On 26 August 2017, at about 1100 Western Standard Time,[1] the crew of a Sikorsky S-92A helicopter, registered VH-IPE, were undertaking a winching exercise to a vessel offshore, near Broome, Western Australia. During the exercise, a fracture of the hi-line weak-link resulted in a near contact of the winch hook with the helicopter main rotor. There were no injuries and the helicopter was not damaged.
There were two flight crew, two aircrewman and one rescue crewman on board the helicopter and one rescue crewman on the vessel at the time of the serious incident. The flight crew were employees of Helicopters New Zealand (HNZ - Australia) and the technical crew[2] were employees of Careflight Australia.[3] The flight was a standardisation check flight for one of the aircrewman in his role of winch operator. The other aircrewman was the instructor conducting the assessment. At the time of the incident the operator was in the training and development phase prior to the commencement of a contracted search and rescue service.
The crew conducted a flight brief before departing Broome at about 1030 to rendezvous with a vessel for their deck winching evolutions.[4] The brief included plans for dealing with major and minor helicopter malfunctions while winching, and concluded with an overall risk assessment score of low, which was calculated in accordance with the operator’s risk scoring system.
After they rendezvoused with the vessel, the crew set up for the first evolution, which was planned to be a stretcher winch using the hi-line (refer to section titled Role equipment).[5] On the first winch, one rescue crewman, with the hi-line bag, was transferred to the vessel with the instructor acting as winch operator for his own currency. As soon as the winch operator received the signal from the rescue crewman that he was safely on deck and disconnected from the winch hook, the winch operator called to the pilot flying (captain in the right seat) that the helicopter was clear to move back to the rest position.[6]
The helicopter started to move left, away from the transfer point. At the same time, the winch operator was slowly winching in and monitoring the line, which was paying out[7] from the hi-line bag. When the helicopter was just clear of the deck, but still moving to the left, with about 30 ft (9 m) of winch cable still extended, a restriction of the line inside the hi-line bag occurred. The hi‑line bag flicked up from the deck around the rescue crewman’s waist and applied additional tension to the weak-link (the weak-link connected the line to the winch hook – refer to section titled Role equipment).[8]
The weak-link immediately fractured and the release of the additional tension sent the winch hook on a near vertical trajectory towards the helicopter’s main rotor disc. The winch cable snatched out of the winch operator’s hand and the hook reached its apogee[9] at about the height of the winch[10] before falling down (Figure 1).
Figure 1: Winch hook near apogee
Source: Winch operator, modified by the ATSB
The pilot flying observed the hook appear at about the height of the winch before the winch operator had time to warn the rest of the crew.[11] After the winch operator regained control of the cable the helicopter returned to the rest position. The winch operator was then able to inspect the cable and debrief the crew about the incident. On retrieval of the hook, the winch operator noted the weak-link had separated at the line end (Figure 2).
Figure 2: Weak-link point of separation
Source: Winch operator, modified by the ATSB
The crew completed an incident debrief clear of the vessel and elected to complete the flight with open water winching and discontinue further use of the hi-line.[12] The flight was completed and the helicopter returned to Broome without further incident.
Post-incident management response
On completion of the flight, the captain submitted an incident report and Careflight’s chief aircrewman directed their personnel to remove the Priority 1 weak-link (refer to section titled Role equipment) from the operation. On 28 August, the operator’s head of flight operations directed a temporary halt to winch training pending an initial investigation and notified the Civil Aviation Safety Authority (CASA) of that decision. On that same day, Careflight removed the Priority 1 weak-link from their other operations.
On 6 September, the operator’s head of training and checking issued a training instruction to prohibit use of the hi-line and weak-link in winch training evolutions until the investigation could develop recommendations. That same day, the head of flight operations notified CASA of the decision to resume winch training in a limited form on 7 September. That limited form was for winch evolutions that did not require the use of hi-line equipment and would continue until such time that the main recommendations from the final investigation were implemented.
Operator’s procedures
The operator’s search and rescue operations manual, issue 1.1, was published on 25 July 2017. The transfer of the rescue crewman with hi-line to the vessel on the incident flight was in accordance with the operator’s procedure 7.7.4: Insertion/Extraction – Vessel Winching. The manual also included crew duties, responsibilities and qualifications.
Crew training and qualifications
The flight crew held the appropriate CASA type ratings for SK92 (S-92A) and low level ratings for helicopters and winching. The aircrewman instructor held a CASA approval to conduct training for helicopter winching for the operator in the S-92A in accordance with their procedures. The rescue crewman on the vessel was trained in accordance with the operator’s requirements. This included deck winching with hi-line on 15 August 2017, followed by a line-check for the operator on 17 August 2017, which included an unattended stretcher winch from a vessel.[13]
Role equipment
The hi-line is a device used to assist in managing the helicopter’s winch hook to a specific area when the helicopter is unable to either position, or remain in position, directly over the transfer point. It is also used as an anti-spin/anti-swing device by a person on the deck of the vessel when a stretcher is winched down from, or up to, the helicopter.
The hi-line equipment comprised of a hi-line bag, a 300 ft x 15/64 inch (91 m x 6 mm) line (rope) inserted in the bag and a break-away weak-link, which connected the line to the winch hook. The weak-link consisted of a plastic buckle and webbing with plastic D-rings at each end. One end was connected to the line, and the other end was connected to a carabiner, which was connected to the winch hook (Figure 3 left). The incident weak-link had an advertised breaking strength of about 90 pound force (400 N). Figure 3 right depicts the fracture of the weak-link that occurred at the line end.
Figure 3: Hi-line with weak-link and carabiner (left) and fractured weak-link (right)
Source: Operator, modified by the ATSB
The weak-link was manufactured by Priority 1 Air Rescue. They provided training and role equipment for helicopter search and rescue services internationally. The role of the weak link was to break in the event of line entanglement. The low breaking tension on the incident weak-link was a design feature to allow personnel tending the hi-line to break it in an emergency.
The hi-line bag was manufactured by Lifesaving Systems Corporation and could be purchased on its own or with a 75 ft x 3/8 inch (23 m x 9 mm) safety line inserted for use as a water rescue throwline. The bag was provided to the operator by All Elements Protection, the Australian representative for Lifesaving Systems Corporation, to fulfil the need for a netted design to allow water to drain out. A 300 ft (91 m) line was inserted by the operator for the hi-line role. The S‑92A main rotor diameter is about 57 ft (17 m). A rest position of about two rotor diameters at 60 ft hover height would therefore require a minimum of 129 ft (39 m) of line. The operator assessed the bag as fit‑for‑purpose, but also recognised the preference for a larger bag with a wider throat (opening). Therefore, the bag was approved as an interim solution until new alternative hi-line bags arrived.
Following the incident, the instructor commented that he had reservations about the narrow throat on the bag and that internal clumps of rope could result in a restriction. The rescue crewman reported to the operator that it would have been easier to manage the hi-line bag if it had a larger throat, or was a larger bag, or had a shorter line inserted.
Previous incidents
The operator’s internal investigation found they had experienced a fracture of a Priority 1 weak‑link buckle about 2 weeks prior to the incident flight. This was considered to be due to mishandling and not related to a hi-line evolution. Another operator using the Priority 1 weak-link was contacted by the incident operator and they reported two previous incidents of weak-link fracture. They determined that these were likely the result of crew kneeling on the buckle. After directing their crew to avoid that practice they had not experienced any further fractures.
Management of change
The operator had an integrated management system in place prior to the incident. This comprised of their safety and quality management systems and included a ‘management of change’ process.[14] The management of change process was used for the introduction of the search and rescue contracted capability, but did not capture risk assessments of the role equipment.
Safety analysis
Fracture of the weak-link
During the first winch evolution of the flight, the rescue crewman was transferred to the deck of the vessel with the hi-line attached. Once on the deck, the rescue crewman disconnected himself from the winch hook and prepared to pay-out the line as the winch was recovered. As the rescue crewman payed-out the line from the hi-line bag, the helicopter was moving slowly away from the transfer point to the rest position, about two rotor diameters from the vessel. At the same time, the winch operator was slowly retrieving the winch hook while monitoring the rescue crewman’s management of the hi-line.
When a restriction of the line inside the hi-line bag occurred, the weak-link was immediately placed under increased tension due to the relative motion of the helicopter and winch cable with respect to the vessel. The tension was sufficient to fracture the weak-link at the line end. The release of the downward tension when the weak-link fractured sent the winch hook on a trajectory towards the helicopter’s main rotor disc. The ATSB could not determine if the weak-link fractured at the advertised breaking force, but a notable amount of tension was required to be released to send the winch hook on its trajectory.
Management of change
The helicopter operator was in the training and development stage for their S-92A search and rescue contract, based at Broome. In preparation for the delivery of search and rescue services, they procured search and rescue role equipment from various manufacturers through a third-party agent in Australia. In accordance with their integrated management system, they completed a management of change process for the introduction of the search and rescue capability. However, their management of change did not capture risk assessments for their search and rescue role equipment.
The operator inserted a 300 ft line into a hi-line bag that was advertised as either a stand-alone item, or fitted with a 75 ft line. In addition, the hi-line bag was a sausage shaped bag with a narrow throat relative to the amount of line inserted. Therefore, when assembled, the hi-line equipment presented an increased risk for restrictions during a hi-line evolution and the equipment was no longer fit-for-purpose.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
During the winching evolution with the vessel, the hi-line became restricted inside the hi-line bag, which, combined with the motion of the winch hook relative to the vessel, resulted in sufficient tension on the weak-link to fracture it and send the winch hook on a trajectory towards the helicopter’s main rotor disc.
The operator's management of change for the introduction of the search and rescue contract capability did not capture risk assessments for their role equipment, which resulted in the use of a small hi-line bag with a narrow throat relative to the length of line required for the task.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Operator
As a result of this occurrence, HNZ Australia has advised the ATSB that they are taking the following safety actions:
Management of change
They have removed the Priority 1 Air Rescue breakaway weak-link and hi-line bag from service, introduced new replacement equipment and initiated their management of change process for their search and rescue role equipment. The performance of the operator’s replacement weak-link will be monitored following the recommencement of hi-line winch evolutions.
Appointment of personnel
They have appointed an experienced search and rescue pilot into a new role of ‘SAR[15] Lead’. A technical crew manager for search and rescue has also been appointed within HNZ Australia. This person is responsible for technical crew procedures, oversight and standardisation, and complement the work of the ‘SAR Lead’.
Review of documentation and procedures
Two reviews of operator documentation and procedures were commenced. One was an internal review and the other a contracted external review. The results of the reviews have been presented to the operator’s head of flight operations for consideration with a range of recommendations accepted and implemented.
Safety message
This serious incident highlighted the importance of change management processes and the unexpected nature of risk. The items of equipment, which comprised the hi-line (line, bag and weak-link) were individually fit-for-purpose, but when the hi-line was assembled it became susceptible to a restriction.
The International Civil Aviation Organization’s safety management manual (Doc 9859) highlighted that a management of change process should take into account the criticality of systems, equipment and activities, their operational environments and past performance. The manual indicated that design factors, including equipment and task design, should be considered in the hazard identification process.
Detailed guidance on aviation operational risk management methodology is available from the United States Federal Aviation Administration in their system safety handbook, Chapter 15: Operational risk management. Hazard identification tools and examples are available in Appendix F: ORM details and examples.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 19 September 2017, at about 1504 Eastern Standard Time,[1] the pilot of a Piper PA‑28‑181 aircraft, registered VH-BDB (BDB), conducted a forced landing about 15 km west-south-west of Bankstown Airport, New South Wales. In addition to the pilot, there was one passenger on board. The pilot received minor injuries and the passenger was uninjured. The aircraft was substantially damaged.
On 15 September, the pilot made a booking to hire an aircraft from Bankstown Airport for a return flight to Wollongong with one passenger, for the time period 1200–1500. The booking was made with the flight school where the pilot had recently completed his private pilot licence and had flown the PA-28 aircraft type. The purpose of the planned flight was for the pilot to accrue command hours towards his commercial pilot licence.
On 19 September, after arriving at the flight school and finalising his flight plan, the pilot was advised that the booked aircraft was unserviceable and the booking was changed to 1230–1530 with an alternate aircraft. The alternate aircraft returned at about 1240–1250 from the previous booking and was then refuelled to full. The pilot conducted his pre-flight inspection and elected to start the flight with a few circuits at Bankstown Airport before departing to Wollongong with the passenger. While conducting the circuits, the aircraft became unserviceable and the pilot returned the aircraft to the flight school.
The school then offered the pilot BDB. The pilot agreed to take BDB, but decided to conduct a local training area flight due to the time delays associated with the aircraft changes. The pilot reported that he conducted a pre-flight inspection of BDB. He believed the aircraft had full fuel on board on departure and planned to fly for only 30–40 minutes. Therefore, he did not intend to change the fuel tank selector during the flight from the tank selected at take-off (refer to section titled Fuel management).
At about 1430, the pilot and passenger departed for a local training flight, with a planned return time of about 1500. At about 1500, as the aircraft was approaching the waypoint 2RN for return to Bankstown, the pilot noticed the engine was fluctuating a couple of hundred revolutions per minute. The pilot elected to track via Camden to avoid overflying built-up areas with what he believed to be an engine problem. After turning towards Camden, the pilot selected the electric fuel pump on, but the engine fluctuations became worse. The pilot then performed his engine failure immediate checks, which involved checking the fuel pump, mixture, oil temperatures and pressures, switches for the magnetos, and throttle for response.
After the pilot completed his immediate checks, there was a total loss of engine power, at which time the aircraft was at an altitude of about 700 ft above ground level. The pilot identified a field out to his left, made a MAYDAY[2] call to Bankstown air traffic control, and briefed his passenger to secure himself for the landing.
There was moderate turbulence, which resulted in fluctuating airspeed and intermittent stall[3] warning activations during the approach. Considering the conditions, low altitude and the location of the fuel tank selector, the pilot felt that attempting to change fuel tanks would have diverted his attention from flying the aircraft at a critical time. Therefore, the pilot focused his attention on not stalling the aircraft while executing the forced landing, and did not conduct any further checks.
After the aircraft touched down, the pilot concentrated on keeping it straight over the rough ground until it ran through a fence at the end of the field and stopped when the right wing struck a tree. The pilot activated the emergency locator transmitter and directed his passenger to stand about 30–40 m behind the aircraft. After the pilot exited the aircraft, he activated his personal locator beacon and made a phone call to emergency services as he could see fuel leaking from the right wing. Emergency services arrived within about 20 minutes and made the accident site safe.
Fuel management
Fuel system
The PA-28-181 aircraft has two fuel tanks, one in each wing, and a fuel gauge located in the cockpit for each tank. A three position fuel selector is located on the lower left side of the cockpit with the positions OFF, LEFT and RIGHT. The rate of fuel consumption in-flight is about 42 L/h and each tank held a total of 90 L. The last fuel system calibration was 19 February 2014.[4] The calibration check found the fuel tanks were empty when the fuel gauges indicated zero. When the fuel gauges indicated 5 USG,[5] the left tank held 17 L and the right tank held 16 L. When the fuel gauges indicated 10 USG, the left tank held 33 L and the right tank held 35 L.
Pilot’s instruction and practices
The pilot’s flying school reported that they teach pilots that fuel gauges are not always accurate. Therefore, if a fuel tank(s) was not full during the pre-flight inspection, a dip-stick located in the aircraft was used to check the tank(s) contents. For in-flight fuel management and aircraft balance, the pilot was taught to change the fuel selector between the LEFT and RIGHT tank at 30-minute intervals. Consequently, the pilot managed fuel in-flight based on flight time, rather than with reference to the fuel gauges.
In the event of a loss of engine power, the pilot was taught to complete the entire emergency checklist procedure provided there was sufficient height and/or time available. However, if he believed the loss of power had occurred in a time critical situation, then he should prioritise flying and safely landing the aircraft in lieu of conducting checks.
Operator’s report
The operator reported that, at the completion of the previous flight, BDB had about 25 L in the left tank and about 55 L in the right tank. The local fuel agent used by the operator also reported that BDB was not refuelled before the flight.
Aircraft inspection
A representative of the insurance company examined the aircraft about 3 hours after the forced landing. That examination found the fuel selector in the LEFT tank position (Figure 1) and no usable fuel in the left tank, which was not breached. The right tank, which was breached, was about one quarter full. The aircraft wreckage was recovered to facilities on 21 September and further inspections were conducted on 26 September. The inspections found no fuel in the engine fuel lines, and about 20 ml and 40 ml of fuel in the fuel filter bowl drain valve and carburettor respectively.
Figure 1: Aircraft fuel tank selector
Source: Insurance assessor, modified by the ATSB
Quick reference handbook
The flight school had a published quick reference handbook for the PA-28 aircraft, which included an abnormal procedure for engine roughness and an emergency procedure for engine power loss in flight. The engine roughness procedure started with carburettor heat on, followed by adjusting the mixture, electric fuel pump on, switching fuel tanks, checking engine gauges and magnetos. The engine power loss in flight procedure started with switching fuel tanks, electric fuel pump on, mixture to full rich, carburettor heat on, check engine gauges and fuel primer.
Safety analysis
Believing the aircraft had full fuel on board, the pilot intended to conduct the 30-40 minute flight on the left fuel tank. It was more likely than not that the pilot believed the fuel quantity on board was full at the start of the flight due to his inspection of another aircraft earlier in the day. However, BDB was not refuelled prior to the flight and had about 35 minutes of fuel available in the left tank and about 78 minutes in the right tank. Despite having sufficient fuel on board for the planned flight, when returning to Bankstown, the engine lost power due to fuel starvation associated with use of the left fuel tank. This resulted in a forced landing.
While the pilot conducted some initial checks before the engine completely lost power, he omitted to change fuel tanks, which likely would have prevented the subsequent loss of engine power. Once the aircraft experienced a total loss of power, the pilot found himself in a time-critical situation in challenging flying conditions and therefore prioritised flying the aircraft in lieu of conducting further checks.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The pilot had refuelled another aircraft to full earlier in the day, which he more likely than not misattributed to the fuel state of VH-BDB.
The loss of engine power was due to fuel starvation associated with the left fuel tank, which resulted in the pilot conducting a forced landing.
Safety message
Fuel starvation and exhaustion events continue to be reported to the ATSB. It is therefore important for pilots to continue to educate themselves on the risks and controls associated with fuel management.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 13 September 2017, the crew of a Boeing 737, registered VH-VUE and operated by Virgin Australia, were flying a scheduled passenger flight from Melbourne, Victoria to Adelaide, South Australia. Shortly before top of descent, air traffic control instructed the crew to perform a high-speed descent. The crew commenced descent with the first officer as pilot flying and the autopilot engaged, and intended to target a descent speed of 320 kt, which was higher than the normal descent speed of 280 kt.
During the descent, the first officer attempted to manage airspeed fluctuations by using changes in the autopilot modes and reductions in the target airspeed. As the aircraft descended through around 17,000 ft, the tailwind affecting VUE decreased suddenly and significantly. The reduction in tailwind caused the indicated airspeed to increase and approach the maximum operating speed limit of 340 kt.
The captain responded to the sudden increase in airspeed by abruptly pulling back on the control column, causing the autopilot to disconnect. The resulting control forces caused sudden changes to the aircraft’s pitch attitude and vertical acceleration. Two cabin crew who had been standing in the rear galley were injured, with one sustaining serious injuries.
What the ATSB found
The ATSB found that a sudden reduction in tailwind caused the airspeed to increase towards the maximum operating speed. The safety implications associated with this event related to the captain’s sudden control inputs to prevent an overspeed, and the consequent effects of vertical acceleration on the aircraft and its occupants. Although there was a resulting one knot overspeed from the sudden speed increase, it was not by an amount that required any structural inspections to ensure the ongoing airworthiness of the aircraft, according to the guidance provided by the aircraft manufacturer.
Even though the autopilot was operating correctly, when the aircraft was approaching and exceeding the maximum operating speed, the captain’s perception was that the autopilot was not controlling the aircraft and that urgent intervention was necessary. However, the captain did not follow the normal procedure for taking over control of pilot flying duties. The large pitch control inputs made by the captain were probably influenced by the captain’s perception of urgency.
The ATSB also found that the captain was highly concerned about avoiding an overspeed. This was partly because of a perception that Virgin Australia were also concerned about overspeed and wanted to avoid overspeed events, and partly because of a perception that minor overspeeds had significant implications for the safety of the aircraft. These factors contributed to how the captain responded to the sudden increase in airspeed towards the maximum operating speed.
The crew identified the risk of overspeed earlier in the descent, but did not discuss how they would manage that risk. This reduced the pilots’ ability to effectively respond to the overspeed situation, and probably contributed to the rapid, reflexive nature of the captain’s control inputs.
What's been done as a result
Virgin Australia have updated the training and information provided to pilots about overspeed and overspeed recovery. The intent of these actions was to reinforce the correct overspeed recovery technique, and to provide a greater opportunity for pilots to understand the negative safety implications of manual inputs to correct a minor overspeed. These actions have included an animation showing pilots mishandled and correct overspeed recoveries, and an update to manuals which explains that the 737 has been flight tested at speeds above VMO.
Virgin Australia have also changed procedures for ground handling staff when responding to requests from emergency services.
Safety message
During this accident, the pilots accepted and targeted an air traffic control instruction to conduct a high-speed descent. Due to increased kinetic energy and reduced margins to placard speed limits, high-speed descents involve a higher level of risk, including increased risk of harm due to abrupt control input. Pilots are entitled to decline air traffic control instructions where they do not perceive they can safely comply.
This accident highlights the challenges pilots face when responding to sudden or unexpected situations. There will often be a reduction in safety when pilots perceive a situation is urgent and when they make decisions rapidly and reflexively. In these situations, pilots may not be able to effectively process information or make good decisions.
Wherever possible, pilots should take the opportunity provided in an earlier stage in flight to identify risks and take steps to reduce the likelihood of a critical situation developing. Potential threat identification and planning for their management should also involve considering, as a multi-person crew, what the implications of a perceived risk might be, and how to respond if the threat does develop. By taking steps in an earlier stage in flight, pilots can improve their ability to respond effectively to threats. The Federal Aviation Administration Aeronautical Decision Making material provides pilots with accessible guidance on these concepts.
The occurrence
On the afternoon of 13 September 2017, the crew of a Boeing 737-800 aircraft, registration VH‑VUE (VUE) and operated by Virgin Australia (VA), were operating a scheduled passenger service from Melbourne, Victoria to Adelaide, South Australia. The scheduled departure time for this flight was 1605 CST.[1]
The flight crew comprised the captain and the first officer (FO), and these pilots had flown VUE together on the preceding flight. The cabin crew comprised the cabin supervisor (CS) and three other cabin crew. There were 151 passengers on-board.
In preparation for the flight to Adelaide, the flight crew reviewed various information relating to the en route and destination weather conditions. The captain briefed the CS, advising the expected flight time was 65 minutes and that the forecast weather was the same as local conditions in Melbourne, which the CS perceived as cloudy.
For the flight to Adelaide, the FO was pilot flying (PF) and the captain was pilot monitoring (PM).[2] At 1610, VUE departed from Melbourne and climbed to flight level (FL) 360.[3] The departure, climb and cruise were uneventful.
Crew instructed to perform high-speed descent
At about 1642, the aircraft was south-east of Adelaide, maintaining FL 360 and approaching top of descent. Air traffic control (ATC) issued the crew clearance to conduct a DRINA NINE ALPHA standard instrument arrival route[4] (STAR) for an approach to runway 23, and when ready descend to FL 250. This STAR provided tracking information including a series of waypoints, altitude and speed restrictions, positioning the aircraft to the north-east of Adelaide to commence an approach to runway 23.
Figure 1 shows the flight path of VUE, with the DRINA NINE ALPHA STAR waypoints overlaid. The original STAR procedure is provided in Appendix A – DRINA NINE ALPHA STAR. This procedure required inbound aircraft track to the DRINA waypoint, then to pass overhead COMLY at or below 13,000 ft.
A few minutes after issuing the STAR, when VUE was 136 NM (252 km) south-east from Adelaide and 93 NM (172 km) from the DRINA waypoint, ATC cancelled all speed restrictions and instructed the crew to maintain maximum speed on descent, which the pilots understood as an instruction to make a high-speed descent. The FO said to the captain that they would ‘see how (the aircraft would) go’ with an airspeed of 320 kt, but that this might be too fast. The captain responded by saying ‘she’ll be right, don’t overspeed’.
Figure 1: Flight path of VH-VUE with DRINA NINE ALPHA STAR waypoints overlaid
Source: Google Earth, with aircraft track and Airservices Australia waypoint information overlaid by ATSB
Descent into Adelaide
Prior to commencing the descent, the crew set up the aircraft’s flight management system (FMS) based on the ATC clearance, and then commenced the approach briefing. The crew programmed a selected airspeed of 310 kt into the FMS.
At about 1652 the captain briefed the CS for the descent, advising that the aircraft would commence its descent to Adelaide in around 30 seconds, and that the expected arrival time was 15 minutes earlier than planned.
Soon after VUE began descending, airspeed started to increase. The FO made a number of changes to the autopilot mode and settings in order to prevent airspeed from increasing too much (see Recorded information). However, airspeed continued to increase. The crew remarked that the changes to the autopilot mode and settings did not help much, with the FO saying that the autopilot ‘doesn’t (manage airspeed) very well…it just doesn’t like to hold her steady’. The captain reminded the FO ‘don’t overspeed’.
Recorded data indicates the crew began increasing the selected airspeed on the mode control panel (MCP) incrementally during the early stages of the descent when approaching the start of the STAR. (Figure 11 in Appendix B – Flight data recorder data shows changes to the selected airspeed, actual airspeed, autopilot modes and other recorded parameters during the descent.)
At about 1654, when VUE was descending through FL 335, the flight crew made the ‘cabin crew prepare for landing’ announcement. Shortly after, the flight crew continued the approach briefing, including briefly reviewing threats (see Other flight crew procedures), then performed the descent checklist.
The crew selected the briefed descent airspeed of 320 kt at about 1656, when the aircraft was descending through FL 250, and the aircraft reached that speed soon after. VUE remained at 320 kt for the following few minutes.
About two minutes later, the aircraft was approaching waypoint DRINA descending through FL 220, when the FO saw the tops of stratocumulus cloud, which the FO thought were about at FL 150.
The FO suggested that it may be appropriate to activate the fasten seat belt sign. The captain responded that the conditions at the time were good, and the FO agreed with that assessment. The captain asked the FO if there were any reports or concerns of turbulence. The FO responded that there had been no reports and was not worried. The fasten seat belt sign remained off.
According to information provided in ATSB interviews after the accident, the captain also wanted to leave enough time for the cabin crew to complete their duties. The FO thought the clouds beneath VUE might be associated with turbulence later in the descent, but at that time the FO was comfortable with the seatbelts sign remaining off for ‘a bit longer’.
At around this time, the FO reduced the selected airspeed to 310 kt. Soon after, VUE commenced the turn towards COMLY.
Captain intervention
At about 1659, VUE was 15 NM (28 km) from COMLY and descending through FL 170. Airspeed reduced by around 10 kt to the selected 310 kt.
Airspeed then started to increase, first gradually, then more rapidly. The flight crew observed the indicated airspeed approaching VMO (maximum operating speed), and the FO observed the airspeed trend indicator[5] move past the lower band of the red bars on the primary flight display airspeed indicator. Both pilots expressed statements of concern and alarm.
The captain called ‘pull-up’ while also making two abrupt nose-up inputs on the left (captain-side) control column. The first was 49 lb (about 22 kg), which caused the autopilot to disconnect. The captain abruptly released the controls and then made a second control input of 28 lb (about 13 kg) about 4 seconds later.
The FO heard the autopilot disconnect audible alert and saw the captain pulling on the control column and acknowledged that the captain had control of the aircraft.
About 8 seconds after the captain’s initial nose-up input and autopilot disconnect, the captain prompted the FO to resume duties as pilot flying, and a normal transfer of control was performed. The flight crew perceived they had encountered severe atmospheric turbulence. Shortly after the FO resumed pilot flying duties, the captain said ‘better put the belts on’, to which the FO responded ‘check’.
The FO continued to fly the aircraft for around 30 seconds before re-engaging the autopilot. During this period, the FO made several nose-down inputs, peaking at 32 lb (about 15 kg) 10 seconds after the initial nose-up input. Shortly after the autopilot was re-engaged, cabin crew contacted the flight crew and reported that the cabin was not secure, and that one of the cabin crew members at the rear of the aircraft had broken their leg.
With the captain communicating with the cabin crew, the FO (who was pilot flying) notified ATC that VUE would not meet the height requirement for COMLY due to encountering turbulence. ATC advised the crew that they could cancel all height requirements and reduce their speed.
Around 90 seconds later, ATC contacted the crew of VUE to confirm their report of severe turbulence. The captain responded in the affirmative and added that the turbulence was associated with some cloud.
Events in the cabin
The cabin crew recalled that the flight had been smooth during the cruise and initial descent, with no turbulence experienced. At the time the flight crew made the ‘cabin crew prepare for landing’ announcement, the in-flight food and drink service had been completed and rubbish collected. Following this announcement, the cabin crew completed duties including securing the cabin for landing. The cabin crew then returned to the forward and rear of the aircraft, with the two cabin crew members in the rear of the aircraft standing in the galley eating a meal.
Cabin crew members recalled an abrupt upset in the cabin, which they perceived as sudden and without warning. One of the cabin crew members in the rear galley was thrown up towards the ceiling, then fell to the floor. The cabin crew member felt their leg snap on landing and was unable to move from the floor.
The sudden changes in pitch attitude also injured the other crew member in the rear of the aircraft. This crew member struck their jaw on the galley bench and had other minor injuries to their body and face.
The CS reported to the ATSB that they experienced muscular skeletal injuries from the accident and had sought out chiropractic care.
After the aircraft had stabilised, the cabin crew member who suffered a leg injury was given oxygen using a portable on-board cylinder.
At about 1704, the CS confirmed with the flight crew the requirement for an ambulance and that the injured cabin crew member was unable to move to a seat for landing and would stay on the galley floor.
The CS then made positional changes among the cabin crew, moving the uninjured cabin crew member from the forward cabin to the rear, and the cabin crew member who sustained minor head injuries to the front. The CS also briefed able-bodied passengers in the last seating row about what the cabin crew might request, to assist with disembarkation if the situation escalated or in case of another emergency. The cabin crew members took their assigned seats for landing.
Coordination and response at Adelaide Airport
At about 1702, the captain contacted VA ground personnel in Adelaide and notified them that a cabin crew member had been injured during turbulence and requested an ambulance on arrival.
The flight crew then notified ATC about the injured cabin crew member and requested Aviation Rescue Firefighting (ARFF) personnel to meet VUE at the arrival gate to provide first aid until the ambulance arrived.
Around the same time, VA personnel notified the SA Ambulance Service (SAAS) of the injury on-board VUE, and that an ambulance was required at the emergency gate at Adelaide Airport, to go airside.[6]
At about 1709, ATC notified ARFF about the accident, and a crew were dispatched around two minutes later. An ARFF officer also contacted SAAS, to confirm an ambulance was en route. During this phone call, the ARFF officer directed the ambulance to the arrival gate via the upstairs sections of the main terminal.
VUE arrived at its bay at around 1719. ARFF personnel had pre-positioned at the bay and entered the cabin via the rear stairs soon after the aircraft arrived. A VA ground supervisor also came into the cabin to assist with the situation. The SAAS patient treatment record indicated the ambulance crew arrived at the Adelaide Airport terminal entrance at 1719, and proceeded to the arrival gate, commencing treatment at 1725.
There was extensive discussion between the ARFF, the SAAS and the VA ground supervisor about how to remove the injured cabin crew member from the aircraft. With a badly broken leg, the injured cabin crew member was not able to walk or to sit in a wheelchair, and the ambulance stretcher did not fit down the aircraft aisle. The emergency services personnel suggested using a scissor lift or catering truck appliance and asked the ground supervisor to assist with this. The ground supervisor advised that no scissor lift was available and declined the use of the catering truck.
After considerably more deliberation, the injured cabin crew member suggested that the ambulance officers conduct the extraction from the aircraft using a slide sheet. Emergency services personnel used the slide sheet to drag the injured cabin crew member along the aisle to the front of the aircraft, then placed the injured cabin crew member on a stretcher. SAAS records showed the ambulance departed the airport at 1845.
The captain joined Virgin Australia (VA) as a Boeing 737 (737) first officer in 2003 and received command upgrade in 2012. The captain had a total flying experience of around 18,000 hours, including over 4,000 hours as captain and almost 6,000 hours as a first officer in the 737.
The captain reported being rested before starting work on the day of the accident. The captain woke at around 0530 for a 0930 sign on, had completed two short sectors prior to the accident flight and had one short sector scheduled afterwards. On the second sector, the captain had flown into Melbourne with the accident flight first officer (FO).[7]
The FO joined VA as a Boeing 777 second officer in 2010, and qualified as a 737 FO in 2012. The FO had a total experience of around 8,500 hours, including around 3,500 hours in the 737.
The FO reported having a normal sleep on the night before the accident and was feeling alert at the top of descent into Adelaide. The FO recalled waking at 0500 on the day of the accident and leaving for work at 0645 for a 0830 sign on. The accident flight was the FO’s third of four scheduled short sectors that day.
Cabin crew information
The cabin supervisor (CS) joined VA in 2003 and became cabin supervisor in 2004. The CS was also involved in training other cabin crew, including instructing cabin crew non-technical skills.
The cabin crew member who sustained serious leg injuries had worked as a cabin crew member since 2002 and joined VA in 2005. The cabin crew member also had qualifications as an enrolled nurse, and was a first aid instructor at VA.
The cabin crew member who sustained minor head and facial injuries had only recently joined VA, and the accident occurred on this cabin crew member’s first day after paired ‘buddy’ training.
Aircraft information
VH-VUE was a Boeing 737-800. There were no indications that any mechanical issues with the aircraft were contributory to the accident. After the accident, maintenance personnel conducted a severe turbulence inspection which did not identify any damage or faults.
Airspeed indications
Figure 2 illustrates how airspeed indications are displayed to the crew on the 737 primary flight display.
Figure 2: Airspeed indications on the 737 primary flight display
Source: Boeing 737 Flight Crew Operating Manual (FCOM). Copyright Boeing.
Item 1 and Item 5: Selected airspeed. The magenta numbers (Item 1) and speed bug (Item 5) display the targeted airspeed, set by the pilots. In the example shown, this is 250 kt.
Item 2: Speed trend vector. The green arrow displays the predicted airspeed in 10 seconds time. This prediction is derived from the air data inertial reference system and is based on the current airspeed and acceleration. In the example shown, the green arrow predicts the airspeed increasing to about 258 kt.
Item 3: Current airspeed. The white value displays the current calibrated airspeed. The value shown is between 242 and 243 kt.
Item 4: Maximum operating speed. The lower of the red bars indicates the maximum speed as limited by lowest of the landing gear placard speed, flap placard speed, or VMO/MMO.
Prior to the autopilot disconnect, the flight crew observed the current indicated airspeed increase to near VMO. The FO also observed the speed trend vector increase to within the lower band of the red bars, indicating that if not slowed the airspeed would exceed VMO within the next 10 seconds. According to the captain’s interview with the ATSB, the captain did not specifically look at the speed trend vector prior to pulling back on the control column in response to the sudden speed increase.
Autopilot modes and airspeed management
Airspeed is the result of the balance between thrust and drag, both of which can be controlled by the automatic flight system (AFS) or the flight crew. The 737 AFS consists of the automatic flight director system (AFDS) and the autothrottle and can operate in multiple vertical and lateral navigation modes. When engaged, the vertical navigation modes control the vertical path and speed by adjusting engine thrust (through the autothrottle) and pitch attitude (through the AFDS). The vertical navigation modes seek to maintain waypoint altitude and speed crossing restrictions programmed into the flight management system in the vertical navigation path mode, or values input to the vertical speed and altitude controls on the mode control panel (MCP).
When the autothrottle is engaged in a mode to control airspeed, the airspeed is adjusted by increasing or decreasing the engine thrust. Alternatively, when the AFDS is in a mode that controls airspeed, airspeed is adjusted by changing the pitch attitude to increase or decrease the drag. To increase the airspeed, the pitch is reduced (nose down), and to decrease the airspeed the pitch is increased (nose up). Depending on the mode engaged, the AFS alters the pitch or thrust commands to attain and/or maintain either the airspeed selected in the flight management system or on the MCP.
Sudden changes in the magnitude of head/tailwind can have the effect of changing the airspeed. For example, a decrease in a tailwind can result in an effective increase in airspeed, all other factors being equal. In order to maintain the target airspeed, the AFS will either pitch the nose of the aircraft up or down, or increase/decrease thrust (depending on the selected mode).
Figure 3 shows the 737 MCP. Located on the glareshield panel, pilots use the MCP to select autopilot modes, and change autopilot target values such as airspeed and vertical speed. For example, pilots can use the IAS/MACH selector to change the MCP selected airspeed or use the vertical speed thumbwheel to change the target vertical speed.
Figure 3: 737 mode control panel
Source: Boeing 737 FCOM. Annotated and cropped by ATSB. Copyright Boeing.
For most of the descent into Adelaide, the pilots engaged the AFS in level change mode. In this mode, the autothrottle engages in the RETARD then ARM modes, meaning the autothrottle reduces the thrust setting to idle, and the pilots have manual thrust control using the thrust levers. The AFDS engages the speed mode, which means the AFDS commands adjustments to pitch attitude to maintain the speed set in the MCP IAS/MACH selector. The AFS system will not accept a selected airspeed greater than VMO.
The FO, who was pilot flying (PF), also intermittently selected the vertical speed mode. In this mode, the AFDS commands pitch attitude adjustments to hold the target vertical speed entered using the MCP vertical speed thumbwheel. The autothrottle is engaged in speed mode to hold the selected airspeed. In descent, engine thrust will be at idle, meaning the autothrottle cannot reduce thrust to target a reduced airspeed.
The AFS mode reversion provides automatic controls which provide additional protections when the AFDS or autothrottle alone are insufficient to prevent exceeding a placard limit speed. In the case of VMO, if the autothrottle is engaged in speed mode and the thrust levers are at idle, the engine thrust cannot be reduced further to prevent a speed increase. If the AFDS is in vertical speed mode, the AFS mode will automatically change to level change mode to provide speed control using pitch attitude changes.
Although different AFS modes automatically maintain the selected airspeed and prevent VMO overspeed, the AFS is not capable of preventing temporary exceedances in certain circumstances. Where the aircraft encounters sudden environmental changes, such as severe windshear, this may exceed the performance capability of the AFS. This may result in temporary overspeed, particularly when the aircraft is operating close to VMO or other limit speeds.
Control options for disconnecting the autopilot
Figure 4 shows the 737 autopilot disengage controls. The autopilot is typically disengaged by pressing the autopilot disengage button on either control wheel. A ‘disengage’ bar is also available on the MCP, which can be pulled down to disengage the autopilot. The position and design of these controls is such that they are accessible from the position of either pilot, and are simple to operate.
Figure 4: 737 Autopilot disengage controls
Source: Boeing 737 FCOM, Cropped and annotated by ATSB. Copyright Boeing.
The autopilot will also disengage if the pilot applies sufficient force to ‘breakout’ or ‘pull through’ the flight controls. After the autopilot has been disconnected, the pilot has full manual control of the aircraft’s pitch and roll attitude. An audible autopilot disconnect alert tone is produced whenever the autopilot is disconnected.
For this event, the captain pulled back on the flight controls, and did not report using either the disengage bar or switch. This action resulted in the autopilot disconnecting due to the breakout function.
Speed brakes
Pilots can extend the 737 speed brakes to increase drag, using the speed brake lever. The Boeing 737 Flight Crew Training Manual (FCTM) provided procedures for using the speed brakes in-flight. These procedures said that ‘the speedbrake may be used to correct the descent profile if arriving too high or too fast’. These procedures also noted that using speed brakes enabled the aircraft to decelerate up to 50 per cent more quickly.
For this event, the pilots did not use speed brakes to reduce airspeed prior to the overspeed or during the recovery.
Atmospheric conditions
Crew perceptions of weather conditions
In preparation for the flight, the pilots reviewed information about the forecast meteorological conditions. The information provided to the pilots included the significant weather charts for Australia for Flight Level (FL) 100-250 and FL 250-650, as well as the trend forecast, meteorological aerodrome report and aerodrome forecast for Adelaide. Other documents included the VA operational flight plan for the flight to Adelaide.
The significant weather charts (shown in Appendix C – Significant weather chart) forecast an area of moderate clear air turbulence from FL 100 to FL 250, which covered the planned route from around 95 NM (175 km) east of Adelaide. The aerodrome forecast for Adelaide was for westerly winds of 20 kt with gusts up to 30 kt, together with intermittent periods of reduced visibility in rain showers and small hail, and broken cloud at 2,500 ft.
The operational flight plan included a dispatcher note to the crew stating that the flight had been planned at FL 360 as this level had been reported ‘smooth’ by previous crews.
The captain reported considering that the overall weather conditions were mostly fine, although noting there was a chance of clear air turbulence en route. The FO identified that conditions may include gusty winds, and noted the forecast included small hail.
The crew reported that the actual conditions for the majority of the descent were smooth. At interview, the FO said that VUE was not in cloud at any time. At the time of the overspeed and sudden changes in pitch attitude, the FO recalled that that VUE was passing through thin wispy cloud.
The captain reported being surprised by the overspeed and perceived turbulence, because there had not been any returns on the weather radar, and that VUE was flying in light cirriform type cloud. The captain recalled the crew had not received any reports of turbulence from ATC or other aircraft. The captain’s initial notification of the accident to the ATSB stated that the overspeed and perceived turbulence occurred when VUE was in cirrus type cloud tops.
At 1645, a pilot of an aircraft departing Adelaide reported to the Adelaide approach controller that they had encountered light and occasionally moderate turbulence between FL 140 to 170. The crew on board VUE were not aware of this report.
Atmospheric data recorded by aircraft
The ATSB derived estimates of the instantaneous local wind speeds during the descent using the airspeed, groundspeed, track and heading information recorded by the flight data recorder (FDR).
The path that the aircraft travels over the ground is a combination its speed and direction through the air and the movement of the air through which it is travelling. As such, the local wind vector (speed and direction) is derived as the difference between the true airspeed and the groundspeed vectors, as shown in Figure 5.
Figure 5: Calculation of local wind vector (green) using the true airspeed (blue) and groundspeed (brown) vectors.
Source: ATSB
The wind vector may be illustrated as two components when referenced to the true airspeed. The component of the wind vector parallel to the true airspeed is the head/tailwind component, and the perpendicular component is the crosswind (Figure 6). The wind vector represents the direction that the wind is coming from, so with reference to the aircraft, a positive parallel component is a tailwind.
Figure 6: Wind components. The component of the wind that is parallel to the true airspeed is the head/tailwind and the perpendicular component is the crosswind.
Source: ATSB
Figure 7 shows the variation in the calculated wind vector and headwind components around the time of the autopilot disconnect. During that period, the wind component changed from almost no headwind component to a tailwind of about 25 kt, where it stabilised for about 10 seconds. Immediately before the overspeed, tailwind dropped by about 13 kt in around 2 seconds. This appears to have been due to a combination of a decrease in the wind strength and a change in the direction of the wind.
Figure 7: Plot of the calculated wind (light green), wind direction (yellow), headwind component (dark green), and aircraft heading (blue) during a two minute period around the autopilot disconnect.
Source: ATSB
Estimating wind information from FDR data is complex, and the reliability and validity of information recorded by aircraft sensors may be influenced by factors such as the sensor location and the sampling rate. Aircraft are also operating in a complex three-dimensional environment, where the aircraft body angles may not be aligned with the aerodynamic flight path vectors (for example, the vector directions may be effected by angle of attack and sideslip angles).[8] The ATSB analysis was based on a simplified two-dimensional model of the aircraft environment.
While the ATSB’s analysis is appropriate for the purpose of estimating relative changes in the wind, analysis conducted by the manufacturer provided further certainty on the estimated wind changes. The manufacturer conducted a kinematic consistency analysis, which they describe as being ‘used to correct inherent inconsistencies often present in recorded data from different sensors because of the presence of instrumentation biases due to misalignment in inertial measurements, contamination of pressure and altitude measurements due to flow separation, and sample rate differences.’
The manufacturer’s kinematic consistency analysis also found that there was a sudden decrease in the tailwind component shortly before the airspeed rapidly increased towards VMO. This change in tailwind component was of a similar magnitude to that calculated in the ATSB’s analysis.
Recorded information
Personnel from VA secured a copy of the quick access recorder (QAR) data for analysis and provided a copy of that data to the ATSB. The FDR and cockpit voice recorder (CVR) were also removed and sent to the ATSB laboratory in Canberra for analysis. The following describes the recorded sequence, changes to the aircraft autopilot modes and key flight data parameters during the descent into Adelaide:
The flight crew commenced the descent with the autopilot engaged. Shortly after commencing the descent, the FO selected the level change AFS mode. There was a gradual increase in airspeed from around 1653:30, when VUE was descending through FL 340.
At 1654:10, the FO briefly changed the AFDS command mode to vertical speed, with a setting of -650 ft/min, winding back to -450 ft/min. This was consistent with the pilots controlling the aircraft speed by reducing the descent rate. A few seconds later, the level change mode was re-engaged.
The computed airspeed reached the selected target airspeed (320 kt) about 1656:30, as VUE was passing through FL250. For the next few minutes, airspeed was stable at around 320 kt.
Figure 8 shows the changes to the autopilot modes and airspeed from 1658:00, when VUE was descending through around FL 200. Figure 9 shows changes to the flight controls and the aircraft vertical acceleration during that period.
At 1658:18 the FO reduced the target airspeed to 310 kt. While the AFDS responded accordingly by adjusting the pitch angle, airspeed remained at about 320 kt.
The FO selected the vertical speed mode again at 1658:38, with a vertical speed of -2,600 ft/min. The AFDS responded by adjusting the pitch angle to meet the new selected vertical speed. The FO then gradually wound back the selected vertical speed to -1,200 ft/min. The aircraft achieved the selected vertical speed, but airspeed remained at around 320 kt. At 1658:52, the FO re-engaged the level change mode.
At about the same time, the autopilot commanded a turn towards the COMLY waypoint, as part of the STAR. The tailwind started to increase from around 20 kt to 38 kt, which contributed to the computed airspeed decreasing towards the target airspeed (310 kt). As the computed airspeed approached the selected airspeed, the autopilot decreased the pitch attitude.
At 1659:05, the FO then selected the target airspeed to 300 kt. However, airspeed began to increase, from about 310 kt to 320 kt.
The AFS and both pilots responded to the increase in airspeed. At 1659:10, the AFDS reduced the nose-down pitch angle. At about the same time, the FO engaged the vertical speed mode, quickly winding the selected vertical speed back from -1,200 ft/min to -400ft/min.
At 1659:14, as the aircraft was descending through around 17,000 ft, the tailwind component quickly reduced from 23 to 12 kt and the wind direction changed (as described in Atmospheric data recorded by aircraft above). The airspeed quickly increased towards VMO (340 kt).
At 1659:16 (vertical purple dotted line in Figure 8 and Figure 9), the captain suddenly pulled back on the control column, with a maximum 49 lb backwards control force. This caused the autopilot to disconnect and resulted in a large increase in the aircraft pitch attitude.
The captain suddenly released the controls after the autopilot disconnect, then pulled back on the controls again a few seconds later. The vertical acceleration rapidly increased to 2.3 g, before rapidly decreasing to 0.9 g. This was immediately followed by another rapid increase to 1.95 g, consistent with the second nose-up control input made by the captain.
At 1659:19, the airspeed peaked at 341 kt, before declining quickly to around 280 kt.
Figure 8: Recorded data parameters including autopilot modes, pitch angle and vertical acceleration
Source: ATSB
Figure 9: Recorded data parameters including control column force
Source: ATSB
Windshear and autopilot performance
The ATSB considered the influence of wind changes on the changes to VUE’s airspeed during the descent. Figure 10 shows the changes in computed airspeed and headwind immediately before and after the overspeed and autopilot disconnect. This analysis indicates that there was a 10 kt speed increase between 1659:06 and 1659:13 that did not appear to be due to change in the headwind component. However, between 1659:14 and 1659:16 (when the autopilot disconnected), the rapid increase in the computed airspeed was consistent with a 12-14 knot change in the headwind component. The second rise in computed airspeed about 2 seconds later was also consistent with another change in the headwind component. This is consistent with a windshear encounter during the descent into Adelaide.
Figure 10: Comparison of the calculated headwind changes (green) and the computed airspeed (blue) in the two minute period around the autopilot disconnect.
Note on graph vertical axes: the left (wind component) and right (airspeed) are on the same relative scale (that is, a 10 knot change in the wind is the same as a 10 knot change in the airspeed). The computed airspeed scale is shifted to provide comparison.
Source: ATSB
When the FO engaged the vertical speed mode to respond to the speed increase, this automatically changed the autothrottle mode from ARM to MCP SPD. Because the thrust was already at idle, there was no capability for the autothrottle system to reduce the airspeed by reducing the thrust. Thus, when the AFS mode was changed, the AFS did not have an effective control over the airspeed, aside from mode reversion to level change mode.
The FCOM states that mode reversion occurs slightly before the aircraft reaches VMO, but does not define the exact point of reversion. In this case, because the pull-through of the control column disengaged the autopilot, this prevented the mode reversion system from engaging. It is unknown to what extent the aircraft would have exceeded VMO had AFDS continued to manage airspeed and the captain not intervened in this way.
The vertical speed selected by the FO was less than the current vertical speed, which would normally be expected to reduce the airspeed. However, the change in the headwind component was probably too rapid for this to be effective. In this instance, it may have been more effective to have left the AFS in level change mode, where the AFDS could provide management of the airspeed.
Handover and takeover procedures
Duties within the cockpit are normally allocated such that only one pilot, the pilot flying (PF), is responsible for manipulating the flight controls and providing input to the AFS. This delineation of responsibilities is important, for maintaining certainty of who is controlling an aircraft.
VA manuals described the procedures for handover and takeover of flying duties. The procedures stated that handover must always be done in a ‘positive manner’ using standard phraseology.[9]
The captain noted that the intervention procedures normally included notifying the PF, and waiting for the PF to relinquish control. The captain identified not saying anything prior to pulling back on the control column, and described this as a reflex action. The captain implied that the decision to take control was rapid, and that a quick action was required given what they perceived to be the state of the aircraft.
The FO reported noticing that the captain had control when the autopilot disconnect audible alert was heard and the captain was observed making control inputs. The FO reported relinquishing control and immediately assumed the role of pilot monitoring (PM). The CVR recorded the autopilot disconnect tone, followed shortly by the FO saying ‘you got it’ then ‘you have control’. Shortly after, the captain said to the FO ‘you go, no you’re right’, and the FO responded ‘I have control’.
Safety systems for overspeeds
Safety implications of VMO overspeed
The United States’ Federal Aviation Regulations (FAR) 25.1505 - Maximum operating limit speed defined VMO as ‘a speed that may not be deliberately exceeded in any regime of flight (climb, cruise, or descent’. These regulations state that VMO/MMO must be sufficiently below the design dive speed of the aircraft, to make it highly improbable that the latter speeds will be inadvertently exceeded in operations.[10] Other regulations provide further guidance on the calculation of the margins between VMO/MMO and these other limit speeds.
The FCTM described the concept of VMO and the causes of VMO overspeed:
VMO/MMO is the airplane maximum certified operating speed and should not be exceeded intentionally. However, crews can occasionally experience an inadvertent overspeed. Airplanes have been flight tested beyond VMO/MMO to ensure smooth pilot inputs will return the airplane safely to the normal flight envelope…Although autothrottle logic provides for more aggressive control of speed as the airplane approaches VMO or MMO, there are some conditions that are beyond the capability of the autothrottle system to prevent short term overspeeds
In a section related to procedures for rapid descent, the FCTM stated:
When descending at speeds near VMO / MMO with the autopilot engaged, short-term airspeed increases above VMO / MMO may occur. These are most often due to wind and temperature changes. These short-term increases are acceptable for this manoeuvre and the autopilot should adjust the pitch to correct the airspeed to below VMO / MMO.
The FCTM said that any time VMO is exceeded, the maximum airspeed should be noted in the flight log. A VA Flight Crew Information Bulletin (FCIB) issued on 4 October 2016 similarly noted that pilots should make maintenance log entries and safety reports for any overspeeds.
The 737 maintenance manual required a structural examination of the aircraft if a VMO exceedance was greater than 20 kt (that is, where airspeed exceeded 359 kt). There were no maintenance actions required for VMO overspeeds less than 20 kt.
VA management of overspeed and flight crew understanding of overspeed implications
VA utilise a flight data analysis program (FDAP) to systematically analyse the flight data generated in each flight, in order to make comparisons between actual operations and company procedures, and to identify non-normal occurrences. VA’s internal investigation into the accident involving VUE noted that during the period 2014 to 2016 there was a tendency for pilots who exceeded VMO to be made subject to operational clearance (SOC). The VA investigation report identified that these overspeed events were often unavoidable. Pilots declared SOC must cease flying duties until given formal notification that the SOC restriction was been removed. Pilots declared SOC typically underwent remedial training and re-assessment prior to resuming flying duties.
The VA internal investigation noted that in early 2017 (before the accident), VA management of minor exceedances shifted, which VA described as a shift in risk tolerance. After this change, the usual response involved reviewing recorded data from the flight, and no further action would typically be pursued if that review identified the crew action had been in line with procedures. After the accident involving VUE, VA provided education to pilots about the FDAP and the management of safety events during 2018 and 2019 (see Safety issues and actions).
The FO stated that it was ‘not a nice feeling’ when an aircraft exceeded VMO. However, the FO also reported intending to let the aircraft overspeed prior to the captain’s intervention. The FO believed that if they had exceeded VMO, the aircraft would be recovered to normal flight, and would require an engineering inspection and safety report.
During company interviews following the accident, the captain reported being mindful that a VMO exceedance would flag in the FDAP. During interview with the ATSB, the captain reported perceiving it was very important to prevent the aircraft from exceeding VMO, and that there was a recent significant focus within VA relating to avoiding overspeeds, which included extensive simulator and classroom training over a period of around 12 months, focussing on the correct use of the overspeed procedures described in the FCTM. The captain described being wary of avoiding overspeed if possible, because it was not good for the aircraft, and because the company did not want any overspeeds.
The captain also stated that VA pilots were generally wary about overspeeds. Although both pilots perceived that 320 kt was the standard or usual target speed for high-speed descent, the captain related that some company pilots would only target 300 kt during descent to avoid exceeding VMO. The captain reported hearing informal rumours prior to the accident that having an overspeed would result in ‘the company wanting to have words with you’. The captain said that their preference for avoiding overspeed was probably influenced by the company’s preference to have less overspeed events.
Information the captain provided at interview indicated a limited awareness of the relationship between VMO and the other aircraft limit speeds. The captain indicated not being aware that overspeeds less than 359 kt did not require maintenance inspection, and did not cause any other delay or significant consequence. When the captain saw the airspeed increasing towards VMO, the captain thought this meant the autopilot was not controlling the aircraft.
Speed management and overspeed recovery
There were no specific procedures for the management of high-speed descents. As such, there were no procedures that described the target speeds pilots should adopt during high-speed descents, or how pilots should use autopilot modes or speed brakes to manage speed in these situations.
Other VA and Boeing procedures described the methods pilots should use to manage speed around VMO, including recovering from overspeed. The 737 FCTM provided procedures for avoiding and recovering from overspeed, including in the descent stage of flight. In the section titled ‘Overspeed’ the FCTM stated that:
If autothrottle corrections are not satisfactory, deploy partial speed brakes slowly until a noticeable reduction in airspeed is achieved…
When encountering an inadvertent overspeed condition, crews should leave the autopilot engaged unless it is apparent that the autopilot is not correcting the overspeed. However, if manual inputs are required, disengage the autopilot. Be aware that disengaging the autopilot to avoid or reduce the severity of an inadvertent overspeed may result in an abrupt pitch change.
During climb or descent, if VNAV or LVL CHG pitch control is not correcting the overspeed satisfactorily, switching to the V/S mode temporarily may be helpful in controlling speed. In the V/S mode, the selected vertical speed can be adjusted slightly to increase the pitch attitude to help correct the overspeed. As soon as the speed is below VMO/MMO, VNAV or LVL CHG may be re-selected.
VA sent company pilots a Flight Safety Notice in 2014, titled Exceedance of VMO/MMO and Assigned Altitude. Although this notice primarily related to overspeed associated with entry to Jetstreams on climb on in cruise, it highlighted that
VMO/MMO is the maximum operating speed and should not be exceeded intentionally, however small excursions of a short-term or transient in nature are within the design envelope of a jet transport aircraft. That is, there is minimal operational impact. Notwithstanding this, anytime VMO/MMO is exceeded the maximum speed and time above
VMO/MMO should be noted. VMO/MMO exceedance poses less risk generally than an excursion beyond a cleared altitude or Flight Level. A VMO/MMO exceedance is preferable to an altitude bust, or large abrupt control inputs.
Any VMO/MMO exceedance must be entered in the Maintenance log and a safety report must be submitted.
The Flight Safety Notice also highlighted relevant sections of the FCOM and FCTM.
In 2016, VA sent company pilots two FCIBs titled ‘Managing VMO Exceedances and Wind Gradients near Jet Streams’ and ‘Assigned Altitude Overshoot and Overspeed Exceedances’. These bulletins provided further information about the risk of overspeed and how they should be avoided and managed, including:
A number of VA crew had pulled back on the control column in an attempt to avoid overspeed. This had led to autopilot disconnection, large abrupt control inputs and significant g forces.
The focus ‘needs to be on a preventative strategy and recovery technique’.
High-speed descents need to be managed carefully, and this may include early descent at reduced speed to avoid potential overspeed.
Level change or vertical navigation speed are the recommended modes for high-speed descents in conditions with steep wind gradients or turbulence.
‘It is preferable to accept a temporary overspeed (provided it is not excessive or sustained) rather than…large abrupt control inputs at high altitude’.
The recovery technique for overspeeds is to ‘leave the autopilot engaged unless it is apparent that the autopilot is not correcting the overspeed. Be aware that disengaging the autopilot to avoid or reduce the severity of inadvertent overspeed may result in an abrupt pitch change and high ‘g’.’
On descent, crews should command reduced airspeed and use temporary vertical speed mode selections to recover from overspeed.
Both the captain and the FO had passed simulator training sessions focusing on overspeeds, with the most recent session for each pilot occurring in 2014. The simulator scenario involved an overspeed during the cruise stage of flight, and pilots were evaluated based on their application of the procedures described in the FCTM.
The pilots recalled VA training and procedures for managing and recovering from overspeed. The captain recalled that VA training on overspeed recovery included using the vertical speed autopilot mode, and the speed brake. The captain also recalled that one VA training document stated that a small overspeed was better than an abrupt recovery. However, the captain noted that there was ambiguity in what was a small overspeed that could be allowed, as opposed to a larger overspeed, which was problematic. That is, the captain identified that the procedures did not define what a ‘small’ overspeed was.
The FO recalled pilots were taught to use the level change and vertical speed AFS modes and speed brake to recover from overspeed, and that if the aircraft was going to overspeed, to let it overspeed. The FO reported believing they would have applied the speed brake to recover from the overspeed situation, had the captain not intervened.
Control sensitivity at high-speeds
As a general principal, aircraft control systems are more sensitive in high energy states such as high-speed, high-altitude flight. This means that control inputs have larger effect when the aircraft is at higher speed. The FCTM noted the potential for over-control due to increased control sensitivity at high-speed, stating:
There have been reports of passenger injuries due to over-controlling the airplane during high altitude, high airspeed flight when overriding the control column with the autopilot engaged or after disengaging the autopilot with the disconnect switch.
Pilots should understand that, in general, the airplane is significantly more sensitive in pitch response (load factor) to column movement at cruise than it is at lower speeds associated with take-off and landing.
The captain reported not expecting to pull back very forcefully when taking manual control of the aircraft. However, reflecting on the development of the accident, the captain considered that their control inputs may have exacerbated what they perceived as the turbulence experienced by the aircraft.
Summary of overspeed safety systems
The ATSB considered the safety systems used by VA to reduce the risk of overspeed and unsafe interventions during overspeed events. Although no procedures specifically related to managing airspeed during high-speed descents, other procedures described the methods for managing airspeed around VMO. Both pilots understood the procedures for managing airspeed on descent, and the FO reported planning to apply the speed brake prior to the captain’s intervention.
Within the safety system, there were controls that sought to reduce the likelihood of pilots unnecessarily taking manual control to prevent overspeed. The documentation suite instructed pilots that the autopilot should be left engaged. During post-accident interviews with the ATSB, both pilots exhibited a good understanding of those procedures.
The defences associated with preventing unsafe pilot interventions during overspeed were thus mainly procedural controls. This is understandable, as pilots should have the ability to take manual control of the aircraft if they perceive the need to do so. The defences within the safety system were associated with supporting effective decisions about intervening.
Pilots’ understanding of aircraft capabilities and limitations is informed by documentation and training. In this case, the documentation provided by VA and Boeing did provide a reasonable indication that minor overspeeds were not problematic. The FCTM advised that pilots sometimes inadvertently encounter overspeed during operations near VMO, and this message was reinforced in the FCIB. The FCTM also contained emergency rapid descent procedures in which VMO was intentionally targeted, and therefore it would be a reasonable inference that minor exceedance of VMO would not risk the safety of the aircraft.
However, the documentation provided by VA and Boeing did not clearly express the tolerances of the 737 to minor overspeeds. VA documentation said that flight crews should document their airspeed any time airspeed exceeded VMO, even though a maintenance inspection was required only for exceedances above 359 kt. In this regard, the documentation provided to pilots could be interpreted as any exceedance of the VMO limit of 340 kt had safety implications.
Although the captain had concerns about an overspeed, this was probably not due to any systemic deficiencies in the documentation, or the training provided to flight crews. It is likely that all pilots, to some extent, have an aversion to exceeding defined limitations. The captain’s concerns about exceeding VMO were probably a reflection of this. Additional context about tolerances beyond VMO in documentation and training may reduce pilots’ concerns about minor overspeeds.
ATC speed control procedures
Air traffic control (ATC) instructions to arriving aircraft can include speed control. Speed control instructions may be based on considerations such as aircraft operational requirements and requirements for managing inbound aircraft traffic. The Airservices Australia Manual of Air Traffic Services (MATS) stated that when applying speed control, ATC should (among other responsibilities):
advise the pilot of future intentions; advise the pilot to resume normal speed as soon as the application of speed control is no longer necessary; and make speed adjustments judiciously in advance of the point at which the new speed is required, depending on the aircraft type and amount of adjustment involved.
MATS identified a speed guidance for Virgin 737 aircraft of 280 kt at 30 NM from an aerodrome. This documentation also identified that the maximum descent speed for these aircraft was 340 kt.
In November 2017 (after the accident), Airservices Australia published a revised MATS, which specifically advised controllers to ‘avoid cancelling published speed restrictions for arriving aircraft, except when necessary for traffic management or aircraft operational requirements’. Changes also included that controllers should not use the phrases ‘NO ATC SPEED RESTRICTIONS’ or ‘NO SPEED RESTRICTIONS’ when issuing speed control instructions to aircraft on a standard instrument arrival route. MATS was later revised to show a maximum descent speed of 320 kt for Virgin 737s.
VA advised that they had asked Airservices to review and change the MATS speed table to align the maximum descent speeds for the B737 for all operators. VA also advised the ATSB that they had asked Airservices to review the terminology ATC were using for issuing speeds on descent, to ensure that standard phraseology was being used.
Airservices advised the ATSB that there had been no internal reviews or investigations associated with this accident.
Acceptance of high-speed descent clearance
As a general principle, the captain of an aircraft has responsibility for ensuring the operational control of an aircraft, which includes accepting air traffic control requests for high-speed descent. The captain reported having no hesitation to deny an ATC request to conduct a high-speed descent, if the captain felt that was necessary.
The captain also reported not being able to recall if ATC instructed the aircraft to ‘make maximum speed’, or if the clearance was to target 320 kt. The FO recalled that ATC had issued the crew with a clearance for a high-speed descent but did not recall any details of the wording of that clearance. The implication, therefore, is that the pilots perceived the instruction issued by ATC as a clearance to conduct a high-speed descent; both pilots recalled that 320 kt was selected as a target speed in response to this clearance.
The ATSB did not find that the wording of the high-speed descent instruction by ATC had any influence on the target speed set by the pilots, or how the pilots managed their speed during the descent.
Other flight crew procedures
The descent procedures applicable to the crew of VUE were described in the 737 Flight Crew Operations Manual (FCOM). These procedures specified the requirement for crews to conduct an ‘approach briefing’ prior to the top of descent. The VA Operating Policies and ProceduresManual stated that flight crews should conduct a review of threats as part of the arrival briefing, which is equivalent to the approach briefing.
The procedures for the threat and error management review stated that the purpose was to review potential threats and determine the best management strategy. The procedure identified possible threats, including significant weather, and noted that the identified list of threats was not exhaustive. The procedures did not identify overspeed as a possible threat.
During the descent into Adelaide, the flight crew briefly conducted a review of threats. The FO noted the potential threats of turbulence and exceedances. The crew did not observe any indications suggesting turbulence. However, when the FO mentioned the threat of exceedances, the captain made a strong informal interjection saying ‘Don’t exceed anything…’ The crew did not discuss these threats any further, nor did they discuss a management strategy.
Cabin crew briefings
VA procedures required the flight crew to brief the cabin crew at different stages of the flight, including pre-flight and at the top of descent. The procedures stated that the pre-flight briefing should include information about the en route weather, any special considerations, and any deviation from normal conditions. Similarly, the top of descent briefing was required to include information about the possibility of turbulence, adverse weather, likelihood of the seatbelt sign being activated early, and ‘other anticipated special considerations for descent, approach and arrival’.
The captain briefed the CS pre-flight, and before top of descent into Adelaide. Neither briefing mentioned the forecast clear air turbulence, nor was the possibility of turbulence otherwise indicated. The top of descent briefing did not mention the planned high-speed descent.
The cabin supervisor (CS) reported that their prior experience was that captains usually advised the cabin crew about planned high-speed descents. The CS perceived this was best practice as it allowed the cabin crew to have awareness of the changed descent conditions.
The ATSB also spoke to a senior pilot from VA about cabin crew briefings for high-speed descents. That pilot reported that it was not typical for captains to brief cabin crew about a planned high-speed descent, and explained that in many cases, ATC issue clearance for high-speed descent after the top of descent. The procedures did not include a requirement to include planned high-speed descent in cabin crew briefings.
The ATSB does not draw an inference from the absence of information about the high-speed descent from the top of descent briefing. However, as expanded on in Unsecured cabin crew, cabin crew are reliant on the pilots for information about the descent conditions, and in this instance the cabin crew had no opportunity to modify their procedures during the descent.
Cabin crew procedures
Normal cabin preparation for landing
VA cabin crew procedures stated that the flight crew would make the ‘cabin crew prepare for landing’ announcement 10 minutes before the crew were required to be seated for landing, and that this would be at about 20,000 ft or higher for 737 aircraft. Cabin crew were then required to:
cease all service involving carts
secure their area of responsibility, including cabin and galley areas.
Toilets could still be used at this time.
The procedures required the PM to activate the fasten seat belt sign at transition level[11] or 10,000 ft, whichever occurred first. After the PM had switched on the fasten seat belt sign, the procedures were for the cabin crew leader to then make the ‘seat belt sign for landing’ announcement. Cabin crew were then required to:
check their area of responsibility and ensure passenger seat belts are fastened, toilets are locked, and personal electronic devices are away.
return to their seat within one minute and be secured for landing including using a shoulder harness.
Prior to the sudden changes in pitch attitude, the ‘cabin crew prepare for landing’ announcement had been made, and the cabin crew had performed the duties required following that. The flight crew had not turned on the fasten seat belt sign, and there was no requirement for the cabin crew to be seated. The sudden pitch changes occurred about 7 minutes after the flight crew made the ‘cabin crew prepare for landing’ announcement.
The ATSB also sought to identify when the seatbelt sign was activated after the overspeed and sudden pitch changes. At interview, the captain reported believing the seatbelt sign was activated immediately after the sudden pitch changes. However, both the CS and the injured cabin crew member said that they observed the seatbelt sign remain off throughout the descent. The FO reported not being able to recall whether the seatbelt light was turned on immediately after the sudden pitch changes or later in the descent.
The illumination of seatbelt sign was not a parameter recorded on either the FDR or the QAR. However, when the seatbelt sign is turned on or off, a distinct audible tone is produced. The prescribed standards for Airborne Passenger Address Amplifiers are for the activation of the seatbelt sign to be associated with a single 494 Hz low tone (equivalent to musical note B). Other signals are associated with a high tone (587 Hz), and combinations of high and low tones.
The ATSB review of the CVR identified a single low tone, consistent with the activation of the seatbelt sign, at 1659:30. This was after the sudden pitch changes, and consistent with the pilots expressing the intent to turn the seatbelt sign on.
Cabin preparation in turbulent conditions
The VA Aircrew Emergency Procedures Manual described procedures for situations when pilots expected turbulence based on information from sources such as the Bureau of Meteorology, weather radar, ATC and reports from other aircraft. If the flight crew judged that turbulence was likely, they were required to inform the cabin crew during the briefings or another suitable time. The pilots were required to activate the fasten seat belt signs no later than one minute prior to the anticipated turbulence.
When turbulence was expected, the procedures instructed cabin crew to prioritise personal safety, and to not risk personal injury by continuing service. During actual turbulence, the procedures said cabin crew should secure themselves by sitting down or holding on to seat backs, evacuation handles or grab handles, where possible.
Because the descent conditions were smooth, and the captain did not perceive there was a risk of turbulence, the pilots did not turn on the fasten seat belt signs.
Stowage of oxygen bottles
The VA Aircrew Emergency Procedures Manual stated that on-board oxygen bottles could be used for a first aid situation. During landing, the procedures said that the oxygen bottles should be secured under a seat. These procedures also specified ‘precautions’ about the use of oxygen bottles, including ‘do not drop or bump oxygen bottle’.
The cabin crew related that their training had emphasised the importance of properly stowing portable oxygen bottles during approach and landing. However, they were unable to comply with the procedures on this occasion, because the injured cabin crew member was not able to move into a seated position. The injured cabin crew member reported maintaining a firm grip on the oxygen bottle during the approach and landing.
The ATSB sought information from the aircraft manufacturer in relation to securing oxygen bottles during landing. The manufacturer subsequently provided the following guidance:
If the condition does not allow proper stowage, the oxygen bottles have shoulder straps that can provide some level of containment.
For a condition where a cabin crew member could not be seated for landing, the crew member should position themselves against structure forward of their position for support in any deceleration condition associated with landing.
The operator can evaluate their own configuration and determine the best course of action for the situation encountered in the occurrence.
Cabin crew incapacitation
The VA Cabin Crew Policy and Procedures Manual described procedures for managing cabin crew member incapacitation. Cabin crew were required to administer first aid, advise the CS and flight crew as soon as possible and place the crew member in a non-exit row passenger seat. The procedure was to then liaise with the captain on positional changes and alternate procedures for landing and reassign cabin duties based on the captain’s instructions. The procedures also included instructions for a single cabin crew member to operate two exit doors in these situations. The CS recalled VA cabin crew emergency procedures training was based on a single incapacitation. The CS said that scenario-based training for multiple incapacitation would have assisted the CS’ response to the accident.
Following the overspeed and cabin injuries, the CS advised the flight crew that the injured crew member was unable to move into an aircraft seat, and that the remaining crew would be repositioned to monitor the rear doors and the injured cabin crew member. The flight crew considered this information during the approach and landing, with the captain saying to the FO ‘Try to make it as smooth as possible. Try not to hit on the brakes too hard. I think (the injured cabin crew member) may still be on the floor’.
Management of injured persons at Adelaide Airport
Adelaide Airport Aerodrome Emergency Plan
The Adelaide Airport Aerodrome Emergency Plan (AEP) provided guidelines to co-ordinate response to and recovery from emergencies at the airport. The medical emergency procedures included that the SA Ambulance Service (SAAS) was the control agency. This means that SAAS were responsible for the overall direction of the activities associated with the response, including tasking and co-ordinating other agencies.
For medical emergencies, the AEP included procedures for notifying airport management, SAAS and Aviation Rescue Firefighting (ARFF). The AEP stated that ‘the plan is based on the assumption that each agency with a statutory responsibility has in place appropriate supporting procedures which deals with that agency’s response in accordance with this plan’.
Adelaide Airport also had procedures and plans related to co-ordinating ambulance access airside. In these procedures, airlines and the SAAS were to notify Adelaide Airport. An airport operations officer could then arrange for an escort from the airport emergency gate to the airside location.
Adelaide Airport advised that there were no entries made in their operations logs in relation to the accident, with the implication being that Adelaide Airport emergency operations personnel had not been alerted to the situation. Adelaide Airport personnel were not requested to arrange for airside ambulance access to VUE.
Relevant VA procedures and context
The VA Guest Services Procedures Manual contained procedures for medical emergencies ‘In Flight or Aircraft Not Parked at Terminal’. These included procedures for the flight crew to contact the medical information provider Medlink, so that Medlink could support the assessment and treatment of the affected persons. During this occurrence, the flight crew determined that it was appropriate to prioritise the descent and landing, so Medlink was not contacted at any stage.
The manual also included procedures for co-ordinating disembarkation, which were that:
The AMCO (Airport movement coordinator)/Airport Manager/attending medical personnel, in consultation with the pilot-in-command, will decide the method of disembarkation and which door the guests are to disembark from that will allow the medical team to, where required, gain immediate access to the person requiring medical assistance.
For this occurrence, the flight crew were not involved in consultation with the medical personnel about the extraction of the injured cabin crew. The captain perceived that with emergency services personnel, cabin crew and the ground operations supervisor in the rear cabin, there was not enough room for him, and also that the attending personnel were managing the situation.
VA advised the ATSB that in the event of a medical emergency response, once the ARFF personnel arrived on scene, VA personnel were no longer involved in the decision making around extraction of injured persons.
The ARFF officers asked the VA ground operations supervisor about access to a scissor lift or a catering truck. The ground operation supervisor identified that there was no scissor lift available and told the ARFF approval was not given for the use of the catering truck. In interview, the ground operations supervisor related that their concerns about using the catering truck included:
The catering truck was not VA equipment and was operated by a contractor.
The use of the catering truck was not part of VA ground handling procedures.
The ground operations supervisor had never heard of the catering truck being used for the purpose of removing an injured person from an aircraft.
The ground operations supervisor perceived that there was a significant fall from height risk. The normal operation of the catering truck involved the use of harnesses. The ground handling supervisor also said that from its ‘lowered’ position, there is around 1.5 m from the catering truck platform to the ground.
The ground operations supervisor perceived that working from heights risks were a main safety focus for VA ground operations. The ground operations supervisor had concerns about what would happen if the injured cabin crew member fell during a lift onto a catering truck, from the perspective of the injured cabin crew being seriously injured and also in terms of repercussions for the ground operations supervisor. The ground operations supervisor recalled a previous incident where someone was injured falling from an aircraft, which added to the concern about the fall from heights risk.
The ground operations supervisor also related that, at around the time the request to use the catering truck was made, the ambulance officers were on-board the aircraft. The ground operations supervisor perceived that the ambulance officers had control of the situation and the injured cabin crew member was in a stable condition. Also perceiving that the emergency services personnel were working towards a plan for the extraction from the aircraft, the ground operations supervisor did not consider it was necessary to explore further the option of arranging the catering truck.
Airport Rescue and Fire Fighting procedures
During an emergency response, ARFF provided first aid to injured persons until ambulance personnel arrive. Once the ambulance personnel are on-site, ARFF procedures were to hand over treatment and management of any casualties.
The ARFF personnel reported they had previously used scissor lift and catering truck appliances in similar situations, and perceived that this would be appropriate for removing the injured cabin crew member. However, this option was not given further consideration after the VA ground services manager denied the request.
ARFF reported that their officers did not assist with the removal of the injured cabin crew member. The ARFF officers handed over treatment and management of the injured cabin crew member to the SAAS and followed the direction of SAAS thereafter.
Previous occurrences
The ATSB reviewed recent accidents involving cabin crew injuries resulting from manual flight control inputs to prevent overspeed during descent. The following four examples were identified which show themes in the development and consequences in these accidents. This is not an exhaustive set of all similar accidents in the time period.
AO-2014-032 In-flight upset, inadvertent pitch disconnect, and continued operation with serious damage involving ATR 72 aircraft, VH-FVR, 47 km WSW of Sydney Airport, NSW, on 20 February 2014. In this occurrence, a rapidly decreasing tailwind lead to an increase in airspeed towards VMO. In response to the unexpectedly high airspeed trend indication and proximity to VMO, the captain made nose-up pitch commands without following the take-over procedure. The aircraft pitched up and down suddenly, and a cabin crew member in the rear of the cabin suffered a broken leg.
AO-2015-041 Flight path management occurrence involving Boeing 737, VH-YID, 55 km from Adelaide Airport, South Australia, on 9 May 2015. During a high-speed descent, the airspeed increased towards VMO. The first officer responded to the unintended speed increase by pulling back on the control column until the autopilot entered a secondary mode. There was a sudden release of the control column, and one cabin crew member in the rear of the aircraft fell, sustaining a knee injury.
AAIB investigation into Boeing 737-8AS, Serious injury to cabin crew, during descent to Manchester Airport, United Kingdom, on 14 January 2017. During a high-speed descent, a decrease in tailwind contributed to a VMO overspeed. Because the captain perceived that the autopilot was not correcting the situation, the captain disengaged the autopilot using the autopilot disengage button, and pulled back on the control column. During the accident investigation, the captain reported pulling back with more force than intended. The aircraft experienced abrupt pitch changes and one cabin crew member in the rear of the aircraft suffered a fractured ankle.
AO-2017-030 Flight path management occurrence involving Boeing 737, VH-VZZ, near Canberra Airport, ACT, on 13 March 2017. During a high-speed descent, a sudden decrease in tailwind contributed to an increase in airspeed towards VMO. The pilot flying pulled back on the control column, causing the autopilot to disconnect. The aircraft experienced sudden pitch changes, and a cabin crew member in the rear of the aircraft suffered a fractured leg.
As this summary indicates, overspeed is a risk during high-speed descent, particularly if the aircraft encounters a sudden change in wind. Pilots have responded to overspeeds by making large pull-back control forces. As highlighted in this accident and the summarised previous occurrences, the application of large control forces to correct or prevent overspeed can cause significant injuries in the cabin.
Previous VA overspeeds and autopilot disconnects
The ATSB reviewed data from other overspeed events involving VA 737s in the years prior to the occurrence. VA provided summary details of flight data from all VA 737 flights from 2014-2017, where airspeed exceeded VMO. This showed numerous overspeed exceedances, none of which involved a maximum airspeed above 359 kt, so none required a maintenance inspection.
VA also extracted data to describe 737 flights from the same period where the airspeed from top of descent to FL 50 was between 319 kt and 339 kt, to understand the actions of pilots attempting to control speed close to VMO In its internal investigation report, VA observed that ‘the data demonstrates in the last three years B737 pilots have entered CWS Pitch or manual control in an attempt to avoid a VMO/MMO exceedance or to rapidly decelerate below it.’ The data did not indicate the portion of these events where the autopilot was disengaged using the dedicated controls compared to flight control pull-through.
During a high-speed descent, the airspeed of VH-VUE increased unexpectedly and briefly exceeded the VMO limit of 340 kt. This was contrary to the operating procedures provided by the manufacturer and the operator, and contrary to the intentions of the flight crew. The captain responded to the sudden increase in airspeed by pulling back on the control column causing the autopilot to disconnect. This caused pitch changes that resulted in large changes to vertical acceleration and injuries to cabin crew at the rear of the aircraft.
The recorded data showed the development of the pitch changes was sudden, and that the onset coincided with the autopilot disconnect. The pitch changes dissipated after the large control inputs had ceased. From this, the ATSB determined that it was highly unlikely that atmospheric turbulence caused the pitch changes.
Although VMO was exceeded, it was not by an amount that required any structural inspections to ensure the ongoing airworthiness of the aircraft, according to 737 maintenance manual. The captain’s intervention probably reduced the magnitude of the eventual overspeed, and it is unknown to what extent the aircraft would have exceeded VMO had the captain not intervened. However, the recorded data indicated that the autopilot was responding to the speed increase by raising the pitch of the aircraft. Furthermore, the pilots could have used the autopilot disengage controls rather than applying breakout force and could have reduced the aircraft speed using the speed brakes.
Therefore, the safety hazards involved in this accident were primarily associated with how the captain acted to prevent overspeed, and the consequent effects of vertical acceleration on the aircraft and its occupants.
Development of the overspeed
The flight crew accepted an instruction from air traffic control to perform a high-speed descent. Accepting a high-speed descent instruction was not unusual, and the ATSB did not find that the issuance or acceptance of a high-speed descent were factors that increased risk. However, targeting a higher descent speed reduces the margin between the target airspeed and airspeed limitations, and the risk of injury due to sudden control inputs will increase due to higher speed and increased kinetic energy.
The flight crew managed the descent using level change autopilot mode, with intermittent use of the vertical speed command mode. This was generally consistent with procedures and airspeed was generally stable at 320 kt during the early descent.
However, about 30 seconds after the turn towards COMLY, when VUE was descending through around 17,000 ft, a sudden decrease in tailwind associated with a windshear encounter led to a rapid increase in airspeed.
After observing the speed increase and trend towards the maximum operating speed (VMO), the first officer (FO) changed the autopilot mode from level change to vertical speed. This is commonly used by flight crew to reduce the airspeed because, in a descent, reducing the vertical speed raises the nose of the aircraft, which consequently also reduces the aircraft’s airspeed. This was also consistent with the procedures in the Flight Crew Training Manual, and bulletins produced by the operator.
However, vertical speed mode does not directly control the aircraft’s speed, and if a windshear results in a large and rapid airspeed change, it may not provide sufficient speed control. Use of control modes that directly control the airspeed, such as the level change mode, allow the aircraft to respond directly to the airspeed changes. This is why the automatic speed protection will change from vertical speed to level change mode. Noting, however, that for very rapid wind changes, as was seen on this occasion, even the automatic flight director system (AFDS) may not be able to prevent an overspeed.
A few seconds later, the captain, who was pilot monitoring (PM) responded to the increasing airspeed by pulling back on the control column, which resulted in the autopilot disconnecting. Two seconds after the autopilot disconnect, the VMO was exceeded by one knot.
Neither crew member applied the speed brakes to prevent the speed increase, nor during recovery from the overspeed. Although they need to be applied with care at high speed, the use of speed brakes would have reduced the likelihood of an overspeed without generating large flight loads and pitching motions.
Intervention to correct speed increase
The captain responded to the unexpected speed increase by pulling back firmly and abruptly on the control column to raise the pitch attitude of the aircraft’s nose. The captain took manual control of the aircraft without notifying the FO (who was pilot flying). This was not consistent with the normal process for handover and takeover. In situations where the pilot monitoring (not flying) perceives immediate action is required to avoid a hazardous situation, there will be a tendency for the transfer of control to happen more rapidly. However, it is still important for flight crew to formally identify who has control, to maintain clarity of the pilots’ roles.
Perceived urgency and lack of autopilot control
The large pull-back control input caused an autopilot disconnect and sudden changes in pitch attitude, resulting in injuries to the cabin crew.
The initial forceful pull back on the control column was in response to what the captain perceived to be a situation involving a nose-down attitude and an unexpectedly high airspeed indication. The sudden pull-back movement was a reflexive application of well-rehearsed basic flying principles, being consistent with an attempt to raise the nose of the aircraft, rather than an explicit attempt to disconnect the autopilot.
The captain indicated at interview that their pull on the control column was more forceful than planned. Consistent with this, the 49 lb backwards force applied by the captain is a large amount of force for a pitch up manoeuvre during high-speed flight and was not consistent with procedures that cautioned against making large control inputs during high-speed, high-altitude flight.
The ATSB considered the reasons for the captain’s large control input and the absent transfer of control. When the captain saw the airspeed increasing unexpectedly and approaching VMO, the captain perceived that the autopilot was not controlling the aircraft, and that an urgent intervention was necessary. The captain related this response to a reflex, impulsive response, with the implication being the action was rapid and without conscious deliberation.
It is likely that the captain’s perception of urgency affected how the captain responded to the sudden speed increase, and contributed to the captain responding rapidly, with a low level of conscious analysis. Research shows that when individuals perceive they need to respond rapidly to a situation, they tend to consider fewer options and less information (Dismukes, Goldsmith, & Kochan, 2015) and typically use rapid, associative and unconscious information processing, which is primarily influenced by pre-existing knowledge and beliefs (Klein, 2008). Research summarised by Means, Salas, Crandall and Jacobs (1993) suggests that in real-world settings, there is a speed/accuracy trade-off between rapid intuitive decisions and more time-consuming analytical decision making.
Other research describes how individuals interact with control systems changes depending on the perceived time available. According to Hollnagel (1998), where the individual perceives there is a large amount of time, he or she is able to look ahead and think about higher level goals. The individual can sample a large amount of information, and feed-forward to test the effect of actions. However, when the individual perceives he or she has little or no time, the most obvious feature of the environment and the immediate needs of the situation will dominate the choice of action. There is no planning or analysis; the individual is essentially seeing and responding.
It was evident that the captain of VUE perceived there was no time to evaluate the sudden airspeed increase and needed to respond urgently because of a perception that the autopilot was not controlling the aircraft. While an overspeed event may not be desirable, this perception to respond urgently was inconsistent with the documentation provided by the manufacturer and the operator about the aircraft safety around VMO. Overall, the documentation implied that minor exceedances of VMO were not hazardous to the safety of the aircraft.
Concerns and beliefs about overspeed
The captain was highly concerned about overspeed, and this probably contributed to the captain’s assessment that the increase in airspeed towards VMO meant the aircraft was not in a controlled state, and that urgent action was necessary. The captain was mindful of avoiding overspeed during the descent and made several comments to the FO along the lines of ‘don’t overspeed’.
The captain’s concerns about avoiding overspeed were influenced by a perception that Virgin Australia (VA) were also concerned about overspeed and wanted to reduce overspeed events. The captain reported hearing rumours that other VA crews had been subject to some form of management review after experiencing overspeeds. Although VA had changed their management of overspeed events prior to the occurrence, it is unknown how flight crew understood these changes. In this event, it is possible that the captain’s concerns about overspeed were a carry-over from the operator’s previous management of overspeed events.
The captain’s concern about the increase in airspeed towards VMO was also influenced by perceptions and beliefs about the airspeed limits of the aircraft. The captain indicated not being aware that there was a margin between VMO and the requirement for a maintenance inspection at 359 kt, or that there was a margin between VMO and the structural limitations of the aircraft.
Influence of the speed trend vector
The speed trend vector is located on the same instrument display as the airspeed indicator. In this case, the FO reported observing the trend indicator moving towards the maximum operating speed (VMO). However, the trend indicator is not a recorded parameter in the flight data recorder, so the ATSB was unable to determine what the speed trend vector showed during the development of the overspeed. The captain reported not specifically looking at the speed trend vector prior to making the abrupt control input. While it is possible the captain’s perception of urgency was influenced by a high airspeed trend projection while observing the airspeed indicator, there was no direct evidence of this effect.
A previous ATSB investigation (AO-2014-032) found that in that instance, the speed trend vector probably indicated a projected speed well above VMO. The investigation found that the captain responded to the high trend airspeed indication by perceiving a need to intervene immediately and made pitch control inputs without following the normal take-over procedure.
Flight crew risk planning and descent preparation
As highlighted in this occurrence, pilots’ management of unexpected events or hazards during descent can be fraught with risk. The descent phase of flight is complex, and there are multiple considerations for the flight crew to manage. Pilots’ ability to manage threats is complicated by perceptions of urgency or threat to the aircraft. In these circumstances, pilots are more likely to use rapid, associative modes of response, rather than planned and analytical behaviours.
Explicit consideration and management of threats is likely to mitigate the known limitations of decision making in real-world settings. The value of formal threat review procedures, in which threats and their responses are deliberately considered ahead of encountering them, is that this removes the requirement to think and act in a time-pressured, tightly coupled setting. By considering potential threats at an earlier stage in flight, threat reviews also allow flight crews to make tactical adjustments, and to observe the effects. When pilots identify potential actions prior to being in a perceived emergency, they can also think through the implications of those actions as a crew. The FAA Aeronautical Decision Making (ADM) educational material provides further support for how threat identification and planning can help address some of these biases and tendencies in decision making.
In this occurrence, the flight crew did not effectively prepare for the risk of overspeed in the arrival briefing. Although the pilots identified overspeed was a potential risk during the high-speed descent, they did not discuss what the implications of an overspeed would be, or what actions they would take if speed started to increase unexpectedly. The crew did not elaborate about the risk of overspeed, apart from the captain saying ‘don’t exceed anything’. This was contrary to the intentions of the procedures, which indicated flight crews were to discuss threats and their management at the top of descent.
Other than the formal procedural control of the threat and error management review, there were other opportunities for the crew to think about the management of a potential overspeed at an earlier stage of the flight. The crew were evidently aware of the risk of overspeed throughout the descent, with the captain saying to the FO ‘don’t overspeed’ on several occasions, and the FO remarking that the autopilot was not very effective at holding the speed steady. Although the FO expressed a plan to reduce the target speed during the descent, there was no discussion of what the crew would do if that did not have the desired effect, or if the airspeed exceeded VMO.
Overall, this was a lost opportunity for the flight crew to effectively manage the risk of overspeed. The pilots were in a position where they had time and space to think about a potential overspeed as a crew. At the top of descent, the pilots could consider the tolerances of the aircraft to airspeed exceedances, and how they could respond safely given the high-energy state of the aircraft.
However, as the aircraft continued the descent and operated close to VMO, the time available to the flight crew reduced. When the captain saw the airspeed suddenly increase, the captain perceived the crew were in a position where there was no time to discuss the situation with the FO, to think about the implications of the overspeed, or to consider the consequences of the pull-back control action. In this way, the absence of planning at an earlier stage in the descent affected how the captain managed the risk of overspeed during the occurrence and increased the risk of unsafe intervention.
Unsecured cabin crew
Seatbelts are a very effective defence against injuries during events where cabin occupants are affected by upset forces. Analysis by the FAA shows that from 1980-2003, there were only four cases of serious injuries on United States carriers during turbulence accidents where the injured person was seated with seatbelts fastened.[12] Conversely, the FAA says that around 58 people are injured each year by turbulence while not wearing seatbelts. Consequently, procedures that require the use of seatbelts, and other methods to secure cabin occupants, are the primary means of preventing injuries during these types of events. The cabin crew were not secured prior to the sudden change in pitch attitude, which increased the likelihood of injuries.
There is a regulatory requirement for cabin crew and passengers to be seated with seatbelts fastened in turbulent conditions,[13] and procedures required the pilots to brief the cabin crew about expected turbulence during both the pre-flight and top of descent briefings. However, neither of the briefings included the forecast clear air turbulence.
Cabin crew briefings are important defences for the safe preparation of the cabin, to mitigate the risk of injury. The cabin crew do not have access to meteorological information or other indications about what is likely to happen in the descent, and therefore their ability to adequately prepare for turbulence is dependent on the information provided by the pilots. When cabin crew are adequately briefed, they can modify their duties and take other steps, such as ensuring they are seated as early as possible. Because the cabin crew were not aware of the forecast clear air turbulence, they had no ability to modify their procedures.
The ATSB considered the influence of the briefings on the injuries sustained by the cabin crew. Although the flight crew reported that they were aware of forecast moderate clear air turbulence during the descent, they perceived the conditions as smooth, and noted that there had been no returns on the aircraft weather radar. Based on the information available to him, the captain did not perceive that a turbulence encounter was likely. The injury to the cabin crew was not caused by a clear air turbulence encounter. Therefore, although the absence of briefing information about the forecast clear air turbulence was not helpful for the ability of the cabin crew to prepare for descent, this did not contribute to the injuries sustained in the accident.
During this occurrence, the ‘cabin crew prepare for landing’ announcement was made about 7 minutes before the sudden changes in pitch attitude, and the fasten seat belt signs had not been turned on. This meant that, based on normal procedures, there was no requirement or expectation from the cabin crew that they should be seated.
Delayed removal of injured cabin crew from aircraft
Defences that assist in the recovery from incidents and accidents form part of the overall safety systems for planned operations into aerodromes. For accidents involving injuries to aircraft occupants, an effective safety system should include the ability to extract casualties from aircraft. Although the use of the slide sheet was not typical, there was no evidence of any safety issues posed by this method. However, the ATSB did consider that the time taken to extract the cabin crew as indicative of a delayed response to the accident. After the arrival of VUE at Adelaide, it took over 90 minutes for the injured cabin crew to be removed from the aircraft and taken to hospital.
The communication between the crew, VA, Airport Rescue and Firefighting (ARFF) and SA Ambulance Service (SAAS) was generally effective and emergency services were notified promptly after the accident. The SAAS crew did not utilise the emergency gate to access the aircraft, because they were directed to the main terminal by ARFF. While the ARFF were at the gate when VUE arrived, the SAAS arrived shortly after. However, there was no evidence that the non-use of the emergency gate affected the timing of the response. As such, the delays associated with removing the injured cabin crew member from the aircraft were related to the on-board co-ordination of the extraction.
The main factor that complicated the extraction of the injured cabin crew was the decision by the VA ground operations supervisor to deny the request to use the catering truck. The ARFF utilise the available resources dependent on the needs of a situation, and the attending firefighters had experience using catering truck vehicles in situations like the occurrence. The ARFF had a reasonable expectation that a catering truck would be made available to them upon request.
The ground operations supervisor performs a defined role within the overall context of the normal airline operations, and the ground operations supervisor’s decision making authority is typically constrained to this role. It is not typical for the ground operations supervisor to make decisions or accept perceived risks relating to departures from procedures. In this context, it is understandable that the ground operations supervisor would be hesitant to grant permission to use equipment owned and operated by another company, which they had no experience using, and which they perceived involved a risk of injury.
On this occasion, the decision making about utilising the catering truck could have been supported by guidance from more senior personnel within VA operations, such as the flight crew. However, the flight crew did not enter the cabin after the aircraft landed, and the ground operations supervisor did not perceive there to be a need to seek their advice, as the ground operations supervisor considered the cabin crew’s condition was being managed by the ambulance officers.
Additionally, within the context of an emergency response, control agencies have a responsibility to exercise authority to task and direct individuals. There must be absolute clarity over who has control of an incident response, and the requirement of other personnel to follow directions. The Adelaide Airport Aerodrome Emergency Plan identified the SAAS as the control authority for a medical emergency. However, ambulance personnel are not likely to have extensive experience in working in and around aircraft, or to be familiar with the aerodrome emergency plans. Ambulance personnel will probably rely on the advice of ARFF and other aviation personnel to identify suitable and available equipment.
The ATSB considers that the overall response by attending personnel, including the response to the request for use of the catering truck, was indicative of a lack of clarity of control responsibility. Agencies involved in the aerodrome safety system at Adelaide Airport may consider additional methods to ensure a shared understanding of the structure of control and authority in medical emergencies.
With the ARFF and ambulance personnel on site, it is likely that the extraction of the injured cabin crew could have been escalated if there was a critical need. While the delayed extraction did not increase safety risk in this instance, the ATSB considers there are opportunities to improve how airside personnel work with emergency services.
From the evidence available, the following findings are made with respect to the overspeed and cabin crew injury involving Boeing 737, VH-VUE, 42 NM east-south-east of Adelaide Airport, South Australia, on 13 September 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
During a high-speed descent, a sudden decrease in tailwind associated with windshear caused airspeed to approach and exceed the aircraft maximum operating speed (VMO). The flight crew did not apply speed brakes to arrest the speed increase.
In response to the airspeed rapidly increasing towards VMO, the captain (pilot monitoring) perceived a need to immediately intervene and made pitch control inputs without following the normal take-over procedure and alerting the first officer (pilot flying).
The magnitude of the captain's control input was probably greater than intended. This was influenced by a perception that the autopilot was not controlling the aircraft, so an urgent intervention was required. The magnitude of the control input caused sudden pitch changes, resulting in the injuries to the cabin crew.
Although the flight crew identified the risk of overspeed during the high-speed descent into Adelaide, they did not consider steps for mitigating that risk, or how they would manage an overspeed during the descent. This reduced the likelihood of the crew effectively responding to the unexpected increase in airspeed.
Other findings
Although the weather forecast included moderate clear air turbulence and the aircraft was making a high-speed descent, the pilots perceived that flying conditions were smooth and elected not to activate the fasten seat belt sign. The cabin crew briefings did not mention the forecast clear air turbulence. The cabin crew were not secured prior to the sudden pitch changes, which increased the likelihood of injuries.
The ground handling supervisor assessed there was a significant fall from height risk associated with the unsecured use of the catering truck. For that reason, the ground handling supervisor did not agree to the emergency services request to use that equipment to remove the injured cabin crew.
Safety issues and actions
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
The captain and the first officer (FO) of VH-VUE both underwent training and assessment after the accident. This included a review of the flight data from the accident flight, the autopilot management and other recovery techniques during that flight, as well as the correct recovery actions from an overspeed. Both pilots were assessed as having demonstrated a competent standard during these reviews.
Virgin Australia (VA) have provided pilots with additional training and information about overspeed, overspeed prevention and overspeed recovery:
In 2018, VA pilots were shown animations demonstrating mishandled and correct overspeed recoveries. VA will also include the accident occurrence as part of future non-technical skills training for pilots and cabin crew.
The Flight Crew Information Manual was updated to include a section on ‘Managing VMO/MMO Exceedances’. This section stated that aircraft have been tested beyond VMO/MMO, and that these speeds include a margin below the speeds that require maintenance action or threaten the structure of the aircraft. The manual also stated that it is acceptable to refuse an ATC instruction to perform a high-speed descent. The manual identified that disengaging the autopilot to respond to an overspeed may result in abrupt pitch change.
A Flight Crew Information Bulleting (FCIB) was sent to VA 737 pilots identifying that there had been many instances where pilots had manually intervened to respond to an overspeed or possible overspeed, and that several of these events had resulted in serious injuries. The FCIB provided information to pilots including that VMO/MMO are not never exceed speeds, and that it is acceptable to refuse an instruction to conduct a high-speed descent. The FCIB emphasised that it is preferable to accept a temporary overspeed than to make large abrupt control inputs.
An email was sent to all VA 737 flight crew, reiterating much of the information covered in the other material. This email also identified the actions pilots should apply if they allowed the autopilot to recover the overspeed, but perceived speed continue to increase or that the autopilot was not handing the situation. These procedures were to hold the control wheel and ensure there is no back pressure being applied to the controls, disengage the autopilot, then slowly raise the nose of the aircraft.
Virgin Australia have updated materials provided to ground handling staff and other personnel working airside. The updated procedures say that in situations where emergency services are in attendance, VA team members should follow reasonable directions from those agencies. Where VA team members are in doubt, the updated procedures say they should liaise with the captain, on-board cabin crew leader or airport manager, as applicable.
To respond to the perceptions within the pilot group and to further educate flight crew about management of flight safety events and the how the flight data analysis program (FDAP) worked, VA pilots undertook non-technical skills training on the FDAP during 2018/19, and senior members of the VA flight operations and safety team conducted roadshows on the management of safety events during the same period.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Interviews with personnel including the flight crew and members of the cabin crew
Recorded information from on-board recorders
Meteorological information from the day of the accident
Records from emergency services operators
Manuals and other documentation related to flight crew, cabin crew and ground crew procedures
Expert analysis provided by the aircraft manufacturer.
Dismukes, R. K., Goldsmith, T. E., & Kochan, J. A. (2015). Effects of Acute Stress on Aircrew Performance: Literature Review and Analysis of Operational Aspects. Moffett Field, CA: National Aeronautics and Space Administration.
Hollnagel, E. (1998). Context, cognition, and control. In Y. Waern, Co-operation in process management - Cognition and information technology. London: Taylor and Francis.
Klein, G. (2008). Naturalistic decision making. Human Factors, 50(3), 456-460.
Means, B., Salas, E., Crandall, B., & Jacobs, T. O. (1993). Training decision makers for the real world. In G. Klein, J. Orasanu, R. Calderwood, & C. E. Zsambok, Decision making in action: Models and methods (pp. 305-326). Norwood, NJ: Ablex.
Reason, J. (1990). Human Error. Cambridge: Cambridge University Press.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Virgin Australia, Boeing, Airservices Australia, Adelaide Airport, SA Ambulance Service, the Civil Aviation Safety Authority, the captain, the first officer, the cabin crew on board VH-VUE, and the Virgin Australia ground supervisor.
Submissions were received from Virgin Australia, Boeing, the cabin supervisor and the cabin crewmember who sustained the broken leg. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – DRINA NINE ALPHA STAR
Figure A: DRINA NINE ALPHA STAR
Source: Airservices Australia
Appendix B – Flight data recorder data
Figure 11: Selected parameters during descent
Source: ATSB
Appendix C – Significant weather chart
Figure C: Significant weather chart for Australia, FL 100-250. This chart was valid 0600 UTC and used for operations three hours either side of that time. The red line shows the flight planned route of VH-VUE. A body of clear air turbulence is indicated by the long-dash line, and affects the planned route, to the west of the 140° meridian of longitude.
Source: Virgin Australia, originally produced by Bureau of Meteorology
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 0945 Eastern Standard Time[1] on 26 August 2017, Queensland Rail (QR) suburban passenger train 1A21, travelling to Shorncliffe on the out-bound suburban line, approached Bowen Hills station.
The signal prior to the station (ME19) displayed a restricted indication (double yellow aspect)[2] for the driver. The Automatic Warning System (AWS)[3] generated an in-cab alert to the driver of the restricted signal indication ahead. The driver acknowledged the AWS and readied the train for the station stop at No.2 platform Bowen Hills.
Mid-way along the platform, the AWS activated again, indicating the next signal at the end of No.2 platform (ME25) was also displaying a restricted indication (single yellow aspect).[4] The driver acknowledged the AWS, but at about that time his attention shifted to a person standing near the end of the platform. The driver, who had previously been exposed to people attempting self-harm, recalled experiencing an anxious moment as the train neared the person.
The driver stopped the train at the platform, but reported that he did not apply the required ‘Start on Yellow’ (SOY) procedure (brake controller to full service and reverser to neutral). This procedure compels the driver to re-check the departure signal indication prior to starting from the platform.
Following the receipt of ‘right-a-way’ from the guard, the driver started from the platform without checking the departure signal (ME25), overlooking the single yellow aspect warning that the next signal ahead (ME45) was displaying a red indication. After accelerating the train to the designated track speed of 30 km/h, the driver noticed temporary stop signs erected on both the adjacent in‑bound and out-bound main lines.
As the train traversed a sweeping right hand curve, the driver then observed maintenance staff working on the main lines (Figure 1). To warn the workers of the approaching train, the driver sounded the train horn on two occasions before one of the workers acknowledged him. As the train neared the workers and signal ME45, the AWS activated, warning the driver of the restricted signal indication (red aspect) ahead. The driver acknowledged the AWS, but did not respond to the signal. After passing the workers, the driver recalled looking ahead, sighting other maintenance staff in the distance, and then observing the red aspect of signal ME45. The driver responded by fully applying the train brake.
At 0948, as the train passed signal ME45, an alarm activated at the QR Rail Management Centre at Mayne. The network control officer overseeing that particular area broadcast an emergency radio message calling for the driver of 1A21 to stop.
On-board CCTV footage indicated the train was travelling at 32 km/h when the brakes were applied, with the train coming to a stop approximately 40 m beyond the signal. Due to the removal of the train’s event recorders for repair, there was no on-board data recording available to capture vehicle parameters, other than the CCTV footage.
In passing signal ME45, train 1A21 had entered into the limits of a Track Occupancy Authority (TOA). At the time of the occurrence, track workers were clear of the danger zone and the TOA was in the process of being suspended.
Figure 1: CCTV footage from the driving compartment of train 1A21
Image shows maintenance staff working on the Main Lines and signal ME45 in the foreground. Image supplied by Queensland Rail – Annotated by the ATSB.
Safety analysis
While perhaps influenced by the driver’s focus on a person near the end of the platform, not applying the ‘Start on Yellow’ procedure removed the requirement to assess signal ME25 (which was displaying a yellow indication) prior to departure. That in turn removed an opportunity for the driver to expect that signal ME45 would be displaying a red indication.
As the train traversed the sweeping curve, it is likely the driver’s attention was diverted from the primary task of observing signals toward other activities adjacent to the track. That may have influenced the driver’s inappropriate response to the AWS indication and led to the train passing the signal at STOP.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Due possibly to distraction, the driver did not apply the applicable procedures relevant to the restricted indication displayed at signal ME25 prior to departing the platform, therefore missing vital information concerning the aspect status of signal ME45.
The driver’s attention was likely focussed on peripheral trackside activity as the train approached signal ME45, distracting him from the primary task of observing signal indications.
Safety message
Train drivers are reminded that distraction while operating trains is a hazard which increases risk. To appropriately manage the risk, drivers are required to follow a robust risk-based approach. This includes applying applicable procedures and control measures.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 15 September 2017, the ATSB commenced an investigation into an aircraft loading event involving Saab 340, VH-ZRB, Sydney Airport, New South Wales on 14 September 2017.
The flight was originally planned to be conducted in a different aircraft, and the captain had advised the trim staff that 239 kg of freight could be loaded. There were subsequently two aircraft changes prior to departure. After the flight crew had been assigned VH-ZRB to conduct the flight, the captain advised the trim staff that the 239 kg of freight was not to be loaded on the aircraft due to weight limitations. The trim staff advised the baggage staff of the change.
There was subsequently a misunderstanding between the baggage staff and the loader, resulting in the loader believing that a barrow containing passenger baggage and freight was approved to be loaded on to VH-ZRB. Subsequent communications between the loader and the trim staff were not conducted in accordance with the operator’s loading and freight confirmation procedure, and the error was not detected until after the aircraft had departed. Subsequent calculations revealed that the aircraft departed Sydney about 77 kg over the aircraft’s maximum take-off weight.
The ATSB obtained the operator’s investigation report into the occurrence and related material, and reviewed previous loading occurrences involving the operator. Based on this information, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues. The ATSB has discontinued the investigation, but will continue to monitor loading occurrences involving all operators.
At about 1330 Eastern Standard Time (EST), on 4 September 2017, the flight crew of a PNG Air GIE Avions de Transport Regional ATR 72-212A aircraft, registered P2-ATR, prepared to operate passenger charter flight CG950 from Cairns, Queensland, to Lihir Island Airport,[1] Papua New Guinea. On board the aircraft were the captain, first officer, three cabin crew and 49 passengers.
While preparing for the flight, the flight crew noted the weather conditions included no significant cloud below 6,500 ft and visibility in excess of 10 km. The flight crew then contacted air traffic control (ATC) to obtain an airways clearance. The airways clearance included a departure from runway 33 via the CAIRNS TWO standard instrument departure (SID). This departure required the flight to maintain the runway track of 330° magnetic (M) until the aircraft climbed to an altitude of 500 ft above mean sea level (AMSL) and had passed the departure end of the runway. The SID then required the flight crew to turn the aircraft to a heading assigned by ATC which would be between 335°M and 070°M (Figure 1).
Figure 1: Cairns Two standard instrument departure
The figure shows the CAIRNS TWO departure including the direction to turn to an ATC assigned heading after passing the departure end of the runway (DER) and upon reaching 500ft. Source: Airservices Australia, annotated by ATSB.
After receiving the airways clearance, the flight crew identified the assigned heading segment of the SID. The captain noted that he had not previously departed using a SID with an assigned heading segment. The captain, acting as pilot flying,[2] elected to depart initially using the lateral navigation mode of the flight management system (FMS). Once the aircraft had climbed through 500 ft AMSL and had past the departure end of the runway, the captain planned to instruct the first officer to select the automatic flight control system (AFCS)[3] heading mode with the ATC assigned heading selected. The captain would then turn the aircraft to the heading assigned by ATC.
At 1344, the flight crew taxied the aircraft to runway 33 and reported being ready for departure. At 1345:07, ATC provided a take-off clearance to the flight crew with an assigned heading of 335°M. This was just a five degree right turn from the runway heading of 330°M. The captain selected the heading bug to 335 and entered the assigned heading using the scratch pad function of the control display unit of the FMS for later reference.
The take-off was conducted normally and as the aircraft climbed through 500 ft, the FMS, in lateral navigation mode, directed a right turn past the assigned heading. The captain followed the FMS direction and turned the aircraft right. As the aircraft turned to 335°M the FMS continued to command a right turn. The captain followed the FMS direction and continued the turn past the assigned heading (Figure 2).
Figure 2: Overview of departure
An overview of the initial departure showing both the assigned flight path and actual flown flight path. Source: Google earth, annotated by ATSB
As the aircraft climbed through about 700 ft, the captain instructed the first officer to select the heading mode of the AFCS with the assigned heading of 335°M selected. Recorded flight data showed that by this time, the aircraft had turned to a heading of 013°M. The AFCS then directed a left turn toward the assigned heading of 335°M. Both flight crew members immediately identified that they had turned past the assigned heading. The captain then began a left turn back to heading 335°M. At about the same time, ATC contacted the flight crew to confirm the assigned heading of 335°M. The flight crew responded confirming the assigned heading and continued the left turn to this heading.
At 1346:24, ATC contacted the flight crew again to confirm that operations were normal, and the flight crew confirmed that they were. ATC then cleared the flight to continue the departure visually on heading 335°M, without reference to the SID.
The flight continued to Lihir Island without further incident. No persons were injured, and the aircraft was not damaged during the incident.
Flight management system
The lateral navigation mode of the FMS provided flight path guidance along a series of pre-programmed waypoints. The aircraft manufacturer advised that when the FMS was programmed with the CAIRNS TWO SID from runway 33 and operated in lateral navigation mode, the system was programmed to maintain the runway track of 330°M until the aircraft climbed to 500 ft. For further track guidance, the continuing flight path needed to be managed by the flight crew.
In the absence of a manually programmed flight path, as in this incident, the SID navigation database within the FMS was programmed to command a turn to a heading of 025°M. This turn was presented to the flight crew on the aircraft’s navigation display prior to departure.
The heading mode of the AFCS provided means for the flight crew to manually select a desired, or ATC instructed, heading. Once activated, the heading mode provided flight director guidance to turn the aircraft to the selected heading.
Operator SID training
Cairns was the only airport in the operator’s network at which SIDs were used.[4]
The company conducted regular simulator training for flight crews at six monthly intervals. The training included departures involving SIDs. However, this training used SIDs that required navigating along a path of pre-programmed waypoints. In these cases, the FMS provided automated guidance.
The training did not include SIDs that involved an assigned heading component.
Captain comments
The captain provided the following comments:
The captain had not previously encountered a SID with an assigned heading component.
In future he will use the heading mode of the FMS for SIDs with an assigned heading component.
First officer comments
The first officer provided the following comments:
The flight crew were not expecting a 5-degree heading change. When assigned the heading, they did not recognise that the heading change was so minor.
The first officer had previously flown ATR72-212A aircraft for an Australian domestic operator and had flown SIDs extensively. In that role, she always conducted SIDs in heading mode.
Safety analysis
When preparing for the departure, the flight crew elected to use the lateral navigation mode of the FMS to provide flight path guidance instead of the more appropriate heading mode.
After take-off, the FMS directed a turn past the assigned heading of 335°M to a heading of 025°M. The flight crew initially followed this guidance, incorrectly turning the aircraft to a heading of 013°M before selecting heading mode and detecting the error. At about the same time, ATC observed the aircraft turning beyond the assigned heading and contacted the flight crew. The error was then managed by both ATC and the flight crew and the flight continued without further incident.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The selected FMS mode was inappropriate for the assigned departure and provided flight path guidance not aligned with the SID. The flight crew followed the guidance provided by the FMS before the error was identified and corrected.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
Flight crew education and training
Aircrew notices were circulated to all flight crew, providing education on SIDs and operations at Cairns.
The simulator training program has been changed to include a greater focus on SIDs and Cairns operations.
Aircraft manufacturer
As a result of this occurrence, the aircraft manufacturer, in coordination with the navigation database provider, has taken the following safety action:
Change to SID navigation database
To avoid a sharp right turn during a take-off using an incorrect AFCS mode, the runway 33 CAIRNS TWO SID navigation database commanded heading has been changed from 025°M to 335°M.
Safety message
This incident highlights the importance of effective use of flight management systems. Modern flight management systems, when used appropriately, can greatly reduce flight crew workload and provide increased levels of safety and efficiency. However, to effectively manage a modern aircraft, flight crews need to ensure they have a thorough understanding of the relevant flight management systems.
Also underlined is the need to effectively cross check flight instrumentation indications to ensure that the aircraft follows the intended flight path. The United States Federal Aviation Administration publication: Advanced Avionics Handbook, Chapter four Automated Flight Control provides the following guidance for effective use of the flight director:
The convenience of flight director cues can invite fixation or over reliance on the part of the pilot. As with all automated systems, you must remain aware of the overall situation. Never assume that flight director cues are following a route or course that is free from error. Rather, be sure to include navigation instruments and sources in your scan. Remember, the equipment will usually perform exactly as programmed. Always compare the displays to ensure that all indications agree. If in doubt, fly the aircraft to remain on cleared track and altitude, and reduce automation to as minimal as possible during the problem processing period. The first priority for a pilot always is to fly the aircraft.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 2 May 2017, the pilot of a Messerschmitt-Bölkow-Blohm BK117-A3 helicopter, registered ZK‑IED, was tasked to relocate power poles from the northern side of the inlet to the southern side at Porirua Harbour, Pauatahanui Arm, New Zealand. The pilot reported that while in the cruise at about 300 ft, the helicopter started an un-commanded yaw, at which point the pilot released the sling load and entered into an autorotation onto the water. The helicopter was substantially damaged, and the pilot was uninjured.
On 3 July 2017, the New Zealand Transport Accident Investigation Commission (TAIC) requested Australian Transport Safety Bureau (ATSB) technical assistance with data recovery from a global positioning system (GPS) device that was onboard the helicopter at the time of the ditching. In accordance with paragraph 5.23 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation, the ATSB appointed an accredited representative (ATSB investigator) to the TAIC investigation. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.
The ATSB successfully recovered the data from the GPS and provided a copy to the TAIC on 4 September 2017.
TAIC is responsible for the release of the final investigation report into this accident. Any enquiries in respect of the ongoing TAIC investigation or release of the investigation report should, in the first instance, be directed to the:
Transport Accident Investigation Commission Level 9, 114 The Terrace PO Box 10323 Wellington, 6143, New Zealand
_______________ The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
On the evening of 8 September 2017, an instructor and student from the Australian International Aviation College were preparing to conduct night training circuits at Port Macquarie Airport, New South Wales, in a Diamond DA40 NG aircraft, registered VH-YPQ. As it was the student’s first time conducting night circuits, once lined up on the runway, the instructor took the aircraft controls for the take-off.
After take-off, as the aircraft climbed, the instructor heard and felt the engine and propeller surging. Propeller speed and engine power fluctuations occurred from about 200 ft above the runway and increased in amplitude as the aircraft climbed to about 400 ft. Recorded data showed that the engine was producing full power despite the fluctuations. The instructor interpreted the fluctuations as a partial engine power loss and commenced a left turn, aiming to return and land on the runway in the opposite direction to the take-off. The instructor had considered landing straight ahead but assessed that there was power available to turn and that they would be unable to see and avoid trees or to be sure to land in a suitable clearing ahead.
In the 10 seconds that the instructor was assessing and making decisions about a perceived partial power loss, the airspeed reduced from 75 to 69 kt due to the aircraft’s nose-up pitch attitude. Then, at the same time as commencing the turn back towards the runway, the instructor reduced engine power to 30 per cent, while maintaining a nose-up attitude, and the airspeed reduced rapidly.
During the turn, the aircraft aerodynamically stalled resulting in a loss of control. Although the aircraft pitched down and the instructor subsequently increased the power, control was not regained. The aircraft descended and collided with trees, coming to rest inverted. The student and instructor were seriously injured, and the aircraft was destroyed.
What the ATSB found
After reducing the power, the instructor did not maintain adequate airspeed during the turn. This resulted in an aerodynamic stall, loss of control and collision with terrain.
The aircraft manufacturer could not determine the reason for the engine speed fluctuations. Propeller speed fluctuations had occurred in other aircraft, and either resolved without pilot input or by moving the power lever.
Although not contributing to this occurrence, in the course of the investigation it was found that engine cylinder heads for the aircraft type were cracking prior to reaching their service life.
What's been done as a result
After the accident, the Australian International Aviation College:
added a requirement to the take-off safety briefing to include setting partial power safety speed in the event of a partial power loss
conducted partial engine failure after take-off training for instructors and students, comprising pre-flight planning and self-briefing, ground training, and flight training
performed flight simulator tests for partial engine failure after take-off conditions in each single engine aircraft model operated by the flying school to assess the power required to maintain altitude in the event of a partial power loss.
Safety message
In this accident, the instructor perceived there was a partial power loss. The ATSB research report Avoidable Accidents No. 3 – Managing partial power loss after take-off in single-engine aircraft provides information to assist pilots maintain aircraft control in the event of an emergency or abnormal situation after take-off. The report prescribed initial actions to be considered including:
Lower the nose to maintain the glide speed of the aircraft. If turning is conducted, keep in mind an increased bank angle will increase the stall speed of the aircraft.
Maintain glide speed and assess whether the aircraft is maintaining, gaining or losing height to gauge current aircraft performance.
Fly the aircraft to make a landing, given the aircraft’s height and performance, and the pre-planned routes for the scenario.
The occurrence
On the evening of 8 September 2017, an instructor and student from the Australian International Aviation College (AIAC) planned to conduct night circuits at Port Macquarie Airport, New South Wales, in a Diamond DA40 NG aircraft, registered VH-YPQ. The student taxied the aircraft to runway 21, then, as it would be the student’s first time conducting circuits at night, the instructor took over the controls for the take-off.
It was dark and the moon had just risen above the horizon when the aircraft commenced the take-off roll at 1957:12 Eastern Standard Time[1] (Figure 1). During the initial climb, about 20 seconds after lift-off, while still above the runway and passing 200 ft, the instructor noticed changes in the engine sound, felt acceleration changes and saw fluctuating indications on engine load and propeller RPM gauges, despite maintaining the power lever in the fully forward maximum power position.
The fluctuations increased over the next 20 seconds as the aircraft climbed. During that time, the aircraft pitched up to about 8 degrees, consistent with the normal attitude for initial climb and to achieve the best rate of climb speed, and the vertical speed increased to more than 900 ft per minute. The instructor assessed that the fluctuations were due to an engine problem and considered the options for landing.
The instructor considered landing straight ahead, however, while there were two fields that may have been suitable for a landing, they were not visible at night and the instructor was concerned the aircraft may land beyond the field in trees. While still above the runway and climbing through about 400 ft, and as the engine was still producing power, the instructor elected to conduct a left turn, aiming to land on the reciprocal runway, 03. The left turn commenced at 1957:58 and 1 second later, the instructor moved the power lever aft, reducing the engine load to about 30 per cent, where it remained for the next 10 seconds.
At 1958:01, the instructor broadcast on the common traffic advisory frequency[2] that they had engine problems and would land on ‘runway 21,’ although actually intending to land on runway 03.
The instructor recalled concentrating on trying to maintain adequate speed—not ‘nosing up too much getting closer to the stall speed or nosing down and not being able to make the runway.’ As the aircraft turned and the runway came into sight, the instructor assessed that the aircraft was not going to make it back as the runway was too far away and the airspeed was too slow. The instructor also recalled looking down and all that could be seen was the trees.
The instructor made changes with the power lever to see if the fluctuation issue improved. Engine data showed the power lever position moving to maximum power for 3 seconds, back to 25 per cent engine load for less than 2 seconds then to full power for the final 4 seconds. The instructor also noticed signs of an impending aerodynamic stall[3]—buffeting and sloppy controls, followed by a left wing drop. The aircraft entered uncontrolled flight, descended rapidly and impacted trees and terrain.
The aircraft collided with trees about 18 seconds after the left turn commenced, 325 m abeam the runway 03 threshold, and came to rest inverted (Figure 1). Both occupants were seriously injured and the aircraft was destroyed.
Figure 1: Aircraft flight path and key events
Source: Google Earth, annotated by the ATSB based GPS, engine control unit and radio recordings, and accident site assessment
The Australian International Aviation College (AIAC) was a flight training and charter organisation based in Port Macquarie, New South Wales. It conducted flight training for up to 90 Australian and international students, from initial training through to commercial pilot licence, and single and multi-engine aeroplane, instructor and instrument flight ratings. The AIAC operated a fleet of Diamond aircraft and an approved flight training device (simulator).
Instructor qualifications and experience
The instructor:
held a commercial aeroplane pilot licence issued in April 2014
held a valid Class 1 medical certificate issued in March 2017 with the restriction that distance vision correction must be worn
held instrument and instructor ratings
met the recency requirements for the planned night circuits
satisfactorily completed flight crew emergency procedures training at AIAC in February 2017
completed a flight instructor standardisation and proficiency check in January 2017 including attaining a Grade 2 instructor rating
obtained an instrument rating training endorsement for single-engine aircraft below 5,700 kg in June 2017
had accrued 1,160.9 hours total aeronautical experience, including 86.2 hours in command at night (73.7 in single-engine aircraft and 12.5 in multi-engine aircraft) and 680.7 hours instructing in single-engine aircraft
logged 124 hours in the DA40 NG and DA42 NG (diesel-engine) aircraft in 2017.
Student pilot experience
The student pilot commenced flight training at AIAC in March 2017 and completed a recreational pilot licence test on 24 May 2017. The student had accrued a total of 85.4 hours flying time, of which 19.8 were as pilot in command.
Weather and environmental information
The weather was fine with light winds and little to no cloud. The time of the occurrence was past astronomical twilight and the nearly full moon was just above the horizon. The township of Port Macquarie provided some light and a horizon reference to the east but the ground near the airport was dark apart from a few scattered dwellings. The instructor reported that the moon and town lights were below their field of vision during the initial stage of the flight.
The Bureau of Meteorology recorded the wind strength and direction at Port Macquarie Airport at 1-minute intervals. Nil wind was recorded at the aerodrome for the 20-minute period encompassing the short duration of the accident flight. Although the aircraft took off with nil wind at runway level, according to GPS data, it encountered an increasing tailwind of up to 8 kt during the climb and turn. As the aircraft climbed, the temperature increased from 12.5 °C at runway level to 16.5 °C at the maximum height reached.
Aircraft information
General information
The Diamond Aircraft Industries DA40 NG aircraft is a four-seat, low-wing, T-tail aircraft constructed from composite materials. The aircraft is factory-fitted with a turbo charged four-cylinder diesel Austro E4 engine, operated on aviation turbine fuel, and a three-bladed wooden composite variable-pitch MT-Propeller MTV-6-R propeller.
VH-YPQ
The aircraft serial number 40.N292 was manufactured in 2015 and placed on the Australian register in early 2016 as VH-YPQ (Figure 2).
The aircraft had a current certificate of airworthiness and maintenance release[4] with no outstanding maintenance or defects notated. The aircraft had a total time in service of about 906 flight hours before the accident flight. The logbook statement indicated that the aircraft was maintained in accordance with the Diamond Aircraft DA40 NG maintenance schedule. It was equipped and certified for operation under the instrument flight rules[5] and was maintained and operated in the Charter Class B category.
Figure 2: VH-YPQ
Source: Simon Coats
System description and information
Engine and propeller control
The constant speed propeller has a governor, which changes the blade pitch to maintain a constant RPM, regardless of the amount of engine torque, airspeed or altitude. The aircraft’s maximum take-off propeller speed was 2,300 RPM.
The engine and propeller were controlled by a single electronic engine control unit (ECU) with dual-redundant hardware that performed continual self-testing. A single power lever provided command input via two separate channels to the ECU and the ECU controlled the engine fuel injection to match the power lever command. For redundancy, there was a cockpit switch for selecting ECU channels in case of a fault.
Integrated instrument and avionics system
VH-YPQ was factory-fitted with a Garmin G1000 integrated avionics system, which consolidated all communication, navigation, surveillance, automatic flight control system, primary flight instrumentation, engine indication, and annunciation systems on two liquid crystal display units (DU) and an audio panel. The two DUs consisted of a primary flight display on the left (student pilot side), and the multi-function display (MFD) on the right (instructor side). The audio panel was located between the two display units. The aircraft was not fitted with the optional terrain awareness and warning system.
Recording capability
The G1000 avionics system was capable of storing up to 60 flight and engine parameters on a data memory card. Data was logged to a new file that was created each time the MFD was powered on. All parameters were recorded at 1-second intervals. The electronic ECU was capable of storing significant amount of engine data and had a backup battery for redundancy.
Aircraft weight and balance
The aircraft was assessed as being within the weight and balance limits throughout the accident flight, with a take-off weight of 1,143 kg.
Relevant speeds
Best glide speed is used to achieve the greatest distance for the height in case of engine failure. At any airspeed faster or slower than the best glide speed, the aircraft will travel less distance over the ground.
According to the Airplane Flight Manual, the best glide speed (‘airspeed for best glide angle’) for the aircraft with flaps up was 88 kt, and ‘airspeed for emergency landing’ with engine off and flaps in the take-off position was 78 kt.
The best rate of climb speed (VY) was 72 kt with take-off flaps set. Therefore, in the event of a power loss when in the climb at VY, the pilot would need to lower the aircraft nose to achieve the best glide speed, and the airspeed for emergency landing.
Accident site examination
The aircraft initially impacted trees causing significant structural damage to the wings, after which it impacted terrain inverted and at a nose-down angle of about 25°. The cockpit was partially collapsed, with the airframe resting on the instrument panel and seat backs. Both wings and the tail detached during the impact sequence (Figure 3).
Figure 3: Wreckage of VH-YPQ, which was partially disturbed during rescue of the occupants
Source: ATSB
Examination of the aircraft wreckage found no pre-existing airframe issues. The flap actuator was found in the take-off position. The aircraft’s fuel tanks were breached and there was evidence of fuel spillage. A small quantity of fuel was drained from the tanks and matched the characteristics of aviation turbine fuel. It tested negative to water content. Previous fuel records and the engine data both indicated that there was sufficient fuel on board the aircraft for the intended flight.
The engine was examined externally with the cowls removed and there was no noted fluid leakage or pre-impact defects identified. During removal of the engine and control parts, no defects were identified. The propeller blades were fragmented, consistent with the engine driving the propeller when the aircraft impacted with terrain. The propeller and propeller control unit were removed from the aircraft for function testing.
The G1000 avionics unit data memory card and electronic ECU memory module were removed from the aircraft and transported to the ATSB technical facilities for examination and download.
Component testing
Propeller hub and propeller control
The propeller hub and controller were sent to the propeller manufacturer for testing. No faults were identified during function testing or visual examination.
Manufacturer data analysis
The aircraft and engine manufacturers analysed the recorded data and could not determine the cause of the propeller speed fluctuations. The engine manufacturer reported that the oscillation was still in a normal range and did neither create an ECU warning nor a reduction of power. There are lots of possible reasons for RPM oscillation but in this case they were not engine related.
They advised that at the propeller speeds that were recorded during the last 40 seconds before the accident, the propeller should have been sitting on the fine pitch limit stops. Whether the propeller was at full fine pitch during the fluctuations could not be determined as the actual propeller blade pitch angle was not sensed or recorded. Fuel injection quantity and timing were not recorded on the ECU, but fuel quantity and fuel flow were recorded on the Garmin system. In the recorded Garmin data, the fuel flow rate increased and decreased in step with the propeller RPM and in response to the changes in power lever position.
Assessment of possible causes of RPM fluctuations
Figure 4 is an extract from the aircraft maintenance manual, which provided troubleshooting for fluctuating propeller RPM from a list of possible causes.
Figure 4: Extract from the aircraft maintenance manual
Source: Diamond Aircraft
From the listed possible causes, the post-accident inspection found the following.
The engine gearbox oil level was not measured, but the ATSB assessed its quantity as unremarkable. There was no sign of an oil leak on or around the engine that would have depleted the oil quantity.
No defects or metal debris were identified in the gearbox oil filter or magnetic chip detector.
No faults were identified with the electrical wiring harness.
The propeller governor was satisfactorily tested by the propeller manufacturer and all measurements and adjustments were found to be within tolerances.
Recorded data
Recorded data from the G1000 memory card and ECU memory module was analysed. The data from the two sources correlated to within about 2 seconds. Selected data is displayed in the graph in Figure 5. In this graph, the altitude, airspeed, ground speed, pitch and roll were retrieved from the G1000 and the propeller speed (RPM), power lever position and engine load were from the ECU. The altitude is accurate to within 30 ft.
Propeller speed fluctuations
According to the data, the aircraft lifted off at 1957:26. Twenty seconds later, the aircraft climbed through 200 ft at an airspeed of 74 kt. The propeller RPM began fluctuating about 10 RPM per second above and below 2,250 RPM. The power lever remained constant in the maximum power position and the engine load made small fluctuations around 98.5 per cent power, consistent with the RPM fluctuations.
The RPM and engine load fluctuations increased in amplitude as the aircraft climbed. The engine manufacturer advised that fluctuations up to ± 20 RPM were acceptable, although no normal operating range of fluctuations was defined. That ‘acceptable’ change in amplitude was first exceeded at 1957:47, 218 ft above the runway.
The fluctuations continued to increase in amplitude over the next 10 seconds to a maximum variation of 73 RPM in 1 second (which equated to about 3 per cent of an average 2,250 RPM) as the aircraft climbed to 361 ft.
Figure 5: Plot of selected engine and aircraft GPS data parameters
Image shows increasing fluctuations in propeller RPM and engine load, followed by a sequence of power lever movements with corresponding RPM and load variations.
Source: Austro Engine and Garmin 1000 data analysed by ATSB
Manoeuvring
As the aircraft climbed through 300 ft above the runway, the airspeed reached 75 kt, which was the maximum achieved on the flight. Over the next 10 seconds the airspeed decreased to 69 kt as the pilot maintained a pitch-up attitude of about 8 degrees, and the aircraft climbed at a rate of up to 938 ft per minute. After reaching a peak pitch-up of 8.3 degrees and still climbing at 928 ft per minute, the pilot started to reduce the aircraft’s pitch attitude.
At 1957:58, as the aircraft was climbing at 904 ft per minute through 389 ft, the airspeed had reduced to 69 kt and a left bank (roll) commenced. At that time, the aircraft was still pitched up about 7 degrees. One second later, the power lever was moved to a lower power setting that corresponded with an engine load reduction to about 30 per cent and the propeller speed decreased to about 1,750 RPM.
Over the next 4 seconds, the aircraft continued to climb albeit at a reducing rate, the airspeed continued to decrease, and the angle of bank increased. At 1958:05, the maximum altitude of about 430 ft was reached, airspeed was 59 kt and the aircraft nose then pitched down. The aircraft then started to descend. The last Garmin data recorded was at 1958:07 with the airspeed at 59 kt (which it had been for 4 seconds), a 29-degree angle of bank and a propeller speed of 1,720 RPM.
The ECU data indicated that at 1958:09, the power lever was moved forward for 3 seconds, back for 2 seconds then forward for the final 4 seconds and the engine load increased and decreased correspondingly. The last recorded ECU data at 1958:17 was consistent with the aircraft colliding with terrain.
Uncontrolled descent
The G1000 memory card was missing approximately the last 12 seconds of data. This was likely due to the unit’s power being cut abnormally during the accident sequence, instead of a normal system shutdown. Consequently, the aircraft’s final descent and flight path were not recorded. Based on alignment between the accident site location, direction of travel and the final recorded position, the left turn and steep descent continued until impact. The aircraft descended from 428 ft in 10 seconds, which was an average descent rate of 2,568 ft per minute.
The stalling speed with power off (VS) for the aircraft weight and take-off flap was 58 kt indicated airspeed (KIAS) at 0° angle of bank, and 62 KIAS at 30° angle of bank. The last recorded airspeed was 59 KIAS when the bank angle was about 30°, below the power-off stalling speed.
No ECU faults were recorded.
Aircraft performance testing
Following the accident, the AIAC conducted in-flight performance testing of partial engine failure scenarios. With an aircraft weight of 1,156 kg (similar to the accident flight), a DA40 NG aircraft maintained level performance (occasional 100 ft per minute climb) and airspeed at a safe margin above the stalling speed, with 30 per cent power, flaps in the take-off position and glide attitude set, including in a turn.
Regulatory requirements
The Civil Aviation Safety Regulations (CASR) Part 61 Manual of Standards (MOS) detailed competency standards for all flight crew qualifications as well as proficiency checks, flight reviews and flight test standards.
Competencies specified for private and commercial aeroplane pilot licence and single-engine aeroplane class ratings included managing a simulated engine failure after take-off in the circuit area, but not partial power loss. Underpinning knowledge of the competencies included ‘engine failure scenarios and procedures for partial and complete power loss.’
Competencies specified for the night visual flight rules (NVFR) rating included skills and knowledge required for managing emergency situations at night including that ‘(in simulated conditions) aircraft control is maintained.’ The Airservices Australia Aeronautical Information Publication En Route 1.1 did not permit simulated engine failures to be conducted below 1,500 ft at night in the circuit area.
The Part 61 MOS Unit A5 – Advanced stalling, included that a pilot is required to demonstrate recovery from a stall with full or partial loss of engine power. The Civil Aviation Safety Authority’s (CASA’s) Flight instructor manual stated:
Before carrying out any advanced stalling exercise it is important that sufficient height is gained to ensure recovery by 3,000 feet above ground level…
CASA advised that competency in this standard ‘should mitigate [against the] risk of partial power loss in the take-off.’
Operator procedures
Managing partial power loss after take-off
The AIAC syllabus of training was in line with the Part 61 MOS requirements and did not reference partial engine failure after take-off or in the circuit. However, the AIAC standard operating procedures included expanded procedures for engine failure immediately after take-off with insufficient/partial engine power. It listed the following considerations in managing a partial power loss after take-off:
When faced with a partial power loss, the pilot in command should not try to diagnose the engine problem at the expense of maintaining aircraft control;
Climbing at the aircraft’s best rate of climb speed will maximize options if a partial power loss or total power loss occurs;
Lower the nose to maintain the glide speed of the aircraft (if unable to climb);
If a partial power loss has occurred with remaining runway, the earlier a decision is made to cut remaining engine power, the greater landing distance is available; the immediate extension of landing flaps is recommended as this will also help to reduce the aircraft groundspeed prior to ground contact;
Conduct the Phase One checks as outlined in the QRH. However, this should only be done if there is sufficient time;
Maintain best glide speed and assess whether the aircraft is maintaining, gaining or losing height to determine current aircraft performance. This will assist in making decisions in the available options for landing.
Fly the aircraft to make a landing, given the aircraft’s height and performance, and the pre-planned routes for the situation. If any turning is conducted, be mindful that an increased bank angle will increase the stall speed of the aircraft. Keeping the aircraft in balance will also minimize rate of descent in any turn.
Re-assess landing options throughout any manoeuvers. Be decisive but be prepared to modify the plan if required.
Maintain glide speed up to the point of landing flare; this will ensure that when flaring there is enough energy to arrest the vertical descent rate.
Circuits under the night visual flight rules
At the time of the accident, the AIAC NVFR training syllabus included 5 hours of night circuits. Prior to commencing night circuits, students were given a briefing by an instructor. The briefing included human factors, illusions that can occur at night, lighting and flight with reference to instruments. It did not include emergencies, but students received a briefing on circuit emergencies earlier in their training. Additionally, at night, company pilots were required to conduct the climb after take-off at the best rate of climb speed.
Quick reference handbook
Emergency and non-normal procedures were detailed in the AIAC Quick Reference Handbook (QRH). These were derived from the emergency procedures detailed in the Airplane Flight Manual. The QRH included ‘Phase 1 checks’ that were printed in bold type. The Phase 1 checks were ‘recall items’ required to be committed to memory. The other, ‘Phase 2’ checks were not memory recall items and the QRH checklist was required to be used when carrying out these checks.
Two QRH procedures were relevant to the accident flight: the checklist for partial or full engine failure after take-off and the ‘defective propeller RPM regulating system’ checklist. The first of these is depicted in Figure 6. Nearly all the items were in bold and were therefore memory recall items. The first (memory recall) item was to achieve an airspeed of 88 kt with flaps up, or 77 kt with flaps in the take-off position. The second item, if time permitted, was to check the power lever was at maximum.
Figure 6: QRH checklist for partial or full engine failure after take-off
Source: AIAC
In this occurrence, the instructor assessed the speed fluctuations as symptomatic of a partial power loss, although the engine was still producing maximum power. The instructor reported confirming the power lever was in the full power position.
The engine manufacturer reported that the defective propeller RPM regulating system procedure had been in the airplane flight manual of the DA40 D aircraft, which had a different engine, since 2003. The procedure was introduced due to issues with the propeller control system of that engine type, but was still a valid procedure to be followed in case of oscillating RPM in the DA40 NG aircraft and in the DA40 NG flight manual.
The QRH defective propeller RPM regulating system checklist carried the following warning:
IN CASE OF DEFECTIVE RPM REGULATING SYSTEM, REDUCED ENGINE PERFORMANCE SHOULD BE ANTICIPATED.
For oscillating RPM, the first action, was:
POWER setting…………..CHANGE
If problem does not clear;
VOTER Switch……………Swap between ECU A and ECU B
If problem does not clear;
VOTER Switch……………AUTO
Land at nearest suitable airport
Revise ENGINE FAILURE DURING FLIGHT checklist (Page-322).
END OF CHECKLIST
The instruction to change the power setting was not a memory recall item. The AIAC Operations manual section QRH procedures stated that ‘the QRH should not be referred to unless flight crew workload is sufficiently low to operate the aircraft while the checks are conducted,’ and that, in visual meteorological conditions, the pilot was not to refer to the QRH (for non-recall items), unless the aircraft was at or above minimum/lowest safe altitude, and/or other safe conditions could be met.
The aircraft manufacturer advised that changing the power lever angle in accordance with the procedure should fix a problem such as that encountered in the accident occurrence, because ‘changing the operating state of the engine will typically stop periodic interactions of systems and thus stop RPM fluctuations.’
The AIAC head of operations considered that the engine fluctuations were ‘very small’ and should have been able to be remedied by changing power setting/moving the power lever slowly back and forth (then changing the ECU switches if necessary), in accordance with the QRH checklist. However, the instructor had not been aware of similar issues within the operator’s aircraft fleet before the accident and reported that similar events had not been discussed or trained for by the operator to a point of being memorable.
Decision making
Pilots operate in a safety-critical environment and need to be trained and supported to make the best possible decisions in challenging conditions. Orasanu (2010)[6] stated that
in many high-risk consequential environments, time for making a decision is limited, information is incomplete, conditions change dynamically, and goals shift, rendering analytic decision-making impractical, if not impossible.
Orasanu detailed ways in which expert knowledge contributes to cockpit decision-making. These included quick and accurate interpretation of a problem and performing rehearsed responses. Where a pilot made an error or did not select the best solution, it may be due to an incorrect interpretation of the situation, or choosing an inappropriate course of action.
The instructor had not previously experienced propeller speed fluctuations and interpreted the problem as a partial power loss. The ATSB Avoidable Accidents No. 3 publication, Managing partial power loss after take-off in single-engine aircraft, stated that while following a complete engine failure, a forced landing was inevitable, a partial power loss required the pilot to make a decision whether to continue flight or land immediately. Research for the publication found that in 145 of 160 occurrences where a pilot turned back to the runway following a partial power loss, the aircraft made it to within the aerodrome grounds. However, the increase in stall speed during the turn and the associated potential for a loss of control meant that the consequences of a mishandled turn back were more serious than a controlled forced landing.
The publication suggested four main considerations when assessing if a turn back to the aerodrome is possible. These were:
• height available
• remaining engine power available – do you have enough power to climb?
• increased stall speed associated with any increase in angle of bank increasing the risk of an aerodynamic stall
• level of confidence in the remaining engine power – but assume the engine may fail at any moment.
Take-off safety briefing
The ATSB Avoidable Accidents publication also stated that pilots should self-brief prior to each and every take-off. The take-off brief ‘serves as a reminder of your planned actions in the event of an emergency such as a partial power loss.’ Planning actions under non-stressful and controlled circumstances prepares pilots for a quick response, reducing mental workload and mitigating some effects of decision making under stress, such as reduced short-term memory, if an emergency situation does eventuate.
The AIAC operations manual specified that a take-off safety briefing must be given by the pilot flying[7] at the completion of pre-take-off checks.
The company take-off safety briefing was:
1. Any emergencies prior to VR[8] I will reject the take-off.
2. Any emergencies at or after VR I will reject and land on remaining runway or clearway.
3. Any emergencies airborne with no runway remaining I will pick a landing area 30° either side of the nose and conduct a forced landing.
4. Special considerations – unique airport information, weather conditions, terrain or obstacles on departure, other known risks and intentions.
The take-off safety briefing did not specify what events constituted an emergency.
The instructor recited their normal take-off safety briefing as:
If there was anything on the ground, power to idle, brakes to come to a stop. Airborne with runway remaining, nose down land on the remaining runway. Airborne with insufficient runway remaining, pick an area either side of the nose, nose down, maintain glide speed, consider flap and then shutdown checks.
Related occurrences
Aircraft operator fleet events
After the accident involving VH-YPQ, the pilot of a twin-engine Diamond DA42 aircraft with a similar engine type to VH-YPQ and operated by AIAC, experienced a similar propeller RPM fluctuation event, where it varied about 50 RPM. In that event, the wind was gusting to 25 kt. During the take-off, there were some RPM changes due to wind gusting, but the pilot reported that was normal. Passing about 400 ft during the climb, fluctuation noise caught the pilot’s attention. The pilot reduced the power to 85 per cent and after 5 to 6 seconds returned it to full power, and the fluctuations, noise and vibration ceased. The reasons for that fluctuation could not be determined from post-event examinations.
The aircraft maintainer provided extracted data of five similar fluctuation events from the aircraft operator’s fleet. The last 3 hours of engine operating data were routinely downloaded from the ECU at each 100-hour maintenance event. Within that data, which represented 3 per cent of an aircraft’s operating time, the maintainer found that oscillations/fluctuations in RPM were present ‘quite a lot of the time.’ Of the five sample events provided to the ATSB, four had fluctuations of greater magnitude than the accident flight. Only one of the five sample events was reported to the maintainer by the flight crew, and they reported ‘hunting’ of power and propeller RPM and that the aircraft was operating in turbulent conditions at the time.
The aircraft maintainer advised that the level of oscillation recorded in the ECU data for the accident flight was ‘quite common’ for the aircraft type (in the AIAC fleet) and believed they were generally introduced by an outside influence such as slight turbulence. The aircraft operator also reported that it was ‘common to observe and hear changes in propeller pitch on DA40 NG aircraft when flying in gusting wind conditions.’
The aircraft manufacturer advised that they were not aware of RPM fluctuations caused by windshear, gusts or turbulence, and that these would normally be eliminated by the governor. The AIAC chief engineer reported that in other previous occurrences of propeller fluctuations involving AIAC aircraft, the fluctuations had reached a maximum amplitude then reduced to near zero without pilot input.
Other aircraft events
In addition to the two events involving AIAC aircraft, the engine manufacturer reported that it was aware of 16 other events on aircraft fitted with the AE300 engine worldwide, involving fluctuations in propeller speed and load, none of which resulted in an accident. The engine manufacturer reported that in all cases, fluctuations ceased with a change in power lever position. Fifteen of these 16 occurrences were found to be the result of either a fuel pressure issue, propeller imbalance, or faulty electrical connection in the propeller governor and the cause of one was not found.
One additional event occurred in 2019, which was traced to excessive play in the alternator rotor. This was fixed by replacement of the alternator.
The reason for the fluctuations was found in all but three of the total of 19 reported occurrences.
Cylinder head cracking
On 25 May 2018, another DA40 NG aircraft in the AIAC fleet, VH-YPJ, had an occurrence where the engine coolant system over-pressurised and the coolant leaked. Inspection of that aircraft found cracking in six of the eight pairs of cylinder valve openings on the cylinder head.
Inspections were then carried out on the remaining aircraft in the operator’s fleet of five DA40 NG aircraft. The findings of the inspections are summarised in Table 1. The time between overhaul for the cylinder head was 1,800 hours.
Table 1: Cylinder head cracking in AIAC DA40 NG fleet
Aircraft
Cracking
Hours in service
VH-YPH
5 of 8 cylinder valves and cylinder head
1,358
VH-YPR
5 of 8 cylinder valves and cylinder head
1,409
VH-YPF
Cylinder head
1,356
VH-YPN
Cylinder head
1,555
VH-YPJ
6 of 8 cylinder valves and cylinder head
1,549
VH-YPQ
Cylinder head
901
Source: AIAC
After the accident and under the supervision of the ATSB, the operator examined the cylinder head fitted to VH-YPQ. Hairline cracks were identified in the cylinder head in the same location as VH-YPJ (Figure 7), however those cracks were assessed as insufficient in size to create engine problems at the time of the accident.
Figure 7: Cylinder cracks in VH-YPQ and another aircraft
The aircraft experienced propeller speed fluctuations shortly after take-off, which although relatively small, the instructor had not experienced previously. The feel, sound and fluctuating engine indications were interpreted by the instructor as a partial power loss. The instructor considered landing ahead as for a complete engine failure. However, due to darkness, obstacles in the path, the aircraft position and the perceived power available, the instructor decided to turn back to the runway.
During the 10 seconds that the instructor was assessing and decision-making prior to commencing the turn, the airspeed decreased 6 knots due to the aircraft’s nose-up pitch attitude. At the same time as commencing the turn, the instructor reduced engine power, while maintaining a nose-up attitude.
Following the power reduction, the combination of nose-up pitch attitude and increasing angle of bank, resulted in an aerodynamic stall. The instructor recognised the signs of the impending stall and knew it was necessary to lower the aircraft nose to recover but did not do so due to the perceived proximity of the trees below. This resulted in the loss of aircraft control and collision with terrain.
In-flight performance testing of a DA40 NG aircraft demonstrated that 30 per cent power was sufficient to maintain level flight including in a turn. Therefore, in this occurrence, had adequate airspeed above the stalling speed been achieved and maintained by lowering the aircraft’s nose, it was likely aircraft control would have been retained, even following the power reduction commanded by the instructor.
Managing a perceived partial power loss
Although the engine did not sustain a partial power loss, the instructor perceived that there was an impending engine issue due to the noise and vibrations brought on by the propeller fluctuations. Therefore, the instructor managed the issue by dealing with it as a partial power loss. However, the instructor could not recall reducing the power at the same time as commencing the turn, or why.
Managing partial power loss after take-off in single-engine aircraft was not included in the units of competency within the Civil Aviation Safety Regulations Part 61 Manual of Standards (MOS) or the aircraft operator’s training syllabus, other than as ‘underpinning knowledge’. The instructor had previously demonstrated competence in managing simulated complete engine failure after take-off in single-engine and multi-engine aircraft and in managing simulated partial engine failure in multi-engine aircraft. The instructor was also required to have demonstrated competence in recovery from a stall with full or partial loss of engine power in accordance with the MOS.
Training for complete engine failure after take-off is straightforward and the trained response is primarily to lower the aircraft nose to achieve a safe airspeed and land ahead. Training for partial power loss is more complex as there can be significant variation in the power loss presentation. This includes anything from almost full to almost no power available, and the situation may resolve, worsen, or both. Following a partial power loss, a pilot will need to make an assessment of the power available, aircraft performance, suitable landing areas and other factors such obstacles and terrain. It may be that turning back to land on a runway is achievable. In any event, the first memory item stipulated in the aircraft’s quick reference handbook in case of full or partial engine power loss, was to achieve the stated (best glide) airspeed, which is essential to avoid a loss of control.
Research conducted for the ATSB publication Avoidable Accidents No. 3 – Managing partial power loss after take-off in single-engine aircraft, found proportionally more fatal accidents occurred following a partial power loss than a complete engine failure. In particular, loss of aircraft control occurred more often following a partial power loss, either during a turn back to the runway or as a result of pilot inaction to prevent airspeed decay. The consequences of these loss of control occurrences were more serious than landing ahead following a complete engine failure. The research identified that pilots generally used a take-off safety briefing that primed them for actions in case of complete engine failure after take-off but not for partial power loss.
The instructor’s take-off safety briefing was consistent with that used across the general aviation industry and included instructions (paraphrased):
In case of engine failure when airborne with no runway remaining, lower the nose to achieve best glide speed and land ahead.
As lowering the aircraft nose when close to the ground is counterintuitive, such priming may help the pilot resist pitching the nose up, thereby avoiding a stall and loss of control. However, in this occurrence, the instructor commenced the turn before lowering the aircraft nose to achieve a safe speed, and although knowing it was necessary to lower the nose, did not want to direct the aircraft towards the trees below.
In the Avoidable accidents publication, the ATSB assessed that including consideration of partial power loss in the take-off safety briefing by reminding the pilot to lower the nose to achieve best glide speed before assessing performance and decision-making, may improve outcomes following (actual or perceived) partial power loss after take-off.
Cylinder head cracking
While not contributing to this accident, engine cylinder head cracking in the aircraft operator’s fleet of DA40 NG aircraft had occurred before the service life of 1,800 hours was exceeded. A crack in an engine cylinder head may develop to a size that results in loss of compression or power, foreign object damage or engine failure.
Findings
From the evidence available, the following findings are made with respect to the collision with terrain involving Diamond DA40 aircraft, registered VH-YPQ, 1 km south of Port Macquarie Airport, New South Wales, on 8 September 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
In response to increasing propeller speed fluctuations which were interpreted as a partial power loss, the instructor decided to attempt to turn back to land at the aerodrome. The instructor reduced power to 30 per cent and did not maintain adequate airspeed during the turn, resulting in an aerodynamic stall, a loss of control and collision with terrain.
Other factors that increased risk
The aircraft manufacturer could not determine the reason for the fluctuations. Propeller speed fluctuations have occurred in other aircraft with the E4 engine and MTV-6-R propeller, and either resolved without pilot input or by moving the power lever.
Cylinder heads for the aircraft type were cracking prior to reaching their service life.
Safety issues and actions
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Australian International Aviation College
The aircraft operator, Australian International Aviation College, reported to the ATSB that after the accident, they:
added the following to their required take-off safety briefing:
In the event of a partial power loss, set partial power safety speed (DA40 NG – 78 kt take-off flap or 88 kt flap up), assess performance. If unable to maintain altitude find suitable place to conduct a forced landing.
conducted partial engine failure after take-off training for instructors and students, comprising pre-flight planning and self-briefing, ground training, and flight training
performed flight simulator tests for partial engine failure after take-off conditions in each single engine aircraft model operated by the flying school to assess the power required to maintain altitude.
Pilot details
Pilot details – Instructor
Licence details:
Commercial Pilot (Aeroplane) Licence, issued November 2015
Aircraft ratings and endorsements:
Manual Propeller Pitch Control; Retractable Undercarriage; Single Engine Aeroplanes less than 5,700 kg Maximum Take-off Weight; Multi Engine Aeroplanes
Ratings:
Multi Engine Aircraft Instrument rating; Instrument Approach 2 Dimensional and 3 Dimensional; Flight Instructor Rating Aeroplane Grade 2, Single Engine Aircraft, Night VFR Training, Design Feature Training, Instrument Rating Training
Medical certificate:
Class 1, valid to March 2018
Aeronautical experience:
1160.9 hours
Last flight review:
June 2017
Pilot details – Student
Licence details:
Recreational Pilot Licence, issued May 2017
Endorsements:
Nil
Ratings:
Nil
Medical certificate:
Unknown
Aeronautical experience:
85.4 hours flying time, of which 19.8 were as pilot in command.
Last flight review:
N/A
Sources and submissions
Sources of information
The sources of information during the investigation included the:
instructor
student
flight training school/aircraft operator
aircraft and engine manufacturer
Civil Aviation Safety Authority
Airservices Australia
Bureau of Meteorology.
References
Orasanu, J., 2010, Flight Crew Decision-Making, in Kanki, B., Helmreich, R. and Anca, J., Crew Resource Management, Elsevier, San Diego, USA
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the aircraft operator, manufacturer and maintainer, the engine and propeller manufacturers, instructor and student pilot, the Civil Aviation Safety Authority, Austrian Federal Safety Investigation Authority and the German Federal Bureau of Aircraft Accident Investigation.
Submissions were received from the aircraft manufacturer, operator and maintainer, the Civil Aviation Safety Authority, Austrian Federal Safety Investigation Authority and the instructor. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 02/11/2017
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Sequence of events
On the evening of 8 September 2017, an instructor and student were preparing to carry out night circuits at Port Macquarie Airport, Port Macquarie, New South Wales in a Diamond DA40 NG aircraft, registered VH-YPQ. The training flight was being operated by the Australian International Aviation College. As it would be the student’s first time conducting night circuits, the instructor was at the controls for the first take-off, which began at about 1957 EST from runway 21.
The instructor reported noticing a ‘surging’ sound and feel on initial climb towards the end of the runway (Figure 1) and felt as though the engine had lost a significant amount of power. The propeller speed and load instruments were showing oscillations. As there was insufficient time for troubleshooting, and no visible forced landing options in the immediate area, the instructor decided to turn left and attempt to land on the reciprocal of the take-off runway, making an immediate radio call to that effect. The instructor recalled pushing the power lever to ensure that it was fully forward, and possibly experimenting with power settings to see if the issue improved.
Figure 1: Aircraft flight path and key events
Times shown in this image are Universal Coordinated Time (UTC). Local time was UTC + 10. Source: Google Earth, annotated by the ATSB based on-board recordings (Garmin and ECU), radio recording, and accident site assessment.
The instructor later reported the aircraft would not maintain height through the turn and it collided with trees about 325 m directly abeam the runway 21 departure threshold, coming to rest inverted (Figure 2). Both occupants were seriously injured and the aircraft was destroyed. There was no fire.
Figure 2: Wreckage of VH-YPQ, which was partially disturbed during the rescue
Source: ATSB
Aircraft information
The DA 40 NG is a four-seat, low-wing, T-tail aircraft. VH-YPQ was manufactured in 2015 and first registered in Australia in January 2016. It was fitted with an Austro Engine AE300 E4-A four-cylinder intercooled turbodiesel engine running on aviation turbine fuel. The engine drove a three-bladed wooden composite variable-pitch MT Propellers MTV-6-R propeller.
The AE300 engine’s fuelling and the propeller pitch are controlled by a single engine control unit (ECU) which has dual-redundant hardware and performs continual self-testing. There is a cockpit switch for selecting ECU channels in case of a fault. The engine is controlled with a single power demand lever with two separate channels into the ECU for fault detection.
The last maintenance carried out on the aircraft was a 50-hourly engine check, landing gear wheel replacement, and coolant relief valve replacement on 28 August 2017. The last major inspection was carried out on 8 August 2017.
The operator’s flight manual for the DA 40 NG, based on that provided by the aircraft manufacturer, had an emergency procedure for a defective propeller RPM regulating system (Figure 3). It stated that in the case of oscillating RPM, pilots should move the power lever to clear the problem.
Figure 3: Operator’s procedure for a defective propeller RPM regulating system
Source: Australian International Aviation College
Recorded data
Recorded data was retrieved from the ECU and the Garmin G1000 navigation/display system. The data closely matched between the two ECU channels and the Garmin G1000.
The engine data showed oscillations in propeller speed and engine load that began at a height of around 110 ft and increased over the next 20 seconds (Figure 4). By that time the propeller speed was varying between 2,206 and 2,279 RPM and load was varying by about 2.5 per cent.
Figure 4: Selected engine parameters for take-off showing propeller RPM (dark blue) and engine load (purple) oscillations. Other parameters shown are power lever position (light blue), boost pressure (red), ambient air pressure (dark green), engine oil pressure (light green), and engine status data (orange).
Image shows increasing oscillations in propeller RPM and engine load, followed by a sequence of power lever movements. RPM and load vary with power lever movement.
Source: Austro Engine
The data presented in Figure 4 shows variations in power lever position following oscillations in propeller RPM and engine load. The movements were accompanied by a reduction in engine load and propeller speed. Full power was then applied and maintained until at least the end of the recording 4 seconds later. It was not clear whether any oscillations occurred after the initial power reduction. The last few seconds of engine data, below about 100 ft height, were lost due to the impact affecting the recording.
No ECU faults were recorded. The engine manufacturer reported that, other than the oscillations in propeller speed and engine load, which were not the result of power lever movement, no signs of engine problems were recorded throughout the flight.
The Garmin G1000 GPS data showed the aircraft banked left at about the same time as the power was reduced, with airspeed then decreasing to about 59 kt. The aircraft reached a height of about 431 ft above ground level before descending in a left turn, with the last recorded bank angle at 30°. Based on alignment between the accident site location, direction of travel, and the recorded data, the left turn and steep descent continued to impact. About 12 seconds of data were lost as a result of the impact.
Accident site examination
Examination of the aircraft wreckage found no pre-existing airframe issues. The aircraft impacted terrain in a northerly direction at a relatively slow speed and steep (about 20°) angle of descent. The cockpit was partially collapsed with the airframe resting on the instrument panel and seat backs. Both wings and the tail were structurally detached during the impact sequence.
The flap actuator was found in the take-off flap position. The aircraft’s fuel tanks were breached and there was evidence of spillage, although the fuel quantity could not be determined. A small quantity of fuel was drained from the tanks and matched the characteristics of aviation turbine fuel. It tested negative to water content. Previous fuel records and the engine data both indicated that there was sufficient fuel on board the aircraft.
Weather and environmental information
The weather was fine with light winds and little to no cloud. The time of the occurrence was past astronomical twilight and the moon, although nearly full, was on the horizon and would not have provided any significant light.
The departure end of runway 21 was surrounded by scrub and swamp. The township of Port Macquarie provided some light and a horizon reference to the east but the ground near the airport was dark apart from a few scattered dwellings.
Related occurrences
The engine manufacturer reported it was aware of 16 other events on aircraft fitted with the AE300 engine worldwide involving oscillations in propeller speed and load, none of which resulted in an accident. The engine manufacturer reported that in all cases, oscillations ceased with a change in power lever position.
Fifteen of these occurrences were later found to be the result of a fuel pressure issue, propeller imbalance, or faulty electrical connection in the propeller governor. Limited data from one occurrence of each type were provided by the engine manufacturer and exhibited different data signatures than that seen in the VH-YPQ accident.
The other occurrence involved a Diamond DA42, a twin-engine aircraft with a similar engine type to VH-YPQ. The reasons for that oscillation could not be determined from post-event examinations.
While acknowledging the difficulty of attempting to train pilots for a partial power loss event which has an almost infinite variability of residual power and reliability, analysis of the occurrences supports the need to raise greater awareness of the hazards associated with partial power loss and to better train pilots for this eventuality… Partial power loss occurrences have a very broad range of characteristics by nature. The most effective risk control method for managing these occurrences may be significantly different between pilots of varying experience and training, aircraft models and the environmental conditions.
Pilots and operators can significantly reduce risk following a partial or complete engine power loss using the following strategies:
Pre-flight decision making and planning for emergencies specific to the current location and conditions, taking into account the runway direction and the best direction of any turn, the local wind strength and direction on a particular day, terrain and obstacles, decision points (taking into account aircraft height and performance) where different landing options will be taken.
Taking positive action and maintaining aircraft control when turning back to the aerodrome or conducting a forced landing.
Safety actions
After the accident, the Australian International Aviation College:
introduced partial engine failure after take-off training into the syllabi for instructors and students, comprising pre-flight planning and self-briefing, ground training, and flight training
performed flight simulator tests for partial engine failure after take-off conditions in each single engine aircraft model operated by the flying school
amended procedures to ensure that pilots keep a hand on the power lever throughout the take-off
investigated the potential to introduce specific single engine escape procedures for partial and complete power loss situations for each runway regularly used by the flying school.
Continuing investigation
The investigation is continuing and will include further examination and analysis of the:
recorded data
propeller hub, governor, and engine control unit
aircraft maintenance documentation
weather conditions
pilot qualifications and experience
coordination and planning of the training flight
aircraft and flying school operational procedures
related occurrences.
____________________ The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 22 August 2017, the ATSB commenced a marine investigation into the grounding occurrence of a domestic commercial vessel (The Big Duck) in South Australia.
The initial notification indicated that the vessel broke its moorings while moored at Granite Island and drifted onto rocks in Victor Harbour.
During the course of the investigation it was identified that, during the early hours of 15 August 2017, the unoccupied vessel broke its moorings as a weather front passed through the area. The ATSB has concluded that further investigation of this occurrence would yield minimal benefits to the enhancement of transport safety.
Therefore, the ATSB has discontinued the investigation in line with the provisions of the Transport Safety Investigation Act 2003 (TSI Act).
Section 21 (2) of the TSI Act empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
The ATSB commenced an investigation into a flight control system event that occurred on 25 May 2017 involving a Boeing Company 737-800, registered VH-YIJ and operated by Virgin Australia International, on a flight from Brisbane, Queensland to Wellington, New Zealand.
The captain was the pilot flying, and he was conducting the night arrival into Wellington. The weather conditions were fine, and the descent (below flight level 250) and approach were briefed to be flown with the autopilot and autothrottle disengaged for practice.
During the approach to runway 34, the flight crew progressively selected flaps 1 then flaps 15. The landing gear was selected down and then flaps 25. The right flap moved to flap 25 but the left flap initially remained at flap 15, before moving very slowly to flap 25, which was not initially detected by the flight crew. Flap 40 was then selected, however, the flaps remained in the 25 and 15+ positions.
While carrying out the landing checklist, the flight crew detected the flap asymmetry. The flight crew attempted to rectify the problem with various flap lever selections, which were unsuccessful. Approaching 1,000 ft, the aircraft did not meet the operator’s stable approach criteria, so the flight crew initiated a missed approach.
During the missed approach, the left flap slowly extended to flap 25, correcting the initial ‘Trailing Edge Flap Asymmetry’ to a ‘Trailing Edge Flap Disagree’ condition. The aircraft, still being manually flown, subsequently climbed above the cleared altitude of 5,000 ft (reaching 5,340 ft) and the flap limit speed was marginally exceeded on two occasions. The flight crew positioned the aircraft into a holding pattern, completed the ‘After Takeoff’ checklist and ‘Trailing Edge Flap Disagree’ non-normal checklist and briefed for a second approach to runway 34 with flaps 25.
Prior to leaving the holding pattern, the captain briefed the cabin supervisor about the situation. However, the format of that briefing was the same as what the cabin supervisor would expect for an emergency. As a result, the cabin supervisor perceived that the cabin needed to be prepared for an emergency landing, which was not the captain’s intention.
A second approach was conducted with the autopilot and autothrottle engaged to 136 ft. The aircraft landed without further incident.
Engineers later performed the required aircraft inspections. They could not reproduce the flap fault, however, replaced the left-hand trailing edge flap position transmitter as a precaution.
The ATSB obtained the operator’s investigation report, and interviewed the flight crew and the cabin supervisor. The ATSB also obtained data from the aircraft’s flight data recorder, aircraft maintenance records and relevant sections of the operator’s operations manual. Based on its review of this information, the ATSB concluded that the operator had conducted a detailed investigation and it was unlikely that further ATSB investigation would identify any systemic safety issues.
The ATSB noted that, although there were flight crew errors made during the approach and the subsequent missed approach, the missed approach was conducted at an appropriate time. In addition, while the cabin crew conducted the cabin preparation drill for a non-normal landing when it was not required, doing so was an example of the operation ‘failing safe’ rather than increasing risk.
The operator has subsequently used this incident as a basis for some recurrent training for its flight crew and cabin crew. Consequently, the ATSB has discontinued this investigation.
