag, the aircraft was fitted with large Fowler-type flaps, interconnected to the ailerons. Fowler flaps extend rearwards before extending downwards, increasing the wing surface area and then the camber. The initial rearwards extension means in the partially extended or take-off position, the flaps increase lift without significantly increasing the drag. That flap design particularly assists agricultural aircraft operating at high weights, close to the ground and for short take-off performance. The flaps are operated electrically and may be stopped at any position from 0° to the maximum of 26° of travel. The flaps had external markings visible from the cockpit at 10° and 20° of travel.
For take-off with a load or for short-field take-offs, 10 to 20° flap was used. Up to 10° of flap was also used during turns. The AFM stated that for take-off with a full hopper load, ‘lower flaps to 10° position…after breaking ground do not retract the flaps until at least 91 kt indicated airspeed is reached.’ This was consistent with the manual’s stated best rate of climb speed[6] for a heavy load, which was between 86 kt and 91 kt indicated airspeed.
When fully extended (to 26°), the flaps significantly increased drag. Following reports of pilots attempting to use full flap on take-off, the aircraft manufacturer added the following warning to the AFM:
Full flaps should not be used during the takeoff sequence. The use of full flaps creates large amounts of drag and will lengthen the ground roll and impair climb performance.
Flap switch position
The AT-502 aircraft are fitted at manufacture with a flap switch near the throttle quadrant. The pilot presses the electric switch and holds it until the desired amount of extension or retraction is achieved. The pilot can verify the amount of flap extended based on two markings on the flap.
In Australia, it is common to fit an additional flap switch in accordance with an engineering order. The setup comprises either a rocker switch or, in the case of LIK, two buttons on the control stick (Figure 1). This allows the flaps to be operated with the pilot’s right hand, leaving the left hand free to operate the throttle and/or dump lever.
Figure 1: Flap stick switch
Source: Aircraft operator
The aircraft manufacturer advised that, although the additional flap switch position was convenient, very few US operators placed one on the control stick due to safety concerns associated with this setup. Specifically, it was reported that during high stress, high workload events, pilots had squeezed the control grip tightly and unintentionally actuated the switch and raised or lowered the flap.
The ATSB received notification in September 2017 of inadvertent flap retraction during take-off, using the flap stick switch, which resulted in the aircraft descending and colliding with terrain (see also ATSB investigation 199800640 in Similar occurrences).
Operations
The day’s planned operation
The task for the pilot was to spray a combination of insecticide and fungicide over an area of 390 hectares, at a volume rate of 30 L per hectare. Seven loads were programmed, with each load area 55.7 hectares and each load volume 1,671 L.
The loader reported loading 1,650–1,670 L of water-based chemical into the hopper for each spray run. In preparation for the seventh spray load, the loader had mixed 400 L of chemical, which the pilot was to load into the hopper along with water to make up the total volume. The exact volume loaded was not witnessed but there was no reason for it to have varied from the quantity loaded on the previous runs.
Fuel
The pilot refuelled the aircraft and refilled the hopper after the loader had left and therefore the amount of fuel and chemical on board at the time of the accident was estimated, based on the available evidence.
The aircraft fuel tanks were full (794 L usable fuel) at the start of the first flight that day. Based on a planned fuel consumption of 225 L per hour, the usable fuel remaining after the sixth spray load would have been 160 L. This was a conservatively high consumption figure used for fuel planning so the fuel remaining may have been greater.
The aircraft operator had a supply fuel tank with a capacity of 14,000 L situated at the airstrip. On 26 October 2016, 12,940 L of Jet A1 fuel was delivered to fill the supply tank. Two days prior to the accident, the job record obtained for a company aircraft showed that 594 L of fuel was taken from the tank to refuel that aircraft. There was no other known refuelling from the supply tank prior to the day of the accident.
After the accident, the supply tank contained about 13,000 L. This indicates that the pilot likely added approximately 400 L of fuel to LIK. In consideration of the conservatively low estimated fuel remaining value (160 L), and the reported normal procedure of filling to a visible indicator, it was therefore estimated that the pilot filled aircraft to between 560‑600 L at the start of the seventh take-off.
Weight and balance
Using the estimated fuel and chemical load at the start of the seventh take-off run, the aircraft take-off weight was probably between 4,214‑4,246 kg (Table 1). This weight was about 41‑73 kg above the TCDS weight of 4,173 kg. At the estimated weight, the aircraft’s centre of gravity would have been within the fore and aft limits.
The stalling speed at the TCDS demonstrated weight was 77 kt CAS (equivalent to 75 kt indicated airspeed).[7]
Table 1: Estimated take-off weight range
Source
Weight (kg)
Basic empty weight
2,007
Pilot
95
Hopper load
1,670
Fuel (using specific gravity of 0.79 for jet A1 fuel at 29 °C)
442‑474
Estimatedlikely take-off weight
4,214‑4,246
Meteorological conditions
As part of the investigation, the ATSB obtained weather data for 5 November 2016 recorded at 10-minute intervals at:
Cryon Station, which was about 7 km south-west of the accident airstrip
Burren Junction (40 km east)
Rowena (40 km north-northeast).
Recorded 1-minute interval data was also obtained for Walgett Airport (50 km west of the accident airstrip).
The weather recorded between 0720 and 1000 at those locations showed the temperature increased from 19 °C to 29 °C and the wind changed from north-westerly, through westerly to south-westerly. As the wind changed direction, it became gustier and the wind speed increased.
The average wind speed and direction for each 10-minute period was recorded at Cryon Station, about 7 km south-west of the accident airstrip. Figure 2 shows the recorded 10-minute data divided into the crosswind and tailwind components for the runway heading 017° True. During the 24 minutes the pilot was on the ground between the sixth and seventh loads, the average wind speed increased to about 11 kt and changed direction so that there was a tailwind of about 6 kt and a crosswind of about 8 kt for the final take‑off. Shortly after take-off, the aircraft turned to track in a more north‑easterly direction (Figure 6), which would have increased the tailwind component by about 1.5 kt.
Figure 2: Recorded wind data at Cryon showing headwind and crosswind components for a runway heading 017° T
Source: Delta Ag – analysed by ATSB
South-westerly winds at Walgett were at 14 kt, gusting to 20 kt between 0930 and 1000. Figure 3 shows the crosswind and tailwind components for the runway heading 017° True if the wind at the accident site was similar to that recorded at Walgett Airport.
Figure 3: Recorded wind data at Walgett Airport showing tailwind and crosswind components for runway heading 017° T
Source: Bureau of Meteorology – analysed by ATSB
A pilot who was operating about 11 km east-south-east of the accident site reported that the wind changed suddenly at the time of the accident, and that he had just ceased spraying operations for the day because of the strong wind. He estimated the wind was gusting about 30 to 35 km per hour (16–19 kt) and potentially over 40 km per hour (22 kt).
Based on the pilot’s assessment and the recorded 1-minute wind data at Walgett, the aircraft may have encountered wind gusts stronger than the 10-minute average recorded at Cryon during take‑off for the seventh run.
Density altitude
Density altitude is pressure altitude corrected for non-standard temperature. As density altitude increases, aircraft and engine performance decrease. The pressure altitude decreased by 30 ft during the morning’s flights from 575 to 545 ft, and the density altitude increased due to an increase in temperature.
The temperature at the time of the accident was 29 °C and the density altitude for the airstrip (elevation 485 ft above mean sea level) was 2,405 ft above mean sea level. The 10 °C increase in temperature and slight decrease in pressure altitude since the first spray run of the day increased the density altitude by 1,170 ft (from 1,235 ft). AT-502B performance data indicated (no performance data was available for the AT‑502) that this would have increased the length of the take-off ground run by about 15% and the distance to clear a 50 ft obstacle by about 17%. As the performance of the AT-502 and 502B is comparable, the required ground run and obstacle clearance distance for LIK would have been similarly affected.
Recorded information
The aircraft was equipped with a satellite navigation system that provided tracking guidance to the pilot to facilitate accurate spray coverage of the crop. The system recorded in-flight data to a compact flash (CF) memory card that included the time and the aircraft’s position, speed, track and altitude.
Data from the seven flights (loads) that day were recovered from the device and the accident flight was compared with the first minute of the six previous flights (Figure 4). On each flight, the system started recording when the aircraft reached 50 kt on the take-off run and stopped when the aircraft decelerated below 50 kt during the landing roll.
The aircraft’s recorded groundspeed on the accident take-off was comparable to the six previous flights, except that the acceleration was slower — between about 70 and 80 kt. The ATSB combined the recorded 10-minute wind data at Cryon with the system data to derive the approximate airspeed for all of the day’s flights. The accident flight showed significantly reduced airspeed and slower acceleration between about 60 and 80 kt airspeed. The previous six flights had similar profiles to each other. Fuel consumption reduced the aircraft’s weight over the six flights, which would have offset the decreasing headwind component to some extent during the morning’s operation.
Based on the recorded groundspeed and 10-minute average wind data at Cryon, the aircraft’s maximum airspeed on the accident flight was about 87 kt (and 80 kt based on the Walgett 1‑minute data) immediately before impact.
Figure 4: Comparison of LIK’s seven flights from the day of the accident – groundspeed (left) and airspeed (right) calculated from recorded groundspeed and adjusted for recorded wind
Source: ATSB analysis of VH-LIK navigation system data
Altitude data from the day’s flights revealed that the aircraft did not climb more than 20 ft above the ground on the final take-off. The data does not depict the exact flight profile and height due to data accuracy limitations (the ‘ground level’ for the accident take-off varies between about 5 and 10 ft), but provides a reliable comparison of the flights (Figure 5).
Figure 5: Navigation system recorded data comparing the aircraft’s recorded height above ground on the day’s flights
Source: ATSB analysis of VH-LIK navigation system data
The data contained a discrete recorded spray on/off parameter. The spray ON is actuated through a pressure switch on the spray boom, as well as a micro-switch at the bottom of the dump handle (for spreading granular chemical or jettisoning the hopper load). The normal data recording rate was about one record per second. However, if the system was actively spraying or spreading, the data recorded at a higher rate of 4 to 5 times per second.
During the first six flights, the spray ON parameter remained on during the spray runs, and then OFF as the aircraft turned for the next run or was taking off and landing. Consistent with the spray ON activating, the data logging rate was higher than once per second.
At 0954:19 on the final take-off, 26 seconds into the recording the system briefly recorded at a higher rate without the spray discrete parameter activating (Figure 5). This occurred just before the aircraft reached a one-metre high fence, about 1.3 km beyond the start of the runway.
Nine seconds later, at 0954:28, the system again recorded at a higher rate, and the spray discrete parameter activated ON once only and then immediately returned to OFF. The discrete parameter activated once more (for one data record) at 0954:37, and the recording ended 0.25 seconds later.
The aircraft’s recorded flight path on the accident flight showed the aircraft’s take-off and a turn gradually to the right, consistent with previous flights and in the direction of the target area to be sprayed on that load (Figure 6).
Figure 6: Recorded aircraft track for accident flight
Source: ATSB
Site and wreckage information
Witness information
A pilot who was conducting aerial spraying about 11 km east-southeast of Cryon saw black smoke and flew towards it. He found LIK inverted and on fire, and radioed for assistance.
The pilot landed his aircraft at the Cryon airstrip and met a farm worker with a vehicle and they travelled together to the accident site. He reported that he could not see any evidence that the pilot had dumped the load.
Wreckage information
The accident site was about 2 km north of the southern end of the runway and the general spread of wreckage indicated the aircraft had been tracking to the north-northeast. Examination of the accident site determined that the aircraft’s left wing struck a tree about 9 ft above the ground, then a second tree about 6 ft above the ground (Figure 7). The right wingtip struck the ground and the aircraft then collided with a third tree dislodging the propeller and engine. The main landing gear struck the ground and separated from the airframe, and the fuselage then collided with the ground nose first, flipped over and came to rest inverted. The debris trail extended about 80 m from the first tree impact to the fuselage. A fuel-fed, post-impact fire destroyed most of the aircraft.
About 1.3 km from the start of the runway, a 1.2 m high wire fence ran across the flight path. The top two fence wires were broken in line with the aircraft’s flight path, suggesting contact with part of the aircraft. The fence was noted to have been undamaged about a week prior to the accident.
The impact forces and post‑impact fire destroyed many of the aircraft components, however all major components of the aircraft were identified.
Figure 7: Accident site showing tree impacts
Source: ATSB
Engine and propeller
Examination of the engine outer combustion case identified evidence of twisting associated with engine torque. Additionally, the compressor blades at the engine inlet were bent opposite to the direction of rotation and the power turbine blades were fractured around the entire circumference of the disc. All of those indications were consistent with the engine rotating at the time of the accident.
The propeller separated from the engine upon striking a tree, with only one of the blades remaining within the hub. One of the two detached propeller blades was located at a right angle to the aircraft’s flight path, approximately 90 m from the tree strike. The significant distance of travel by the ejected blade required significant energy, which was only likely to occur under conditions of high engine power/torque.
That blade had fractured at the blade tip and displayed rearward bending that was indicative of a ground or tree strike while rotating. There was a hand file mark along the edge of the blade but no indication of pre-existing cracking or other defects.
All of the propeller blades exhibited a general level of bending, twist and leading edge impact damage that was consistent with the propeller being driven with significant torque at the time of impact.
Flight controls
Examination of the aircraft’s flight controls verified that they were continuous prior to the collision. The flaps were found in the retracted position. The flap controls were heavily damaged by impact forces and fire, but the remaining identifiable parts appeared to be in place. The flap micro‑switches and relays had melted, so their positions could not be verified.
Flap actuator
The flap actuator was in the fully retracted position (Figure 8) and the flap actuator motor had broken free from the gearbox.
Figure 8: Flap actuator
Source: ATSB
When fully retracted, the manufacturer specified that there should be a gap of 1/16” to 1/8” (1.6‑3.2 mm) between the striker and the end of the up travel. If the flap micro-switch is not set correctly, and the gap is insufficient, the flap motor may stop the ‘up’ travel. If this occurs, it can jam the actuator and prevent the flaps from extending. An appropriate gap was identified on the occurrence actuator. The aircraft’s maintenance records indicate that the aircraft had flown 150 hours without any related issues since the flap micro-switch was set.
Air Tractor Service Letter 260 reported a case of the rubber coupling between the flap actuator motor and gearbox tearing. This occurred during take-off with the flaps extended and allowed the actuator to back-drive, which resulted in an uncommanded flap retraction. The service letter recommended that the coupling be replaced upon condition and inspected every 400 hours to prevent a similar event occurring. Due to the extent of damage, the condition of the rubber coupling prior to the impact could not be assessed.
Hopper
The emergency hopper dump mechanism appeared to be continuous except for a rod end fracture, consistent with impact damage. The dump lever (handle) was found in the closed position, but was not locked and was free to move. Its pre-impact position could not be determined. The over-centre latch of the hopper gate box was in the unlocked and fully-open position; however, it was not clear whether it had moved to that position during the impact sequence.
A modification, involving a sleeve bolted to the hopper gate box push rod, was identified during the wreckage examination (Figure 9). No documentation for the modification was available and therefore an assessment of its suitability could not be made. However, the operator advised that the modification had been made to extend the rod, and that the aircraft had flown over 10,000 hours since, without any issue relating to the dump mechanism. The push rod was bent at the sleeve modification but it had not fractured. It was likely that the damage was a result of the accident impact. The hopper gate mechanism had been used in this configuration during spreading operations and cleaning.
Examination also identified that a bolt was missing from one of two gate box push rod attachments (Figures 10 and 11). The bolt was not recovered and therefore the failure mode could not be assessed. The aircraft manufacturer advised that those bolts and clamps were known to separate from the torque tube during the majority of impact sequences. In any event, testing showed that failure or absence of one of the bolts would not prevent the transfer of sufficient force to open the hopper door, providing the associated clamp was tightened securely.
At the time of writing, the aircraft manufacturer reported that there were no known failures of the hopper dump mechanism.
Figure 9: Gate box push rod showing modification
Source: ATSB
Figure 10: Gate box wreckage showing hole in gate box torque tube where bolt was missing
Source: ATSB
Figure 11: Image of gate box torque tube bolt in place
Source: ATSB
Survivability
The webbing of the seat harness was entirely destroyed in the post-impact fire. Despite this level of damage, various buckle and harness adjust mechanisms were identified. The lap-belt harness buckle was found in the secured, or closed position. The pilot’s helmet was located in the wreckage and seriously damaged by fire. The loader reported that the pilot was wearing the helmet throughout the morning’s flights, and it was therefore very likely he was wearing it at the time of the accident. The cockpit survivable space was relatively intact but severely burnt.
Previous occurrences
Occurrence involving VH-LIK
On 16 November 2015, the pilot of VH-LIK was conducting the ninth load of a spray job. There was 1,500 L of chemical in the hopper, and 400 L of fuel on board (about half fuel capacity). The pilot reported that the start of the take-off roll was normal – the first performance check point was reached with the tail wheel off the ground at approximately 400 m, the second check point at 600 m was achieved. At the 800 m mark, the pilot selected additional flap to try to get the aircraft to climb out of ground effect (break ground) and applied back pressure on the control stick. The aircraft failed to break ground so the pilot selected the dump lever and jettisoned the chemical load. The pilot descended onto the remaining airstrip and attempted to land, but the aircraft collided with a fence.
The operator reported that aircraft likely encountered windshear during the take-off run and once airborne. An engineering inspection found a faulty relay on the flap system such that the flaps could be raised but not lowered. In response to that accident, the operator implemented a periodic inspection for the flap relay to be replaced every 1,000 hours. Prior to that, the flap motors were routinely replaced at 450 hours but the relays were not routinely replaced, nor were they required to be.
On 1 March 1998, the pilot of VH-ODL was conducting a fire-fighting demonstration at an air show. The pilot started the drop run and at a height of about 40 ft, the load release commenced at, or close to, the maximum rate. During the load release, the nose of the aircraft pitched up and the aircraft entered a climb. On completion of the load release, the aircraft nose continued to pitch up and the climb angle increased. The aircraft climbed straight ahead for a short distance before commencing to yaw and roll to the left. The bank angle increased to a maximum of about 90 degrees, while the nose attitude dropped to almost horizontal. At about 450 ft and a very low airspeed, the aircraft rolled inverted and entered the incipient stages of an inverted spin. Recovery to controlled flight was not achieved and the aircraft impacted the ground inverted. The pilot sustained fatal injuries and impact forces and the ensuing fire destroyed the aircraft.
Among other findings, the investigation found that the flaps were fully extended (to 30 degrees), which could be selected by the pilot using either a switch mounted just below the throttle quadrant, or by a toggle switch mounted on the control stick. Experienced AT-802A pilots reported that it was possible to inadvertently extend the flaps by unintentionally activating the control stick switch. Extending the wing flaps resulted in a nose-up pitching moment.
200600851 Aircraft loss of control – 20 km SSW of Cootamundra, NSW, 16 February 2006, VH‑FVF PZL M-18A, Dromader
The pilot was fatally injured when the aircraft stalled and impacted terrain during fire-bombing operations. The pilot was an experienced agricultural pilot with previous fire-bombing experience, but had limited familiarity with the handling characteristics of the modified and heavily-loaded aircraft. The pilot had not jettisoned the load of retardant when the aircraft stalled. The ensuing loss of control occurred at a height that did not permit recovery before the aircraft collided with the ground.
Review of occurrence data
For the period September 2000 to September 2018, the ATSB identified 26 take-off accidents involving aircraft in agricultural operations, where inadequate aircraft performance was a factor. These included stalling shortly after take-off, tailwind conditions, and several occurrences where the pilot dumped or attempted to dump part or all of the hopper load. Three of the accidents resulted in serious injuries and another three in minor injuries.
Of the accident aircraft, at least 18 had take-off performance data available. Five involved AT-502 aircraft, which did not have published take-off performance data. Given that the majority of the accidents occurred in aircraft with performance data available, this suggests that a lack of performance data is not associated with an increased likelihood of take-off accidents. However, a lack of reference to performance data may have contributed to these accidents.
Having failed to gain any significant altitude, the aircraft clipped the top of a fence about 1,300 m beyond the start of the runway. The aircraft subsequently descended and collided with trees and the ground a further 700 m along the flightpath. Despite the impact and fire damage to the aircraft, there was no evidence of failure of the engine, or structural failure of the aircraft that may have contributed to the accident. The pilot was suitably qualified and experienced in low-level and agricultural operations and the investigation did not identify any preconditions with the pilot that may have contributed to the accident.
The investigation identified some operational factors that would have contributed to decreased aircraft performance during the accident flight. These included high outside air temperature and aircraft weight, tailwind conditions, combined with the flaps being retracted at some point prior to the impact. Apparently unable to maintain height, the aircraft descended into the trees. Although it is evident that the pilot attempted to dump the hopper load, which would have significantly improved the aircraft’s performance, no significant dump of the contents occurred. These factors are explored in detail below.
Aircraft performance
Aircraft weight
After refuelling, the estimated weight of the aircraft at the start of the accident flight take-off run was likely at, or about 70 kg above, the aircraft’s maximum demonstrated weight and within the aircraft’s centre of gravity fore and aft limits. The additional weight of the aircraft, due to refuelling after the previous load, would have comparatively lengthened the ground run, slowed acceleration, increased the stalling speed and reduced the rate and angle of climb. However, the aircraft had reportedly been operated at that airstrip previously at the same weight and in similar conditions and therefore the weight alone was not considered to have affected the performance sufficiently to have resulted in the accident.
Environmental conditions
Similar to the effect of aircraft weight, the 10 °C increase in temperature across the day’s operations would have resulted in a significant reduction the aircraft’s performance, including a 15 per cent increase in the length of the ground roll, for an equivalent weight, over that time.
The take-off distance and climb gradient would have been further increased by the effect of the probable tailwind. The aircraft was on the ground for 24 minutes before the start of the accident take-off. The pilot may not have been aware of the wind change as he was refuelling and refilling the aircraft and there was no fabric on the windsock frame. A gusty tailwind can cause sudden reductions in airspeed and increase the pilot’s workload to control the aircraft. There would have been an increase of 16 per cent in the take-off distance for a tailwind of 6 kt based on the wind conditions measured at Cryon, and a greater effect if the wind conditions were similar to those recorded at Walgett Airport and reported by a nearby witness.
Effect of retracted flap
The combined effect of the likely weight and local environmental conditions was considered in terms of overall effect on aircraft performance. There was no performance data available for the 502 aircraft. However, based on performance data for the 502B aircraft with the same engine model, there was sufficient runway distance available for the aircraft to take off with the estimated weight, temperature and density altitude, with the flaps extended 20 degrees. When the effect of the recorded average tailwind component was considered, there was still likely sufficient runway distance available for the take-off. Although if the aircraft encountered the witnessed stronger wind gusts during the take-off, this may have resulted in the ground roll extending to the fence.
The distance required to climb to a height of 50 ft above ground level was sufficient even at the highest likely aircraft weight, in nil wind, with the flaps extended to 20 degrees. However, with a tailwind of 6 kt (or more), the aircraft may not have achieved 50 ft by 2,000 m beyond the start of the runway – the distance at which the aircraft struck a tree. The recorded data identified that the aircraft was not climbing at that time, and that it struck the tree about 9 ft above the ground while descending.
In summary, the aircraft had reportedly taken off successfully at that airstrip on previous occasions, with similar weight and environmental conditions, with the flaps extended in the take‑off position of between 10 and 20 degrees. However, with the flaps retracted, as found at the accident site, the aircraft would likely have had insufficient take-off performance in the distance available.
While the evidence from the engine and propeller damage at the accident site indicated the engine was making significant power at the time of impact, a partial power loss that may have reduced the aircraft performance could not be ruled out.
Reduction of ground effect
According to the recorded data, the aircraft descended in the last 3–4 seconds while continuing to accelerate. This likely occurred as a result of diminishing ground effect.
After lift-off and before the aircraft reaches the best rate of climb speed, induced drag is nearly all of the total drag. Remaining in ground effect significantly reduces the induced drag. The normal take‑off technique for heavily loaded agricultural aircraft is to hold the aircraft in ground effect as it accelerates until the airspeed approaches the best rate of climb speed, which is the speed where the aircraft has the most excess power.
The best rate of climb speed for the likely weight of the aircraft was 91 kt indicated airspeed. The highest recorded groundspeed of about 93 kt was the last recorded interval on the accident flight. Assuming a 6 kt tailwind, the aircraft’s highest airspeed was about 87 kt immediately prior to impact, so it never reached the best rate of climb speed, and therefore the best available performance was not achieved.
As the aircraft approached trees, it effectively climbed gradually as the ground sloped away. This height above the ground resulted in the aircraft losing some of the benefit of ground effect – less than half the reduction in induced drag of that achieved near the ground. As the induced drag increased, the aircraft performance would have reduced, further reducing the excess power available to climb.
In discussing ground effect on take-off, the United States Federal Aviation Administration Airplane Fling Handbook (section 5-9 page 107) stated:
Due to the reduced drag in ground effect, the airplane may seem to be able to take off below the recommended airspeed. However, as the airplane climbs out of ground effect below the recommended climb speed, initial climb performance will be much less than at [best rate of climb speed] Vy or even [best angle of climb speed] Vx. Under conditions of high-density altitude, high temperature, and/or maximum gross weight, the airplane may be able to lift off but will be unable to climb out of ground effect. Consequently, the airplane may not be able to clear obstructions. Lift off before attaining recommended flight airspeed incurs more drag, which requires more power to overcome. Since the initial take-off and climb is based on maximum power, reducing drag is the only option. To reduce drag, pitch must be reduced which means losing altitude. Pilots must remember that many airplanes cannot safely take off at maximum gross weight at certain altitudes and temperatures, due to lack of performance.
With insufficient performance available to climb or maintain altitude, despite accelerating, the aircraft descended. The small margin above the stalling speed and low height above ground would have precluded any turn away from the trees ahead in the flight path, as an increase in bank angle would have increased the load factor and further reduced the margin.
Retracted flaps
With the flaps retracted, the stalling speed would have increased by about 10 kt. Retracting the flaps would also have increased the angle of attack to achieve the same lift coefficient. If the pilot was not aware the flaps were retracted, the higher nose attitude may have led the pilot to perceive the aircraft was climbing and would out-climb the trees. Several scenarios for when and how the flaps were retracted were considered.
The pilot may have omitted to extend the flaps prior to take-off due to oversight. Normal pre‑take‑off checks included that the pilot looks out to a mark on the left flap and checks the 10 degrees of extension prior to commencing take-off. However, some highly experienced pilots reported that they extend the flaps based on feel and, rather than looking outside to check, extend (or retract) small amounts of flap and assess how the aircraft responds.
Based on interviews with a number of pilots of Air Tractor aircraft, the ATSB assessed that the experienced pilot would have been well aware of the importance of flap for take-off with a heavily‑loaded aircraft. Therefore, he was unlikely to have commenced the take-off run if he knew that the flaps were retracted or would have quickly assessed that the weight was excessive for the conditions (and no flap) and dumped the hopper load.
The flaps may have been extended at the start of the take-off run but then retracted at some point during the flight. It was considered unlikely that the pilot would have deliberately retracted the flaps during the take-off, given his experience and knowledge of performance degradation that would have ensued. Previous occurrences have shown that it was possible to inadvertently retract the flaps using the flap stick switch however, there was insufficient evidence to determine if that occurred.
It was possible that the flaps may have suffered a technical failure. Failure of a flap relay or the flap motor, or jamming of the flap actuator would result in the flaps being stuck in whatever position they were in at the time of failure. The likelihood of this was reduced by the fact that the flap relay had been replaced after failing 12 months earlier and the flap motor had been replaced on schedule, 150 flying hours prior to the accident flight.
There was one known means for the flaps to retract uncommanded. That is, if the rubber coupling in the flap actuator perished (as per Air Tractor Service Letter 260), which should be inspected for during scheduled maintenance. The condition of the coupling prior to the accident was unable to be assessed, however, based on previous occurrences, the likelihood of this occurring was considered low.
Ultimately, there was no conclusive evidence to determine how and when the flaps were retracted. In any event, if the pilot was aware that the flaps were retracted, based on his experience he is very likely to have recognised the adverse effect on the take-off and climb performance, and dumped the chemical load.
Emergency hopper dump
If the aircraft is not achieving the required performance for take-off, particularly to clear obstacles in the flight path, the pilot can dump all or a portion of the hopper load and/or abort the take-off. When the pilot pushes the dump handle forward and the hopper door opens fully, the entire liquid load should jettison in about 8 seconds. Dumping the hopper load will significantly, and almost immediately, reduce the aircraft’s weight and increase performance. In the context that agricultural aircraft are often operated near their maximum capability, pilots should be prepared to dump the load if the expected performance is not realised during take‑off.
About 26 seconds after the start of the recorded data (50 kt groundspeed) there was an increased logging rate, but no activation of the spray ON discrete parameter. For this to occur, it was possible that the pilot moved the spray lever down, but not enough to activate the spray pressure switch or that the pilot moved the dump lever forwards slightly very briefly and then returned it to closed. Normal procedure was to take-off with the spray pump off, so activation of the spray lever would not result in any liquid dispersal. The ATSB analysed data from a test flight where the spray lever was activated with the pump off, and no Spray ON or increased logging rate occurred in the data. This indicated that the accident data was not consistent with the pilot inadvertently pushing the spray lever instead of the dump lever.
About 9 seconds before the recording ceased, the spray ON discrete parameter activated and the logging rate increased. The operator conducted a flight test by setting the unit to liquid (spraying) and then pushing the dump lever forwards to jettison the contents of the hopper during the take-off run and again in level flight. The data from the test flight exhibited the same characteristics of the accident flight. The Satloc manufacturer advised that the accident and test dump data is consistent with the pilot pushing the dump lever forward far enough to activate the micro-switch. The data was therefore consistent with one positive dump handle micro-switch activation during the accident flight.
This indicated that the pilot pushed the dump handle forward far enough to activate the micro‑switch, in an attempt to jettison at least a portion of the hopper load. However, the recorded data did not show any significant aircraft performance improvement at the time the micro-switch activated (or at any time during the flight), and the airspeed and groundspeed continued to increase at a comparable rate to the previous six flights. In addition, there was no evidence of chemical residue other than at the main wreckage site. Based on those factors, it was determined that, at most, only a small amount of liquid was jettisoned.
The ATSB considered the following potential factors contributing to why that may have occurred.
Timing of the micro-switch activation
The micro-switch activation consistent with the pilot initiating a jettison of the hopper contents occurred 35 seconds after the data started recording and about 5 seconds after the aircraft clipped the fence. The delay in the pilot’s initiation of the dump may have been due to the pilot experiencing high workload controlling the aircraft in gusty conditions.
The pilot may also have expected that the aircraft would fly when it accelerated to 80 kt. About 40 seconds into the recorded data, the derived airspeed (based on a tailwind of 6 kt) reached 85 kt, and although the speed continued to increase, the aircraft then started to descend. A number of AT-502 pilots reported that once the airspeed reached 80 kt (with the take-off flaps extended) the aircraft would normally climb away and this may have also been the pilot’s expectation, particularly if he was unaware that the flaps were retracted.
Hopper door malfunction
The aircraft manufacturer advised that there was no known malfunction of the dump lever that would have prevented a successful dump and that the mechanical jettison system had never been known to fail. Despite this, the data indicated that the pilot pushed the lever far enough forward to activate the micro-switch, which would ordinarily effect a hopper dump. Therefore, while a detailed examination of the dump system functionality was not possible due to accident damage, a technical failure or malfunction could not be ruled out. The effect, if any, that the apparently unapproved modification of the dump mechanism had on the ability to jettison the chemical could not be determined.
Hopper dump mechanism checks
Civil Aviation Advisory Publication (CAAP) 42B-1(1.1), January 2016, stated that the manufacturer’s maintenance schedule is generally more appropriate than the alternative Civil Aviation Safety Authority (CASA) maintenance schedule. However, in this instance, the aircraft’s system of maintenance (in referencing the aircraft flight manual and owner’s manual) was less specific than the CASA alternative in relation to required daily or scheduled inspection of the dump mechanism and controls.
The reason for the unsuccessful hopper dump was unknown, as was the extent of any pre-flight or periodic inspections leading up to the accident. Therefore, the potential influence of dedicated checks of the dump system in this occurrence could not be established. Nevertheless, daily and scheduled inspections do provide an established and effective means of providing improved assurance around component and system integrity. Additionally, the majority of aeroplanes used in agricultural operations rely on operation of the dump mechanism to reduce weight if there is insufficient available performance.
Take‑off performance
Successive approvals to operate the AT‑502 aircraft at weights higher than that originally certified indicate that the aircraft is often operated at the upper end of its load capacity. That situation increases the risk that the aircraft may not have adequate take‑off performance for certain weight/operating conditions. This has been partially recognised by publication of a revised stall speed associated with the Type Certificate Data Sheet that demonstrated safe operation of the aircraft at weights 877 kg (27 percent) higher than the originally‑approved limit. However, and although not required, that approval was not accompanied by access to performance data to assess the runway length required to take off for given aircraft weights/environmental conditions.
A review of performance‑related accidents involving agricultural aircraft identified that performance data was available for the overwhelming majority of the involved aircraft. While that indicated that the absence of performance data for the AT‑502 was not itself a safety issue, it did indicate that this important source of planning information may not be widely used during agricultural operations.
The majority of agricultural aircraft have the advantage of a dump mechanism to rapidly reduce weight if the pilot assesses that there is insufficient available performance during the take‑off. While this does provide some mitigation, pilots may still be exposed to degraded performance situations, with the associated risk that control of the aircraft may be lost before the load can be jettisoned. Past performance‑related accidents have demonstrated this does occur. All of the aircraft involved in the 26 accidents reviewed by the ATSB had the capacity to jettison the load however, in all cases this either did not commence or the dump was unable to prevent the accident.
As environmental conditions change throughout the day, take-off performance can change significantly. In addition, variations in runway surfaces used in agricultural operations can also significantly affect the required runway distance required. For those reasons, pilots need to monitor changes in operating conditions and use all means to assess the effect on the aircraft’s performance. These include the use of experience, local knowledge and published take‑off data (including documented take‑off configuration).
The Australian Aerial Application Association’s Aerial Application Pilots Manual advises pilots that:
if you are operating off an unfamiliar strip, always take a light load first time and then build up gradually to a load that is heavier but still safe.
Further, the manual reminds pilots that environmental conditions will change throughout the day and the pilot must constantly monitor these.
Findings
From the evidence available, the following findings are made with respect to the collision with terrain involving an Air Tractor AT-502 aircraft, registered VH-LIK, which occurred at an agricultural airstrip 50 km east of Walgett Airport, New South Wales, on 5 November 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The flaps were either never extended, or were retracted at some point during the take-off sequence. This probably resulted in insufficient take-off performance when combined with the high aircraft weight and environmental conditions. The ATSB could not determine at what point during the take-off the flaps were retracted.
The pilot attempted to jettison the hopper contents but no significant dump of the chemical occurred and therefore the associated performance gains were not realised. It could not be determined why the load did not dump.
The aircraft reached a height above the ground where the reduced benefit of ground effect further reduced the aircraft's performance, at a height and airspeed which precluded the pilot from turning the aircraft towards a clear area. This probably resulted in the aircraft descending into trees.
Other factors that increased risk
There was no evidence of appropriate approvals for the modification to the hopper gate box push rod.
There was no performance data available for the AT-502 aircraft to calculate the required departure runway length.
The aircraft was operated under a Civil Aviation Safety Authority‑approved system of maintenance that did not explicitly require a daily or periodic inspection of the hopper dump system.
Safety issues and actions
The ATSB did not identify any organisational or systemic issues that might adversely affect the future safety of aircraft operations. However, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.
Air Tractor
As a result of this occurrence, Air Tractor advised the ATSB that the following inspection will be added to the maintenance section of the owner’s manual, to be completed every 100 hours:
Check gatebox controls and emergency dump controls for proper function and adjustment. Check all components and hardware for condition, wear, and/or cracking.
This requirement will apply to all three types of emergency dump system that can be fitted to Air Tractor aircraft.
Additional details
Pilot details
Licence details:
Commercial pilot (aeroplane) licence issued 24 February 2015 (first issued 4 September 1990)
Relevant ratings and endorsements:
Aircraft ratings and endorsements:
Class ratings: single and multi-engine aeroplane Design feature endorsements: gas turbine engine, tailwheel undercarriage
Operational ratings and endorsements:
Aerial application rating aeroplane (day and night)
Low level rating
Medical certificate:
Class 1 valid to 22 December 2016; Restrictions: none
Aeronautical experience:
9896.8 hours at the start of the accident day
Last flight review:
7 June 2016
Aircraft details
Manufacturer and model:
Air Tractor Incorporated AT-502
Year of manufacture:
1990
Registration:
VH-LIK
Serial number:
502-0115
Total Time In Service
13150.6 (at last inspection 15 October 2016)
Type of operation:
Aerial work – Aerial agriculture
Persons on board:
Crew – 1
Passengers – 0
Injuries:
Crew – 1 Fatal
Passengers – N/A
Damage:
Destroyed
Sources and submissions
Sources of information
The sources of information during the investigation included:
recorded meteorological information
the Civil Aviation Safety Authority
Satloc US
Air Tractor US
the aircraft operator and operator records
a number of Air Tractor pilots
the aircraft maintainer and maintenance records
the pilot’s medical records and logbook.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the aircraft operator, aircraft maintainer, Civil Aviation Safety Authority, Air Tractor via the United States National Transportation Safety Board, Bureau of Meteorology, and a number of Air Tractor pilots.
Submissions were received from the aircraft operator, the Civil Aviation Safety Authority and the aircraft manufacturer. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 29 October 2016, an Airbus A320 registered VH-VQC, approached Gold Coast Airport, Queensland, prior to operating Jetstar flight JQ407 from Gold Coast to Sydney, New South Wales.
In preparation for the aircraft’s arrival, the ground crew leading hand checked whether the pit load sheet[1] from the previous destination had arrived. This would allow the crew to be better prepared to unload the aircraft. As it had not, the leading hand went to assist loader operator 1 in preparing the bay for the aircraft’s arrival.
At about 1050 Eastern Standard Time (EST), 20 minutes before the aircraft’s arrival, the leading hand received a call detailing the requirements for the aircraft. These requirements included two lifts for passengers who could not board the aircraft using the portable stairs, a non-standard toilet clean and an aircraft water top up. The ground crew were also advised that the aircraft would arrive 3 minutes later than scheduled.
About 7 minutes prior to the aircraft’s arrival, the leading hand again checked whether the pit load sheet had arrived, it had not.
Once the aircraft arrived, the leading hand estimated the unloading would require three dollies[2] and retrieved the dollies to unload the aircraft. Loader operator 1 unloaded containers from positions 41, 42, and 32 (Figure 1). Both loader operator 1 and the leading hand assumed only three containers needed to be unloaded.
Figure 1: Aircraft hold positions (with position 31 highlighted)
Source: Operator (modified by the ATSB)
After unloading, the loading procedures require a check of the aircraft hold to confirm if there are any containers remaining in the hold. The loader operator 1 reported checking the hold, however as they were walking towards the hold door, watching their footing, they did not detect a container in position 31. The leading hand witnessed loader operator 1 checking the aircraft hold and assumed all containers had been unloaded.
Loader operator 1 then turned the loader around, and unloaded the container in the front of the aircraft (which was staying on the aircraft) and reloaded it at position 11. During that time, they inadvertently put the yellow copy of the underfloor load advice (ULA) [3] sheet in their pocket, rather than on the clipboard as is required. As loader operator 1 repositioned the loader at the rear of the aircraft, they received the request for a passenger lift, and they left the loader, to organise the lift. After organising the lift, loader operator 1 went to complete the clean of the two rear toilets, which took between 5–10 minutes. At the same time, loader operator 2 assisted with the aircraft water top up.
After cleaning the aircraft’s toilets, loader operator 1 observed loader operator 2 on the loader continuing the loading process. Loader operator 2 presumed that loader operator 1 had started the loading process and had already loaded a container in position 31. They loaded containers in position 42 and 32, using the information on the container destination cards, as they did not have the yellow ULA copy, and ensured all the locks were engaged. Loader operator 1 then completed the yellow ULA copy using the bingo cards,[4] but they were not aware of the container at position 31.
The leading hand observed loader operator 2 entering the rear hold and assumed that they were checking the locks, which they were doing. As the leading hand had previously worked with the loader operator, they trusted them to have completed the lock check.[5] Loader operator 1 signed the yellow copy of the ULA and handed it to the leading hand for crosschecking. The leading hand checked the yellow copy against their white copy. As both copies matched, they assumed the aircraft was loaded correctly.
The leading hand then proceeded to the flight deck to hand the paperwork to the captain and confirmed that all locks had been engaged.
While pushing the aircraft back, the leading hand received a call advising that the aircraft had been correctly loaded for the previous flight in Cairns and that 20 bags had been reported missing. The duty manager also contacted the leading hand to confirm if all containers had been unloaded, which the leading hand confirmed.
After the aircraft departed the bay, the leading hand and loader operator 1 considered the possibility that a container may have been left on the aircraft. They recalled that all areas had been checked. The leading hand contacted loader operator 2 assisting on the loader who confirmed that there was a container in position 31, however they assumed it had been loaded prior to them taking over the loading of that hold. The duty manager contacted company personnel in Cairns, who provided a pit load sheet for the previous flight. The pit load sheet confirmed there was a container in position 31 with 40 bags that should have been unloaded at Gold Coast Airport.
At about 1230 EST during the cruise, the flight crew received an aircraft communications addressing and reporting system (ACARS) message advising that there was an extra container in position 31. The container weighed about 360kg and had not been included in the aircraft take-off performance calculations.
Prior to being advised of the extra container, the flight crew determined the aircraft take-off weight to be 62,844 kg and the take-off trim[6] position to be 0.4 degrees nose down. After being advised of the extra container, the flight crew recalculated the aircraft weight and trim to be 63,204 kg and 0.5 degrees nose down. The recalculated weight and trim showed that the aircraft was within all weight and balance limitations.
The flight proceeded to Sydney without further incident.
Loading procedures
Jetstar’s ground operations procedures include the following steps:
All compartments must be checked and confirmed as empty, including the bulk hold, on all arrivals after unloading.
If a position in the cargo hold is labelled as ‘Nil fit’ (empty), then the loader operator is required to inspect the position. The leading hand is then required to visually inspect the nil fit positon and initial the loader copy to show it has been inspected.
As containers are progressively loaded, the loader operator must notate on the ULA container serial number, destination, contents, and tick loaded and locks up.
Leading hand comments
The leading hand provided the following comments:
It is unusual for a loader operator to complete a different task.
The leading hand and two loader operators had worked together previously. This led to a lot of trust within the group.
At the time, there were also two off-schedule aircraft being handled. This resulted in no extra staff being available to assist with the servicing of the aircraft.
The other tasks to be completed (lift, water top up, and toilet clean) during the unloading had taken a lot of time and created pressure, which may have led to short cuts being taken.
They had not come across through-freight before, normally they just take all containers off the aircraft. This particular through-freight needed to have the destination card completed and this created a distraction.
When they realised that loader operator 2 had not been using the yellow ULA to load the aircraft, they considered unloading the aircraft and restarting the loading process. As they were already running late, they decided against this.
They were experiencing personal issues on the day, but does not believe they were contributory to the incident.
Loader operator 1 comments
Loader operator 1 provided the following comments:
Normally when they operate as loader operator, they have always fully loaded or fully unloaded the aircraft.
During unloading, if you are standing at the controls of the loader you cannot see position 31, only part of 32, and positions 41, and 42. It is only when you walk into the compartment door, or stand on the very edge of the loader at the door are you able to see position 31.
They were feeling fatigued on the day due to a lack of, and poor quality sleep the previous night. They were also feeling a little dehydrated at the time.
Captain’s comments
The captain provided the following comments:
The pilot flying commented that during the take-off, they did not notice any unusual aircraft behaviour and did not detect the incorrect trim setting.
They had used a higher take-off weight than required, to allow for last minute adjustments in the passenger loads. This meant that the extra weight did not have much effect on the flight.
Ground handling operator internal report
The ground handling operator internal report found the following:
Initially, loader operator 1 was not aware that loader operator 2 had commenced the loading as they were still cleaning. Therefore, they did not offer the yellow copy of the ULA.
There was a revision to the Standard Underfloor Load Advice Procedures for both leading hand and loader operators to commence from 13 October 2016. One of the changes was that loader operators are to complete the yellow ULA copy progressively as containers are loaded. This was not adhered to during the loading process.
Previous occurrences
A search of the ATSB database of previous loading related occurrences involving incorrect load or weight on the aircraft were detected, particularly when crew were under time pressures and procedures were not followed to resolve discrepancies:
8 May 2014: During unloading, unmanifested baggage in the front hold of the aircraft was detected from the previous flight. The dispatcher did not check the front hold due to time pressures from the short turnaround times.
Loading related event, Bali, Indonesia, 26 May 2014 (ATSB investigation AO-2014-110)[7]. A Boeing 737 aircraft was being loaded at Bali Airport for a flight to Melbourne, Victoria. Due to the time restrictions, the ground staff were unable to load all of the bags for the flight before aircraft had to be prepared for departure. The load controller assessed that a total of 93 bags had been loaded and the flight documents produced were using that figure. About 30 minutes after the aircraft departed Bali, the ground handler advised network operations and load control that the final baggage numbers were incorrect. The total number of bags loaded onto the aircraft was 189 instead of 93, which an estimated additional weight of about 1,600 kg. Prior to loading, the ground crew were under time pressure due to the flight already being delayed, breakdown of baggage belt, and scheduled closure of the runway and impending airport curfew.
Loading event, Sydney Airport, NSW, 8 September 2016 (ATSB investigation AO-2016-119)[8]. An Airbus A320 was being loaded at Sydney for a flight to Brisbane, Queensland. The leading hand received the deadload weight statement (DWS) and checked the containers. The third container number (1483) did not match the number listed on the DWS (4183), nor the container card (4183). The leading hand assumed that the freight handler had inadvertently transposed the numbers incorrectly and amended the card and DWS with 1483 and continued loading. When the aircraft was unloaded in Brisbane, it was found that the incorrect container (1483) was delivered and was nearly 650kg heavier than container 4183. The loading procedure if the DWS is incorrect, is that the container must not be loaded onto the aircraft. The leading hand noted that the short turnaround time and the flight was the last one of the day led to procedures being bypassed.
Loading event, Brisbane Airport, Qld, 19 October 2015. During boarding, the flight crew were notified of a discrepancy between passenger numbers, but later advised the issued had been resolved. After the passenger count during the flight, it was found that the aircraft departed with 16 more passengers than advised. The investigation is continuing.
Safety analysis
The first step in the ground handling operator’s aircraft loading procedures involve obtaining a pit load sheet, if available. If the load sheet is not available, then the ground crew can contact the ground operations controller. The ground crew attempted to contact the ground operations controllers, but they were unavailable at the time of this occurrence. These are the only two sources that can provide accurate load information. The investigation was unable to determine why the pit load sheet was not provided.
After unloading, all compartments are to be checked and confirmed as empty. Loader operator 1 did check the hold, but did not see the container in position 31. The leading hand witnessed loader operator 1 checking the hold, but did not check the hold themselves.
Loader operator 1 had commenced the loading and was called away with the yellow ULA copy in their pocket, as opposed to on the clipboard in the loader per normal. Because loader operator 2 continued the loading process, they assumed that any containers on the aircraft had been pre-loaded. This assumption was reinforced as the yellow copy was with loader operator 1. Therefore, load operator 2 completed the loading without the yellow copy and did not complete the sheet as containers were loaded. There was also no communication between the two loader operators on how much of the task had been completed.
When a position is identified as empty on the ULA, the loader operator and leading hand are to check the position is empty and initial it on the yellow copy. The loader operator 1 had commenced the loading process but did not complete the process, nor did they check all the containers once they had been loaded. The leading hand also did not check position 31 though it was marked as empty.
On that day, the ground crew were required to complete additional tasks, including putting in a lift, toilet clean, and water top up. Ordinarily, the leading hand would have asked another team to complete the toilet clean in order to keep the loader operator on that task. It is unusual to have a leading hand complete a different task. The leading hand did call for assistance, but as there were two off-scheduled aircraft also being turned around at the time, no assistance was available Furthermore, the leading hand reported feeling rushed because of the extra tasks to be completed during the 30-minute turnaround, and this contributed to the checks not being completed.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The lack of loading documentation received at the Gold Coast resulted in the ground crew not knowing the number of containers to be off-loaded from the aircraft. Loader operator 1 did not detect the container in position 31 as they checked to ensure the hold was empty.
The loader operator and leading hand did not adequately check the containers during the loading process, leading to the container in position 31 not being noticed.
The individual conducting the loader operator role changed during the loading of the aircraft, which likely led to a misunderstanding of how much of the loading had been completed.
The ground crew had additional tasks to complete during the unloading and a smaller ground team than normal, which led to the hold not being checked adequately.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Ground handling operator
As a result of this occurrence, the ground handling operator has advised the ATSB that they have taken the following safety actions:
Ground handling operator’s safety communications
The loader operator procedures have changed to include the following requirements:
Physically touch each bulkhead wall after unloading is completed, to ensure no containers are left inside the aircraft.
If there is no leading hand present, then no movement by the loader machine including unloading/loading will be undertaken.
If there is no yellow ULA, then no loading is to be completed.
Yellow ULA must be completed as each container is loaded
Yellow ULA must be handed to the leading hand for cross checking before the white ULA is taken to the crew.
Standardised communication between loader operators and leading hand to confirm that all containers have been unloaded.
The leading hand is to conduct a mandatory visual check to ensure unloading has been completed before any loading commences for the new outbound flight.
Safety message
This incident highlights the effect time pressures and workload can have during loading operations. The ATSB report: Aircraft loading occurrences - July 2003 to June 2010 found that one reason unlisted cargo was loaded into an aircraft was time pressure where late arriving inbound traffic left little time for loading. This pressure is increased when airlines are under internal and external pressures to meet timeframes.
Overall, this investigation emphasises the importance of adhering to procedures during the completion of tasks and communication between fellow colleagues, particularly if there is a role changeover.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Since September 2016, the ATSB has received several reports of contaminants being identified in Jet A1 drum stock fuel around Australia. The contaminant was a white, stringy, rubbery substance, varying in size and shape from 10-20 mm to as small as 1-2 mm. An operator first identified the contamination in Queensland through visual inspection of fuel drums. Subsequent fuel pump filter inspections revealed that the filters had trapped further contaminants prior to it entering the aircraft’s fuel system. No contaminants were found in any aircraft exposed to the fuel.
Contaminated drums were filled by different refuelling companies but were manufactured by the same company, VIP Packaging. Batch numbers and manufacturing dates on the drums across the incidents did not show any correlation.
What the ATSB found
The ATSB determined that the contaminant was a sealant used by the drum manufacturer on the lid and base of the drums. The sealant’s mechanical properties were found to degrade when exposed to solvents such as Jet A1 fuel. This, in combination with vibration and drum deformation during transport, likely caused pieces of the sealant to enter the fuel within the drum.
Filtration during the refuelling process appeared to be effective in preventing contaminants from reaching the aircraft and there was no evidence that the sealant dissolved in the fuel.
Safety message
Fuel sourced from drum stock is particularly susceptible to contamination. However, there are a number of ways to minimise the likelihood of using contaminated fuel. These include:
applying appropriate drum handling and storage methods
visually inspecting drums for contaminants prior to refuelling activities
regularly inspecting fuel pump filters
conducting fuel drains from the aircraft after each refuel for visual inspection.
The following publications provide useful information to pilots, operators, and refuellers regarding the use of drum stock:
Civil Aviation Order 20.9 titled Air service operations – precautions in refuelling, engine and ground radar operations; available from the Federal Register of Legislation.
Safety on the ground provides advice on refuelling from a drum, and on the correct way to store a fuel drum; available from the Civil Aviation Safety Authority’s website.
CASA Safety Video – Drum Refuelling provides an overview of safe refuelling practices using drum stock; available from the Civil Aviation Safety Authority’s YouTube channel.
The occurrence
What happened
In September 2016, the ATSB received a report from a helicopter operator regarding contaminated drum stock fuel in Cloncurry, Queensland. One of the operator’s pilots observed white particles floating in Jet A1 fuel while inspecting one of several recently arrived drums. The same contaminant was subsequently found in all seven of the drums that were opened and inspected. Similar contaminants were found in the fuel filtration system of the drum transfer pump.
All of the drums appeared to be new, and came from the same manufacturer, VIP Packaging. One of the contaminated drums was manufactured less than a month prior to the incident. The refueller was informed of the contamination and recalled all 50 of the drums that had been recently supplied to the operator.
In October 2016, the same operator reported that it had found four more drums containing the same type of contaminant near McKinlay, Queensland. The contaminants were observed during visual inspection of the drums and ranged in size from 1-2 mm to 10-20 mm in length (Figure 1). These drums were also manufactured by VIP Packaging. Date stamps on the fuel drums showed that they were all manufactured at different times. The operator noted that the drums had been previously used, cleaned, and refilled by the refuelling company with no evidence of contaminants.
Figure 1: Contaminant removed from the drum
Source: Operator
In April 2017, the same operator reported drum stock contamination at two remote airfields in Western Australia. The majority of drums inspected were reported to contain the same sort of contaminant. The contaminant was described as small pieces of white debris and tended to settle at the base of the drum. The contaminant was most easily detected when the fuel was stirred well and then allowed to settle, causing the contaminant to collect at the centre of the drum’s base.
The drums in Western Australia were filled by a different refuelling company but supplied by the same drum manufacturer. The drums had various manufacturing dates, including some produced less than a month prior to the observed contamination. On 10 June 2019, the same operator reported 20 more VIP drums with various levels of contamination. The filters within the drum transfer pump also contained white contaminants.
At the time of publication, every reported instance of this type of contamination involved Jet A1 fuel. Additionally, there have been no reports of the contaminant entering an aircraft’s fuel system.
Context
Drum fuel filtration
Fuel drums are often used as a means of transporting and storing fuel in remote areas and for smaller operations, where using fuel trucks or bulk storage is not practical.
The requirements for refuelling aircraft using ground stock is outlined in Civil Aviation Order 20.9. With regard to drum stock fuel, the following applies:
All fuel shall be strained or filtered for the removal of free or suspended water and other contaminating matter before entering the aircraft tanks.
There are no other regulations pertaining to the state of the drum, however the following broader guidance is available on safe drum refuelling practices:
Safety on the ground provides advice on refuelling from a drum, and on the correct way to store a fuel drum; available from the Civil Aviation Safety Authority’s website.
The CASA Safety Video – Drum Refuelling provides an overview of safe refuelling practices using drum stock; available from the Civil Aviation Safety Authority’s YouTube channel.
Refuelling systems that use fuel drums typically have multiple types of filtration. Refuelling systems used in these occurrences had the following:
A coarse ‘rock catcher’ filter made from rigid wire mesh located immediately downstream of the fuel drum. This removed larger contaminants and protected the refuelling pump.
A micronic pre-filter – a cylindrical filter made from pleated fabric – prevented fine contaminants and water from being uplifted to the aircraft.
Contaminant description
The white, stringy material was observed in the Jet A1 fuel drums in each instance of contamination. Figure 2 shows the largest of these contaminants.
Figure 2: A large contaminant observed at the base of a drum of Jet A1 fuel
Source: Operator, modified by ATSB
On several occasions, contaminants were also found within the fuel filtration system of the pump used for fuelling aircraft. Several pieces of the white contaminant can be seen in the coarse filter shown in Figure 3.
Figure 3: White contaminants in the ‘rock catcher’ – part of the fuel pump system
Source: Operator, modified by the ATSB
Contaminants were also found beyond the ‘rock catcher’, such as in the micronic pre-filter seen in Figure 4. This filter was from a fuel pump involved in the April 2017 occurrence and was provided to the ATSB for examination. Figure 5 shows contaminants removed from the same filter. These rubbery contaminants appeared too large to pass through the upstream coarse filter, as well as the mesh surrounding the filter shown in Figure 4. Assuming the filters were all functioning properly, the large contaminants found in the pre-filter were likely the result of many small pieces (less than 1 mm) coalescing into a larger piece. Other small contaminants (such as dirt and metal) were found within these larger pieces (Figure 5). The smaller pieces were not identified in the fuel drum, most likely because they were too small to be visually observed.
Figure 4: Micronic pre-filter containing contaminants from April 2017
Source: ATSB
Figure 5: Contaminants removed from a pre-filter involved in the April 2017 occurrence
Source: ATSB
Drum manufacturing
VIP Packaging is the only Australian manufacturer of fuel drums. All of the drums in the occurrence were the same type – a stainless steel drum with rolled seams on the lid and base. The drum parts were manufactured in Victoria, but the drums were assembled at different facilities in Queensland and Western Australia. A bead of sealant was added onto the lids and bases of each drum before being transported for assembly.
The assembly process involved rolling the lid/base and the barrel of the drum together to create a sealed vessel with a cylindrical lip on the top and bottom to add rigidity (Figure 6).
Figure 6: Cross section of a drum's triple seam
Source: Henkel
Previous instances of fuel contamination
In 2015, a refueller in Western Australia reported an instance of fuel contamination to the Civil Aviation Safety Authority. The contamination was discovered by an operator in the Kimberley region. The drums were also supplied by the same manufacturer. Contaminants were found in drums as well as filters in the refuelling system. The refueller arranged to have the material tested and found that the contaminant was consistent with the sealant used on the lids and bases of the fuel drums manufactured by VIP Packaging. The refueller published a customer alert identifying the contaminant as drum sealant, and urged customers to inspect their drums, filters, and strainers for any evidence of the contaminant. Figure 7 shows a comparison of the contaminant found in the ‘rock catcher’ filters in 2015 and the most recent occurrence in 2017.
Figure 7: A comparison of the white contaminant found in 2015 and in April 2017
Source: Refueller, Operator
The refueller reportedly brought the issue to the attention of the drum manufacturer, who sent them a batch of new drums manufactured in a different factory. However, the refueller found the new drums had the same contamination present.
Drum manufacturer’s response
As a result of the 2015 occurrence, the drum manufacturer reportedly increased their inspections of the fabricated drums and acquired a probe to check inside the empty barrels before sale. This check was meant to ensure that no sealant was visible within the drum, since it should all be trapped in the seam between the barrel and lid/base. The bead of sealant was also moved closer to the edge of the lid/base to reduce the likelihood of any sealant entering the drum. It was also reported that instead of shipping the lids, bases and barrel of the drum to be assembled at other facilities, the manufacturer started shipping some drums fully fabricated from their manufacturing facility in Victoria.
The manufacturer reported being unsure how the contaminant, whether it was drum sealant or otherwise, was entering the drum. They suggested that contamination by drum sealant could be caused or exacerbated by drum handling and noted that transport to remote airports could cause drum damage from high temperatures as well as rough and corrugated roads. One of the refuelling companies involved also believed that the contaminants might be associated with the forces resulting from transport. One drum that had been returned to VIP with reported contaminants showed signs of physical deformation consistent with mishandling. A cross section of the drum revealed that the gap had opened up between the base and sidewall.
Sealant interaction with fuel
The ATSB sought to determine whether the sealant interacted physically and/or chemically with Jet A1, and whether a combination of handling and temperature could degrade the sealant.
A drum base was provided by the manufacturer in order to test the behaviour of the sealant in Jet A1. The base had a bead of sealant applied around its circumference, which was removed for testing. The removed sealant exhibited the behaviour of a piece of thin, elastic tape (Figure 8).
Figure 8: A section of sealant removed from a drum base.
Source: ATSB
Pieces of sealant were taken from the base, immersed in Jet A1, and exposed to:
room temperature without agitation
periodic heating to 50C without agitation
periodic heating to 50C and agitation by a magnetic stirrer bar
an ultrasonic bath for one hour.
A sample of the sealant was also immersed in water, as an experimental control.
It was found that after 24 hours of immersion in Jet A1, the appearance and properties of the sealant changed noticeably. Specifically, the:
width of the sealant increased by approximately 50 per cent
extension to failure dropped from ~250 per cent of original length down to less than 20 percent
sealant became friable when held.
Temperature had no noticeable effect on the sealant, but agitation by the stirrer and the ultrasonic bath both caused the sealant to degrade. The stirrer caused the sealant to break into pieces of varying sizes, while the ultrasonic bath liberated very fine particles from the single piece of sealant (Figure 9). When the sealant was removed from the Jet A1 and dried, the appearance and properties appeared to return to normal. There was insufficient evidence to suggest the sealant dissolved in Jet A1. When immersed in water, the sealant did not appear to change properties or appearance at all.
Figure 9: A piece of sealant after immersion in Jet A1 fuel and ultrasonic agitation
Source: ATSB
Once properly dried, the sealant’s properties returned to normal. Therefore, it was concluded that the interaction between sealant and Jet A1 was primarily physical rather than chemical. The substantial change in the width of the sealant suggested that Jet A1 was being temporarily absorbed into the material, causing the change in properties.
In response to these findings, the sealant manufacturer stated the following:
Drum and can sealants are designed to be tightly bound within a metal seam of the drum. This keeps them largely protected from drum contents… Can sealants are not designed for direct exposure to solvents and must be incorporated into a correctly formed drum seam.
The manufacturer also stated that the drum sealant it supplied had been used in Australia for approximately 45 years without issue.
Safety analysis
There have been several occurrences of white contaminants found in refuelling systems’ fuel pump filters and fuel drums, all involving drums from the same manufacturer. Photos and descriptions of the contaminants indicated that they were all a similar material and also similar to instances of drum contamination identified in 2015. At that time, the contaminant was tested and found to be sealant from the base and/or lid of the drums.
Experiments carried out by the ATSB demonstrated that the presence of Jet A1 fuel adversely affects the sealant used in the drums. The sealant manufacturer confirmed that the sealant is not designed for exposure to solvents such as Jet A1, and must remain in the drum seam to be effective. After being immersed in Jet A1, vibrations caused the sealant to break down into very fine particles. This result is consistent with the contaminants reported in the fuel transfer pumps’ coarse (‘rock catcher’) and micronic pre-filters. Large pieces were caught by the ‘rock catchers’, while very small pieces passed through and coalesced on the pre-filter. There was no evidence to suggest that the sealant was dissolving in Jet A1, so the properties of the fuel should not be affected by the sealant.
VIP Packaging believed transport on rough roads could lead to deformation of the drums. In particular, a gap can open up between the barrel and base/lid of a drum. Coupled with vibrations associated with transport, this deformation may have allowed pieces of sealant to escape the seam and enter the fuel.
There have been no reported instances of this contaminant affecting the performance of an aircraft, or entering an aircraft’s fuel system. In every instance of contaminated fuel, adequate fuel filtration caught the contaminant. It is possible that the sealant may break down into small enough pieces to pass through the micronic pre-filter and reach the aircraft’s fuel tank, and from there pass through the aircraft’s fuel filtration system and enter the engine. However, if that was to occur, the particles would be in minor quantities and too small to affect engine operation. As long as fuel is filtered as required under the regulations, and in accordance with best practice, harmful contaminants should not be able to reach the aircraft.
Findings
From the evidence available, the following findings are made with respect to the fuel contamination issues observed at Cloncurry Airport, Queensland and in Western Australia in 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
Interaction with Jet A1 and rough handling likely caused pieces of drum sealant to detach and enter the fuel stock, increasing the risk of contaminants entering an aircraft's fuel system.
Other findings
Adequate fuel filtration in accordance with regulations and best practice should prevent contaminants from entering aircraft.
There have been no reported occurrences of this contaminant entering an aircraft’s fuel system or affecting the performance of an aircraft.
Sources and submissions
Sources of information
The sources of information during the investigation included:
a number of helicopter operators and refuelling companies
the fuel drum manufacturer
the Civil Aviation Safety Authority.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the fuel drum manufacturer, the sealant manufacturer, the involved operators, refuelling companies and the Civil Aviation Safety Authority.
A submission was received from the sealant manufacturer, which was reviewed and, where considered appropriate, the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 25 October 2016, at about 0640 Central Daylight-saving Time (CDT), an Embraer-120 ER aircraft, registered VH-YEI (YEI), departed from Adelaide Airport, South Australia (SA), for a chartered passenger flight to Challenger, SA with 4 crew and 29 passengers on board.
During the initial climb, the pilot attempted to fully retract the flaps (flaps 0) from their take-off position (flaps 15). The crew received a flap disagreement warning from the outboard pair of flaps. The other two pairs of flaps (inboard and nacelle) retracted without issue. A flap disagreement fault is triggered when one flap within a pair is unable to move to its selected position. To prevent wing asymmetry and control issues, the pairing flap will also not move. The crew reported no noticeable aircraft handling or control issues as a result.
The crew contacted air traffic control (ATC) to notify them of the fault and requested a climb to 4,000 ft on their current heading. After levelling off and reducing power to a cruise setting, the crew consulted the quick reference handbook, which advised cycling the flaps to their original position and back again. The fault cleared when the flap control was lowered to 15 degrees but occurred again upon retraction.
The captain and first officer discussed the situation and agreed to return to Adelaide. The crew then informed ATC. The first officer continued flying the aircraft, burning off fuel to reduce landing weight. The captain conducted the landing calculations and determined that they had sufficient runway to land with flaps 15, in case they were unable to deploy further.
During approach, the flaps fully extended (flaps 45) and the aircraft landed without further incident. The flaps were retracted after landing, and all three pairs moved to flaps 0 without the fault reoccurring. The crew visually inspected the flap and immediately identified a damaged bracket and fibreglass shroud.
There were no injuries as a result of the occurrence and the aircraft sustained no damage beyond the fractured bracket and shroud.
Component Failure
The failed bracket secured a roller to the underside of the wing. This roller supported the inboard side of the left-hand outboard flap shroud and was used to guide the flap shroud as it was deployed and retracted. Figure 1 shows failed the bracket, still fixed to the aircraft after it was identified by the flight crew.
The support of the roller pictured was not required for the flaps to actuate. This was apparent after landing, when the flaps were successfully retracted, despite the bracket fracture. It is likely that a portion of the bracket or its fibreglass housing obstructed the flap, preventing it from fully retracting during flight.
Figure 1: Bracket on the aircraft after it had failed. Most of the bracket is obscured by the fibreglass housing. Its outline is shown by the dotted red line.
Source: Flight crew
Figure 2 shows the failed component after it was removed from the aircraft. Figure 3 shows the fracture surface on the smaller of the two fragments. Two distinct regions were visible on the fracture surface. The upper region was tarnished and had likely been exposed to the atmosphere for a longer period of time. It was probable that this was the result of a pre-existing crack, and the stress in the remaining section resulted in failure of the component during normal operation.
Figure 2: The failed bracket after it had been removed from the aircraft.
Source: ATSB
Figure 3: Fracture surface illustrating the pre-existing crack and the overstress region, which fractured when the bracket finally failed.
Source: ATSB
Aircraft Maintenance
YEI was manufactured in 1992 and, at the time of the incident, had accumulated 41,961 hours total time in service. The aircraft was being maintained by a Civil Aviation Safety Regulations (CASR) approved maintenance organisation and the most recent comprehensive inspection was approximately 600 service hours prior, in November 2014. No problems with the outboard flap shroud or bracket were identified at that time.
Similarly, no problems were identified during the more recent line checks and daily inspections. However, the maintainer believes that the location of the bracket and the positioning of the shroud would make it difficult to see any cracks during this type of inspection.
Similar Occurrences
The CASA Service Difficulty Report (SDR) database shows two other reports of unserviceable flaps on EMB-120s. Both involved the left-hand outboard flap, however the fault in both cases was unrelated to the inboard bracket or flap track. Likewise, no reports of issues with this part could be found in the US Federal Aviation Administration (FAA) SDR database.
Safety analysis
A pre-existing crack on a partially concealed bracket propagated to the point where it failed in overstress during normal operation. The origin and age of the crack could not be determined, so it is not known whether there was an opportunity for it to have been detected during a base check conducted in 2014.
As a result of the bracket failure, the left-hand outboard flap could not be fully retracted during climb and a flap disagreement warning occurred. It was unclear exactly how the failed bracket prevented the flap from retracting, but it may have been caused by a bracket fragment physically obstructing the flap.
While there were no adverse control or handling issues, the flight crew returned the aircraft to Adelaide Airport. The flaps extended for landing without any further problems.
All risk controls during this incident worked well. The aircraft’s flap monitoring system identified the misalignment of the outboard flaps and prevented an asymmetry occurring. The crew were then adequately warned of the fault and advised ATC of the situation. The crew followed the quick reference handbook in an attempt to rectify the problem, but when the fault could not be cleared, returned the aircraft to Adelaide Airport. A contingency plan was formulated in the event the flaps could not be extended, but ultimately it was not necessary.
Findings
These findings should not be read as apportioning blame or liability on any organisation or individual.
Pre-existing cracking and subsequent fracture of a bracket supporting the left, outboard flap shroud prevented the flap from being fully retracted during climb and resulted in a flap disagreement warning.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
The Operator
Following the identification of the failed bracket, the operator inspected similar parts on YEI as well as the rest of their Embraer-120 fleet. No further damage or signs of cracking were identified.
Safety message
This incident highlights the importance of comprehensive maintenance inspections in maintaining aircraft airworthiness. However, when technical failures occur in spite of rigorous maintenance procedures, it is important to have adequate risk controls in place, as well as trained crew capable of adjusting plans to account for unforeseen circumstances. In such an event, a positive outcome can be achieved by maintaining composure, planning ahead, and communicating with other crewmembers, ATC.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 26 October 2016, a Beechcraft B200 aircraft, registered VH-XGV (XGV), taxied at Brisbane Airport for a private ferry flight to Archerfield Airport, Queensland. The pilot was the only occupant of the aircraft.
The pilot taxied the aircraft to holding point A7 (Figure 1).
According to recorded air traffic control communications, at about 2010 Eastern Standard Time (EST), the aerodrome controller (ADC) asked the pilot of XGV whether they were ‘ready to go’ and the pilot responded advising they were ready. The ADC issued an instruction to the pilot to conduct a right turn onto a heading of 090° after take-off and cleared the pilot to line up on runway 01 and wait due to wake turbulence from an aircraft that had just taken off. The pilot read back the line-up instruction, but as they omitted to read back the assigned heading, the ADC repeated the turn and heading information and then also advised the pilot of an amended Departures frequency (from the one issued in their initial airways clearance).[1]
After the pilot received the line-up instruction, they started to taxi the aircraft onto the runway, and commenced the line-up checks. The pilot read back the frequency initially, but subsequently asked the controller to repeat it. The pilot lined the aircraft up on what they thought was the centreline of runway 01, and the aircraft remained stationary on the runway for about 30 seconds before the controller cleared the pilot for take-off.
At about 2011, the aircraft commenced the take-off run. During the take-off, the pilot realised that the aircraft was not on the centreline and steered the aircraft right towards the centreline prior to the aircraft becoming airborne. A subsequent runway inspection found damage to a runway edge light and the aircraft sustained minor damage to the nose landing gear.
Figure 1: VH-XGV commencing take-off on runway 01
Source: Airservices Australia
Pilot comments
The pilot provided the following comments:
It seemed very dark on the taxiway and runway 01. They had difficulty detecting the taxiway centreline markings.
The aircraft had its LED taxi light on, but it did not seem effective, as it did not appear to illuminate the area.
The pilot advised that the taxiway and runway lights were difficult to see and was not sure if there were runway centreline lights and whether they were activated.
Once they had changed to Tower frequency, they felt rushed by air traffic control to line up on the runway.
The pilot was not expecting the change in Departures frequency, which was given to them with the departure instructions as they were in the process of entering the runway and completing their line-up checks. This distracted them from ensuring the aircraft was lined up correctly on the centreline.
The pilot thought something was not right but did not think the aircraft hit anything and realigned the aircraft on the runway centreline. Only after airport ground personnel found the parts of damaged lighting was it evident the aircraft took off on the runway edge.
Airport lighting
At Brisbane Airport, the taxiway has green centreline lights and lead-off lights from the runway, but no lead-on lights from any intersection departure points. The lead-off lights are one-way lights and would not be visible to the pilot entering the runway. Runway 01 has white runway centreline lights, runway threshold lights, and both high and medium intensity runway lights along the runway edge.
Air traffic control selects the lights on with one switch, which turns on both edge and centreline lights on the runway. There were no reports of any technical problems with the lighting that night.
Aircraft lighting
The aircraft had two LED landing lights below a single LED taxi light, all of which are attached to the nose landing gear leg of the aircraft. The pilot confirmed that the taxi light was switched on during taxi and take-off. Switching on landing lights is part of the line-up checklist, but the pilot was uncertain whether it was switched on during take-off.
Previous incidents
A search of the ATSB database found similar misaligned take-off occurrences at night during the absence of a particular type of runway lighting and perceived pressure on the pilot to take-off:
Operational event, Brisbane Airport, Queensland, 25 November 2007 (ATSB investigation AO-2007-064[2]): The pilot of a Gulfstream Aerospace Corporation G-IV was operating a charter flight from Brisbane to Sydney, New South Wales (NSW). The pilot-in-command commenced take-off on taxiway A, which was adjacent to runway 01. The aerodrome controller instructed the pilot to cancel the take-off clearance. It was found that the electronic flight bag (EFB) was not functional, and the pilot-in-command relied on memory of the aerodrome from landing earlier that morning to take-off. On the entrance to runway 01 (at the A7 intersection), there were no runway threshold markings and lights to indicate the beginning of the runway.
The crew of a SAAB 340B was preparing to take-off from Sydney Airport to Lismore, New South Wales. The aircraft was lined up for take-off on runway 25 on the left runway edge runway lights. During take-off run, the captain thought something was wrong and realised that the aircraft was incorrectly lined up on the runway edge lights and re-aligned with the centreline. The crew were completing the line-up checklist at the time. Furthermore, runway 25 does not have centreline lighting.
Collision on ground, Townsville Aerodrome, Queensland, 11 February 2009 (ATSB investigation AO-2009-007[3]). During take-off, the pilot-in-command realised that the Bombardier DHC-8 was aligned with the left runway edge of runway 01. The aircraft was manoeuvred to the centre of the runway, and the take-off was rejected. It was found that the aircraft’s left mainwheel had damaged a runway edge light. Factors that may have led to the misaligned take-off related to the adverse weather. These included the weather being a distraction to the flight crew to monitor the aircraft’s path onto the runway, pressure to depart, and reliance on aerodrome lighting. Furthermore, the centre taxiway lighting stopped prior to the runway threshold making it difficult for crew to identify the runway edge.
Safety analysis
Animation of the recorded radar data from Brisbane Airport showed the aircraft commencing take-off on the runway edge, then moving across to the centreline.
Brisbane Airport taxiway and runway lights were operational on the night of the incident. However, lead-in lights were not installed to assist pilots lining up on the runway centreline. In addition, the aircraft’s taxi light used during the taxi, and possibly the take-off, supplied only very limited visibility to the pilot.
The pilot stated they felt rushed when the ADC gave them clearance to line up, and they were still completing the line-up checks when the controller issued the change in frequency. This combination of time pressure and distraction affected the pilot’s ability to detect the aircraft was not on the runway centreline. Airservices commented that as there was a 30 second delay on the runway for wake turbulence and no other aircraft on final approach, there was no actual urgency for the pilot. Despite this, the pilot had a perception of time pressure.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The pilot lined the aircraft up and commenced take-off on the runway edge lighting from an intersection (A7) departure.
The misalignment of the aircraft was influenced by the pilot rushing due to perceived pressure to commence the take-off when the line-up clearance was given, the issuing of a frequency change while the pilot was completing the line-up checks as well as lining up the aircraft on the runway, the lack of taxiway lead-on lights to the runway, and limited brightness of the aircraft taxi light.
Safety message
This incident highlights the effect time pressure and distraction can have on flight safety, particularly during critical stages such as while completing checklists. An ATSB research report Dangerous distraction: An examination of accidents and incidents involving pilot distraction in Australia between 1997 and 2004 provides an overview of occurrences resulting from pilot distraction. One strategy outlined is that if completion of checklists are disrupted, go back and start the checklist again (if possible) to reduce the potential for error.
In addition, ATSB research report Factors influencing misaligned take-off occurrences at night outlines conditions including intersection departure, air traffic control clearance/s issued during runway entry, and divided attention of flight crew. The ATSB has also developed a Pilot Information Card featured within the report to help flight crew identify factors that could increase the risk of a misaligned take-off.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 19 October 2016, at about 1037 Western Standard Time (WST), a vehicle was travelling along the northern perimeter road at Perth Airport, Western Australia. The vehicle had a driver and three passengers who were going to conduct a customs inspection on an aircraft, which was scheduled to depart Australia.
The driver had been advised that the aircraft would be parked on the international apron in preparation for the inspection. When the vehicle arrived at the international apron, the aircraft was not there, so the driver decided to show the other passengers some different areas of the airport while they waited for the aircraft to arrive.
As they drove towards the domestic apron, an area unfamiliar to the driver, the driver observed the aircraft that they were to meet, stationary in a position different to what was expected. They thought the aircraft was on the domestic apron, and instead of continuing along the northern perimeter road to the domestic apron, the driver turned left (Figure 1 item 1) and crossed the red and white zipper markings[1] that denote the road is crossing taxiway R (Figure 2). About another 50 m past taxiway R, was a left turn (item 2) for vehicles to access the domestic apron.
Figure 1: Airport map showing the path of the vehicle
Source: Google earth, modified by the ATSB
Figure 2: Photo showing stop sign and red and white zipper markings that denote a taxiway like that for taxiway R
Source: Airport operator
Rather than being parked as assumed by the driver, the aircraft was actually being towed in company with two safety vehicles and was stationary at taxiway D holding point, waiting for clearance to cross-runway 21. The vehicle then turned left onto taxiway W (item 3) and then right onto the 700 lane (item 4). At about 1038, the surface movement controller (SMC) cleared the aircraft that was being towed (item 5), to cross runway 21. At about the same time, a senior airport operations officer (SAOO), who was in a vehicle and parked near the 700 lane (item 6), noticed the vehicle traveling along the 700 lane but was not able to identify it. The vehicle turned right onto taxiway B (item 7) and then left onto taxiway H3 (item 8).
At about 1040, the tower air traffic controller cleared a Fokker Aircraft F28 MK 100 aircraft (Fokker 100) that was on final approach, to land on runway 21.
At about the same time, the SAOO contacted the SMC to determine the identity of the vehicle that was just turning onto taxiway D (item 9). The SMC advised that they assumed that the vehicle was associated with works being conducted at the intersection of taxiways A and D. The vehicle was not fitted with a transponder. A transponder was not required for operating in the non-manoeuvring area of the airport, but the vehicle was displayed intermittently on the surface movement control system.[2]
A work safety officer (WSO), who was supervising a work site at the intersection of taxiways A and D heard this exchange and observed the vehicle in the rear-view mirror (item 10). They turned their vehicle around, and followed the unidentified vehicle that was traveling along the paved edge of taxiway D, towards the runway 21 holding point. As the vehicle should not have been there and did not appear to be stopping, the WSO used their vehicle’s siren, horn and loudspeaker to alert the driver, and informed them that they were about to enter the runway and to stop immediately.
The vehicle passed over the holding point for runway 21 before it stopped. The vehicle stopped about two to three car lengths past the holding point (item 11). The WSO stopped about 5 m before the holding point and over the loudspeaker instructed the driver to go no further and to turn around. The WSO also advised the SMC that they were talking with the driver. The vehicle had stopped about 20 m before the white gable markers that denote the runway strip. The vehicle did a hard right turn and crossed back over the holding point at about 10:41:05 (Figure 3). About 3 seconds later, the Fokker 100 aircraft that had just landed on runway 21, passed the vehicle position. At this time, the estimated distance between the vehicle and the Fokker 100 was about 100 m. The crew of the Fokker 100 did not notice the vehicle.
Figure 3: Location of Fokker 100 aircraft landing on runway 21 and vehicle as it crossed back over the taxiway delta holding point for runway 21
Source: Airport operator, modified by ATSB
Vehicle driver comment
The vehicle driver indicated that the three passengers were new to the airside area of Perth Airport and they had used the delay to show the passengers the charter area that was on the same side of the airport as the domestic terminal. As they were traveling back to the international terminal, the driver saw, in the distance, the aircraft that they were to meet. The driver indicated that they were not familiar with the domestic area of the airport where the incident occurred, and they were focused on the aircraft that they needed to meet to complete their job, which also had time constraints.
The driver reported that as they approached the runway, they had stopped to allow the landing aircraft to pass before they saw the flashing lights of the WSO vehicle.
The driver reported that during the training to obtain the authority to drive airside (ADA), they would take every opportunity to gain more experience but would generally go to the same places.
The vehicle was not fitted with a VHF radio to communicate on or hear any of the air traffic control frequencies, nor was it required to be, as it was only authorised to travel on the perimeter road and apron areas.
The driver advised that there was no airport map or airside driving manual located in the vehicle.
Work safety officer comment
The WSO advised that the vehicle did not seem to be slowing down as they crossed the holding point and only seemed to start to slow when the WSO commenced calling on the loudspeaker.
The driver seemed confused and was focused on getting to the aircraft to complete their inspection, rather than where they were on the airport.
Airport operator comment
The airport operator conducted an investigation into the incident and determined that:
The vehicle was not fitted with a transponder, as the vehicle was not permitted to access the airport manoeuvring area.
The vehicle driver was issued with a category 2 authority to drive airside (ADA) in April 2016, which included approval to drive on all aprons and roadways but was not permitted on any taxiways or runways.
The actions of the vehicle driver in leaving the marked perimeter roadway, traversing several taxiways and then crossing a marked runway holding point, were the actions of an individual confused with their location on the airport.
The lost procedures for Perth Airport are promulgated in the airport driver-training programme and the Airside drivers pocketbook.
Safety analysis
The driver observed the aircraft they were scheduled to inspect and thought they were stationary on the domestic apron. They did not realise that the aircraft was being towed and was stopped at the holding point for runway 21. The driver entered the taxiways without a clearance and without having authorisation to do so. They became confused and crossed the holding point for runway 21. The WSO used their vehicle’s siren, horn, and loudspeaker to alert the driver, and informed them that they were about to enter the runway and to stop immediately.
The driver was focused on completing a time critical activity in an area of the airport that they were not familiar with. These probably combined to affect the driver’s ability to recognise that the aircraft they were to meet was being towed and stationary on a taxiway and not parked on the apron. The driver also did not identify that they had turned off the perimeter road and traversed several taxiways before crossing a holding point and entering an active runway.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The driver incorrectly assumed that the aircraft was parked on the domestic apron and in an effort to save time, entered several taxiways without the required approval and authorisation.
The driver was confused with their location, as they were unfamiliar with that area of the airport, and continued traveling down taxiway D and crossed the holding point for runway 21 before the WSO stopped the vehicle.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Airport operator
As a result of this occurrence, the airport operator has advised the ATSB that they are taking the following safety actions:
A review of the zipper markings will be conducted in areas where taxiways cross roadways to provide an enhanced level of identification to airside drivers.
The incident and lessons regarding airfield familiarity, lost procedures and general situational awareness will be communicated in an incident alert.
Explore the option to implement an authority to drive airside (ADA) ’zoning system’, to include a review of all organisations and their requirement to access different areas of the airport.
Review the system of ADA categories to determine if there is scope to implement a system that controls the access of particular organisations to prevent them from entering areas that they do not have a requirement to regularly access.
Safety message
The International Civil Aviation Organisation (ICAO) has identified runway safety as one of its priorities and has been working with countries and aviation organisations globally to reduce runway safety accidents. ICAO has developed a runway safety website, which offers a range of information and products to assist the aviation community to improve runway safety.
In addition, ICAO has published a Manual on the Prevention of Runway Incursions Doc 9870 AN/463 and this is available from the ICAO website. The manual includes information on the prevention of runway incursions. The manual discuses that deficiencies in design, training, technology, procedures, regulations and human performance can result in a system break down and safety being compromised. It is important in a complex and dynamic airport environment that all people working in that environment remain vigilant, maintain open communications, and use the systems in place to minimise the risk of a system break down.
Additional information on runway safety is also available from the Airservices Australia webpage Runway safety.
In addition, Airservices Australia has published a guide for airside drivers, The Airside Drivers Guide to Runway Safety, which focuses on four aspects of operating safely on an aerodrome:
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 24 October 2016, the operator (pilot) of a Lockheed Martin Stalker eXtended Endurance (XE) unmanned aerial system (UAS), configured in vertical take-off and landing (VTOL) mode,[1] prepared to conduct a demonstration flight at Mount Disappointment, Victoria.
Figure 1: VTOL Stalker XE
Source: Lockheed Martin Corporation. All rights reserved. Copyright 2017.
The previous day, the operator had loaded the latest autopilot software onto the aircraft’s main autopilot. One aim of the flight was to demonstrate the use of a particular radio frequency for the command and control communication link. The ground radio equipment incorporated a narrow beam width directional antenna.
The operator programmed a simple mission: launch segment to a first waypoint and one primary waypoint, which was a coordinate centred on the launch location, then a landing pattern and an alternate landing pattern.
The crew then conducted a physical inspection of the aircraft and ensured all was mechanically correct. They also completed the pre-flight checks. The operator then commanded the aircraft to launch. All four vertical-lift rotors were energised, and the aircraft lifted off the ground. At about 20 ft above ground level (AGL), the aircraft paused in accordance with normal procedures, to conduct an airborne check.
The aircraft then climbed to about 300 ft AGL, which was the programmed transition altitude, but did not transition to forward flight. As the aircraft climbed above the ground antenna, it flew into a null in the antenna pattern above the antenna where communication between the ground control station (GCS) and the aircraft was interrupted.
The aircraft hovered and, after about five minutes, the operator commanded ‘abort’ from the GCS. At that time, the operator observed that communication with the aircraft had been lost and repositioned the antenna to point directly at the aircraft. After observing continued lost link indications for about 30 seconds, the operator enabled the alternate radio datalink, restoring communication with the aircraft. However, the previously selected ‘abort’ command was unavailable for re-issue after the initial selection.
About 11 minutes after launch, the aircraft’s power failed, the vertical propellers stopped, and the aircraft pitched about 95 degrees nose down, descended vertically and collided with the ground.
The aircraft sustained substantial damage.
Vertical take-off and landing (VTOL) configuration
In the VTOL configuration, four vertical lift motors are fitted in addition to a conventional tractor motor/propeller. The aircraft takes off vertically and then transitions to horizontal flight at a set altitude. Following the period of horizontal (fixed-wing) flight, the aircraft transitions back to vertical flight for landing.
Transition altitude
The typical time needed to climb to departure altitude and transition to forward flight is less than 1 minute.
The transition altitude is specified by the operator and is usually 150-200 ft higher than any nearby obstacles. In this incident, the operator had selected 300 ft due to trees about 100 ft high in the vicinity. The lower the transition altitude, the less time is required in the VTOL configuration, which requires substantially more power (and therefore battery) than the more efficient forward flight.
Post-accident inspection
Following the accident, an inspection revealed that the aircraft’s negative main power cable was unsoldered and had separated from its pin in the main power connector, which was plugged into the aircraft’s battery. The operator’s investigation found that the connector had failed before the aircraft battery drained.
Loss of electrical power
The wiring in the VTOL aircraft configuration was designed to supply vertical climb power for 2 minutes and the system had been validation-tested for 3 minutes at that power setting. The battery connector wiring in the accident aircraft failed 11 minutes into flight, resulting in total loss of electrical power and loss of aircraft control.
Flight data
According to the recorded flight data, the data link was interrupted about 1 minute and 20 seconds after launch. Two seconds later, an aircraft software lost-link contingency response automatically issued a command to latch the current altitude command, navigate to the launch point, descend and land.
However, 1 second after the lost link contingency command was issued, an additional spurious command was issued. This inappropriate spurious command caused the aircraft to remain in an extended hover and prevented the operator from further affecting aircraft operation, even after re-establishing data link communications. Extended operations at hover power, well beyond electrical power supply system design limits, overheated the wiring and resulted in a connector failure causing interruption of the battery power supply and subsequent loss of aircraft control.
Software error
The system manufacturer found that an inappropriate spurious command issued by the aircraft software was due to a coding error in the VTOL software that had not been detected during testing.
Communications
Communication between the GCS and aircraft is not required for flight. If communication between the GCS and aircraft is lost during flight, the autopilot continues to fly the aircraft according to programmed contingency logic. If communications are lost for more than 5 seconds during the VTOL launch phase, contingency logic commands the aircraft to return to the launch point, descend and land.
Landing/emergency command options
Having commanded ‘abort’, the operator thought that the command would continue to be sent to the aircraft after communications were restored until the aircraft acknowledged receipt of the command. This did not occur. In the launch phase, the ‘abort’ command should cause the aircraft to navigate to the launch point and descend vertically to the ground.
No other appropriate commands were available to the operator.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Communication between the GCS and aircraft was lost for about 5.5 minutes during the launch phase, due to the aircraft flying into the null in the antenna pattern above the antenna.
A return to launch command was issued by the autopilot due to loss of communications, but was not completed, because a spurious command was issued due to a coding error.
After 11 minutes at vertical climb power, the high current overheated the wiring. The heat unsoldered the negative main power cable resulting in a total loss of electrical power.
The total loss of power resulted in a loss of control and the aircraft collided with the ground.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.
UAS manufacturer
As a result of this occurrence, Lockheed Martin has advised the ATSB that they are taking the following safety actions:
Software redesign
The software is undergoing testing, redesign and a review of contingency management in VTOL modes.
Safety message
This occurrence highlights the importance of UAS software testing to cover potential non-normal scenarios prior to release into operation.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
