What happened

On 22 September 2016, at about 1000 Central Standard Time (CST), a Cessna 210M aircraft, registered VH-SQT (SQT), departed Jabiru Airport, Northern Territory (NT), for a scenic charter flight with the pilot and four passengers on board. The aircraft followed the scenic route ‘Charlie’ in the fly neighbourly agreement (FNA) promulgated by Parks Australia (red line in Figure 1).

Figure 1: Recorded track of VH-SQT and relevant locations

Source: Operator of VH-SQT

About twenty-five minutes after SQT had departed from Jabiru, a Gippsland Aeronautics GA8 aircraft, registered VH-KNB (KNB), departed Jabiru Airport for a scenic charter flight to Cooinda Airport, NT, with the pilot and three passengers on board. Another aircraft from the same company departed immediately behind KNB on the same route. Both aircraft were following route ‘Delta’ in the FNA (yellow line Figure 1). The pilot of KNB broadcast on the common traffic advisory frequency (CTAF) when departing Jabiru. The pilot of SQT heard this call but did not respond. KNB then tracked south via Lightning Dreaming.

After overflying Jim Jim Falls, the pilot of SQT broadcast on the CTAF that they were departing Jim Jim and tracking for Double Falls (about 10 NM north-east) at 1,500 ft, and did not receive a response. The pilots of KNB and the company aircraft did not hear that call.

At about that time, KNB was also at 1,500 ft. The pilot of KNB selected the second radio in the aircraft which was on their company frequency to talk to the pilot of the company aircraft. During that time, the pilot was able to hear broadcasts on both the CTAF and the company frequency except while transmitting. The pilot then spoke to the passengers to provide commentary as they overflew a waterfall and switched back to the primary radio to be able to transmit on the CTAF. As KNB was then at Double Falls which is about 10 NM from Jim Jim Falls, the pilot subsequently reported that they were then about to make a 10-mile inbound call for Jim Jim Falls.

After orbiting Double Falls in a left turn, the pilot of SQT rolled the wings level. Just as they did so, the pilot of SQT sighted a GA8 (KNB) pass within about 20 m horizontally to their left, and about 30 ft above SQT.

The pilot of SQT broadcast on the CTAF asking whether the pilot of the GA8 in the vicinity of Double Falls had heard their departure call from Jim Jim Falls. The pilot of KNB replied that they had not. The pilot of KNB then looked for SQT but did not see the aircraft at any time. When the pilot of SQT heard the callsign and response from the pilot of KNB, they realised that this company often had multiple aircraft operating in company and immediately looked for and sighted the other company aircraft at the same altitude about 300 m away.

Operator comments

The operator of SQT commented that they believe there is a need for a separate radio frequency for the Jabiru area. On the existing CTAF, pilots can hear broadcasts from Batchelor to the west and Numbulwar to the east. Most of those broadcasts are not relevant to pilots operating in the Jabiru area but increase radio congestion and can potentially lead to over-transmissions.

Fly neighbourly agreement scenic routes

Following consultation with local operators through the Northern Territory Regional Airspace and Procedures Advisory Committees, the FNA routes were agreed on and published by Parks Australia in 2010 and published in the En Route Supplement Australia (ERSA). The FNA was due to be reviewed by Parks Australia in 2015 and the review is expected to be conducted later this year (2016).

The FNA routes were designed to avoid sensitive areas and for ‘park amenity, tourism experience and nature conservation’. The routes were not intended to provide aircraft separation, but they are mandatory routes for aircraft operating below 2,500 ft (unless operating in accordance with a special permit).

SQT and KNB were following different routes published in the FNA with both aircraft at 1,500 ft on reciprocal tracks. SQT was following route Charlie and KNB was following route Delta from Jabiru to Cooinda.

This was the first of the flights on the wet season routes this year. There had been significant rain in the previous fortnight that closed the roads to the falls. Pilots from the two aircraft operators had identified the possible conflict of opposite-direction aircraft the previous year and had agreed that they would broadcast departing via Lightning Dreaming when tracking south to alert pilots of aircraft tracking north on the reciprocal track. However, when the pilot of KNB broadcast on the CTAF that they were departing Jabiru, the broadcast did not include that they were tracking via Lightning Dreaming.

The pilot of KNB commented that they could have a similar procedure as they use for flights to Oenpelli: they track to Oenpelli at 1,500 ft and back to Jabiru at 2,000 ft to ensure separation between aircraft travelling in opposite directions. The pilot of SQT commented that having a plan and agreed routes and specified altitudes would help to prevent similar occurrences.

Safety analysis

The pilot of the north tracking SQT broadcast when departing Jim Jim Falls for Double Falls but the pilot of the south tracking KNB did not hear that transmission, possibly due to communicating with the other company pilot on the other radio. Therefore, they were not aware of SQT until the pilot of SQT broadcast after the near collision. The pilot of KNB also commented that the CTAF was busy as it covered a large area, and this may have contributed to the missed communication.

The pilot of KNB did not include ‘via Lightning Dreaming’ in their departure broadcast when departing Jabiru Aerodrome. While the broadcast ‘via Lightning Dreaming’ was not mandatory, it may have alerted the pilot of SQT to the two aircraft tracking in the opposite direction on reciprocal routes at the same altitude.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The aircraft were at the same altitude on reciprocal tracks on published FNA scenic routes and came into close proximity because the pilots were not aware of each other due to ineffective communication.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Operator of VH-KNB

As a result of this occurrence, the operator of KNB has advised the ATSB that they are taking the following safety actions:

• A notice to pilots was distributed reminding them of the importance of effective radio usage as an aid to situational awareness in high traffic areas. Pilots were instructed to review and acknowledge Civil Aviation Advisory Publication (CAAP) 166-2(1) as it contains relevant information on alerted see and avoid radio techniques.
• Pilots of aircraft tracking towards Double Falls from the north are required to make an additional radio broadcast.
• All other scenic routes will be examined for potential conflict points and effectiveness of standard radio calls.
• They will discuss the incident with the operator of SQT and determine ways to reduce the risk of a similar incident occurring.
• Investigate alteration of flight routes and altitudes flown in conjunction with other operators.
• Investigate and review potential implementation of a dedicated radio frequency in scenic flight locations in Kakadu National Park.

Safety message

This incident highlights the importance of effective risk analysis by operators. An effective risk analysis of the FNA routes would probably have highlighted the potential for opposite-direction traffic. This may have led to risk management strategies such as implementation of vertical separation planning, radio broadcasts, and consideration of having a dedicated frequency.

A search for other traffic is eight times more effective when a radio is used in combination with a visual lookout than when no radio is used. In areas outside controlled airspace, it is the pilot’s responsibility to maintain separation with other aircraft. For this, it is important that pilots use both alerted and un-alerted see-and-avoid principles.

Pilots are encouraged to ‘err on the side of caution’ when considering when to make broadcasts and whether specific frequencies should be monitored, particularly noting the fundamental importance of communication in the effective application of the principles of see-and-avoid. The ATSB report Limitations of the See-and-Avoid Principle outlines the major factors that limit the effectiveness of un-alerted see-and-avoid.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 27 September 2016, a Pulse Aerospace Vapor 55^[1] remotely piloted aircraft (RPA), was operating a test flight at Lighthouse Beach, Ballina, New South Wales (Figure 1).

Figure 1: Photo of a (different) Vapor 55 RPA

Source: www.skylineuav.com.au

According to telemetry data^[2] recorded on the remotely piloted aircraft system’s ground control station (GCS), at about 0910 Eastern Standard Time (EST), the RPA lifted off from its start position in front of the surf clubhouse (Figure 2). About 30 seconds later, when the RPA was at an altitude of about 36 ft, it entered ‘manual’ flight mode. The RPA then tracked according to manual inputs from the pilot for about 7 minutes, at which time (when at 124 ft altitude) the data-link signal was lost. Thirty seconds later, the RPA entered the ‘home’ flight mode, and commenced tracking to the programmed home position at an altitude of 154 ft. The last position of the RPA recorded by the GCS was about 165 m NNE of the start position, and about 4 km SE of Ballina/Byron Gateway Airport.

In the home flight mode, the RPA did not respond to the flight control inputs made by the pilot and the pilot subsequently lost sight of the RPA. The RPA was not found despite an extensive search.

Figure 2: Recorded RPA track

Source: Google earth and remotely piloted aircraft system operator, annotated by ATSB

Mission planning

Prior to the flight, the pilot’s preparation for the planned mission involved using Google earth on a computer (not the GCS), and selecting a north-western and a south-eastern reference point. These markers defined an outer rectangle, within which the flight was to take place (Figure 3).

Figure 3: Planned operating area defined using NW and SE markers

Source: Google earth, annotated by ATSB

The pilot then transferred an image of the google earth map for the area onto the GCS using a USB stick, and uploaded it to create the ‘Lighthouse Beach’ mission. To georeference^[3] the image, the pilot then overlaid the markers in the image with a point icon on the controller, and entered the latitude and longitude of two positions into the dialogue box on the GCS. The north-western GCS marker is visible in the top left corner of Figure 4, but the latitude and longitude values visible are image text only.

Once the image had been georeferenced, the pilot then used the graphical interface to place the start and home icons and any intervening waypoints for the planned mission (Figure 4).

Figure 4: Image uploaded onto GCS with planned mission overlaid

Source: Remotely piloted aircraft system operator, annotated by ATSB

Incorrect georeference

The remote pilot reported that both they and an observer checked each waypoint before the flight, verifying latitude, longitude, altitude and height. However, the GCS data shows that during the planning phase, while the north-western marker was correctly assigned, the south-eastern marker was incorrectly assigned to a georeference point with a latitude in the northern hemisphere. This resulted in all of the waypoints and home location being incorrect, as they were created by dragging icons on the georeferenced image. Waypoints 2, 3, 6 and 7 had latitudes in the northern hemisphere, and the home position was assigned to 17.222395° S and 153.591582° E. That location was in the Coral Sea Islands about 1,200 km north of the start position (Figure 5).

Figure 5: Actual location of home position and select waypoints from the GCS

Source: Remotely pilot aircraft system operator, Google earth

The RPA’s start position was correct as it was obtained using the RPA’s GPS. As the aircraft entered manual mode after take-off and the pilot did not initiate the automatic mode to fly the programmed mission, it was only when the RPA lost the datalink, stopped responding to the pilot’s manual control inputs and commenced tracking for the programmed home position, that it left the planned operating area. The pilot can also manually give the ‘home’ command. In all home and automatic modes, the handheld controller is ignored unless the pilot gives the ‘manual’ command via the GCS application and manually takes control of the RPA.

The GCS has a ‘flight plan’ tab, which shows the planned distance and time (among other items) for the mission, which could have alerted the pilot to the incorrect latitude references. However, a check of the flight plan tab had not been included in the operator’s pre-flight procedures. In addition, the flight plan tab includes a measure tool that can be used to check that the map size is correct.

The manufacturer advised that the following steps are included in their pre-flight procedure specified in the aircraft flight manual:

• verify flight plans
• verify lost communication home waypoint.

The operator stated that there was no further detail of the verification process in the manual.

The default hemisphere was north (N) in the GCS for entering positions. The manufacturer stated that there was no feature that would change the default (to south (S)). The manufacturer assessed that changing the default could lead to issues with the conduct of appropriate pre-flight checks.

The operator reported that information about the default setting to north was not provided in the Aircraft Flight Manual.

Loss of data-link signal

The RPA system commands homing after 10 seconds of data link loss when in automatic mode and 2 seconds if in manual mode. In this incident, as the RPA was in manual mode, it initiated homing after 2 seconds.

The cause of the lost signal could not be determined. The operator thought that there may have been interference from a media outside broadcast unit located about 30 m from the GCS. However, the media personnel advised the operator that they were using a satellite communications link and therefore should not cause interference.

Appropriate action

The manufacturer advised that once the aircraft commenced tracking to an incorrect home location, the appropriate action would have been to use the ‘hold’ or ‘manual’ command so that the joystick flight control could be used.

The remote pilot advised that they had attempted to use the ‘hold’ command, as they were shown in their training, but the RPA did not respond. No evidence of this was recorded in the GCS data.

Safety analysis

Although the pilot reported having completed the pre-flight preparations and associated checks, the data stored on the GCS showed that the incorrect (northern) hemisphere was assigned to the south-eastern georeference marker at the time the map image was created. This led to the home position being assigned a location in the Coral Sea Islands, so when the RPA lost signal and tracked for home, it headed north and was not recovered. The same outcome would have occurred if the pilot had selected the RPA to fly home, even with a continuous data-link signal. While all of the intermediate waypoints were also incorrect, as the GCS remained in manual mode, the RPA did not attempt to track to any of those waypoints.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The south-eastern point used to georeference the image on the ground control station map was selected to a northern hemisphere latitude, which resulted in incorrect waypoints and home position for the mission.
• The RPA data-link signal to the ground control station was lost, so it commenced tracking to the programmed home position, which was in the Coral Sea Islands at a latitude 17.22° S, about 1,200 km north of the start position.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Manufacturer

As a result of this occurrence, the RPAS manufacturer has advised the ATSB that they are taking the following safety actions:

• Audit of training curriculum to ensure that pilots understand how to verify GPS coordinates, interpret their values and signs. The training course will continue to train pilots on the tools available to them within, and outside of the GCS software.
• Share this incident with operator trainers so that new operators can learn from the events of this incident.
• Continued education and outreach discussions with RPAS operators pertaining to decreased mishap rates through training and currency policies.

Remotely piloted aircraft system operator

As a result of this occurrence, the remotely piloted aircraft system operator has advised the ATSB that they are taking the following safety actions:

• The pre-launch checklists have been modified to include additional and enhanced procedures to verify data input and flight plans.
• Investigate the fitting of either GPS or cellular tracking devices to remotely piloted aircraft.
• Update the risk assessment form to include location of external broadcast stations such as television outside broadcast units.
• Brief all company pilots on the event for safety and education purposes.
• Continue liaison with the manufacturer.

Safety message

Incorrect reference data can have potentially serious consequences in remotely piloted and manned aircraft. It is imperative that remotely piloted aircraft systems incorporate means of minimising the opportunity for errors to occur and also for detecting and correcting errors that do occur.

The careful application of operational controls and procedures, underpinned by robust risk assessment, will become increasingly important as relevant technologies develop further and new RPA applications continue to emerge. RPA operators should expect data loss events and prepare for these appropriately.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns relates to data input errors.

Aviation Short Investigations Bulletin - Issue 56

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The Pulse Aerospace Vapor 55 is a helicopter, gross weight 25 kg, with a maximum cruise endurance of 60 minutes, controlled via a laptop computer operating the ground control station and flight controls (joystick).
2. The telemetry data is sent from the RPA to the ground station and stored.
3. Georeferencing means to assign a physical location (coordinates) with a position in an image.

What happened

On 23 September 2016, a Network Aviation Fokker F28 MK 100 aircraft, registered VH-NHY, departed Newman Airport, Western Australia (WA), on flight 1623 to Perth Airport, WA. On board were two flight crew, three cabin crew and 97 passengers.

About 550 km north of Perth, at 1048 Western Standard Time (WST), the flight crew were alerted to a caution for low quantity in hydraulic system 1. The flight crew completed the checklist actions, which included selecting the hydraulic system 1 pumps off. The loss of hydraulic system 1 results in the loss of the following systems:

• normal landing gear extension (alternate gravity landing gear extension required)
• normal flap extension (electric power used to extend flaps)
• nose-wheel steering, speed brakes and thrust reversers.

The flight crew notified air traffic control (ATC) of the fault and discussed the implications of the failure. Without nose-wheel steering, they planned to land the aircraft on runway 21 at Perth Airport and roll through to the end of the runway, where a pre-positioned tug would connect to the aircraft and tow it to the allocated gate for passenger disembarkation. Rather than use the engines for electrical power and air-conditioning during the aircraft tow, the captain elected to start the auxiliary power unit (APU) during the approach. The APU would then supply air for the air-conditioning system after landing and electrical power after the engines were shut down.

The flight crew discussed the issue with the cabin crew manager (CCM), advised them of the implications of the fault and their plan for when the aircraft landed. The flight crew subsequently advised the company of their plan and made a PAN^[1] call to ATC with their landing intentions. They started the APU and then configured the aircraft early for the approach and landing. The aircraft landed without further incident and rolled through to the end of runway 21.

Figure 1: Emergency evacuation of VH-NHY

Source: Airport operator

At the end of runway 21, the flight crew could not see a tug waiting for the aircraft, so they used differential braking to turn the aircraft off the runway and onto the taxiway before stopping. The first officer completed the after landing checks, while the captain called the CCM to explain the situation and discuss the public address requirements. While on the interphone to the captain, the CCM reported that there were fumes present in the cabin. The captain turned the APU bleed off, to prevent the APU supplying air to the cabin. However, the CCM then reported that the fumes in the cabin were getting worse. Consequently, the captain suspected the fumes could be from the engines and in consultation with the CCM they elected to conduct an emergency evacuation (Figure 1).

The flight crew started the emergency evacuation checklist and the captain called for the evacuation over the public address system. The cabin crew opened the two front doors and the four over-wing emergency exits were removed by the passengers (Figure 2). The forward left door (L1) slide did not automatically inflate when the slide deployed, so the CCM manually inflated the slide. When the CCM checked on the forward right door (R1) slide they observed that it was not deployed and the cabin crewmember was blocking the exit. The passengers evacuated through the forward left door and the over-wing exits.

The flight crew completed the emergency evacuation checklist and the captain directed the first officer to take the fire extinguisher from the flight deck and join the passengers. The captain then left the flight deck about one minute after the evacuation started with the passenger manifest. They noted there were only a couple of passengers left in the cabin, and the CCM was directing one of them to leave their baggage behind and evacuate. The captain waited for all personnel to leave the aircraft, completed an inspection of the cabin and then exited the aircraft to join the passengers, provide them with support and liaise with the authorities. During the emergency evacuation, three passengers received minor injuries.

Figure 2: Aircraft emergency evacuation routes

Source: Operator, annotated by ATSB

Maintenance findings

The maintenance organisation found the number 1 engine thrust reverser selector valve (see Thrust reverser selector valves), located in the left outboard APU (see Auxiliary power unit) compartment (zone 313), leaked hydraulic fluid from a damaged O‑ring (Figure 3). Further inspection found the APU and air-conditioning system were contaminated with hydraulic fluid.

A gap between the APU intake door actuator rod cut-outs was identified as the path for contaminated air to enter the APU inlet. When the APU inlet door is open inflight, air is scooped into the inlet creating an area of high pressure. However, when the aircraft is on the ground with the APU running, the APU inlet becomes an area of lower pressure as the APU is now ‘sucking’ air into the inlet.

Figure 3: Location of APU and thrust reverser selector valves

Source: Operator, annotated by ATSB

The R1 door was found by the maintenance organisation to be in the ‘DISARM’ position (‘MANUAL’ mode; see Cabin emergency exits) and an inspection was conducted on the slide and associated mechanism. No defects were found. Inspections of the L1 door slide could not identify a reason for this slide to not inflate automatically.

Auxiliary power unit

The APU is located in the aft fuselage, behind the rear pressure bulkhead. It supplies pneumatic power for starting of the main engines and air-conditioning on the ground, and electrical power if the number 1 and 2 engine driven generators are not supplying power. If the APU is started while airborne, it will not supply air to the air-conditioning system until the ground-flight logic switch detects the aircraft is on the ground.

Thrust reverser selector valves

The thrust reverser selector valves supply hydraulic fluid under pressure to the thrust reverser actuators. Hydraulic fluid for the thrust reverser selector valves is supplied by hydraulic system 1. The number 1 selector valve (left side) is installed in the rear aircraft fuselage behind the pressure bulkhead in zone 313 adjacent to the APU compartment.

Cabin emergency exits

The aircraft is fitted with one forward left side passenger door with an inflatable slide, one forward right side door with an inflatable slide, and four over-wing escape hatches. The inflatable slides will deploy automatically when the door is opened from the inside with the door selector set to ‘AUTOMATIC’. If the slides do not inflate in the automatic mode, then the red inflation handle on the right side of the slide pack must be pulled for inflation. When disarmed (‘MANUAL’ mode), the slide is not attached to the aircraft doorway and remains inside the door assembly when the door is opened. Once the door is opened in the MANUAL mode, there is no way to deploy the slide.

Previous incidents

A search of the ATSB database revealed two previous incidents of fumes entering the cabin on Fokker F28 aircraft from the same operator following a hydraulic leak when the APU was supplying air to the air-conditioning system:

• 21 November 2014: VH-NHM cabin fumes present on pre-departure. Source of hydraulic leak found to be from the horizontal stabiliser actuator.
• 21 January 2016: VH-NHP hydraulic system 1 low quantity inflight followed by cabin fumes during aircraft tow to the gate. Tail section was found wet internally with hydraulic fluid. Speed brake actuator found with damaged O-ring, which was identified as the source of the leak.

In response to the incident in 2014, the operator contacted the aircraft manufacturer to propose the design of a seal located at the entry point of the APU air intake. This would mitigate the potential for contamination of the air-conditioning system following a hydraulic leak. The manufacturer considered the proposal plausible and reasonable, but elected not to initiate action as this was their first reported occurrence.

Following the latest incident, and in light of the two previous incidents, the aircraft manufacturer considered if an amendment to emergency procedures was required to warn flight crew of the potential risk of a fumes incident from operation of the APU following a hydraulic leak. The manufacturer decided this was not supported based upon the following service experience:

The majority of the reported hydraulic leaks are not located in the tail section. Hydraulic fumes entered the cabin or flight deck in less than 1% of the non-tail origin events. The APU was not implicated in the non-tail origin events.

A change to the hydraulic quantity low emergency procedure was considered, but their review indicated that only a small percentage of tail origin hydraulic leak events that could potentially lead to fumes were associated with a hydraulic quantity alert.

Safety analysis

The hydraulic leak was the result of a failure of an O-ring in the number 1 thrust reverser selector valve. The checklist actions resulted in switching off the pumps supplying the number 1 hydraulic system with the loss of the associated systems, which included the nose wheel steering. The loss of nose wheel steering necessitated a tow to the gate by a tug after landing. The captain elected to start the APU inflight so that it would be available to supply air for the air-conditioning system after landing and electrical power after the engines were shutdown. However, unknown to the flight crew, the location of the hydraulic leak relative to the APU air intake, and a gap between the APU intake door actuator rod cut-outs, resulted in the contamination of the air-conditioning system. This occurred when the ground-flight logic switch detected the aircraft was on the ground and the APU started to act as a source of air supply for the air-conditioning system.

After the fumes were detected in the cabin, the first action by the captain was to switch off the air supply from the APU. Following this action, the air for the air-conditioning system was supplied by the engines. However, by this stage various parts of the air-conditioning system were contaminated with hydraulic fluid. Therefore, fumes continued to enter the cabin through the air-conditioning system.

During the emergency evacuation, the R1 door slide did not deploy. The maintenance inspection found the R1 door was disarmed and no fault was found with the door operating mechanism. Therefore, it is likely that during the emergency evacuation procedure the cabin crewmember at the R1 door reverted to previous experience and disarmed the door prior to opening it, which prevented the slide from automatically deploying.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• A damaged O-ring in the left engine thrust reverser selector valve resulted in a hydraulic leak.
• Hydraulic fluid, or vapour, entered the APU air intake through a gap between the APU intake door actuator rod cut-outs.
• The cabin fumes were the result of the APU supplying air contaminated with hydraulic fluid to the air-conditioning system after the ground-flight logic switch detected the aircraft on the ground, which resulted in the contamination of the air-conditioning system.
• The R1 door slide did not deploy automatically because the door was disarmed when it was opened.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they have taken the following safety actions:

Air quality checks

Following the replacement of parts contaminated with hydraulic fluid and cleaning of the APU area and air-conditioning system, the operator and their maintenance organisation conducted air quality checks on the aircraft before return to service.

Flying operations advisory bulletin

The operator’s flight operations department issued flying operations advisory bulletin (FOAB) 031/16: Fumes ingestion by the APU. The bulletin advises flight crew of the potential for ingesting fumes through the APU intake in the event that the APU is operating with a hydraulic leak in the tail section of the aircraft.

Human factors review

The human factors review of the incident was conducted for learning points and future training considerations.

Maintenance program

Changes to the aircraft maintenance program have been introduced to proactively identify potential issues, such as detailed visual inspections within areas which may lead to potential air quality issues.

Safety message

This incident highlights the importance of training and procedures, and the need for organisations to educate their workforce about safety incidents. The flight crew on board NHY were confronted with two consecutive emergencies. They responded to each situation in accordance with their training and procedures, which resulted in everyone safely evacuating the aircraft with only minor injuries reported.

Further information about the risk of fumes can be found in ATSB research report AR-2013-213: an analysis of fumes and smoke events in Australian aviation.

__________

1. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Aviation Short Investigations Bulletin - Issue 57

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 22 September 2016, at 1608 Eastern Standard Time (EST), a Jetstar Airways Airbus A320-232 aircraft, registered VH-VFY (VFY) (Figure 1), operated a scheduled passenger flight, JQ956, from Sydney, New South Wales, to Cairns, Queensland (Qld).

At about 1630, as the aircraft climbed, the cabin manager (CM) was on the flight deck. A cabin crewmember notified the flight crew and the CM of an unusual odour in the cabin. The CM left the flight deck to conduct an inspection of the cabin and detected a burnt electrical type odour present in rows 1 to 5. They notified the flight crew and continued to inspect the cabin.

At 1632, the flight crew received an ENG 2 OIL FILTER CLOG message on the electronic centralised aircraft monitor (ECAM) system. This message indicated that the engine management system had detected an increase in pressure across the engine oil filter of more than 12 psi. However, the increase in pressure did not reach the required level of 20 psi for the engine management system to automatically bypass the engine oil filter. The ENG 2 OIL FILTER CLOG message was an advisory message and did not require any flight crew actions. During this time, all engine indications were within normal limits.

At about the same time, the CM returned to the flight deck having conducted an inspection of the full cabin and reported that the unusual odour had dissipated. The cabin manager returned to the cabin to monitor the situation. The flight crew continued the climb and levelled the aircraft at the planned cruising level of flight level (FL) 340.^[1] The flight crew then reviewed the engine oil system and, anticipating a possible diversion, obtained the weather for Brisbane Airport, Qld.

Figure 1: Airbus A320 VFY

Source: Tony Coles

At 1644 the cabin crew detected smoke entering the cabin and the CM instructed the cabin crew to stop the cabin service and stow the cabin carts. The CM reported to the flight crew, via the aircraft interphone, that light smoke was entering the full length of the cabin through the overhead air conditioning vents. As the flight crew received this report, they detected a vibration and unusual noise from the right engine and the aircraft yawed^[2] to the right. At the same time, the ECAM displayed the message ENG 2 FAIL.

The flight crew then commenced the engine failure checklist and switched on the seat belt sign in the cabin. While conducting the checklist, they observed a small amount of smoke coming from the cockpit ventilation system. At the same time, the cabin crew observed heavy smoke entering the cabin through the overhead air-conditioning vents. The flight crew donned oxygen masks, and in accordance with the engine failure checklist, depressed the right engine fire button. This action isolated the engine systems from the rest of the aircraft and shortly after, the flight crew observed that the smoke had dissipated and they removed their oxygen masks.

The smoke also dissipated in the cabin after a short time.

After completing the checklist, the flight crew diverted the aircraft to Brisbane, declared a PAN^[3] to air traffic control and began a descent to FL200. During the descent, the flight crew briefed the CM and advised them of the engine failure and the diversion.

The flight proceeded to Brisbane Airport and landed at about 1720 without further incident. No persons were injured in the incident and the aircraft was not damaged.

Captain comments

The captain provided the following comments:

The aircraft communications addressing and reporting system (ACARS) notified the company operations centre as the incident unfolded. The information provided by ACARS to the operations centre enabled the company to prepare for the aircraft arrival at Brisbane and reduced the workload of the flight crew during the diversion.

Training previously undertaken by the captain and first officer was very similar to the incident. This enabled the first officer to anticipate many of the captain’s needs and ensured the flight crew worked well as a team during the incident.

The captain had not met any member of the cabin crew prior to this flight. The captain commented that the procedures in place and training that all crewmembers had undertaken ensured that the flight crew worked very effectively with the cabin crew to manage the incident and diversion.

The flight crew calculated that the landing would be at a weight above the aircraft maximum landing weight^[4]and assessed that the emergency facilities and long runway at Brisbane provided the most suitable airport for diversion.

Donning the oxygen masks greatly hindered communications with the first officer, performance as a team improved markedly after removal of the oxygen masks.

Cabin manager comments

The cabin manager provided the following comments:

Due to training requirements, there were five cabin crew on board the flight, rather than the usual four. The additional crew member assisted in the management of the passengers and cabin during the incident and diversion.

The cabin crew training and procedures were very effective. Two of the cabin crew on the flight were new to the role, however they were able to effectively carry out their tasks during the incident and diversion.

Engineering examination

After the incident, the engine manufacturer, International Aero Engines (IAE), conducted an engineering examination of the engine and detected that the number 3 bearing had failed. A detailed examination of the bearing was conducted. IAE reported that due to secondary damage, the engineering examination could not determine the cause of the number three bearing failure.

IAE reported that the ball material was found to be compliant with manufacturing quality requirements.

Airworthiness directives

In 2007, the Civil Aviation Safety Authority released airworthiness directive (AD) AD/V2500/3 relating to failures of the number 3 bearing within IAE V2500 series engines within a specified range of serial numbers.

This airworthiness directive did not apply to the IAE V2527-A5 engine fitted to VFY, as the serial number (V17515) for the engine was outside the specified range, however the AD contained the following information:

The issuing of this AD is to prevent failure of the number three bearing, which could result in an in-flight shutdown and smoke in the cockpit and cabin. The smoke is a result of oil escaping from the bearing compartment due to a fracture of the numberthree bearing race.

The United States Federal Aviation Administration released AD 2016-25-11, which has an effective date of 20 January 2017. This AD also required inspections and corrective actions for damage to the number 3 bearing. The FAA released this AD after the premature failure of number 3 bearings resulted in nine in-flight engine shutdowns. The AD does not apply to the engine fitted on VFY, as the serial number was once again outside of the specified range.

Applicability of airworthiness directives

The ADs were introduced after failures of the number three bearing led to the discovery of microstructural defects in some bearing components, introduced during the manufacturing process. Following this discovery, the engine manufacturer reviewed manufacturing records to determine the extent of engines with affected bearings.

The engines with the highest level of number 3 bearing material defects, and therefore the highest risk of failure, were included in the original AD. Engines determined to have a lesser level of defects required additional inspections and/or were subject to reduced service life. The second AD was introduced to increase the number of engines affected.

IAE advised that V2500 series engine-powered A320 aircraft currently achieve an in-flight shut down rate of 0.00136 per 1,000 flight hours. This is less than IAE’s target in flight shut down rate, of 0.02 per 1,000 flight hours.^[5] IAE investigates the cause of each in-flight shut down and takes corrective actions with the goal of maintaining the target in-flight shut down rate. IAE will continue to monitor the performance of the bearings and will adjust the fleet management plan if required.

The engine manufacturer and the United States Federal Aviation Administration advised that no further actions were planned beyond the current ADs.

The Civil Aviation Safety Authority (CASA) commented that they are monitoring the situation and awaiting reports from the aircraft operator and engine manufacturer.

Safety analysis

The initial odour detected by the cabin crewmembers during the aircraft’s climb, along with the ENG 2 OIL FILTER CLOG ECAM message, likely resulted from the early stages of the number 3 bearing failure. The later instance of smoke in the cabin and flight deck occurred as the bearing failed. The failure of the number 3 bearing resulted in a complete power loss from the right engine.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

The right engine number 3 bearing failed, resulting in engine power loss and led to smoke entering the flight deck and cabin.

Safety message

This incident highlights the importance of effective crew management techniques, training and robust emergency procedures. The captain had not met any of the other flight and cabin crewmembers prior to the flight. In addition to this, some cabin crewmembers were new to the role. Despite this, the emergency procedures and training undertaken by the crewmembers ensured that they were able to fulfil their roles and work effectively as a team to manage a difficult situation safely and efficiently.

Aviation Short Investigations Bulletin - Issue 59

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level. Flight level 340 represents 34,000 ft.
2. Yaw is the motion of an aircraft about its vertical or normal axis.
3. PAN is an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
4. Maximum landing weight is the maximum gross weight an aircraft may land at due to structural or performance limitations. Landing at a weight above this weight may require a structural inspection of the aircraft.
5. 0.02 per 1,000 flight hours is the rate required for an engine and airframe combination to achieve the acceptable in-flight shut rate for 180 min extended operations.

On 23 September 2016, the ATSB commenced an investigation into the descent below segment minimum safe altitude involving Airbus A330-343X, 9M-XXI, near Gold Coast Airport, Queensland, on 11 September 2016.

The aircraft was cleared to conduct a RNAV-Z (GNSS) instrument approach to runway 14 (Figure 1) at Gold Coast Airport in visual meteorological conditions. During the approach, the aircraft was observed to descend below the 1,700 ft segment minimum safe altitude between the instrument approach’s intermediate fix (OOLNI) and a position 2.5 NM from the final approach fix (OOLNF).

Figure 1: The Gold Coast RNAV-Z (GNSS) Rwy 14 non-precision instrument approach

Source: Jeppesen

The ATSB interviewed the flight crew and also examined the operator’s policies and procedures for the conduct of the RNAV-Z type approach. The flight crew reported that they had briefed the approach. That briefing included identification that the 2.5 NM position was not included in the aircraft’s navigation data base and that there was a segment minimum safe altitude requirement associated with this position.

The approach was flown using the autoflight system in a managed mode. As the aircraft approached the OOLNI, the aircraft was in a shallow descent and the flight crew commenced configuring the aircraft for landing (Figure 2). At OOLNI the aircraft was fully configured for landing and at a speed of 150 kt. As the aircraft passed through OOLNI, the autopilot pitched the aircraft down. The flight crew attempted to recover the speed through the application of speed brake. However this, coupled with the aircraft pitching down, resulted in an increased rate of descent, which in turn led to the penetration of the 1,700 ft segment minimum safe altitude. The aircraft subsequently returned to its targeted flight profile by OOLNF and continued the approach for landing.

Figure 2: The instrument approach vertical profile

Source: Jeppesen

The Flight Crew Training Manual (FCTM) for the A330 stated that the activation of the approach phase will initiate a deceleration towards the approach speed or a speed constraint inserted into the Final Descent Point (FDP). The FDP was defined as the capture point of the final descent segment coded into the navigation data base. The two approach techniques for the final descent segment were the decelerated approach and the early stabilised approach.

For the decelerated approach, the vertical flight profile was managed by the aircraft’s Flight Management Guidance and Envelope System (FMGES) using data in the aircraft’s navigation database, modified as required by the flight crew. This was described as using the autoflight system in a ‘managed mode’. The deceleration profile targeted having the aircraft at 1,000 ft above the landing point, in the landing configuration and at the approach speed. This profile generally equated to the aircraft being configured with the first stage of flap/slat and at the required speed at the FDP. In the discussion on the use of a managed vertical profile for a non-precision approach, the FCTM noted that for some non-precision approaches, ‘the final approach flies an “idle descent” segment from one altitude constraint to another, followed by a level segment’.

The early stabilised approach technique required the flight crew to have the aircraft in the landing configuration and at the approach speed at the FDP. The final descent segment was then flown using a selected vertical profile mode, such as the Flight Path Angle (FPA) mode.

The ATSB obtained the navigation database used by the FMGES for the RNAV-Z (GNSS) Rwy 14 approach. That database included initial (OOLNI) and final (OOLNF) approach fixes and their associated altitude limits, but did not include the point 2.5 NM from OOLNF and its associated segment minimum safe altitude limitation. The database also included a three degree approach profile from the OOLNF, but did not include a three degree profile before OOLNF.

The operator’s investigation into the occurrence identified that, as the three degree glide path started at OOLNF, the aircraft would conduct a stepped descent between OOLNI and OOLNF. The stepped approach profile was reflected by the autopilot pitching the aircraft down as it passed through OOLNI. In a stepped approach, on passing an altitude constrained position (such as OOLNI), the autopilot will fly an idle descent to the new altitude constraint and then fly level until the completion of that segment. The operator also noted that the step down limitation between OOLNI and OOLNF was not coded into the database due to specific coding rules. In response to the occurrence event, the operator custom coded the RNAV-Z (GNSS) Rwy 14 approach to include a 3 degree slope from OOLNI. The operator also issued a memorandum to all pilots requiring all non-precision approaches into Australia to be conducted using the selected vertical guidance Flight Path Angle mode only. Based on this information, the ATSB determined that it was unlikely that further ATSB investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.

At about 1000 Western Standard Time on 10 September 2016, an Air Tractor AT-502 aircraft, registered VH‑ULV, was conducting aerial agricultural spraying activities at Salmon Gums, near Esperance, West Australia. During a turn at about 200 ft above the ground, the pilot lost control and the aircraft collided with terrain. The aircraft was substantially damaged and the pilot sustained serious injuries.

Figure 1: VH-ULV showing damage
 

Source: Operator

Preliminary enquiries by the ATSB suggest that the accident was attributable to pilot actions. The ATSB considered it was very unlikely that further investigation would uncover any systemic safety issues. The ATSB has discontinued the investigation.

What happened

On 18 September 2016, at about 1355 Eastern Standard Time (EST), the pilot of a Robinson R22 helicopter, registered VH-PFX, commenced aerial mustering on a property about 15 km south of Coen, Queensland.

After successfully mustering one mob of cattle into a yard, the pilot started moving a second mob towards the north. The cattle started to move west instead of north, so the pilot descended closer to the cattle to encourage them to turn.

At about 1415, the helicopter was about 10 ft above the ground, at an airspeed of 40 to 50 kt, when a cow with long horns charged and reared up at the helicopter. The cow’s horn went over the right skid of the helicopter, trapping the skid underneath it. The pilot applied full left cyclic^[1] and raised the collective^[2], but the helicopter rolled to the right. The main rotor blade struck the ground and the helicopter collided with the ground and slid about 10 m along a dirt road.

As the helicopter slid along the ground, it caught fire. The pilot exited with minor injuries and the helicopter was destroyed (Figure 1).

Figure 1: Accident site showing VH-PFX destroyed by post-impact fire

Source: Queensland Police

Pilot comments

Normally, the helicopter can remain at a higher altitude and mustering will still be effective as the noise moves the cattle in the intended direction. Very occasionally, when the area is clear, the only way to move the cattle is to get down low.

Bladder-type fuel tanks

In July 2014, the Civil Aviation Safety Authority’s (CASA) monthly update, the CASA Briefing included the section ‘R22 operators urged to fit new fuel tanks’. CASA strongly recommended operators of R22 helicopters to install modified fuel tanks as early as possible. This was in response to Robinson Helicopter Company R22 Service bulletin SB-109, which required R22 helicopters with aluminium fuel tanks to be retrofitted with bladder-type tanks to improve the fuel system’s resistance to a post-accident fuel leak. The retrofit was to be completed as soon as practical, but no later than the next 2,200-hour overhaul or 12-year inspection.

VH-PFX was not fitted with bladder fuel tanks. Although the bladder tanks could have been fitted at any time, as the aircraft had not yet reached the 2,200-hour overhaul or 12-year inspection period, it was not yet required to be fitted with bladder fuel tanks.

ATSB comment

Aerial mustering, as with other low-flying operations, carries an inherent level of risk. Elevated awareness and vigilance is necessary to fly an aircraft safely, monitor for the effects of environmental conditions such as wind direction and strength, and to scan for and avoid obstacles and other hazards. Operating at the height of the animals while mustering introduces additional risk as animals can act unpredictably, and should only be done as a last resort. At low level there is limited opportunity to react and respond to an abnormal situation.

Short Investigations Bulletin - Issue 55

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.
2. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.

What happened

On 8 September 2016, at about 1900 Eastern Standard Time (EST), an Airbus A320-232 aircraft, registered VH-VFN, was being loaded at Sydney Airport, New South Wales, to operate Jetstar flight JQ820 from Sydney to Brisbane, Queensland.

The leading hand assigned to loading the aircraft had received the deadload weight statement^[1] (DWS) for the cargo from the cargo terminal operator (CTO), and printed out a copy to refer to while loading the aircraft. The DWS listed three containers of freight, which the leading hand reported was usually loaded onto the aircraft before the passenger bags. The CTO had previously delivered the three containers to the loading bay from their facility. The leading hand checked the containers with those listed on the DWS – crosschecking the container numbers and the flight details, and confirming that the sum of the weight of the three containers corresponded to the total gross weight on the DWS. Two of the three listed containers were correct, however, the third was listed on the DWS with number 4183 and a gross weight of 240 kg, while the container on the bay was number 1483 (Figure 1), which was subsequently found to have had a gross weight of 900 kg.

Figure 1: Container AKH 1483 JQ

Source: Jetstar

The container card associated with, and attached to the container also had number 4183 on it (Figure 2). The leading hand assumed that the freight handler had inadvertently transposed the first two digits of the container number from 14 to 41, entered that onto the card and transferred the error onto the DWS. The leading hand therefore amended the card and the DWS with the actual number of the container (1483), and entered that container number onto the underfloor load advice (ULA) as it was loaded onto the aircraft (Figure 3).

The leading hand supervised the loading of the three containers and the passengers’ bags onto the aircraft and completed filling out the ULA. Container 1483 was loaded into position 32 (see Underfloor load advice), which was close to the aircraft’s centre of gravity.

Figure 2: Container card

Source: Jetstar

Figure 3: Extract of the underfloor load advice

Source: Jetstar

At about 1915, the leading hand completed loading the aircraft and took the paperwork, including the DWS and ULA, to the flight deck. The captain sighted the amendments and the leading hand explained that they had amended the container number because the digits had been mixed up. The captain said they would accept the paperwork if the leading hand was sure the contents of the container was the same as the container listed on the DWS. The leading hand affirmed, as they believed at the time, that the weight was correct and the container number was now correct on the DWS and ULA.

The flight crew then entered the data into the loading program and crosschecked it. The data was then used to generate the take-off data including reference speeds and trim settings based on the weights provided on the DWS. The crew then entered the performance data into the aircraft’s flight management and guidance system.

The aircraft departed on time at about 1925. The flight crew were not aware of the discrepancy during the flight and did not encounter any handling or control issues on take-off or receive any abnormal indications.

Subsequent investigation revealed that the incorrect container was delivered for loading; the CTO had delivered container 1483 (which weighed 900 kg) instead of 4183 (which weighed 240 kg).

Freight management procedures

The aircraft operator’s procedures included that if the DWS was incorrect, then the leading hand was to ‘offload’ the freight – that is, not load it onto the aircraft and remove it from the DWS, irrespective of how the incorrect container arrived at the bay.

Leading hand’s comments

Generally, if there is a discrepancy between the freight and the DWS, the leading hand commented that they would cease loading, go to the office and give the CTO a call. They would then ask the team to email a new DWS and bring a new container card to the loading bay. In this event, time did not permit the normal process to be followed, due to the short turnaround time for the aircraft. In addition, as it was the last Brisbane flight of the day, they were trying to ensure the cargo would be loaded if possible. The leading hand also commented that in their experience, it was not uncommon to have discrepancies on the DWS, including errors in the weights. The leading hand assessed that this had just been a simple transcription error, and changed the numbers.

The leading hand had not been to the CTO facility and was not certain as to how the container card and DWS were compiled. However, the leading hand was experienced in operations in the bag room, where the bags were loaded into containers. The loader would then fill out the container card including the container number and the number of bags loaded into the container. The leading hand commented that transcription errors sometimes occurred in that process, resulting in the incorrect number on the container card. The leading hand would then amend the card to reflect the actual (and correct) container number.

The leading hand subsequently found that the CTO did not operate in a similar way to the bag room. On this occasion, container 4183 with 240 kg of freight was scheduled to be loaded onto JQ820, but the incorrect container was delivered to the bay. The leading hand was advised during a post-incident discussion, that the container numbers and corresponding cargo are entered into a database at the CTO and the container numbers on the DWS would therefore be correct.

The leading hand stated that they would only open up the containers to check the contents if there were dangerous goods manifested in the contents, to check for spills or leakages, or if some contents were insecure. Otherwise, once the container is delivered to the bay from the freight shed, there is no confirmation of its contents and no ability to check the weight of the container.

Captain’s comments

The captain commented that it is necessary for the leading hand to be able to amend the ULA, which is a Jetstar document. However, the DWS is not a Jetstar-generated document. If there was a Jetstar procedure that did not allow amendments to the DWS (and a new one was required from the CTO whenever a change was deemed to be necessary), that may prompt the CTO to review the DWS details. Such a review may identify any discrepancies such as an incorrect container. This would provide an additional defence against an incident of this nature.

The aircraft operator responded to the comment, advising that the operations manual stated that ‘all changes to the DWS must be completed by the cargo terminal operator (CTO)’.

The captain was not required to sign the ULA, unlike the Notification to the Captain (NOTOC) – which contains information about dangerous goods. The captain commented that ULAs were frequently amended, and if the leading hand amends them on the flight deck, they then initial the change.

The leading hand is a trusted member of the team; the captain delegates responsibility for the loading of the aircraft to them. If there are any issues with the loadsheets, the flight crew clarify them with the leading hand. The flight crew can also contact the ground operations controller (GOC) if there are any issues, but the GOC will refer the crew to the leading hand for questions regarding the underfloor load.

The captain accepted the amendment to the DWS based on the leading hand’s confirmation that the correct container weighing 240 kg had been loaded onto the aircraft. The captain then entered that weight into the loading program, an iPad application ‘Jetload’, which was used to generate the aircraft’s performance data.

The captain commented that the Jetload program is very robust and is designed around ease of use. It prevents crew making a basic input error because there is a crosscheck. If there is a mismatch, it will not proceed to the next screen. The data then goes into the Airbus fly smart program along with the environmental and aircraft data, and generates the V speeds^[2] and flex temperature for take-off. While the system is robust, it depends on the correct data being provided on the DWS and ULA. Offloading freight or bags is easy to do with the program and only takes 5–8 minutes for the leading hand to action and the crew to amend the data.

Deadload weight statement

The deadload weight statement (Figure 4) was generated by the freight shed at 1824 and the loading details specified three unit load device (ULD, or container) items: AKH4183JQ gross weight 240 kg, AKH4297JQ 300 kg and AKH1583JQ 115 kg, all destined for Brisbane with a total ULD weight of 655 kg.

Figure 4: Extract of the deadload weight statement

Source: Jetstar

Effect on the aircraft

The actual container loaded onto the aircraft weighed 660 kg more than the 240 kg entered into the loading program, and was loaded close to the aircraft’s centre of gravity. The trim setting used for the take-off was the same as would have been used if the actual container weight and position had been entered and the derived V speeds were within 1 kt and the flex temperature within 1 °C of those generated based on the actual aircraft take-off weight. There was no effect on the aircraft performance or handling and no issues or abnormal indications were identified by the flight crew.

Based on the weights listed on the DWS, the leading hand commented that they could have loaded any of the three containers into the forward compartment of the aircraft, but elected to load container 4297 with a gross weight of 300 kg for position 11 (Figure 3) and fortuitously elected to load 1483 close to the centre of gravity.

Safety analysis

The aircraft operator advised that a member of the freight company misread the digits on the container (confusing 1483 for 4183) and transported it to the incorrect bay while delivering the correct DWS and container card.

The leading hand (incorrectly) assumed the freight container (1483) was the correct container to be loaded, but that the container number on the container card and DWS (4183) had been entered incorrectly (due to a transcription error). Although the leading hand could have requested a new printed DWS and container card, due to the combination of the limited turnaround time available and the concern to ensure the freight made it to the destination that night, the leading hand instead ‘corrected’ the numbers with a pen so they matched the number on the container. This resulted in a lost opportunity for the leading hand’s incorrect assumption to be identified. Similarly, although the captain could see there was a discrepancy, they accepted the hand-written amendment to the DWS based on the leading hand’s assurance that the correct container been loaded onto the aircraft.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• An incorrect container was delivered to the ramp by the cargo terminal operator, probably because the cargo terminal operator crew misread the similar container numbers.
• The short turnaround time combined with this being the last flight to Brisbane that night, along with the assumption there was a transcription error, resulted in the leading hand not requesting a new deadload weight statement and container card, and loading the incorrect container on the aircraft.
• Due to the leading hand's assurance, the captain accepted the hand-written amendment to the deadload weight statement.
• Although the actual take-off weight was about 660 kg more than the calculated take-off weight, as the container was loaded close to the aircraft’s centre of gravity, there was no effect on the aircraft performance or handling.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Aircraft operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

Reminder to ground staff

Ground crew have been reminded to offload any freight where there is a discrepancy in the paperwork.

Safety message

The procedure published by the aircraft operator was to offload freight if a discrepancy existed. The leading hand thought it was a simple typographical error and amended the associated paperwork. Their intention was to facilitate loading the freight if at all possible, rather than offload it and leave it overnight for the next shift to deal with. This incident highlights how being service oriented to increase efficiency can inadvertently bypass safety-related risk controls.

Short Investigations Bulletin - Issue 55

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Deadload weight statement: Document produced by the cargo terminal operator that listed the details of freight booked on a specific flight.
2. V speeds: take-off reference speeds or V speeds are provided by the manufacturer to assist pilots in determining when a rejected take off should be initiated, and when the aircraft can rotate, lift off and climb.

What happened

On 9 September 2016, at about 0005 Eastern Standard Time (EST), an AirAsia X Airbus A330-343X, registered 9M-XXK (XXK) pushed back^[1] from gate D12 to disconnect point S7 (Figure 1) at Melbourne Airport, Victoria, to operate scheduled passenger flight D7213 to Kuala Lumpur, Malaysia. Although it was night-time, the apron was well lit by flood lights.

The aircraft maintenance engineer (AME) conducting the pushback was provided by a contracted company, the tug and tug driver were provided by a third company. Prior to commencing the pushback, the AME installed the nose gear steering bypass pin,^[2] connected the tow bar to both the aircraft nose landing gear and the tug. During the pushback, as the tug moved the aircraft, the AME was seated in the tug. The AME was in continuous communication with the flight crew using a headset connected directly through a headset jack to the cockpit. During the pushback, the flight crew started one engine. After reaching disconnect point S7, the flight crew applied the park brake and started the second engine.

Figure 1: Melbourne Airport apron section overview

Source: Airservices Australia, modified by ATSB

At 0008, after both engines were started, the AME disconnected the headset and tow bar from both the aircraft and the tug, the AME also removed the bypass pin. The tug driver turned the tug around to allow the AME to attach the tow bar to the rear of the tug. The tug driver then moved the tug and tow bar to a position forward of the aircraft’s right engine and visible to the first officer (Figure 2). The AME then walked to a position in front of the tug, and displayed the bypass pin to the first officer. The AME received a hand signal from the first officer confirming the first officer had sighted the bypass pin. Sighting the bypass pin was the final item on the flight crew’s after start checklist. The flight crew then contacted ATC and obtained a taxi clearance.

At 0009, the first officer confirmed to the captain that the AME and tug were clear, the captain then began to taxi. At this time, the AME was walking towards the left side of the tug, which remained parked forward of the aircraft’s right engine and wing. As the AME walked, they detected the aircraft’s taxi light illuminate and the aircraft begin to move. The AME then ran toward the tug door and alerted the tug driver to the aircraft movement.

Video footage of the incident shows the tug driver taking action to avoid a collision with the taxiing aircraft.

The flight departed without further incident.

Figure 2: Positions at commencement of aircraft taxi

Source: Melbourne Airport, modified by ATSB

Flight crew procedures

The flight crew procedures included the following steps:

• After the pushback and engine start sequence is complete, the bypass pin must be sighted.
• Once taxi clearance is obtained, the flight crew shall ensure both sides of the aircraft are clear prior to taxi.

Flight crew comments

The flight crew of XXK provided the following comments:

• Both flight crew interpreted the AME displaying the bypass pin as meaning the tug and AME were clear, and it was safe to commence taxi.
• The flight crew assumed that ATC providing the taxi clearance meant that ATC had confirmed the tug was clear of the aircraft.
• The first officer observed the tug and AME to the right of the aircraft and assessed that they were clear of the right engine.

Aircraft maintenance provider procedures

The ground handling procedures include the following steps:

• Once the tow bar is connected to the tow vehicle (after being disconnected from the aircraft), the tow vehicle must move away to an area that is visible to the flight crew.
• At a suitable and safe distance from the aircraft, (the AME must) hold up the bypass pin to provide visual confirmation that it has been removed to the flight crew and give a ‘thumbs up’ signal indicating ‘clearance to proceed’. Once acknowledged by the flight crew, move away from the aircraft to a safe distance for the aircraft to taxi.

AME and tug driver comments

• The tug driver and AME both commented that they expected the aircraft to remain stationary until they had moved clear of the S7 disconnect point boundary.

Airservices Australia safety bulletin

The AME and captain commented that they expected air traffic control (ATC) to confirm that the tug was clear of the aircraft and disconnect point S7 prior to providing a taxi clearance.

In 2015, ATC provider, Airservices Australia, identified some misinterpretation among pilots, airside drivers and ground crew regarding the responsibilities for collision avoidance on aerodrome movement areas and the services ATC provide to aircraft and/or vehicles operating on these areas. In response, on 12 November 2015, Airservices Australia released an Aeronautical Information Circular AIC (H32/15) and subsequently in 15 March 2016, this information was released as a safety bulletin, Safety of ground movement on a controlled aerodrome. The bulletin had been provided to the operators involved in this incident.

The bulletin contains the following information regarding operations on the apron and push-back approvals:

The pilot in command (with any assisting ground personnel) is responsible for avoiding collision on the apron. ATC push-back approvals and taxi clearances are only to regulate entrance to, and movement on, the taxiways and do not relate to movement on the apron areas.

When ATC issue approval for push-back or taxi clearance, they will only provide information about relevant known aircraft moving on the same apron. This information may be incomplete as ATC has limited knowledge (or visibility) of movements on the apron. Pilots must also obtain traffic information from assisting ground personnel and, where available, the apron service which may be established as a discrete service at some locations.

Safety analysis

The flight crew interpreted the AME showing the bypass pin at the end of the pushback sequence as notification that all vehicles and equipment were clear of the aircraft and it was safe to commence taxi. The ground crew expected that the flight crew would commence taxi only after all personnel and equipment had crossed the line demarcating the boundary of the S7 disconnect point. Both the flight crew and AME expected that the aircraft would not receive a clearance to taxi until ATC had confirmed that the tug and AME were clear. The misunderstandings by the parties involved during this sequence likely led to incorrect expectations of when the aircraft would begin taxi and the aircraft beginning to taxi prior to the tug moving clear.

The flight crew procedures required the flight crew to visually confirm that all ground equipment was clear of the aircraft prior to taxi. The first officer assessed that the tug and tow bar were clear of the right engine when they were not, although their perception may have been influenced by an expectation of them being clear given the communications with the AME and ATC providing taxi clearance.

Findings

This finding should not be read as apportioning blame or liability to any particular organisation or individual.

• The flight crew and ground crew had differing understandings of procedures. These differing understandings led to different expectations of when the aircraft would commence taxi which resulted in the near collision.
• The first officer incorrectly assessed the distance of the tug from the aircraft.

Safety message

Ground handling of large aircraft presents many safety risks and requires many separate operators to work closely together. Effective teamwork ensures safe and efficient ground operations.

This incident highlights the importance of separate operators working closely together and having procedures which are well harmonised. It is also important that these procedures are well understood and practiced by all individuals involved from the different operators to ensure all parties understand their role but also how their role interacts with other parties.

Also highlighted, is the importance of understanding the services provided by ATC. ATC provide separation between aircraft, personnel and equipment operating on manoeuvring areas. ATC do not separate aircraft from tugs and other ground personnel on apron areas such as disconnect point S7.

__________

1. Pushback is a procedure during which an aircraft is pushed back, away from an airport gate or bay, by an external tug.
2. The nose gear bypass pin is installed during the pushback sequence to bypass the normal aircraft steering, allowing the tug to control aircraft steering.

Aviation Short Investigations Bulletin - Issue 57

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 11 September 2016, at about 1000 Eastern Standard Time (EST), a Jabiru SP500 aircraft registered 19-5503 (5503), departed Caboolture Airfield, Queensland (Qld), for a flight to Boonah Airfield, Qld. The pilot was the only person on board.

As the aircraft approached Boonah Airfield, the pilot observed large white crosses on the runway indicating the airfield was closed. The pilot elected to return to Caboolture and applied engine power to climb to cruise altitude.

At about 1055, the aircraft climbed to the north of Boonah. At a height of about 1,000 ft above ground level, the pilot noticed the engine RPM reducing and applied full throttle. At the same time, the pilot observed a low and fluctuating engine oil pressure indication. Within seconds, the engine failed and the propeller stopped rotating. The pilot broadcast a MAYDAY^[1] call on the Amberley common traffic advisory frequency. Air traffic control staff at RAAF Base Amberley received the MAYDAY broadcast and initiated an emergency response.

The pilot identified a paddock to the north of their position as suitable for a forced landing. They manoeuvred the aircraft to conduct a forced landing into the paddock (Figure 1). The pilot ensured that turns made during the forced landing were not tight and of low bank angle to avoid an aerodynamic stall. Late in the ground roll, the nose wheel dug into the soft surface (Figure 2), the aircraft tipped onto its nose and the right wingtip struck the ground. The aircraft then stopped and settled onto its wheels. The pilot was not injured, and the aircraft sustained minor damage.

Figure 1: 19-5503 after the forced landing

Source: Pilot

Figure 2: 19-5503 after the forced landing

Source: Pilot

Engineering details and examination

5503 is an owner built and maintained aircraft. The engine fitted to 5503 was manufactured in 2001.

A post incident examination of the engine found the engine oil pump drive had failed.

Due to the limited scope of this investigation a post incident engineering examination was not conducted. The cause of the oil pump drive failure was not determined.

Previous occurrences

Jabiru advised that they are aware of one previous oil pump drive failure. In the previous occurrence the manufacturer found the engine maintainer had tightened the oil pump housing bolts (Figure 3) unevenly.

The Jabiru engine overhaul manual part 7.8.17 contains the following guidance on this part of the engine assembly:

Fit the outer pump housing over the gears and insert & hand tighten the retaining cap screws. Use Loctite 243 on the threads and ensure the Jabiru bird is oriented correctly.

While the housing is still loosely held to the engine, rotate the crankshaft through at least 2 full revolutions. This turns the cam and allows the oil pump to find its preferred position. The housing can now be tightened to the value given in Table 9.^[2] Failure to turn the engine can result in the oil pump being offset from the cam axis – this applies side loads to the cam and can eventually crack it or break the tip off altogether.

Figure 3: Oil Pump Housing (not incident engine)

Source: Jabiru

ATSB comment

In December 2014, the Civil Aviation Safety Authority (CASA) introduced instrument 294/14 imposing operation limitations on aircraft fitted with Jabiru engines. In July 2015, this instrument expired and was replaced by instrument 102/15.

In July 2016, instrument 102/15 expired. CASA then introduced instrument 65/16 – Conditions and direction concerning certain aircraft fitted with engine manufactured by Jabiru Aircraft Pty Ltd. removing restrictions on Jabiru engines which met criteria detailed within the instrument.

The engine fitted to the aircraft was a Generation 1^[3] engine. The pilot reported that the engine was maintained in accordance with Jabiru directions and complied with all Service Bulletins and Service Letters.

The ATSB determined that the operational restrictions imposed by instrument 65/16 did not apply to this aircraft.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The oil pump drive failed leading to engine failure and forced landing.
• The soft surface of the paddock used for the forced landing resulted in damage to the landing gear.

Safety message

This incident is a good example of the effect an in-flight engine failure at a low altitude has on the time available to manage that failure and identify a suitable forced landing area.

The ATSB booklet Avoidable Accidents No. 3 - Managing partial power loss after take-off in single-engine aircraft contains information that is also relevant to a complete engine power loss in flight.

The booklet shows that you can prevent or significantly minimise the risk of damage following a partial or complete engine power loss by using the strategies below:

• Pre-flight decision making and planning for emergencies and abnormal situations for the particular aerodrome
• conducting a thorough pre-flight and engine ground run to reduce the risk of a partial power loss occurring
• taking positive action and maintaining aircraft control either when turning back to the aerodrome or conducting a forced landing until on the ground, while being aware of flare energy and aircraft stall speeds.

Short Investigations Bulletin - Issue 55

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
2. Table 9 of the Jabiru engine overhaul manual.
3. A Jabiru 3300 engine in the manufacturer serial number range 33A0001 – 33A0960.