During the period from 30 September 2016 to 3 November 2016, a series of unlawful communications occurred on multiple air traffic control (ATC) frequencies and the aircraft emergency frequency around the Melbourne area, Victoria.
On 30 September, the flight crew of an aircraft approaching Melbourne Airport, reported hearing two instructions on the Melbourne tower (Figure 1) ATC frequency. The Melbourne tower controller did not make or hear the instructions, and there was no impact on operations.
On 25 October, on three occasions, flight crew of aircraft landing on runway 34 at Melbourne Airport received instructions, via unlawful broadcasts from an individual impersonating a Melbourne tower controller, on the Melbourne tower frequency. The Melbourne tower controller heard the broadcasts and immediately provided clarifying instructions to the flight crew. There was no impact on aircraft operations.
Figure 1: Melbourne airport ATC tower
Source: Airservices Australia
On 27 October, at about 1429 eastern daylight time, ATC received reports from flight crew of emergency broadcasts on the aircraft emergency frequency, apparently being transmitted by multiple aircraft. The broadcasts indicated an inflight emergency to the north of Melbourne. In response to these reports, ATC declared a distress phase[1] and, in accordance with emergency procedures, contacted the Australian Maritime Safety Authority (AMSA). At 1502, AMSA confirmed that the broadcasts were false and cancelled the distress phase.
At 1539, ATC received two further reports of emergency broadcasts on the aircraft emergency frequency. The broadcasts used the registration of an aircraft which was operating to the north of Melbourne at that time. The broadcasts indicated an inflight emergency overhead the Melbourne metropolitan area. ATC immediately declared a distress phase. Air traffic control then contacted the aircraft, the flight crew confirmed that they had not made the broadcasts and that operations were normal. At 1542, having confirmed that the emergency broadcasts on the aircraft emergency frequency were false, ATC cancelled the distress phase.
At 1721, a Boeing 737-800 aircraft approached runway 16 at Melbourne airport. As the aircraft descended through about 200 ft above ground level, the flight crew received the instruction ‘go around’.[2] The flight crew could not determine a reason for the instruction, however, recognising that questioning the instruction at that time could create further confusion, elected to conduct the go around. As the flight crew commenced the go around, the controller confirmed that the instruction had not been broadcast by the controller and that the aircraft remained cleared to land. As the flight crew had already commenced the go around, they elected to continue the procedure. The aircraft returned to land without further incident.
At 1724, ATC personnel updated the Melbourne Airport automatic traffic information service (ATIS)[3] used by arriving and departing aircraft crew for airport information to include notification of the unlawful broadcasts.
At 1739, the ATIS was further updated to include the information that ATC would use light signals to confirm aircraft clearances in the event of further unlawful broadcasts.
At 1929, the Avalon approach controller received an emergency broadcast using the registration of an aircraft which was operating to the north-west of Melbourne at that time. Air traffic control contacted the aircraft, the flight crew confirmed that they had not made the broadcasts and that operations were normal. No distress phase was raised and there was no impact on operations.
On 31 October, ATC received a report from the flight crew of an aircraft departing Melbourne Airport of unlawful broadcasts on the aircraft emergency frequency. The broadcasts simulated aircraft ground proximity and warning system aural alarms. There was no impact on operations.
On 3 November, ATC received multiple reports from flight crew of unlawful broadcasts occurring on the aircraft emergency frequency. The broadcasts indicated an inflight emergency, the flight crew receiving the broadcast responded, however no reply was received. There was no impact on operations.
Air Traffic Control procedures
The provider of civil ATC services in Australia, Airservices Australia, had the following procedures in place to manage unlawful broadcasts on ATC frequencies:
Manual of air traffic services (MATS)
The Airservices Australia MATS contained the following procedure for managing malicious radio transmissions:
Report unauthorised (malicious) transmissions to aircraft as detailed in local instructions.
MATS also contained the following instructions to assist controllers in managing unforeseen situations which have not been documented:
Best judgement
Do not allow anything in these instructions to preclude you from exercising your best
judgement and initiative when:
a) the safety of an aircraft may be considered to be in doubt; or
b) a situation is not covered specifically by these instructions.
Local Instructions
Melbourne tower local instructions did not provide procedures or guidance to controllers on the handling of unlawful communications.
ATC personnel response
In the absence of detailed procedures, ATC personnel used the following to manage the impact of the unlawful communications:
Shift managers briefed controllers about the activity.
Shift managers also provided controllers with recordings of previous events to familiarise the controllers with the individual’s voice.
Controllers contacted individual aircraft directly to advise that unlawful broadcasts were occurring. When controllers heard unlawful broadcasts, they immediately clarified clearance details with the affected aircraft.
The no-radio procedure of using light signals to provide aircraft clearance details was determined to be a suitable method to confirm clearances.
Included a warning on the Melbourne Airport ATIS.
Recorded all available information.
Airservices Australia Comment
The provider of civil air traffic services within Australia, Airservices Australia, provided the following comments:
Airservices considers that the established organisational resilience/crisis management practices proved effective to handle each unlawful communication event. Given it is not possible to document all elements of scenarios that a controller may face, Airservices training and risk management practices are designed to enable controllers to manage a range of unusual situations which are not documented.
Controllers will always assume that an ATC broadcast is real, as was prevalent in these occurrences. The In-Flight Emergency Response checklist was utilised and followed until it was determined that the broadcasts were hoax calls and the aircraft were not in distress. Having an established procedure to manage hoax calls may lead to ambiguity with regards to the validity of a broadcast.
The development of detailed procedures may not achieve a safety outcome as it would be impracticable to cater for all situations. Furthermore, it may restrict initiative required by ATC to safely manage each scenario on a case-by-case basis.
Safety analysis
Despite an absence of local instructions, ATC personnel were able to use best judgement to implement effective methods to manage the unlawful communications.
The false emergencies scenarios were handled quickly and effectively within existing emergency procedures. Air traffic control and AMSA personnel were able to quickly confirm the non-existence of the emergency situations and cancel the distress phases.
The unlawful communications resulted in minimal impact on aircraft, ATC and AMSA operations.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation.
There were minimal documented local instructions in place for managing unlawful communications.
Despite an absence of documented local instructions, training and crisis management practices enabled ATC personnel to effectively manage the unlawful communications to minimise the impact on aircraft and AMSA operations.
ATSB comment
The unlawful communications were broadcast by one individual. The Australian Federal Police arrested and charged this individual with five offences relating to the communications.
Safety message
Unlawful communications transmitted with malicious intent, while rare, have the potential to impact the safe operation of aircraft and, as demonstrated by this series of events, divert AMSA away from their core tasks.
Despite an absence of local instructions, ATC personnel were able to use best judgement to implement effective methods to quickly and effectively manage the unlawful communications to minimise the risk to flight safety.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 23 November 2016, a Fairchild SA226TC, registered VH-SSV (SSV), departed from Brisbane Airport, Queensland, for a passenger charter flight to the Theodore aircraft landing area (ALA), Queensland. On board the aircraft were the pilot and five passengers.
When SSV arrived at Theodore, the aircraft joined the circuit on the downwind leg for runway 17 at 2,100 ft[1] using the area QNH.[2] The pilot turned the aircraft through the base leg of the circuit, using a constant radius turn, and rolled the aircraft to wings level for the final approach at about 1,400 ft.
In the early stages of the final approach, the pilot noticed the aircraft sink,[3] so they[4] increased power slightly to compensate and by mid final they were satisfied the aircraft was stable on the desired approach path profile. On short final, the pilot checked the airspeed and noted the aircraft was at their calculated airspeed of VREF[5] +2 (111 kt). Shortly after they checked the airspeed, the pilot noticed the aircraft sink, so they pulled back on the elevator control and started to increase power, but the main wheels touched down just prior to the runway threshold. A loud bang was heard within the aircraft and the pilot immediately suspected the aircraft had struck one of the runway 17 threshold solar powered lights.
The landing was completed and after parking the aircraft on the apron, a passenger reported to the pilot that the right wing was leaking fuel. On inspection, the pilot found a puncture to the underside of the right wing, just outboard from the right engine nacelle, which had breached the fuel tank (Figure 1). They concluded it was probably the result of debris from the damaged runway light flicked up by the right main wheel tyre. There were no injuries and the aircraft received minor damage.
Figure 1: Damage to the underside of wing
Source: Pilot
Landing threshold height
Theodore ALA is situated about 560 km north-west of Brisbane. The ALA has a sealed runway strip surface at an elevation of 560 ft and direction 170-350. The runway length is 1,342 m with a slight down slope to the south (runway 17) and is fitted with low intensity runway lights at the thresholds and at 90 m intervals alongside the runway strip. The pilot used the first row of runway lights from the threshold as their landing aim point.
The landing distance required (LDR) begins at a height of 50 ft from over the runway threshold. The pilot reported flying a standard 3° approach path angle. However, a 3° approach path, with a threshold height of 50 ft is based on a landing aim point about 290 m from the runway threshold. Using the same approach path angle with an aim point 90 m from the runway threshold will reduce the threshold height to about 15 ft (Figure 2).
Figure 2: Runway threshold heights
Source: ATSB (not drawn to scale)
Landing distance performance calculations
Aeroplane flight manual
The pilot used the aeroplane flight manual (AFM) for their performance calculations. The AFM has six sections. The first four sections of the AFM were approved by the United States Federal Aviation Administration (state of manufacture). Section six was manufacturer’s data for calculating performance. The manufacturer’s data section provided two approach options for calculating LDR. One option was the short field landing approach at VREF 1.1 Vs0[6] with full reverse thrust on landing. The other option was the normal approach at VREF 1.3 Vs0 with no reverse thrust on landing.
The AFM charts are only applicable to level runways. Runway slope is not included as a factor in any of the landing distance charts.
Civil Aviation Order 20.7.4
Civil Aviation Order (CAO) 20.7.4 – Aeroplane weight and performance limitations – aeroplanes not above 5,700 kg – private, aerial work and charter operations – paragraph 10 was the CAO for defining how to calculate LDR. Paragraph 10.1 required the calculated LDR to be multiplied by a safety factor, which was 1.43 for SSV. However, paragraph 10.1 was subject to paragraph 10.3. Paragraph 10.3 stated:
Where there is an approved foreign flight manual or a manufacturer’s data manual for an aeroplane that sets out the landing distance required for that aeroplane, then that aeroplane must be operated so as to comply with the requirements set out in paragraphs 10.1 and 10.2 or the requirements relating to landing distance set out in either of those manuals.[7]
Therefore, CAO 20.7.4 did not require a multiplication factor to be applied if LDR was calculated from either the approved foreign flight manual[8] or manufacturer’s data manual.
Company operations manual
The company operations manual for the Fairchild SA226TC provided the following directions to their pilots for performance calculations:
The pilot-in-command is responsible for ensuring the aircraft is capable of the performance required for the operation. This assessment should include take-off and landing distances, climb performance, and single engine performance.
Charts supplied in the manufacturer’s approved flight manual for this aircraft are American charts and are not factored as required by CAO 20.7.4. Take-off and landing information derived from these charts must be factored to comply with the CAOs, specifically:
Take-off distances must be multiplied by a factor of 1.25
Landing distances must be multiplied by a factor of 1.43
While the operations manual referenced factoring as a regulatory requirement, it was also company policy to factor landing distances in accordance with CAO 20.7.4 paragraph 10.1, in order to include a safety margin to the flight manual charts, which were un-factored charts.
Pilot calculations
The pilot calculated a short field approach and normal approach LDR with the following results:
Short field approach VREF 93 kt. Un-factored LDR 590 m; factored LDR 840 m.
Normal approach VREF 109 kt. Un-factored LDR 1,080 m; factored LDR 1,543 m.
Therefore, for a runway length of 1,342 m, both approaches were suitable un-factored, but only the short field approach was suitable when factored. The calculations did not include a factor for runway slope, but the pilot was aware of a downslope on runway 17 from their previous experience.
Pilot’s minimum control speed experience in SA226TC
The pilot noted that the AFM-published VMC[9] for the aeroplane was 94 kt, which was greater than their calculated short field approach VREF, but less than their calculated normal approach VREF.
During the pilot’s SA226TC endorsement training in the simulator, the first time they were given an engine failure at V1 they were unable to arrest the yaw and roll in a timely manner and crashed the aircraft (simulator). The SA226TC does not have an auto-feathering[10] propeller mechanism fitted. It is fitted with a negative torque sensing system (NTS system). In the event of an engine failure during flight, the NTS system provides automatic drag reduction by moving the propeller blades towards the feather setting. Once the drag reduces and the negative torque decreases, the feather valve returns to its normal position under the influence of its spring, and the propeller blades move toward the fine (unfeathered) setting. This condition is repetitive until the pilot manually feathers the propeller and is called ‘NTSing.’
The pilot then successfully completed the simulator exercise three more times, completing all drills and feathering the propeller in an appropriate time frame. However, the minimum angle of bank they achieved while regaining control of the aircraft (simulator) was 30°.
From their simulator experiences of the asymmetric handling qualities of the aircraft near VMC, the pilot was uncomfortable conducting approaches at a calculated VREF below or close to VMC.
Approach profile and aim point selection
The pilot reported that they had flown to Theodore numerous times previously, which included 28 times during 2016 in SSV. They did not want to conduct an approach using a VREF less than VMC. Therefore, they employed the normal approach profile with a VREF 1.3 Vs0, with the LDR factored in accordance with their operations manual. This produced an LDR greater than landing distance available. In addition, the AFM charts assume a level surface. There is no factor for runway slope and downslope will increase LDR. To minimise the landing distance, the pilot applied full reverse thrust in addition to wheel braking after touchdown for the ground roll when landing at Theodore.
Runway aim point markers, located about 300 m from the threshold on sealed runways, were the standard aim point employed by the pilot. However, unsealed runways, such as Theodore, do not require aim point markers. Consequently, the pilot utilised the runway side lights for their aim point. The pilot understood that the landing distance available was between their calculated un-factored and factored LDR for a normal approach using VREF 1.3 Vs0, but the downslope on runway 17 would increase their landing distance. This led them to select the first row of runway lights as their aim point in order to maximise the runway distance available for braking. They estimated, from their previous experience, that the normal approach with the use of full reverse thrust on landing would result in a landing distance about 100 m longer than that calculated using a short field approach.
Stabilised approach criteria
The company had a ‘no-fault’ go-around policy and published stabilised approach criteria. For a visual approach the criteria apply from 300 ft above ground level. There were several criteria listed for a stabilised approach, which included:
The aircraft is on the desired flight path, e.g. established on final/base leg;
Only small pitch and heading changes are required to maintain the desired flight path;
For circling approaches, the wings must be level on final not below 300 ft above ground level; indicated airspeed at threshold (50 ft) within tolerance (VREF +5, -0).
During the approach, the aircraft was flown on the pilot’s desired flight path. On short final the pilot checked their airspeed, which was within the threshold stabilised approach criteria and continued the approach. When the aircraft began to sink on short final, the pilot pulled back on the elevator to pitch the aircraft nose upward and applied power in an attempt to avoid an early touchdown, but there was insufficient height to recover.
Convective weather
The pilot reported the incident occurred at about 1657 Eastern Standard Time (EST) and the temperature was about 36 °C. The runway surface is bitumen and the ALA is surrounded by paddocks. On the approach to runway 17, some of the paddocks had been ploughed in preparation for planting and some had light coloured crops. Following discussions between the pilot and their chief pilot, they concluded that because the wind speed in the area at the time was light, the sink may have been the result of local convective currents (known as thermals).
Convective currents are the result of uneven surface heating, which sets up areas of local circulation as the air flows from areas of higher pressure towards areas of lower pressure. Ploughed ground and bitumen surfaces, such as sealed runways, absorb and radiate a large amount of heat. If there are neighbouring surfaces, which absorb and radiate less heat, then local updrafts and downdrafts will form, which may strengthen throughout the day.
The pilot considered that a go-around from short final, with an engine failure to be the worst-case scenario when flying the Fairchild SA226TC. The short field approach required a VREF below the published VMC and therefore, when they planned their flight to Theodore, they utilised the normal approach profile speed of VREF 1.3 Vs0 to provide a safety margin.
The pilot calculated a LDR, from the AFM, for a short field and normal approach, which were both less than the landing distance available. When the pilot applied the factor of 1.43, the normal approach LDR was greater than the landing distance available. The pilot also knew from their previous experience, that there was a downslope on runway 17 at Theodore, which increased their LDR relative to a level runway. Therefore, the pilot always applied full reverse thrust whenever they landed the aircraft on runway 17 at Theodore. Their previous experience of using full reverse thrust on landing from a normal approach, led them to expect an actual landing distance about 100 m longer than required for a short field approach and within the Theodore landing distance available.
The pilot’s knowledge of the landing distance required and downslope of runway 17, led them to select the first row of runway lights as their aim point marker, while maintaining a 3° approach path profile. The use of this aim point resulted in the aircraft descending below 50 ft prior to reaching the runway threshold and therefore a low approach path on short final.
The time of the incident was near the end of a hot day with light winds. The pilot did not report that any airspeed fluctuations occurred during the approach, but they experienced sink early on the final approach and again when the incident occurred. Therefore, the runway undershoot was probably the result of a low approach path, which combined with a downdraft from local convective activity to lead to an early touchdown. The early touchdown resulted in the collision with a runway light and subsequent damage to the aircraft wing.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The pilot flew an approach path with a low runway threshold height, which combined with a downdraft from local convective activity on short final, resulting in a runway undershoot, collision with the runway light and damage to the aircraft wing.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they have taken the following safety actions:
Internal investigation
The operator conducted an investigation into the incident, where a detailed safety report was produced. The report concluded that ‘this incident was a mishandled landing, with the pilots’ aiming point and probable thermal activity as contributing factors.’
Training
Prior to further operations in this aircraft type, the incident pilot was retrained on the aircraft type, which involved the following:
The pilot received a detailed briefing covering aircraft type performance.
The pilot flew with the type specialist for re-training. These flights involved operations into different airports and runway environments.
The pilot was returned to duty on charter operations under supervision, and then re-assessed prior to further line flying operations.
Operations manual
The company operations manual for the Fairchild SA226TC shall be amended to reference the factoring of landing distances as a company procedure.
Safety message
This incident highlights the risk of unintended consequences associated with variations from standards. Each change on its own may not lead to an incident or accident, but may increase the likelihood of an incident or accident if combined with an unexpected event(s).
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 17 March 2017, an Agusta AB206A helicopter, registered VH-DPU, departed Caboolture Airfield, for Curtis Island, Queensland, on a private flight. On board the helicopter were the pilot and one passenger.
Prior to departure, the helicopter had been refuelled to full at Caboolture Airfield. The helicopter was flown for about 2.5 hours north, initially inland, then coastal to the north of Curtis Island where the pilot planned to land for a fishing trip (Figure 1). At 1142 Eastern Standard Time (EST), the pilot sent a text message from their[1] mobile phone to a friend monitoring their search and rescue time, which indicated they had arrived at their planned fishing spot.[2] At 1144, the helicopter was recorded on an OzRunways application, running on a mobile device, at the north-east coast of Curtis Island heading 209°.
Figure 1: VH-DPU track and accident site (drop pin)
Source: OzRunways track on Google earth, annotated by ATSB
The pilot reported that they tracked along the coast at about 500 ft and then turned the helicopter to the left from the coast to identify their planned landing site. The pilot was uncertain of the number of turns conducted near the landing site, but believed that it was during the second turn at about 50 ft and 40–60 kt that they suddenly felt there was ‘no power’. The pilot reported that the helicopter made one uncontrolled turn through about 360° during the descent, and at some stage they lowered the collective with the assumption the engine had failed.[3] The main rotor blades appeared to be flapping[4] violently to the point the pilot thought the blades were going to separate from the helicopter before impact with the water. The pilot and passenger reported that they did not see any caution lights or hear any audio alarms before or during the accident sequence.
The helicopter initially impacted upright in the water before the airframe separated from the helicopter skids, turned through 180° and rolled onto its left side (Figure 2). This placed the passenger, in the left seat, under water. As soon as movement ceased, the pilot tried to pull the passenger’s head above the water, but the passenger was initially trapped in their harness. The passenger subsequently struggled free from their harness without unfastening it. The pilot and passenger exited the helicopter, at which stage the pilot reported to the passenger that they felt paralysed below the waist.
Figure 2: VH-DPU accident site at low tide
Source: Queensland Police Service
The pilot and passenger decided to attempt to retrieve the emergency position indicating radio beacon (EPIRB),[5] which was located in a bracket mount on the passenger side of the helicopter, which was under water. On their third unsuccessful attempt to retrieve the EPIRB, the pilot became temporarily entangled with the helicopter controls and headset under water and no further attempts were made. The passenger then assisted the pilot, who was unable to move their legs, to above the high tide mark along with the provisions they could retrieve from the helicopter, which included a first aid kit.
On 18 March 2017 (the next day), a member of the public sighted debris north of Curtis Island, which they reported to the police. The recovery of the debris revealed the name of the accident passenger’s daughter. When the police contacted the passenger’s family, the family told the police the helicopter was overdue. The Australian Maritime Safety Authority then coordinated the search, which included use of OzRunways data. Although the pilot could see the search and rescue services within their vicinity at times during the search period, they could not signal them. At about 0300 on 19 March 2017, the rescue helicopter located the wreckage and survivors, who were transferred to Rockhampton Hospital. The pilot and passenger were seriously injured, and the helicopter was substantially damaged.
Fuel on board
The helicopter was originally manufactured with a standard 288 L fuel tank and was subsequently modified with a fuel range extender device, which increased the fuel tank capacity to 344 L. The standard fuel refill port is not located at the top of the fuel tank. The range extender is an L-joint device fitted to the refill port, which raises the height of the refill port to increase the capacity of the fuel tank. It was reported that the helicopter was refuelled to full fuel (344 L) with the addition of 212 L on the morning of the accident by the pilot’s maintenance provider. The pilot did not visually inspect the fuel quantity, but noted the fuel gauge indicated full when power was applied to the helicopter.
The manufacturer calculated the helicopter would consume about 100 L per hour of fuel. If the helicopter had full fuel at departure, the manufacturer estimated that after 2.5 hours of flight there should have been about 94 L of fuel on board. This is greater than the quantity of fuel which would activate the low fuel level caution light, which is about 76 L. The pilot reported that the fuel gauge indicated about 25 gallons (95 L) when they conducted their pre-landing checks, and the low fuel caution light did not illuminate during the flight. The passenger reported a strong smell of aviation fuel in the water immediately following the accident.
Examination of the wreckage
The aviation loss surveyor appointed by the insurer recovered the helicopter wreckage from Curtis Island to Rockhampton for an initial examination. They found the fuel tank ruptured and fuel present in the fuel filter, which is located in the fuel line between the fuel tank and the engine. They followed the fuel line to the engine fuel control unit and found fuel present on both the inlet and outlet side of the unit. They inspected the engine inlet and outlet and did not find any obvious damage. They noted one of the rotor blades had very little damage, which indicated to them that there was little rotational energy in the rotor blades at the time of impact.
The surveyor subsequently conducted further detailed inspections of components and parts. They found the drives for the fuel pump, fuel control unit and governor were intact. The engine and transmission chip detectors and filters for the fluid systems (fuel, oil and hydraulic) revealed no evidence of a mechanical failure.
ATSB review of photographic evidence
The Queensland Police Service provided a considerable number of photographs of the wreckage to the ATSB. On review of the photographs, the ATSB could not identify any obvious mechanical fault with the helicopter that was not attributable to accident impact damage. The overhead circuit breaker panel had several tripped circuit breakers, including the warning lights, audio panel and instrument lights circuit breakers. However, it is possible for circuit breakers to trip as a result of impact forces.
Testing the warning and caution lights, and checking the overhead circuit breakers, are items in the flight manual checklists for before and after engine start. The pilot reported that these checks were performed before departure from Caboolture. They made radio transmissions during the flight and communicated with the passenger using headsets, which indicates that the audio circuit breaker was in prior to the accident. The ATSB noted that the condition of the main and tail rotor blades indicated there was little rotational energy in the blades at the time of impact (Figure 3).
Figure 3: VH-DPU main and tail rotor blades
Source: Queensland Police Service
Engine out warning
The helicopter was fitted with an ‘engine out’ warning light and audio alarm (horn). The warning activates at 55 (+/- 3) per cent engine gas generator speed. Activation of the warning light is checked when the battery is switched on in the engine pre-start check. The pilot reported that this was checked serviceable before the accident flight in accordance with the checklist. The pilot and passenger reported that they did not observe any warning lights or hear any alarms during the accident sequence. The ATSB inspected the ‘engine out’ light bulb and found no evidence of stretching or ductile failure. Substantial impact force is required to damage a light bulb filament and a hot filament will sustain damage at a lower force than a cold filament. The absence of damage to the filament, by itself, is inconclusive.
Torque effect
The AB206A helicopter engine drives the main rotors to the left, when viewed from the pilot’s seat. This subjects the airframe to a turning moment to the right (Figure 4). The tail rotor provides the anti-torque force to prevent the engine power from turning the airframe to the right. It is mechanically connected to the main rotor system through the main rotor gearbox and operates at a speed, which is much higher, but proportional to the main rotors. A reduction in rotor speed will reduce the anti-torque force provided by the tail rotor and can lead to loss of tail rotor effectiveness and consequently loss of directional control.
Figure 4: General effect of engine torque
Source: Bell Helicopter, annotated by ATSB (Agusta AB206A rotors turn in the same direction)
Rotor stalls
During a powered descent, or a descent following an engine failure, the helicopter experiences a rate of descent airflow in opposition to the rotor induced airflow.[6] This can increase the rotor blade’s angle of attack[7] to the point that the root of the blades may stall.[8] Decaying rotor speed is the initial indication. If the pilot does not respond to the early symptoms by lowering the collective, then the stalled region spreads outward towards the rotor tips. A complete rotor stall will lead to a loss of directional control, severe blade flapping and possible blade failure from high blade coning angles.[9]
Further information on rotor stall and how to recover from low rotor speed is available from the United States Federal Aviation Administration Helicopter flying handbook, chapter 11: Helicopter emergencies and hazards.
Pilot reaction to low rotor speed
If a high collective setting is in use, then the rotor blades will have a high pitch setting with associated high rotor drag. In the absence of power, or with insufficient power, the high drag will reduce the speed of the rotors.
The research was conducted in response to three recommendations from fatal helicopter accidents in the UK in 1981, 1986 and 1992. The accidents were associated with low rotor speed at impact.
The UK CAA found that ‘pilots immediately detected failures involving variables within their focus of attention, but required more time to detect alerting cues outside their focus of attention.’ It also found that ‘auditory cues were probably the most significant alerting stimuli in each type of helicopter, and some differences in detection times correlated with the degree to which auditory cues were ‘attention getting’.’
Low rotor speed warning
The AB206A helicopter flight manual emergency procedures section included the following details within the caution system:
Fault and remedy: Rotor RPM is below normal. Reduce collective pitch and check that throttle is full open.
The 206A was manufactured by Agusta,[11] in Europe, and by Bell Helicopter in North America and Canada. The accident helicopter was an Agusta AB206A, manufactured for the Austrian Army in 1969 and registered in Australia on 7 April 2011. The pilot was unsure if the helicopter was fitted with a low rotor speed warning system, but the former owner reported that it was not fitted. The manufacturer reported that at the time of the delivery of the helicopter from production, the low rotor speed warning system was not fitted to the AB206A helicopters. Bell Helicopter have published approved data to retrofit a low rotor speed warning system to some serial numbers of their 206A helicopters (service instruction 206‑74), but there is currently no approved data to retrofit a low rotor speed warning system to the Agusta AB206A.
Certification specifications
The accident helicopter was operating under the Civil Aviation Safety Authority type acceptance certificate for the AB206A, which referenced the European Aviation Safety Agency (EASA) issued type certificate data sheet for the certification specifications (CS). VH-DPU was manufactured in 1969 in Italy to the United States (US) Civil Aeronautics Board[12] standard Civil Air Regulations Part 6 (CAR 6) Rotorcraft airworthiness: normal category, dated 20 December 1956.
Current EASA (CS-27) and US Federal Aviation Administration (27.33) certification specifications for ‘Main rotor speed and pitch limits’ include the following:
For each single engine helicopter…there must be a main rotor low speed warning.
In accordance with CS 27.33 (e) (1) and (3):
The warning must be furnished to the pilot in all flight conditions…when the speed of a main rotor approaches a value that can jeopardise safe flight, and, a visual device that requires the attention of the crew within the cockpit is not acceptable by itself.
The CAR 6 standard did not require the installation of a low rotor speed warning system, only instrument markings to indicate the limits beyond which operation is dangerous. Nevertheless, from the AB206B model, the low rotor speed warning system was factory installed as standard.
Previous accidents
Low rotor speed
The ATSB investigation of a forced landing involving a Robinson R44 helicopter (AO-2016-172) on 17 December 2016 indicated that the pilot was alerted to a low rotor speed condition by the associated warning horn. The pilot noted the rotor speed had reduced to 85 per cent at the time the warning directed their attention to the rotor speed. They were conscious of a potential rotor stall condition if they allowed the rotor speed to reduce below 80 per cent while they positioned the helicopter for an autorotation to a safe landing site.
Active noise reduction headsets
The pilot of VH-DPU was wearing an active noise reduction (also known as noise cancelling) headset and was not alerted to any unusual noises before they experienced what they described as ‘no power.’ Several pilots involved in previous accidents have commented that the use of these headsets may have impeded their ability to hear aircraft warning devices or the early signs of an impending mechanical failure.
For further information see the following ATSB reports:
In 2013, the ATSB published a report on the effectiveness of emergency locator transmitters (ELTs) in aviation accidents (AR-2012-128). ELTs are radio beacons carried on aircraft so that in the event of an accident in a remote location the wreckage and survivors can be located quickly by search and rescue services. This increases the chances of survival for the occupants. The report included personal locator beacons (PLBs) and EPIRBs.
Airframe mounted ELTs are designed to automatically activate during a crash, by a g-force activated switch or, less commonly, by a water-activated switch. The report identified safety concerns regarding the operation of ELTs and found that they functioned as intended in about 40–60 per cent of accidents in which their activation was expected. The report indicated that carrying a PLB (or EPIRB) in place of, or as well as, an airframe mounted ELT will most likely only be beneficial to safety if it is carried on the person, rather than being fitted or stowed elsewhere in the aircraft.
Safety analysis
Accident sequence
The potential wind effect on the helicopter just prior to the accident sequence was not analysed due to the pilot’s uncertainty[13] in the number of turns prior to and during the accident sequence and their report of light wind conditions leading up to the accident. The pilot reported that during the approach to land, there was suddenly ‘no power’ and that they experienced a sudden engine failure. However, the ATSB notes that the symptoms reported by the pilot were similar to the symptoms of a rotor stall.
If a helicopter is in an incipient rotor stall and the pilot either maintains or increases collective, the rotor stall will deepen. In this situation, the helicopter will not respond in the normal and expected manner, instead, rotor speed will decay and the rate of descent will increase. This response by the helicopter could be perceived by the pilot as a loss of power.
During the accident sequence, the airframe separated from the helicopter skids and turned 180°, which indicates that there was a turning moment (torque) on the airframe at touchdown. This is consistent with the pilot’s report that the helicopter rotated during the accident sequence. In the event of an engine failure, there will be no turning moment from the engine applied to the airframe. Any turning moment from the tail rotor is easily corrected and becomes negligible at low rotor speed. However, in a rotor stall the engine continues to apply torque to the airframe, which results in an uncommanded turn at low rotor speed.
The separation of the airframe from the landing skids, and final relative position of the airframe and landing skids, was consistent with low forward speed and engine torque combined with low rotor speed at impact. Therefore, the accident was probably the result of a rotor stall, but it was not determined how the helicopter entered the rotor stall. From the evidence available, fuel starvation or fuel exhaustion were considered unlikely.
Caution system
The pilot checked the circuit breakers and tested the caution and warning lights before take-off. Therefore, the circuit breakers, which were found out post-accident, probably tripped as a result of the impact forces. The results of the analysis of the ‘engine out’ light bulb were inconclusive but did not contradict the findings of the aviation loss surveyor, who found no evidence of pre-impact mechanical fault. Of note, the pilot was using an active noise reduction headset. Active noise reduction headsets could impair a pilot’s ability to hear a warning horn, such as the ‘engine out’ warning,[14] which is not transmitted through the intercom system, or any subtle pitch changes in rotor speed or engine speed. However, the ATSB did not perform any tests to evaluate this effect.
Low rotor speed warning
Previous research has found that auditory cues can reduce pilot detection time of a problem in an emergency. The current European and United States airworthiness standards for this category of helicopter require a main rotor low speed warning system, but this was not required for the accident helicopter, which was manufactured to 1956 standards. The pilot did not identify a low rotor speed condition before they experienced ‘no power’ and the helicopter was not fitted with a low rotor speed warning system.
The condition of the rotor blades post-impact indicated there was little rotational energy in the blades at the time of impact. The helicopter could lose rotor speed due to either an engine failure or rotor stall condition. In each case, other than an engine failure close to the ground,[15] the pilot should lower the collective to maintain or recover rotor speed.
It is probable that the helicopter had entered an incipient rotor stall while the pilot’s attention was focused on positioning the helicopter for their intended landing site. In the absence of a low rotor speed warning this was initially undetected until the pilot suddenly experienced ‘no power’, at which stage there was insufficient height to recover. Therefore, the absence of a low rotor speed warning system increased the risk of a loss of control.
Emergency position indicating radio beacon
The helicopter was carrying an emergency position indicating radio beacon (EPIRB), which must be manually activated. However, the pilot was unable to locate and retrieve the beacon from the wreckage in order to activate it after the accident. The pilot reported their arrival at their intended landing spot before the accident occurred, which, in combination with their inability to retrieve and activate the beacon, resulted in a considerable delay after the accident before search and rescue was activated.
The pilot and passenger were found by search and rescue services about 39 hours after the accident. Therefore, the absence of an automatically activated emergency locator transmitter (ELT) and the inability of the occupants to retrieve their EPIRB increased the risks associated with their post-accident survival.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
It is probable the helicopter experienced a main rotor stall from a low height and low forward speed.
The helicopter was not fitted with a low rotor speed warning system. A low rotor speed warning system was not a certification requirement for the helicopter at the time of manufacture and there is currently no approved data for the modification. The absence of a low rotor speed warning system increased the risk of the pilot losing control of the helicopter.
The helicopter was carrying an emergency position indicating radio beacon which was inaccessible after the accident. This resulted in a considerable delay to the search and rescue.
The pilot reported a sudden loss of power. However, examination of the wreckage by the aviation loss surveyor found no evidence of pre-impact mechanical fault. Fuel starvation or fuel exhaustion were considered unlikely.
Safety message
The pilot reported that it was beneficial to have a first aid kit on board the helicopter, which they retrieved and used following the accident. However, they considered it necessary to carry the emergency position indicating radio beacon on the person, rather than fitted to the helicopter. They further noted that a high quality strobe light would have assisted them to signal their location once search and rescue services were in the vicinity.
The use of active noise reduction (noise cancelling) headsets has become prevalent in aviation. It is, however, important to always consider their compatibility with the aircraft warning systems. The Civil Aviation Safety Authority have published an airworthiness article (previously an airworthiness advisory circular) AAC 1-43 Noise isolating headsets, which highlights the potential benefits and risks associated with the use of these headsets.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 17 March 2017, a Saab 340B aircraft, registered VH-NRX, was operated by Regional Express (Rex) as flight RXA768 on a routine passenger flight from Albury, New South Wales (NSW) to Sydney, NSW. On board the aircraft were 16 passengers and three crew.
About 102 km (55 NM) south-west of Sydney Airport, the crew noticed uncommanded engine indications and began the necessary checklists. While undertaking the checklist items, the crew experienced minor vibrations from the right engine. These vibrations worsened as the checklist progressed and became visually evident to the first officer. As a result, the crew commenced the engine shutdown procedure. During the procedure, the propeller separated from the aircraft. The crew made a PAN PAN[1] call to air traffic control, and completed the engine shutdown procedure. The aircraft landed without incident at Sydney Airport.
On 21 March 2017, the NSW Police Aviation Support Branch located the propeller in an area under dense forest about 19 km (10 NM) south-west of Sydney Airport.
What the ATSB found
An inspection of the aircraft by the ATSB at Sydney Airport identified that the propeller gearbox (PGB) propeller shaft had fractured, leading to the separation of the propeller. Subsequent laboratory analysis of the propeller shaft revealed that the failure occurred as a result of a fatigue crack that had initiated from the PGB propeller shaft flange dowel pin hole.
The ATSB found that the manufacturer’s maintenance documentation did not include specific inspection procedures to detect fatigue cracking of the propeller shaft. In addition, the operator’s inspection worksheets did not provide for the recording of inspection findings as defined within documented procedures. Consequently, this may not have provided for the best opportunity to ensure potential defects were identified, recorded and monitored.
What's been done as a result
Following the occurrence, the engine manufacturer (General Electric) released a number of service bulletins (SB 72-0530 and SB 72-0531) requiring immediate inspection of the PGB propeller shaft. Changes were also made to the engine maintenance manuals to include more ongoing detailed inspections of this area. Additionally, the United States Federal Aviation Administration, issued airworthiness directive AD 2018-03-13, on 14 February 2018, which required initial and repetitive visual inspection and fluorescent-penetrant inspection (FPI) of the main propeller shaft for affected engines.
Safety message
This occurrence highlighted how non-life-limited components such as a propeller shaft may still develop defects and fail in-flight. Appropriate training, the use of checklists and effective crew interaction, provide the best opportunity for a positive outcome in the event of such a failure affecting flight safety. Additionally, operators are reminded of the importance of having worksheets that accurately reflect the requirements and intentions of associated maintenance documentation.
On 17 March 2017, a Saab 340B aircraft, registered VH-NRX was operated by Regional Express (Rex) as flight RXA768 on a routine passenger flight from Albury, New South Wales (NSW) to Sydney, NSW. On board the aircraft were 16 passengers and three crew.
About 109 km (55 NM) south-west of Sydney Airport, the crew noticed a slight fluctuation on the right engine torque gauge. The captain manipulated the power levers and condition lever to see if that could rectify the condition. When those actions were unable to stop the fluctuations, the crew proceeded to action the uncommanded engine operation procedures. While undertaking the checklist items, the crew experienced minor vibrations from the right engine. These vibrations worsened as the checklist progressed and became visually evident to the first officer. As a result, the crew commenced the engine shutdown procedure. During the engine shutdown procedure, at 1149 AEDT[2], the propeller separated from the aircraft. The crew made a PAN PAN[3] call to air traffic control, and completed the engine shutdown procedure. The aircraft landed without further incident at Sydney Airport.
Figure 1: The aircraft, VH-NRX, at Sydney Airport after the incident showing the point of separation of the propeller in close-up
Source: Grahame Hutchison and ATSB (modified)
An inspection of the aircraft by the ATSB at Sydney Airport identified that the propeller shaft had fractured, leading to the separation of the propeller.
On 21 March 2017, the NSW Police Aviation Support Branch (PolAir) located the propeller in an area under dense forest about 19 km (10 NM) south-west of Sydney Airport. The propeller was found with the flange section of propeller shaft secured to the propeller assembly and a fracture through the propeller shaft (Figure 2).
Figure 2: The separated propeller from VH-NRX
This image shows the propeller as found in bushland by PolAir about 19 km (10 NM) south-west of Sydney Airport.
This shows the propeller flange still attached to the rear of the propeller. Note that the attachment nuts were in the process of being removed by ATSB investigators onsite, in order to release the flange.
The ATSB downloaded and analysed data from the aircraft’s flight data and cockpit voice recorders (FDR and CVR, respectively). The data confirmed the crew had identified problems with the right engine torque gauge approximately 10 minutes before the failure of the propeller shaft and were in the process of actioning the relevant checklists when separation of the propeller from the aircraft occurred.
Personnel information
Both the captain and first officer held valid Class 1 medical certificates, and were appropriately qualified to conduct the flight. The captain had a total aeronautical experience of 6,631 hours, with 2,788 hours flying Saab 340 aircraft. The first officer had a total aeronautical experience of 1,683 hours with 1,410 hours flying Saab 340 aircraft.
Crew actions
Following the onset of the torque gauge fluctuations, the flight crew used the relevant the checklists, and worked together well as a crew. The crew did not divert from the checklists, and used additional services from air traffic control to manage the aircraft. The crew did not make any rapid decisions, and ensured that all options were considered before action was taken, including consideration of the go-around requirements due to weather.
Aircraft and engine information
The aircraft was a Saab 340B aircraft, serial number 340B-291, manufactured in 1991 and first registered in Australia in October 2004. At the time of the occurrence, the airframe had accumulated 39,625 hours and 43,112 flight cycles total time in service.
The aircraft was fitted with two General Electric (GE) CT7-9B turboprop engines. The CT7 engine consists of a modular power unit and a propeller gearbox (PGB). The engine can be fitted with a Dowty or Hamilton Sundstrand propeller.
The propeller separated due to cracking between the propeller main shaft and the flanged region (Figure 3) on the right side PGB.
Figure 3: Propeller gearbox schematic highlighting the recovered section of the propeller shaft
Source: GE Aviation, modified by ATSB
The operator imported the event PGB module—serial number UDAG0153—from an international operator in December 2015. It entered service in Australia in March 2016 following fitment to the event engine—serial number (ESN) 785150—on 8 March 2016 on another company aircraft. The assembly—ESN 785150 and PGB UDAG0153—with Dowty propeller SN DRG/7635/91 was fitted to the right side of VH-NRX on 16 November 2016. At the time of the occurrence, the PGB had accumulated 46,406 hours (TSN) and 42,872 flight cycles since new (CSN).
Propeller shaft examination
Failure of the propeller occurred as a result of cracking between the propeller main shaft and the flanged region.
The propeller was found attached to the forward-facing (mating) flange by 12 self-locking nuts and two dowel pins, which are a press fit into the dowel pin holes. Following removal of the bolts, the fractured section of the propeller shaft was removed. The dowel pins were still installed in their respective dowel pin holes, and the non-metallic gasket/shim located between the propeller shaft flange and the propeller hub did not exhibit any wear or damage. The flange section of the propeller shaft was sent to the ATSB’s Canberra facilities for further examination (Figure 4).
Figure 4: Separated shaft section in their as-received condition
Image shows that cracking was observed near one of the dowel pins and the fretting discolouration observed on the propeller side of the flange. Source: ATSB
Examination of the propeller flange section of the fractured shaft revealed cracking emanating from one of the dowel pin holes (Figure 4). The cracking had progressed through the flange thickness, transitioning into the shaft portion at an angle indicative of torsional loading, and ultimately resulted in shaft separation. The shaft fracture had deformed in a radial direction, which exposed some of the fracture face, and evidence of beachmarks typical of fatigue (cyclic) cracking were observed (Figure 5).
Figure 5: Section of the exposed propeller shaft showing beachmarks
Image shows the beachmarks on the fracture surface, which was indicative of a fatigue failure mechanism. Source: ATSB
Local fretting damage and corrosion was observed around the forward flange surface circumference with the more severe damage observed directly inboard of the dowel pin hole at the crack location. Remaining flange thickness in the more heavily fretted region measured 0.684 inch (17.37 mm), which was 0.03 mm below the minimum manual limit requirement of 0.685 inch (17.40 mm). An oily dark residue was present around the retention lip feature of the dowel pin hole.
Similar shaped discoloration patterns to those observed on the propeller shaft forward flange were present on the gasket/shim; however, negligible wear was measured in these regions. Gasket/shim thickness measured 0.060 inch (1.524 mm) in two areas, indicating fretting wear on the steel propeller shaft likely occurred prior to the introduction of this particular gasket/shim. The gasket/shim is retained with the propeller during the removal/installation procedure, and the maintenance manual does not contain any information on when it is required to be changed. As such, there was no record of when this gasket/shim had been installed on that propeller.
Following the initial visual examination, the sample was sectioned through the dowel pin holes in order to expose the fracture surface (Figure 6). Once opened, a discoloured initial fracture region consistent with fatigue was observed towards the forward flange face along with some discoloration of the dowel pin itself. The fatigue fracture itself had completely progressed through the flange thickness.
Figure 6: Section of the propeller shaft showing the fatigue crack progressing into the shaft
Source: ATSB
The dowel pin bore was corroded in parts (shown in Figure 7), and corrosion pitting was found near the fracture. Cadmium (Cd) plating, normally present on the forward flange face, dowel pin hole surfaces and exposed propeller shaft, was missing within the dowel pin hole, with the exception of several streaks near the aft end of the hole.
Figure 7: Corrosion observed within the bore of the dowel pin hole
Image show corrosion in bore, along with crack originating at the forward corner of the dowel pin hole (arrowed) Source: ATSB
Manufacturer’s materials failure analysis
Following the visual examinations and preliminary sectioning at the ATSB facilities, the fractured components were returned to the engine manufacturer for additional analysis and testing. Examination in a scanning electron microscope confirmed the presence of corrosion product immediately below the initial fracture region along with shallow, trough-shaped features (Figure 8). Corrosion pitting was observed along the edge of the initial fracture leading to a rounded appearance. Spectral imaging (energy dispersive x-ray analysis) of the dowel pin hole and fretted region on the propeller shaft flange forward face also confirmed the absence of original cadmium (Cd) plating. The corrosion product consisted of iron (Fe), oxygen (O) (consistent with a steel corrosion product) sulphur (S) and residual cadmium (Cd).
Figure 8: Scanning electron microscope image of the internal surface of the dowel pin hole and initial fracture surface
Source: GE
The propeller shaft flange was then sectioned to perform a microstructural examination of the fracture surface and the adjacent area. No microstructural anomalies were observed, and the microstructure was tempered martensite, consistent with the material type in the correctly processed condition. However, the metallographic sections showed significant general surface corrosion, pitting corrosion and secondary cracking in the area adjacent to the primary fracture surface. Many of the shallow secondary cracks identified during a step polishing examination were filled with corrosion product (Figure 9). The presence of multiple shallow crack features supported crack initiation towards the forward dowel pin hole area.
Figure 9: Metallographic cross section adjacent to the fracture surface showing secondary cracking
The micrograph shows the secondary cracking extending from the dowel pin hole in the region adjacent to the primary fracture surface. Also, note the corroded initial fracture surface at the top of the image, and the rounded fracture edge. Note that 2 mil is approximately equal to 50 µm. The crack length in the image is approximately 84 µm in length. Source: GE
Due to the badly corroded condition of the initial fracture surface, the engine manufacturer was unable to establish a definitive contributing factor for crack initiation. It was considered that corrosion within the dowel pin hole was a strong contributor. However, stress analysis performed by the manufacturer confirmed low alternating stresses in dowel pin hole area. For a flaw of 3.8mm x 3.8mm, with nominal assumptions, it was predicted that there would be no crack propagation. That is, corrosion pitting down to depth observed in the dowel pin hole on its own, would not cause crack propagation.
Mechanisms that would increase the dowel pin load such as loss of clamp between the flange faces could assist in crack initiation. While the torque values were not recorded during flange removal from the recovered propeller, bolt tensions were observed to be similar for all bolts and were consistent with expectations. Additionally, while the operator did not record torque values as part of their propeller removal process (nor were they required to per the propeller maintenance manual), they did not report experiencing any instances of low bolt tension during the propeller removal process.
The presence of that significant secondary corrosion did, however, support either an initially slower moving crack or a crack that had arrested for some unquantifiable period allowing the corrosion to occur. The remaining, less damaged portion of the fracture surface was consistent with lower alternating stress, high cycle fatigue (HCF) mechanisms, ultimately leading to shaft separation.
Propeller gearbox maintenance
Maintenance of the PGB propeller shaft was on-condition, meaning no mandated maintenance activities were specified, as it was a non-life-limited component. There were no records of shop visits for repair of PGB UDAG0153. There were also no records of animal strikes or propeller events.
The maintenance documentation did require ongoing inspection of the main propeller shaft whenever the gearbox was returned for maintenance. The GE maintenance manual SEI-576 72-10-00 also stated that whenever the propeller flange was exposed, for example, a propeller change, it was to be inspected for the following:
nicks, burrs and scratches
usable limits: any number, 0.15 inch (0.38 mm) deep maximum
corrective action: remove high metal
elongated holes
usable limits: none allowed
corrective action: replace gearbox
dowel deformation
usable limit: not permitted
corrective action: replace gearbox
missing cadmium plating on:
forward face of the flange
usable limit: any amount with no corrosion
corrective action: replace gearbox
other locations
not permitted, if base metal visible
corrective action: repairable, brush with cadmium
wear on the face of the flange
usable limit: flange thickness at worn area must be 0.685 inch (17.40 mm) minimum
corrective action: replace gearbox.
The most recent opportunity for the flange to be inspected was at a propeller change on 20 October 2016, approximately 5 months and 437 hours / 516 flight cycles prior to the occurrence. No rejectable issues were reported. The inspection was included in the operator’s propeller removal/installation worksheet, HM-26 Revision 5. One entry related to inspection of the flange, stated:
Carry out visual inspection of PGB propeller drive shaft flange (MRB 721003)
The worksheet contained a single box to be signed and dated at the completion of the task.
MRB 721003 was a task in the aircraft Maintenance Review Board report, which specified a ‘Visual inspection of the PGB propeller drive shaft flange during exposure at propeller maintenance’ and referred to GE MM SEI 576 72-10-00.
This particular PGB was subject to Airworthiness Directive AD 94-17-16 and Service Bulletin SB 72-A0350, Engine – General – Recommended Inspection of Propeller Shafts for Possible Inclusions. The service bulletin and supporting airworthiness directive required a one-time ultrasonic inspection of the propeller shaft flange outer diameter (OD) fillet radius and inner diameter (ID) bore to look for subsurface metallurgical defects on a suspect population of propeller shafts. The inspection was carried out on UDAG0153 on 8 February 1994 with no findings reported.
Propeller balancing
The manufacturer’s maintenance documents required a static balance of the propeller following overhaul (7,500 hours or 5 years) or major repair. The operator’s system of maintenance also required periodic dynamic balancing of propellers every 2,000-flight hours of operation. There was no requirement from the manufacturer to perform a dynamic balance upon installation of the propeller following an overhaul.
The occurrence propeller was statically balanced on 19 October 2016, at 1,361.8 hours since overhaul (TSO), as a result of fitment of a new de-ice boot. Following this maintenance activity, the propeller was fitted to PGB UDAG0153, which was installed on another company aircraft, VH-ZLX. The entire assembly (engine, PGB and propeller) was then moved to VH-NRX on 16 November 2016.
Other occurrences
The same propeller gearbox design was fitted to multiple variants of the CT7 engine (5A2, 7A1, 9B, 9C, and 9C3) on Saab 340 and EADS CASA[4] CN-235 aircraft. On 21 November 1991, a Comair Saab 340A aircraft experienced an in-flight propeller separation event near Buffalo, New York, United States. The National Transportation Safety Board (NTSB) examined that occurrence (NTSB No. NYC 92-I-A035) and concluded that the propeller shaft fractured as result of a fatigue crack that had initiated at an inclusion near the flange radius. Following the occurrence, GE mandated a fleet wide ultrasonic inspection to look for metallurgical inclusions at that location. They also changed the design of the shaft to include a larger radius at the fillet, which led to a reduction in stresses at that location.
The in-flight loss of propeller involving Saab 340B VH-NRX at 19 km (10 NM) south-west of Sydney, New South Wales (NSW), on 17 March 2017, was the result of the fracture of the propeller shaft on the right engine propeller reduction gearbox (PGB). The shaft fracture led to the separation of the propeller from the aircraft. The flight crew performed an uneventful single-engine landing at Sydney Airport. The crew showed a high level of professionalism in their response to the engine failure and loss of a propeller. The crew demonstrated high levels of communication and coordination, and promptly applied checklists and procedures. As such, this analysis will focus on the failure of the propeller shaft.
Propeller shaft separation
The shaft failed as a result of a fatigue crack propagation that initiated at a dowel pin hole. The crack then propagated into the shaft in a torsional manner, before failing in overstress.
Extensive corrosion and fretting was observed on the PGB propeller shaft forward flange surface. The initial fracture surface adjacent to the dowel pin hole corner exhibited a darker surface from corrosion and debris product compared to the remaining fracture. The corroded condition of the initial fracture surface suggested the fatigue crack had been present for a significant period. However, the time from when it initiated could not be quantified. The portion of the fracture slightly beyond the heavily corroded region was smeared, but also exhibited significant pitting corrosion. Higher magnification examination in these areas revealed general fracture morphology consistent with lower alternating stress, high cycle fatigue (HCF) crack propagation mechanisms.
Due to the corroded condition of the initial fracture surface, a definitive root cause for crack initiation could not be established, although corrosion within the dowel pin hole was believed to be a strong contributor to crack initiation. Analysis by General Electric indicated that the initiation of fatigue cracking of the flange may be associated with a combination of factors that include:
the accumulation of significant operational hours for the PGB
the development of pitting corrosion damage within the dowel pin bore and at the front face of the propeller flange
progressive wear and subsequent surface damage of the hub flange at stress-critical regions surrounding the dowel pin
possible dowel pin load increase due to reduced clamping force.
Propeller gearbox maintenance requirements
At the time of the occurrence, there were no specific requirements in the manufacturer’s maintenance documentation for routine inspection within the dowel pin bores and cracking in that location. A failure in a similar location in 1991 prompted a one-off ultrasonic inspection for inclusions in the area, however, there were no ongoing inspections required.
While the maintenance manual did specify some general inspection and measurement of the propeller flange, there was no specific task to look for cracks, such as a magnetic particle or dye penetrant inspection. These techniques were only utilised when the PGB was disassembled for maintenance at a workshop specifically approved by the engine manufacturer. As such, any cracking or corrosion within the dowel pin hole may go undetected during routine maintenance.
Operator maintenance procedures
The operator was following the directions set out in the manufacturer’s maintenance documents. The operator demonstrated that they had previously rejected two PGB’s in 2007 and 2011 due to corrosion and missing cadmium plating on the propeller shaft and/or flange.
A single direction to inspect the PGB propeller drive shaft flange was included in the propeller removal/installation worksheet, HM-26 Revision 5, in accordance with the manufacturer's maintenance procedures. However, a number of deficiencies were identified in the worksheet, which meant the aircraft maintenance engineers may not have been given the best opportunity to detect a growing crack in the PGB shaft flange area. This is because:
The worksheet referred to a visual inspection; however, the task in the maintenance manual was not solely a visual inspection. If wear was observed on the face of the flange, the flange thickness required measurement and it could be no less than 0.685 inch (17.40mm).
The brief nature of the task description meant that there were no specific instructions on how the task should be carried out. For example, the method of flange thickness measurement was not specified on the form.
There was no space on the worksheet to record any findings, such as recording the flange thickness measurements or if the cadmium (Cd) plating was worn and a repair required.
Findings
From the evidence available, the following findings are made with respect to the propeller separation event involving a 340B aircraft, registered VH-NRX (NRX), which occurred about 10 NM south-west of Sydney, New South Wales (NSW) on 17 March 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The propeller shaft failed as a result of a fatigue crack that had initiated at the dowel pin hole and propagated through the shaft until it could no longer transmit the required loads.
The engine manufacturer did not have specific inspection procedures in the maintenance documents of the propeller shaft to detect a fatigue crack originating from the dowel pin hole. [Safety Issue]
Other safety factors
The form used by Regional Express during a propeller removal and installation, HM-26 Revision 5, included the task to inspect the propeller gearbox, but did not provide for recording of inspection findings as defined within documented procedures. Consequently, this did not provide for the best opportunity to ensure potential defects were identified, recorded and monitored.
Other findings
The flight crew used checklist management and crew resource management effectively. These factors combined to contribute to a positive outcome for the aircraft.
The ATSB and the engine manufacturer, General Electric, were unable to determine conclusively the reason for the fatigue crack initiation and propagation.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
The engine manufacturer did not have specific inspection procedures in the maintenance documents of the propeller shaft to detect a fatigue crack originating from the dowel pin hole.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Regional Express
Following the occurrence, Regional Express (Rex) undertook a large number of actions, both in the immediate aftermath and as more information became available on the nature of the failure.
Five aircraft with the same series PGB and shafts were immediately removed from service for further examination.
The fleet-leader inspections of 12 nominated PGB’s were completed as per service bulletin SB 72-0530, by 16 June 2017.
Inspections in accordance with service bulletin SB 72-0531 were completed on 14 February 2018 (71 inspections).
The Rex Safety Management Group also approved completing the service bulletin inspection for all Rex fleet PGB’s that were outside of SB 72-0530 and SB 72-0531. As of 4 July 2018, Rex has completed a further 23 PGB inspections. On 28 February 2018, the FAA issued AD 2018-03-13, which was effective to the CT7 PGB and required the GE SB to be carried out on all PGB’s regardless of the TSN. Due to the existing propeller maintenance practices Rex had implemented and service bulletin scheduling in place, Rex was already compliant with the requirements of AD 2018-03-13. They also adjusted the scheduling of certain PGB inspections to match the AD compliance timeframe.
The previous operator of the PGB was contacted to obtain historical details of operation and maintenance.
During inspection of the propeller shaft in accordance with SB 72-0531, onsite training, including instruction from the manufacturer’s CT7 platform lead principal engineer, was conducted with line maintenance supervisors and other licensed aircraft maintenance engineers (LAMEs). In addition, computer based training (CBT) with specific reference to inspection of the propeller shaft was set up for all B1 LAMEs. The CBT will be recurring every 2 years.
The operator performed a review of the maintenance practices for propeller removal/installation as described in their worksheets, HM-26, HM-27 and HM-15. As a result, the operator identified areas of improvement and changes to the worksheets have been implemented. The worksheets have been amended to include additional inspection steps for the PGB propeller shaft based on the latest GE service bulletin, SB 72-0531. A Notice to Engineers (NOTEM) was issued to all Saab Engineers on 3 July 2017 to advise them of the worksheet revisions.
Established in-house capability to carry out the manufacturer's corrosion prevention process (cadmium (Cd) plating) through procurement of the necessary materials and equipment and training of engineering staff.
An assessment of propeller balance maintenance practices were carried out and some modifications implemented including;
Introduction of a periodic oil change task for the Hamilton Sundstrand[5] propeller hub.
A requirement to carry out a dynamic balance on each occasion that a Hamilton Sundstrand propeller blade or hub is installed.
Issuing instructions to engineers with a policy to achieve blade-shimming clearance at the lower end of the available range when installing Hamilton Sundstrand propeller blades.
Initiation of a review of the propeller balance policy for the Dowty propeller.
Civil Aviation Safety Authority
The Civil Aviation Safety Authority conducted two audits on the operator following the event; the first was carried out from 3-11 May 2017; the second on 10-11 July, specifically looking at the propeller maintenance practices of the organisation.
The sources of information during the investigation included the:
flight crew
aircraft operator (Regional Express)
engine manufacturer (General Electric)
aircraft manufacturer (Saab)
Federal Aviation Administration (USA)
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Regional Express, Civil Aviation Safety Authority (CASA), General Electric, National Transportation Safety Board (NTSB), Saab, and the Swedish Accident Investigation Authority.
Submissions were received from Regional Express, CASA, General Electric and NTSB. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 13/04/2017
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
The occurrence
On 17 March 2017, a Saab 340B aircraft, registered VH-NRX (NRX) was being operated as RXA768 on a routine passenger flight from Albury, New South Wales (NSW) to Sydney, NSW. On board the aircraft were 16 passengers and 3 crew.
About 55 nautical miles south-west of Sydney airport, the crew noticed uncommanded engine indications and began the necessary checklists. While undertaking the checklist items, the crew experienced minor vibrations from the right engine. These vibrations worsened as the checklist progressed and became visually evident to the First Officer. As a result the crew commenced the engine shutdown procedure. During the engine shutdown procedure, the propeller separated from the aircraft. The crew made a Pan-Pan[1] call to air traffic control, and completed the engine shutdown procedure. The aircraft landed without incident at Sydney airport.
Figure 1: The aircraft, VH-NRX, at Sydney airport after the incident
Source: Grahame Hutchison
An inspection of the aircraft by the ATSB at Sydney airport identified that the propeller shaft had fractured, leading to the separation of the propeller.
On 21 March 2017, the NSW Police Aviation Support Branch (PolAir) undertook a search operation for the separated propeller. The propeller was located in an area under dense forest about 8NM south-west of Sydney airport.
Figure 2: The propeller that had separated from VH-NRX as found by PolAir about 8NM south-west of Sydney airport
Source: ATSB
The propeller was found with the flange section of propeller shaft secured to the propeller assembly and a fracture through the propeller shaft. ATSB subsequently removed the remaining propeller shaft and integral flange section (Figure 4) for examination at its facilities in Canberra.
Propeller shaft examination
The recovered part of the propeller shaft is highlighted in figure 3. The propeller was found properly secured to the forward-facing flange by bolts and the dowel pins pictured. The examination was conducted with representatives present from the Civil Aviation Safety Authority (CASA), SAAB, GE Aviation (engine manufacturer) and Regional Express (REX). Initial observations revealed cracking that appeared to run between the main shaft and the flange region. The part was sectioned in order to expose the crack’s fracture surface.
Figure 3: Propeller gearbox schematic highlighting the recovered section of the propeller shaft
Source: GE Aviation, modified by ATSB
The crack was found to be a fatigue fracture that had initiated within the propeller mounting flange, and then transitioned into the shaft section (see figure 4). The crack originated at the bore of a dowel pin near the forward face of the propeller hub flange. The dowel pin bore was corroded in parts (shown in figure 5), and corrosion pitting was found near the fracture. Further work is ongoing to ascertain whether the corrosion or other factors contributed to the fracture initiation.
Figure 4: Section of the propeller shaft showing the fatigue crack originating at the dowel hole and progressing into the shaft itself
Source: ATSB
This is the first known critical failure of this type initiating within the propeller hub flange of a GE Aviation CT7-9B engine. The same propeller gearbox (PGB) is fitted to multiple variants of the CT7 engine (5A2, 7A1, 9B, 9C, and 9C3) on SAAB 340 and EADS CASA[2] CN-235 aircraft. There is currently no maintenance requirements specified in existing maintenance manuals for routine inspection within the dowel pin bores. Any corrosion or cracking within the bore may go undetected until it progresses to the surface of the flange. Other than a visual inspection of the flange during propeller removal, inspection for surface defects (via magnetic particle inspection or dye penetrant inspection) only occurs when the PGB is disassembled for maintenance at a workshop specifically approved by the engine manufacturer.
Figure 5: Corrosion observed within the bore of the dowel pin hole
Source: ATSB
Safety advisory notice
AO-2017-032-SAN-001:
The ATSB advises that those responsible for the operation and maintenance of SAAB 340 and EADS CASA CN-235 aircraft fitted with the GE Aviation CT7 engine type variants 5A2, 7A1, 9B, 9C, and 9C3 should note the facts presented in this preliminary report with a view to addressing any risks to their own operation.
Proactive safety action taken by GE Aviation
GE Aviation is actively involved in supporting the Australian Transport Safety Bureau in this investigation. The propeller flange and all required hardware has been transported to GE Aviation laboratories in Cincinnati for further metallurgical analysis. GE Aviation is inspecting additional PGBs from the fleet and recommends that all operators follow existing maintenance and inspection procedures. As the investigation progresses GE Aviation will release additional maintenance and inspection recommendations if they become necessary.
Proactive safety action taken by Regional Express
Regional Express has quarantined all propeller gearboxes with propeller shafts of the same series as that installed in VH-NRX.
Further investigation
The investigation is continuing and the ATSB will focus on:
maintenance procedures associated with the PGB shaft
factors that may have contributed to the fatigue fracture at the propeller mounting flange, possibly including:
design and manufacturing of the dowel pins, bores, and overall assembly
corrosion protection on the surface of the part
opportunities for crack detection.
Should any critical safety issues emerge during the course of the investigation, the ATSB will immediately bring those issues to the attention of the relevant authorities or organisation. This will allow those authorities and organisations to consider safety action to address the safety issues. Details of such safety issues and any safety action in response will be published on the ATSB website at www.atsb.gov.au.
______________________
The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 13 March 2017, at about 1700 Eastern Standard Time (EST), a de Havilland DHC-2 seaplane, registered VH-AWD, taxied at Hardy Lagoon aircraft landing area (ALA), for a charter flight to Shute Harbour, Queensland. On board the aircraft were the pilot and five passengers.
Hardy Lagoon had four waterways, marked by buoys, for take-off and landing. The company preference for take-off was to use the most into wind waterway. The wind strength was about 8 kt with a low sun, calm to smooth water surface and low tide at 0.6 m. The pilot positioned the aircraft between the northerly and easterly waterways (Figure 1) and started the engine with the water rudders retracted to allow the aircraft to weathercock into wind.
The wind effect on the aircraft indicated to the pilot that the northerly waterway was the most into wind waterway. In order to maximise the take-off distance available the pilot applied power to start the take-off run from a position to the south-east of the northerly waterway, while aiming to join the waterway at buoy F (Figure 1). Shortly after applying full power, and before the aircraft entered the northerly waterway, both floats struck submerged reef, which brought the aircraft to a stop.
Figure 1: Hardy Lagoon (north pointing downwards)
Source: Operator, annotated by ATSB (black, yellow, white and orange lines indicate the dimensions of the waterways)
The pilot shut down the aircraft and assessed the passengers for injuries and the aircraft for damage. The passengers were uninjured, and the aircraft was stuck on the reef at the point of low tide. After relaying a message to their[1] company, via an airborne helicopter, the pilot elected to transfer the passengers to one of the boats used for reef tours in Hardy Lagoon. About 20 minutes after transferring the passengers to the boat, another company aircraft arrived and was able to return the passengers to Shute Harbour before last light.
The following day the aircraft sank in 3 m depth of water after several attempts were made to keep it afloat. The aircraft was subsequently salvaged.
Seaplane take-off
The application of power to start the take-off pushes the centre of buoyancy aft, due to increased hydrodynamic pressure on the bottom of the floats. This places more of the seaplane’s weight towards the rear of the floats which sink deeper into the water. This results in a higher nose attitude, reduced forward visibility, and creates high drag, which requires large amounts of power for a modest gain in speed (Figure 2 left). This phase of the take-off is known as in the plow.
As speed increases, hydrodynamic lift on the floats and the aerodynamic lift of the wings supports the seaplane’s weight instead of the buoyancy of the floats. This allows the pilot to lower the nose attitude, which raises the rear portions of the floats clear of the water (Figure 2 right). This is the planing position, which reduces water drag and permits the seaplane to accelerate to lift-off speed. The pilot reported this was about 25-30 kt for the DHC-2.
Figure 2: Seaplane in the plow (left) and planing (right)
Source: US Federal Aviation Administration
Environmental conditions
The tide was at 0.6 m at the time of the collision, which occurred outside of the waterways. When the tide is above 2.5 m, the aircraft can manoeuvre around Hardy Lagoon outside of the dimensions of the ALA without striking reef. Below the 2.5 m tidemark, it was known that the reef could be struck when manoeuvring the aircraft outside the dimensions of the ALA. However, the pilot believed that their chosen track from buoy I to buoy F, where they would join the northerly waterway, was clear of underwater terrain. There were no hazard marks on the left side of their track towards buoy F, but this was outside the prescribed waterway.
The collision occurred at 1700 and sunset was about 1820, with the associated low sun angle. When the sun angle is low, more light is reflected off the water than refracted through the water and consequently it is more difficult to see objects underneath the surface.
The pilot described the water conditions in the lagoon as smooth to calm. Prior to the accident, and while still on the boat, the pilot received a phone call from the chief pilot to check on conditions. This was in response to light winds affecting an earlier take-off. They both agreed that with an eight-knot northerly wind, take-off could be achieved without the need to reduce weight.
Recent experience
The pilot had extensive flying experience, which included 127 total landings on and take-offs from Hardy Lagoon, 17 under supervision. They had operated at Hardy Lagoon the previous day. At the time of the collision, they were in their ninth-hour of their duty for the day. Earlier in the day, they experienced two unsuccessful take-off attempts in which the aircraft did not get into a planing position, which they attributed to light winds and high aircraft weight.
Safety and survivability
The pilot received annual training from the operator in emergency and life-saving equipment and passenger control in emergencies, in accordance with Civil Aviation Order 20.11. Prior to flight, passengers receive a video briefing on the safety aspects of the aircraft and are required to wear life jackets for the flights. A personal locator beacon and first aid box are carried on board the aircraft.
Search and rescue time (SARTIME) is managed by the operator. On approach to Hardy Lagoon, by about 500 ft above sea level, the pilots notify their operator of their arrival, at which point the operator starts a SARTIME for the aircraft’s departure from Hardy Lagoon of arrival time plus 2.5 hours. The operator has two boats moored at Hardy Lagoon with a mobile phone capable of contacting the mainland.
Previous similar accidents
On 25 June 2015 a de Havilland Canada DHC-2, registered VH-AWI, struck reef while attempting to take-off from Hardy Lagoon. While attempting a take-off manoeuvre to maximise the take-off distance available, the aircraft inadvertently drifted out of the waterway and struck reef.
For further information refer to ATSB report AO-2015-069.
Safety analysis
At the time that the pilot attempted the accident take-off, they had experienced two failed take-off attempts earlier in the day, which they believed were the result of light wind and high aircraft weight. As the wind was still light and the aircraft was relatively heavy, the pilot decided to start the take-off from a position outside the dimensions of the waterway, to increase the take-off distance available.
At the time of the attempted take-off, the tide was close to the low point, but the reef struck by the aircraft was still submerged. The sun angle was low, which increased the amount of sunlight reflected from the water surface. At the speed of the collision, the aircraft nose attitude was at the highest angle for the take-off run, which combined with the sunlight reflection to severely restrict the pilot’s ability to detect submerged reef.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The light wind conditions and aircraft weight led the pilot to initiate the take-off run from outside of the dimensions of the waterway in order to maximise the take-off distance available.
The aircraft struck submerged reef, which was obscured by the sunlight conditions and high nose attitude of the aircraft, before it entered the waterway.
Safety message
The pilot commented that there were a number of factors, specific to their own operation, which could minimise the risk of a similar occurrence. They noted there are too many variables in the operation to identify all possible scenarios when in training. Their most important lesson was the need to ask ‘am I safe’, particularly in ambiguous conditions, and ‘if I continue on this plan, will I remain safe?’
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 2155 Eastern Daylight‑saving Time[1] on 13 March 2017, a Qantas Airways (Qantas) Boeing 737-838 aircraft (B737), registered VH-VZZ (VZZ), was about to start its descent in to Canberra Airport, Australian Capital Territory. The aircraft was on a scheduled passenger flight from Perth Airport, Western Australia, and had two flight crew, five cabin crew, and 177 passengers on board. The first officer was the Pilot Flying (PF) and the Captain was performing the role of the Pilot Monitoring (PM).[2]
Air traffic control (ATC) cleared VZZ to descend and advised its flight crew to expect an arrival on runway 17. The controller also requested that the crew maintain maximum speed. In response, a descent speed of 320 kt was selected, 40 kt above the standard descent speed of 280 kt. The aircraft’s maximum allowable operating speed (VMO) was 340 kt.
At about 2200, the flight crew informed ATC that descent from flight level (FL) 310[3] had commenced and reported some light to moderate turbulence (Figure 1). Shortly after, ATC informed the flight crew that there would be a runway change to 35.
Figure 1: Diagram showing actions, conditions, and events during the aircraft’s descent
Source: ATSB
At about 2204, VZZ was descending past FL 280 when the flight crew made an announcement over the aircraft’s public address system advising the cabin crew to prepare for landing. That announcement provided a cue to the cabin crew that they had about 10 minutes to secure all loose items in the cabin before illumination of the ‘fasten seat belt’ sign. By the time the aircraft passed FL 270, it had accelerated to the flight crew selected speed of 320 kt.
At about 2209, the turbulence began to increase. In response, the flight crew switched on the ‘fasten seat belt’ sign and advised the passengers and crew to be seated with seat belts fastened. The operator’s procedures required cabin crew members to be seated within 1 minute of that announcement.
At that time, a cabin crew member was passing row 22 on her way back to the rear of the cabin (Figure 2). The aircraft’s movement due to the turbulence was such that she needed to hold onto the overhead lockers as she walked along the aisle. About 15 seconds later, she reached the rear galley, closed a stowage latch, and secured a rubbish bin in preparation to be seated in the left cabin crew seat.
Figure 2: Boeing 737-800 VH-VZZ aircraft seat map
Source: Qantas (annotated by the ATSB)
When VZZ descended through FL 220 (about 30 seconds after the ‘fasten seat belt’ sign was switched on), the wind direction changed by about 80 degrees, resulting in a head wind increase from 15 kt to 32 kt. That in turn led to the airspeed increasing through 325 kt, and the PF applying control column backpressure to avoid exceeding VMO. About 1 second after the maximum control column force was applied, the autopilot disengaged and the G‑Load[4] peaked at 2.2 g. The pilot monitoring reported that they were checking the instrument approach, as a result of the change to runway 35, when they heard the autopilot disengage tone and saw the speed of the aircraft increasing toward VMO.
The aircraft’s pitch angle changed by 3.87 degrees in 1 second, and its airspeed reached a maximum of 339.5 kt.
The cabin crew member recalled that, while standing in the rear galley and preparing for arrival, she felt the cabin floor drop and then quickly come up. The force due to the aircraft’s movement resulted in the cabin crew member fracturing her leg. The cabin crew member seated in the right rear seat assisted the injured cabin crew member.
The aircraft movement also resulted in a second cabin crew member in the forward galley falling forward and hitting her head on a trolley. She also received injuries to her knees, back and neck.
The flight crew received an interphone call from the cabin reporting the leg fracture injury. The turbulence subsided and the flight crew turned off the ‘fasten seat belt’ sign and first aid was provided to the injured crew members.
At about 2211, the aircraft’s speed decreased and the flight crew re-engaged the autopilot. The flight crew alerted ATC to the turbulence and were informed that no other turbulence had been reported in the area.
Due to her fractured leg, the injured crew member in the rear galley remained lying on the cabin floor for the landing. The aircraft landed at about 2234, and paramedics met the aircraft to attend to the two injured cabin crew members. Both of them were transferred to a hospital for treatment. The cabin crew member injured in the rear galley was admitted to the hospital. The other crew member was treated and discharged without admission. The aircraft was not damaged and none of the other crew or any of the passengers were injured.
Autopilot
The autopilot of VZZ remained engaged until the control column force reached about 25 lbs.
Qantas advised the ATSB that it was common practice for its B737 flight crews to manage an impending overspeed by applying control column force to override the autopilot. The expected outcome of this action was for the autopilot to revert to ‘control wheel steering-pitch’ (CWS-P)[5] mode, and raise the aircraft’s nose. According to VZZ’s first officer, the technique was part of initial B737 type rating training and line training. The captain also confirmed that this technique was commonly practiced.
Following review of the draft investigation report relating to this occurrence, Boeing advised that they were considering a revision to the overspeed guidance in the 737 flight crew training manual. Specifically, they were considering inclusion of the following preferred response to an impending overspeed:
VMO/MMO is the airplane maximum certified operating speed and should not be exceeded intentionally. However, crews can occasionally experience an inadvertent overspeed. Airplanes have been flight tested beyond VMO/MMO to ensure smooth pilot inputs will return the airplane to the normal flight envelope.
Periodic wind speed or direction changes may lead to overspeed events. Although autothrottle logic provides for more aggressive control of speed as the airplane approaches VMO or MMO, there are some conditions that are beyond the capability of the autothrottle system to prevent short term overspeeds. In these cases, leave the autopilot engaged and deploy partial speedbrakes slowly until a noticeable reduction in airspeed is achieved. Retract speedbrakes slowly when below VMO/MMO.
The autopilot of VZZ had been modified to remove the CWS-P reversion (that is, it would instead disengage when 25 lbs of control column force was applied). Boeing advised that the modification was introduced due to concern ‘…that flight crews may not recognise or correctly interpret the autoflight system automatic transition to the Control Wheel Steering mode…’.
A consequence of the modification was that the autopilot disengagement produced a sharper elevator response than reversion to CWS‑P, as that mode provided a smoothed resistance as a function of the pitch rate. That is, for the same control force input, the elevator deflection and pitch change were significantly larger when the autopilot disconnected compared to reversion to CWS‑P.
Recorded data
Examination of the relevant flight data showed that:
Minor turbulence occurred from 2208:30 to 2209:00 while the rate of descent was steady and the aircraft’s speed was about 320 kt. There were slight variations in the headwind and airspeed in this period.
At 2209:00, ‘level change mode’[6] was engaged and, over the next 20 seconds, the rate of descent increased and peaked at 4,725 ft/min.
Between 2209:30 to 2209:44, the wind direction changed about 80 degrees and the headwind increased from 15 kt to 32 kt.
At 2209:36, as the airspeed began increasing above 325 kt, the control column was pulled back and the autopilot disengaged at 2209:40. About 1 second after maximum control column force, the G-load peaked at 2.2 g and the aircraft pitch angle changed from -1.58° to 2.29°. The aircraft reached a maximum speed of 339.5 kt, 0.5 kt below VMO.
On the 9 May 2015, a Boeing B737-8FE aircraft was making a high-speed descent (320 kt) into Adelaide, South Australia. The crew responded to indications the aircraft was approaching the maximum allowable airspeed by extending the speed brakes. However, the airspeed continued to increase. The autopilot was then overridden by pulling back the control column (the force required was greater than the pilot expected) until the autopilot entered the CWS-P mode. Immediately afterwards, the control column was abruptly released. The subsequent motion of the aircraft resulted in a cabin crew member suffering a minor injury.
Safety analysis
The Qantas internal investigation of this occurrence found that in the past 6 years there had been 47 previous overspeed occurrences involving its Boeing 737-800 aircraft, of which 20 had been managed via manual intervention (that is, overriding the autopilot into CWS-P). The internal investigation also found that it was common practice among its Boeing B737-800 flight crews to descend at 320 kt (20 kt below the VMO) when cleared by ATC to conduct a high-speed descent.
The common practice of flight crews to prevent an overspeed was not a documented Qantas or Boeing procedure. As a result, the potential consequence of this practice was not considered when the autopilot was modified.
Qantas also advised that the flight crew of VZZ had no information that indicated that there would be a risk of turbulence. The wind information provided in the flight plan did not show there would be a significant change in the wind direction during descent. As such, descending at 320 kt was not considered to present an increased risk.
The first officer of VZZ responded to the increase in speed towards the aircraft’s VMO consistent with his training, experience, and observations of other crew members. As VZZ had a modified autopilot, it was not possible to override it into CWS-P. Consequently, when sufficient force was applied to the control column, the autopilot disengaged. That resulted in abrupt elevator deflection and pitch change, which in turn led to the cabin crew injuries.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The increase in headwind while VH-VZZ was making a routine high speed descent at 320 kt resulted in the airspeed increasing towards the aircraft’s maximum allowable speed.
The pilot flying applied a control column input to prevent an overspeed, which resulted in the autopilot unexpectedly disengaging. The consequent change of pitch and g-loading led to two cabin crew suffering injuries.
The aircraft’s autopilot had been modified such that, if sufficient control column back pressure was applied, the autopilot would disengage rather than revert to the Control Wheel Steering (CWS) mode. Autopilot disengagement resulted in larger elevator and pitch responses than those associated with reversion to CWS mode.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
Qantas advised the ATSB that it has taken the following safety action.
Safety information notice
A safety information notice titled Pilot responses during high and low airspeed events has been provided to the flight crew. The notice advised flight crew that:
during an impending or actual overspeed event, it is preferable to keep the autopilot engaged
there is a reasonable buffer on VMO before any significant maintenance actions are required. Disengaging (and/or overriding) the autopilot to avoid an overspeed may result in an abrupt pitch change that could lead to more adverse consequences than the overspeed itself.
Safety message
Although there was no expectation of varying wind conditions during the descent on this occasion, this occurrence highlights the increased risk of overspeed when operating with a reduced margin below VMO.
The intervention by the pilot flying to prevent the impending overspeed was understandable, and consistent with previous responses of other flight crew in similar situations. However, as detailed in the Qantas safety information notice, when faced with an impending overspeed, abrupt pitch changes may have more adverse consequences than an overspeed event. The manufacturer’s preferred use of speedbrakes to manage increasing airspeed, removes the hazard associated with abrupt pitch changes.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 12 February 2017, the fully-laden bulk carrier, Aquadiva, was departing Newcastle Harbour under the conduct of a harbour pilot. At about 2218 Australian Eastern Daylight Time (AEDT), during Aquadiva’s passage through a section of the harbour channel known as The Horse Shoe, insufficient rudder was applied in time to effectively turn the ship. The ship slewed, or moved laterally (sideways), toward the southern edge of the channel, and at 2224 it was over the limits of the marked navigation channel. Additional tugs were required to arrest the ship’s movement and return it to the channel to complete its departure.
What the ATSB found
The ATSB found that bridge resource management (BRM) techniques were not effectively implemented throughout the pilotage. In particular, the harbour pilot’s passage plan was not provided to the ship’s crew prior to his boarding. As a result, the harbour pilot’s passage plan was different to that of the ship’s bridge crew’s. This meant they did not share the same mental model of the planned passage, and were unable to actively monitor the progress of the ship or the actions of the pilot.
As a consequence, the safety net usually provided by effective BRM was removed and the pilotage was exposed to single-person errors. Such errors, when they occurred, were not identified or corrected. When insufficient rudder was applied and the ship did not turn as expected, no-one from the ship’s bridge crew challenged or intervened to draw this error to the attention of the harbour pilot. Consequently, the ship travelled too close to shallow water.
The ATSB also found that ambiguities in the details of the incident (whether the ship touched bottom or not) and in reporting requirements, as understood by relevant responsible persons (as defined by the Transport Safety Investigation Regulations 2003) led to delays in the reporting of the incident to authorities, including the ATSB. These delays meant that evidence available at the time of the incident, such as voyage data recordings, were not collected.
What's been done as a result
As a result of this incident, the Port Authority implemented a training and information process with pilots to discuss the incident and its outcomes and to inform them of their incident reporting obligations. Also, procedures are to be updated to require the use of portable pilotage units on all pilotages, and a project to implement sharing of electronic passages plans is also being undertaken.
Aquadiva’s operator provided targeted training to the ship’s officers. The company also completed an internal investigation and circulated the report and discussed and implemented identified preventive and corrective actions throughout its fleet.
Safety message
Safe and efficient pilotage requires clear, unambiguous, effective communication and information exchange between all active participants. An agreed passage plan, its understanding and the establishment of a ‘shared mental model’ between a harbour pilot and a ship’s crew, forms the basis for a safe voyage. Without this, effective implementation of BRM techniques will be limited, removing the intended safety net provided by BRM and, in this instance, leaving the passage exposed to potential single-person errors.
The occurrence
On 11 February 2017, the dry bulk carrier, Aquadiva (Figure 1), arrived at Kooragang number 8 berth, Port of Newcastle, for cargo loading. At 1209[1] on 12 February, cargo loading was complete and preparations were made for departure on the evening high tide, due at 2250. Aquadiva had departure draughts of 15.24 m fore and aft.
Figure 1: Aquadiva
Source: Australian Transport Safety Bureau
At 2000, the ship’s crew completed pre-departure checks. The ship’s berth-to-berth passage plan for the voyage included nine course alteration positions (waypoints) for the departure pilotage from the berth to the pilot disembarkation point. The passage plan included advice to ‘follow courses laid on the ECDIS (Electronic Chart Display and Information System)’ and ‘monitor the vessel’s position’.
At 2048, a Newcastle harbour pilot boarded the ship. The master and pilot commenced the master-pilot information exchange (MPX) and discussed the pilotage. Tug requirements, position and repositioning were explained during the exchange. Four tugs were to be in attendance: Mayfield on the centre lead forward, Svitzer Hamilton on the centre lead aft, Svitzer Meringa on the port shoulder and Svitzer Myall on the starboard shoulder.
At 2112, at nearby Kooragang berth number 4, a similar sized ship (FPMC B Justice - 300 m long, 50 m beam, 207,000 deadweight tonnes) departed ahead of Aquadiva. The plan of the pilot of Aquadiva was to remain mid-channel, passing through the Newcastle port passage plan waypoints. He was to remain at least 1,000 m behind the ship in front to minimise any hydrodynamic interaction between the two ships.
Passage to the wheel over point for The Horse Shoe
At 2123, with the four tugs in attendance, dead slow ahead was ordered and Aquadiva was under way (Figure 2 and appendix A). The pilot conned Aquadiva south, clear of Kooragang Island, and into the Steelworks Channel at about 3 knots.[2] At 2203, the pilot ordered slow ahead on the main engine and the ship’s speed increased.
Figure 2: Extract from navigational chart Aus 207 showing Aquadiva’s track departing Newcastle; position times and port waypoints (WP) indicated
Source: Australian Hydrographic Service; annotations by ATSB
At 2204, the pilot directed the master of the tug SvitzerMyall to reposition from the starboard shoulder to the port quarter. The tug master experienced some difficulty positioning the tug due to the ship’s stern cut away. The tug was repositioned further forward on the port side but was hampered due to the position of the accommodation ladder, which was not fully housed. By 2212, the tug was in position, forward of the ship’s accommodation, adjacent to the aftermost hatch.
At 2214, as Aquadiva passed waypoint 9 (WP9) at about 4 knots, the pilot ordered half ahead. The ship had a speed of 5.1 knots as it approached the alteration to port through The Horse Shoe. The alteration was more than 90°, from about 153° onto a heading of 056° leading out past Nobbys Head and to sea.
Passage through The Horse Shoe
The pilot’s plan was for a speed of about 4.7 knots as the ship approached the wheel over point (WOP)[3] for the alteration, about 120 m before WP8 (Figure 3). At 2218, at 5.1 knots, the pilot ordered 10° of port rudder followed by 20°. He wanted a rate of turn of about 13°/minute and he closely monitored the ship’s rate of turn indicator, which was mounted overhead in the bridge front. The ship’s bow turned to port while the ship continued to track almost straight ahead. Hard port rudder was ordered and, at 2220, the ship began to slow and turn to port. The pilot reported that he continued to focus on the rate of turn indicator to see if the ship was turning as quickly as desired.[4]
Figure 3: Extract from navigational chart Aus 208 showing Aquadiva’s track through The Horse Shoe
Source: Australian Hydrographic Service; annotations by ATSB
A short time later when he checked the ship’s position by looking out of the windows, the pilot saw that the ship was deeper into The Horse Shoe than expected. It was now south of his intended track and closing on the east cardinal buoy[5] (Birubi buoy). The buoy indicated safe water to the east and the outer limit of the channel, maintained to a depth of 15.2 m. At 2221, the pilot contacted the tugs to assist the turn. He requested SvitzerMeringa (on the port shoulder) to come astern and SvitzerMyall (port quarter) to take the ship’s stern to starboard. Astern of the ship, the master of SvitzerHamilton (centre lead aft) expressed concern that his tug would contact Birubi buoy. The pilot then requested Mayfield (centre lead forward) to take the ship’s bow to port.
Aquadiva’s master was following the progress of the ship and noted that it was deep into the turn. However, the pilot had ordered full rudder and engaged the tugs to assist the turn and the master, having little additional to contribute, did not challenge or intervene.
Nearby, the four tugs, which had assisted FPMC B Justice, were returning along the southern side of the channel. At 2221, the master of one of these tugs, PB Darling, having noticed Aquadiva was too far south in the channel, called the pilot and offered assistance. The pilot accepted the offer.
At this stage, Aquadiva was north of Birubi buoy with a speed of 4.9 knots, on a heading of 116° and course over the ground of 134°. At 2222, the pilot ordered the main engine slowed and then astern. At 2223, now past the buoy (Figure 4) the engine was briefly at full astern before being returned to stop and then dead slow ahead.
Figure 4: Relative positions of Aquadiva and tugs at 2223
Yellow line indicates the track followed by FPMC B Justice. The blue lines join passage plan waypoints.
Source: Australian Maritime Safety Authority and ATSB
At about the same time, Svitzer Hamilton had avoided Birubi buoy and repositioned to apply weight to take the ship’s stern to starboard. PB Darling had also been manoeuvred to push up on the ship’s starboard shoulder to move the bow further to port.
Aquadiva’s speed continued to reduce. At 2224, the speed was 2.6 knots and the ship’s bow continued to swing to port. The ship was now on a heading of 087° and positioned along the southern edge of the channel. The pilot ordered all tugs to stop. The ship continued to swing to port and, at 2225, was on a heading of 068° with a speed of about 2 knots (Figure 5). The pilot then ordered slow ahead, followed by half ahead on the main engine. From this point, the ship was successfully manoeuvred back into the channel.
Figure 5: Aquadiva in its most southerly position at 2225
Source: Australian Maritime Safety Authority and ATSB
At 2228, the additional tugs were released and by 2230 the ship had returned to the intended route. The remainder of the pilotage continued without further incident. By 2242, the pilot had released the four tugs and at 2250 he disembarked the ship by helicopter. At 2330, Aquadiva commenced sea passage, destined for Map Ta Phut, Thailand.
Post occurrence events
Upon returning ashore, the pilot telephoned the Newcastle harbour master and left a message about the incident. He then submitted an incident report to the Port Authority. Over the following days, the harbour master made further inquiries into the circumstances of the incident, including reviewing the automatic identification system replay. The pilot was debriefed and consulted on a number of occasions. On 21 February, the harbour master notified Transport NSW, the state authority for transport services within New South Wales.
On 23 February, the harbour master contacted the ATSB and the Australian Maritime Safety Authority to discuss the incident. An incident report was submitted and, after obtaining further information, on 3 March the ATSB commenced this safety investigation into the incident.
On 12 March, while Aquadiva was at anchor off Map Ta Phut, an underwater inspection was conducted. No serious damage or definitive indication of grounding was discovered and only minor paint scratching and peeling was found.
Subsequent investigations by the Port of Newcastle included a hydrographic survey of the area of The Horseshoe. This survey indicated that Aquadiva had touched bottom although not enough for the ship to have stopped and grounded.
The pilot had worked as a Newcastle harbour pilot for 22 years and completed almost 5,000 pilotages in and out of the port. He had also been a check pilot for 8 years.
The pilot was rostered off duty from 3 to 9 February 2017. He commenced a rostered duty period at 1600 on 10 February and completed two pilotages during that evening. He did not complete any pilotages on 11 February and Aquadiva was the pilot’s first pilotage for 12 February. He stated that he was well rested prior to boarding the ship at 2048.
Each pilot within the Port Authority of New South Wales (nsw) was subject to regular assessments by a check pilot, known as a ‘Pilots Annual Assessment’, while conducting an inbound or outbound pilotage. The pilot had completed an average of two checks per year during the period 2012 to 2016, with no problems noted on any of the checks. The last check was an outbound pilotage conducted on 18 October 2016.
In addition to the annual assessments, each pilot was required to undertake ‘electronic simulation’ training every 3 years. This involved conducting multiple simulated pilotage exercises over 3 days into and out of Newcastle. The scenarios included emergency and contingency situations, with the level of intensity higher than for most real world pilotages. Performance during the simulations was not recorded using a specific type of assessment form. However, if a pilot did not meet the required pilotage criteria, they were debriefed and the exercise conducted again until they were able to demonstrate the required proficiency. The pilot completed his last electronic simulation training in March 2016, and no problems were recorded on the pilot’s file.
The pilot was 58 years old. In accordance with the NSW Marine Pilotage Code, the Port Authority of NSW required each pilot to undergo regular health assessments conducted by an authorised health professional. For a pilot aged between 50 and 60, the code required an assessment to be conducted every 2 years. The pilot was undertaking annual medical assessments, with the last assessment conducted on 10 March 2016. The Port Authority advised that the pilot had been declared fit for work in each assessment during the 5 years prior to the 12 February 2017 occurrence, and no concerns had been reported about his medical fitness or performance during this period.
Following the occurrence, and with the pilot’s agreement, the pilot undertook a triggered medical assessment at the request of the Port Authority of NSW.[6] As part of this process, he undertook a neurological assessment. The assessment identified evidence of subtle difficulties with some cognitive abilities relative to other cognitive abilities, and recommended that further assessment be done in a simulated work environment. This assessment was not conducted. Following an extended period away from work, a subsequent medical assessment concluded that the stress resulting from the occurrence compromised the pilot's ability to safely return to pilotage work.
Overall, the ATSB concluded there was insufficient evidence to conclude that the pilot was experiencing a significant medical or physiological problem at the time of the occurrence that was associated with the occurrence.
Aquadiva crew
Aquadiva had a crew of 20 Greek, Filipino and Romanian nationals. The master had a Greek master’s certificate and had sailed as master since 2003. He had joined the ship 8 months prior to the incident. This was his first visit to Newcastle.
Vessel information
Aquadiva was registered in Greece, operated by Carras (Hellas), owned by Arion Shipping (Panama) and classed with the American Bureau of Shipping (ABS).
The ship is 292.0 m long with a beam of 44.98 m and has a summer deadweight capacity of 182,060 t at a draught of 18.30 m. Propulsion is via a Doosan MAN B&W 6S70 main engine delivering 18,660 kW via a right hand, fixed pitch propeller at 91 rpm. According to the ship’s posted manoeuvring characteristics, dead slow ahead (25 rpm) yielded 4.1 knots in the loaded condition and the minimum speed to maintain course was 3 knots.
Master-pilot information exchange
The pilot’s passage plan for the outbound pilotage was the same as that included on the port’s passage plan chartlets. The chartlets, which included waypoints and cross track errors, were available through the Port Authority of NSW website. The same chartlets were also used by the pilot that conducted the inbound pilotage of Aquadiva on 11 February 2017.
During the master-pilot information exchange (MPX) soon after the pilot boarded for the outbound pilotage, the ship’s master and pilot discussed the ship’s passage plan, the pilot card (appendix B), the Newcastle standard master/pilot information exchange document (appendix C) and the Newcastle pilot passage plans (appendix D).
The ship’s route and speeds down the channel were discussed as per the port passage plans. However, the pilot and master did not compare the ship’s passage plan with the pilot’s plan. There were some differences in the number and location of waypoints between the two plans (Figure 7), and these differences were not identified and corrected. In addition, the MPX did not include details of the passage such as manoeuvres through turns, wheel over points, rates of turn, comfort zones and cross track error.
The ship’s under keel clearance was also discussed. Based upon ship, tide and channel information, the static under keel clearance would be 1.6 m to contend with a vessel squat of about 0.6 m at 6 knots and the high tide (due at 2250) of 1.56 m. The MPX form noted that the wind was 20 knots from the south-south-east.
The MPX form also included additional general pilotage information. This included referring to the Port of Newcastle passage plan chartlets, details of several bridge team requirements,[7] guidance on reducing bridge alarms, pilot disembarkation details and anchor requirements. The master signed the MPX form acknowledging that he had received and understood the information provided, including the passage plan chartlets.
The pilot advised the ATSB that marine pilotage is a specialised skill requiring local knowledge and experience combined with complex, often interrelated, ship-specific and external variables. How an individual pilot conducts a pilotage also varies depending upon the situation at the time and as the pilotage progresses. He therefore noted that it is often difficult to clearly convey to the ship’s master in the timeframe available at the MPX all the information about how a specific pilotage will be conducted.
The pilot also advised that, in his experience, most ships did not input the port passage plan waypoints into their navigation systems prior to the pilot boarding, and the plans that were inputted generally contained fewer waypoints than the port’s plan.
Portable pilotage unit
A portable pilotage unit (PPU) is a portable, computer-based system that pilots bring aboard a vessel to use as a decision-support tool for navigating in confined waters (International Maritime Pilots’ Association). The units carried by Newcastle pilots operated independently of the ship’s equipment. These PPUs provided real-time automated positioning information which vastly enhanced situational awareness through the display of past tracks and predicted ship path on a chart familiar to pilots.
The Port of Newcastle Pilot Portable Units Operational Guidelines identified the PPU ‘as a decision support tool, to aid navigation and conning of the ship in confined waters.’
This equipment could also have been used as a communication tool, to assist in explaining the pilot’s passage plan and intended actions into and through the turn. In this way it could have assisted in building a shared mental model and clarifying the differences between the pilot’s and the ship’s passage plans.
The port’s operational guidelines also noted that since late 2012 the use of PPUs had become accepted practice on the majority of passages in the Port of Newcastle. This document went on to state that the harbour master had determined that a PPU was to be carried on passages involving vessels of 289 m length overall (LOA) and above, entering or departing the port.
Aquadiva is 292 m LOA. However, the pilot of the outbound pilotage did not take a PPU with him. He stated that, in discussion with the pilot of FPMC B Justice (which departed just prior to Aquadiva), they considered the conditions were such that visibility would not be restricted and that it was a good opportunity to practise and maintain visual pilotage skills. He also said that his understanding was that carriage of a PPU was not mandatory.
As Aquadiva was piloted down the Steelworks Channel (Figure 6), the ship was close to the middle of the channel, as per the pilot’s and ship’s passage plans. However, as the ship approached the course alteration to port, insufficient rudder was applied to achieve the necessary rate of turn to successfully make the turn. The pilot was distracted and the ship moved sideways (slewed), wide into the turn, south of the intended route and toward the outer limits of the channel. At 2224, the ship had slowed to 2.6 knots and was atop the deep water channel 15.2 m contour, at risk of grounding. With the assistance of additional tugs, the ship’s sideways movement was controlled and it was subsequently returned to the channel and the intended route.
Figure 6: Extract from navigational chart Aus 207 showing a comparison between ship tracks and the pilot’s passage plan track
Source: Australian Hydrographic Service; annotations by ATSB
This analysis discusses the manoeuvring of Aquadiva through The Horse Shoe and then examines the turn in the context of the use of the available resources to monitor and manage the pilotage. The requirement to report incidents and the ambiguities around these requirements, by the relevant responsible persons, are discussed in relation to pilotage incidents and the effect on safety investigations.
Turning through The Horseshoe
Aquadiva’s pilot intended to follow the port’s passage plan (appendix D), passing through the waypoints. The ship passed through waypoints 9 and 8 as it approached the wheel over point (WOP) for the course alteration through The Horse Shoe (Figure 7). At this point, it was the pilot’s usual practice to apply sufficient rudder to get the ship to turn at about 2½ times the ship’s speed (about 13°/minute). On this occasion, the ship did not turn as expected and the pilot stated that his attention was focussed on the ship’s rate of turn indicator. Shortly after, as the ship passed to the west of WP7, it was turning, but not quickly enough to complete the turn.
The ship continued to turn too slowly despite the application of full port rudder. However, by the time the pilot looked outside the bridge and noticed this, the ship was already significantly off course. At 2225, the ship was about 1 cable (185 m) south of waypoint 5, in a position over the outer limits of the 15.2 m channel, possibly touching bottom.
Figure 7: Extract from navigational chart Aus 208 showing comparison of tracks and waypoints through The Horseshoe
Source: Australian Hydrographic Service; annotations by ATSB
In comparison, FPMC B Justice had taken the turn through The Horse Shoe about 15 minutes before Aquadiva. Its pilot had applied rudder to commence the turn at WP9, about 3 cables before WP8. The ship began turning and, as it passed Aquadiva’s WOP, its rate of turn was greater than 10°/minute and the turn was under control. Figure 7 shows that the ship then tracked close to or through the remaining waypoints in completing the turn. A rate of turn of 19°/minute was achieved between waypoints 6 and 5.
This comparison shows that not enough rudder angle was applied, early enough, to get Aquadiva to turn sufficiently quickly to make the turn. In the critical early stages of the turn, the pilot was distracted from the primary task of monitoring and controlling the turn. This distraction was for a sufficient amount of time for control of the turn to be lost. The situation was not identified and challenged by the ship’s crew.
Through a fortunate coincidence, the tugs returning from the successful departure of FPMC B Justice were nearby and able to lend assistance to Aquadiva. Their assistance aided in preventing the ship from grounding on the southern side of The Horse Shoe.
Situational awareness and shared mental models
Situational awareness can be defined as knowing what is going on around you. In relation to a ship’s passage, it includes knowing what has recently happened (perception), what is currently happening (comprehension) and, based on where the ship is, what is about to happen (projection).
Closely related to situational awareness is the concept of a shared mental model. Each individual member of a group performing a common task will develop a mental model of what they think will occur during the task. Each person’s mental model is based upon the information available to them at the time and their past experience. Ensuring that each member involved in a pilotage (pilot and ship’s bridge team) shares the same mental model of the voyage (passage and pilotage plan) is central to effective bridge resource management (BRM).[8]
Australian Marine Notice 17/2014[9] states that with a pilot embarked:
The bridge team should support the pilot by:
maintaining a good lookout and situational awareness…
continually monitoring the pilot’s actions and promptly seeking clarification as necessary…
discussing, agreeing and communicating to the entire bridge team, any change to the ship’s voyage plan advised by the pilot…
To emphasise this, the Newcastle master-pilot information exchange (MPX) form contained guidance taken from Australian Marine Notice 11/2016[10] with respect to the ship’s bridge team, including the need to:
clearly define and delegate tasks and responsibilities
set and constantly review priorities
continuously monitor the ship’s position, speed and heading
continuously monitor the ship’s navigation against the passage plan and notify the pilot and master should any deviation from the plan or standard operating procedures occur.
The marine notice also stated:
The agreed passage plan, its understanding and the establishment of a ‘shared mental model’ by the entire bridge team forms the basis of a safe voyage under pilotage conditions…
It is essential that the pilot, master and bridge team work together to ensure that errors are detected early and corrected before the ship is put into any danger.
Furthermore, the Port of Newcastle’s pilotage safety guidelines[11] stated:
Efficient Pilotage is chiefly dependent upon the effectiveness of the communications and information exchanges between the pilot, master, bridge personnel and other participants including tug masters and mooring personnel. The mutual understanding each has for the functions and duties of the others is paramount. This is core to Bridge Resource Management and is a required element of the pilot’s task.
In summary, it can be stated that if there is no shared mental model for a complex task such as marine pilotage then BRM will be ineffective.
On board Aquadiva, the pilot had a plan for the pilotage and an intended route for the ship based on the port’s passage plan waypoints and his many years of experience of piloting similar sized ships out of the port. However, the pilot’s passage plan was not communicated to the ship until the pilot boarded and the MPX was conducted.
The ship also had a passage plan for the pilotage. However, the ship’s plan differed to the pilot’s in key areas, significantly in the region of the turn to port through The Horse Shoe (Figure 7). Here, the ship’s plan contained two less waypoints than the pilot’s plan. This meant that, though similar, the ship’s master and bridge crew built their mental model based upon differing information to the pilot. These differences were not identified, and corrected, during the MPX or at any time during the passage to The Horse Shoe.
The port’s passage plan chartlets, including waypoints and cross track errors, were available through the Port Authority of NSW website and they were also used by the pilot conducting the ship’s inbound pilotage. However, there was no procedure to proactively provide the passage plan to a ship prior to a pilotage and ensure that the ship’s crew had included it in the ship’s passage plan prior to the pilot boarding (for example, via inclusion in arrival requirements or through the ship’s agent). This contrasts with the procedure followed in a number of other ports around Australia and overseas, where the pilotage plan is proactively provided to the ship well prior to the arrival of the pilot on board. Such a process helps ensure the ship’s passage plan for the pilotage is the same as the pilot’s.
In Newcastle, the passive availability of the passage plan chartlets meant that it was not uncommon for ships arriving at the port to have not accessed this important information, despite opportunities to do so. On this occasion, had the pilot’s plan been received by the ship at an earlier stage (prior to passage), this plan, including transit parameters and limits, could have been included in the ship’s berth-to-berth passage plan. Any deviation from this plan could then have been explained during the MPX.
Furthermore, the pilot had not taken a portable pilotage unit (PPU) to assist with the pilotage. This equipment could also have been used as a communication tool, to assist in explaining the pilot’s passage plan and intended actions into and through the turn. In this way it could have assisted in building a shared mental model and clarifying the differences between the pilot’s and the ship’s passage plans.
In addition to differing passage plans and not fully explaining and communicating the intended plan, the pilot did not converse and engage frequently or effectively with the ship’s crew. At no time did the master or pilot seek to ensure that all personnel were actively engaged and shared the same detail for the pilotage, especially in the area of the turn to port. The pilot’s intentions were only broadly conveyed, such as the positioning and repositioning of the tugs and the hand drawn track on the passage plan chartlets. Details of the course alterations and any wheel over points, rates of turn, cross track limits or comfort zones were not discussed.
As a consequence of the differing mental models of the pilotage, the safety net around the pilotage, provided by BRM, was significantly compromised. The result was that specific details of how the pilotage was to progress resided only with the pilot, and the pilotage was then exposed to the dangers of single-person errors. As a consequence, the ship’s crew were unable to accurately and actively monitor the ship’s progress or the actions of the pilot against the pilot’s plan. They did not question, challenge or intervene, or otherwise effectively contribute to the safe completion of the pilotage. Any errors which arose, such as the ship not being in a position the pilot was comfortable with, or the rate of turn being too slow, were not identified as errors. Consequently, no action was taken to prevent these errors from escalating into the incident.
In summary, from the outset, neither the pilot nor the master took the opportunity to effectively manage the resources present and available to safely monitor the ship’s progress or the actions of other bridge personnel. Consequently, any opportunity to capture and correct errors which occurred was lost.
Previous incidents
A common thread in pilotage related investigations conducted by the ATSB has been the breakdown in BRM and its implementation. This is particularly apparent in establishing and maintaining a shared mental model for the entirety of the passage. A recent investigation involving contact between the bulk carrier Navios Northern Star and a navigation buoy while under coastal pilotage in the Prince of Wales Channel, Torres Strait, Queensland (ATSB investigation 325-MO-2016-003, report published June 2017) also highlighted these points.
That investigation found that:
BRM techniques were not effectively followed by the ship’s bridge team. This meant that the ship’s personnel did not have the same mental model of the course alteration as the pilot and they did not actively monitor the pilot’s execution of the alteration.
The ship’s voyage plan contained only basic passage information and its bridge team did not know or fully understand the pilot’s planned operational parameters and limits, including WOPs and safety margins.
The pilot was distracted during a critical 2-minute period before the incident. Further, the master’s challenge to the pilot as the ship closed on the buoy was too late.
Amongst other things, the MAIB investigation found:
These findings echo similar findings from many of the pilotage incidents the ATSB has investigated, including the current one.
The rate of turn required to stay within the dredged channel could not be sustained.
The pilotage was not properly planned with key decision points, WOPs and abort options not identified.
The ship’s pilotage plan did not reflect the plan (intentions) of the lead pilot.
Poor information exchange and communication led to the lead pilot and the bridge team not sharing the same mental model.
Differing mental models meant that the ship’s master and bridge team were unable to monitor, challenge or seek to clarify the lead pilot’s actions and the vessel’s progress.
The breakdown of BRM resulted in the lead pilot becoming the sole decision-maker and a single point of failure.
Portable pilotage units were carried but were not effectively used to assist the master / pilot exchange and provide additional situational awareness.
Overall, these investigations highlight the changing requirements and expectations of industry and involved organisations with respect to pilotage. In particular, the desire to use BRM as an effective risk and error management tool is apparent. This is being achieved through emphasis on greater passage plan detail, improved communications, improving the building of a shared mental model and similar strategies.
For example, as a result of the Navios Northern Star investigation and as part of a continuous improvement program, the pilotage organisation involved undertook significant proactive safety action. This included initiating a pilotage workshop facilitated by an external consultant to assess and amend the company’s pilotage safety management system (SMS). Significantly, one aim was to determine and include good pilotage practice guidance in the SMS.
Importantly, the workshop determined that good pilotage practice covered all aspects of the pilotage, from booking to completion, not just the conduct of the ship. Amongst other initiatives, this resulted in the identification of practices and procedures to assist pilots to:
Establish involvement in and agreement to BRM techniques as essential for safe conduction of any pilotage.
Set operational parameters and limits for ship handling and navigation for each of the company’s pilotage areas.
Ensure ships’ personnel have accurate detail of the passage plan the pilot will follow, well in advance of the pilotage. The crew are to be expected to incorporate this information, including transit parameters and limits, into the ship’s berth-to-berth passage plan. Any deviation from this plan is to be explained fully to the master during the MPX phase(s) of the pilotage.
Assign roles and responsibilities to ships’ personnel in support of and as assistance to the pilot.
Use a variety of techniques for engaging and informing ships’ personnel of the pilot’s plans and intentions, so as to establish and maintain a shared mental model and situational awareness. In doing so the ship’s crew can be actively involved and monitor the pilot and the passage and provide challenge/intervention as needed.
Use the PPU not just as a significant navigation tool but as an information, teaching and communication tool for use with the ship’s master and crew. PPUs were identified as being especially useful for developing expectations and explaining impending manoeuvres such as turns and course changes.
Incident reporting
For all ships in Australian waters, the Australian Maritime Safety Authority (AMSA) requires that it be notified within 4 hours of becoming aware of any incident that has affected, or is likely to affect the safety, operation, or seaworthiness of the vessel. The Transport Safety Investigation (TSI) Act 2003 requires a responsible person to report marine accidents and serious incidents to a nominated official as soon as possible. A responsible person is defined by the Transport Safety Investigation Regulations as the master or person in charge of the ship, the owner or operator of the ship, an agent of the owner or operator, or a pilot who has duties on board the ship.
On board Aquadiva, the master was not aware that the ship had contacted the bottom, or had come very close to grounding. He therefore did not report the incident to AMSA until prompted by notice from the ship’s Newcastle agent. The initial report from the master to AMSA was dated 14 February, 2 days after the incident. This report identified the incident as a ‘dangerous occurrence’ and detailed manoeuvring difficulties but did not mention grounding or touching bottom.
The pilot reported the incident to the Newcastle Harbour master and submitted a report to the Port Authority upon his return ashore from the pilotage. The pilot, in reporting the incident to port management, believed he had fulfilled his requirements to report. Some confusion then existed regarding the requirements for subsequent reporting to authorities by port officials not nominated as responsible persons in the legislation.
The combined delays in reporting this incident and initiating the safety investigation meant that valuable evidence available at the time of, and for a short time after, the incident was lost. This is particularly relevant to the voyage data recording information from the ship, which provides valuable, relevant data and recordings to assist in safety investigations. Further, once the safety investigation had commenced, sufficient time had passed to have potentially affected the memories of the people involved in the occurrence.
From the evidence available, the following findings are made with respect to the near grounding, under pilotage, of the bulk carrier Aquadiva in Newcastle on 12 February 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
As Aquadiva commenced the 90° course alteration to port through The Horse Shoe, insufficient rudder was applied, and too late, to achieve the necessary rate of turn to successfully make the turn. As a consequence, the ship went off course, toward the southern limit of the channel, coming very close to grounding.
During the early stages of the turn, the pilot was distracted from the primary task of monitoring and controlling the turn when he was likely focussed on the rate of turn indicator and achieving the desired rate of turn. This short period of time was for sufficient duration at a critical point in the turn that control of the turn was compromised.
A shared mental model for the pilotage was not established between the pilot, Aquadiva’s master and the bridge crewmembers. In particular, techniques such as
ensuring the same plan for the pilotage was shared by the ship’s crew and the pilot prior to the pilot boarding,
utilising equipment such as the portable pilotage unit to assist explanation of the pilotage stages and parameters,
ensuring active monitoring, challenge and response/intervention and error management techniques were used by all personnel involved in the pilotage, were not used. Therefore, bridge resource management was not effectively implemented and practised.
Other key findings
Ambiguities and uncertainties around reporting requirements for port pilotage incidents led to delays in the ATSB being notified of the incident and commencing a safety investigation. These delays meant that volatile evidence such as the voyage data recordings were not able to be collected.
The tugs returning from the successful departure of FPMC B Justice offered assistance to Aquadiva. Their assistance aided in preventing the ship from grounding.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Port Authority of New South Wales
The Port Authority of New South Wales informed that ATSB that it had undertaken the following safety actions:
an external law firm was engaged to conduct an investigation into the incident and report findings and provide recommendations
Port Authority pilots, including those in ports other than Newcastle, were informed of the event and learnings from it
procedures are to be amended to require compulsory carriage of portable pilotage units on all pilotages
pilot passage plans have been located in a more prominent position on its website (since February 2017)
a project to implement sharing of electronic passage plans has been commenced
a training package for pilots informing them of their obligations and requirements to report incidents is to be developed and implemented.
Carras (Hellas), Aquadiva’s operator
Carras (Hellas) notified the ATSB that it had taken the following actions in response to this incident:
conducted an internal investigation into the incident and distributed copies of the internal investigation report throughout the company’s fleet, with direction to masters to be aware of bridge resource management (BRM) procedures associated with pilotage plans and to discuss the incident during ship safety meetings
discussed the incident, investigation and lessons learned during Aquadiva’s safety committee meeting following the incident and provided bridge resource management and safety of navigation training to Aquadiva’s bridge team officers
discussed the incident, investigation and outcomes during a shore-based deck officers forum meeting attended by senior fleet deck officers.
Ship details
Ship details
Name:
Aquadiva
IMO number:
9469675
Call sign:
SVAN4
Flag:
Greece
Classification society:
American Bureau of Shipping (ABS)
Ship type:
Bulk carrier
Builder:
Odense steel shipyard (Denmark)
Year built:
2010
Owner(s):
Arion Shipping (Panama)
Manager:
Carras (Hellas) (Greece)
Gross tonnage:
93,360
Deadweight (summer):
182,060 t
Summer draught:
18.30 m
Length overall:
292 m
Moulded breadth:
44.98 m
Moulded depth:
24.85 m
Main engine(s):
Doosan-MAN B&W 6s70 C-7
Total power:
18,660 kW at 91 rpm
Speed:
15.0 knots
Damage:
Nil reported
Sources and submissions
Sources of information
The sources of information during the investigation included:
Aquadiva’s master and bridge team members
Carras (Hellas)
the Port Authority of New South Wales - Port of Newcastle, harbour master, vessel traffic information centre and harbour pilots
Svitzer Australia and tug masters
the Australian Maritime Safety Authority (AMSA).
References
Australian Maritime Safety Authority (AMSA) 2016, Marine Notice 11/2016 Bridge Resource Management (BRM) and Expected Actions of Bridge Teams in Australian Pilotage Waters, AMSA, Canberra. Available at www.amsa.gov.au.
Australian Maritime Safety Authority (AMSA), 2014, Marine Notice 17/2014 Sound navigational practices, AMSA, Canberra. Available at www.amsa.gov.au.
Clark, I.C. 2005, Ship Dynamics for Mariners, The Nautical Institute, London.
International Maritime Pilots' Association (IMPA), 2016, Guidelines on the design and use of Portable Pilot Units, IMPA, London. Available at www.impahq.org.
Marine Accident Investigation Branch (MAIB) 2017, Report on the investigation of the grounding of the ultra-large container vessel CMA CGM Vasco de Gama, Thorn Channel, Southampton, England, 22 August 2016, MAIB, Southampton. Available at www.gov.uk/maib.
Rowe, R.W. 1996, The Shiphandler’s Guide, The Nautical Institute, London.
The Nautical Institute 2016, ‘Error Management’, The Navigator, October 2016.
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Port Authority of New South Wales, Newcastle harbour master, Newcastle harbour pilot, the master and bridge team members on board Aquadiva, Carras (Hellas), the Australian Maritime Safety Authority, the Hellenic Bureau for Marine Casualties Investigation (HBMCI) and Svitzer Australia.
Submissions were received from the Newcastle harbour pilot, the master of Aquadiva, the Port Authority of New South Wales (including harbour master), Carras (Hellas) and the Australian Maritime Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Table of selected data for Aquadiva’s departure from Newcastle
Appendix B – Aquadiva’s pilot card and master / pilot information exchange form for departure Newcastle
Source: Master, Aquadiva
Appendix C – Master / pilot information exchange (MPX) document, pilot’s component
Source: Port Authority of New South Wales
Appendix D – Reproduction of the pilot’s Newcastle pilot passage plan chartlets showing the planned track and speeds
These chartlets, including the waypoint and cross track error lists, were available on the Port Authority of New South Wales’ website, Port Authority NSW under Newcastle Harbour). Pilots conducting inbound pilotages also used the same documents.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
RReleased in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 22 February 2017, at 1433 Eastern Daylight-saving Time (EDT), a Virgin Australia ATR 72-212A aircraft, registered VH-VPJ, departed Port Macquarie Airport, New South Wales (NSW) to operate scheduled flight VA1188 to Sydney, NSW. There were four crew and 23 passengers on board.
At 1453:35, during cruise at Flight Level (FL) 180,[1] the Centralized Crew Alerting System (CCAS) alerted the flight crew to a failure of the number one static inverter (Figure 1).[2] The CCAS then displayed multiple messages indicating a loss of power to systems associated with the number one static inverter. The aircraft electrical system power transfer function automatically transferred these systems to the number two static inverter and the CCAS warnings extinguished.
At 1453:43, the cockpit master warning activated and the CCAS displayed an electrical smoke warning. The flight crew immediately donned their oxygen masks and enacted the smoke checklist memory items. As the flight crew fitted the oxygen masks, they detected a strong electrical type burning odour and observed faint wispy smoke within the cockpit. After conducting the memory items, the flight crew then completed the electrical smoke checklist. The checklist included selecting the avionics vent exhaust mode to overboard. After completing this selection, the flight crew reported the smoke quickly dissipated. Flight data shows the electrical smoke warning extinguished at 1454:56.
After completing the electrical smoke checklist, the captain identified Williamtown Airport about 65 km (35 NM) south-east of the aircraft and elected to divert the flight to Williamtown.
At 1455, the captain contacted air traffic control (ATC) and declared a MAYDAY.[3] The captain advised that they intended to divert to Williamtown Airport. ATC cleared the flight to descend and track directly to Williamtown.
After contacting ATC, the captain requested that the senior cabin crew (SCC) report to the aircraft interphone using the cabin public announcement system. The SCC heard the announcement, but due to muffling caused by the captain’s oxygen mask, they did not understand the request. The second cabin crewmember heard the announcement more clearly and communicated the request to the SCC. The SCC contacted the flight deck using the aircraft interphone. The captain advised them of the emergency and that the flight was diverting to Williamtown. The SCC advised the other cabin crewmember of the diversion and commenced securing the cabin.
After securing the cabin, the SCC returned to their seat and contacted the flight deck. The captain provided them with a full briefing, advising the nature of the emergency and to expect a precautionary disembarkation[4] after landing. Recognising the high workload of the flight crew, the SCC advised the captain that they would conduct the passenger briefing tasks on behalf of the flight crew. The captain instructed the SCC to begin the precautionary evacuation once the seat belt sign extinguished after landing.
As the aircraft descended through 10,000 ft, the flight crew removed their oxygen masks. The captain found the remaining odour very strong and elected to refit the oxygen mask. The captain identified that the aircraft was too high to commence an approach to Williamtown and conducted a descending orbit to lose height prior to commencing a visual approach for runway 12. While approaching runway 12, the captain found the oxygen mask blurred their vision. The captain briefly handed control of the aircraft to the first officer and removed the oxygen mask.
At 1512, the aircraft landed on runway 12. After landing, ATC instructed the flight crew to taxi the aircraft to Bay 11. Once the aircraft stopped and the flight crew shut the engines down and extinguished the seat belt sign, the SCC initiated the precautionary disembarkation. The SCC used the cabin public address system to direct passengers to disembark the aircraft using the cabin door. Emergency services personnel met the disembarking passengers and guided them clear of the aircraft to a safe area.
After shutting down the engines, the flight crew noticed the smell intensifying. The captain elected to immediately vacate the flight deck. The flight crew followed the last passenger and the cabin crew in vacating the aircraft through the cabin door.
The aircraft was not damaged, and no persons were injured during the incident.
Figure 1: Number one static inverter
Source: Operator
Captain comments
The captain provided the following comments:
Time was lost due to difficulties with the first officer refitting their headset after donning the oxygen mask. The oxygen mask also created difficulties in communication between the flight crew and cabin crew. Managing these communication difficulties added to the flight crew workload during the emergency.
While the company did not operate the ATR 72 to Williamtown and the captain had not previously operated there, the captain commented that the best place for an aircraft with smoke in the cockpit is on the ground. The long runway, available emergency services and clear weather between their position and the airport enabled the captain to quickly elect to divert to Williamtown.
Senior cabin crew member comments
The senior cabin crew (SCC) provided the following comments:
They had not expected and were not prepared for the communications difficulties caused by the flight crew’s use of oxygen masks. Their voices were heavily distorted which led to difficulty in understanding information. After the initial briefing from the captain, the SCC did not realise there was a smoke issue and believed the aircraft was experiencing an unspecified ‘leak’. After the initial briefing, they began to prepare the cabin for a possible depressurisation.
Due to the communications difficulties caused by the flight crew oxygen masks, the SCC did not realise that they were being requested to contact the flight crew and did not immediately respond.
The aircraft interphone does not allow the flight deck to address all cabin crew at the same time. Therefore, the SCC was required to relay information to the other cabin crewmember. This made it difficult for the other cabin crewmembers to be fully aware of the progress of the incident and increased the SCC’s workload.
Cabin preparation procedures for the precautionary disembarkation require that the SCC use designated Cabin Preparation cards. These cards provide guidance for full and reduced cabin preparation procedures and associated passenger briefings. The cards were located under the SCC’s seat and were inaccessible while seated. As the SCC was unable to leave their seat during the period between receiving the full briefing from the captain and landing, they were unable to access these cards.
Engineering examination
The manufacturer of the static inverter conducted an engineering investigation of the failed static inverter. The investigation found that the failure of the number one static inverter and associated smoke and odour was caused by a failure of a C60x series capacitor within the number one static inverter.
The aircraft manufacturer also noted that the operator experienced two previous static inverter failures in November and December 2016. These failures were also caused by failure of a C60x series capacitor.
Vendor Service Bulletin
On 22 June 2016, the manufacturer of the static inverter released vendor service bulletin SB 1002-0102-2173-24-36.
This service bulletin identified an issue with capacitor C311 which led to instances of reduced reliability and premature failure, sometimes with associated smoke emission. As part of this service bulletin, the C311 capacitor is replaced with a modified capacitor of increased reliability.
The service bulletin recommended that the modification be incorporated at the next shop visit for the static inverter units. After completion of the service bulletin modifications the static inverters are designated as ‘Amendment E’ status.
From October 2016, a retrofit campaign was undertaken by the static inverter manufacturer to refit all in-service static inverters to ‘Amendment E’ standard.
In December 2016, the aircraft manufacturer advised operators of the vendor service bulletin. The bulletin was classified as a minor change and did not imply safety concerns.
Continued static inverter issues
Following reports of failures of ‘Amendment E’ static inverters, the aircraft manufacturer identified an issue with additional capacitors within the static inverter. These capacitors are of the C60x (C601 through C605) series. Failures of these capacitors also led to failure of the static inverter unit and associated smoke emission.
Static inverter failure
In the event of failure of a static inverter, the power transfer function automatically transfers power of the associated electrical systems to the second static inverter.
The operator’s Minimum Equipment List allows dispatch of an aircraft with an unserviceable static inverter for a period of up to two days.
Safety analysis
A C60x series capacitor within the number one static inverter failed in a manner consistent with other C60x series capacitor failures. Failure of the capacitor resulted in failure of the static inverter and smoke being emitted into the cockpit.
Difficulties in communication with the flight deck led the SCC to initially believe the flight crew were managing an unspecified ‘leak’. Therefore, the SCC began preparing for a possible depressurisation. However, as the required actions were similar to those required for the smoke event in progress, the misunderstanding did not impact on the management of the cabin during the incident.
The Cabin Preparation cards were inaccessible during the period that procedures directed the SCC to use them. However, as the SCC was able to complete the required actions without reference to the cards this did not impact on their ability to prepare the cabin for landing and the precautionary disembarkation.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
A C60x series capacitor within the number one static inverter failed leading to failure of the static inverter and associated smoke.
Difficulties in communication caused by oxygen mask use led to misunderstandings between the flight crew and cabin crew and increased flight crew workload.
The Cabin Preparation cards were inaccessible to a seated cabin crewmember.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
Verifying the integrity of the Power Transfer function across the ATR fleet. The operator advised that after completing this campaign no adverse findings were reported.
The operator has initiated a retrofit campaign to route all in-service static inverters to the vendor to have the modification to both the C311A and the C60x capacitors completed (‘Amendment E’ and ‘Amendment F’ (see Aircraft manufacturer) standard).
The operator has initiated a fleet wide inspection and operational test of the oxygen mask integrated microphone.
The operator has undertaken a risk assessment for single and dual static inverter failure.
Aircraft manufacturer
As a result of this occurrence, the aircraft manufacturer has advised the ATSB that they are taking the following safety actions:
Short term actions:
Replacement of C311 capacitor resulting in service units being modified to Amendment E standard. New production units have been modified and the retrofit process is on-going.
Change in the manufacturing process with ‘burn in’ test on C60x capacitors resulting in units being modified to ‘Amendment F’ standard. New production units have been modified. The retrofit process is being prepared.
Mid-term actions:
A design change is under development including the replacement of the C60x capacitors. The redesigned unit will be identified with a new part number. The design change certification expected to be complete before the end of quarter 2, 2017.
Safety message
This incident underlines the value of effective training and procedures. Despite the communications difficulties and the inaccessible cabin preparation cards, the cabin crew were able to effectively prepare the cabin during the diversion and manage the subsequent precautionary disembarkation. This enabled all aircraft occupants to disembark the aircraft quickly and without injury.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 22 February 2017, a Singapore Airlines Boeing 777-212, registered 9V-SRP, operated scheduled flight SQ291 from Singapore Changi Airport, Singapore, to Canberra Airport, Australian Capital Territory (ACT). There were 13 crew and 235 passengers on board. The instrument landing system (ILS) for runway 35 at Canberra was out of service at the expected arrival time.
Prior to descent to Canberra Airport, the flight crew reviewed the weather conditions for Canberra. Canberra weather observations indicated that the visibility was greater than 10 km and wind conditions favoured runway 35 to be used for landing. As the runway 35 ILS was not available, the flight crew prepared to conduct the Standard Arrival Route (STAR)[1] POLLI FOUR PAPA arrival (Figure 1 left) and associated RNAV-Z[2] approach[3] (Figure 2) for runway 35. As the aircraft was arriving from the west, the flight crew elected to commence the RNAV-Z approach from waypoint[4] SCBSG. The captain, acting as pilot monitoring,[5] entered the arrival and approach into the aircraft’s flight management computer (FMC).
As the aircraft descended, air traffic control (ATC) instructed the flight crew to conduct the POLLI FOUR BRAVO arrival (Figure 1 right).
The flight crew had not briefed for this arrival and the first officer, who was pilot flying, identified that the POLLI FOUR BRAVO arrival led to the runway 35 VOR approach.[6] As the POLLI FOUR PAPA and POLLI FOUR BRAVO arrivals were very similar, the flight crew elected to reprogram the POLLI FOUR BRAVO arrival into the FMC while keeping the RNAV-Z approach. The flight crew intended to request the RNAV-Z approach from ATC upon first contact with the Approach controller. As the POLLI FOUR BRAVO arrival did not lead to the RNAV-Z approach, this created a discontinuity[7] in the programmed FMC flight path between the completion of the arrival at waypoint MENZI and the commencement of the approach. To correct this discontinuity, the first officer asked the captain to connect waypoint MENZI to the approach at waypoint SCBSI. In doing so, the waypoint SCBSG was erased from the programmed FMC approach.
Figure 1: POLLI FOUR PAPA (left) and POLLI FOUR BRAVO (right) arrivals
Source: Operator (annotated by ATSB)
At 0905 Eastern Daylight-saving Time (EDT), the aircraft was about 70 km (38 NM) southwest of Canberra at flight level (FL) 120,[8] with the autopilot engaged. ATC instructed the flight crew to contact the Approach controller. After establishing contact with the flight crew, the Approach controller instructed the flight to continue descending to 9,000 ft above mean sea level (AMSL). The controller advised the flight crew to expect the VOR approach to runway 35.
After the flight crew were advised to expect the VOR approach, they immediately requested the RNAV-Z approach. ATC instructed the flight crew to track to the commencement of the RNAV-Z approach at SCBSG and to expect the RNAV-Z approach. Due to high terrain to the south and southwest of Canberra, the RNAV-Z approach via SCBSG must be commenced from an altitude at or above the minimum sector altitude (MSA) of 7,500 ft. This altitude constraint is included in the FMC programmed flight path when selecting an approach using the arrivals/departures page in the FMC.[9]
Figure 2: RNAV-Z Approach
Source: Operator (annotated by ATSB)
After the controller advised the flight crew to expect the RNAV-Z approach, the captain manually re-entered SCBSG into the FMC without detecting that the 7,500 ft MSA constraint was now missing. The captain then manually connected SCBSG to SCBSI for the continuation of the approach.
At 0908, ATC cleared the flight for the RNAV-Z approach. After receiving clearance to conduct the RNAV-Z approach, the first officer entered the final approach fix crossing altitude of 3,900 ft[10] into the autopilot altitude selector. This directed the autopilot to continue descent to 3,900 ft.[11]
At 0909.16 in visual conditions, the aircraft tracked towards SCBSG. About 7.5 NM (13.9 km) prior to SCBSG, the aircraft descended below 7,500 ft (Figure 3). At 0909.37, as the aircraft descended to about 7,000 ft, the controller contacted the flight crew and advised that they were required to maintain 7,500 ft until SCBSG. The flight crew immediately disconnected the autopilot and climbed the aircraft to 7,500 ft. After climbing to 7,500 ft, the first officer reconnected the autopilot with 7,500 ft as the selected altitude.
At 0911:24, after the aircraft passed SCBSG, the first officer selected the final approach fix crossing altitude of 3,900 ft in the autopilot altitude selector and the aircraft commenced descending. The segment minimum safe altitude (SMSA)[12] for the leg of the approach from SCBSG to SCBSI was 5,300 ft.
As the aircraft descended through about 6,000 ft, and before they had passed SCBSI, the first officer sighted the runway. The first officer advised the captain that they wished to manually fly the aircraft and conduct a visual approach to runway 35. The captain agreed and the first officer disconnected the autopilot and commenced a manual visual approach. The flight crew did not advise ATC that they were visual and had sighted the runway, or that they had elected to conduct a visual approach.
At 0912.37, about 2.1 NM (3.9 km) prior to passing SCBSI on the segment between SCBSG and SCBSI, the aircraft descended below 5,300 ft. As the aircraft descended to about 4,600 ft the captain commented that the aircraft approach profile was becoming low. At the same time, the controller contacted the flight crew and advised them that the aircraft was below the SMSA and that they were required to maintain 5,300 ft until passing SCBSI. The first officer immediately levelled the aircraft at about 4,600 ft. The flight crew advised the controller that they had the runway and terrain in sight. The controller then cleared the flight to conduct a visual approach. After being cleared for a visual approach, the first officer commenced a climb to about 5,000 ft and re-established the aircraft on the desired approach profile.
At 0917, the aircraft landed on runway 35. The aircraft was not damaged, and no persons were injured.
Figure 3: Arrival and approach profile
Source: ATSB, derived from Airservices Australia radar data
Captain comments
The captain of 9V-SRP provided the following comments:
The runway 35 ILS was not available, therefore the RNAV-Z approach was selected as this approach provided the lowest available minimum descent altitude (MDA).[13] The captain did not expect to receive, and had not prepared, for the POLLI FOUR BRAVO arrival and associated VOR approach.
After receiving the POLLI FOUR BRAVO arrival, the captain elected to delay requesting the RNAV-Z approach until in contact with the Approach controller. The captain was not sure how the clearances were coordinated between different ATC units in Australia and believed it would be simpler to request the approach directly from the Approach controller.
As the POLLI FOUR BRAVO arrival tracked via MENZI, this presented a smooth transition to the RNAV-Z approach at SCBSI. The captain did not expect ATC to instruct the flight crew to track via SCBSG as this required a left turn from their position to SCBSG, then a right turn to SCBSI, then another left turn onto final approach.
The waypoint SCBSG should have been added to the FMC programmed flight path by selecting the SCBSG transition using the arrivals/departures page of the FMC. This would have ensured the SCBSG 7,500 ft altitude constraint remained programmed into the FMC.
ATC should have been advised when they became visual and elected to conduct a visual approach.
At the time the first officer commenced the visual approach, the runway 35 T-VASIS[14] was not visible.
During the visual approach, the flight crew used runway visual perspective and attitude along with a check of expected altitudes at specified distances from the runway to assess the approach profile.
Operator report
The operator conducted an investigation into the incident which identified the following points:
The flight crew fixated on flying the RNAV-Z approach as the crew had briefed and planned for this approach. The approach briefing did not include reversion to conventional navigation.
Standard operating procedures direct the flight crew to advise ATC when the flight crew have established visual conditions and are flying a visual approach.
The company operations manual states that flight crew must check FMC waypoints against the arrival chart, the navigation display map and the control display unit. This check shall include the verification of any altitude and speed constraints.
The flight crew training manual directs flight crew to avoid making manual entries when an approach or transition is available in the FMC, to prevent input errors or omissions.
Any transition to a visual approach should only be made when the appropriate cues to ascertain vertical profile such as T-VASIS are clearly visible.
Related occurrences
A number of ATSB investigations have examined occurrences relating to deviations in flight path involving foreign crew operating within Australia. Of these, three are summarised below.
At 2019 at night on 24 July 2011, a Boeing Company 777-3D7 aircraft, operated by Thai Airways, was conducting a runway 34 VOR approach to Melbourne Airport, Victoria. During the approach, the tower controller observed that the aircraft was lower than required and asked the flight crew to check their altitude. The tower controller subsequently instructed the crew to conduct a go-around. However, while the crew did arrest the aircraft’s descent, there was a delay of about 50 seconds before they initiated the go-around and commenced a climb to the required altitude.
The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’ when the aircraft pitched up to capture the VOR approach path. As a result, the remainder of the approach was conducted using the autopilot’s flight level change mode. In that mode the aircraft’s rate of descent is unrestricted and therefore may be significantly higher than that required for an instrument approach. In addition, the flight crew inadvertently selected a lower than stipulated descent altitude, resulting in descent below the specified segment minimum safe altitude for that stage of the approach and the approach not being managed in accordance with the prescribed procedure.
On 4 and 29 May 2010, an Airbus A330-343E aircraft, was being operated by AirAsia X to the Gold Coast, Queensland. On both occasions, there was low cloud and reduced visibility on arrival at the Gold Coast.
During VOR approaches conducted at Gold Coast Airport on both days, the flight crews descended the aircraft below the segment minimum safe altitudes. As a result, the aircraft descended to an altitude where there was no longer separation assurance from terrain and aircraft operating outside controlled airspace.
On 17 December 2008, a Boeing Company 737-4MO aircraft, operated by Garuda Indonesia, made a significant diversion around weather at night while en route to Darwin, Northern Territory. The aircraft was cleared to conduct the runway 11 VOR approach via the initial approach fix NASUX. After the weather diversion, it was more convenient for the flight crew to make a pilot intercept of the 285 radial from the VOR but there was a period of misunderstanding as a result of a breakdown in the application of standard radiotelephony readbacks.
The flight crew left the previously cleared altitude of 3,000 ft on descent although they had not been cleared to do so. When this became apparent, no updated clearance for a pilot intercept of the 285 radial was issued by the controller. The aircraft continued to descend on the basis of the runway 11 VOR descent profile, even though it was not conducting the runway 11 VOR approach.
The flight crew used the position calculated by the aircraft's inertial reference system (IRS) to intercept the 285 radial, instead of using the signal from the VOR. The IRS position was not accurate enough for this, and the aircraft tracked to outside of the stipulated 5 degrees tolerance either side of the 285 radial. From then on, the aircraft was no longer 'established' on the 285 radial even though it was below the minimum sector altitude in cloud. When it broke through the cloud, the aircraft was clearly not aligned with the runway and a missed approach was carried out.
ATSB comment
Over recent years, the number of active VORs has reduced as part of the Airservices Australia Navigation Rationalisation Project. Global navigation satellite system (GPS) is now the primary means of navigation for instrument flight rules aircraft, including RNAV approaches where an ILS is not available.
Internationally, the prevalence of VOR approaches is even further reduced. This reduces the exposure of international flight crew to VOR approaches and therefore reduces the familiarity of international flight crew with the conduct of a VOR approach.
This incident, along with the previous occurrences identified above, highlight the importance of familiarity with this approach type. However, this familiarity may be reduced for foreign flight crews operating into Australia.
The air traffic services provider in Australia, Airservices Australia, advised that all of the runway connected STARs have been removed from the VOR approaches at Melbourne, Adelaide and all but one at Perth to discourage their use. While the VOR approaches are still available on request, flight crews are assigned only instrument approach procedures that are connected to STARs.
Safety analysis
The flight crew planned to conduct the POLLI FOUR PAPA arrival and RNAV-Z approach. When ATC issued instructions for the POLLI FOUR BRAVO arrival and VOR approach, the flight crew accepted the POLLI FOUR BRAVO arrival while preparing to conduct the RNAV-Z approach, instead of the associated VOR approach. This led to a discontinuity in the programmed flight path between the arrival and approach. The flight crew did not select the entry to the approach in the FMC and manually entering the waypoint SCBSG. As the waypoint was manually entered, the 7,500 ft altitude constraint was not included into the FMC programmed flight path. This missing altitude constraint was not detected by the flight crew.
The flight crew entered the altitude of 3,900 ft into the autopilot altitude selector prior to commencing the approach. With the autopilot engaged, the aircraft descended through 7,500 ft prior to commencing the approach at SCBSG. The flight crew did not detect that the aircraft had descended through the 7,500 ft MSA. The approach controller identified the error and alerted the flight crew.
Once established visual with the runway, the flight crew elected to conduct a manually flown visual approach without advising ATC and did not receive a clearance to discontinue the RNAV-Z and conduct a visual approach. The aircraft then descended below the standard profile which led to the aircraft descending below the 5,300 ft SMSA prior to passing SCBSI.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The captain manually entered the waypoint SCBSG into the FMC instead of selecting the RNAV-Z approach via waypoint SCBSG. This removed the 7,500 ft altitude constraint.
The crew did not identify the aircraft had descended below the 7,500 ft minimum sector altitude prior to passing SCBSG.
Prior to passing SCBSI, the flight crew elected to conduct a visual approach without advising air traffic control, the flight crew then descended the aircraft below the 5,300 ft segment minimum safe altitude.
The aircraft was in visual conditions at all times.
Safety message
This incident highlights the importance of preparation and communication prior to commencing a phase of flight. Requesting a preferred clearance early allows ATC to ensure that a clearance can be provided, or if not available, allows the flight crew time to prepare for a different clearance.
The Australian air traffic control provider, Airservices Australia, document: Standard Instrument Arrival Routes (STARS) provides further information to assist flight crew in adhering to clearances when conducting arrivals and approaches.
This incident also underlines the importance of adhering to standard operating procedures (SOPs). By deviating from SOPs and manually entering the waypoint, the crew removed a protection which was in place to prevent data input errors.
The ATSB has identified numerous accidents worldwide that were the result of simple human errors in data calculation or entry.
Data input errors-such as the wrong figure being used as well as data being entered incorrectly, not being updated, or being excluded-happen for many different reasons.
The consequences of these errors can range from rejected take-offs through to collisions with the ground. Errors can occur irrespective of pilot experience, operator, aircraft type, location and take-off performance calculation method.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 12 February 2017, a Boeing 747-47UF (freighter) aircraft, registered N416MC, operating from Honolulu, Hawaii, conducted an approach to Sydney Airport, New South Wales. On board the aircraft were two flight crew. The captain was the pilot monitoring (PM) and the first officer was the pilot flying (PF).[1]
The aircraft was cleared by the approach controller for the runway 16R instrument landing system (ILS) approach.[2] The autopilot was engaged[3] and the modes for localiser and approach (glideslope) were armed[4] while the aircraft was flown at 2,200 ft on a heading of 200° to intercept the 16R ILS. The aircraft captured[5] the localiser and the PF turned it left onto the 16R final approach course, while maintaining 2,200 ft, in order to intercept the glideslope from below.
Shortly after the turn onto the final approach, the PF called ‘glideslope captured’ and the aircraft started to descend. However, the PM’s primary flight display[6] was still showing the aircraft below the glideslope. The PM crosschecked the PF’s display and noticed the glideslope was captured, then checked their own display and noticed there was a failure flag displayed for the glideslope. The PM again crosschecked the PF’s display, noticed there was a failure flag for the PF’s glideslope, and instructed the PF to disconnect the autopilot and stop the descent.
As the aircraft descended through 2,100 ft, the approach controller requested confirmation that they were established on the glideslope. The PM responded that they had an interruption on glideslope and would maintain altitude until they could re-intercept. During the response, a minimum safe altitude warning (MSAW) alert appeared on the approach controller’s radar for N416MC at an altitude of 1,800 ft. The approach controller immediately issued the instruction ‘go-around, you are well below the glide-path, go-around’. The PM immediately acknowledged the instruction, and the flight crew initiated the missed approach procedure.
The lowest point on the approach was 1,559 ft from flight data (1,600 ft on radar) at about 8.0 NM (14.8 km) from runway 16R (Figure 1). This resulted in the aircraft descending about 1,000 ft below the nominal 3° glideslope at the time of the incident. The aircraft was flown on the second approach with autopilot engaged. The localiser and glideslope captured and tracked the ILS with no anomalies detected.
Figure 1: Minimum safe altitude warning for N416MC
Source: Airservices, annotated by the ATSB
ILS signal interference
Disturbances to ILS localiser and glideslope courses are caused by fixed structures, such as buildings (static distortion), and moving vehicles or aircraft (dynamic distortion). The total ILS course distortion is determined by the root square summation of static and dynamic distortion, and this is used to define critical areas[7] near each localiser and glideslope antenna (Figure 2).
Figure 2: Runway 16R glideslope antenna and critical area hold point
Source: Google earth, annotated by the ATSB
The critical areas are protected for low visibility approaches. This is when the cloud ceiling is at or below 600 ft, or the visibility is 2000 m or less. In which case, no aircraft or vehicle is permitted to enter the critical areas when an arriving aircraft is within the outer marker, or 4 NM from the threshold if there is no outer marker.
At the time N416MC intercepted the runway 16R localiser, a Boeing 787 was holding on taxiway A1, within the runway 16R glideslope critical area (Figure 3). However, the weather conditions did not require air traffic control to activate the ILS critical area, and N416MC was instructed to go‑around before reaching the outer marker.[8]
Figure 3: Infringement of the 16R glideslope critical area
Source: Airservices, annotated by the ATSB
Receiver characteristics
A moving receiver passing through a distorted ILS signal will produce a guidance error. The error produced will vary depending on the receiver characteristics, its antenna characteristics and the speed of the vehicle carrying the receiver as it passes through the distorted signal.
Similar incidents
Glideslope signal disturbances
On 17 March 2017, a Boeing 747-400 attempted to intercept the runway 16R ILS in instrument meteorological conditions using the autopilot for a coupled approach.[9] When the glideslope was captured, the indications began to oscillate, and the autopilot chased the indications. A high rate of descent developed and a ‘low on profile’ call was made on the flight deck to stop the descent. The descent was stopped at about 1,500 ft, about 7 NM (13 km) from the threshold of runway 16R. An Airbus A380 was lined up for departure on runway 16R from taxiway A1 when the Boeing 747 was about 8 NM (14.8 km) from the threshold of runway 16R.
On 23 March 2017, a Boeing 747-400 attempted to intercept the runway 16R ILS in instrument meteorological conditions using the autopilot for a coupled approach. Approaching 2,000 ft, the glideslope on the captain’s primary flight display disappeared, followed by the glideslope on the first officer’s primary flight display. The aircraft pitched nose down with an associated increased rate of descent. The captain disengaged the autopilot and stopped the descent at about 1,500 ft and 8 NM (14.8 km) on final for 16R. A minimum safety altitude alert activated, and the approach controller instructed the flight crew to conduct a missed approach. An Airbus A380 was holding on taxiway A1 at the time of the incident. A second approach was flown using the autopilot without incident. There were no aircraft in the glideslope critical area during the second approach.
Localiser signal disturbance
On 27 August 2015, a Boeing 787-800 attempted to conduct an autoland[10] to runway 34L at Sydney Airport in visual meteorological conditions. The aircraft experienced a disturbance to the localiser signal at about 100 ft and the flight crew immediately disconnected the autopilot to complete the landing. The flight crew were aware the ILS critical area was not required to be protected at the time and had not notified air traffic control they were conducting an autoland. They were aware that disturbances to the ILS signals were possible and were prepared to intervene. An Airbus A330 departed directly in front of the 34L localiser antenna at the time of the incident.
Manufacturer comments
Boeing, the aircraft manufacturer, reported that they have no reason to believe that the 747 would behave any differently to their other aircraft types. The same antenna system is installed on the 757, 767 and 777. However, there are some differences in the antenna locations. The 747 and 777 receiver antennas are located on the main landing gear doors, while the 757 and 767 antennas are located in the nose of the aircraft. The glideslope incidents might relate to a varying signal strength, rather than a distorted beam.
Aeronautical Information Publication
If a pilot advises air traffic control that an ‘autoland’ or ‘coupled approach’ is to be flown, then air traffic control will either report ‘ILS critical area not protected’ or ‘LVP[11] in force’ if the critical area is protected.[12]
Airservices Australia comments
Airservices Australia, the air traffic services provider, reported that disturbance of the glideslope signal is less for aircraft at the taxiway A holding point (holding point for glideslope critical area) than it is for the same aircraft at the holding point on taxiway A1. Airservices Australia conducted a computer simulation which indicated that an Airbus A380 aircraft stationary at holding point A1 is unlikely to have caused the large ILS signal disturbance observed in this incident.
The simulations and radar recordings indicated the observed disturbance in each case occurred after the holding aircraft was provided with its line up clearance and while taxiing between the holding point and the runway. In this respect, there will always be significant interference to approaching aircraft outside 4 NM regardless of whether the holding point on taxiway A or A1 is used at the same time as runway 16R is used for arrivals.
Safety analysis
N416MC intercepted the final approach, and the autopilot captured the ILS localiser and glideslope at the same time as a Boeing 787 (B787) was holding on taxiway A1, which lies within the critical area for the runway 16R glideslope. The presence of the 787 in the critical area likely resulted in N416MC receiving either a distorted glideslope beam or a beam of varying signal strength. This required flight crew intervention following a glideslope failure indication, which was detected by the captain crosschecking the two primary flight displays. At the time of the incident, the glideslope critical area was not required to be protected, in accordance with the manual of air traffic services.
ATSB comment
It has been previously noted by regulators and manufacturers, that it is common practice for operators to conduct coupled approaches and autoland to satisfy maintenance, training or reliability program requirements. These approaches may be conducted in weather conditions which do not require protection of the ILS signal. There have been incidents reported in which the autopilot has responded to disturbances in the ILS signal when the aircraft was close to landing. Airservices Australia advise that ILS signals may be disturbed with the consequential effect on autoland performance when weather conditions do not require protection of the ILS critical area.
For more information on ILS signal distortion and determination of protected areas following the introduction of the Airbus A380 see Assessment of ILS protection areas impact on large aircraft operations.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The descent below the nominal 3° approach glideslope was probably the result of the aircraft auto-pilot capturing a distorted glideslope beam.
The glideslope beam was probably distorted due to the presence of a Boeing 787 in the glideslope critical area, which was not required to be protected in the weather conditions which prevailed at the time of the incident.
Safety message
This incident highlights the importance of crosschecks on the flight deck and between air traffic control and the flight crew. After detecting unexpected indications on the flight deck, the flight crew intervened to stop the descent, which was then followed by an instruction from air traffic control to initiate a go-around.
The aircraft manufacturer and regulators have recommended that flight crew remain vigilant for ILS disturbances with resulting unexpected flight control movements and be prepared to immediately disconnect the autopilot, particularly during autoland operations.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
