What happened

At about 2310 Eastern Standard Time (EST), a Hawker Beechcraft Corporation B300C, registered VH‑NAO (NAO), taxied at Sydney Airport, New South Wales (NSW) for a flight to Coffs Harbour, NSW to retrieve a patient. On board were the pilot and three medical staff. The weather was fine and clear.

The pilot made a taxi call and air traffic control (ATC) cleared NAO to taxi from the domestic 5 apron where the aircraft was parked, with a requirement to give way to an inbound company aircraft (taxiing to the domestic 5 apron) and hold short of taxiway delta.

At about the time that NAO taxied, activities commenced in association with planned aerodrome works near the intersection of taxiways golf, charlie and domestic 2 (see Figure 1). Two work safety officers moved to the area in separate vehicles to establish the worksite. Establishment of the worksite included placement of red lights across affected taxiways and covering (taping over) existing green taxiway centreline and lead-in lighting. Placement of red lights and covering of existing lights was intended to delineate the closed areas of affected taxiways.

Figure 1: Excerpt from aerodrome chart showing the location of the relevant taxiways

Source: Airservices, modified by the ATSB

Other aerodrome works activities required the closure of runway 16R, north of golf. Associated with that work, the controller switched off the runway lights north of the intersection of the runway with golf. Additionally, runway 07/25 was closed.

Once the inbound company aircraft was clear, the pilot of NAO was given further taxi clearance. The cleared route was intended to take the aircraft around the worksite that was being established, and to approach runway 16R at the point from which the aircraft could depart. The pilot was cleared as follows:

…taxi golf, bravo 4, and then left at bravo to the golf holding point runway 16R, just to go around the worksite.

After placing red lights at the eastern and western ends of the worksite on golf, a safety officer moved to the northern end of the worksite on charlie. The safety officer parked the vehicle on the centreline of charlie, facing west across the taxiway, and commenced placing red lights across the taxiway between the position of the vehicle and where charlie meets bravo 4. By then, NAO was on bravo 4, and the safety officer was aware of the location and expected taxi route of the aircraft.

Soon after the safety officer commenced placing red lights across charlie, the pilot contacted ATC to confirm the instruction to turn left into bravo, then back onto golf. The controller advised the pilot that they were ‘just crossing charlie now, so bravo is just coming up on your left, about 50 m, and then you’ll be right into golf’. At that point, the pilot believed that they had already passed charlie, and were now required to make a sharp left turn into bravo, following the green taxiway lights.

The pilot turned left, believing that they were entering bravo, where in fact, the aircraft was entering charlie, in the area where the safety officer was in the process of placing red lights. As the pilot made the turn, they were not aware of the position of the safety officer, who by then had placed four of seven red lights across charlie. The safety offer saw that NAO had turned onto charlie and waved at the pilot believing that the aircraft would stop. The pilot did not report seeing the safety officer but saw the vehicle and manoeuvred the aircraft to the western side of the centreline to pass the vehicle. The left-wing tip of the aircraft passed about 2 to 3 m from the safety officer who moved further out the way as the aircraft passed. At the time, the vehicle warning beacon was operating, and the headlights were on. The safety officer was wearing a high visibility vest.

About ten seconds after advising the pilot of NAO that they were crossing charlie, and that bravo was a further 50 m ahead, the controller observed the aircraft turning into charlie. The controller immediately advised the pilot that the aircraft was heading towards the worksite and restated the requirement to ‘continue to the north-west on bravo 4, and then bravo will be on your left’. The pilot advised the controller that the situation was ‘confusing’ and that they would turn around. The controller informed the pilot that there were safety vehicles in the area that could provide assistance if required. The pilot declined that offer, and advised the controller that they would ‘just get round this one’, confirming that the safety vehicle on charlie was sighted.

The pilot made a 180 degree turn on charlie and headed north, back towards bravo 4. The safety officer saw that NAO was returning and moved the vehicle off the centre line. The pilot passed the vehicle and taxied onto bravo 4, before making a left turn onto bravo, as initially intended. The approximate taxi path of the aircraft and the position of the safety vehicle at the time the aircraft entered charlie are shown in Figure 2.

The pilot taxied southward on bravo, but turned right towards runway 16R on bravo 6, contrary to the clearance which was to taxi to the runway holding point on golf. ATC advised the pilot that the aircraft appeared to be entering bravo 6, and that golf was the taxiway ‘just to the south’.

With the aircraft on bravo 6, ATC checked with the safety officer managing the runway 16R closure to confirm that the aircraft could enter the closed part of the runway at that point without causing any concerns, to which the responsible safety officer replied ‘affirm’. The pilot asked ATC if they required the aircraft to reposition, but ATC was able to provide a clearance to enter the runway at the bravo 6 intersection. ATC cleared the aircraft to enter at bravo 6 and taxi south on the runway to the point at which golf intersects the runway (the runway was available for take-off south of that intersection). The aircraft taxied forward then took off from runway 16R without further incident.

Figure 2: Approximate aircraft taxi path and location of safety officer’s vehicle

Source: Aircraft operator, modified by the ATSB

Safety analysis

Aerodrome works

Aerodrome works on golf had been underway at Sydney aerodrome since early in 2016 and were undertaken during the aerodrome curfew period. Airservices Australia Aeronautical Information Circular (AIC)^[1] H38/15 provided a summary of the works, including a statement that ‘operational restrictions will be advised by NOTAM’^[2]. On the night of the occurrence, the relevant NOTAM came into effect at 1300 UTC (2300 EST), and included the following operational restrictions:

TWY RESTR DUE WIP

TWY G BTN TWY B AND TWY B4 NOT AVBL

TWY C BTN TWY B4 AND RWY 07/25 NOT AVBL

TWY DOM2 BTN TWY B4 AND TWY G NOT AVBL

Although the pilot was aware of the aerodrome works, they were unaware of this particular NOTAM.

Taxi route

The taxi route by which the pilot was cleared was uncommon. The pilot had considerable experience operating at Sydney, but could not recall having followed the taxi path previously, either during the day or at night. Under normal circumstances, the pilot would have expected to taxi to runway 16R via golf. At the time of the occurrence, taxi via golf was not available because of the works. Similarly, runway 07/25 was also unavailable for taxi.

Aerodrome lighting conditions and taxiway markings

The taxi paths through the open space at the junction of bravo 4, charlie and charlie 2, are complex. Numerous guidance markings and lights complicate the area, and bravo 4 merges with charlie for a short distance as the two taxiways cross (Figure 3). A curve in bravo 4 as it meets charlie may have given the pilot the impression that the aircraft had arrived at the intersection of bravo 4 and bravo, being the point at which a sharp left turn was required. This expectation by the pilot may have been reinforced by the fact that the aircraft had just passed domestic 2, which the pilot may have misinterpreted as charlie.

The potentially confusing characteristics of the taxiway junction would have been exacerbated at night. At the time of the occurrence, additional vehicle lights were moving about the area, some steady (head/tail lights) and some flashing, and the partially established worksite lighting would have further complicated the environment. The pilot expected that some lights may have already been covered or turned off, which added to the potential for confusion over taxiway identification.

Figure 3: Taxiway intersection showing the area where bravo 4 veers right (taxying NW) and bravo 4 and charlie merge for a short distance

Source: Google earth, modified by the ATSB

At the time of the occurrence, the lead-in lighting to charlie and the charlie taxiway lighting had not yet been covered. This may have given the impression that the taxiway was still available, perhaps further reinforcing in the pilot’s mind that they had already passed charlie, and reached bravo. The taxiway signage was not affected by the works and was illuminated at the time of the occurrence. The pilot commented that their mental picture of the area was different to what they encountered at the time of the occurrence.

For similar reasons, as the pilot turned into bravo 6 (from bravo) to approach runway 16R, they were initially under the impression that they had reached golf.

Electronic charts

The operator had recently installed electronic charts (e‑charts) in the aircraft. Using GPS information, e‑charts can provide near real-time on-aerodrome positional information. At the time of the occurrence, the pilot was using paper charts, because they were more comfortable with paper charts and had not been trained in the use of e‑charts. The use of e‑charts was not mandated by the operator.

ATSB Comment

Continuing aircraft operations in the vicinity of a worksite while that worksite is only partially established, can be problematic. Operational considerations should be carefully balanced with the safety implications of allowing aircraft to continue to operate near a partially established worksite.

Under some circumstances, particularly where other complicating factors exist (such as poor ambient lighting conditions), it may be prudent to identify a transition period, and temporarily restrict aircraft movements until the worksite is fully established. The transition period would essentially be the time from which ATC release control of an area to a safety officer, until the safety officer then advises that establishment of the worksite is complete.

Airservices provided comment in relation to establishing a transition period, advising that the potential for a transition period to cause additional confusion around the availability of the work surface, or create additional disruption during times of high traffic levels would need to be taken into consideration. They consider the current process of instructing pilots with detailed taxi routes, as was the case in this occurrence, is effective. ATC will treat work areas as unavailable once an area is released to the work safety officer.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The pilot was unaware of relevant taxiway closures until advised by ATC as part of their taxi clearance.
• The pilot became confused about the position of the aircraft as they taxied past the worksite on bravo 4, probably due to a combination of factors, including:
• The pilot was not familiar with the taxi route, and the taxi route took the aircraft through a complex junction of taxiways at night.
• The worksite was only partially established (not all red lights were in place, and some existing taxiway lighting had yet to be covered).
• The pilot was not familiar with the use of e‑charts, which may have assisted with their orientation under the circumstances.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Aircraft operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are considering the following safety actions:

• Implementation of a training program to cover some contributing factors identified in the internal company report dealing with the occurrence, including the use of e-charts and other similar technologies.
• Development or acquisition of safety promotional material for staff, dealing with aircraft operations near worksites.

Safety message

This occurrence highlights the potential hazards involved when mixing aircraft operations with aerodrome works. The potential for misunderstanding or confusion is significant, particularly at night and in complex movement areas. The potential for confusion is further elevated when a worksite is in the process of being established. Relevant authorities are encouraged to carefully consider the risks involved and implement appropriate risk management strategies to minimise the likelihood of a misunderstanding or confusion.

Additionally, pilots are encouraged to stop and seek clarification from ATC if there is any doubt about the cleared taxi route. Similarly, ATC officers are encouraged to direct an aircraft to stop if they have any doubt about the intentions of the pilot, or there is any evidence that taxi instructions have been misunderstood. Timely and effective communication is essential to a shared understanding in a dynamic operational environment, particularly when the environment is complicated by unusual circumstances.

Aviation Short Investigations Bulletin - Issue 58

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Aeronautaical Information Circular (AIC) is information for personnel concerned with flight opeations that is of an administrative nature and not directly concerned with the present conduct of flight opeations, but may have implications for the future (Aeronautical Information Publication (AIP) GEN 3.4).
2. A NOTAM is a notice that the timely knowledge of is essential to personnel concerned with flight operations that contains information concerning the establishment, condition or change in any aeronautical facility, service, procedure or hazard (Aeronautical Information Publication (AIP) GEN 2.2).

What happened

On 23 August 2016, at about 0634 Eastern Standard Time (EST), a Regional Express Saab 340B aircraft, registered VH-ZRJ, taxied at Ballina/Byron Gateway Airport, for a scheduled passenger flight to Sydney, New South Wales. On board were two flight crewmembers, one cabin crewmember and 22 passengers (Figure 1).

Figure 1: VH-ZRJ

Source: Victor Pody

All engine indications had been normal throughout the start and after-start procedures. The crew elected to use runway 06 for take-off. The runway was wet so the flight crew selected the environmental control system (ECS) off for take-off in accordance with the operator’s standard operating procedures.

Shortly after take-off, the captain called ‘positive rate gear up’ and the first officer selected the landing gear up. While the gear was retracting, the crew heard loud bangs and the left engine performance degraded noticeably, reducing the climb performance. The crew also noticed that the left engine instruments were fluctuating rapidly and indicating a high inter-turbine temperature. At that time, the cabin crewmember advised the flight crew that passengers could see flames coming from the left engine.

The flight crew kept the aircraft tracking straight ahead over water and climbing. Based on the noises and engine instrument indications, the crew identified the issue as a compressor stall and carried out the failure management procedure. This included reducing the power on the left engine and setting maximum continuous thrust on the right. Reducing the power also reduced the banging noises to popping noises.

At about 0639, the first officer contacted air traffic control (ATC) and declared a PAN.^[1] The crew then commenced the checklist procedures for a compressor stall from the operator’s quick reference handbook. The checklist procedure involves trying to increase the rearward flow of air through the compressor via the low- and high-pressure bleed valves and the engine anti-ice bleed valves. Although reducing the fuel flow to the left engine reduced the popping noises, the compressor stall continued. The crew therefore commenced the appropriate failure management procedure to shut down the left engine and feather the left propeller.

At about 0650, the crew shut down the left engine and the first officer advised ATC that they had one engine inoperative. The crew also advised ATC that once they had completed their checks, they would return to Ballina via an area navigation (RNAV) approach.

After levelling out at 5,000 ft, the captain completed two to three holding patterns while the crew completed all relevant checklists. They then made an RNAV approach to runway 24. The captain reported that the approach and landing went smoothly and the aircraft landed at about 0720.

During the landing roll, as the captain moved the thrust lever on the right engine from flight idle to ground idle, the aircraft deviated to the right of the runway centreline. The captain later commented that this was probably associated with asymmetric propeller drag (the left propeller was feathered and the right propeller generated more drag as the right thrust lever was moved into ground idle). The captain moved the right engine thrust lever forward, out of ground idle, and the aircraft straightened up. The taxi to the bay was uneventful. There were no injuries to crew or passengers and no damage to the aircraft.

Pilot comments

The captain commented that ECS is usually selected ON for take-off on the first flight of the day (see Similar incidents). However, as the runway was wet, the crew selected ECS to OFF for this take-off, which was the standard procedure because of the performance considerations associated with a wet runway. In this incident, it is unlikely that the ECS selection contributed to the compressor stall, as the stall did not clear despite reducing the fuel flow and managing the bleed air in the failure management checks.

Both members of the flight crew commented that their simulator training, dealing with compressor stalls and one-engine inoperative scenarios, had been invaluable in contributing to their effective management of the situation. A compressor stall scenario that the captain had recently practised in the simulator was very similar to the incident, except that during the actual incident, the noises were louder and the instrument fluctuations more varied.

The captain also commented that the aircraft was easier to handle than the simulator during the compressor stall/one engine-inoperative situation, except during the landing roll where the simulator did not mirror the yawing tendency when ground idle is selected.

Engineering report

Engineers reviewed the flight data from the incident flight, which confirmed a compressor stall had occurred. No exceedances of torque, inter-turbine temperature, or turbine speed (rpm) limits (Ng and Np) were recorded. Borescope inspections of the engine did not detect any compressor damage. After finding no fault that may have caused the compressor stall, engineers replaced the hydromechanical unit (HMU) in accordance with the manufacturer’s fault isolation procedure.

The SAAB 340B Aircraft operations manual includes the following in the description of the HMU:

The HMU provides high pressure metered fuel for combustion. It contains a high-pressure vane pump and a pressure regulator and metering valve that schedules fuel to meet the various engine operating conditions and demands. The HMU also controls the variable geometry system (inlet guide vanes and stage 1 and 2 stator vanes) and the start and anti-ice bleed valve to provide for efficient and smooth engine operation throughout the entire speed range.

Significantly, the variable geometry system is instrumental in minimising the risk of compressor stall.

After replacing the HMU, engineers conducted ground runs of the engine with no defects found and the aircraft was returned to service.

Compressor stall

A turbine compressor stall occurs when there is a breakdown in airflow through the compressor. This can lead to a flow reversal, banging sounds and flame expulsion. The normal (rearward) air flow can usually be restored by reducing the engine power or thrust setting. Despite the noise, flames and associated heat, a compressor stall often results in no damage to the engine.

Similar occurrences

ATSB investigation 200300040 reported two incidents involving compressor stalls shortly after take-off in different Saab 340B aircraft. Both of those incidents also occurred on the first flight of the day. In response, the engine manufacturer made some recommendations to the operator of those aircraft, including that the operator consider amending procedures to include the selection of ECS ON for the first flight of the day. Use of the ECS opens the bleed air valves and reduces the likelihood of compressor stalls. The report stated that use of ECS on the first flight of the day would counteract the conditions of temperature inversions that were usually more pronounced in the early morning.

Safety message

This incident highlights the importance of well-designed simulator training and robust failure management procedures. Faced with an abnormal scenario, from their training and robust procedures, the crew was able to manage the situation efficiently and safely.

Aviation Short Investigations Bulletin - Issue 54

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. An internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Safety summary

What happened

On 11 August 2016, track maintenance was to be undertaken east of Ballarat Railway Station. To protect the work group, three sets of points within the work area were remotely Blocked to prevent them being operated from the train control system (TCS). However, the points unexpectedly operated when a route was set by the train controller for a train to travel from Wendouree to Ballarat Station. There were no injuries or equipment damage.

What the ATSB found

The ATSB found that the train controller had placed a Block on the three sets of points, but these ‘Blocks’ were ineffective due to design errors within the TCS. Train control for the location had been moved from Ballarat to the Melbourne control centre about three months earlier and the new configuration lacked full points-Blocking functionality.

The ATSB found that the software written to provide the points-Blocking functionality within the TCS did not include coding for points that lay outside the selected route but within its overlap. The Wendouree-to-Ballarat route-setting required three sets of points in the overlap to be in a defined position. The absence of Blocking software for the overlap meant that these points were not Blocked and were able to be remotely moved when the route request was executed by the TCS. It was also found that neither Factory- nor Site-Acceptance testing of the new system considered this scenario. As a result, the deficiency was not identified at this early stage.

The system configuration for the relocated train control was uncommon for the Victorian regional network. It placed reliance on the TCS to perform the points-Blocking function rather than also providing an additional level of defence to the interlocking.

What's been done as a result

V/Line have issued instructions for track workers to isolate points prior to undertaking work on them.

The TCS software designer, UGL Pty Limited, have updated their instructions for software development and testing of unit-lever interlockings, to specifically require overlaps to be included in the Blocking functionality.

Safety message

It is critical that system designers ensure that the functionality and performance requirements needed to meet all operational scenarios are incorporated within the design. It is also important that effective check and test processes are developed to fully validate system functionality.

Ballarat Railway Station, Victoria

Source: ATSB

Occurrence

The incident occurred in Ballarat, a Victorian regional city located about 100 km west of Melbourne. Ballarat is linked to Melbourne and other regional centres by the regional rail network managed by V/Line.

At about 1230 on 11 August 2016, track maintenance personnel were preparing to commence maintenance works near Ballarat Railway Station. The maintenance included points cleaning and was to be conducted under Lookout Protection.

To prevent the unintended movement of points, the Signal Maintenance Technician (SMT) in charge of the maintenance group contacted the train controller for the Ballarat location and requested that a Block^[1] be applied to motor point №s 35 (two sets) and 37 (one set) (Figure 1).

Figure 1: Points 35D, 35U and 37 adjacent to Ballarat Railway Station

Note that the Normal position for points 35U and 35D was for the respective turnouts and not the straight-ahead direction. The Normal position for points 37 was for the straight.Source: ATSB

System logs indicate that the train controller first Blocked 35D and 35U points and subsequently Blocked 37 points. These Blocks were placed through the train control system (TCS).

At about 1251, the train controller prepared a route from signal BAT2^[2] to BAT24, using a ‘route-setting’ feature of the TCS, for train 7130 to travel from Wendouree to Ballarat. Wendouree Station is approximately 4.5 rail-kilometres from Ballarat Station.

The TCS cleared the route between BAT2 to BAT8 and stacked^[3] the remainder of the route, from BAT8 to BAT24, pending the required pre-conditions being met. The system would automatically execute the control commands and create the route when those conditions were satisfied.

At about 1257, points 35 and 37 moved to meet overlap requirements for the BAT8 to BAT24 route and the full route was established. The previously applied blocks to 35 points (two sets) and 37 points did not prevent their movement during the execution of the route.

The SMT in the field noticed the movement of the points and contacted the train controller to confirm the application of the Blocks. The controller confirmed that the Blocks had been applied but acknowledged the points had moved. Due to this apparent anomaly, the controller notified the Senior Train Controller.

The maintenance workers were not affected by the unexpected movement of the points and there were no injuries.

__________

1. The electronic Blocking of a system component such as a set of points is done to ensure that an inadvertent control command cannot operate or activate that component in the field. Electronic Blocking replicates the functionality achieved by “sleeving” a points lever (or switch on a control desk) and is non-vital (see footnote 7 and 8).
2. The ‘BAT’ prefix on signal numbers indicates the Ballarat location.
3. Storage of commands until conditions allow the commands to be executed.

Context

Train control sequence of events

A logger recording of the train control system (TCS) for the period preceding and during the incident provided detail of track routes, the status of points, signal position and train position and movements. From the commencement of the available recording (from 1242), points 35U and 35D were already Blocked (identified by blue highlight, Figure 2) and both were set for the diverge, their ‘Normal’ position. Train 8129 arrived at Ballarat Platform 1 at about 1245.

Train 8129 was recorded as leaving Ballarat and then arriving at Wendouree Station at about 1251. At Wendouree, the train was to reverse direction and return to Ballarat Station as train 7130. At this time, 35 points remained Blocked and 37 points were not yet Blocked (Figure 2).

Figure 2: Signal and points status when train 8129 terminated at Wendouree Station

Source: V/Line TCS recording

The recording showed that at 1251:08, the train controller called a route between signals BAT2 and BAT24 to bring train 7130 from Wendouree to platform 2 at Ballarat. Soon after, the system indicated a clear route from BAT2 to BAT8. The request for the remainder of the route from BAT8 to BAT24 was automatically stored (stacked) pending the operation of the Lydiard Street level crossing gates.

A short time later, the recording indicated a number of actions taken by the train controller. Blocking previously applied to 35 points was removed and the points were operated to their Reverse (straight) position, and then the Block re-applied at 1253:43. Then 37 points were operated to their Normal (straight) position and a Block applied at 1254:05 (Figure 3).

Figure 3: Extract of panel display showing status of 35 and 37 points at 1254:05

Source: V/Line TCS recording

At 1254:26, the controller called a route between BAT102 (at Wendouree Station) and BAT2 in preparation for the departure of train 7130 from Wendouree Station. Then, upon operation of the level crossing protection at Gillies Street, the system cleared BAT102 signal permitting train 7130 to depart from Wendouree.

At 1256:43, the Lydiard Street level crossing was activated. The Lydiard Street gates are not automatic and are controlled from Centrol^[4]. At 1257:29, the level crossing gates were detected in their Road-Closed/Rail-Open position, at which point the TCS called the previously-stored route between BAT8 and BAT24.

A few seconds later, the TCS recording showed 35 and 37 points had operated and moved to their Normal and Reverse positions respectively. In both cases, the logger recording indicated that Blockings applied by train control had remained, and there was no evidence that the points operation had resulted from a train controller input.

By 1257:48, the system had cleared BAT8 signal for the passage of train 7130. The route was set for the passage of the train to platform 2 at Ballarat Station with 35 and 37 points in their altered positions (Figure 4).

Figure 4: System status when the route from 8 to 24 signal was cleared (green line)

The display shows BAT8 signal cleared for train 7130 to proceed to BAT24 signal (for berthing at platform 2). The Lydiard Street gates are depicted in the Road-Closed position. Blocking facilities (shown in blue) have been applied to both 35 and 37 points.Source: V/Line TCS recording

At 1300:04, train 7130 occupied the track indicating its arrival at the Ballarat Station platform.

Ballarat signalling

Background

Between 2005 and 2016, the control of points and signals at Ballarat was conducted using a local control panel and relay interlocking^[5]. The local panel incorporated unit-lever^[6] control of points and signals and provided a monitoring function with indications for signal, turnout position, and track occupancy.

Relocation of Ballarat train control

The implementation of Centralised Traffic Control (CTC)^[7] between Melbourne and Ballarat in May 2016 required transfer of the control of points and signals at Ballarat to Centrol in Melbourne.

CTC systems (which are non-vital^[8]) interface in the field with signal interlocking (which is vital^[9]) to provide remote monitoring and control of the total system. The Centrol TCS for Ballarat was a SigView system developed and supplied by UGL^[10]. The SigView workstation provides a graphical user interface (GUI)^[11] to display indications for signal aspect, turnout position, track occupancy, and train information. Keyboard and mouse inputs allow for both unit-lever and Entrance-Exit^[12] controls for points and signals.

When CTC was implemented at Ballarat, a MicroLok^[13] computer-based interlocking (CBI) was used to facilitate the interface, allowing the relay interlocking at Ballarat to remain largely unchanged. MicroLok provides the interface between SigView and the relay interlocking (Figure 5).

Figure 5: The interface between the SigView, MicroLok and interlocking systems

Source: ATSB

Signalling systems usually include both vital controls (signalling interlocking) and non-vital controls (local control panel and/or CTC system). The signal interlocking is designed to provide fail-safe protection for train operations. In other words, the system ensures that field equipment (such as points and signals) is controlled in a manner that will maintain separation between all rail traffic detected (by track circuits) on the network. The CTC system and control panel affords the ability to send commands to operate points and signals, but the interlocking will only allow operation if all prerequisite conditions are satisfied.

In most cases, only trains can be reliably detected by track circuits (and consequently the signal interlocking), whereas maintenance workers and their equipment are not. Because of this, additional process controls are implemented to ensure adequate protection of workers on track.

Blocking facilities are a process control often used for the protection of maintenance workers. Blocking may be applied to exclude rail traffic from a track section, or to prevent the unintended operation of equipment during maintenance activity. For the signalling system at Ballarat, the Blocking functionality existed within the SigView system.

SigView Train Control System

In relation to the real-time monitoring and management of field signalling equipment, SigView provides the train controller with a video display unit (VDU) system display and a keyboard and mouse to enter control requests. To avoid unnecessary field communication, SigView incorporates a feature called Pseudo-Interlocking. Pseudo-interlocking is a model within the TCS that reflects the requirements of the signal interlocking in the field, so that only valid commands that are able to be actioned by the interlocking will be sent by the SigView system.

The SigView TCS provides the controller with several assistive features. One is the option of using the Entrance-Exit method for setting routes. SigView also incorporates Route-Stacking. This is a function by which SigView stores valid requested routes that are currently unavailable. When the routes become available, the system automatically issues the request to the interlocking.

SigView also provides for Blocking to be applied to points, signals, and tracks. The intent of a ‘Block’ is to prevent the unintended or automatic operation of points and signals, and to prevent clearing of signals that protect Blocked points or tracks.

Signal control tables

The sequence of events suggested that the operation of 35 and 37 points was related to the control of signal BAT8. The signal control tables^[14] and the signalling circuits were examined to comprehend the operation of BAT8. The signal control tables defined the requirements for clearing a route from BAT8 to BAT24, and included (but were not limited to) the following:

• That all tracks between signals BAT8 and BAT24 be unoccupied
• That all tracks in the overlap^[15] be unoccupied
• That 35 points (in the overlap) be in their Normal position
• That 37 points (in the overlap) be in their Reverse position
• The noting of a requirement for interlocking with level crossings.

The control tables also defined the requirements for operating 35 and 37 points, and included (but were not limited to) the following:

• That points trackage be unoccupied
• That no routes had been set over the points.

Examination of the Ballarat signalling documentation revealed that the circuit diagrams were consistent with the requirements of the control tables. Therefore, so long as the specified conditions were met, SigView would issue commands to operate points and clear signals.

Interlocking

The interface circuitry between the control system and interlocking was such that all control functionality and indications were achieved through discrete Inputs and Outputs. Under this type of control, the only way for points to operate was for the interlocking to receive a control signal via the interface circuits. In this case, a MicroLok Computer Based Interlocking (CBI) interface connected the SigView control system with the relay interlocking at Ballarat.

__________

4. The operational control centre for Victoria’s regional broad-gauge rail network, located in Melbourne.
5. Railway signalling apparatus designed to prevent conflicting movements at an intersection of tracks, such as junctions or crossings. Interlocking is designed such that a Proceed signal indication is impossible unless the route to be used has been proven clear and ‘safe’.
6. Unit-Lever control describes a signalling control panel where a separate lever or switch is provided for each signal and set of points. To set a route, the signaller is required to first set all the required points before operating the lever or switch for the particular signal.
7. Operated under Automatic & Track Control (ATC) safeworking rules under the Network Service Plan, applicable between Deer Park West and Ballarat.
8. Those signalling system components that will not affect the safe operation of the signalling system.
9. Equipment that is fundamental to the safe operation of the signalling system. If such equipment fails, it is designed to do so in a predetermined state that does not create an unsafe situation.
10. UGL Pty Limited is a wholly-owned subsidiary of Australian publicly listed company CIMIC Group Limited.
11. A Graphical User Interface allows users to interact with electronic devices using images rather than [keyboard] text commands. A GUI presents the information and actions available to a user via graphical icons and visual indicators. The actions are usually performed through direct manipulation of the graphical elements.
12. Entrance-Exit is a method of signalling control whereby a signaller operates a switch (usually on a mimic panel or VDU) at the entrance to the required route and another at the exit. This action initiates the automatic setting of all points required by the route and (when all conditions are valid) the automatic clearing of relevant signals.
13. MicroLok is a computer-based interlocking (CBI) control system specifically designed for safety-critical railway signalling applications. MicroLok is usually configured for vital interlocking, but in this application was mainly providing a non-vital interface function between the SigView system and the relay interlocking at Ballarat.
14. Signal control tables describe, in tabular form, the requirements for the operation of various items of signalling equipment (points, signals level crossings).
15. The overlap of a signal is the extension of a track circuit beyond a Stop signal to provide a margin of safety beyond that signal.

Safety analysis

The incident

The Route-Setting feature of the SigView Train Control System (TCS) provides for the automatic setting of points required to complete a particular route. Depending on the signalling design for each route, the interlocking may also require points outside of the direct route (such as in an overlap) to be in a particular position to permit the route being set.

In this instance, an Entrance-Exit route had been requested between BAT2 and BAT24 signals. This route consisted of two component sub-routes; BAT2 to BAT8 and BAT8 to BAT24. All conditions were met for the first sub-route from BAT2, so the request was issued from SigView to the Ballarat signal interlocking. However, the route ahead of BAT8 was not available due to the interlocking requirements at Lydiard Street level crossing and the lay of 35 and 37 points within the overlap. The route request from BAT8 was therefore stored by the Route-Stacking function until conditions within the SigView pseudo-interlocking were met.

Once the Lydiard Street level crossing was detected in the Road-Closed position, the conditions for BAT8 signal were met except for the lay of 35 and 37 points. At this point, SigView automatically issued a request to move 35 and 37 points to their required position. The previously applied Blocking of 35 and 37 points (on SigView) to protect maintenance workers, did not stop the command to move the points being issued to the interlocking.

Ballarat TCS Blocking functionality

The route-setting functionality of the TCS system only evaluated the Blocked points between the entrance and exit signals and did not take into consideration the Blocking of points that lay within the overlap. UGL subsequently modified both Factory- and Site-Acceptance test procedures for control of unit-lever relay interlockings to explicitly test the Blocking functionality in overlaps.

Testing and commissioning of new control

Testing conducted by UGL was limited to the software functions that had been included in the design and did not include testing of other possible operational scenarios or conditions.

There was no explicit requirement to test the Blocking of points in the overlap (outside the entrance and exit for a route) either as part of the factory testing or during on-site commissioning.

Reconfiguration of signalling control

Relocation of train control from Ballarat to Melbourne, resulted in the adoption of the SigView TCS. As part of this reconfiguration of train control for Ballarat, the in-field relay interlocking was retained and a computer based interlocking (CBI) (MicroLok) introduced to provide the communication interface between SigView and the relay interlocking.

However at other locations controlled by the Ballarat TCS, the interlockings were designed to provide points keying functionality^[16] ensuring a second level of protection by implementing a Train Controller-initiated Block (a SigView function) to the specific points using the interlocking.

On the SigView screen, manual control of specific points is achieved by using a graphical depiction of a three-position (Normal-centre-Reverse) rotary switch, or ‘points key’. The points key is set to the centre position where routing of trains and control of points is to be done automatically by the TCS. However, if the points key is manually switched to either the Reverse or Normal position, the points are controlled to that position.

At other locations controlled by the SigView TCS, the signal blocking function also incorporated a points keying function as a second level of protection. That is, if a command was issued to Block a set of points in the Normal position, the system would also simulate placing the corresponding point key to the Normal position, thereby preventing automatic control. Similarly, for Blocking of points in the Reverse position.

Combining the points keying functionality with the signal Blocking command had not been implemented for the Ballarat TCS. Consequently, the system did not prevent the interlocking from responding to automatic SigView routing commands for points 35 and 37.

__________

16. Latching of the points at the interlocking in response to the Train Controller placing the on-screen unit-lever switch to either Normal or Reverse position.

Findings

From the evidence available, the following findings are made with respect to the signalling control system irregularity that occurred at Ballarat, Victoria, on the 11 August 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• Software written to manage the points-Blocking functionality within the Ballarat SigView Train Control System (TCS) did not include coding for points that lay within the overlap of the selected route
• The factory testing and commissioning of the new TCS configuration for Ballarat did not include processes that tested the Blocking and response of points in signalling overlap areas.

Other factors that increased risk

The implementation of Blocking functionality for Ballarat differed from other locations controlled by the Ballarat TCS by not incorporating points-keying functionality.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk.

The ATSB has been advised of the following proactive safety actions in response to this occurrence:

• V/Line instituted several interim mitigation actions, including conducting a system review of points-Blocking, and issuing formal instructions for track workers to place points individually into the ‘Hand’ mode
• UGL issued an internal engineering instruction that identified the design deficiency and the necessary changes to the design, check, and test processes for software development. Design procedures were modified to explicitly require overlaps to be included in the Blocking expression and both the Factory- and Site-Acceptance test procedures were similarly modified
• SigView expressions and functionality were modified such that when points are Blocked in a position contrary to that required for a route, then if requested by the train controller the route called will be suppressed by SigView and not stacked
• Examination of similar scenarios resulted in extensive testing and minor changes to SigView expressions for other adjacent points that have been installed, tested and in use since late September 2016, with no further Blocking issues observed.

Appendices

Appendix A – SigView TCS replay sequence of events

Sources and submissions

Sources of information

The sources of information during the investigation included:

• V/Line Pty Ltd
• UGL Limited.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to V/Line, ONRSR, TSV, and UGL Limited.

Any submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 19 August 2016 at 1458, a Port Phillip Sea Pilot boarded Bow Singapore outside Port Phillip, Victoria. The pilot was to conduct the ship through The Rip and the South Channel to an anchorage in the northern part of Port Phillip.

At 1614, as the ship neared the eastern end of the South Channel, the rudder ceased responding to helm inputs and remained at 5° to port. The ship started swinging towards the edge of the channel. Steering was regained a short time later but, despite the efforts of the pilot, the ship grounded at 1617.

On 20 August at 0040, Bow Singapore was re-floated, with the assistance of the rising tide and a tug. The ship proceeded to anchor and, later, to the discharge berth in Geelong. After discharging cargo the hull was inspected by divers and no damage was found.

What the ATSB found

The ATSB found Bow Singapore’s steering gear ceased working and the rudder remained at 5° to port. A telemotor solenoid, controlling the rudder’s movement to starboard, had stopped responding to electrical signals. This initiated an uncontrolled turn towards the edge of the channel and shallow water.

The company’s procedures for a steering gear failure required a change in operation from the bridge to local emergency operation from the steering gear room. However, the procedures did not include the steps to be taken on the bridge prior to that change, such as using non follow-up mode and changing to alternate telemotor and/or pump systems.

The planned maintenance system for the steering gear did not include or contain any schedules for any detailed inspections or scheduled parts replacement. In addition, the hydraulic system port and starboard solenoids were painted green and red respectively, to match the side of the ship that each is on when mounted on the shuttle valve. However, this was opposite to the direction the rudder would move when they were operated.

What's been done as a result

Odfjell Management, the ship’s managers, arranged for a manufacturer’s representative of the steering gear to attend the ship when it arrived in Singapore. The solenoids and shuttle valves for both steering systems were replaced, the relief valves were opened and examined and the oil was changed. No faults that could cause the failure were found.

The ship managers have now included a 6‑monthly job entry into their planned maintenance system for the opening and inspection of the steering gear’s solenoids. In addition, the telemotor solenoids have been repainted so that the colours now match the direction of rudder movement, rather than the side of the ship on which they are mounted.

Further, the fleet wide safety management system procedure for ‘steering gear failure’ has been amended to include reference to ship specific emergency change over procedures.

Safety message

For equipment, particularly that which is critical to the safe operation of a ship, it is important that there is a well-formulated maintenance plan that includes inspection, testing and planned maintenance.

The occurrence

On 19 August 2016 at 1450,^[1] the 105 m chemical and products tanker Bow Singapore, approached the Port Phillip pilot boarding ground. The ship was bound for the port of Geelong, Victoria. The bridge team consisted of the master, second mate as the officer of the watch (OOW) and a seaman as the helmsman.

At 1458, a Port Phillip Sea Pilot boarded the ship for the inbound transit (Figure 1), through The Rip and South Channel to an anchorage off the Port of Geelong. The master and pilot exchanged information regarding the ship and the inward passage and the pilot then took the conduct.^[2]

Figure 1: Section of chart AUS 158 showing the track of Bow Singapore

Source: Australian Hydrographic Service with annotation by the ATSB

At 1505:13, the pilot instructed the helmsman to steer a heading^[3] of 042°. Shortly after, the ship entered The Rip and was turned into the South Channel on an east by south course. The transit through the channel continued as intended by the pilot.

At 1600, the ship was approaching the eastern end of the South Channel at a speed of 13.5 knots.^[4] At that time the third mate took over the navigational watch from the second mate as OOW and another seaman took over as helmsman.

At 1611:43, the pilot ordered a heading of 093° (Figure 2, point 1), an alteration of about 7° to port. The order was repeated back by the helmsman, and at 1612:32 he advised the pilot that the ship’s heading was 093° (Figure 2, point 2). The helmsman then used the rudder, as needed, to maintain that heading.

At 1613:38, the helmsman applied 5° of port rudder and then went back to midships. A few seconds later, he checked the rudder indicator and saw that the rudder had remained at 5° to port (Figure 2, point 3). He gave a series of starboard rudder movements in quick succession, however the rudder remained at 5° to port and he then informed the ship’s bridge team of the problem.

At about 1614, the OOW took the helm from the helmsman. He changed to the non follow-up (NFU) mode^[5] and made a series of starboard rudder movements. Again, the rudder did not respond and remained at 5° to port.

Figure 2: Bow Singapore’s rudder movements, speed and position prior to grounding

Source: ATSB

By 1614:10, the pilot became aware that there was a problem with the steering gear and ordered ‘hard to starboard’. He then asked the master about changing the steering system to NFU mode. In response to the pilot’s order, the OOW put the NFU lever to starboard again. A few seconds later, the pilot then asked the master to change over the steering pumps.

At 1614:35, the pilot ordered 'stop engine’, which was acknowledged by the ship’s bridge team and 7 seconds later the engine telegraph was moved to stop.

At 1614:52, the pilot asked for ’full astern’.

By 1615:03, the master had changed the main steering pumps from number one to number two as requested by the pilot and the OOW had changed the steering (telemotor) system^[6] from number one to number two. The rudder then started to respond to the NFU starboard demand. A few seconds later the pilot observed that the rudder was moving to starboard (Figure 2, point 4).

By 1615:14, the pilot again ordered ‘full astern’ and 10 seconds later the ship’s engine was full astern.

At 1615:32, the pilot made VHF radio contact with the Port of Melbourne^[7] and advised the duty Lonsdale vessel traffic service officer (VTSO) that Bow Singapore was about to run aground.

Shortly after, at 1615:58, the pilot observed that the rudder was now hard to starboard and the ship had slowed to 10 knots and he ordered ‘stop engine’. He then considered the options that may prevent the ship from running aground.

At 1616:07, the main engine had stopped and shortly after the ship’s bridge team mentioned the rudder was still hard to starboard. The pilot then ordered ‘slow ahead’ to increase the water flow over the rudder and assist the manoeuvre away from the shallow water.

However, by 1616:38, the ship had slowed considerably and in the limited time available, going slow ahead on the main engine had little effect. About 6 seconds later, the pilot ordered ‘stop engine’ and then ‘slow astern’. He then informed the master the ship had run aground and asked for the ship’s crewmembers to stand by the anchors.

At 1617:22, the pilot contacted Lonsdale VTS and reported the ship had grounded on the sandbank (Figure 2, point 5).

Over the next 7 minutes the pilot attempted to manoeuvre the ship off the sandbank by increasing astern power and using the bow thruster. Although the ship did move, the pilot’s efforts to re-float the ship were ultimately unsuccessful.

The crew then started taking soundings of empty ballast tanks, the full cargo tanks and the water depth around the ship. No ingress or egress was found and the ship’s crewmembers continued to monitor until the ship was re-floated.

On 20 August at 0040, with the assistance of a tug and the rising tide, Bow Singapore was re‑floated. It then proceeded to the anchorage off the Port of Geelong. Subsequent underwater hull inspections/survey did not indicate any damage to the ship.

__________

1. All times referred to in this report are local time, Coordinated Universal Time (UTC) + 10 hours.
2. Conduct of the ship’s passage determines the outcome by controlling (con) how the outcome is achieved.
3. All ship’s headings in this report are in degrees by gyro compass with negligible error.
4. One knot, or one nautical mile per hour equals 1.852 kilometres per hour.
5. In non follow-up (NFU) mode, the movement of rudder to port or starboard is controlled through the use of a lever. The lever is released when the rudder has reached the required angle.
6. The telemotor comprises a transmitter on the bridge and a receiver connected to a variable delivery pump through the hunting gear.
7. The Port of Melbourne operates a 24 hour Vessel Traffic Service (VTS), which is divided into two sectors: Lonsdale VTS (LVTS) for traffic south of 38°05’S and Melbourne VTS (MVTS) for traffic north of 38°05’S.

Safety analysis

Steering gear

Bow Singapore was fitted with a Kawasaki Precision Machinery RV21-022 steering gear (Figure 3). It was a two (simplex) ram Rapson slide system with two identical hydraulic systems. Each system included a hydraulic pump, directional control (shuttle) valve and electrical control systems.

Figure 3: Bow Singapore’s steering gear

Source: ATSB

The rudder was moved by the hydraulic shuttle valve directing high pressure oil from the pump to one of the two rams. The valve consisted of a spring-centred shuttle operated by two opposing solenoids. When electrical power^[8] was applied to a solenoid, it moved the shuttle directing the flow of oil to a ram and the rudder moved. When the signal was removed, the valve’s internal springs returned the shuttle to a neutral position and the rudder stopped moving.

Manual (emergency) operation can be performed locally by inserting a pin (Figure 4, blue arrow) into the back of the required solenoid and pushing the shuttle valve across (red arrow – rudder to port, green arrow – rudder to starboard).

Figure 4: Steering system one solenoid valve arrangement

Source: ATSB

The solenoid’s electrical connection consisted of two hard-mounted pins that protrude from the mounting face of the solenoid. They made contact with spring-loaded receivers when the solenoid was mounted on the body of the shuttle valve.

Prior to departure from the last port, both steering gear systems were tested from the bridge and the steering gear room, as part of the normal departure routines. No faults were recorded. The ship departed on steering system number one, as was the normal practice, and operated without fault for the voyage to Port Phillip.

While the ship was aground in Port Phillip, the steering gear was inspected and tested by the ship’s engineers and an electrician. They first confirmed that the telemotor signal had reached the number one starboard solenoid.^[9] However, the solenoid did not respond to the starboard telemotor signals. Next, the port and starboard solenoids were manually operated and the rudder responded in both directions. The telemotor test was repeated and the rudder, again, did not respond to starboard telemotor signals.

The manual testing showed that the solenoid, shuttle valve and pump were operating as expected. Therefore, the fault was unlikely to be mechanical and more likely to be an electrical fault associated with the starboard solenoid. The engineers then changed the solenoid and the steering gear resumed normal operation.

When the solenoid that had been replaced was bench tested on board Bow Singapore it operated as designed. The solenoid was further tested in the ATSB laboratory and it also worked as designed and the coil’s current flow and resistance were as per the specification. It was then disassembled and visually inspected and no abnormal conditions were evident.

As no fault could be found with the solenoid, the ATSB identified two other possible reasons for the failure:

• An intermittent fault. Although an intermittent fault is possible, it is unlikely as this condition has not reoccurred and there is no history of this fault having previously occurred.
• A high-resistance contact. The solenoid’s electrical pins were clean and showed no signs of mechanical damage. There was also no sign of arcing and/or heat discoloration that can sometimes be found with a poor electrical connection. However, this does not rule out the possibility of a high-resistance (dry) joint having developed. As the steering gear returned to normal operation, after fitting another solenoid, it is possible that if there was a poor connection, it was restored during the solenoid changeover.

Further inspection of the steering gear in Singapore, by the manufacturer’s representative, also found nothing to explain why the steering gear had stopped responding.

In summary, from the evidence provided by the ship, the manufacturer’s representative and the ATSB laboratory, no mechanical or electrical fault could be found to establish why the steering gear failed to respond to starboard telemotor signals.

Emergency procedures

The International Safety Management (ISM) Code^[10] requirements are mandatory for Bow Singapore and its management company to comply with. Part A (Implementation), Section 8.1 (Emergency preparedness) states:

The Company should identify potential emergency shipboard situations, and establish procedures to respond to them.

Therefore, a procedure should contain all steps, in a logical order, so the operators can respond to a problem expediently and enable the best possible outcome.

However, the management company’s (Odfjell Management) procedure for ‘steering gear failure’ stated:

Inform the Master and Engineer on duty

Engage the emergency steering

Call up an additional look-out if necessary

…

…

Reduce speed or stop engines, if necessary

Hence, an immediate change in operation from the bridge to local emergency operation from the steering gear room. The procedure did not include steps to be taken on the bridge, such as the use of the NFU mode or changing over pumps and/or telemotors.

However, the crewmembers had made an on board procedure stating the above (Figure 5) and affixed it to the bridge steering console. The ship’s bridge team followed the steps in the on board procedure after the helmsman reported the issue with the steering gear.

Figure 5: Bridge steering console emergency procedure for steering gear failure

Source: ATSB

Therefore, there was an inconsistency between the company-controlled documented procedure and the procedure affixed to the steering console. The company procedure would have resolved a loss of steering control from the bridge but required local operation to work. However, during pilotage in restricted waters, there is a limited time available to respond. Hence, the time required for crewmembers to proceed to the steering gear room and operate locally would not be the most expedient way to respond to a steering failure.

Equipment knowledge

Guidance regarding equipment knowledge is contained in Section 3.2, Regulation 26, Chapter V, SOLAS^[11] (Safety of Navigation), which specifically states:

All ships’ officers concerned with the operation and/or maintenance of steering gear shall be familiar with the operation of the steering systems fitted on the ship and with procedures for changing from one system to another.

The ship’s bridge team initially responded to the steering failure by changing over to NFU mode. When the rudder did not respond, they changed over from steering pump number one to two and steering (telemotor) system number one to two, the reverse order of the procedure affixed to the steering console (Figure 5).

Their actions of changing both the pump and telemotor over to the other system was due to their understanding that cross operation of systems one and two was not possible (for example, number one telemotor could not control number two steering system), however, it was. Notwithstanding, the actions of the ship’s bridge team were appropriate, timely and in excess of what had been documented in the company’s emergency procedure.

As stated in the SOLAS requirements, the management company’s procedures need to document how to change over from one system to another and that the crew are adequately trained to ensure system knowledge is accurate. However, the company’s emergency procedure did not provide these directions and in lieu of this the ship’s crew had made their own ship-specific procedure.

Maintenance procedures

The ISM Code, Part A (Implementation), Section 10.3 (Maintenance of the ship and equipment) states:

The Company should identify equipment and technical systems the sudden operational failure of which may result in hazardous situations. The SMS should provide for specific measures aimed at promoting the reliability of such equipment or systems.

The management company’s planned maintenance system (PMS) schedule contained monthly and three-monthly checks for the steering gear. It required the crewmembers to test the alarms, check for leaks and to check the auto start of the standby pump in case of any alarm. Prior to each dry-docking (twice in a 5 year period), Odfjell Management had the steering gear inspected by the manufacturer’s representative. A repair specification was then compiled based on the results of the inspection report.

The PMS also required checks of the steering gear’s hydraulic oil, which were sampled three times a year, and sent ashore for analysis.^[12] Although oil analysis is a useful tool, it has limitations. It cannot identify all age and wear related problems, such as the hardening/flattening of O-rings, a change in a spring’s characteristics or leakage past a valve.

Similarly, electrical systems would benefit from planned maintenance inspections, such as electrical insulation testing, checking terminations for tightness and checking that relays and timers are properly seated in their bases.

Further, the PMS schedule for the steering gear did not include the manufacturer’s recommendations for a monthly check^[13] of the solenoid valves. In addition, detailed inspections or scheduled parts replacement were not included. Therefore, the continued safe operation of the steering gear was reliant, for the most part, on breakdown maintenance when components failed.

Planned maintenance systems that include regular and thorough maintenance and visual inspections, as well as operational tests, better reduce the risk of machinery failure than operational tests alone. This is particularly important for systems that are critical to the safe operation of the ship.

Equipment labelling and visual cues

Each hydraulic system had two solenoids that moved a shuttle valve which directed the flow of oil to a ram which moved the rudder. Manual (emergency) operation of the solenoids required a pin to be inserted into the back of the required solenoid to push the shuttle valve across. That action would then move the rudder in that direction.

System number one’s solenoids were each painted and stencilled for identification. The port solenoid had a ‘P’ stencilled on it and likewise the starboard solenoid had an ‘S’. However, the dominant information was the colour that they had been painted. The solenoid bodies were painted a colour that was opposite to the direction the rudder would move. The red solenoid was painted green (starboard) but when operated moved the rudder to port. Likewise, the green solenoid was painted red (port) but when operated moved the rudder to starboard.

Therefore, this could create confusion when crewmembers operating the solenoids locally receive a rudder order from the bridge. For example, receiving an order for port 5 could be interpreted as either operating the port solenoid or the red starboard solenoid. Although the colouring of the solenoids did not contribute to this occurrence, in an emergency situation, the risk of a helm order being incorrectly applied would increase. The added complexity of steering a ship from the steering gear room and the likelihood of an error occurring would be further increased due to the colouring found on the solenoids.

Similar past incidents

Flag States with the responsibility to investigate safety occurrences have investigated similar incidents regarding steering gear failures and the crew’s limited understanding of steering gear systems and shipboard maintenance procedures.

Flag Gangos

On 12 August 2014, the outbound bulk carrier Flag Gangos collided with the berthed oil tanker Pamisos on the Mississippi River at Gretna, Louisiana. The Flag Gangos subsequently collided with a pier at the facility where the Pamisos was berthed, and the pier struck and damaged a fuel barge, berthed behind the Pamisos.

The US National Transportation Safety Board (NSTB) investigated the collision. Its final investigation report (NTSB/MAB-15/25, accident number DCA14FM015), stated that the ‘probable cause’ was a delay in completing a mandatory upgrade to the vessel’s steering system and a ‘failure to routinely test the steering gear’s hydraulic fluid for debris as required by the manufacturer’.

Halit Bey

On 22 April 2014, the chemical and products tanker Halit Bey was proceeding up the St. Lawrence River, under the conduct of a pilot, when steering control was lost. The vessel veered to port and exited the navigational channel, running aground on the south side of the river off Grondines, Quebec. The vessel was later re-floated with the assistance of two tugs.

The Transportation Safety Board (TSB) of Canada investigated the grounding (report M14C0045). The findings with potential relevance to the current investigation included:

The bridge crew was not adequately familiarized with the characteristics of the Halit Bey's steering control system and did not know how to regain steering control after the autopilot override alarm activated.

After steering control was lost, the vessel veered to port, towards the shore.

The crew’s attempt to reduce speed and anchor the vessel were unsuccessful, in the limited time available, to prevent the vessel from exiting the navigational channel and running aground.

If crew members are not familiarized with all aspects of the operation of safety critical equipment, such as a vessel’s steering control system, there is a risk that they will not have the knowledge required to operate the system proficiently or regain control in the event that it is lost.

Orsula

On 15 December 2011, the bulk carrier Orsula departed Contrecœur, Quebec, in ballast for Baie‑Comeau, Quebec. While proceeding down the St. Lawrence River under the conduct of a pilot, the vessel lost steering control and ran aground at 1329 on the Battures de Gentilly, 1.25 miles northeast of Bécancour wharf, Quebec. About 48 hours later, it was re-floated on the first attempt using tugs.

The Canadian TSB investigated the grounding (report M11L0160). The findings with potential relevance to the current investigation included:

Steering control was lost when the port steering system potentiometer failed while the rudder angle was at 10º to starboard, causing the vessel to veer to starboard and leave the dredged channel.

The bridge crew members were not familiar with the use of the non-follow-up mode or with switching the steering system selector switch from port to starboard to regain steering control.

The master switched the steering system selector switch from port to starboard, which restored steering control, but it was too late to prevent the vessel from running aground.

Arcadia

On 22 October 1996, the oil tanker Arcadia was under the conduct of a pilot inbound for a refinery at Anacortes, Washington. The loss of steering occurred due to a loose electrical connection on the steering gear's number one hydraulic control solenoid. The connection was overlooked during a regular maintenance check.

The Washington State Department of Ecology published an investigation report (publication # 98-253). The lessons learnt and recommendations with potential relevance to the current investigation included:

Steering gear is a critical vessel safety system. As such, steering gear systems must be properly maintained. However tedious, inspections of the electrical connections of the system must be part of the maintenance program. The maintenance program should be structured to minimize the opportunity for human errors.

Ensure that steering gear is properly maintained under a comprehensive planned maintenance program that minimizes the likelihood of human error and conforms with the International Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code), especially Section 10. All electrical connections should be regularly checked for integrity as part of such a steering gear maintenance program.

__________

8. The telemotor’s electrical signal is generated by moving the wheel or NFU lever on the bridge.
9. The telemotor signal was confirmed by using a non-contact test pen. The test pen will indicate that voltage is present but does not differentiate between circuits in which there is or isn’t current flow.
10. The International Management Code for the Safe Operation of Ships and for Pollution Prevention ISM Code adopted by the International Maritime Organization’s Resolution A.741 (18) as amended.
11. The International Convention for the Safety of Life at Sea, 1974, as amended.
12. The most recent oil samples (17 June) for both steering gear systems showed that the oil’s viscosity was as expected, the contaminant levels were low and that they had not risen from those in the previous four sample results.
13. Monthly check that the solenoid valve is correctly operated from the steering console on the bridge.

Findings

From the evidence available, the following findings are made regarding the grounding of Bow Singapore, under pilotage, in Port Philip on 19 August 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

Bow Singapore’s steering gear stopped responding to helm inputs and the rudder remained at 5° to port. This initiated an uncontrolled turn towards the edge of the channel and shallow water.

Other factors that increased risk

The company’s procedures for a steering gear failure required a change in operation from the bridge to local emergency operation from the steering gear room. However, the procedures did not include the steps to be taken on the bridge prior to that change, such as using non follow-up mode and changing to alternate telemotor and/or pump systems.

The number one steering system telemotor solenoid stopped responding to helm inputs. However, when examined and tested, the solenoid functioned as designed and no faults were found.

Bow Singapore’s planned maintenance system for the steering gear did not include or contain any schedules for any detailed inspections or parts replacement. [Safety issue]

The hydraulic system solenoids were painted red or green to match the side of the ship that each were mounted on, but that was opposite to the direction the rudder would move.

Other findings

The actions of the bridge team were both timely and appropriate as well as being in excess of the requirements of the procedure that was in place at the time of the incident.

Safety issues and actions

The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Steering gear planned maintenance instructions

Bow Singapore’s planned maintenance system for the steering gear did not include or contain any schedules for detailed inspections or parts replacement.

Safety issue number: MO-2016-005-SI-01

Safety issue description: Bow Singapore’s planned maintenance system for the steering gear did not include or contain any schedules for detailed inspections or parts replacement.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• interviews of the directly involved crew of Bow Singapore
• interview of the pilot
• automatic identification systems and voyage data recorder data
• documents provided by Odfjell Management
• Kawasaki Heavy Industries (S) Pty. Ltd.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the master and directly involved crew of Bow Singapore, the pilot, Odfjell Management, the regional harbour master, Transport Safety Investigation Bureau, Singapore and the Australian Maritime Safety Authority.

Submissions were received from the pilot, Odfjell Management, Transport Safety Investigation Bureau, Singapore and the Australian Maritime Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 17 August 2016, at about 0926 Central Standard Time (CST), an Alliance Airlines Fokker F27 MK 50 aircraft (Fokker 50), registered VH-FKV (FKV), and operating with callsign ‘Unity 3201’, landed on runway 12 at Adelaide Airport, South Australia (SA) after a flight from Olympic Dam, SA. The flight crew consisted of a captain seated in the left seat and a check captain seated in the right seat acting as the first officer. Also on board were two cabin crewmembers and 49 passengers.

Air traffic control (ATC) audio recordings showed that at 0926:53, after FKV had rolled through the intersection with runway 23, the aerodrome controller (ADC) cleared an aircraft for take-off on runway 23 (Figure 1).

Figure 1: Adelaide Airport

Source: Airservices Australia – annotated by ATSB

At the end of runway 12, FKV then exited runway 12 onto taxiway D2. After vacating the runway, the check captain switched the aircraft radio from the ATC Tower frequency to Ground frequency and reconfigured the aircraft in accordance with standard operating procedures after landing. The check captain was unable to immediately contact the surface movement controller (SMC) due to congestion on the Ground frequency. The SMC position had combined SMC and airways clearance^[1] delivery responsibility.

At 0927:46, the ADC cleared a Jetstar Airbus A320 aircraft, registered VH-VGI (VGI), to land on runway 23. At that stage, the ADC sighted the A320 about 3 NM away on final approach. The flight crew of FKV did not hear that clearance.

Shortly after entering taxiway D2, the check captain, seated on the right of FKV looked outside and sighted an aircraft in the take-off roll on runway 23 and also sighted the A320 on final approach. They estimated that the A320 was 5 to 6 NM away. Based on that estimate, the check captain assessed that they would probably be cleared to cross runway 23 behind the departing aircraft and in front of the landing A320, and then turned their attention inside the cockpit to complete their after-landing checks.

As FKV approached holding point D2, the flight crew had not received an ATC clearance to cross runway 23, and the flight crew therefore assumed they were going to stop at the holding point. The check captain was still waiting for a break in transmissions to make their initial contact with the SMC to advise ‘Adelaide Ground, Unity 3201 for bay 50 golf’.

The SMC was issuing a clearance to another aircraft when they sighted FKV taxiing on taxiway D2 towards the direction the controller was facing. At 0927:49, the SMC told the flight crew of an aircraft awaiting an airways clearance to standby, then immediately said ‘Unity 3201 hold short of runway 23, I’ve got you going to 50 golf’.

The check captain of FKV reported that the start of the transmission from the SMC was over-transmitted and what they heard was ‘runway 23 and I’ve got you for bay 50 golf’. As the instruction included the parking bay, the check captain thought the SMC had instructed them to ‘cross runway 23…’ and read back ‘cross runway 23 to 50 golf, Unity 3201’. The SMC thought the pilot read back ‘short runway 23...’ and assumed that the word ‘hold’ had been ‘clipped’. Both flight crewmembers of FKV thought they had received a clearance to cross runway 23.

The ADC sighted FKV on taxiway D2 and heard the SMC say ‘hold short’, but did not hear the response from the flight crew. The ADC scanned runway 23 to check it was still clear for the landing A320, which was then over buildings and less than 30 seconds from touchdown, and then commenced a handover of the ADC position to another controller.

At 0928:10, the SMC coordinated^[2] with the ADC and cleared a vehicle to cross runway 12.

The captain (in the left seat) of FKV then looked to their left and stated ‘clear left’ and taxied the aircraft onto runway 23 to cross. The check captain then looked to their right and sighted the A320 and reported that it was a lot closer than they had expected.

The SMC had looked down at their screen to check the flight strip for the aircraft awaiting a clearance. As the controller looked up, they saw FKV crossing the holding point.

At 0928:21, the SMC called ‘hold short’ and immediately realising that was not the correct instruction, said ‘Unity expedite expedite Unity’. The SMC could then see the A320 in the go-around. The ADC heard the SMC call ‘expedite’ and looked up to see the A320 about 100 ft above the runway – already in the go-around. At 0928:25, the ADC directed the A320 crew to go around.

The captain of FKV continued to taxi the aircraft across the runway and onto taxiway D1 and did not sight the A320 at any time. The A320 (VGI) returned to land without further incident.

Flight crew (FKV) comments

Check captain acting as first officer

The check captain commented that a crossing instruction fitted with their judgment of the situation when they first sighted the A320 while taxiing on D2. They were close to the holding point when they received the initial (hold short) instruction from ATC, and assessed that there was a level of urgency in the SMC’s voice which indicated to them that it was a crossing instruction.

The sun was behind the A320 on final approach to runway 23, which may have affected the check captain’s initial estimate, when they first entered taxiway D2, of how far away the A320 was. However, it was not a factor when FKV taxied onto the runway. At that time, the check captain estimated that the A320 was about 1.5 NM away at about 200 ft above the runway. The check captain decided not to advise the left-seat captain then of the A320 as they had already entered the runway.

There was no confusion in the flight deck over whether they had been instructed to cross the runway or not, they both thought that was the clearance.

The clearance was clipped or over-transmitted and led them to believe it was ‘cross’ not ‘hold short’. In hindsight, the pilot commented that maybe they should have reconfirmed the clearance to cross because the words were clipped, but they expected the readback would give the SMC confirmation that what they understood was correct and the opportunity to detect any misunderstanding. They did not hear anything that sounded like ‘hold short’. It was possible that the check captain had pushed their transmit (push-to-talk (PTT)) button which had momentarily over-transmitted the SMC’s call.

If the check captain had sighted the A320 later in the taxi and closer to the holding point, they would probably have expected to hold short rather than cross in front of it.

The controller’s addition of the bay information to the instruction was not consistent with a hold short instruction. The standard clearance is either hold short (with no further instructions), or cross and taxi to your bay or with additional taxiing instructions.

It was possibly a professional courtesy so the pilot did not have to respond with their bay number, but it added to their expectation that it was a crossing instruction. The flight crew had contacted their company personnel about 100 NM prior to their arrival and were issued with parking bay 50G. It was standard procedure to advise the SMC of their bay number on first contact with the SMC. The SMC presumably gets the bay allocation from the airport ground personnel, and provided that information to the flight crew to save a radio transmission. However, its addition to the end of the hold short instruction misled the pilots.

In the absence of any communication with the SMC prior to reaching the holding point, they would have stopped at the holding point rather than enter the runway.

When discussing the incident afterwards, the captain told the check captain that they had not been aware of or sighted the A320 at any time. The check captain commented that maybe they should have told the captain ‘there is one rolling and one on final’ when they first saw the two aircraft to increase the captain’s situational awareness.

Captain

The captain was normally based in New Zealand and commented that to cross an active runway there, pilots are required to contact the ADC on the Tower frequency for a clearance.

The captain was intending to stop at the holding point, but proceeded to cross when they thought they got the clearance to do so. They had to increase power to accelerate, having slowed ready to stop.

The bay number was a non-normal addition to a taxi instruction, possibly provided as the check captain had not yet been able to give the normal transmission with their bay allocation after exiting the runway.

Controller comments

The air traffic controllers provided the following comments.

Aerodrome controller

It was a quiet and routine traffic sequence and the weather at the time was benign.

The voice equipment was fitted in 2013 to Adelaide Tower. The Tower was a ‘quiet tower’, which means that the controllers can only hear the transmissions on the frequency they are controlling, in their own headsets. Although the ADC could hear the SMC give the instruction to hold short, they could not hear any response from flight crew on the Ground frequency.

Prior to the implementation of the quiet tower, controllers could hear transmissions on the other frequencies on speakers in the Tower. The ADC commented that this improved their situational awareness, particularly from a coordination perspective.

The ADC commented that since the incident, in a similar situation, they would wait for the aircraft to land before commencing a handover.

The ADC commented that following the incident there would be a greater focus among the controllers, not just on the instructions controllers give, but that it is not complete until you get adequate readback that responds to all the components of the clearance. In addition, there should be no taxi instruction beyond a hold short instruction.

Controller taking over from aerodrome controller

The controller in the process of a handover/takeover with the ADC was looking at the weather display and listening to the ADC handing over, when they heard the SMC say ‘hold short’ and then ‘expedite’. The controller looked across and sighted FKV half way across the runway and the A320 in the go-around.

The controller commented that before the ‘quiet tower’ they could all hear each other’s radio, which improved their situational awareness.

The controller also commented that when they receive a call from a pilot, they sometimes miss the first part of the transmission. The controller reported that this is a known fault that the controllers have reported via the Airways systems issues reporting scheme (see below). They also advised that they have become desensitised to hearing only part of the readback, which negates the effectiveness of the readback.

The controller advised that there were a number of things that could have prevented the incident:

• if the SMC had heard the readback correctly
• better scanning by air traffic controllers and pilots of aircraft approaching and crossing runways
• stop bars^[3] could have been an effective risk control even without hearing the readback or effective scanning.

The controller commended the actions of the A320 flight crew.

Surface movement controller

The SMC was confident they had given the hold short instruction clearly.

The SMC thought that the Unity flight crew would be expecting to hold short because there was no way they were going to be cleared to cross in front of the landing A320. The SMC commented that if they had not contacted Unity 3201 as they were approaching the holding point, they would have stopped. Because the aircraft was taxiing towards the runway and it is difficult to tell if the aircraft is slowing down, the SMC issued the hold short instruction to be sure they would stop.

They commented that they added the bay number to the hold short instruction to save a transmission, as another aircraft was waiting for their clearance. They were not sure why they did not pick up the incorrect readback, but they did not hear the first word.

The SMC asserted that in most of the transmissions in Adelaide, the initial second of a readback is clipped, for example they only hear ‘short’ instead of ‘hold short’. The controller thought the readback was ‘short runway 23’ not ‘cross runway 23’. As they thought the pilot would be expecting to hold short, the controller was expecting the readback to be ‘hold short’ and that expectation affected what the controller heard.

In Adelaide Tower, it is difficult to tell when a controller’s PTT button is released and whether the frequency is open or closed. Normally for a ‘hold short’ readback, you would be expecting two words but they get used to looking for one word. If you are not certain of a readback, you are meant to ask again, but if they don’t get the first word every time, it can lead to a lot of additional transmissions. Maybe if radio operators push the PTT button and then wait two heartbeats before they start talking, that technique may prevent transmissions being clipped.

The pilots may not hear the controllers’ instructions clearly either as they are also not listening in a perfect environment.

The airport ground staff provide the ADC with bay allocations, which the ADC then put on the flight strip. When the pilots first make contact with the SMC, they state the bay allocated by their company and the SMC checks that matches the bay number on the strip.

The SMC did not hear the ADC clear the A320 to land (or the other aircraft to take off) because they were issuing a clearance at the time.

If the A320 had landed and FKV had crossed the runway, they may have just got across in front of it but it would have been close.

If the airport had stop bar lights, the incident would more than likely not have occurred.

Manual of air traffic services

In the Manual of air traffic services (MATS), under section 12.3.1.11 Taxiing across runways, section 12.3.1.11.1 Intermediate holding points, stated: ‘Do not include positions beyond required intermediate holding points in taxi instructions.’

Airways systems issues database report

Airservices Australia provided the ATSB with a copy of the relevant Airways systems issues database (ASID) report. In June 2013, the ASID report from Adelaide ATC stated that inbound calls from pilots were clipped at the beginning of calls. This could be heard on recorded audio from the tower transmissions and was compared with transmissions recorded prior to the implementation of the new radio system. Following ATC transmissions, when the controller releases the PTT, the voice communications control system switch remains in the transmit state for 200 milliseconds, known as the guard period. During this period, receive audio is blocked, therefore the audio from pilots is dropped.

In August 2014, the report was updated to state that the clipping issue had been incorporated into the voice system training manual. On 17 December 2015, the comment added was ‘Vendor has advised that this defect will be addressed in the next software release which is currently scheduled for delivery in June 2016’. There was no indication what, if anything, was delivered in that release to address the issue.

On 25 August 2016, a comment was added to the report indicating that rather than a system defect, the cut-off responses could be ‘mostly attributed to poor radio technique by pilots or ATC’. Furthermore, ‘it is also important that controllers release PTT as soon as possible to ensure that the receiver is unmuted’.

The ASID entry dated 17 December 2015 was based on information received from the vendor. Airservices sought input from the vendor on whether they believed the reported issue was a defect and whether the guard period could be adjusted.

Airservices received a response from the vendor with a list of issues which the vendor aimed to address in the next release and the guard period issue was included in this list. Airservices has investigated this issue and has determined it is not a system issue, given that the guard period of 200 milliseconds is less than other voice communication systems used by Airservices and the same as used in other Integrated Tower Automation Suite (INTAS) towers where there has been no observed replication of this issue. It was instead concluded that this issue was due to controller actions related to extended engagement of the foot PTT beyond the end of their transmissions. Airservices considers that the issue was not prevalent in the occurrence as was communicated by the interviewees.

Airservices Australia comment

Airservices Australia provided the following comments in response to the ATSB draft report.

Quiet tower

Although some controllers prefer speakers to increase their situational awareness, it may also result in considerable noise when all three positions are open during periods of increased traffic. Such noise is particularly distracting for controllers that have transitioned from an enroute environment where headsets are used and speakers are not permitted.

Additionally, ATC procedures are designed to ensure controllers can perform their duties safely without reliance on speakers. The use of speakers does not always increase situational awareness and should not be relied upon as an effective threat barrier.

Clipped transmissions

The recorded audio leading up to, during and after the occurrence did not contain any clipped transmissions related to the ‘fault’ reported.

Adelaide Tower Line Manager's and Shift Manager's regular monitoring of the controller's air­ ground communications have observed that pilot transmissions may occasionally be missing the first part of the call (clipped transmissions are less than one second in duration). This typically occurs when the pilot commences their response prior to the controller releasing the press to talk (PTT) button. However, clipping of this nature does not occur frequently and not to a point where controllers would become desensitised to only hearing part of the readback.

Existing ATC procedures require the controller to obtain a correct readback of instructions (in accordance with per AIP GEN 3.4 -12). In the absence of the correct and complete readback, the controller must challenge the readback until they are satisfied it is correct.

Audio sample

Airservices randomly sampled 90 minutes of audio from 1 August 2016 at Adelaide and did not identify any calls which had a clipped the transmission.

On 12 September, Airservices reviewed the radio technique of a controller in the tower using a foot PTT and noted that there was a significant (0.5-1 second) delay from the end of the delivery of the instruction by the controller to the time when the controller disengaged the foot PTT. This anomaly in the controller's technique resulted in a number of clipped pilot transmissions due to them starting the readback whilst the foot PTT was still engaged. The controller's error was rectified by using the in-line PTT which decreased the delay of the controller releasing the foot PTT.

Additionally, the Voice Communications and Control System (VCCS) enables controllers to view the status of the transmitter and receiver.

ATSB comment

The A320 crew are to be commended for their actions in preventing a potentially more serious incident occurring.

The flight crew of FKV thought they were cleared to cross the runway probably because of the bay allocation at the end of the hold short instruction. An effective sighting of the aircraft on final approach may have led them to query their understood instruction to cross the runway.

The SMC heard one word in response and mis-heard it as ‘short’ rather than ‘cross’ and that assumed ‘hold’ had been clipped from the transmission. The SMC did not question the pilots about the missing word as they had some previous experiences of the beginning of transmissions being clipped. As there was a ‘quiet tower’ communications system, there was no opportunity for the ADC to hear this pilot read-back to the SMC and notice the misunderstandings before the runway incursion.

The ADC was in the process of handover/takeover and was not watching the landing A320 or the runway as they assumed FKV would hold short and that the runway was clear.

Safety message

The risk of runway incursions and other separation events can be minimised through good communication. This incident highlights the importance of:

• controllers and flight crews using correct phraseology
• controllers and pilots challenging instructions which they have not heard or understood fully
• pilots looking carefully for aircraft or other hazards before entering an active runway.

Aviation Short Investigations Bulletin - Issue 54

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. A clearance issued by ATC to operate in controller airspace along a designated track or route at a specified level to a specified point or flight-planned destination.
2. Coordination is the process of obtaining agreement on clearances, transfer of control, advice or information to be issued to aircraft, by means of information exchanged.
3. Stop bars are a series of unidirectional lights at right angles to the taxiway centreline. The lights are spaced three metres apart and located 0.3 m before the holding point. Stop bars show red in the direction of approach to the stop bar from the taxiway and are controlled by ATC.

Safety summary

What happened

While en route from Sydney, New South Wales, to Kuala Lumpur, Malaysia, the oil pressure pump for the right engine (engine 2) of an AirAsia X Airbus A330 experienced a shaft failure. That shaft failure resulted in the oil pressure in engine 2 dropping rapidly to 0 psi. The aircraft’s electronic centralised aircraft monitor (ECAM) detected the drop in oil pressure and notified the flight crew through the ENG 2 OIL LO PR failure alert. In response to the alert, the flight crew commenced, but did not complete, the associated procedure. In accordance with the procedure the flight crew reduced the engine’s thrust to idle, but then elected to monitor the engine instead of shutting it down. After about 4 minutes, the flight crew returned engine 2 to normal operations. Shortly thereafter, the engine surged a number of times and eventually failed. The flight crew completed the engine failure procedure, shutting the engine down, and initiated a diversion to Melbourne. During the diversion, the flight crew attempted to relight engine 2 twice, the first shortly after the engine failure, and the second just prior to descending into Melbourne.

What the ATSB found

The ENG 2 OIL LO PR failure, a level 3 alert, was the result of a shaft failure of the right engine oil pressure pump. A level 3 alert required immediate crew action as the failure may be altering the safety of the flight. The ECAM procedure required the flight crew reduce the engine thrust to idle and, ‘if [the] warning persists’, then shut the engine down. The flight crew probably interpreted this as a temporal requirement and not a continuation of the condition, as intended by Airbus. As a result, the flight crew continued to troubleshoot the failure. After monitoring the engine, they established a belief that the warning was the result of a gauge failure. With a stated intent of further trouble shooting, the flight crew then increased the engine’s thrust. This led to the first engine stall and ultimately the engine failure.

Despite available guidance and cumulative evidence to the contrary, the flight crew determined that right engine was not damaged and could be restarted. Consequently, and contrary to the operator’s procedures, the flight crew made two attempts to restart this engine. Both restart attempts failed.

Also contrary to the operator’s procedures, the flight crew elected to divert to Melbourne following the engine failure, bypassing closer suitable aerodromes. This increased the time that the aircraft was operating in an elevated risk environment.

What's been done as a result

The operator restated the operational requirements concerning engine restarts and diversion decision making to flight crew. The operator also used the occurrence as the basis of a training package on response to engine failures, restarting failed engines and diversion decision making.

Safety message

This occurrence demonstrates the importance of crews adhering to standard operating procedures. It also identifies the need for clarity in the construction of procedures, and that where there is not a need for immediate response, to look at the full contextual and available information before deciding on a plan of action.

The occurrence

At 2137 Eastern Standard Time^[1] on 16 August 2016, an AirAsia X Airbus A330-343X,^[2] registered 9M-XXD, departed from Sydney, New South Wales. The aircraft was performing the scheduled passenger service XAX221 to Kuala Lumpur, Malaysia. The flight crew consisted of the aircraft captain, who was the pilot monitoring (PM),^[3] and the first officer, who was the pilot flying (PF).

The flight’s operational flight plan stated that the flight was an extended range operations (ETOPS) flight,^[4] with a ‘maximum diversion time [in the event that one engine failed] in still air limited to 120 minutes’. The operational flight plan listed Alice Springs and Darwin as the only planned Australian ETOPS alternate aerodromes.^[5] The first ETOPS operating area was about 400 NM (740 km) outbound from Alice Springs, Northern Territory.

As the aircraft approached Alice Springs (Figure 1), the right engine’s (engine 2) oil pressure pump failed, and shortly thereafter, the engine failed. The aircraft descended and diverted to Melbourne. During the diversion, the flight crew attempted two restarts of the failed engine. The aircraft landed at Melbourne at 0159 on 17 August 2016.

Figure 1: XAX221 flight path

Source:  Google earth, modified by ATSB.

The following description of the occurrence will focus on the oil pressure pump failure and subsequent engine failure, the flight crew’s actions, including the diversion decision, and the two restart attempts. Information contained therein is derived from data recorded by the full authority digital engine control systems,^[6] data from the flight data recorder, air traffic control recordings and flight crew interviews.

The oil pressure pump failure and subsequent engine failure

As the aircraft was in cruise at flight level^[7] (FL) 380 and tracking towards Alice Springs, the engine 2 oil pressure pump failed as a result of the pump’s drive shaft failing, resulting in a rapid and total loss of engine oil pressure. The shaft failure occurred at 2343:20, while the aircraft was 240 NM (445 km) south-east of Alice Springs. Over the subsequent 7 seconds, the aircraft’s flight data recorder (FDR) recorded the engine 2 oil pressure drop from 90 to 0 psi ((1) and green line on Figure 2).

Figure 2: Engine data recorded by the flight data recorder

Legend from bottom: ‘Oil P’ oil pressure; ‘Oil Q’ oil quantity units; ‘Oil T’ oil temperature; ‘TLA’ thrust lever angle; ‘N1’,’N2’, ‘N3’ refer to low-pressure, intermediate-pressure and high-pressure (respectively) engine fan speeds.

Source: ATSB.

While no oil was being fed into the engine as a result of the oil pressure pump shaft failure, the air pressure in the bearing chambers would have forced the residual oil in the chambers down the scavenge lines and back to the tank. This resulted in the indicated oil quantity increasing by about one third ((2) and purple line on Figure 2).

ENG 2 OIL LO PR message

The loss of oil pressure was detected by the electronic centralised aircraft monitor (ECAM). At 2343:33, the ECAM alerted the flight crew by:

• triggering the ’master warning’ lights, located on the glareshield panel (Figure 3), and associated aural warning alert
• displaying the level 3 red warning alert ‘ENG 2 OIL LO PR’ message and associated emergency procedure on the engine/warning display (Figure 3)
• displaying the engine schematics on the system display (Figure 3).

Included within the engine schematics on the system display were the oil system parameters.

In response to the ECAM alert, the captain took over duty as the PF, and at 2343:47, the engine 2 thrust lever was retarded to idle ((3) and blue line on Figure 2). The flight crew reported that, after retarding the thrust lever, the emergency procedure required the flight crew to monitor the engine and to shut the engine down if the problem persisted. While the warning persisted after the thrust lever was retarded, the flight crew stated that all other engine indications were normal. Specifically, while the crew could see that the oil pressure was indicating zero, there was still oil quantity. The flight crew recalled that, as this was the only abnormal indication, they were reluctant to shut engine 2 down. This also led them to believe that the fault might be a false warning from the oil pressure indicator.

The first engine stall

About 3.5 minutes after retarding the thrust lever to idle, at 2347:14, the flight crew advanced the thrust lever for engine 2 to the CL^[8] position (see (4) and blue line at Figure 2). The flight crew stated that this was done with the intent of checking/troubleshooting the engine. Approximately 40 seconds later, at 2347:55, engine 2 stalled^[9] and began to run down ((5) on Figure 2). In an immediate response to the stall, the engine’s full authority digital engine control^[10] (FADEC) briefly cut the fuel flow to the engine, enabling the engine’s airflow to return to normal. The stall was accompanied by a significant spike in recorded engine vibration.

The ECAM detected the stall at 2347:57, and alerted the flight crew by:

• triggering the ’master caution’ lights and associated caution aural alert
• displaying the level 2 amber ECAM message ‘ENG 2 STALL’ with its associated abnormal procedure on the engine/warning display
• displaying the engine schematics on the system display.

The flight crew responded to the ECAM alert by retarding the thrust lever to idle ((6) and blue line on Figure 2). The engine parameters stabilised at an idle setting.

Shortly thereafter, at 2348:02, the flight crew declared a PAN PAN^[11] to air traffic control (ATC), stating that they had experienced an engine stall and requesting descent to FL 250. In communications with ATC over the following 30 seconds, the flight crew stated that they were ‘breaking off the airway doing a left turn’ and declared a probable intention to divert to Melbourne.

The second engine stall

At 2348:37, 35 seconds after the first engine stall, the engine stalled again and ran down further ((7) on Figure 2). The second engine stall was also accompanied by a significant spike in the recorded engine vibration. The FADEC again responded by briefly cutting the fuel flow, however, this time the engine did not recover. The engine continued to run down, and failed. The ECAM detected the engine failure and at 2348:42, alerted the flight crew by:

• again, triggering the master caution lights and associated caution aural alert
• displaying the level 2 amber ‘ENG 2 FAIL’ ECAM message, with its associated abnormal procedure on the engine/warning display
• displaying the engine schematics on the system display.

The flight crew responded to the ENG 2 FAIL ECAM alert by commencing the displayed procedure. That procedure included a decision about whether the engine was damaged. The flight crew stated that they consulted the flight manuals and determined that the engine was not damaged. In accordance with the required procedure, the engine master switch was selected to off at 2348:50, shutting the engine down ((8) on Figure 2).

Flight crew’s recollection of the engine stall/failure

The flight crew later reported that, coincident with the stall, they heard a slight bang from engine 2. The flight crew reported that, at the same time, they observed the ENG 2 STALL ECAM message, which was almost immediately replaced by the ENG 2 FAIL message. The ENG 2 FAIL message was coincident with the engine failing.

Actions following the engine failure

The following communications between XAX221 and Melbourne ATC immediately following the second engine stall and subsequent failure were relevant:

• At 2353 the flight crew advised ATC that the intention was to divert to Melbourne.
• At 2355 ATC re-cleared the aircraft to track direct to position ARBEY^[12] and then to Melbourne, and to descend to FL 250.
• At 2356 the flight crew called the operator’s maintenance support using Satcom, reporting that engine 2 had been shut down due to low oil pressure followed by an engine stall. The flight crew requested advice regarding the preferred diversion destination for either Adelaide or Melbourne. Maintenance support advised of a preference for Melbourne due to technical support concerns with Adelaide, but that the decision was the aircraft captain’s.
• At 2358 ATC requested the flight crew confirm the nature of the situation. The flight crew responded, stating:

…the situation now is we have the number two engine oil, that pressure is zero then [unintelligible]. Then after that is engine stall which we shut down the engine. Then at the moment we are flying on single engine before we are able to double check for engine start, then our decision is to proceed to Melbourne sir.

• At 0019 ATC requested the flight crew advise if there was visible damage or evidence of fire. The flight crew reported that there was no damage, just that low oil indication led to an engine stall. In subsequent communications, the flight crew requested advice on the runway in use at Adelaide, and whether Adelaide had a curfew. ATC advised that the curfew in Adelaide was in force, but that if the flight crew declared an emergency the curfew would be waived. The flight crew responded that their intention was to continue to Melbourne. There were no further communications between the flight crew and ATC about Adelaide.

The diversion decision

Relevant company nominated alternate aerodromes available for diversion at the time that the flight crew declared the PAN PAN, and the distance to those aerodromes, were:

• Alice Springs, about 205 NM (380 km)
• Adelaide, about 545 NM (1,009 km)
• Melbourne, about 815 NM (1,509 km).

The captain stated that the initial diversion decision was to go to Melbourne—Alice Springs was closest but discounted as the emergency was considered to be controlled. This decision was based on the understanding that the track took the aircraft close to Adelaide, which would allow for a diversion to Adelaide if conditions deteriorated.

The captain stated that the flight crew then reviewed the decision using the company’s integrated decision-making model. As part of that process, the captain reported that:

• in terms of safety, the emergency was controlled and the engine secured
• weather at both Adelaide and Melbourne was good, although Melbourne had an indication of moderate turbulence
• Adelaide was subject to curfew, but that ATC later advised it was ready to accept the aircraft
• rescue and fire fighting services at Adelaide were below that required for the company’s operations
• from a passenger wellbeing perspective, Melbourne was preferred
• the company had a station in Melbourne, which would enable easier aircraft recovery.

The first officer later stated that Alice Springs was not considered due to the it being an uncontrolled airfield that used pilot activated lighting.^[13] The captain reported that the flight crew calculated an equal time point^[14] between Adelaide and Melbourne. When the aircraft arrived at this point, they decided to continue to Melbourne for better recovery of the aircraft and passengers. The flight crew also reported there was concern regarding the Melbourne weather forecast due to the turbulence, although this concern was alleviated when later weather updates identified the Melbourne weather as good.

Attempted engine restarts

Two attempts to restart (relight) the failed engine were conducted during the diversion to Melbourne. The flight crew later reported that the intent to relight the failed engine was based on the ‘engine fail’ (ENG FAIL) procedure, which instructed the flight crew to consider a relight provided the engine was not damaged. The flight crew reported that, after working through the quick reference handbook and flight crew operating manual, they determined that the engine was not damaged.

At 0002:14 on 17 August, about 13 minutes after shutting the engine down, the flight crew attempted to relight engine 2. The following engine parameters were recorded immediately preceding the relight attempt:

• N1^[15] was indicating a stable 23 per cent rotation
• N2 was indicating a stable 7 per cent rotation
• N3 was indicating 0 per cent rotation.

The relight attempt commenced when the engine master switch was selected to ON at 0002:15, and ceased at 0003:38 when the switch was selected to OFF. During the relight attempt, the aircraft was slowly descending from FL 239 to FL 232 with the airspeed slowly increasing from 258 kt to 280 kt. The attempted relight was unsuccessful. During the relight attempt, the ‘ENG 2 START FAULT’ ECAM message was displayed.

At 0132:00, just before commencing descent into Melbourne, a second relight was attempted by the flight crew. During this relight attempt, the aircraft was at FL 190 and the airspeed about 315 kt. The following engine parameters were recorded immediately before the relight attempt commenced:

• N1 was stable at about 25 per cent rotation
• N2 stable at about 6 per cent rotation
• N3 stable at 0 per cent rotation.

The flight data identified that both relight attempts were starter motor assisted relights. For the second relight, there was a 13 second delay from the initiation of the relight until the first indication of rotation of N3. A further 12 seconds later, at 0132:25, N3 achieved sufficient rotation for fuel to be introduced into the engine. At this time, N1 remained at 25 per cent, N2 had increased to 12 per cent and N3 had increased to 25 per cent. At 0132:36 a successful relight occurred, however, N1 remained at 25 per cent, N2 had increased to about 22 per cent, and N3 had stabilised at about 43 per cent. The flight crew later reported that, during the relight, vibrations were felt from the engine. As a result of this vibration, at 0132:46, the flight crew ceased the relight attempt and shut down engine 2.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. An Airbus A330 is a twin-engine aircraft.
3. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
4. Many of the documents and source material used in this report use the term ETOPS and EDTO (extended diversion time operations) interchangeably. As most of the regulatory sources applicable to this operation used ETOPS, this report will use ETOPS when describing principles that apply to either ETOPS or EDTO.
5. See Aerodrome information for definition of an alternate aerodrome.
6. The aircraft engines’ FADEC systems record a significant amount of engine data that is not recorded by the aircraft flight data recorder.
7. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 380 equates to 38,000 ft.
8. This position sets the thrust limit for the engine electronic control.
9. A stall in a turbine engine refers to a compressor stall. It is abnormal airflow resulting from the aerodynamic stall of aerofoils (compressor blades) within the compressor. Steady flow through the stages of a compressor occurs within a relatively narrow band of conditions. If the conditions inside a compressor go outside of this band due to an operating condition or a disturbance, the flow around the blades can break down in a manner known as a stall. In this instance, the blades would no longer effectively compress the air. If the breakdown of flow in a compressor stall is significant enough, the pressure change within the engine could be sufficient to reverse the flow through the compressor in a phenomenon known as a ‘surge’. A surge is often associated with a loud bang, or series of bangs, that can be heard in the aircraft.
10. For further information concerning the FADEC system, see The Trent 700 engine.
11. An internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants, but where the flight crew does not require immediate assistance.
12. ARBEY was a navigation point at the commencement of the standard arrival route into Melbourne from the north.
13. Pilot activated lighting is a runway and taxiway lighting system that is activated by a series of timed transmissions made by flight crew using the aircraft’s very high frequency radio on a designated frequency. Alice Springs did not have pilot activated lighting, but instead operated with the runway lights on at night.
14. A point along track where the time to fly to Adelaide is equal to the time to fly to Melbourne.
15. See The Trent 700 engine.

Context

Operator information

AirAsia X is a Malaysian company based in Kuala Lumpur, Malaysia, operating under an Air Operator’s certificate issued by the Department of Civil Aviation Malaysia. AirAsia X operates long haul air transportation services throughout the Asia-Pacific region and the Middle East.

Personnel information

Captain

The captain held an Air Transport Pilot (Aeroplane) Licence (ATP(A)L), a current Class 1 medical certificate, and was certified in English proficiency at level 5. The captain had accumulated about 8,700 hours of aeronautical experience. Of these, approximately 2,540 hours were on Airbus A330 type aircraft. In the 90 days preceding the occurrence, the captain had logged 244 hours, all of which were on Airbus A330 aircraft.

About 4 months prior to the occurrence, the captain had a recurrent training session in an A330 simulator, and about 10 months prior to the occurrence an annual line check, both of which were completed to a satisfactory standard.

First officer

The first officer held an Air Transport Pilot (Aeroplane) Licence (ATP(A)L), a current Class 1 medical certificate, and was certified in English proficiency at level 5. The first officer had accumulated about 3,265 hours of aeronautical experience. About 4 months prior to the occurrence, the first officer had a recurrent training session in an A330 simulator, and about 7 months prior to the occurrence an annual line check, both of which were completed to a satisfactory standard.

Aircraft information

The A330 is a twin turbofan engine, medium to long range, wide-body passenger aircraft. Manufactured by Airbus, 9M-XXD was fitted with two Rolls-Royce Trent 700 series engines. The following discussion will cover the:

• electronic centralised aircraft monitor (ECAM)
• Trent 700 engine, including the engine oil system and starter system.

The electronic centralised aircraft monitor

The ECAM monitors the various aircraft systems and displays information about those systems, including the aircraft’s engines, to the flight crew. The components of the ECAM include the:

• flight warning computers (FWC)
• engine/warning and the system display units (Figure 3).

Figure 3: The cockpit front panels, showing the location and exploded view of the engine/warning display and system display, and the master warning/caution lights

The figure shows the location and exploded view of the engine/warning display and system display, and the master warning/caution lights.

Source: Airbus, modified by ATSB.

When the FWCs detect a system failure, they automatically trigger the appropriate ECAM alert level. That ECAM alert level will result in the display of the ECAM message attached with the condition, the triggering of the alert level’s aural and visual attention-getters, and the display of the required emergency/abnormal procedure as well as the relevant system display.

There were three ECAM alert levels. From a systems perspective:

• The most serious, a level 3 red safety priority alert, denoted a system failure that alters flight safety and required immediate flight crew action.
• A level 2 amber abnormal priority alert denoted a system failure that does not have a direct consequence on flight safety, but required crew awareness. Action in response to a level 2 alert should be taken without delay, time and situation permitting. The required action is displayed as a procedure on the lower left section of the engine/warning display (Figure 3).
• A level 1 amber degradation priority alert required crew awareness and then monitoring.

The Trent 700 engine

An overview

The Rolls-Royce Trent 700 engine has three compressor/turbine assemblies, identified as the low-pressure, intermediate-pressure and high-pressure assemblies (Figure 4). The measure of the rotation of these assemblies is displayed as the N1, N2 and N3 values respectively (see the engine/warning and system displays at Figure 3). The high-pressure assembly has an accessory gearbox attached. That gearbox includes components used to start the engine. A full authority digital engine control (FADEC) system controls and manages the engine, as well as provides engine parameters to the ECAM system.

Figure 4: Trent 700 cutaway diagram

The cutaway identifies the low-pressure assembly (blue), the intermediate-pressure assembly (yellow), the high-pressure assembly (orange) and the combustion chamber (red).

Source: Rolls-Royce, modified by ATSB.

The engine oil system

The engine’s oil system provides lubrication for engine components. A pressure pump module takes oil from the oil tank and supplies that oil to the engine components at the required pressure. That oil is then returned from the engine components to the oil tank using a scavenge pump module. The oil system uses three sensors to monitor oil pressure, two oil pressure transducers and an oil pressure switch. The transducers provide oil pressure parameters to the ECAM system, which in turn, are displayed as oil system parameters on the relevant engine systems display. Those transducer parameters are also sent to the FWC. The oil pressure switch provides a signal directly to the FWC in the event of loss of oil pressure. The FWC will generate a low oil pressure message in the event that any two of the three oil pressure sensors indicate low oil pressure.

The FCOM contained a section that detailed the limitations contained within the manufacturer’s Aircraft Flight Manual.^[16] Limitations attached to the aircraft’s power plant included a minimum oil pressure of 25 psi.

In a Flight Operations Briefing Notes (FOBN) titled Supplementary Techniques – Handling Engine Malfunctions,^[17] Airbus provided basic guidelines to identify engine malfunctions and typical operational recommendations in case of engine malfunctions. The FOBN included the following with respect to low oil pressure and low oil level:

In service experience shows that some rejected takeoffs and in-flight shutdowns have been commanded because of a low oil level. However, a low oil level alone is not a symptom of an engine malfunction.

On the other hand, a low oil pressure is the sign of an imminent engine failure. Therefore, the published procedure must be applied.

The engine starter system

The engine starter system comprises an air turbine starter (starter motor), a starter valve to provide high pressure bleed air to the starter motor, and engine start controls on the flight deck panels. The FADEC controls the system components and the start sequence.

For an inflight relight of the engine, the FADEC will identify whether the relight will require the assistance of the starter motor, or whether the flight conditions are sufficient to enable a windmilling relight. Rolls-Royce advised that if airspeed is greater than 280 kt and N3 is greater than 7 per cent, then a windmill relight will be performed. If either of these two parameters are not met, the FADEC will perform a starter assisted relight. During an inflight relight, the FADEC will:

• provide fuel to the engine when the high-pressure turbine has achieved greater than 10 per cent rotation
• if the starter motor has been engaged, disengage the starter motor when the high-pressure turbine has achieved greater than 50 per cent rotation.

Rolls-Royce also advised that there was no published data on engine indications for a windmilling engine. The expected N1, N2 and N3 indications would depend on the aircraft’s speed and altitude, however, test data for conditions similar to the first relight attempt suggest that these parameters would be about N1 of 18 per cent, N2 of 6 per cent and N3 of 4 per cent.

Emergency and abnormal procedures

The triggering of an ECAM alert will result in the procedure, which the flight crew are required to complete, being presented on the engine/warning display. Some actions required by the procedures may depend on a precondition. These preconditions are identified by a preceding dot. Procedures can also conclude with associated procedures. Associated procedures are additional non-normal procedures required to be completed as a result of a change in the aircraft’s configuration or status.

The procedures discussion will examine the Airbus ECAM procedures for the ENG OIL LO PR, ENG STALL, ENG FAIL, and the related ENG SHUT DOWN messages. This will be followed by discussion on the LAND ASAP message, engine restart in-flight procedures and the ENG START FAULT alert.

The AirAsia X Flight Crew Operating Manual (FCOM) contained explanations on these procedures. The intent was to explain actions for which the reason is not self-evident, and to provide additional background. As far as practicable, the procedural presentation in the FCOM was identical to that presented by ECAM. The following discussion on specific emergency/abnormal procedures is based on what is displayed to the fight crew on the ECAM, and any other relevant information that is contained in the FCOM.

The AirAsia X Flight Crew Training Manual^[18] contained general guidance on the conduct of engine malfunctions. That guidance stated:

Most engine malfunctions are taken into account by one or several ECAM alerts that warn the flight crew and provide the flight crew with the actions to perform. However, some engine malfunctions require some knowledge and the analysis of the flight crew, so that the flight crew can recognize, understand, and manage these engine malfunctions.

When the flight crew identifies an abnormal parameter, the flight crew should use all the information available to analyze the engine malfunction. The flight crew should not consider only this abnormal parameter to perform their analysis.

If possible, the flight crew should keep the engine running in flight. Except if a procedure requires an engine shutdown, it is usually preferable to keep the engine running. Even at idle, the engine powers the hydraulic, electric, and bleed systems.

In addition, if the flight crew is not sure which engine has a malfunction, the flight crew should keep the engines running. If really damaged, the affected engine will eventually fail.

The ENG OIL LO PR ECAM procedures

If engine oil pressure drops below 25 psi, the ECAM will trigger the ENG 1(2) OIL LO PR (engine oil low pressure) level 3 alert, with an associated aural alert. The displayed ECAM procedure was:

THR LEVER (AFFECTED ENGINE).................................................IDLE

● IF WARNING PERSISTS:

ENG MASTER (AFFECTED ENGINE)..............................................OFF

Selecting the ENG MASTER switch to OFF will shut the engine down. If the flight crew select the ENG MASTER to OFF, the ECAM identified the ENG 1(2) SHUT DOWN (engine shutdown) procedure as an associated procedure.

The ENG STALL ECAM procedures

An engine stall will trigger a level 2 alert, which is notified to the flight crew by the ENG 1(2) STALL (engine stall) ECAM message and associated aural alert. The displayed ECAM procedure is:

THR LEVER 1(2)....................................................................................IDLE

ENG 1(2) PARAMETERS.......................................................................CHECK

● IF ABNORMAL:

ENG MASTER 1(2).................................................................................OFF

If the flight crew select the ENG MASTER to OFF, the engine shutdown procedure is identified as an associated procedure.

The FCOM guidance for the engine stall procedure provided additional detail on the indications of a stalled engine, and also stated that an engine restart is at the flight crew’s discretion.

The ENG FAIL ECAM procedures

When the engine’s core speed is below idle while the engine MASTER switch is ON,^[19] the ECAM will trigger a level 2 alert with the ENG 1(2) FAIL (engine fail) ECAM message being displayed and associated aural alert. The displayed ECAM procedure is:

ENG START SEL.........................................................................................IGN

THR LEVER (AFFECTED ENGINE)...........................................................IDLE

● IF NO ENG RELIGHT AFTER 30 S:

ENG MASTER (AFFECTED ENGINE)........................................................OFF

● IF DAMAGE:

[not relevant]

● IF NO DAMAGE:

ENG (AFFECTED) RELIGHT........................................................................CONSIDER

The procedure required the flight crew to determine whether the engine is damaged. The FCOM provided guidance on indications of damage to an engine. The FCOM procedure stated that:

Engine damage may be accompanied by:

●  Explosions

●  Significant increase in aircraft vibrations and/or buffeting

●  Repeated, or uncontrollable engine stalls

●  Associated abnormal indications, such as hydraulic fluid loss, no N2 or N3 indication.

The placing of the ENG MASTER switch to OFF would result in the engine being shut down. This would trigger the ENG 1(2) SHUT DOWN ECAM, which was also identified as an associated procedure. Appended to the end of the ENG 2 FAIL and part of the notice that the associated procedure was the ENG SHUT DOWN procedure, was the following additional information:

Apply the ENG SHUT DOWN procedure … if damage, or if engine relight is unsuccessful.

The ENG SHUT DOWN ECAM procedures

When an engine was shut down, the amber LAND ASAP (land as soon as possible) and ENG 1(2) SHUT DOWN ECAM messages were displayed. The engine shut down procedure was designed to place the aircraft in a configuration that enabled single engine operation.

LAND ASAP message

The FCOM included definitions for the LAND ASAP ECAM message:

• LAND ASAP (red). Land as soon as possible at the nearest airport at which a safe landing can be made. Note: LAND ASAP (red) information is applicable to a time-critical situation.
• LAND ASAP (amber). Consider landing at the nearest suitable airport. The definition included a note, stating that the suitability criteria should be defined in accordance with the operator's policy.

Inflight engine relight

There was no ECAM displayed procedure for an in-flight engine relight. The FCOM and quick reference handbook (QRH) contained the ENG RELIGHT (IN FLIGHT) procedures.

Rolls-Royce advised that there is normally a delay of around 7 seconds between initiation of an inflight relight—through selection of the ENG MASTER switch to ON—and the first indication of rotation for N3.

The ENG START FAULT ECAM alert

The ENG 1(2) START FAULT level 2 alert was triggered when one of a number of conditions were detected during an engine start, including:

• exceeding the starter time
• an engine stall
• the engine’s exhaust gas temperature exceeds the limit
• no light up
• low N1 speed.

The ECAM procedure associated with the alert is not provided in this report, as it is not relevant for the event’s investigation.

For the first relight, the airspeed and starter motor were unable to provide sufficient N3 rotation to trigger the FADEC to provide fuel to the engine. As a result, light up did not occur within the required time. This was the probable cause of the ENG START FAULT ECAM alert.

For the second relight, the airspeed and starter motor were able to provide sufficient N3 rotation to enable fuel flow and light off, but due to the deteriorated state of the engine the N3 did not increase sufficiently to enable disengagement of the starter motor until the flight crew stopped the relight through selecting the ENG MASTER switch to OFF.

Aerodrome information

Rescue and fire fighting services

The rescue and fire fighting services (RFFS) required for various aerodromes was established through the International Civil Aviation Organization (ICAO), 2016 Annex 14 to the Chicago Convention, titled Aerodrome Design and Operations.^[20] The principal objective of RFFS is to save lives in the event of an aircraft accident or incident occurring at, or in the immediate vicinity of an aerodrome. An aerodrome’s required RFFS was based on a number of criteria, including the overall length and the fuselage width of the aircraft that predominantly use the aerodrome, and a threshold value in the number of movements of the highest category of aircraft. The various levels of RFFS category (CAT) establish a requirement for, among other things, the types and number of rescue and firefighting equipment required to be available at that aerodrome. Essentially, the larger the aircraft the higher the required RFFS CAT. The highest category was CAT 10.

Annex 14 also included a standard requiring that all aerodromes provide RFFS. Australia had a registered difference against this standard. That difference stated that not all international alternate aerodromes had RFFS. That difference also listed eight aerodromes where this was the case. Alice Springs was not included within that list.

Alice Springs

The AIP listed Alice Springs as a designated alternate airport to international airports. A designated alternate airport was defined as:

... an airport specified in the flight plan to which a flight may proceed when it becomes inadvisable to land at the airport of intended landing.

For the day of the occurrence, Alice Springs tower operated from 0830 to 1830 EST, with associated class C and D airspace^[21] being active. The occurrence happened outside of these hours, where the airspace at and below FL 180 became class G. RFFS was CAT 7 from 0745 to 1830. At the time of the occurrence, Alice Springs Tower was not manned and RFFS was not available. The NOTAMs^[22] contained in the OFP identified the correct RFFS availability.

Airservices Australia provided advice to the operator which stated that ‘outside the advertised operational hours RFF can be at Category 6 within 30 minutes notice in case of emergency’. This out of hours RFF support was provided by off-aerodrome municipal emergency services.

Neither pilot had operated into Alice Springs.

Adelaide

Adelaide operated a curfew from 2330 through 0630 EST. The aerodrome was available for nomination as a planned or unplanned alternate during the curfew. Specifically, curfew restrictions did not apply in a number of circumstances, including when the pilot of the aircraft had declared an in‑flight emergency, or when there was an urgent need for the aircraft to land to ensure the safety or security of the aircraft.

RFFS was CAT 9 from 0630 to 2330, and CAT 5 at other hours, however, on request and with one hour’s notice, RFFS could be raised to CAT 9. The NOTAMs contained in the OFP identified the correct RFFS availability.

The captain stated that he had operated into Adelaide twice and was familiar with that aerodrome, but was more familiar with Melbourne.

Melbourne

Melbourne did not operate a curfew. RFFS was CAT 10 with 24-hour availability.

Operational information

The occurrence involved an engine failure while the aircraft was operating as an extended range operations (ETOPS) flight.^[23] An ETOPS segment commenced when the flight was more than the threshold time, 60 minutes at the engine out cruise speed, from an authorised ETOPS alternate aerodrome. The occurrence flight had a maximum authorised diversion time of 120 minutes, that is, the flight was approved to operate no further than 120 minutes from any authorised ETOPS alternate aerodrome. The flight’s operational flight plan (OFP) listed three alternate aerodromes. Alice Springs and Darwin were two of those alternate aerodromes. In-flight, the flight crew were able to use a number of approved ETOPS alternate aerodromes, including Adelaide and Melbourne, should they be required for use. At the time of the engine failure, the aircraft was approaching Alice Springs and, at the relevant ETOPS planning speed, was about:

• 30 minutes from Alice Springs
• 75 minutes from Adelaide
• 115 minutes from Melbourne.

The following discussion on operational considerations around the engine failure and subsequent actions includes:

• an examination of Malaysian and Australian legislation, regulation and/or standards relevant to:
  • preflight planning requirements for international operations, and in particular alternate aerodrome requirements, for both normal operations and ETOPS
  • in-flight requirements following an engine failure
• an overview of the operator’s operations manual suite
• the operational flight planning requirements as contained within the operator’s operations manual
• the inflight requirements as contained within the operator’s operations manual.

Malaysian and Australian regulatory requirements

The operator was registered in Malaysia and required to meet Malaysian regulations for the conduct of operations and the occurrence flight. The flight, and the occurrence, however, was over Australian territory and therefore Australian law applied. It is therefore necessary to consider the effect of both states’ legal and regulatory systems on the planning and conduct of the occurrence flight.

The Malaysian legislative and regulatory system that applied to civil aviation consisted of the Civil Aviation Act 1969 (Malaysia), the Civil Aviation Regulations 2016 (Malaysia) and subordinate rules, standards, requirements and procedures . The following points are relevant:

• An operator was required to submit an operations manual to the regulator for approval.
• The regulator was required to approve ETOPS operations. That approval included relevant procedures, the authorised ETOPS routes, and alternate aerodromes available to be used.
• The Malaysian regulatory system applied to Malaysian registered aircraft extra-territorially.

The Civil Aviation Act 1988 (Australia) required international aircraft operating into or from Australia to have permission from the Civil Aviation Safety Authority (CASA). At the time of the occurrence, AirAsia X was operating under a Foreign Aircraft Air Operator’s Certificate (FAAOC). Civil Aviation Order (CAO) 82.0 applied a number of conditions to Air Operator’s Certificates authorising, among other things, regular public transport operations. CASA advised that CAO 82.0 was not applicable to foreign registered aircraft. CASA also advised that, in accordance with the Chicago Convention, the AirAsia X’s operations manuals, as authorised by the Department of Civil Aviation Malaysia (DCAM),^[24] were accepted by CASA for the purposes of issuing the FAAOC.

The Operations Manual suite

The operations manual (OM) suite, which was approved by the DCAM, contained the operator’s policies, instructions and procedures necessary for flight operations. There were four parts to the suite:

• Part A General/Basic (OMA) that contained non-type related operational policies, instructions and procedures.
• Part B Aeroplane Operating Manual (OMB) that contained all of the type related airplane operating manuals.
• Part C Route and Airport (OMC) that contained route and airport information.
• Part D Training (OMD) that contained training related information.

Operating procedures

The OMA contained ‘non-type related operational policies, instructions and procedures that are needed for a safe operation’. OMA Chapter 8 contained matters directly dealing with aircraft operations. That chapter contained a number of subsections, three of which were relevant for the occurrence event—flight preparation, flight procedures and ETOPS.

The OMC also contained material that supplemented the requirements in the OMA.

Flight preparation

The flight preparation section included criteria for determining the usability of aerodromes. The usability of an aerodrome was based on whether that aerodrome met:

• certain physical and supporting infrastructure requirements, that is, it met the criteria for being an adequate airport
• weather requirements at the projected time of use, that is, being an adequate airport that aerodrome met additional weather criteria for being a suitable airport.

An adequate airport was one that:

• met the required runway characteristics, including sufficient length and performance requirements
• had sufficient supporting infrastructure, including lighting, communications and navigation aids
• had the recue and firefighting services (RFFS) required for the type of operation that it was to be used for
• the pavement strength was compatible for the aircraft weight.

The adequate airport criteria also contained a limitation regarding operations over remote areas. That limitation required that a two engine aircraft operating over remote areas to not be flown more than 60 minutes:

• from an adequate airport
• at the one engine inoperative cruising speed
• where weather conditions are forecast at or above the applicable landing minima at the expected time of arrival.

The exception to this limitation was when operating in accordance with ETOPS criteria.

The adequate airport criteria also contained the operator’s required RFFS categories^[25] for various types of operations with their A330 aircraft. The A330 had an RFFS requirement for CAT 9. That RFFS requirement could be reduced, based on the type of operation that a particular adequate airport was to be used for. These reduced CAT requirements were:

• CAT 8 for a departure or destination airport
• CAT 7 for an en route alternate airport
• CAT 4 for an ETOPS suitable airport.

Finally, the adequate airport requirements also included a statement that:

• ‘RFF[S] category required for ETOPS and Adequate alternates is 4’. This statement contradicted the CAT 7 requirement for an en route alternate airport. The operator advised that this statement should have read ‘RFF[S] category required for ETOPS Adequate alternates is 4’.
• if during flight the aircraft captain becomes aware of an RFFS category downgrade, the captain may either divert or elect to accept an RFFS of no lower than CAT 4 and continue the flight.

A suitable airport was a departure, destination or alternate airport that met specific weather criteria at the time of the operation. The reported weather conditions at Alice Springs, Adelaide and Melbourne met the requirements for a suitable airport.

Flight procedures

The OMA section on flight procedures included policy and procedure for handling an abnormal/ emergency condition. Included within that material were the inflight requirements following an engine failure, which stated:

As a general rule if the reason for the engine failure cannot be clearly identified (ice, heavy rain, turbulence, etc.) then it shall not be restarted unless a greater emergency exists…

Two Engine Aircraft: The Commander/PIC shall: …

– Divert to the nearest suitable airport that is safe and operational.

– When two or more suitable airports are available then the nearest airport in flight time terms should be considered…

The following elements and others which may be relevant, should be considered, to determine whether an airport is suitable or not:

• Aircraft configuration and performance, current weight, systems status, required fuel versus usable fuel available, wind, weather, terrain, minimum altitudes, runway dimension, surface condition, braking devices available, navaids for approach and lighting available, RFF category at diversion airport and any injuries to any person or persons on board.

The Commander/PIC is expected to divert to the nearest suitable airport if operationally possible otherwise, he is expected to state his reason or reasons for the exceptional circumstances leading to him not to divert to the nearest suitable airport.

ETOPS

The OMA separated out all material pertaining to ETOPS into its own section. This section was broken down into a number of sub-sections that covered topics including general information, ETOPS specific definitions, dispatch requirements, normal and non-normal procedures. Regarding the scope of ETOPS policy, the introduction to ETOPS included the following statement:

The policies contained in this section are to be applied over and above AAX’s Flight Operations Standard Operating Policy when operating any of the specified ETOPS routes.

The definitions sub-section contained definitions specifically applicable to ETOPS. For the purposes of the occurrence, the following were relevant:

• ETOPS operations. The definition stated the following:

ETOPS operations apply to all flights conducted in a twin-engine aircraft over a route that contains a point further than 60 minutes flying time from an ADEQUATE airport at the approved one-engine-out diversion cruise speed schedule in still air and ISA conditions.

• Adequate airport. Otherwise known as an ETOPS adequate airport, the definition identified a number of variations or additions to the adequate airport criteria, as stated in the flight preparations section. These included:
  • the requirement for DCAM authorisation for an ETOPS alternate
  • the setting aside of runway pavement requirements^[26]
  • the minimum acceptable RFFS as being CAT 4
  • that remote airports that have reduced or no RFFS capacity could be used, where the minimum capacity is met by municipal fire departments located off-airport. Alice Springs was specifically identified as being an example of this type of remote airport. The operator stated that Airservices Australia had advised that Alice Springs municipal fire services met the RFFS CAT 4 requirements.
• Suitable Airport. Otherwise known as an ETOPS suitable airport, there were variations in the weather requirements for a suitable airport, but these were not applicable for the occurrence.
• Maximum Diversion Time. This is the maximum flying time authorised from any point of the route to the nearest adequate airport. The definition included the following:

AAX is approved by DCAM for 120/180 minutes maximum diversion time. Refer to specific aircraft Operations Specifications (OPS SPECS).

It is only used for determining the area of operation, and therefore is not an operational time limitation for conducting a diversion, which has to cope with the prevailing weather conditions.

• Maximum Diversion Distance: This definition applied a standard one engine out diversion profile and reference weight, resulting in still air standard distances for various approved diversion times. The following were applicable:
  • 60 minutes. Also referred to as the threshold time, the equivalent distance was 430 NM (see Figure 5 for the application of this threshold time for the occurrence flight).
  • 120 minutes. The equivalent distance was 823 NM. The OFP stated that the occurrence flight was an ETOPS flight limited to 120 minutes.

Figure 5: XAX221 flight track, with 430 NM range circles

The flight track of XAX221 is displayed, as are 430 NM range circles from the company preferred alternates of Melbourne, Adelaide and Alice Springs aerodromes. The positions of the ENG2 OIL LO PR warning and the two engine relight attempts are also shown.

Source: Google earth, modified by ATSB.

• Area of operation: Also known as the ETOPS area of operation, this was defined as follows:

The ETOPS Area of Operation is the area in which it is permitted to conduct a flight under the ETOPS regulations. It is defined by the declared maximum diversion distance from an adequate airport (or set of adequate airports), and is represented by the area enclosed within the circles centred on the selected adequate airports, the radius of which is the declared maximum diversion distance.

The OMA separately listed Australia as an ETOPS area of operations.

• ETOPS entry point (EEP). The point located on the aircraft’s outbound route, 60 minutes from the last adequate airport. It marks the beginning of the ETOPS segment.
• ETOPS exit point (EXP). The point located on the aircraft’s route, where the aircraft has been flying in the ETOPS segment, it enters an area within the threshold time to an adequate aerodrome. It marks the end of the ETOPS segment.
• ETOPS segment. Defined as follows:

The ETOPS segment (ETOPS area of operations) starts at the EEP and finishes at the exit point (EXP) when the flight path is back and remains within the 60 minutes area from an ADEQUATE airport. An ETOPS route can contain several successive ETOPS segments well separated from each other.

For a graphical presentation of the EEP, EXP and the ETOPS segment, see Figure 6.

Figure 6: The ETOPS segment, EEP and EXP.

Source: AirAsia X.

The dispatch requirements sub-section included guidance on the content and structure of an ETOPS OFP. As part of ETOPS dispatch requirements, the operator was required to keep a list of approved ETOPS routes with the corresponding en route alternates. The OM suite did not identify any specific ETOPS routes, but instead listed ETOPS areas of operations, which included Australia. The en route alternates were listed separately in the OMC, in a section titled Company Preferred Alternates.

The normal procedures sub-section included procedures relating to preflight cockpit preparation, taxiing, specific inflight procedures such as after airborne communications with dispatch, renomination of en route alternates, fuel and weather update requirements, and various procedures relating to whether the aircraft can meet the specific requirements for ETOPS flight prior to entering an ETOPS segment.

The non-normal procedures sub-section contained the following relevant content:

• The Airbus recommendations and guidelines for inflight re-routing or diversion decision making contained in the flight crew operating manual (FCOM) was referenced.
• A section titled Failure Cases Requiring a Diversion to the Nearest Airport stated:

In cases leading to a LAND ASAP message on ECAM or QRH, the crew are to follow the ECAM procedures and land at the nearest suitable airport. LAND ASAP in RED requires greater urgency than LAND ASAP in AMBER.

• There were also procedures applicable to various systems failures that contained specific guidance prior to the ETOPS segment and during the ETOPS segment.

The operator advised that, as the aircraft had not entered an ETOPS segment, ETOPS policy and procedures did not apply to this particular phase of the aircraft’s flight.

Company preferred alternates

The OMC contained criteria used to select company preferred alternates. The selection criteria for a company preferred alternate included 24 hour operations (unless otherwise stated) and an RFFS of CAT 7 or better (CAT 4 or better for ETOPS).

The OMC also contained a list of preferred alternate aerodromes. The intent of the list was to assist pilots in the selection of an aerodrome for a safe landing when circumstances necessitated, such as a change from a planned en route alternate. The list of company preferred alternates included:

• Alice Springs, with a stated RFFS of CAT 6, and also an indication that additional information regarding operating time/hours applied
• Adelaide, with a stated RFFS of CAT 9 during published normal hours and CAT 5 at other times.

That list also included Melbourne, Avalon and Sydney. The OMC also contained the following statement:

There is nothing to prevent pilots from considering airports that are not listed for diversion. However, it is the responsibility of the Commander to ensure that the aircraft performance requirements are met and the deviation from the prescribed criteria is justified under the circumstances.

Meteorological information

The following summarises the METARs^[27] covering the period 2330 to 0330 for:

• Alice Springs, visibility was greater than 10 km, the wind light and variable, temperature around 12 °C and dew point^[28] 0 °C, with the QNH^[29] 1021.
• Adelaide, was CAVOK^[30] with the wind light and variable, temperature around 13 °C and dew point 10 °C, QNH 1021, with a trend indicating no significant change.
• Melbourne was CAVOK with a strong northerly wind of 20 kt but decreasing over the period, temperature around 13 °C and dew point 9 °C, QNH 1019. The METARs also included an observation of moderate to severe turbulence below 5,000 ft.

The ATIS^[31] for the aircraft’s arrival at Melbourne stated that the wind was 350 degrees at 16 kt, and the weather conditions were CAVOK.

Flight recorders

The aircraft was fitted with a flight data recorder and cockpit voice recorder as required by regulation. The cockpit voice recorder was not obtained by the ATSB—the event would have been overwritten due to the length of flight. Additional data from the aircraft’s FADECs was obtained from the engine manufacturer.

Post flight examination of the engine

Examination by the engine manufacturer

Rolls-Royce conducted an investigation into the engine failure, which included an examination of the affected engine. That examination found the following:

• there were no obvious engine oil leaks
• oil tank contents were full
• the engine magnetic chip detectors and oil filters were clean
• the oil pressure pump drive shaft neck was fractured (Figure 7)
• the high pressure (HP) assembly was seized due to bearing stress
• damage to the HP assembly ball and roller bearings was consistent with engine operation without oil pressure.

Figure 7: Fractured oil pressure pump shaft

Source: Rolls-Royce.

On examination of the failed shaft, Rolls-Royce identified that the failure occurred at the shear neck,^[32] but that the failure was not typical of any previous shear neck failures (Figure 8). Rolls‑Royce found that the shaft fracture was the result of fatigue cracking that originated at multiple sites within the shaft bore. Those cracks grew over time, weakening the shaft, until the remaining material failed in overstress. The material and shaft dimensions reportedly complied with specifications. Rolls-Royce was not able to determine what generated the fatigue cracks in this pump shaft. Other than the fracture in the shaft, the pump was in a serviceable condition.

Figure 8: Example of a typical shear neck fracture of an oil pressure pump shaft

Note that the fracture surface is perpendicular to the shaft axis.

Source: Rolls-Royce.

The Rolls-Royce investigation concluded that damage to the HP assembly bearings was consistent with engine operation without oil pressure. Rolls Royce also concluded that the surges were consistent with the expected behaviour of an engine with the identified damage to the HP bearings.

An analysis of the relight attempts was also completed. The analysis stated that during the:

• first relight attempt, the engine did not reach the FUEL ON condition,^[33] and therefore fuel flow remained at zero throughout the relight attempt.
• during the second relight attempt:
  • at 0132:25, N3 exceeded the FUEL ON condition and fuel was introduced into the engine
  • 11 seconds later the engine’s EGT^[34] began to increase, indicating light up
  • N3 did not increase above the 50 per cent threshold required for starter disengagement, the highest recorded value being 43 per cent
  • oil pressure for the engine remained at zero throughout both relight attempts.

Oil pressure pump history

Rolls-Royce reported that the oil pressure pump had completed 2,250 cycles^[35] and 13,597 hours since new. It had recently been removed from the engine and sent to the pump manufacturer for inspection and rebuild as part of checks for another engine issue. The pump shaft had been subjected to, and passed, non-destructive testing as part of the rebuild. Since being refitted to the engine, it had completed a further 20 hours and 6 flights. Rolls-Royce did not identify any significant events during the engine history that would have affected the oil pressure pump’s integrity.

The oil pressure pump model is common to both the Trent 700 and the Trent 800 (fitted to Boeing 777 aircraft). Rolls-Royce reported that in an initial review of in-service experience, it identified two previously reported cases of pump failure. The first was on a Trent 800, with approximately 3,000 hours since overhaul, and the second was on a Trent 700, with 7,730 hours since new. In both cases, the failure was a result of pump bearing seizure, and the fracture was perpendicular to the axis of the shaft, consistent with that shown in Figure 8.

Procedural instructions

Procedural compliance

In an article in the Airbus safety magazine Safety First, Airbus (2007) discussed the issue of trained flight crew not following procedures. Airbus identified that procedural compliance required not only good procedural design, but also appropriate explanations to support the procedure. Appropriate explanations ensure that flight crew have sufficient confidence in their skills and judgment to manage the situation. Airbus argued that mismatches between procedures (an instruction) and their implementation (an action) can be a function of human performance, which is not stable. Aside from factors such as fatigue, workload and stress, the implementation of procedures requires:

• understanding the situation
• understanding the procedure and its meaning
• ensuring that all pre-conditions are checked
• anticipating the expected results
• ensuring that all actions required by the procedures are performed in the right order, with good judgment and with good synchronisation between crewmembers.

Airbus concluded that no set of procedures can substitute for human intelligence and flight experience. Safety is a function of a safe aircraft, procedures, and flight crew competence as an ability to manage the expected and unexpected.

Ambiguity in procedural construction

As pointed out by Airbus, good procedural design is a critical component of the safety equation. A factor influencing checklist performance is ambiguity of terms listed (Degani and Weiner, 1993). Once the appropriate procedure has been found (de Britto 1998):

• the crew have to understand the content
• then plan the necessary actions
• and finally execute actions planned.

One type of understanding required is a literal understanding of the items. A literal understanding can be affected by ambiguity in the English language, particularly when the crew are from non-English speaking countries (de Britto, 1998; Burian, 2006).

To improve the effectiveness and clarity of technical documentation, the AeroSpace and Defence Industries Association of Europe published a guide on simplified English for use in technical publications (ASD-STE100). That guide included a dictionary that identified words that should be replaced with another word that provided a clearer meaning. The guide identified the verb ‘persist’ as one such word. It recommended that persist be replaced by ‘continue’. Airbus stated that it has an internal lexicon which is used to construct procedures displayed to flight crew through the ECAM. The operator stated that it did not hold a copy of that lexicon.

The ECAM procedure for the ENG 1(2) OIL LO PR^[36] contained the precondition ‘IF WARNING PERSISTS’ before shutting the engine down. ‘Persist’, however, could refer to either a:

• temporal sense, such that if the warning exists for a length of time, then the ENG MASTER switch is to be selected to OFF, however, the length of time was not specified in the procedure
• change in the way that the condition presents itself, requiring a response to a change or absence of change—specifically the ECAM message goes away and the associated alerts cease.

The flight crew appear to have interpreted the precondition as a temporal change, as they stated that:

• all other engine indications were normal after the thrust lever was retarded
• they monitored the engine and then some minutes later advanced the thrust lever to trouble shoot the alert.

Rolls-Royce Trent 700 engine operating instructions

The Rolls-Royce engine operating instructions identified that the ENG X OIL LO PR message was a level 3 alert that triggered in response to the indicated oil pressure being below 25 psid.^[37] The recommended procedure in flight was:

— THR LEVER X REDUCE

Reduce the thrust on the affected engine until the 'OIL LO PR' ECAM warning clears.

Continued operation of the affected engine is acceptable providing this thrust level is not exceeded.

If warning has not cleared even when the IDLE setting has been achieved.

— ENG MASTER X OFF

ATSB observation

Airbus have used the following procedure in the A330 FCOM as an equivalent procedure to the Rolls-Royce procedure:

THR LEVER (AFFECTED ENGINE)...........................................................IDLE

● IF WARNING PERSISTS:

ENG MASTER (AFFECTED ENGINE)........................................................OFF

This would indicate that Airbus have intended the use of ‘persists’ to mean ‘if warning has not cleared’, however, common language usage of persists is in a temporal sense.

Airbus comments regarding the occurrence

Airbus provided the following comments regarding flight crew’s response to the ENG OIL LO PR alert:

The ASD-STE100 standard proposes to use the ‘continue’ instead of ‘persist’. Having discussed with our native English speaking test pilots, such wording may also be interpreted by flight crews as a temporal requirement, as it is a synonym of ‘persists’.

In the controlled language used by Airbus, the word ‘persist’ is authorized and has the following meaning : "To continue to exist especially past a usual, expected, or normal time."

The ENG 1 (2) OIL LO PR alert is a red warning. As stated in the FCOM, such configuration/failure requires an immediate crew action, as this system failure may be altering the flight safety. Even if the flight crew misinterpreted the procedure line to be a temporal condition and not a conditional one, monitoring the engine for more than 3 minutes cannot be considered to be an appropriate crew response to an emergency procedure.

The AAIB UK analysis of previous events where spurious OIL LO PR alerts were generated shows that the majority of flight crews will consider such alert as genuine and therefore will shutdown the engine.

Human performance related information

Error

Errors are the result of actions that fail to generate the intended outcomes. The cognitive processes involved in achieving the goal provide a means of categorising error, and may relate to either the planning or execution of the activity. When there is a prior intention to act and the actions proceeded as planned, but the desired result is not achieved, that error is identified as a mistake. Reason (1990) stated that:

Mistakes are deficiencies or failures in the judgemental and/or inferential processes involved in the selection of an object or in the specification of the means to achieve it, irrespective of whether or not the actions directed by this decision-scheme run according to plan.

One type of mistake is known as a rule-based mistake, which involves the inappropriate matching of environmental signs to the situation and applying troubleshooting principles. Wickens and Hollands (2000) add that this type of mistake occurs when operators know, or believe they know the situation, and they invoke a rule or plan of action to deal with it.

While managing emergency or stressful situations, decision errors can occur. One example is when flight crew develop an incorrect interpretation of the situation, which leads to an inappropriate decision (Orasanu, 2010). Within these situations, demands on the flight crew increase (Woods and Patterson 2001). This is because:

• more knowledge potentially needs to be recalled
• there is more information to monitor and consequently, there is a changing set of data to integrate into a coherent assessment
• theories need to be generated and evaluated
• assessment may need to be revised as new data comes in
• actions to protect the safety of systems need to be identified, carried out, and monitored for success
• existing plans need to be modified or new plans formulated to cope with this process.

When evaluating a situation, there are often available cues that can actually leave the crew without a clear idea of the underlying problem (Orasanu, 2010). Various noises, thumps, vibrations, rumblings, pressure changes, or control problems indicate that something has happened, but not necessarily what. The cues signal potentially dangerous conditions that trigger emergency responses, regardless of the source of the problem. In addition, when experiencing stress and high workload, crews are vulnerable to missing important cues related to their situation and are likely to experience difficulty pulling together disparate pieces of information and making sense of them. This is especially true when some of that information is incomplete, ambiguous, or contradictory (Burian, Barshi, and Dismukes, 2005).

In addition, there is the potential effect of confirmation bias. This is a type of bias that describes a tendency for people to seek information and cues that confirm the tentatively held hypothesis or belief, and not seek (or discount) those that support an opposite conclusion or belief (Wickens and Hollands 2000). Incorrectly interpreting cues due to confirmation bias can strengthen that bias, leading to further cues not being correctly interpreted.

The operator’s internal safety investigation process

Safety Management Systems

The International Civil Aviation Organization (ICAO) Annex 19 to the Chicago Convention, Safety Management, defines a safety management system (SMS) as ‘a systematic approach to managing safety, including the necessary organizational structures, accountabilities, policies and procedures’. The implementation framework for an SMS needs to include the conduct of safety investigations. In alignment with ICAO standards, r. 167 of the Civil Aviation Regulations Malaysia requires that service providers, including air operator certificate holders, shall establish a SMS.

One of the key SMS references documented in the operator’s SMS Manual was the Civil Aviation Authority of Singapore’s Advisory Circular AC-1-3(5), Safety Management Systems. This AC advised that organisations should ‘show that the investigation identifies contributing or causal factors, identifies and ensures the implementation of necessary corrective actions’ and that identified controls are implemented.

Purpose of a safety investigation with a systemic approach

The latest edition of ICAO Doc 9858 Safety Management Manual, released in 2018, states that:

The primary objective of the service provider safety investigation is to understand what happened, and how to prevent similar situations from occurring in the future by eliminating or mitigating safety deficiencies. This is achieved through careful and methodical examination of the event and applying the lessons learned to reduce the probability and/or consequence of future recurrences.

ICAO also advocates for a no-blame approach to investigations:

The safety investigation should focus on the identified hazards and safety risks and opportunities for improvement, not on blame or punishment.

ICAO further promote that safety provider’s investigation reports should include clearly defined findings and recommendations designed to eliminate or mitigate identified safety deficiencies.

The operator’s processes and approach to safety investigations

The operator's SMS policy stated that:

Investigations are undertaken to help identify areas of safety deficiencies. When reports are submitted, an investigation process takes place to discover the details of the occurrence. It is through this process that safety deficiencies can be identified and corrected.

The stated objectives of an investigation included not only establishing what happened, but to identify the local conditions and organisational factors that contributed to the occurrence, review the adequacy of existing system controls and barriers, and to formulate recommendations and lessons learned. The objectives also outlined that the operator took a no-blame approach to investigations.

The documented means for AirAsia X investigators to conduct their analysis included the AirAsia Systemic Investigation Analysis (ASIA) method, which was outlined in a Quick Reference Guide. The ASIA process was described as follows:

ASIA is a process for conducting a systemic analysis of data collected during an incident or accident investigation, and for summarising and reporting this information using a structured framework and standard terminology.

ASIA aims to broaden the spotlight from the errors of individuals and to identify factors at all levels of the organisation or broader system that contributed to the safety event. Correct application of the ASIA method will identify systemic safety deficiencies and guide the generation of effective recommendations to prevent recurrence of similar events.

AirAsia X SMS guidance material stated that the ASIA method was based on the Reason accident causation model.^[38]

AirAsia X internal investigation report

The operator conducted an internal investigation into the occurrence.

A preliminary report from this investigation, released on 12 September 2016, contained a number of findings, including that the flight crew performed the ‘correct procedure’ by shutting down engine 2 after it had failed, and that the crew perceived that all engine indications and oil quantity were as indicating normal after engine shutdown. On the topic of the engine re-light attempts, the report stated that the flight crew referred to the FCOM, but were unsuccessful with each of the two attempts. With respect to the diversion to Melbourne, the report indicated that Melbourne was more favourable due to considerations around company RFFS requirements, Adelaide being under curfew, and passenger well-being (among others).

There were three safety recommendations, predominantly around needing to share the event with flight crew and the training department for enhancing current training programs. The operator published an update to the report in May 2018. The operator later advised that this updated report was their final report on the occurrence. This report restated the safety recommendations to share the event with flight crew and the training department for enhancing current training programs. It also contained two further recommendations, which concerned the issuing of a flight safety notice and a training bulletin designed to re-emphasised the inflight engine shutdown procedures and policies. The final report also included a finding that the decision by the flight crew to divert to Melbourne was not in accordance with the company policy that requires a landing at the nearest suitable airport when an amber LAND ASAP is displayed.

Related occurrences

ATSB investigation AO-2007-035

On 15 August 2007, an Airbus A330-300 aircraft, registered PK-GPF, was about 926 km north-west of Sydney, NSW en route to Denpasar, Indonesia when the right engine low oil pressure warning activated. The flight crew shut down the engine and commenced a descent to FL 240 while they advised ATC of the event and requested a clearance to return to Sydney. ATC cleared the crew to descend and to track directly to Sydney.

The ATSB found that it was probable that the flexible oil pressure transmitter tube fractured as a result of fatigue from the tube not being adequately supported while being subjected to high levels of vibration. As a result of the crack, engine oil leaked to atmosphere, activating the right engine low oil pressure warning. There had been a history of this cracking and the engine manufacturer, Rolls-Royce, had issued a service bulletin to provide additional support for the tube. This had not been incorporated into the occurrence aircraft.

The ATSB investigation report also noted that another service bulletin had been released in 2002 by the engine manufacturer to alleviate false low oil pressure warnings and fluctuating oil pressure readings. These false readings were attributed to intermittent electrical signals resulting from wear of the electrical contact pins on the oil pressure transmitter connectors.

AAIB UK Bulletin 9/2013 Airbus A330-343, G-VKSS 19 January 2013

On 19 January 2013, an Airbus A330, registered G-VKSS, was in the initial climb and passing 530 ft above ground level when it was struck by birds. The birds impacted the fan blades of both the left and right engines. Both engines were damaged, resulting in significant vibration. The left engine was shut down by the crew following an ENG 1 OIL LO PR ECAM message and the engine oil pressure indicated zero. The aircraft returned to the departure aerodrome.

The aircraft was fitted with Trent 700 engines. No defects were identified with the engine oil system. The left engine oil pressure indication was the result of the high engine vibration causing transient negative oil pressure. The oil pressure transducers detected the transient negative oil pressure. When combined with the engine’s electronic controller logic, this caused the system to generate a low oil pressure warning that was locked on until the engine was shut down.

Rolls-Royce advised that there had been seven previous events of high vibration resulting in the generation of a low oil pressure message. Of these, five had resulted in a precautionary shutdown. However, no details were provided as to why the other two did not result in a shutdown.

In 2018 Rolls-Royce introduced a number of modifications to address the issue of ‘Low Oil Pressure’ warnings being spuriously triggered due to high engine vibration. A new oil pressure transmitter with an electronic filter to dampen high frequency/high amplitude measurements from its input was introduced in a January 2018 engine service bulletin. The engine manufacture also determined that the oil pump failure detection logic in the electronic engine controller software was no longer required. This software function was disabled through an October 2018 engine service bulletin.

__________

16. The Aircraft Flight Manual is a certification document attached to the certification of a given aircraft model. It is not an operational document. The FCOM is designed for use by flight crews.
17. Available at https://skybrary.aero/bookshelf/books/193.pdf, the FOBN series is designed to provide an overview of specific standards, flying techniques and best practices, with the intent of enhancing safety awareness.
18. The Flight Crew Training Manual was an Airbus document fully adopted by the operator.
19. And the FIRE push button has not been pressed.
20. ICAO Annexes are reliant on member State’s promulgating their content in national laws, regulation, standards and procedures, and implementing that content.
21. Class C airspace is the controlled airspace surrounding major airports. Class D airspace is the controlled airspace that surrounds general aviation and regional airports equipped with a control tower. Uncontrolled airspace is designated as class G.
22. A notice to airmen (NOTAM) is a notice containing information concerning the establishment, condition or change in any aeronautical facility, service, procedure or hazard, the timely knowledge of which is essential to personnel concerned with flight operations.
23. For background information on ETOPS see Appendix 2: Extended range operations for two-engine turbine aircraft.
24. In 2018, DCA Malaysia transitioned to the Civil Aviation Authority of Malaysia.
25. Particular aircraft types have minimum RFFS category requirements, which in turn determines aerodromes they are able to use.
26. The basis of the removal of runway pavement requirements was that an aircraft in an emergency is not required to consider runway pavement limitations. The definition, however, identified specific guidance that limited the application of this rule.
27. METAR: a routine aerodrome weather report issued at routine times, hourly or half-hourly.
28. Dewpoint: the temperature at which water vapour in the air starts to condense as the air cools. It is used, among other things, to monitor the risk of aircraft carburettor icing or the likelihood of fog.
29. QNH: the altimeter barometric pressure subscale setting used to indicate the height above mean seal level.
30. Ceiling and visibility okay (CAVOK): visibility, cloud and present weather are better than prescribed conditions. For an aerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, no cumulonimbus cloud and no other significant weather [see AIP GEN 3.5 – Meteorological services, Section 4 Meteorological reports, paragraph 4.4.1, subparagraph g; and Section 12 Aerodrome weather and forecast decode, paragraph 12.13 CAVOK].
31. Automated terminal information service, a continuous broadcast of recorded non-control information in selected high-activity terminal areas.
32. A design function, where the diameter section of the shaft is reduced to provide a weak point on the shaft. That weak point enables a controlled site for failure should the pump shaft seize, thereby providing protection from further damage to the engine.
33. A minimum N3 speed required before fuel will be introduced into the engine.
34. Exhaust-gas temperature, measured immediately downstream of the turbines[s].
35. One complete sequence of events making up a portion of the life of the engine. A cycle normal commences with the start-up and concludes with the shutdown of the engine.
36. See Emergency and abnormal procedures.
37. Pounds per square inch differential.
38. See AR-2007-053, Chapter 3.3.at: www.atsb.gov.au/publications/2008/ar2007053/.

Safety analysis

While en route from Sydney, NSW to Kuala Lumpur, Malaysia, the oil pressure pump drive shaft for the right engine (engine 2) of an AirAsia X Airbus A330 failed. That shaft failure resulted in the oil pressure in engine 2 dropping rapidly to 0 psi. The aircraft’s electronic centralised aircraft monitor (ECAM) detected the drop in oil pressure and notified the flight crew through the ENG 2 OIL LO PR alert and associated warning signals. In response to the alert, the flight crew reduced the engine’s thrust to idle in accordance with the displayed procedure, but then elected to monitor the engine instead of shutting it down as intended by the procedure. After almost four minutes, the flight crew returned the engine 2 thrust lever to the normal inflight position, resulting in the engine’s thrust increasing. Shortly thereafter, the engine surged a number of times and eventually failed. The flight crew completed the engine failure procedure, shutting the engine down, and initiated a diversion to Melbourne. During the diversion, the flight crew attempted to relight engine 2 twice, the first shortly after the engine failure, and the second just prior to descending into Melbourne. Rolls Royce determined that the drive shaft failed due to fatigue cracking, but this was an unusual failure that had not been observed previously.

This analysis will examine the flight crew’s:

• response to the oil pressure alert and the subsequent engine failure
• attempted relights of the failed engine
• diversion decision.

The analysis will conclude with a discussion on the internal investigation conducted by the operator.

Oil pressure alert and subsequent engine failure

The oil pressure pump shaft failure resulted in a level 3 failure red alert, and the ECAM message ENG 2 LO OIL PR and associated procedure being displayed to the flight crew. A level 3 alert is associated with a configuration or failure that requires an immediate crew action, as this configuration or failure may alter the safety of flight. After moving the thrust lever to idle, the procedure included a precondition for initiating the next and final step. That precondition required the flight crew to determine whether the ‘warning persists’, and if it did, then to shut the engine down. The flight crew probably interpreted the precondition as a temporal and not a conditional requirement:

• temporal, in that any further action be delayed, an interpretation that could be supported by the Flight Crew Training Manual (FCTM) guidance that urged a bias towards deferring any action that will result in shutting an engine down, and to look beyond the abnormal parameter
• conditional, as is the intent of the Rolls-Royce guidance to Airbus on the procedural design.

The flight crew elected to leave the engine at idle, and instead undertook further analysis of the engine indications. The flight crew’s actions point to two human performance issues in the conduct of the checklist:

• potential ambiguity in the checklist’s construction
• error in the flight crew’s performance, as a result of their mistaken belief as to the source of the level 3 alert.

Ambiguity in the checklist language

The engine manufacturer’s engine operating instructions clearly identified that the procedural response to the OIL LO PR message required the engine to be shut down if the message had not cleared when the idle setting had been achieved. The use of the word ‘persists’ in the precondition for completing the procedure in the Airbus ECAM procedure introduced the possibility of misinterpretation of the required precondition by the flight crew.

Effective communication, which includes all transfer of information whether spoken or written, is essential for the safe operation of flight. The quality and effectiveness of communication is determined by its intelligibility, that is, the degree to which the receiver understands the intended message. Individual words can have multiple meanings, while sentence construction and context can further complicate understanding.

While English is the international language of the aerospace industry, English is often not the native language of flight crew. An example of an attempt by an industry organisation to promote clarity in the use of English in technical documents is the ADS-STE100. That document highlights the potential ambiguity of the verb ‘persists’. Airbus have also identified that an internal lexicon is used in the construction of ECAM language. That lexicon does not appear to be publicly available.

The flight crew’s action in monitoring the engine parameters after partially completing the required procedure is a strong indicator of a misunderstanding in the language used for the precondition description.

Error in the conduct of the ENG 2 OIL LO PR procedure

Airbus pointed out that procedural non-compliance can be a function of understanding the procedure and its meaning. While the supporting explanation for the ENG OIL LO PR alert in the flight crew operations manual (FCOM) was limited, the ECAM was a level 3 alert. A level 3 or red alert denotes a ‘system failure that alters flight safety and requires immediate action’, and the associated procedure is one ‘which may result in personal injury or loss of life if not carefully followed’.

The flight crew’s response, however, should also be assessed in light of the FCTM’s guidance on shutting an engine down as well as the apparent miscomprehension of the ‘persist’ component of the procedure. The FCTM guidance stated that a flight crew should keep the engine operating unless the procedure required an engine shutdown. Instead of shutting the engine down, the flight crew mistakenly continued monitoring the condition of engine 2.

While monitoring the engine, the flight crew developed a belief that the zero oil pressure readings were due to a gauge error, as all other engine parameters were interpreted as being normal. This led to a mistaken understanding that the alert was a false indication. The flight crew subsequently increased engine 2’s thrust. The increase in thrust resulted in the engine surging then stalling, which triggered the ENG 2 STALL alert. The flight crew correctly actioned this new ECAM procedure, retarding the thrust lever. About 30 seconds later, however, the engine surged again and failed. The engine failing triggered the ENG 2 FAIL alert.

The flight crew’s action of increasing the thrust on engine 2 following the ENG 2 OIL LO PR alert led to the engine stalling and then failing. While it is likely that continued operation of the engine at idle thrust with zero oil pressure would have eventually resulted in sufficient bearing damage that would lead to stalls and engine failure, the increase in thrust accelerated that result and probably increased the damage to the engine.

Finally, as identified by the United Kingdom’s Air Accidents Investigation Branch bulletin 9/2013, there had been a recent series of false low oil pressure ECAM alerts on Rolls-Royce engine A330 aircraft. It is not known whether the flight crew were aware of these, or any subsequent Airbus notifications concerning this issue.

Attempted relights of the failed engine

The flight crew stated that, following the engine failure, they then actioned the ENG 2 FAIL procedure. That procedure included a restart (relight) attempt, and then required a decision about whether the engine was damaged. If the engine was deemed not to be damaged, the procedure prompted the flight crew to consider a further relight attempt. The conditions indicative of engine damage were contained within the FCOM, but not displayed on the ECAM. The flight crew later reported that they consulted the FCOM, following which they determined that the engine was not damaged. This may have been influenced by confirmation bias as there was evidence available to the crew that met the criteria for damage, including:

• repeated or uncontrollable engine stalls—the engine experienced two surges/stalls. The ENG 2 STALL message alerted the flight crew to the first stall, to which they responded in accordance with the required procedure, and from which the engine recovered. The second stall was uncontrolled and resulted in the engine failing. The flight crew stated that they did not recognise the two stall events as being separate, however, they stated that they briefly saw the engine stall message and that the engine then failed. By this account, the engine experienced an uncontrollable engine stall.
• abnormal engine indications—the guidance cites hydraulic fluid loss, no N2 or N3 indication as examples. The flight crew stated that they assessed the oil pressure indications as being abnormal after they had completed the initial actions for the ENG OIL LO PR alert.

Further, the FCOM version of the ENG 2 FAIL procedure stated, at the end of the procedure, that the engine should be shut down if a relight was unsuccessful.

About 10 minutes after shutting the engine down, the flight crew attempted to relight the engine. Prior to this attempt, the first following the engine shut down, there were a number of factors that should have alerted the flight crew that there was a problem with engine 2 and not to attempt to a relight:

• The engine had an oil pressure issue, the source of which had not been clarified.
• The engine had experienced a stall, then failed.
• The engine indications were not normal.
• The operations manual stated that a failed engine should not be restarted if the reason for the failure cannot be clearly identified.
• The relight attempt that was part of the ENG FAIL procedure was not successful, and the subsequent ENG SHUT DOWN procedure did not include the option of a relight.

There was no safety risk to the aircraft that demanded a relight attempt, and there was significant contextual evidence related to that engine that should have created doubt about the engine. The flight crew’s first relight attempt was unsuccessful. They stated that the relight procedure was terminated as a result of the ENG 2 START FAULT message being displayed.

The flight crew commenced a second relight attempt of the failed engine just prior to descending into Melbourne. In addition to the above factors that should have alerted the flight crew that there was a problem with engine 2, there was the additional evidence of a failed restart attempt and the ENG 2 START FAULT message. For this restart, the engagement of the starter motor and the airspeed were sufficient to enable fuel to be introduced into the engine. While the engine relit shortly after, the Rolls-Royce report identified that either prior to, or as a result of, the second relight attempt, the damage to the engine was sufficient to ensure that the engine could not achieve rpm for sustained operation. Further, the flight crew stated that the relight attempt was terminated as a result of vibrations from the engine.

The multiple failures and abnormal indications associated with engine 2 should have raised questions for the flight crew on the cause of the failures and the viability of the engine. The operator’s procedures stated that, if the reason for an engine failure cannot be clearly identified, then it shall not be restarted unless a greater emergency exists. A greater emergency did not exist. Contrary to the operator’s procedures, the flight crew attempted two restarts on the failed engine.

The diversion

A factual synopsis

Following the first engine surge the flight crew declared an emergency and notified ATC of the event, requested descent, and indicated an initial intention to divert to Melbourne. ATC cleared the aircraft to divert to Melbourne and descend. Following the second surge and subsequent engine failure, the flight crew confirmed the intent to divert to Melbourne. A few minutes later, the flight crew contacted maintenance support, who stated a preference for Melbourne as the diversion target due to better support, but stated that the decision was the aircraft captain’s. Shortly after, the flight crew requested advice on the runway in use in Adelaide, and whether the Adelaide curfew was in force. ATC responded with the runway, and that the curfew would be waived if the flight crew declared an emergency. The flight crew did not respond to this advice.

From the flight crew’s perspective, the following considerations influenced the diversion decision:

• The minimum RFFS requirement for a diversion airport was CAT 7.
• Adelaide was not preferred due to the curfew and RFFS status being below the required CAT 7 and the flight crew being more familiar with Melbourne.
• Melbourne provided the best option due to RFFS and maintenance support.
• Due to the close proximity of Adelaide to the intended diversion route, it offered a diversion option should a subsequent emergency require an immediate diversion.
• The final decision to divert to Melbourne could be delayed until an equal time point between Melbourne and Adelaide.
• The flight crew’s stated belief that the emergency was controlled, which formed the basis for not using Alice Springs.

From an inflight procedural perspective, the diversion following an engine failure required consideration of a number of criteria:

• The flight was ETOPS, but the operator advised that ETOPS policy and procedure did not apply, as the aircraft had not yet entered an ETOPS segment.
• The OMA required response to an engine failure during normal (non-ETOPS) operations was to divert to the nearest suitable aerodrome. The criteria for a suitable aerodrome included a minimum RFFS of CAT 7.
• The OMA required response to a LAND ASAP ECAM message, which was part of the ETOPS procedural section, was to land at the nearest ETOPS suitable aerodrome. The ETOPS suitable aerodrome criteria required a minimum RFFS of CAT 4.
• Alice Springs, which was nominated in the operational flight plan (OFP) as an en route alternate, had no RFFS capability during the required period of use, but the operator stated that it meet the adequate aerodrome requirements through municipal fire services that were located off-aerodrome.
• Adelaide, which was not nominated as an en route alternate but was listed as a company preferred alternate, had RFFS CAT 5 with the capacity to be CAT 9 with one hour’s notice. Adelaide also had a curfew operating during the flight, but an in-flight emergency was sufficient to override those curfew restrictions.
• At the time of the engine failure, the aircraft was within the 60‑minute zone from a company approved adequate en route aerodrome—Alice Springs—and had not entered and ETOPS segment.
• OMA stated criteria for determination of whether an aerodrome was suitable for diversion did not include commercial criteria such as availability of maintenance.
• The Airbus FCOM definition for an amber LAND ASAP included that the flight crew consider landing at the nearest suitable aerodrome.
• At no point during the diversion did the aircraft exit the 60-minute zone from a company approved alternate.

‘ETOPS’/‘Flight’ policy and procedures

The OMA ETOPS policies and procedures section contained statements indicating they applied to the diversion:

The section commenced with a statement that the ETOPS section applied over and above standard operations policy when operating on specified ETOPS routes. The aircraft was operating on an ETOPS route that was authorised by the Malaysian regulator.

The ETOPS definition section stated that ETOPS operations apply to all twin-engine aircraft over a route that contains a point further than 60 minutes flying time from an adequate airport. The aircraft was flying on a route that met this description.

Further, the structure of the ETOPS section—in that it contained policies and procedures that specifically required certain preflight checks, immediate actions post departure, and actions before entry into an ETOPS segment—indicated that these policies and procedures were applicable outside of the ETOPS segment. The ETOPS section contained a requirement to divert to the nearest suitable airport when a LAND ASAP message was displayed. The ETOPS section contained specific criteria for this type of airport. Those criteria included a minimum RFFS of CAT 4. Therefore, under these policies and procedures, the available diversion airports were Alice Springs, Adelaide and Melbourne.

The operator stated that the OMA ETOPS policies and procedures did not apply for the diversion, as the aircraft had not entered an ETOPS segment. Therefore, policies and procedures contained within the OMA ‘Flight procedures’ section applied. Those policies and procedures specifically required diversion to the nearest suitable aerodrome following an engine failure. An engine failure will result in a LAND ASAP message if the engine is not restarted. The criteria for a suitable aerodrome was determined by the ‘Flight planning’ section, which stipulated a minimum RFFS of CAT 7. The operator stated that this could be reduced to CAT 6 on authorisation of the Flight Operations Director. This was the case with Alice Springs. Therefore, under these policies and procedures, the available diversion airports were Alice Springs and Melbourne.

The flight crew stated that the ‘Flight procedures’ minimum RFFS requirement of CAT 7 was the basis of the decision to not use Adelaide. The effect was to limit the airports available for a diversion. That is, a variation in required RFFS CAT for an en route alternate airport available to be used for diversion was based on whether or not the aircraft had passed a specific point in the flight plan—a point that had only a marginal relationship to the actual flight conditions. If an emergency condition enables the flight crew to use an aerodrome with a lower RFFS CAT after passing this point, there is no reason the same RFFS CAT cannot be used before passing that point. The difference is not based in safety.

The safety aspect of the diversion to Melbourne

Both the normal and the ETOPS procedures in the OMA required a diversion to the nearest suitable aerodrome following an engine failure. The captain stated that the decision to bypass Adelaide for Melbourne was based on Adelaide not having the required RFFS, but there was also a commercial advantage cited. Alice Springs was not considered as the emergency was controlled.

Regarding the controlled emergency, shortly after the engine failed the flight crew attempted a restart. That restart failed. The aircraft was then limited to operating on a single engine. While it is argued that ETOPS did not apply in this instance, the development of ETOPS is instructive in considering the safety effect of the loss of an engine on twin turbine-engine aircraft. The increased and increasing reliability of turbine engines has resulted in the capacity of this aircraft type to fly further from an en route airport that is available for use in the event of an engine failure—that is the increasing ETOPS range of these aircraft. The basis for certifying this increasing ETOPS range is the likelihood of a catastrophic result from engine failure—that is the likelihood of a double engine failure. The statistical probability of a double engine failure is materially less than the probability assigned to a catastrophic accident. The point to note, however, is that following an engine failure, the risk to the aircraft is the statistical likelihood of the remaining engine failing. This is an elevated risk in comparison to normal operations. While certification identifies that single engine operations can be achieved out to the limit of the ETOPS range, safety would indicate that the earliest landing is the safest option. As stated in the operator’s OMA, in all cases involving an engine failure the requirement is to land at the nearest suitable airport. Other risk factors can affect this decision; however, commercial considerations are not included.

The nearest suitable airport at the time of the engine failure was Alice Springs. The operator’s internal investigation stated that the diversion did not meet the policy and procedures requirement to divert to the nearest suitable alternate. Communications records and flight crew statement indicate that the flight crew intended to divert to Melbourne from the initiation of the diversion. Alice Springs was available and it nominated in the OFP as an en route alternate airport. Adelaide was a company preferred alternate, and while it was subject to curfew restrictions and RFFS limitations these were not an impediment to its use as a diversion airport. In conclusion, the diversion to Melbourne resulted in an increase in the time that the flight was exposed to the higher risk environment of single engine operations.

Findings

From the evidence available, the following findings are made with respect to the engine failure and diversion of an Airbus A330, registered 9M-XXD that occurred 445 km south-east of Alice Springs, South Australia on 16 August 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• In response to an engine oil low pressure (ENG OIL LO PR) ECAM, resulting from a fractured shaft within the oil pressure pump, the flight crew continued to monitor the engine parameters instead of shutting the engine down. Due to a mistaken understanding that the alert was a false indication, the flight crew subsequently increased thrust.
• The Airbus A330 engine oil low pressure (ENG OIL LO PR) abnormal procedure included the conditional instruction 'if the condition persists'. This may be interpreted as either requiring the flight crew wait a certain period of time to determine the continuation of the condition, as apparently interpreted by the flight crew, or, as intended by Airbus, that the condition has not changed as a result of the previous procedural step.
• Contrary to operating procedures, the flight crew made two attempts to relight the failed engine.
• The crew diverted to Melbourne instead of the nearest suitable aerodrome. This increased the time that the flight was exposed to the higher risk environment of single engine operations.

Safety actions

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Training and guidance

As part of a flight safety notice to flight crew, the operator, AirAsia X, emphasised the general rule regarding restarts following an engine failure. The rule, contained within Operations Manual, stated that a failed engine should not be restarted when the cause of that failure is unknown or there is insufficient information to determine the cause. That flight safety notice also reiterated the requirement to land at the nearest suitable airport when a LAND ASAP notification is displayed.

The operator also developed a training package to be presented at the flight crews’ annual base check classroom review. That package, based on the occurrence, was developed to identify lessons learnt from the oil pressure loss and subsequent engine failure, the engine restarts and the diversion decision making.

General details

Captain details

First officer details

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew
• AirAsia X
• Airbus Industrie
• Rolls-Royce
• Civil Aviation Safety Authority (CASA)
• Civil Aviation Authority Malaysia (CAAM)
• Airservices Australia
• Air Accident Investigation Bureau, Malaysia (AAIB MY)
• Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA)
• Air Accident Investigations Branch, United Kingdom (AAIB UK).

References

AeroSpace, A.S.D., 2013. Defence Industries Association of Europe. Simplified Technical English, Specification ASD-STE100, (6).

Airbus. 2007, ‘Compliance to Operational Procedures – Why do well trained and experienced pilots not always follow procedures?’, Safety First, Issue #05 December 2007, pp. 20-23.

Burian B.K., Barshi I., and Dismukes K., 2005, The challenge of aviation emergency and abnormal situations, NASA report (213462), Moffett Field.

Civil Aviation Safety Authority (CASA) 2014, SMS for Aviation—A Practical Guide, SMS 4 Safety assurance, 2nd Ed., CASA.

International Civil Aviation Organization (ICAO) 2016, Annex 6 Part I – International Commercial Air Transport - Aeroplane¸ 10th Ed, ICAO, Montreal.

International Civil Aviation Organization (ICAO) 2016, Annex 14 Aerodrome Design and Operations¸ 7th Ed, ICAO, Montreal.

International Civil Aviation Organization (ICAO) 2013, Annex 19 Safety Management¸ 1st Ed, ICAO, Montreal.

International Civil Aviation Organization (ICAO) 2013, Document 9859 Safety Management Manual¸ 3rd Ed, ICAO, Montreal.

International Civil Aviation Organization (ICAO) 2018, Document 9859 Safety Management Manual¸ 4th Ed (advanced unedited), ICAO, Montreal.

Li, Y. and Guldenmund, F.W., 2018. Safety management systems: A broad overview of the literature. Safety Science, 103, pp.94-123.

Orasanu, J., 2010, ‘Flight crew decision-making’, in Kani, B., Helmreich, R., Anca, J. (eds), Crew resource management, 2nd Ed, Academic Press, San Diego.

Reason J., 1990, Human error, Cambridge University Press, Cambridge.

Reason, J.T., Carthey, J. and De Leval, M.R., 2001. Diagnosing “vulnerable system syndrome”: an essential prerequisite to effective risk management. BMJ Quality & Safety, 10(suppl 2), pp.ii21-ii25.

Wickens and Hollands (2000). Engineering psychology and human performance. (3rd edn). New Jersey: Prentice-Hall.

Woods, D.D. and Patterson E.S., 2001, ‘How unexpected events produce an escalation of cognitive and coordinative demands’, in Hancock P.A. and Desmond P.A. (Eds), 2000, Stress, Workload and Fatigue, Lawrence Erlbaum Associates, Hillsdale, NJ.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, AirAsia X, Airbus, Rolls-Royce, CASA, CAAM, AAIB MY, AAIB UK, and BEA.

Submissions were received from AirAsia X, CAAM, AAIB MY, Rolls-Royce, Airbus, BEA and CASA. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix 1: Malaysian legislation and regulation

The principal legislation covering civil aviation in Malaysia is the Civil Aviation Act 1969 (Malaysia). The act established the position of the Director General of Civil Aviation Malaysia (DGCA)^[39] and enabled the Minister to make regulations for the purposes of carrying out the objects and purposes of the act, and for carrying out the Chicago Convention and its Annexes. That regulation is the Civil Aviation Regulations 2016 (Malaysia) (CARM). The act, regulations and other subordinate laws applied extraterritorially to Malaysian aircraft and flight crew. The act and regulations also enabled the DGCA to issue notices, circulars, directions or information as required.

The CARM required:

• an operator to submit an operations manual to the Director General for approval
• EDTO operations to be approved by the Director General, and for the Director General to establish the threshold time for an en route alternate.

The Aeronautical Information Circular (AIC) 09/2000 provided detail in the regulation of ETOPS, and which also applied to EDTO operations. The AIC included:

• a method for approving ETOPS, which referenced ICAO Annex 6
• a requirement that nominated adequate aerodromes be accepted by DCA
• that en route alternate aerodromes required for ETOPS be included within the operational and air traffic services flight plans.

DCA published a number of Directives during 2016. These directives contained rules, standards, requirements and procedures pertaining to air operations. The following directives, which came into effect on 15 April 2016, were applicable:

• Rules of the Air
• specific approvals (SPA).

The rules of the air applied extraterritorially for Malaysian aircraft, ‘to the extent that they do not conflict with the rules published by the State having jurisdiction over the territory overflown’. The rules contained the Annex 6 definition for an alternate aerodrome.

The SPA contained a number of requirements that reflected the content of AIC 09/2000. En route alternate aerodrome requirements were also listed in the SPA, and stated the following:

• An EDTO en route alternate aerodrome shall be considered adequate, if, at the expected time of use, the aerodrome is available and equipped with necessary ancillary services such as air traffic services (“ATS”), sufficient lighting, communications, weather reporting, navigation aids and emergency services and has at least one instrument approach procedure available.
• Prior to conducting an EDTO flight, the operator shall ensure that an EDTO en route alternate aerodrome is available, within either the operator’s approved EDTO, or a diversion time based on the MEL generated serviceability status of the aeroplane, whichever is shorter.
• The operator shall specify any required EDTO en route alternate aerodrome(s) in the operational flight plan and ATS flight plan.

DCA published two other directions on 12 September 2016. While coming into effect shortly after the occurrence, they contain information relevant to current EDTO requirements. These directions were:

• organisation requirements for air operations (ORO)
• commercial air transport (CAT).

The ORO required an operator to obtain a route qualification from DCA, which included that the route have sufficient aerodromes that are properly equipped for the operation. That requirement was expanded by the following:

The operator must ensure that relevant RFFS category must be met for applicable aircraft at the airport of operation. However certain countries adopted its own requirement especially for EDTO operation. Therefore, an operator may exercise its requirement whenever applicable if operating into their Flight Information Region (FIR).

Appendix 2: Extended range operations for two-engine turbine aircraft

Background

Prior to the 1980’s, regulation limited twin-engine aircraft to operations no more than 60 minutes range from an aerodrome. The introduction, in the 1980’s, of twin turbine engine aircraft capable of long-range operations resulted in the need to develop a method of extending this range limitation, while at the same time ensuring that an equivalent level of safety as that established by aircraft with more than two engines was attained. The result was a system of engine/airframe certification requirements, established engine reliability, and maintenance and operational procedures that created the necessary level of safety. The system was known as extended range operations, or ETOPS. From an ETOPS certification perspective, manufacturers were required to establish that the risk associated with the loss of both engines from independent causes met the required level of safety. From an operational procedural perspective, the risk associated with single engine operations was minimised through, among other things, the identification of, and procedural requirements attached to, the use of ETOPS specific en route alternate aerodromes. As a result of this system, twin turbine engine aircraft have progressively extended the time that they can operate from an en route alternate aerodrome, the diversion time, to more than 4 hours.

International standards for ETOPS

Standards applicable to ETOPS were contained in ICAO Annex 6 to the Chicago Convention, titled Part I – International Commercial Air Transport - Aeroplanes. The following requirements under these standards were applicable:

• The state of the operator was required to issue an air operator’s certificate (AOC) to an operator. That AOC was to include operations specifications. An ETOPS authorisation, threshold time and maximum diversion time limits were to be stated in those operations specifications.
• The operator was to submit an operations manual to the state of the operator for acceptance, and where required, approval. That operations manual was to:
  • detail the required content of the OFP
  • specify procedures for ETOPS, including engine failure procedures
  • nominate and determine the utilisation of diversion aerodromes
  • state the level of rescue and fire fighting services (RFFS) deemed acceptable for operations.
• An operator was to prepare an OFP for all intended flights. In preparing that OFP, the operator was to:
  • ascertain that all required ground facilities were adequate for the operation, including that the aerodromes specified in the OFP had adequate RFFS
  • identify and state in the OFP the en route alternate aerodromes required for ETOPS.

Annex 6 also contained guidance for assessing what level of RFFS was acceptable for the various operational uses of aerodromes. An Airbus A330 aircraft required a base level RFFS of CAT 9. The recommended RFFS category for an en route alternate aerodrome was two levels below that base level—therefore the A330 required RFFS CAT 7 for an en route alternate aerodrome. Annex 6 also recommend that an ETOPS alternate aerodrome should have a minimum of CAT 4.

Flight Crew Operating Manual (FCOM) guidance on ETOPS

The special operations section of the FCOM contained general guidance on ETOPS, as well as specific ETOPS diversion procedures and profiles. It identified that the system design and the engine reliability met with applicable European Aviation Safety Agency (EASA) guidelines, as set forth in AMC 20-6 rev. 2 (EASA).

With respect to diversion decision making, AMC 20-6 contained the following guidance:

Factors to be considered when deciding upon the appropriate course of action and suitability of an aerodrome for diversion may include but are not limited to:

a. Aircraft configuration/weight/systems status;

b. Wind and weather conditions en route at the diversion altitude;

c. Minimum altitudes en route to the diversion aerodrome;

d. Fuel required for the diversion;

e. Aerodrome condition, terrain, weather and wind;

f. Runways available and runway surface condition;

g. Approach aids and lighting;

h. RFFS* capability at the diversion aerodrome;

i. Facilities for aircraft occupants - disembarkation & shelter;

j. Medical facilities;

k. Pilot’s familiarity with the aerodrome;

l. Information about the aerodrome available to the flight crew.

Contingency procedures should not be interpreted in any way that prejudices the final authority and responsibility of the pilot-in-command for the safe operation of the aeroplane.

Note: for an ETOPS en-route alternate aerodrome, a published RFFS category equivalent to ICAO category 4, available at 30 minutes notice, is acceptable.

__________

39. The Civil Aviation Authority of Malaysia replaced the Department of Civil Aviation in 2018.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 9 August 2016, at about 1310 Eastern Standard Time (EST), a Cessna A188B aircraft, registered VH-BCT (BCT), taxied to depart from a private strip near Hay Airport, New South Wales to complete a run to spread fertiliser on the property. The pilot was the only person on board the aerial agriculture operation.

The pilot had already completed two spreading runs, for the field being treated, and on each occasion, the pilot took-off and banked the aircraft to the right, and then banked to the left to align with the field. During the third take-off, the pilot noticed a vehicle traveling along a road at the beginning of the spreading run for that field. The pilot climbed the aircraft to about 200 ft and commenced an orbit to allow the vehicle to move out of the way (Figure 1).

Figure 1: Map showing the location of the landing area, field to be treated and the aircraft flight path

Source: Google earth, modified by the ATSB

During the 30-degree turn to the left, the aircraft started an aerodynamic buffet.^[1] The pilot moved the engine controls to full power but did not notice a difference in engine noise or a change in the aircraft performance. At the same time, the pilot levelled the aircraft wings, lowered the nose to increase speed and as there was no change in the performance, they began jettisoning the load. Due to the load type, the pilot had to jettison the load slowly so as not to block the spreader. The pilot elected to return to the airstrip to check the operation of the engine and commenced a gentle turn to the left. The aircraft continued to buffet and the altitude continued to decrease, despite having full engine power selected and the load being jettisoned. The pilot continued to lower the nose of the aircraft and when it became evident that the aircraft was not going to make the strip, the pilot elected to land straight ahead. As the aircraft flew over a channel, the tail wheel clipped that channel, and the aircraft collided with the ground on the flat area between two channels. The landing gear and propeller detached as the aircraft continued forward and came to rest on the top of the opposite channel. As there was a lot of fuel leaking from the fuel tanks, the pilot quickly turned off the engine magnetos and the electrical master switch and exited the aircraft through the cockpit door. The pilot was uninjured and the aircraft was substantially damaged (Figure 2).

Figure 2: BCT at the accident site

Source: Aircraft owner

Pilot comment

The pilot indicated that the wind was steady throughout the day, 12 to 15 knots gusting to 20 and from a northerly direction.

The pilot commented that the engine was not performing how it had been on the previous 17 flights that day. They also reported that at about 200 ft, there was little time from when the problem was first noticed to when the aircraft landed. The pilot reported expecting an instant response when full power was applied, a change in engine noise, and the aircraft should have gained airspeed and continued flying like had happened on previous turns.

The pilot indicated that the aerodynamic buffet occurs frequently during the spreading of fertiliser and occurs well above an aerodynamic stall. It indicates that the aircraft is getting slow and to ease off the pressure on the control column and increase engine power. The pilot reported that the aircraft maintained an aerodynamic buffet all the way to the ground.

The pilot indicated that the aircraft’s seat restraint was a 4-point harness and that they had locked the inertia reel system for the flight and it had worked well. The pilot was wearing a helmet at the time of the accident.

The aircraft was refuelled the night before the accident at Hay Airport and again from fuel drums about 20 minutes flight time prior to the accident. The pilot completed fuel drains on the aircraft and the drum pump and did not notice any issues. The pilot checked the fuel from the drums after the accident and found no contamination. Another aircraft completed the spreading job the day of the accident and also used the fuel from the drums and had no issues.

Operator comment

The aircraft operator conducted an investigation and identified the following:

The pilot had completed 17 similar flights that day, prior to the accident flight.

During the turn, the pilot allowed the aircraft speed to diminish and they did not have the height to recover.

The aircraft was loaded with about 600 kg fertiliser and about 130 litres of fuel. The aircraft engine and propeller had been modified from a Continental IO-520 engine to a Continental IO‑550 engine with a three bladed constant speed propeller.

A licensed aircraft maintenance engineer inspected the engine and no reason was identified for an engine power loss. The engine magnetos and engine carburettor were tested separately and found to be operating normally. As such, the operator believed the engine was still producing full power at the time of the accident. The engine and propeller were extensively damaged by the accident sequence (Figure 3).

Figure 3: BCT damaged propeller^[2]

Source: Aircraft owner

The pilot had about 1,927 flight hours in the Cessna 188 conducting top dressing operations. In the last 12 months, the pilot had predominately flown an Air Tractor AT-502 turbo propeller aircraft and more recently had flown about 40 flight hours in the Cessna 188. Unlike the AT-502, there is very little difference between working power and full power in the Cessna 188. This may have resulted in the pilot having an over expectation of the aircraft performance especially when fitted with a spreader.

The aircraft was also fitted with vortex generators^[3] that allowed the aircraft to have a lower stall speed than the published stall speed. However, when the stall is reached there is considerable more speed required to resume normal flight and also more height loss to regain that speed at the working height of 150 to 250 ft. With the aircraft fully loaded, the pilot would not have enough height to regain enough speed to recover.

Another company pilot was also flying about 74 km south of the accident site, in a different aircraft type. They experienced down drafts, 20 knot winds, and a downgrade of performance in the downwind turns. With the increase of engine power, the effect of a downwind turn was negated.

Safety analysis

During a turn, the pilot allowed the speed to decrease and the aircraft started a buffet like an approaching aerodynamic stall. The pilot lowered the nose of the aircraft to increase the speed, levelled the wings, selected full engine power and started jettisoning the load. The pilot continued to lower the nose of the aircraft in in an attempted to regain control of the aircraft until it collided with the ground. With the vortex generators, the full load, and the minimal difference between working and full engine power, there was not enough height to recover the aircraft.

Although the pilot believed the aircraft engine was not performing as well as it had in previous flights there was no indications of this before the turn. No problems were identified with the engine after the accident, however, it had been extensively damaged during the accident sequence. The engine’s inability to counteract the effect of the buffeting during the turn (as the aircraft was fully loaded and minimal additional power was available above normal operating power), possibly also influenced by the pilot’s recent experience with a more powerful aircraft, may have influenced this belief.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During a turn, at a slow speed the aircraft started to buffet like approaching an aerodynamic stall. Due to the vortex generators, full load and insufficient engine power available, there was not enough height for the pilot to regain control of the aircraft before it collided with the ground.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Aircraft operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

The pilot has undergone refresher training on the effects of the wind on a downwind turn and flight training in windy conditions with reference to the airspeed and lighter aircraft weights.

Safety message

In this accident, the time available to manage the degradation of the aircraft performance meant that there were little options in regards to a landing area. The accident highlights the importance of taking positive action and maintaining aircraft control in both turning back to the strip or conducting a forced landing, while being aware of flare energy and aircraft stall speeds.

Aviation Short Investigations Bulletin - Issue 57

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Aerodynamic stall occurs when airflow separates from the wing’s upper surface and becomes turbulent and results in reduced lift. The stall is preceded by a mild, aerodynamic buffet, which increases in intensity as the stall is approached.
2. The damage to a propeller alone cannot accurately quantify the power produced by an engine. There are many inconsistencies in the way propellers bend and twist under impact loads. Some variables include terrain type and surface, angle and speed of the aircraft at impact (Manual of aircraft accident and incident investigation Part III — Investigation ICAO Doc 9756-AN/965, is available from the US Naval Safety Centre website).
3. Vortex generators re-energise the airflow over an aerofoil. They are usually placed where the airflow starts to lose laminar flow and becomes turbulent. The result is that airflow sticks to the wing better, permitting flight at lower airspeeds with improved control authority if installed and maintained correctly Civil Aviation Safety Authority (CASA) AWB 02-056 Issue 1 - Vortex Generators and Aerodynamic Configuration Control for Small Single and Twin Engined Aircraft, is available from the CASA website.

What happened

On 9 August 2016 at about 2020 Central Standard Time (CST), a Raytheon B200 aircraft, registered VH‑ZCJ (ZCJ), departed from Darwin Airport, Northern Territory (NT), to collect a patient from Tindal Airport, NT, for transfer to Darwin. On board the flight from Darwin were the pilot and one flight nurse.

As the flight approached Tindal Airport, the pilot checked the Tindal ATIS^[1] which stated that runway 14 was not available. There was no NOTAM^[2] to indicate that was the case, so the pilot contacted Brisbane Centre air traffic control (ATC) to confirm the status of Tindal Airport. Brisbane Centre ATC advised the pilot there was an earlier incident at Tindal that was now cleared and runway 14 would be available for their arrival. The aircraft landed on runway 14 with Tindal ATC still active, at about 2120, then back-tracked runway 14 and parked at the terminal for the patient collection.

The patient was loaded on board ZCJ at about 2250. At about 2300, the Tindal ATC tower closed and procedures for operating at non-controlled aerodromes then applied. The pilot taxied ZCJ for departure at 2309. They entered runway 14 from taxiway echo (Figure 1), lined up for departure ensuring they used the entire runway length available and applied power. At about 70 kt, the pilot performed their ‘cross check of airspeed indicators’. At this time there were no warning indications, so the pilot committed to continue the take-off.

At about 85–87 kt, the pilot felt the aircraft nose wheel strike something on the runway with an associated vibration through the rudder pedals. The pilot checked the airspeed, observed the aircraft was continuing to accelerate and there was no change in directional control, so they rotated the aircraft at the lift-off speed of 94 kt.

After departure, the pilot contacted the Tindal Airport emergency services and asked them to inspect the runway to check on the status of the aircraft arrestor cable (refer to Aircraft Arrestor System and Enroute Supplement Australia). The emergency services inspected the runway and advised the pilot that the arrestor cable was in the raised position, and that they would immediately report this to the Tindal Airport cable barrier crew for rectification.

The pilot continued the flight to Darwin and enroute contacted their company chief pilot to report the incident and discuss options for the management of the landing at Darwin. They also discussed the management of the patient in the event of a landing incident or accident. The chief pilot, in turn, contacted one of the company check and training captains, and notified Darwin ATC. On approach to Darwin, the pilot consulted the checklist for landing with an unsafe landing gear. When they extended the landing gear, there were no unsafe indications, so the pilot considered a blown tyre was the most credible risk for the landing.

The chief pilot then advised the pilot that Darwin ATC had activated their emergency response for the landing. They also suggested that the nurse look outside the cabin windows for any visual indications of damage. The nurse could not see any indications of damage. The pilot conducted their approach and landed at Darwin Airport without further incident. The aircraft was not damaged and there were no injuries.

Aircraft Arrestor System

The Tindal Airport aircraft arrestor system (AAS) is used to stop military jets that have a malfunction, which may otherwise cause them to overrun the runway. In this case, the jet will lower a hook at the rear of the aircraft to catch the cable. The AAS includes two cables, one positioned at either end of the runway and displaced from the respective threshold as displayed on the airport diagram of runway 14 (Figure 1).

Figure 1: Tindal airport apron diagram

Source: Airservices, annotated by ATSB

The AAS may be controlled by ATC from the Tindal ATC tower through each cable’s control console, or by the AAS barrier crew from the runway site control location. Each location control console feeds into the hook cable control module, which manages the cable position logic (Figure 2). When ATC is active the control of the system is with the Tindal ATC tower. When the tower closes, ATC select the AAS controller to ‘maintenance’, which switches the control to the runway site control location.

There are four pushbutton selection/indicator lights on the tower control consoles (Figure 2). They comprise two green UP and DOWN pushbuttons, an amber maintenance pushbutton and a red fail pushbutton. The maintenance pushbutton is used to pass AAS control between the tower and runway site control location.

When AAS control is passed to the runway site control, the amber maintenance pushbutton will illuminate to indicate the runway site have control of the AAS. The red fail pushbutton will also flash, and be accompanied by an audible clicking. This is a warning to the tower controllers that they do not have control of the AAS. The warning is cancelled by manually depressing the fail pushbutton. In maintenance control, the tower console UP and DOWN pushbuttons are indicator lights only, which will respond to cable position changes made at the runway location.

Figure 2: Tower control console cable pushbuttons

Source: Tindal Airport

The runway site control has a physical switch, which is selected to either the UP or DOWN position. When control of the cable is passed from the tower to the runway site control, the hook cable control module will command the cable into the position selected on the runway site control switch.

When an aircraft is arrested with the AAS, the barrier crew take control of the AAS from ATC until the aircraft is released and the inspection and servicing of the cable completed. On completion of the cable servicing, the barrier crew lower the cable using the site control switch before passing control of the AAS back to ATC.

On 9 August 2016, at about 2045 CST, the runway 14 AAS was used to stop a military jet. The barrier crew then entered the runway and performed the servicing and reset of the cable. This task required the control of the AAS to be passed from the tower to the runway site control. The servicing and reset also required the cable to be cycled between the UP and DOWN positions. On completion of the reset the barrier crew passed AAS control back to the tower with the runway site control switch selected in the UP position. This deviated from the barrier crew’s normal procedures, which required them to lower the cable into the DOWN position before passing control back to the tower.

Tindal ATC did not notice the discrepancy with the handover. They cycled the cable to check serviceability, then continued with normal cable operation for the remainder of ATC services. The cable was in the DOWN position for the arrival of ZCJ. When the Tindal ATC tower closed at 2300, the controller closing the tower performed the procedural steps, which included (1) ensuring the cable is set to DOWN on their control console, and (2) once confirmed DOWN, select AAS control to maintenance. The ATC procedural steps did not include checking the position of the cable after the maintenance selection.

There are no differences in the maintenance and fail pushbutton light indications if the cable changes position after control is passed to maintenance. However, the DOWN pushbutton green light would extinguish after about one second and the UP pushbutton green light would illuminate after about 10–15 seconds.

When the airport emergency services inspected the cable at 2320 they found the cable raised and contacted the barrier crew supervisor. The supervisor inspected the runway site control location and found the switch selected to the UP position.

Enroute Supplement Australia

The Enroute Supplement Australia entry for Tindal airport includes the following information:

Physical characteristics: Recessed bi-directional hookcables installed 1,266 ft from threshold runway 14 and 1,515 ft from threshold runway 32… Distance between cables 6,214 ft… No arrestable aircraft operations or outside tower hours – both ends down. No crossing restrictions in down position... In the event of power failure, cables will rise to a height of 10 cm until [power] restored – recommended that aircraft not approved to trample hookcables confine operations to between cables during CTAF.

Enroute Supplement Australia introduction paragraph 22.2 b. states:

Pilots should refer to the Pilot Operating Handbook of Flight Manual for specific restrictions for each aircraft. In the absence of any reference to trampling in either the Handbook or Manual, trampling is not authorised.

Company procedures for Aircraft Arrestor System

The pilot was unaware of any previous incident or discussion within the company regarding the AAS at Tindal Airport. There is no reference to trampling hook cables in their B200 flight manual and therefore no trample speed approved for the aircraft. The company did not have a procedure in place to require their pilots to avoid the runway length which incorporates the AAS when non-controlled aerodrome procedures apply.

ATSB comment

The ATSB notes that although there was sufficient runway for the pilot to stop the aircraft after trampling the cable, they were already passed their ’airspeed indicator cross check’. After this point, the pilot was mentally committed to continue the take-off and only to abort the take-off for a cockpit warning light.

It is likely that when the Tindal Airport tower closed and passed AAS control to maintenance, the runway 14 threshold AAS cable raised into the UP position in response to the existing site control switch selection, and this was not detected by ATC during the tower closing procedure.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Airport operator

As a result of this occurrence, the airport operator has advised the ATSB that they are taking the following safety actions:

Training

The training for barrier crew is to be reviewed to ensure the runway switch is set to DOWN during hand-over procedures. A maintenance assurance inspection is to be investigated for the purpose of verification of switch position within the hand-over procedure.

ATC training is to be reviewed to ensure indication of DOWN position after hook cable is switched to maintenance position.

Aircraft operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

Operations notice

The company has issued an operations notice to their flight crew to advise them of the incident and instruct them that if the pilot in command cannot be assured of the cable status, to taxi past the cable prior to take-off, or land long to avoid it on arrival.

Training

The company’s pilot training syllabus relating to potential hazards associated with operating at military aerodromes was updated to include arrestor cables.

Safety message

While the outcome of this incident was benign, the actions of the pilot demonstrated how crew resource management skills can be employed to engage assistance from outside the aircraft to effectively manage an unexpected risk. Their decision to contact Tindal Airport emergency services mitigated a potential risk to other operators before the tower re-opened.

Aviation Short Investigations Bulletin - Issue 54

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. An automated pre-recorded transmission indicating the prevailing weather conditions at the aerodrome and other relevant operationsl information for arriving and departing aircraft.
2. A Notice To Airmen advises personnel concerned with flight operations of information concerning the establishment, condition or change in any aeronautical facility, service, procedure, or hazard, the timely knowledge of which is essential to safe flight.

What happened

On 9 August 2016, at about 0930 Western Standard Time (WST), a Cessna 210N aircraft, registered VH-NLV (NLV), departed Kununurra Airport for a scenic charter flight to Mitchell Plateau aircraft landing area (ALA), Western Australia (WA), with a pilot and five passengers on board.

Shortly before 1100, after completing orbits overhead Mitchell Falls, about 9 NM south-west of Mitchell Plateau ALA, the pilot of NLV positioned the aircraft to track for a straight-in approach to runway 06 at Mitchell Plateau ALA (Figure 1).

Figure 1: Mitchell Plateau ALA showing approximate aircraft tracks

Source: Google earth – annotated by ATSB

At that time, the pilot of a Gippsland Aeronautics GA-8 aircraft, registered VH-BFL (BFL), prepared to taxi at Mitchell Plateau ALA, for a scenic charter flight to Kalumburu, WA, with four passengers on board. Prior to taxiing, the pilot of BFL selected a company frequency on the aircraft’s radio and communicated with the pilot of another aircraft. After that communication, the pilot pressed the radio’s frequency select button in an attempt to switch to the North Kimberley common traffic advisory frequency (CTAF). However, the pilot did not detect at that time that the CTAF had not been selected and the radio remained tuned to the company frequency. 

When about 5 NM from the ALA, the pilot of NLV broadcast on the CTAF, advising they were on a 5-mile final for runway 06 at Mitchell Plateau, and did not receive a response. When about 3 NM from the runway, the pilot of NLV sighted an aircraft (BFL) on the parking bay at the ALA, with the beacon on, indicating that the aircraft’s engine was running.

The pilot of BFL reported that they broadcast a taxi call and a call advising that BFL was entering runway 16/34 to taxi to runway 06, and subsequently broadcast prior to entering runway 06 to backtrack to the runway threshold. The pilot inadvertently made those broadcasts company frequency instead of CTAF and did not receive any response.

When at about 1 NM on final approach to runway 06, the pilot of NLV broadcast again on the CTAF and did not receive a response. From the aircraft’s position, the parking bay and adjacent taxiway were obscured by a line of trees, and the pilot was unable to see BFL.

As the pilot of NLV flared the aircraft for landing, they sighted BFL turn left and taxi onto runway 06. The pilot of NLV assessed that if they conducted a go-around the aircraft may be unable to climb fast enough to avoid the aircraft on the runway and could not diverge from the runway direction due to the trees beside the runway, therefore the pilot elected to land. After landing, the pilot of NLV braked more heavily than normal and moved to the left of the runway to increase the separation between the two aircraft.

As BFL entered runway 06 to backtrack, the pilot sighted NLV in the landing roll and also moved to their left. The pilots assessed that the aircraft passed within 2 m of each other at taxi speed and neither aircraft moved outside the runway strip. The aircraft were not damaged, and no injuries were sustained.

Pilot comments

Pilot of VH-NLV

The pilot of NLV commented that during the flare, they considered conducting a go-around, but assessed that due to the high outside temperature, the aircraft may not have adequate climb performance to pass at a safe height above BFL.

Pilot of VH-BFL

The pilot of BFL had been in the airport terminal for about 2 hours before the incident. They commented that as the CTAF covered a large area, normally they would have very good awareness of other aircraft operating there. As they had not been listening to the radio during the time in the terminal, they were not aware of NLV. The pilot recalled looking for aircraft as they taxied onto runway 06, but did not see NLV.

The pilot also commented that due to a delay on the ground, they were keen to get away, and that may have contributed to not noticing that the radio was still on the company frequency.  

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Operator of VH-BFL

As a result of this occurrence, the operator of BFL has advised the ATSB that they are taking the following safety actions:

Flight crew briefing

The operator is proposing the following briefing for new flight crew regarding radio procedures:

• mentally confirm the required frequency
• visually confirm the required frequency is set as active, and the correct COM is selected on the audio panel
• aurally check by activating the squelch.

In addition, company pilots will be reminded to be mindful of the impact that stress (such as that due to delays) can have on their performance, to recognise the signs and symptoms of stress, and to return to the basics of good airmanship if/when they find themselves under stress and pressure.

Safety message

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns is safety around non-towered aerodromes.

Pilots are encouraged to prioritise their attention carefully and appropriately as they near non-towered aerodromes. An effective lookout for other aircraft, supported by communication with traffic in the vicinity, should be a high priority.

The ATSB report Limitations of the See-and-Avoid Principle outlines the major factors that limit the effectiveness of un-alerted see-and-avoid. Insufficient communication between pilots operating in the same area is the most common cause of safety incidents near non-controlled aerodromes.

Most occurrences reported to the ATSB at non-towered aerodromes involve conflicts between aircraft, or between aircraft and ground vehicles. In particular, active runways should be approached with caution. The ATSB publication A pilot’s guide to staying safe in the vicinity of non-towered aerodromes, stated that a large number of the conflicts between aircraft involved:

• ineffective communication between pilots operating in close proximity
• the incorrect assessment of other aircraft’s positions and intentions
• relying on the radio as a substitute for an effective visual lookout
• failure to follow published procedures.

Aviation Short Investigations Bulletin - Issue 53

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 23 May 2016 at about 0600 Western Standard Time (WST), a team of ground and flight crew met to discuss the day’s operations to move a drill rig and associated platform and equipment by helicopter to a new location at Lake Disappointment, Western Australia (Figure 1). The rig had been operating on a salt lake and the move involved two helicopters – an Aerospatiale Industries AS350 helicopter, registered VH-BII (BII), to move the rig and heavier equipment, and a smaller helicopter (Robinson R44) to move the smaller, lighter equipment and personnel.

Figure 1: Drilling rig on Lake Disappointment

Source: Ground crew operator

The pilot of BII suggested that the ground crew use tag lines for the operation. These would enable the ground crew to manoeuvre the loads as necessary while the load was off the ground slung under the helicopter. For tag lines, the pilot provided the ground crew with slings – 6 m loops (Figure 2), which they were to attach to the loads that were already encased in other slings ready for moving.

The ground team for the removal of the equipment, consisted of a load master and a driller’s offsider. The driller’s offsider involved in the operation was new to the role. For the operation, the offisider’s role included ground support and to sling equipment under the guidance of the load master. The load master was to guide the helicopter using hand signals and a two-way radio to communicate with the helicopter pilot.

Figure 2: Loop slings

Source: Operator of VH-BII

At about 0700, the pilot of BII commenced sling operations. The pilot worked with the ground crew to move three mats (weighing 550 kg each) and a power pack (770 kg) to a new site, before returning to move the rig (about 700 kg). The pilot positioned the helicopter into wind. The load master and offsider attached the rig to the hook under the helicopter using the slings around the load and four attachment points. They attached two tag lines to the load on separate corners. At about 1040, in readiness to lift the rig, the load master advised the pilot using hand signals that the load was attached and that they were clear and ready for the lift.

The pilot commenced lifting the rig. The helicopter climbed and the rig lifted a few centimetres above the ground. The load swivelled as it lifted off the ground, and pushed against a PVC pipe protruding from a bore hole. The load master and offsider stepped in closer to guide the rig. The load master pushed the rig while the offsider pulled on the tag line to manoeuvre the rig clear of the pipe.

The pilot looked down through a window in the floor of the helicopter beside the seat and observed the ground crew then step away from the rig. The pilot then shifted their attention inside the cockpit to the instruments to monitor power settings and continued with the lift.

As they^[1] stepped back, the offsider had inadvertently stepped into the loop of the tag line. As the helicopter lifted the rig, the tag line went taught, and the offsider’s leg was ensnared in the loop. The offsider was lifted off the ground by the leg and the helicopter began lifting the load. The load master radioed the pilot, and advised that the offsider was hanging in the loop.

By the time the pilot became aware that the offsider was caught in the loop, the helicopter was about 50–60 ft above the salt lake. The pilot turned the helicopter around to return to the pad and encountered a tailwind of 8–10 kt. The helicopter overflew mud flats and the pilot descended as low as they felt was safe, which was about 15–20 ft above the ground. The pilot also slowed the helicopter as much as possible given the load and the tailwind, to a groundspeed of about 25 kt.

The offsider then freed their leg and was about to jump off from about 2 m above the ground, but reported that the helicopter then started to climb and accelerate. Now only holding on by their hands, the offsider was concerned that they would not be able to hold on much longer if the helicopter sped up, and that they risked injury from falling further as the helicopter climbed. The offsider therefore released the tag line and dropped into the mud below. The offsider estimated they were about 10 m above the ground when they let go.

The load master ran to assist the offsider. The pilot saw the offsider land in the mud and flew the helicopter to an island nearby and put the rig down. The pilot of the R44 helicopter working on the site picked up the offsider, who was then taken for medical assessment. The offsider sustained a serious injury.

Pilot comments

The pilot later commented that, having become aware that the offsider was ensnared, they had no intention of putting the rig down while the offsider was hanging underneath. The pilot intended to turn the helicopter back around into wind to slow the helicopter sufficiently for the offisider to release themselves back onto the ground, at the pad where they had lifted off.

The ground crew had cautioned each other to be careful of the loop. But with the noise and downwash of the helicopter, watching the rig taking off, and the tag line hanging 4-5 m after the load, the offsider was ensnared.

In future, if a ground crewmember became trapped in a line, the pilot would remain in radio contact with the load master and would not put the load down. They would return as quickly as possible to the site so the load master could assist with the safe release of the offsider.

Driller’s offsider comments

The offsider commented that once they were slung under the helicopter there was no way they could communicate with the pilot or the load master. The offsider did not have a radio. The helicopter was then about 100 m from the pad and too far away to be able to hear or communicate with the load master. Although there was a small window in the floor of the helicopter, the pilot would not have been able to see the offsider hanging as they were below the rig.

The offsider further commented that it was important for the load master, or person in radio communication with the pilot, to ensure all ground personnel were a safe distance from the helicopter before giving the pilot the all clear to lift.

The offsider also commented that use of a sling as a tag line carries increased risk of ensarement. A single or unlooped line would be less hazardous.

Ground crew operations company report

The ground crew operations company conducted an investigation into the incident and identified three contributing factors:

Tag lines to loads were introduced without an associated risk assessment.

The offsider was a new employee and was not fully aware of the hazards.

The load shifted in an unexpected direction, resulting in the ground crew moving back in towards the rig after the load master had given the all clear.

Helicopter operator report

The helicopter operator conducted an investigation into the incident and included the following conclusions:

• The pilot was appropriately qualified, current and proficient.
• The format of the ground crew briefing did not, nor was it required to, include an entanglement response in emergency procedures.
• Tag lines were new equipment on the project and were introduced without a formal risk assessment. There were no formal procedures for the use of tag lines and the risk of entanglement was not identified at the time. The 6 metre loops usually used for lifting loads were not standard tag lines.
• Some improvements could be made with better communication between pilot and ground crew which may require additional training or practice. This may have been a factor in this incident.
• The pilot met the procedural take-off requirement visually ensuring they were clear of the load before lifting started, however, procedures do not identify risk aspects of multiple ground crew operations nor do they take into account the high workload of the pilot at time of lift.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Ground crew operations

As a result of this occurrence, the ground crew operations company has advised the ATSB that they have taken the following safety actions:

• people carrying out slinging operations are to use more appropriate tag lines – 16 mm single strand synthetic rope^[2]
• ground crew to undergo Dogging^[3] training
• helicopter pilot to visually confirm the load is not entangled prior to moving off
• job hazard analysis to incorporate the use of tag lines
• safe working procedures to take into account visual confirmation that the load is clear
• promotion of ‘take 5 culture’^[4] to address hazards as they are identified
• platform scales to weigh rig items have been provided, sling line certification has been conducted and routine condition inspections have been conducted
• UHF radios have been installed.

Helicopter operator

As a result of this occurrence, the operator of BII has advised the ATSB that they have taken the following safety actions:

• Enhanced briefing implemented for client ground crew which includes potential of entanglement and preventative measures as well as roles when there are more than one ground crew member.
• A risk profile has been completed for tag line use.
• Clients are provided with a personal protective equipment list for their personnel involved with ground operations.

Safety message

This incident highlights the importance of conducting a thorough risk analysis prior to commencing operations. The risk assessment should clearly identify hazards and introduce measures that mitigate any associated risks. In addition, it is important to consider possible emergency scenarios and develop procedures to follow in the event of an abnormal situation developing.

Appropriate training is essential for personnel working in complex operations. In addition to individual roles and skills, training should include how team members work together to maintain and improve safety. Part of working together safely involves effective communication and a mutual understanding of phrases and signals.

Aviation Short Investigations Bulletin - Issue 54

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Gender-free plural pronouns are used throughout the report to refer to an individual (i.e. they, them and their).
2. The helicopter operator commented that the lines are to be weighed and assessed to ensure they do not create an entanglement hazard in flight to the tail or main rotor.
3. Use and care of slings and strapping gear, and load movement and crane operations.
4. Take 5 culture increases safety awareness by encouraging workers to 5 minutes to assess hazards and implement risk control actions.