What happened

On 19 September 2013, the pilot of a Beechcraft B300, registered VH-FIZ, was conducting calibration activities of ground-based navigation aids at Williamtown (Newcastle Airport), New South Wales.

During the calibration activities, the aircraft conducted a 7 NM (13.0 km) orbit around Williamtown. However, the Tower air traffic controller had intended the aircraft to hold south of Williamtown over land. At the same time, other aircraft were approaching Williamtown to land.

VH-FIZ tracked on the 7 NM arc towards, and then across the coast, on a converging path with a formation of four Boeing F/A18 aircraft that were on a visual approach to Williamtown. The formation flew directly below VH-FIZ with less than the required 1,000 ft separation.

What the ATSB found

The ATSB found that the applicability of a general requirement to conduct aviation risk assessments at Department of Defence aerodromes for complex, new, unusual or irregular activities was open to interpretation. This led to an absence of prior planning for the calibration activities, resulting in an air traffic control work-around on the day of the activities that did not address all related safety aspects. One work-around was that airspace over land usually controlled by Approach was transferred to the Tower. The resultant airspace controlled by the Tower was considerably larger than normal, resulting in the Tower controllers having difficulties visually monitoring the airspace and needing to rely on the surveillance display for situation awareness.

An instruction given to VH-FIZ to ‘orbit’ was insufficiently clear, resulting in the pilot misinterpreting it as permission to conduct a pre-planned 7 NM (13.0 km) orbit around Williamtown. As a result of the Tower controller’s assumption that VH-FIZ would remain in the area they intended, the aircraft was not adequately visually monitored by the controllers in the Tower, or monitored on radar by the Approach controller. This removed any chance of early detection of the impending aircraft conflict. When the Tower controller did detect the conflict, clear control instructions were not immediately given to either VH-FIZ or the F/A18s, leading to a loss of separation.

What's been done as a result

The Department of Defence took proactive action to improve the implementation of aviation risk management (AVRM) to ensure that AVRM plans developed for unusual or irregular operations, such as calibration operations, addressed staffing and traffic levels, coordination and workload.

Safety message

Although not guaranteeing the absence of aircraft separation incidents, prior planning for unusual or irregular operations can permit the development of robust air traffic control defences that address the specific hazards of that operation. Aircraft separation safety also relies on controllers issuing specific control instructions to all pilots, along with the provision of timely and relevant traffic information to pilots of aircraft identified to be in conflict.

Williamtown Visual Terminal Chart

Source: Airservices Australia

Context

Background

As a Department of Defence (Defence) airfield, air traffic services at Williamtown, also known as Newcastle Airport, were provided by Defence personnel. Approval had been granted for the operation of a number of civil aircraft, including regular public transport flights. In 2013, there were 16,764 domestic/regional airline movements^[15] into and out of Williamtown.^[16] In addition to airlines and military aircraft, civilian general aviation aircraft also regularly used the airfield.

Airspace

Williamtown Tower controllers are normally responsible for the Aerodrome Traffic Zone (ATZ) (shown as the dark green area in Figure 1) that includes the circuit area; 5 NM (9.3 km) radius of Williamtown, over land only, from the surface to 1,500 ft above mean sea level (AMSL).

On the morning of the occurrence, the Tower and Approach supervisors learnt that calibration check activities for the instrument landing system (ILS) and the tactical air navigation system (TACAN) would commence at 1100. There were no procedures in place relating to the control and sequencing of the calibration flight. To expedite the calibration activity and reduce the workload of both the pilot and controllers, the Tower and Approach supervisors agreed that VH-FIZ (FIZ) would remain on the Tower controller’s frequency and operate in airspace normally under the jurisdiction of the Approach controller. To achieve this, airspace usually under the control of Approach was released to the Tower. The released airspace, over land within a 12 NM (22.2 km) radius of Williamtown, from the surface to 3,500 ft (light green area of Figure 1), would contain all of the planned calibration runs apart from the two 7 NM (13.0 km) orbits of Williamtown. The latter required FIZ to track over water in airspace controlled by Approach.

The airspace was released to the Tower controller 2 minutes before FIZ became airborne. The pilot of FIZ had been cleared to operate within 15 NM (27.8 km) of Williamtown not above 3,300 ft. However, as the clearance did not specify ‘over land’, the clearance contained the airspace required to complete all calibration runs.

Personnel information

On weekdays, three controllers normally worked in Williamtown Tower – a Tower supervisor, a Tower controller and a Surface Movement controller. On the morning of the occurrence, two additional controllers were present – a training officer and a checking controller. The afternoon shift comprised three controllers – the Tower supervisor, the Tower controller and a newly endorsed Surface Movement controller. All controllers held the appropriate endorsements to provide a Tower control service for aircraft operating within the Williamtown airspace.

A review by the Australian Transport Safety Bureau (ATSB) indicated that the roster for the controllers was unlikely to have resulted in work-induced fatigue.

The primary duty of the Tower controller was to visually separate aircraft. The surveillance display could be used as a separation and situation awareness aid, as long as that utilisation did not detract from the primary duty of applying visual separation. The intent of allowing Tower controllers to use the display to establish or monitor separation was to enable the controller to convert a radar separation standard established by the Approach controller into a Tower visual separation standard for arriving aircraft and vice versa for departing aircraft. The display was not designed to enable Tower controllers to use radar as the primary method of separation between aircraft operating within the ATZ.

The larger than usual volume of airspace released to the Tower controller required the controller to, on occasion, use the display to monitor and separate aircraft, even though they were not trained to use radar separation. Neither the afternoon Tower supervisor nor the Tower controller had ever operated with such a large volume of airspace. They both reported that it had been difficult to see the calibration aircraft and that often binoculars were needed to see FIZ.

Aircraft information

The operator of FIZ provided calibration services to both of Australia’s air navigation service providers – Airservices Australia and Defence. The flight crew included a number of technicians to undertake the actual calibration tasks while the pilot maintained a pre-determined and specific flight path and level.

The four Boeing F/A18 aircraft (F18s) were operated by Defence personnel based at Williamtown. The F18 flight crew operated in accordance with procedures designed to provide separation assurance and contained within the Williamtown Base Standing Instructions (Base SIs), available to both the Defence aircrew and air traffic control (ATC) personnel.

Calibration activities

Both the ILS and the TACAN were designed for use by aircraft in instrument meteorological conditions (IMC)^[17] and both provided guidance to aircraft during the final stages of an approach to land. Routine monitoring, ground testing and maintenance ensured that the systems performed within the specified tolerances and that the operational integrity and serviceability of the systems were maintained. Australia-wide, periodic flight testing (calibration) was required to ensure that ground-based aeronautical navigational equipment remained within the tolerances required for the safe operation of aircraft.

The Flight Commander^[18] at Williamtown was given 24 working days’ notice that a calibration aircraft would be operating there for a 2-day period. The run sheet for the instrument landing system (ILS) calibration was emailed to Williamtown 2 days prior to the occurrence, but those for the tactical air navigation system (TACAN) were only emailed on the morning of 19 September 2013 (the day of the occurrence). Additionally, the TACAN run sheet was only provided in ‘draft’ to the operational personnel, not to the Flight Commander.

The run sheet for the ILS listed 23 runs and included a copy of the Williamtown visual terminal chart (VTC) with relevant information added. The ILS run sheet indicated that some runs could be deleted, and that runs would not necessarily be consecutive. The run sheet for the TACAN calibration was emailed to Williamtown in draft format, with a note ‘The run numbers are to assist with Pilot/ATC communications, not to indicate the order in which the runs will be completed.’ Although the approaches and manoeuvres were listed as runs, the layout was significantly different to that used on the ILS run sheet. The TACAN runs included two 7 NM (13.0 km) orbits around Williamtown (runs 1A and 1B, the blue broken line in Figure 1) and two approaches to each runway (runs 2A and 2B to runway 30, runs 3A and 3B to runway 12).

At about 1500, when the afternoon Tower shift commenced work, FIZ had completed almost all of the ILS runs, but had yet to commence the TACAN runs.

When run 3B was cancelled and the pilot of the calibration aircraft asked ‘… can we climb up and do the orbit then?’ the Tower controller reported that they expected FIZ would complete a holding orbit. That is, that the pilot would conduct a continuous steady rate turn to remain to the south of the airfield. However, the tracking of FIZ demonstrated that, on receiving the response ‘…affirm climb not above 3,100’, the pilot understood the controller had cleared the calibration aircraft for the 7 NM (13.0 km) orbit around the Williamtown TACAN.

Military operations

Military fast jets and some training aircraft operate predominately in formation where the pilots of two or more aircraft fly in close proximity to each other and operate as a single aircraft with regard to navigation, position reporting and control.^[19]

Military aircraft ‘initial and pitch’ circuit procedures were as follows:

For military fast jet and training aircraft, the preferred method of joining the circuit is via a procedure known as Initial and Pitch. The aircraft (or formation) will track to the Initial Point, a point at 5 NM downwind of the runway in use displaced to the dead side, and track inbound at high speeds. At any stage once abeam the threshold of the runway in use, and safe to do so, the aircraft turns (“Pitches”) to join downwind and configures for landing.^[20]

The initial point for runway 30 was a position at the intersection of a line aligned slightly north of the runway and the coast to the east of Williamtown (pink cross on both Figure 1 and 2). Base SIs required military pilots to report their position to the Tower controller 30 seconds prior to the initial point as left, right or straight initial – the direction denoting the turn required from their arrival path to align with the landing direction. Traffic information^[21] was provided to these aircraft following that report.

Organisational and management information

Coordination

The 453 Squadron Williamtown Flight Standing Instructions (ATC SIs) stipulated that the Approach controller did not need to seek a clearance from the Tower controller for visual approaches to the duty runway for locally-based Hawk and F18 aircraft. They also stipulated that those aircraft on a visual approach would be transferred to the Tower frequency at 10 NM (18.5 km). However, the Approach controller was required to coordinate all traffic that would infringe the ATZ.

To reduce workload when the ATZ was controlled by the Tower controller, voice coordination from Approach to Tower controllers for arriving locally-based Hawk and F18 aircraft was replaced by silent coordination. Silent coordination was conducted by placing the intentions for the aircraft in the data label for the aircraft or formation on the surveillance display, utilising abbreviations listed in the ATC SIs.

Strategic separation assurance

The Manual of Air Traffic Services (MATS)^[22] stipulated that separation assurance must be applied. It defined strategic separation assurance as:

Strategic separation assurance is the designing of airspace, air routes, air traffic management plans and air traffic control practices, to reduce the likelihood that aircraft will come into conflict, particularly where traffic frequency congestion or system performance, amongst other considerations, may impair control actions.

Strategic separation assurance was provided at Williamtown and published in the Base and ATC SIs. When issued a visual approach, pilots of locally-based military aircraft were required to remain outside the Tower’s airspace until provided with traffic information on aircraft within that airspace. The normal vertical limit of the Tower’s airspace was 1,500 ft with a requirement that local military aircraft were required to overfly not below 2,500 ft. On the day of the occurrence the Tower’s airspace was increased to 3,500 ft. However, as the operators of the local military aircraft were not advised, the minimum overfly altitude remained unchanged at 2,500 ft. Changing the airspace on the day of the occurrence without changing these requirements, or amending the silent coordination arrangements, negated the documented strategic separation measures applicable to locally-based military aircraft.

Separation

Separation is the concept of ensuring an aircraft maintains a prescribed minimum distance from another aircraft or object. Within controlled airspace, ATC provided separation using standards specified in the Manual of Standards Part 172^[23] (MOS 172) and listed in MATS. Although different standards could be used between military aircraft, Williamtown ATC used the MOS 172 standards when controlling civil, or a combination of civil and military, aircraft. Only one separation standard was required to be in place between aircraft at any one time, but another standard had to be established by a controller prior to the current separation minimum being infringed. Controllers normally base the method of separation on operational advantage but the type of separation standard used depends on a number of factors.

The ATC SIs required the Tower controller to separate and sequence circuit aircraft with all arrivals, departures and transits of the ATZ. As well as all aircraft conducting operations in the ATZ, aircraft arriving via the initial point were considered to be circuit aircraft at the initial point.

The methods of separation used by Williamtown Tower controllers were predominately vertical and visual. Although the Tower controller had access to a surveillance display, they were not trained or endorsed to use that equipment for radar separation, and as such, the surveillance standard of 3 NM (5.6 km) did not apply. However, the Tower controller could use the surveillance display to assist with situation awareness and for silent coordination (see the section on Coordination).

The use of one of the two vertical separation standards available to the Tower controller, 500 ft or 1,000 ft, was dependent on the maximum take-off weight (MTOW) of the aircraft being separated. If both aircraft were 7,000 kg MTOW or less, 500 ft could be used. Although the MTOW of the calibration aircraft was below 7,000 kg, the weight of the F18s was considerably higher so the appropriate minimum vertical separation standard between FIZ and the F18s was 1,000 ft.

To determine the altitude of the F18s for separation purposes, the Tower controller could request the pilot of the lead F18 to report when the formation had descended through 2,100 ft (1,000 ft below FIZ).

Two visual separation standards were available to the Tower controller. The use of the visual (pilot) separation standard transferred separation responsibility from ATC to the pilot of an aircraft and required that pilot to ensure that their aircraft remained clear of other aircraft. A number of requirements existed for the use of the visual (pilot) standard, the most relevant to this occurrence were that the pilot of one aircraft had to have reported the other aircraft in sight and the pilot of the other aircraft, if IFR, had to have been provided with traffic information and advised that the responsibility for separation had been transferred.

The visual (ATC) separation standard could be used between aircraft that had been positively identified by the Tower controller visually identifying the aircraft type. Prescribed separation minima could be reduced in the vicinity of airfields when adequate separation could be provided using visual observation and each aircraft was continuously visible by the Tower controller. However, visual (ATC) separation could only be applied when the projected flight paths of the aircraft did not conflict. As long as the calibration aircraft remained over land to the south of Williamtown, the visual (ATC) separation standard existed.

The lateral separation standard of 1 NM (1.9 km) could have been applied to the aircraft if their positions were determined relative to a prominent topographical feature. If the Tower controller has issued positive holding instructions to the pilot of FIZ to hold over land to the south of the airfield, and the controller had established that the aircraft was holding in that position either by sighting the aircraft or by pilot report, the lateral standard would have existed.

Of the separation standards available to the Tower controller, the only applicable standards on the day were 1,000 ft vertical, visual (pilot) or lateral. As the requirements for the visual (pilot) standard and the lateral standard were not in place, 1,000 ft was required between FIZ and the F18s. When the Tower controller identified that FIZ was over water to the south-east of the airfield, they asked the pilot for confirmation that the aircraft was holding to the south. However, if the Tower controller had at that time issued turn instructions to the pilot to re-establish FIZ over land and clear of the projected flight path of the F18s, the visual (ATC) separation standard would have been re-established between the calibration aircraft and the F18s.

Monitoring aircraft

To ensure that separation was maintained, Tower controllers were required to monitor the traffic situation. However, the Tower controller did not monitor the location of FIZ holding to the south and was therefore unaware that the aircraft had crossed the coast and left the airspace under their jurisdiction. Although the Tower controller had requested that the Surface Movement controller monitor FIZ, monitoring an aircraft of that size at that distance was difficult. Additionally, the Approach controller did not monitor the airspace under their jurisdiction sufficiently to observe FIZ crossing the coast.

Compromised separation recovery

If a controller determined that aircraft were, or would be, in unsafe proximity, the controller was required to issue a safety alert, using the following prescribed phraseology:

SAFETY ALERT TRAFFIC (number) MILES OPPOSITE DIRECTION / CROSSING LEFT TO RIGHT / RIGHT TO LEFT (level information).^[24]

Although the Tower controller did issue a safety alert to the pilot of VH-FIZ, the correct phraseology was not used, and no safety alert was provided to the F18 pilots.

Supervision

The Tower supervisor was responsible for, among other activities, supervising and coordinating the work of the Tower and Surface Movement controllers, and for maintaining a close working liaison with the Approach supervisor.

The Tower supervisor reported that the calibration aircraft was difficult to see when it tracked to hold south of the airfield and that they had told the Tower controller a number of times to provide clearer holding instructions to the pilot of FIZ as the aircraft did not look like it was holding as expected.

Close liaison was a regular activity for the supervisors to optimise traffic management as the majority of Williamtown Tower traffic was high speed military aircraft, sometimes requiring last-minute sequence changes for operational reasons.

Priorities

The Australian Aeronautical Information Publication (AIP) stated that an aircraft first able to use the airspace in the normal course of its operations would be given priority. However, as the AIP allowed for aircraft engaged in navigation aid checks to be given priority, controllers prioritised FIZ’s operations as much as possible. The prioritisation was achieved by holding departures on the ground and holding arrivals outside the calibration aircraft’s area of operations for short periods of time, then holding FIZ to facilitate departures and arrivals.

Risk management

Defence required the use of aviation risk management strategies across all aviation activities. In line with this, the agency responsible for Defence air traffic services stipulated that any complex, new, unusual or irregular activity required a risk assessment and that treatments be developed for any risks assessed as medium or higher.

Williamtown ATC had in place a number of generic risk assessments and treatments for occasions when less than the required number of endorsed personnel were available to assist decision making while balancing controller workload and safety. Issues requiring consideration included anticipated traffic complexity or unusual activity, complexity of airspace, and experience levels. The documentation provided direction on the number of personnel required and methods for reducing the number or complexity of traffic. Within each assessment, the level of risk had been assessed in line with specific conditions and/or treatments – including staffing and traffic levels, weather, equipment serviceability and airspace configuration. However, there were no risk assessment for increased traffic complexity (such as a calibration aircraft operating to the non-duty runway) or for additional airspace being released to the Tower controller.

Although executive personnel within the Williamtown ATC unit were notified of the calibration flight inspection 5 weeks prior to the event on 15 August 2013, and further details of the proposed inspection were available from an internal Defence website, the Williamtown Flight Commander reported that, as calibration flights occurred a number of times each year at Williamtown, they were not considered irregular activities and therefore did not require the development of a risk assessment or treatment. The Flight Commander noted that initial notification of calibration flights had provided no details.

Previous occurrences

A review of the ATSB database identified three notifications involving a calibration aircraft at Australian airfields in the 7 years prior to, and one shortly after, the Williamtown occurrence. None of these notifications were investigated by the ATSB.

The ATSB research report AR-2012-034 Loss of separation between aircraft in Australian airspace – January 2008 to June 2012, noted that ‘assessing and planning’ or ‘monitoring and checking’ errors were involved with most individual controller actions that contributed to loss of separation (LOS) occurrences. Ineffective management of compromised separation before it became a LOS was categorised as an assessing and planning error. Monitoring and checking errors included controller actions associated with maintaining awareness of traffic disposition and not detecting that the pilot of an aircraft was not complying with an instruction when there was opportunity to detect this.

Additionally, the ATSB report found that about a quarter of LOS occurrences contributed to by ATC actions involved communication errors. These included not passing traffic information to pilots once separation was compromised and not providing clear, timely or urgent instructions to pilots when separation had been lost to ensure that immediate action was taken to avoid other aircraft or re-establish separation.

The research report found that task demands were the most common type of local condition identified in LOS occurrences where controllers were involved – in particular, high workload and distractions. Common in all ATC environments, these local conditions were more common in the Tower environment. Controller knowledge, skills and experience factors were also identified as local conditions in LOS occurrences.

__________

15. Movements refer to the combination of take offs and landings.
16. Source: Bureau of Infrastructure, Transport and Regional Economics, Airport traffic data http://www.bitre.gov.au/publications/ongoing/airport_traffic_data.aspx
17. Instrument meteorological conditions (IMC) describes weather conditions that require pilots to fly primarily by reference to instruments, and therefore under instrument flight rules (IFR), rather than by outside visual references. Typically, this means flying in cloud or limited visibility.
18. The Flight Commander was the senior air traffic controller at Williamtown and responsible for the provision of an air traffic service.
19. AIP GEN 2.2 – DEFINITIONS AND ABBREVIATIONS, paragraph 1 Definitions.
20. AIP EN ROUTE (ENR) 1 – GENERAL RULES AND PROCEDURES, Section 48 LANDING MANOEUVRES, paragraph 48.8 Military Initial and Pitch Circuit Procedures 48.8.1 and 48.8.4.
21. Traffic information is issued by a controller to alert a pilot to other known or observed air traffic which may be in proximity to the position or intended route of the flight and to help the pilot avoid a collision.
22. The Manual of Air Traffic Services (MATS) is a joint Department of Defence (Defence) and Airservices Australia (Airservices) document, based on the rules published in Manual of Standards Part 172 (MOS 172) and the International Civil Aviation Organization standards and recommended practices, combined with the rules specified by Airservices and Defence. The requirements and obligations in MATS are in accordance with provisions and regulations of the Air Navigation Act 1920, the Air Services Act 1995, and Defence Instructions. MATS is not publically available.
23. MOS 172 Air Traffic Services outlined the requirements and standards for air traffic services in compliance with Civil Aviation Safety Regulation (CASR) 1998 Part 172 Air Traffic Service Providers, including aircraft separation.
24. AIP GEN 3 SERVICES, Section 3.4 COMMUNICATION SERVICES, Subsection 5 PHRASEOLOGIES, paragraph 5.1 Traffic Alert and Collision Avoidance System (TCAS), Safety Alerts and Avoiding actions and Wind Shear Escape.

Findings

From the evidence available, the following findings are made with respect to the loss of separation between a Beechcraft B300, registered VHFIZ, and a formation of four Boeing F/A18 aircraft that occurred near Williamtown (Newcastle Airport), New South Wales on 19 September 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The applicability of a general requirement to conduct aviation risk assessments for complex, new, unusual or irregular activities was open to interpretation. [Safety issue]
• The absence of prior planning relating to the operation of the calibration aircraft resulted in a work-around that did not address all related safety aspects and negated the existing strategic separation assurance.
• The Williamtown Approach controller released airspace to the Tower controller that was considerably larger than that normally controlled by the Tower, resulting in both the Tower supervisor and the Tower controller having difficultly monitoring the airspace visually, and the need for the Tower controller, though not trained in the use of surveillance control, to rely on the surveillance display for separation.
• The absence of specific control instructions by the Tower controller to the pilot of VH-FIZ created an opportunity for the pilot to misunderstand the Tower controller's intent in relation to the pilot’s requested ‘orbit’.
• The Tower controller did not monitor the flight path of VH-FIZ due to an assumption the aircraft would remain in the area the controller had intended the aircraft to remain, leading to a loss of separation assurance.
• The Approach controller did not monitor their airspace sufficiently well to observe VH-FIZ crossing the coast into airspace under their jurisdiction, removing the chance for earlier detection of the loss of separation assurance.
• The Tower controller did not provide immediate and clear control instructions to either VH-FIZ or the formation of F18s once the conflict was detected, resulting in a loss of separation with the formation of Boeing F/A18 aircraft flying directly below VH-FIZ with less than 1,000 ft separation.

Safety issues and actions

The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Absence of prior planning

The applicability of a general requirement to conduct aviation risk assessments for complex, new, unusual or irregular activities was open to interpretation.

Safety Issue No: AO-2013-160-SI-01

Safety analysis

Although the opportunity for Williamtown air traffic control (ATC) to undertake prior planning for the calibration operations had existed in the 24 working days between the initial notice and the activity, no such planning took place. Defence air traffic services stipulated that any complex, new, unusual or irregular activity required a risk assessment. However, as calibration flights occurred a number of times each year, the Williamtown ATC Flight Commander did not believe that such activity required the conduct of a risk assessment. In addition, although Williamtown ATC had in place a number of generic risk assessments and treatments for unusual situations, there were no risk assessment for increased traffic complexity such as that created by the calibration activities.

Prior planning and a risk assessment had the potential to identify the need to increase staffing in both the Tower and Approach areas, provide briefings for ATC personnel and the pilots of locally-based aircraft, and ensure controllers had a thorough understanding of the calibration run sheets prior to the activity commencing. Such prior planning would have incorporated strategic separation assurance considerations.

The Williamtown Approach controller released airspace to the Tower controller that was considerably larger than that normally controlled by the Tower. That resulted in both the Tower supervisor and the Tower controller having difficultly monitoring the airspace visually, and the need for the Tower controller, though not trained in the use of radar separation, to rely on the surveillance display for situation awareness as well as separation. In situations where the location of an aircraft is known (from a position report or from observing a surveillance display), a controller could quickly use the binoculars to locate an aircraft. However, to locate an aircraft at an unknown position, the controller would need to scan the sky, possibly with the assistance of binoculars. Although binoculars were available to the controllers, binoculars could potentially limit the controller’s view. Using binoculars would also have been time-consuming.

During the morning, there had been two additional controllers in the Tower cabin than normal. They were able to assist with monitoring VH-FIZ (FIZ), and a number of the controllers present had experience with the use of surveillance data for monitoring aircraft and providing separation instructions. At the time of the occurrence, only three controllers were in the Tower cabin. One was newly endorsed in Surface Movement control, without having undertaken training in the control of airborne aircraft. The other two controllers present were not trained in separating aircraft with surveillance data.

Williamtown Base Standing Instructions (Base SIs) and 453 Squadron Williamtown Flight Standing Instructions (ATC SIs) contained restrictions and requirements, for both controllers and locally-based military aircrew, to provide strategic separation assurance between arriving locally-based military aircraft and those within the airspace normally controlled by the Tower controller. These specifically required the local aircraft to remain clear of airspace under the Tower controller’s jurisdiction until issued with traffic information. The last minute planning conducted on the morning of the occurrence by two ATC supervisors, though well intentioned, resulted in less than optimal conditions. These included procedures that negated the established strategic separation assurance documented in both Base and ATC SIs, increased traffic complexity, and the need for the Tower controller to rely on the surveillance display when the controller was not trained to use radar separation.

The run sheet provided to ATC for the calibration of the tactical air navigation system (TACAN) numbered each required run and included a note ‘The run numbers are to assist with Pilot/ATC communications, not to indicate the order in which the runs will be completed.’ Had the pilot of VHFIZ (FIZ) used the run number (Run 1A) in the request to conduct the 7 NM (13.0 km) orbit around Williamtown, the Tower controller may not have misinterpreted the pilot’s request with a request to hold south of Williamtown in an orbit – a standard holding manoeuvre that would essentially keep the aircraft in the same area. However, as the only calibration runs requiring 3,100 ft were the 7 NM (13.0 km) orbits of the Williamtown TACAN, the Tower controller’s reported belief that the pilot of FIZ had asked for that altitude to prepare for the next run to runway 30, for which the run sheet indicated a commencement altitude of 1,500 ft, demonstrated that the controller was either not referring to the run sheet or did not understand the run sheet.

If the Tower controller had used run numbers on the data labels for silent coordination, the Approach controller would have had the opportunity to maintain situation awareness of calibration activities. Further, the use of run numbers would have provided cues to the Tower controller. In turn, the Tower controller may then have been more likely to use the numbers in communication with the pilot of FIZ, removing the opportunity for the pilot to misunderstand the controller’s approval to conduct an orbit.

Although prompted a number of times by the Tower supervisor, the Tower controller did not issue specific holding instructions to the pilot of FIZ. Specific holding instructions could have included ‘hold over land to the south of the field’ or to hold over a specific location. Such an instruction would have resulted in the pilot of FIZ questioning their understanding of the approval to conduct an orbit.

Once the pilot of FIZ commenced the 7 NM (13.0 km) orbit around Williamtown, in line with the pilot’s interpretation of the Tower controller’s response to the request, a loss of separation assurance (LOSA) existed between the calibration aircraft and the formation of four Boeing F/A18 aircraft (F18s) tracking for runway 30. Believing that FIZ was holding to the south in an orbit, the Tower controller did not visually monitor FIZ’s position. Instead, the Tower controller relied on the Surface Movement controller to do so while the Tower controller attended to other aircraft.

An opportunity to identify the loss of separation assurance at an earlier point was lost when the Approach controller did not identify that FIZ had crossed the coast, leaving the airspace released to the Tower controller. The Tower controller had not coordinated FIZ’s entry into airspace under the jurisdiction of the Approach controller. However, the Approach controller should have observed the calibrator entering and remaining in airspace under their jurisdiction. FIZ crossed the coast into the Approach controller’s airspace prior to the F18s passing overhead Williamtown and before they were issued with a visual approach. If FIZ had been identified in the Approach controller’s airspace at this stage, the F18s could have been held away to allow FIZ to complete the 7 NM (13.0 km) orbit of Williamtown, or the Tower controller could have been instructed to turn FIZ to re-establish the calibration aircraft over land. When the Approach controller did observe FIZ and realise the potential conflict with the F18s, they immediately contacted the Tower controller and asked that a safety alert be issued.

Once the Tower controller became aware of FIZ’s position to the south-east over water, clear and urgent information was not immediately provided to the pilot to ensure separation and avoidance with the F18s. As the closure speed between the calibration aircraft and the F18s was very high, the opportunity to provide timely control instructions and traffic information was lost when the controller asked the pilot of FIZ to confirm that the aircraft was holding to the south even though the controller had observed the aircraft tracking in a northerly direction south-east of Williamtown. The absence of clear control instructions to either the calibration aircraft or the formation of F18s resulted in a loss of separation (LOS) between aircraft that had not been provided traffic information in relation to the impending conflict. The absence of traffic information in sufficient time and in sufficient detail increased the risk posed by the LOS.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the Department of Defence (Defence)
• Airservices Australia
• the operator and pilot of VHFIZ.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Defence, the pilot and operator of VHFIZ and the air traffic controllers directly involved.

Submissions were received from Defence. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

The occurrence

At 1549 Eastern Standard Time^[1] on 19 September 2013, a Hawker Beechcraft Corporation B300, registered VH-FIZ (FIZ), was conducting calibration operations at Williamtown (Newcastle Airport)^[2] in NSW (Figure 1). While conducting a 7 NM (13.0 km) orbit around Williamtown at 3,100 ft (the broken blue line in Figure 1), a loss of separation (LOS) occurred between FIZ and a formation^[3] of four Boeing F/A18 aircraft (F18s). The formation of F18s flew directly below the B300 with less than the required 1,000 ft separation.

The calibration activity involved checking the equipment associated with the instrument landing system (ILS),^[4] which was aligned to runway 12,^[5] and the tactical air navigation system (TACAN).^[6] To complete the calibration, numerous approaches and manoeuvres were required to test the accuracy of the navigational equipment, each referred to as a run. The various planned runs each had a number on a run sheet held by both the pilot of FIZ and air traffic control (ATC).

The Williamtown ATC Tower controller normally had jurisdiction over the airspace within 5 NM (9.3 km) of Williamtown over land (dark green area in Figure 1), from the surface to 1,500 ft above mean sea level (AMSL),^[7] referred to as the aerodrome traffic zone (ATZ). Earlier in the day, additional airspace had been released by the Williamtown Approach controller to the Tower controller – over land within a 12 NM (22.2 km) radius of Williamtown, from the surface to 3,500 ft AMSL (light green area in Figure 1).

On the day of the occurrence, the wind at Williamtown favoured the use of runway 30 (marked in orange in Figure 1), so the majority of FIZ’s approaches were to the opposite direction non-duty runway. To reduce traffic complexity, FIZ was permitted to conduct calibration runs while ATC held other aircraft on the ground or outside the airspace released to the Tower controller, while FIZ was held clear of traffic when a mix of military and civil aircraft were required to depart or arrive. The majority of military aircraft arrived via the initial point, marked by a pink cross in Figure 1 (see the section titled Military operations).

Figure 1: Williamtown Tower airspace: Dark green shading shows the usual airspace, light green shows additional airspace on 19 September 2013. An orange arrow indicates the duty runway location and direction. A blue dashed line indicates the intended flight path of VH-FIZ during the aerodrome orbit run. A pink cross indicates the initial point used by military aircraft.

To reduce the need for extensive voice-coordination between the Tower and Approach controllers, Williamtown ATC added information to an aircraft’s data label^[8] on the surveillance data display. The information added to a data label, referred to as silent coordination, was visible to both Approach and Tower controllers. For an arriving aircraft, the Approach controller would add arrival type (e.g. ‘T’ for a TACAN) or that an aircraft had reported visual (‘V’). Both the Tower controllers that day (morning and afternoon shifts) had been using the data label for FIZ to indicate the current run number, and, when known, the next run number. However, at 1530 the Tower controller did not include a run number in the data label of FIZ, rather the label indicated that the calibration aircraft was completing a TACAN approach to runway 12 (which was run 3A) and that the next approach would be a 7 NM (13.0 km) orbit of Williamtown (run 1A). Shortly after, the data label was amended to show that the next run would be the second TACAN approach to runway 12 (run 3B).

At 1537, the Tower controller advised the pilot of the calibrator aircraft that, after the next run (that is, run 3B), FIZ would be required to hold to facilitate a number of arriving aircraft. In response, the pilot of FIZ asked ‘on completion of this run would it be possible to join the 7 TAC^[9] counter-clockwise orbit 3,100 and would that keep us clear of traffic?’ This referred to run 1A on the TACAN run sheet, although the pilot did not include ‘run 1A’ in the request. The Tower controller responded with ‘standby’.

To enable the calibration of all of the TACAN equipment, the second of each run number (runs 1B, 2B and 3B) required ground-based technicians to switch to the redundant TACAN system. However, there was a delay in the requested switch for run 3B which was increasingly causing a delay to arriving aircraft, so the Tower supervisor told the Tower controller to cancel run 3B and hold FIZ to facilitate the arrivals.

At 1541, on being advised to hold south of the airfield not above 1,500 ft, the pilot of FIZ asked ‘… can we climb up and do the orbit then?’ The Tower controller responded with ‘… affirm climb not above 3,100 (ft).’ Anticipating that they may become busy with other tasks, the Tower controller reported requesting the Surface Movement controller to monitor FIZ.

At 1543, the pilot of the first of the arriving aircraft, a passenger Airbus A320, contacted the Tower controller and was cleared to track from the north of Williamtown to the right base leg of the circuit for runway 30. At the same time, surveillance data showed that FIZ commenced flying in a counter-clockwise direction (run 1A) around Williamtown from a position 7 NM (13.0 km) to the west of the airfield (position 1 on Figure 2).

Figure 2: Williamtown airspace showing the location and track of VH-FIZ and a formation of four Boeing F/A18 aircraft (numbers represent relative locations at the same time – see Table 1)

At 1546, the pilot of the lead aircraft in a formation of three BAE Systems Hawk aircraft (Hawks) contacted the Tower controller east of Williamtown for a visual approach stream landing^[10] via ‘straight initial’ (see the section titled Military operations) to runway 30. The Hawks were descending to 2,500 ft, 1,000 ft above the level of the A320, and advised the Tower controller that the aircraft would be deploying brake-chutes^[11] on landing.

At the same time, the pilot of the lead aircraft of a formation of four F18s contacted the Approach controller tracking from the west directly to Williamtown on descent to 8,000 ft. At the time, the transponder for the lead F18^[12] indicated that the aircraft was descending through flight level^[13] (FL) 137. The Approach controller entered silent coordination in the data label for the F18s which indicated that the aircraft would track to overhead the airfield and then to the northeast on a heading. No information on how or if the aircraft would return for landing was included.

At 1545, the Tower controller cleared the A320 to land and at 1546 cleared the Hawks for a visual approach. At the same time, the Tower controller was involved in coordinating personnel to enter the runway after the Hawks landed to retrieve the brake-chutes. The surveillance data showed that, nine seconds later, FIZ crossed the coast tracking in a north-easterly direction, leaving the airspace released to the Tower controller and entering airspace under the jurisdiction of the Approach controller (position 3 , Figure 2).

Shortly before the formation of F18s passed overhead Williamtown at 1547, the Approach controller cleared the F18s to descend to 5,000 ft and track for an arrival via ‘right initial’ to runway 30 involving a right descending turn towards the ‘initial point’ seen in Figure 2 (see the section titled Military operations). The Approach controller then removed the heading from the F18s data label. After the pilot of the lead F18 reported the Hawks in sight, the Approach controller cleared the F18s for a visual approach.

Ten seconds after clearing the F18s for a visual approach, the Approach controller updated the silent coordination on the data label to show that the F18s were making a visual approach via right initial (the F18s were then at position 6 in Figure 2). Nine seconds later, at 1548, the pilot of the lead F18 contacted the Tower controller while descending through 6,300 ft and on a converging track with the track of FIZ.

Twenty four seconds later, as FIZ was maintaining 3,100 ft at 7 NM (13.0 km) to the southeast of Williamtown and about 8 NM (14.8 km) from and 1,100 ft below the F18s, the Tower controller asked the pilot of FIZ to confirm that the aircraft was holding south of the airfield. The pilot responded in the negative and that FIZ was conducting a counterclockwise orbit of Williamtown.

Fourteen seconds later, when the aircraft were about 6 NM (11.1 km) apart, the Approach controller alerted the Tower controller to the need for a safety alert^[14] between the aircraft. The Tower controller responded that he had ‘got it’ and 4 seconds later issued a safety alert to the pilot of FIZ: ‘safety alert Toxin Tripod four F18s your 2 o’clock passing through 3,000’. At this time, the lead F18 was descending through 3,400 ft, 5 NM (9.3 km) directly in front of and converging with FIZ. At that time, FIZ was travelling at 230 knots (kt) towards the F18s travelling at 460 kt.

At 1549, as the pilot of FIZ reported the F18s in sight, separation between the formation of F18s and FIZ reduced below 3 NM (5.6 km) with the lead F18 descending through 2,700 ft. Nineteen seconds later, the F18s flew directly below FIZ with less than the required 1,000 ft separation and they advised the Tower controller that they were ‘visual with the traffic that just passed overhead’

Shortly afterwards, the Approach controller resumed the airspace outside 5 NM (9.3 km) Williamtown and above 1,500 ft, and FIZ was transferred to the Approach controller’s frequency for the remainder of the calibration flight. The F18s landed shortly afterwards.

Table 1: Location of VH-FIZ and the F18s at specified times as shown in Figure 2

 

__________

1. Eastern Standard Time (EST) was Coordinated Universal Time (UTC) + 10 hours.
2. Williamtown is known as Newcastle Airport for scheduled passenger flights.
3. A formation is two or more aircraft flown in close proximity to each other and operating as a single aircraft with regard to navigation, position reporting and control – Australian Aeronautical Information Publication (AIP) GENERAL (GEN) 2.2 – DEFINITIONS AND ABBREVIATIONS, paragraph 1 Definitions.
4. An instrument landing system (ILS) is a standard ground aid to landing, comprising two directional radio transmitters: the localizer, which provides direction in the horizontal plane; and the glideslope, for vertical plane direction, usually at an inclination of 3°. Distance measuring equipment or marker beacons along the approach provide distance information.
5. Runways are named by a number representing the magnetic heading of the runway.
6. A tactical air navigation system (TACAN) is an ultra-high frequency navaid which provides continuous indication of bearing and distance, in nautical miles, to the selected station. In the application of separation standards, DME includes TACAN for distance measurement and TACAN distances can be used for the same purpose as DME.
7. Defined in Williamtown Base Standing Instructions and the Williamtown aerodrome segment of the AIP En route Supplement Australia.
8. An aircraft’s data label displayed pertinent aircraft data for the controller’s use, such as callsign, current altitude, speed, aircraft type and coordination information.
9. TAC is an abbreviation of TACAN.
10. A formation landing may involve a stream landing where aircraft land on the same runway in quick succession.
11. Brake-chutes were designed to aid aircraft deceleration on landing. Once the aircraft’s speed has been sufficiently reduced, the chute is jettisoned onto the runway and must be retrieved prior to other aircraft using the runway.
12. As formation aircraft fly close together, to ensure that the surveillance system display did not show overlapping or garbled returns, only the transponder in the lead aircraft in each formation transmitted information.
13. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 370 equates to 37,000 ft.
14. A safety alert is the provision of advice to an aircraft when a controller becomes aware that an aircraft is in a position which is considered to place it in unsafe proximity to terrain, obstructions or another aircraft.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

Early in the afternoon on 7 November 2015, a Robinson R44 helicopter, registered VH-HOQ (HOQ), was conducting pilot training on the western end of Redcliffe aerodrome, Queensland. HOQ was conducting a training sortie and had an instructor and student on board. The training involved practicing engine failures in the hover and while taxiing. Their operations were confined within the aerodrome boundary (Figure 1) and clear of the runway and taxiway. They had completed the initial part of the sortie on the grass area to the south of the taxiway.

Figure 1: Redcliffe Aerodrome layout showing the approximate position of the aerodrome boundary (yellow)

Source: Google Maps. Modified by ATSB

At the same time, a de Havilland DH82A (Tiger Moth), registered VHBJE (BJE), was taxiing for departure on runway 07. BJE was departing for a scenic flight with the pilot and one passenger on board. Both aircraft were operating under the visual flight rules,^[1] and the weather conditions were fine and clear.

While BJE was taxiing for Runway 07, HOQ moved to the grassed area just north of the taxiway to practice engine failures while taxiing. These manoeuvres involved the helicopter flying at low level parallel to the taxiway and landing on the grass. Once they had reached the eastern end of the grass area the instructor would taxi back to the start point to allow more training to occur.

Due to the nature of the helicopter training being conducted, the focus of the instructor and student was reduced to their immediate operations. During the transit from the grassed area to the area next to the taxiway HOQ did not advise the change in operating area on the common traffic advisory frequency (CTAF)^[2] to other aircraft. While they were aware of the Tiger Moth, they did not consider it to be a concern. This was because the helicopter operations were going to remain clear of where the Tiger Moth was intending to operate.

The pilot of BJE broadcast their intentions to taxi and enter the runway to other aircraft in the area on the Redcliffe CTAF. There were no other radio transmissions by other aircraft while BJE was taxiing and entering the runway. While taxiing, the pilot of BJE noted the position of the helicopter and saw that it was well clear. The pilot of BJE therefore did not expect that the helicopter would change operating area to conflict with their departure.

The pilot of BJE lined up for departure on the grass beside the runway, because the aircraft was fitted with a tail skid, not a tail wheel. The grass area for BJE’s take off was within the runway strip to the side of the runway closest to the taxiway. BJE commenced the take-off run and, shortly after, the pilot noticed HOQ flying on a parallel track to BJE (Figure 2). The helicopter was to the right, slightly ahead and above BJE, and in close proximity.

Figure 2: BJE during the take-off run just prior to HOQ conducting the left turn

Source: Observer

Shortly after becoming airborne from the grass runway, at about 50 to 60 ft above ground level (AGL), the pilot of BJE saw the helicopter commence a left turn towards the runway. Thinking that there was going to be a collision, the pilot of BJE took avoiding action by conducting a hard left turn, with a high angle of bank, at low altitude. The approximate tracks of the aircraft are depicted in Figure 3.

Figure 3: Redcliffe aerodrome showing the runway strip (white). The take-off run and left turn of BJE is indicated in orange. The track of HOQ when conducting the engine failures during taxi and the reversal turn is indicated in blue.

Source: Google Maps. Modified by ATSB

The instructor in HOQ was executing a reversal turn in order to reposition the helicopter for further training (Figure 4). The manoeuvre involved a 180-degree left turn, to reverse the direction of flight, with an increase in height to about 50-60ft and a bank angle of about 50o. The turn and track back down the grassed area would keep the helicopter outside the runway strip and clear of BJE. However, as the instructor had not advised their intentions on the CTAF, the pilot of BJE was unaware that the helicopter was going to remain clear of the aircraft.

Figure 4: View from the Tiger Moth when the helicopter was approximately half way through the reversal turn

Source: Video from passenger

Pilot comments

Instructor, HOQ: Teaching, demonstrating, and conducting, practice engine failures at low level is a very high demand task. The instructor’s attention is, predominantly, directly ahead of the aircraft and in closely monitoring the student control inputs. This is to ensure that the student is executing the correct technique and safely executing the manoeuvre to avoid damage to the aircraft.

The operations in between the taxiway and the runway strip were going to be conducted so that they would always remain clear of other aircraft operating on the runway. The instructor did not advise the change in operating area as he assessed that there would be no conflict between the aircraft.

Pilot in Command, BJE: During the taxi to the runway the pilot noted the position of HOQ. At this time HOQ was operating to the south of the taxiway and not near the runway. The next time that the pilot of BJE saw HOQ was just after commencing the take-off roll. This surprised the pilot of BJE as he had not heard any transmissions advising that HOQ had changed their operating area. As a result, when HOQ commenced the reversal turn, he assessed that a collision was imminent. To avoid the possibility of a collision, the pilot of BJE turned the aircraft away to the left. The turn was made at low level, with a high angle of bank and at a relatively slow airspeed.

ATSB comment

Both pilots were monitoring the CTAF and the pilot of BJE had transmitted their intentions correctly. However, as the instructor of HOQ did not advise that they were going to conduct the reversal turn, the pilot of BJE did not know that the helicopter would remain outside the runway strip. The avoiding action taken by the pilot of BJE in this case may have been avoided if the helicopter pilot had communicated their intentions.

Safety message

Pilots are encouraged to ‘err on the side of caution’ when considering when to make broadcasts on CTAF, particularly when the aircraft operations are likely to be in close proximity to other aircraft.

 Insufficient communication between pilots operating in the same area is the most common cause of safety incidents near non-controlled aerodromes.

• A search for other traffic is eight times more effective when a radio is used in combination with a visual lookout than when no radio is used.

The CASA booklet titled

provides guidance with respect to the limitations of the see-and-avoid principle and relevant radio procedures. also provides relevant guidance with respect to CTAF procedures.

Aviation Short Investigations Bulletin - Issue 47

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Visual Flight Rules (VFR): Rules that allow a pilot to operate an aircraft in weather conditions that are generally clear enough to allow the pilot to see where the aircraft is going.
2. The CTAF is the frequency on which pilots operating at a non-controlled aerodrome should make positional radio broadcasts.

What happened

On 6 November 2015, at about 1829 Eastern Daylight Saving Time, the pilot of a Cessna Aircraft Company 310R registered VH‑BWZ, on a private flight from Moorabbin to Mildura, Victoria lost control of the aircraft near Mildura Airport and collided with terrain. The pilot was fatally injured and the aircraft destroyed.

What the ATSB found

Witnesses reported that when on final approach to land at Mildura, at low altitude, the aircraft yawed to the left, dropped its left wing and rapidly lost altitude. A number of factors contributed to the loss of control. The aircraft’s left engine was found to have been starved of fuel and at the time of the accident was not producing power. The left propeller was found to be towards fine pitch, not feathered (rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown), and the flaps and landing gear were fully extended, consistent with a normal landing configuration. In that configuration with the engine not producing power, the aircraft’s performance would have degraded to the extent that altitude could not be maintained.

The ATSB was unable to ascertain why the left engine was starved of fuel, nor could it be determined when the engine was starved of fuel. The ATSB did establish that it was likely the aircraft was carrying a substantial amount of fuel on board for continued flight and that the left engine and left propeller were capable of normal operation.

Several components recovered from the aircraft were tested. Some abnormalities were identified, however, it was unlikely that these contributed to the accident. No mechanical defects were identified that may have contributed to the accident. However, examination of the aircraft was limited due to the extent of the damage resulting from the post-impact fire.

It was likely that the combination of the inoperative left engine with the propeller in the fine pitch and the right engine at high power resulted in asymmetric thrust. Whilst at low altitude in a landing configuration with asymmetric thrust, the pilot lost control of the aircraft.

Safety message

In situations such as an inoperative engine condition, the aircraft’s landing gear, flaps and or propeller management can potentially impose increased drag impacting significantly on the aircraft’s performance. Low airspeed in critical phases of flight such as take-off and landing can further exacerbate the situation. Pilots need to train, maintain their skills and constantly monitor aircraft systems to be prepared for abnormal flight situations, especially during critical phases of flight where greater attentional focus is required.

While ATSB research has found that the rate of power loss accidents in multi-engine aircraft occur less than that in single-engine aircraft, they are more likely to be fatal and overwhelmingly due to the potential for loss of control. In particular, the approach phase of flight is considered riskier due to lower altitudes and lower available aircraft energy.

This accident has emphasised the adverse consequences of aircraft configuration on performance with one-engine inoperative, particularly when at low altitudes. It reinforced the importance of pilots remaining well versed in engine failure response procedures and being aware of the drag penalties associated with varying configurations. It also highlighted the challenges associated with recognising an asymmetric condition when in a descent or at a low power setting. When faced with an inoperative engine in a multi-engine aircraft, attention to both aircraft control and performance is crucial for safe flight.

The occurrence

On 3 November 2015, the pilot of a Cessna Aircraft Company 310R, registered VH-BWZ, departed Mildura, Victoria on a private flight to Latrobe Valley. The pilot had intended to return to Mildura the next day, however, due to poor weather, he elected to fly to Moorabbin. On 5 November, the pilot was again unable to return to Mildura due to poor weather and took the opportunity to have some minor maintenance performed on the aircraft while at Moorabbin where a wire was repaired to the tachometer.

On 6 November, at about 1650 Eastern Daylight-saving Time,^[1] the pilot departed Moorabbin for Mildura, operating under instrument flight rules.^[2] Despite the pilot having some difficulties shortly after departing, including a transient transponder code issue, navigating in poor weather and reporting a ‘downward force on the aircraft’, the pilot appeared to resolve these issues and stated to air traffic control (ATC) an intention ‘to continue to Mildura’. ATC subsequently issued vectors to depart Melbourne airspace for Mildura.

The flight between Melbourne and Mildura appeared to continue uneventfully. Airservices Australia surveillance radar data showed the aircraft tracking direct from Melbourne to Mildura at an altitude of 6,000 ft until radar services were no longer available.

While en route, the pilot sent several text messages, and telephoned the Mildura automatic weather information service and a family member. During this latter communication, the pilot indicated that he experienced difficulties while departing Moorabbin, however, the pilot did not state any specific mechanical defects or problems with the aircraft. The pilot was reported to have sounded normal during that conversation.

At about 1814, the pilot made a broadcast on the Melbourne Centre ATC frequency that the aircraft was 38 NM (70 km) from Mildura, at top of descent. No further broadcasts were made by the pilot on this frequency. It was unknown if the pilot made a call on the Mildura common traffic advisory frequency as broadcasts were not recorded.

Several witnesses situated to the south and east of Mildura Airport observed the aircraft approaching from the north, consistent with being on final approach to runway 18. One witness described the aircraft to be flying ‘in a nose-up attitude or yawing’.^[3] At about 1829, when about 1.9 km north-north-east from the runway at low altitude, several witnesses described the aircraft as yawing left, the left wing dropping, the aircraft then rotating in an anti-clockwise direction and rapidly lose altitude before colliding with terrain.

The aircraft collided with steel trestles mounted on wooden poles that were strung with heavy gauge single strand wires, used to support grape vines. The aircraft came to rest on four strands of 11,000 volt high tension (HT) power lines that were strung across the property from the road. A post impact fuel-fire ensued. The pilot, the sole occupant, was fatally injured and the aircraft destroyed.

Pilot information

The pilot held a Private Pilot (Aeroplane) Licence issued on 25 June 2006. The pilot was endorsed on the Cessna 310 in September 2012 and last completed a multi-engine flight review in December 2013, valid until December 2015. The pilot was also the owner of VH-BWZ.

Extracts from the pilot’s logbook found at the accident site showed a total flying experience of about 511 hours. The pilot’s experience on the Cessna 310 was estimated at about 113 hours, based on a combination of entries on the aircraft’s maintenance release and the pilot’s logbook. It appeared that the pilot had not flown in the period February to October 2015. However, on 14 October 2015, the pilot completed an instrument landing system endorsement for the private instrument rating with a Civil Aviation Safety Authority (CASA) approved testing officer. During the endorsement, the pilot was subjected to several simulated one-engine inoperative exercises in the approach phase-of-flight. The testing officer reported that the pilot’s response to these exercises were considered ‘normal’.

The pilot held a valid Class 2 Medical Certificate with the requirement for reading correction to be available while exercising the privileges of the licence. While a post-mortem medical examination found that the pilot had a mild heart enlargement, there was no evidence of any pre-existing conditions identified that may have contributed to the accident.

The investigation included an assessment of whether the pilot may have been experiencing a level of fatigue known to have an effect on performance. Consideration was made of the pilot’s sleep obtained, time awake at the time of the occurrence, time on task, potential workload and environmental factors. However, given the limited data available in relation to the pilot’s sleep history in the 72 hours prior to the accident and the nature of the individual actions leading up to the accident, there was insufficient evidence to determine whether fatigue contributed to the accident.

Aircraft information

The aircraft was maintained by a provider approved by CASA. About 4 months prior to the accident, a periodic inspection was conducted and the aircraft was released to service. The maintenance provider reported that during the pre-maintenance engine run check the autopilot was operated while holding the elevator trim wheel. This test established that, while the autopilot was operating the trim could be arrested manually, establishing that the elevator trim could be overridden if unintentionally activated.

The aircraft’s fuel system consisted of two main tanks located on the tip of each wing and two auxiliary tanks located within each wing. The combined usable capacity was about 100 US Gallons (378 L) for the two main tanks, and 63 US Gallons (238 L) for the auxiliary tanks. The main tanks were integrally sealed aluminium tanks, which were vented to the atmosphere. Each auxiliary fuel tank consisted of two interconnected bladder-type fuel cells that were located between the wing spars in the outboard section of each wing.

Two fuel selectors, one for each engine, were located on the floor in between the pilot and co-pilot seats. These allowed selection of main tank fuel, auxiliary fuel, cross-feed and no fuel through the wing selector valves located in each respective wing.

Meteorological information

The Mildura aerodrome forecast, issued at 1613 and valid between 1700 on 6 November to 0500 on 7 November 2015 indicated that conditions were forecast as CAVOK^[4] with a wind direction of 210° at 10 kt. The Bureau of Meteorology provided the ATSB with data recorded by the automatic weather station at Mildura which indicated at the time of the accident (1829), the wind was 220° at 11 kt gusting to 12 kt.

Wreckage and impact information

The aircraft was found in a left-wing, nose-down attitude and had come to rest on four strands of 11,000 volt HT power lines that were strung across the nearby property from the road. Ground scars of ruts, and soil and vegetation built up on one side of the landing gear and wings, indicated that the aircraft was rotating in an anti-clockwise direction during the impact sequence. The aircraft was destroyed by the impact forces and a post impact fuel-fed fire. The ATSB examined the wreckage and found:

• The landing gear was down and flaps fully extended.
• Continuity of all flight controls was established.
• The elevator, rudder and aileron trims were found in the neutral position.
• There was nil evidence of a pre-impact structural failure or in-flight fire.
• All fuel caps were identified in the wreckage in a closed locked position. The left wing main fuel tank was found attached to the left wing tip, while the right main tank had separated from the wing and had been thrown forward about 10 m. Both were significantly melted, consistent with the fuel-fed fire. The outer section of the right auxiliary fuel tank had fractured and separated due to the impact forces, and was found forward of the main wreckage, also significantly melted (Figure1). The inner section of the right wing auxiliary fuel tank did not burn and contained an adequate quantity of fuel to obtain a sample. That sample was field tested and found to be consistent with aviation fuel of a suitable quality. In contrast, the left auxiliary fuel tank displayed only some degree of melting. In consideration of the left wing-down attitude at the time of impact, it was unlikely that the left auxiliary fuel tank contained a significant quantity of fuel.

Figure 1 : Aircraft wreckage with evidence of fire and right wing auxiliary fuel tank in the foreground

Source: ATSB

• The right engine propeller blades were towards the fine pitch^[5] and displayed significant bending, torsional twisting and chord wise (across the width of the blade) scratching. The bolt holes of the engine crankshaft propeller flange, where the propeller mounted to the crankshaft with bolts and locating dowels, were elongated opposite to the direction to the crankshaft rotation. This was consistent with the right engine producing significant power when colliding with terrain.
• The left engine propeller displayed no evidence of torsional bending or chord wise scoring, nor was the engine crankshaft propeller mount flange distorted. The angle of the propeller blades were consistent with being towards the fine pitch. In addition, one HT power line was found routed through the left propeller arc and engine cowling, then under the wing and through the landing gear. There was no evidence of the HT power line or the single strand wires used to support the grape vines being wrapped around the engine crankshaft. Similarly, there was evidence of arcing and mechanical abrasion on one of the propeller blades from contact with a HT power line while in-flight. This was limited to the leading edge of the propeller blade only. Collectively, these elements indicated that at the time of the collision the left engine was not producing power nor was the propeller producing thrust.
• The cockpit and cabin were severely fire damaged, consistent with a significant fuel-fed fire supplied from the right inboard section of the auxiliary fuel tank.
• The fuel selectors located in the cockpit were melted. Examination of the wing fuel selector valves, operated through push pull rods from the cockpit, showed that the right valve was selected to the right main fuel tank. In that position, the right engine received fuel from the right main fuel tank. The left wing fuel selector valve was in between the left auxiliary and cross-feed positions. The ATSB could not establish if that valve position was:
  • representative of the tank selection during normal operations,
  • selected in response to a left engine issue, or
  • a result of the impact sequence.
• For each engine, the fuel line between the engine and fuel control unit and the engine and the wing were disconnected by the ATSB. The right engine fuel lines contained fuel. In contrast, no fuel was observed in the fuel lines of the left engine. No mechanical defects were identified that may have prevented normal operation of the left engine.

The source of ignition that led to the fire could not be established, however, the aircraft battery, damaged aircraft electrical wiring, hot engine and turbo charger, HT power lines and collision with steel were all possible sources of ignition. No mechanical defects were identified that may have contributed to the accident.

The left engine and propeller were recovered from the wreckage and transported to a CASA approved overhaul facility for detailed inspection under the supervision of the ATSB. The autopilot pitch and roll servos, and elevator trim actuator were also removed and sent to the United States for inspection under the supervision of the Federal Aviation Administration (FAA) and aircraft manufacturer. These components were tested in accordance with the manufacturer’s system of maintenance (refer to section titled Test and research).

Test and research

Left engine fuel system

The left engine fuel control fuel filter and fuel manifold top cap were removed and examined. No foreign object debris or fuel was identified in either component.

Left engine and propeller examination

Left engine internal components used to achieve normal engine operation, including the crankshaft, connecting rods, pistons, pushrods, cylinders, valves, camshaft, bearings and gears were inspected and found to have continuity. External accessories such as the fuel pump, magnetos, propeller governor and fuel injector were inspected and tested for correct operation. Other components such as the turbo charger and associated components were visually inspected.

The left propeller was also disassembled and inspected. Witness marks of the propeller blade situated in the cuff and bearing race damage found within the propeller established that, at the time of the collision, the propeller was towards the fine pitch position. Nothing was identified from those inspections or tests that may have prevented normal engine or propeller operation.

Autopilot pitch and roll servo, and elevator electric trim actuator

The servo drive motor for the autopilot pitch mode operated when power was applied. When an over voltage is detected in the system, the unit should trip the autopilot off-line and stop the motor; this function was inoperative. The motor clutch assembly was tested and slipped at 17 in lb in the clockwise direction and 21 in lb in the anti‑clockwise direction. The specification for this unit is 14 ±1 in lb in either direction. The actuator mount clutch on the capstan did not breakaway until 70 in lb in both directions. The specification for this clutch to slip is 20 ±2 in lbs.

The servo drive motor for the autopilot roll mode and the electric elevator trim actuator were also tested. Some minor breakout torque discrepancies were identified, however, were not considered significant.

Operational information

Fuel quantity

The pilot’s personal fuel records showed that 219.69 L was uplifted at Latrobe Valley on 4 November. The ATSB could not determine if that fuel was placed in the main and/or auxiliary fuel tanks. However, a witness at Latrobe Valley reported observing the main fuel tanks full. There were no fuel records identified to indicate any fuel uplift at Moorabbin.

The combined flight time from Latrobe Valley to Moorabbin and Moorabbin to Mildura was about 110 minutes, excluding taxi time. A pilot that had previously flown the aircraft reported that it had an average fuel burn rate of 60 litres per hour per engine (120 litres per hour total).

The Cessna Aircraft Company’s Pilot Safety and Warning Supplements, dated 1 June 1998, stated that:

Many twin engine Cessna airplanes incorporate auxiliary fuel tanks to increase range and endurance. These tanks are usually bladder type fuel cells located symmetrically in the outboard wing areas and contain no internal fuel pumps. When selected, the fuel from these tanks is routed to the engine driven fuel pump.

If the auxiliary fuel tanks are to be used, the pilot must first select main tank (tip tank) fuel for at least 90 minutes of flight with use of 63-gallon auxiliary fuel tanks. This is necessary to provide space in the main fuel tanks for vapour and fuel returned from the engine driven fuel pumps when operating on the auxiliary fuel tanks. If sufficient space is not available in the main tanks for this returned fuel, the tanks can overflow through the overboard fuel vents. Since part of the fuel from the auxiliary fuel tanks is diverted back to the main tanks instead of being consumed by the engines, the auxiliary tanks will empty sooner than may be anticipated. However, the main tank volume or quantity will be increased by the returned fuel.

As the ATSB was unable to establish the amount of total fuel on-board the aircraft when it departed Latrobe Valley or Moorabbin, or the pilot’s fuel management practices, the fuel remaining in each tank at the time of the accident could not be determined.

Asymmetric operations

The aircraft was fitted with two Teledyne Continental IO-520-MB piston engines and two three‑bladed McCauley propellers. Both engines rotated clockwise as viewed from the pilot’s seat.

When discussing the differences between single-engine and multi-engine aircraft, the FAA Airplane Flying Handbook (2016) stated that:

The basic difference between operating a multiengine airplane and a single-engine airplane is the potential problem involving an engine failure. The penalties for loss of an engine are twofold: performance and control. The most obvious problem is the loss of 50 percent of power, which reduces climb performance 80 to 90 percent, sometimes even more. The other is the control problem caused by the remaining thrust, which is now asymmetrical. Attention to both these factors is crucial for safe OEI [one-engine inoperative] flight.

The majority of light multi-engine aircraft such as the Cessna 310 have two wing-mounted engines that produce symmetrical propeller thrust during normal operation. One-engine inoperative operations on these aircraft result in asymmetric thrust and drag due to the offset position of the engines from the aircraft’s centreline. This results in a tendency for the nose of the aircraft to yaw in the direction of the inoperative engine. The extent of the yaw may vary depending on which engine becomes inoperative. The engine whose failure would most adversely affect an aircraft’s performance and handling qualities is termed the ‘critical’ engine. As the Cessna 310 engines turn in a clockwise direction, the left engine is the critical engine.

The asymmetric yawing tendency may be countered through the application of rudder and aileron control inputs. However, the minimum control speed of 80 kt^[6] for the Cessna 310 must be achieved to ensure that the rudder and aileron retain sufficient control authority to maintain directional control of the aircraft. The Cessna 310 Pilot’s operating handbook stated that, the aircraft is controllable at this speed, but performance is so far below optimum that continued flight near the ground is improbable. Consequently, the handbook indicated that a more suitable recommended safe single-engine speed was 92 kt. At this speed, altitude could be maintained more easily with the landing gear retracted and the propeller feathered^[7]. This speed is similar to the all engines landing approach speed of 93 kt with full flaps selected.

In addition, the CASA Civil Aviation Advisory Publication 5.23-1(2) stated that the majority of engine failures were not instantaneous. For example, if an engine failed as a result of fuel starvation or low fuel pressure, the engine will usually cough and splutter before stopping. However, the FAA recognised that:

An engine failure in a descent or other low power setting can be deceiving. The dramatic yaw and performance loss will be absent. At very low power settings, the pilot may not even be aware of a failure.

Pilot actions

The Cessna 310 Pilot’s operating handbook states that, following an engine failure, the pilot’s first consideration is to maintain control of the aircraft and ensure the airspeed remains above the minimum control speed. It then states that the pilot needs to identify the inoperative engine, adjust the operative engine as required, and perform a number of checks relating to fuel flow, tank selection and quantity; engine oil pressure and temperatures; magneto switches and mixture. If the engine does not re-start, the pilot must ‘secure’ or shutdown the engine, which includes feathering the propeller. The FAA flying handbook highlighted that completely securing a failed engine may not be necessary or even desirable depending upon the failure mode, altitude, and time available.

Aircraft performance degradation

The aircraft manufacturer advised that the Cessna 310 had a single-engine climb rate of about 375 feet per minute (at sea level and at maximum landing weight). However, with drag penalties of an unfeathered windmilling^[8] propeller, landing gear extended and full flap, the aircraft’s single-engine climb performance would degrade. Under these conditions, one-engine inoperative performance would result in a descent at 875 feet per minute.

Various other sources have also highlighted these adverse consequences on aircraft single-engine performance. For example, Multi-Engine Pilot Manual by Jeppesen Sanderson (1992) stated:

It is important that the pilot be familiar with the correct order for drag reduction following an engine failure. Normally, a windmilling propeller contributes the greatest amount of drag, followed by full flaps, extended landing gear, and the control deflections required to stop the airplane from turning. Since it is considered unwise to immediately feather an engine before it has been positively identified, drag is normally reduced by first retracting flaps and gear. Next, the failed engine is identified and the propeller is feathered. However, the specific order of drag reduction may vary between types of twin‑engine airplanes, so the manufacturer’s recommendations should be followed.

Generally, the landing gear is not extended during the approach until the airplane is established at approach airspeed and the pilot is positively assured of reaching the desired runway. This timing is important since the extension of the landing gear adds sufficient drag to create a 300 to 500 f.p.m. [feet per minute] rate of descent without power reduction.

The wing flaps should be used as little as possible, preferably not at all until the landing gear is extended and the landing is assured.

The FAA Airplane Flying Handbook (2016) stated:

A single-engine go-around must be avoided. As a practical matter in single-engine approaches, once the airplane is on final approach with landing gear and flaps extended, it is committed to land on the intended runway, on another runway, a taxiway, or grassy infield. The light-twin does not have the performance to climb on one engine with landing gear and flaps extended. Considerable altitude is lost while maintaining VYSE^[9] and retracting landing gear and flaps. Losses of 500 feet or more are not unusual. If the landing gear has been lowered with an alternate means of extension, retraction may not be possible, virtually negating any climb capability.

The CASA Civil Aviation Advisory Publication 5.23-1(2) stated:

A windmilling propeller causes the largest component of drag on an aircraft that suffers an engine failure. If the propeller is not feathered following an actual failure…the aircraft’s climb performance cannot be guaranteed. In many cases, it is likely that the aeroplane will only be able to maintain a descent.

Multi-engine power loss accidents

An ATSB research report, Power loss related accidents involving twin-engine aircraft (Research and analysis report B2005/0085), found that power loss accident rates in twin-engine aircraft were almost half of the rate for single-engine aircraft.^[10] However, a power loss accident in a twin‑engine aircraft was more likely to be fatal and overwhelmingly the result of in-flight loss of control. Of the 58 accidents identified between 1993 and 2002 that resulted in damage following the power loss, seven accidents occurred during the approach phase of flight. Three of these involved a loss of control, including one fatal accident. Given the approach phase was a relatively small portion of the overall flight, this was considered a more risky time, with low altitude and only a little more energy available than during the take-off phase.

__________

1. Eastern Daylight-saving time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
3. Yawing: the motion of an aircraft about its vertical or normal axis.
4. Ceiling and visibility OK, meaning that the visibility, cloud and present weather are better than prescribed conditions. For an aerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft or cumulonimbus cloud and no other significant weather within 9 km of the aerodrome.
5. Fine pitch (or low pitch blade angle) yields good low speed acceleration used during take-off and landing. In contrast, course pitch (or high pitch blade angle) is used in cruise and optimises high speed performance and economy.
6. With an angle of bank of less than 5°, one-engine inoperative, and the remaining engine at take-off power.
7. Rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown
8. Windmilling: a rotating propeller being driven by the airflow rather than by engine power, and results in increased drag at normal propeller blade angles.
9. VYSE: Best rate-of-climb speed with one-engine inoperative.
10. Only aircraft below 5,700 kg maximum take-off weight were included in the analysis.

Findings

From the evidence available, the following findings are made regarding the collision with terrain involving a Cessna Aircraft Company 310R, registered VH-BWZ, which occurred 1.9 km north-north-east of Mildura Airport, Victoria, on 6 November 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

For undetermined reasons the left engine was starved of fuel, which resulted in a loss of power during flight.

The left engine’s loss of power while the aircraft was in a landing configuration resulted in the pilot being unable to maintain aircraft control and the aircraft subsequently collided with terrain.

Safety analysis

Introduction

When on final approach to runway 18 at Mildura, witnesses reported seeing the accident aircraft at low altitude yaw to the left, followed by the left wing drop where the aircraft rapidly lost altitude. The aircraft subsequently impacted powerlines before colliding with terrain. The pilot was fatally injured, and the aircraft destroyed. The ATSB examined air traffic control recorded data, the aircraft wreckage, the pilot’s training and medical records, postmortem and toxicology reports, aircraft maintenance history and witness interviews. Aircraft components, including the left engine, left propeller and aircraft auto-pilot servo units were recovered from the wreckage for further examination.

The pilot was appropriately qualified to conduct the flight and was declared medically fit. Despite having relatively low flying hours on the aircraft type and twin-engine aircraft operations, the pilot demonstrated proficiency about one month prior to the accident where he completed an instrument landing system endorsement for the private instrument rating in the accident aircraft. During that endorsement he was subject to several simulated one-engine inoperative exercises during the approach phase for the ILS endorsement.

Four months prior to the accident, the maintenance provider performed a simple operational test of the autopilot and held the elevator trim wheel, proving that the elevator electric trim could be overridden manually. The ATSB did identify some anomalies with the auto-pilot elevator clutch assembly but could not determine if those abnormalities were pre-existing or were a result of the collision with terrain The ATSB did not consider the identified abnormalities factors contributing to the accident.

Examination of the left engine and propeller determined the engine was not producing power nor was the propeller producing thrust. This was most likely due to fuel starvation to that engine. No mechanical defects were identified that may have contributed to the occurrence. However, the examination of the wreckage was limited due to the extent of the fire damage sustained to the aircraft.

The following analysis will examine fuel starvation of the left engine and the subsequent power loss. The adverse consequence of this on aircraft performance, combined with the aircraft’s configuration, will also be discussed.

Left engine and fuel

Disassembly, inspection and examination of the left engine, left engine accessories and the left propeller at the accident site and during the post onsite detailed examination did not identify any mechanical defects or abnormalities that may have prevented normal engine or propeller operation.

However, examination of the engine fuel system identified no fuel in the left engine fuel manifold and supply fuel lines, which is situated between the wing fuel selector and the engine. The right fuel manifold and supply fuel line did contain fuel.

The aircraft departed Latrobe Valley with both main fuel tanks full, a total of at least 378 L of usable fuel on board. The flight time from Latrobe Valley to Mildura via Moorabbin was about 110 minutes. Based on that data and in consideration of an average fuel burn of 2 litres per minute, there should have been at least 158 litres of fuel remaining on board when the aircraft reached Mildura, not taking into account any fuel in the auxiliary fuel tanks. On that basis, it is likely that the aircraft had a significant amount of fuel on board at the time of the accident and the left engine had been starved of fuel.

The severe disruption of the left and right main fuel tanks and the right auxiliary fuel tank, including burning and melting indicated that those tanks held a significant amount of fuel at the time of the collision. In contrast, the left auxiliary fuel tank did not display the same level of disruption, including burning and melting of the aluminium structure or bladder fuel cell indicating that it is likely the left-wing auxiliary fuel tank did not have a significant quantity of fuel at the time of the accident.

The position of the wing fuel selector valves during flight was inconclusive as it could not be determined if the pilot had selected the fuel selector to the position found during the wreckage examination, or whether it was a result of the accident sequence.

The reason for the starvation of fuel to the left engine and the disparity of fuel quantity between the left and right auxiliary fuel tanks could not be quantified or determined due to the damage to the aircraft from impact forces and post impact fire.

Asymmetric condition

Witnesses observed the aircraft yawing to the left prior to loss of aircraft control and evidence located at the accident site showing the aircraft rotating in an anticlockwise direction during ground impact sequence was consistent with asymmetric thrust. It was likely the inoperative engine (which was the critical engine), with its propeller towards the fine pitch and the opposite engine at high power, resulted in an asymmetric thrust condition. To maintain control of the aircraft and counteract asymmetric thrust the pilot needed to apply rudder and if necessary the aileron to counteract the forces generated from the drag of the non-performing engine and high thrust from the performing engine. Rudder and aileron input also increases drag and contributes to the decay of airspeed.

Aircraft performance degraded

The ATSB could not determine when the engine failed, nor could it be determined if or when the pilot was aware of the failure. At the time of impact, the aircraft landing gear and flaps were fully down, the flight control trim devices were in the neutral position and both propellers were towards the fine pitch, consistent with a normal landing configuration. In this configuration, combined with the left engine not producing power the drag penalties were such that altitude could not be maintained.

It is possible that the pilot may have been in the initial stages of responding to the engine failure and was not in a position to secure the engine, which included feathering the propeller. Further, it is not known if the landing gear and flap positions were selected prior to the asymmetric condition in preparation for a normal landing or after, as the pilot may have believed an engine inoperative landing onto the runway could be assured. Irrespective, in this configuration the aircraft’s performance would have degraded to the point at which altitude could not be maintained to assure a landing.

This accident highlights the adverse consequences of aircraft configuration on one-engine inoperative performance, particularly when at low altitudes. It further demonstrates the challenges of asymmetric operations and the importance of pilots being aware of the drag penalties and associated consequences.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Airservices Australia
• a number of witnesses
• Textron Aviation
• the Civil Aviation Safety Authority
• United States Federal Aviation Administration
• Victoria Police.

References

• Jeppesen Sanderson Inc 1992, Multi-Engine Pilot Manual, Jeppesen Sanderson, Colorado.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, Airservices Australia, Textron Aviation, the aircraft maintenance provider, National Transportation Safety Board and the operator of the aircraft.

Submissions were received from the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

At about 1050^[1] on 31 October 2015, Genesee & Wyoming Australia train 6DA2 derailed near Marla, South Australia. The derailment resulted from a package bearing failure on wagon FQWY 12-F. The wagon and three other container wagons were significantly damaged and there was significant damage to the track. There were no injuries.

What the ATSB found

The ATSB found that the journal and bearing on wagon FQWY 12-F had seized and lost interference fit. The loss of interference fit generated high levels of frictional heating between the bearing and the axle journal, and the subsequent torsional shearing failure of the axle (commonly referred as a ‘screwed journal’). The axle failure caused the axle and wheels to stop rotating, resulting in one wheel skidding along the railhead for approximately 50 km, before derailing.

On the balance of the available evidence, the ATSB concluded that a loss of lubrication was the most likely contributor to the bearing breakdown and seizure. Evidence also suggested the breakdown developed relatively rapidly, given the absence of a positive fault detection from two bearing acoustic monitoring systems (RailBAM) passed on the previous day of the occurrence.

Safety message

Bearing failures leading to derailment continue to occur within the Australian rail network. Rail operators must continue to be vigilant and ensure axle bearings are correctly installed, maintained, and monitored throughout their life.

Screwed journal

Source: Genesee & Wyoming

__________

1. The 24-hour clock is used in this report and is referenced from Central Daylight Time (CDT)

Safety analysis

Bearing remanufacturing process

Package bearings used within Australia require minimal in service maintenance, generally limited to visual inspections. When a package bearing is identified as requiring service, either through visual detection of a fault or through predictive monitoring systems such as RailBAM, the axle with the two package bearings is sent for bearing replacement.

The bearing packages are removed from the axle, stripped and cleaned before being sent for inspection. All components of the stripped package bearing are kept together (cup, cone, bearings, and spacers) excluding the seal, which is disposed of. The inspection and remanufacturing area then receives the components.

At the commencement of each shift the remanufacturing staff verify the operation of all equipment, including the grease applicator. The grease injection system has seven settings for delivering a pre-determined amount of grease for the various areas of a packaged bearing, such as the rollers/cage. The operator checks a test application using calibrated scales to ensure the correct amount of grease is delivered for each setting. The results are recorded on a daily test sheet.

An initial examination of the bearing components is carried out prior to a detailed review. If any damage or corrosion is detected the bearing is scrapped. The more detailed inspection examines the bearing for any marks or damage to the rolling surfaces. The internal and external diameters are checked and the bearing endplay (movement) tested before the bearing is reassembled and packed with grease.

The grease injection system delivers a pre-determined amount of grease to the various areas of the bearing. The operator selects the appropriate grease delivering option for each component and manufacturer of the bearing (Rollers, Spacer ring). The selections are clearly marked and numbered one through seven, each number showing the amount of grease delivered in ounces and grams.

After each phase, the bearing package is visually inspected to confirm the correct amount of grease has been applied. Once the bearing has been fully greased the final seal is pressed onto the package and the bearing history sheet updated.

Whilst the most likely contributor for the bearing failure was a lack of lubrication and the observation suggesting approximately 50% lack of grease in the partner bearing, the ATSB could not substantiate any failure in EDI Downers remanufacturing. In general, the axle bearings on FQWY 12-F were maintained in accordance with GWA and rail industry standards.

Findings

From the evidence available, the following findings are made with respect to the derailment of train 6DA2 near Marla on bearing failure on 31 October 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• Freight train 6DA2 derailed due to a failed axle on wagon FQWY 12F.
• The axle failed when the bearing seized, generating enough heat for the bearing journal to go ‘plastic’ and separate from the axle, a condition referred to as a ‘screwed journal’.

Other findings

• A loss of lubrication most likely contributed to the relatively quick deterioration and seizure of the bearing, resulting in a catastrophic failure of the bearing with minimal (if any) warning signs.
• The axle bearings on FQWY 12-F were maintained in accordance with GWA and rail industry standards.
• It was considered unlikely that the bearing on wagon FQWY 12F failed due to simple fatigue alone.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• The Australian Rail Track Corporation (ARTC)
• Railway Industry Safety and Standards Board (RISSB)
• Genesee & Wyoming Australia (GWA)

References

• ATSB Transport Safety Report, Rail Occurrence Investigation RO-2008-010
• ATSB Transport Safety Report, Rail Occurrence Investigation RO-2010-011
• SKF, Product Information 401, Bearing failures and their causes 1994
• Bureau Veritas, Metallurgical report, 11 December 2015
• Genesee & Wyoming Australia Wagon Maintenance Instruction WMI 01-01

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Genesee Wyoming Australia, the drivers of train 6DA2, EDI Downer, and the Office of the National Rail Safety Regulator.

Submissions were received from Genesee Wyoming Australia, a driver of train 6DA2, EDI Downer, and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Genesee Wyoming Australia

GWA have investigated and implemented the following short-term actions:

• Investigate imposing a life limit on bearings, either by years or by overhauled cycles (i.e. bearings greater than 8 years old and/or greater than 8 rebuilds to be scraped when the wheelsets is next machined).
• Investigate the use of polymer cage in all new bearings.
• Investigate recent development relating to bearing seals.
• Develop a process for examining bearings and for providing important feedback from the bearing maintainer on the analysis of bearings that have been identified as faulty by wagon condition monitoring systems.
• Review the preferred bearing supplier/maintainers unit overhaul quality processes and subject bearing to random inspections at various stages of their lifecycles.
• Consider utilising alternative bearing suppliers.
• Conduct a gap analysis between Pacific Nationals wheel bearing standards used by Downer EDI and the RISSB Wheel Bearing Standards, December 2015.
• Consult with other rolling stock operators on the methods they use in an effort to increase best practice.
• Conduct an audit of the EDI Downer workshops in Port Augusta.
• Complete a quality examination of bearings recently overhauled by Downer EDI.

GWA have investigated and implemented the following long-term actions:

• Consider the installation of Hotbox detectors on the Northgate BP-Berrimah corridor.
• Investigate the use of ‘on wagon’ bearing condition monitoring.

Context

Train information

Train 6DA2 was an intermodal freight service operated by Genesee & Wyoming Australia (GWA) between Darwin and Adelaide. On departure from Darwin, NT, the train consisted of three locomotives (GWU 6 leading, ALF 18 trailing and ALF 21 off line) hauling 29 wagons for a total length of 1,179 m and trailing mass of 2,016 t.

The 26th wagon behind the locomotives was FQWY 12-F, a 2-pack platform wagon (Figure 4) used to transport containers. The FQWY class wagons are rated at 43 t (tare), 184 t (gross) and operate at a maximum speed of 115 km/h.^[4] The wagons ride on 70 t AAR three piece bogies. The wagons are owned and maintained by GWA.

Figure 4: Schematic of FQWY 12-F

The R2 axle bearing on platform two bogie D failed. The wheelset was the leading axle on bogie D in the direction of travel. Source: Genesee Wyoming Australia Pty Ltd and annotated by ATSB

The failed axle was the lead axle on the rear bogie (Bogie D). At the time of the derailment the train was traveling at approximately 82 km/h. A 6.45 t container was loaded on platform A and an 11.8 t container loaded on platform B.

Train crew

The train crew consisted of four drivers working the train in pairs on a rotating 8-hour relay shift. Two crew members would work the train while the remaining pair of drivers rested in the accommodation provided in the attached crew van.

Train handling

Analysis of the train data logger and found that train handling was consistent with the speed restrictions of the track.

Drugs and alcohol

Due to the remoteness of the site and time limitations, neither driver was tested for the presence of alcohol or drugs.

Track information

The track infrastructure was leased and maintained by GWA, with the movement of rail traffic managed from GWA’s Transport Control Centre located at Dry Creek (South Australia).

The standard gauge (1,435 mm) track was a mixture of 47 kg/m and 80 lb/yd rail fastened to concrete sleepers by resilient clips. The track formation comprised sand/clay based soil, topped with a capping layer and overlaid with ballast to a nominal design depth of 250 mm. The track bed supported prestressed concrete sleepers spaced at 667 mm centres.

Sections of track with 80 lb/yd rail had a speed restriction for freight trains of 50 km/h. Sections of track with a 47 kg/m had a limit of 110 km/h.

The rail size at the Point of Derailment (PoD) (approximately 951 km point) consisted of 47 kg/m. The rail size at the location where the journal separated (approximately 1,001 km point) was 80 lb/yd.

Wagon Maintenance

As per GWA Wagon Maintenance Instruction (WMI 01-01), all wagon maintenance was based on time or kilometres travelled. The inspection frequency was also dependant on the type of wagon. However, where a defect was detected either by a train examination or by condition monitoring equipment such as RailBAM, the wagon was scheduled for repairs.

For the FQWY class wagons, the maintenance instruction specified a time-based inspection period of five years from its last inspection date.^[5] However, the maintenance instruction also stated the frequency of the examination is subject to duty cycle, and condition monitoring equipment available on the operational route.

The failed axle (numbered 45043), with bearing numbers 040321 and 00686 (left and right respectively), was installed under wagon FQWY 12-F in August 2014. The wagon’s most recent maintenance was completed in July 2015. While three wheelsets were changed on platform A, the wheelsets on platform B (including axle 45043) were within specification and returned to service.

Package bearings

The bearing that failed on wagon FQWY 12-F was a SKF 70t E-class package unit bearing. The mated bearing was a Timken 70t E-class package unit bearing.

Packaged bearings consist of two tapered roller bearing assemblies (rollers, cage and inner ring/raceway, sometimes referred to as a cone) mounted inside a common outer ring/raceway (sometimes referred to as the cup). During assembly, a spacer ring of specific width is placed between the two cones to ensure the correct pre-loading for the bearing assemblies. Outside each bearing assembly is a seal wear ring, over which the grease seal is positioned. When installed on the wheel-set, a backing ring is mounted on the in-board side of the axle journal and an end-cap is bolted onto the outer end of the bearing journal (Figure 5).

The manufacturers’ specification for the grease amount for the Timken bearing was approximately 400 grams (14 oz) and the SKF bearing at just over 450 grams (16 oz).

Figure 5: General arrangement of package bearing

The package bearing is assembled then press fitted onto the axle journal. As the bearing is completely sealed prior to being fitted there is no requirement to add any lubrication post fitting. Source: RISSB, coloured and annotated by ATSB

Maintenance

The Australian Rail Industry Safety and Standards Board (RISSB) is responsible for the development and management of rail industry standards, rules, codes of practice and guidelines, all of which have national application. Australian Standard AS7516 Railway Rolling Stock - Axle Bearings – Part 2: Freight Rolling Stock covers the maintenance of the various types of bearings used in the Australian railway industry, including package type bearings.

Section 3.2 of AS7516-2 states that package bearings should be of the No Field Lubrication (NFL) type, and that all components of the package assembly shall have the design capability of completing a service life without maintenance attention. Replacement of package bearing lubrication should occur not more than 8 years after assembly.

Bearing history

The failed bearing (00686) was manufactured in May 2005, with the first recorded fitting to an axle by Downer EDI occurring in February 2006. The bearing was subsequently inspected/remanufactured and re-fitted to different axles at irregular intervals until August 2014 when it was fitted to the axle subsequently used on FQWY 12-F. The fitting of the mated bearing was done concurrently.

Since its installation in August 2014, the wheel set (45043) has travelled over an estimated 335,000 km in a 13-month period.

During it’s in service life of over 10 years it is estimated that bearing would have travelled between 2,500,000 km and 3,000,000 km.

Bearing fatigue life

Bearing fatigue life is commonly referred to as the L10^[6] life. This is a calculated prediction of bearing life in terms of stress cycles (related to revolutions) based on 10% of bearings showing the first evidence of fatigue. The first evidence of fatigue is defined as when one of the rolling contact surfaces develops a spall measuring approximately 6 square mm (refer to section - Contributors to bearing failure, Rolling surface damage).

Based on formulae contained in ISO281:2007, Roller bearings – Dynamic load ratings and rating life, the basic rating life of a roller bearing, in millions of revolutions (L10) is inversely proportional to the 10/3 power of the load applied. For example, if the bearing load is halved, the fatigue life will increase by a factor of about 10. Conversely, doubling the bearing load will result in a decrease in fatigue life by a factor of about 10.

The bearings used on the FQWY class wagon were ‘Class E’ tapered roller bearings and are commonly used on railway rolling stock throughout Australia. A typical fatigue life specification for a Class E bearing indicates that its L10 life is equivalent to about 2,600,000 km (wheel diameter of about 840 mm) when operating at maximum bearing load for 50% of its time. Tapered roller bearings are designed to support both radial loads (weight of wagon and other vertical forces) and thrust loads (cornering and other lateral forces). When considering bearing load, manufacturers sometimes provide both radial and thrust load ratings for their bearings. The rating is usually specified at a specific rotational speed of 500 revolutions per minute, which equates to about 80 km/h for wagons with a wheel diameter of 840 mm.

Records show that the bearing had been in service for just over ten years and travelled an estimated 3,000,000 km. However, its exact loading over this time could not be determined, as there are no accurate records kept over the life of the bearing.

When applying the L10 considered loading of 50% for the bearing, the bearing is determined to be in the 90% range of failure (developing rolling surface defects) at 10 years. However, when applying a more practical loading profile for FQWY 12-F of typically running to Darwin loaded and returning empty, the loading percentage is significantly reduced. As a result, the fatigue life for bearings operating from Adelaide to Darwin is likely to be much higher than the L10 life specified in the manufacturer’s documentation. Consequently, the fatigue life would likely increase beyond the 10 years/3,000,000 km travelled at the 50% loading.

It is considered typical of railway bearings, that their serviceable life is usually limited by factors other than simple bearing fatigue. While actual kilometres and loadings are not known for this bearing, it was considered unlikely that the bearing on wagon FQWY 12-F failed due to simple fatigue alone.

Bearing examination

GWA forwarded the recovered failed bearing components to Bureau Veritas for metallurgical examination. The Bureau Veritas also examined the mated bearing (opposite end of axle).

It was evident that a bearing on the wagon had failed and completely seized, causing the inner raceway to loose interference fit and spin on the axle journal. This generated and transferred sufficient heat into the journal to reduce its strength, make it ‘plastic’, and caused it to separate from the axle (an event commonly referred to as a screwed journal).

Post-derailment inspections were unable to locate any rolling elements or seals. The remaining components (Figure 6) consisted of the outer race shell (cup), a single inner race (cone) and the screwed off end of the axle with the bolted end cap.

Figure 6: Recovered components of failed bearing

The remaining components of the failed bearing above were retrieved from site and was inspected and analysed by the Bureau Veritas Source: Genesee & Wyoming Australia and annotated by ATSB.

Examination of the inner race of the failed bearing found stamping from SKF (Sweden). There was evidence of significant heat damage and significant amount of mill scale (flaky surface, often found on hot rolled steel), suggesting a long period of exposure to high temperatures.

Examination of the outer race was unable to identify any stamping. There was significant mechanical and thermal damage to the surfaces, as well as a build-up of mill scale. Marks found around the race suggested post incident false brinelling^[7]. An area of spalling was also noted on the rolling surface of the outer race, though this was partially obscured by post failure surface damage.

There was no evidence of residual lubrication or grease on any of the bearing components.

The Bureau Veritas concluded that the most likely contributor to the bearing failure was a lubrication supply issue. This may have been due to either seal failure or inadequate lubrication at the time of assembly of the bearing package. The seal was not recovered so could not be examined to determine its condition and the possibility that it may have failed prior to the derailment.

Partner bearing

The examination also included the partner bearing from the opposite end of the axle, and found it to be in good order. The amount of grease in the mated bearing was only a light application and contained small amounts of sand. The Bureau Veritas estimated conservatively that there was less than 200 grams of grease in the bearing as supplied (approximately 50% when compared to a newly packaged bearing). However, Downer EDI considered the grease levels to be relatively typical for in-service bearings. This was noted by ATSB investigators, during site visit to the Downer EDI workshops, in Port Augusta (February 2016). A collection of in service bearings, when examined, showed about 50% grease content, when compared to newly packaged bearings. There was no evidence of false brinelling or surface damage on the mated bearing.

Both grease seals were present and intact, though post derailment observations show the end seals of the bearing appearing to be ‘wet’ which indicates that some grease may have been liberated during the derailment. It could not be determined how much grease was installed in the bearing. However, it is likely that some grease from the mated bearing was lost as a result of the derailment.

Figure 7: Mated bearing with signs of grease leaking from end caps

Figure 7 shows that the end seals of the bearing appearing to be ‘wet’ which indicates that some grease may have been liberated during the derailment. This also indicates that there may have been a failure in the bearing seal. Source: Genesee & Wyoming Australia

Predictive monitoring

The RailBAM system is a predictive bearing condition monitoring system (Appendix A) used throughout Australia. The system listens for unique acoustic signatures known to be associated with specific defect conditions in bearings, such as rolling surface faults and looseness / fretting faults.

Rather than identifying imminent failure of a component, RailBAM facilitates the potential identification of defects as they develop. This is achieved through analysis of acoustic signature data and the identification of data trends from multiple passes. Rail vehicle operators may use this information for ongoing monitoring and/or scheduling for servicing and repairs.

RailBAM has proved reliable at detecting the acoustic signatures of developing surface faults such as spalling damage. However, it has proved more difficult to detect an acoustic signature that would suggest loss of lubrication.^[8]

RailBAM data for 6DA2

A wayside RailBAM site is located near Berrimah. RailBAM data from that site for 6DA2 was examined. The data showed a single acoustic signature associated with the subsequently failed bearing (leading axle on the trailing bogie on wagon FQWY12-F). The signature was consistent with low-level rolling surface irregularity.

Since RailBAM is a predictive system for identifying data trends, it generally requires a series of consistent repeated detections to determine if the noise is erroneous or a true identification of a bearing fault. Consequently, a single low-level acoustic signature is considered more likely a false positive rather than a developing fault.

No alert or alarm condition was identified against wagon FQWY 12-F by the RailBAM system at Berrimah.

Similarly, there were no alarms or alert trends recorded against wagon FQWY 12-F for previous journeys through the condition monitoring stations at Berrimah, Port Germien (South Australia) or Northgate (South Australia).

It should be noted that GWA advised they no longer use RailBAM to track bearing looseness or fretting faults as it is considered to be unreliable.

Contributors to bearing failure

The failure process resulted in complete destruction of the bearing and much of the evidence that may have identified the cause of the failure. Consequently, the investigation looked at the common failure modes for railway bearings to identify the most probable cause.

The main contributors to rolling-stock axle bearing failure are:

• Rolling surface damage
  Rolling surface damage (spalling) is a contact-fatigue mechanism and can result from lubrication supply or effectiveness issues, contaminants carried in the lubricant, or indentations due to impact loading. Spalling is where the bearing surfaces or rollers begin to break up, or flake. The material that has broken away then moves around inside the bearing, causing further damage to the rolling surfaces.

• Component failure
  A common cause of bearing failure is failure of the cage. The cage maintains the roller bearings in the correct spacing and alignment. If the cage loses its ability to correctly align and guide the rollers, the resultant forces can lead to rapid deterioration and break-up of the cage. Under these conditions, broken cage material may become jammed in the rolling surfaces, with bearing seizure the likely result. Note that cage failure can also occur as a consequence of other failure modes, including rolling surface damage or lubrication failure.

• Lack of (or faulty) lubrication
  The purpose of a lubricant is to reduce friction by separating the rolling surfaces at the points of high-pressure contact. Contamination of the lubricant by foreign materials such as metal flakes, filings and dirt reduces the effectiveness of the lubricant, and often causes accelerated wear of the components. A lack (or loss) of lubricant, through failed seals or poor maintenance, can result in elevated levels of frictional heating at the contact surfaces – leading to the eventual overheating of the bearing. This can cause components within the bearing to fail, such as the roller bearing cage.

Examination of the failed bearing found evidence of rolling surface damage. However, the absence of repeat acoustic signatures from the various RailBAM sites suggests the bearing condition on FQWY 12-F had deteriorated relatively quickly.

Failure of the cage (component failure) may have contributed to the failure of the bearing, however the cage could not be located so this mode of failure could not be confirmed.

Considering the available evidence and in the absence of any evidence to the contrary, a loss of lubrication was considered the most likely contributor to the failure and seizure of the bearing, resulting in a catastrophic failure with minimal (if any) warning signs.

__________

4. All weights and lengths for FQWY wagons refer to the total weight and/or length of the two platforms combined.
5. With a tolerance of 6 months before or after the due date
6. L10 is the life expectancy of a bearing in kilometres before the likelihood of rolling surface defects increases.
7. Brinelling is the imprint on a hard surface, such as raceways of a bearing, which can lead to spalling. False brinelling is indent damage caused by reasons other than fretting as is normally associated with this type of damage.
8. Southern,C., Rennison,D & Kopke,U (2004). RailBAM - An advanced bearing acoustic monitor – initial operational results RTSA – Conference on Railway Engineering,

The occurrence

At about 0900^[2] on 30 October 2015, Genesee & Wyoming Australia (GWA) train 6DA2 carrying containerised freight departed Berrimah (near Darwin, Northern Territory) bound for Adelaide Freight Terminal (AFT) (near Adelaide, South Australia). At Alice Springs, train 6DA2 stopped to off load and pick up containerised freight before continuing onto AFT the following day.

Prior to leaving Alice Springs, a full mechanical examination, including train brake test, and brake pipe leakage test (FX1) was completed. No issues were detected, and train 6DA2 departed at about 0555 bound for AFT in Adelaide.

Shortly after crossing the Northern Territory border into South Australia (at about the 1,001 km point^[3] - Figure 1), a bearing journal separated from the lead axle of the trailing bogie 2 on the fourth-to-last wagon of the train. It is likely that as the right bogie side-frame collapsed, the additional load on the left caused the axle to tilt and jam the right wheel onto the wagon body. This subsequently caused the left side wheel to ‘lock up’ and slide along the railhead (flat spot shown in Figure 3).

At the time, train 6DA2 was travelling through a section of track with a speed restriction of 50 km/h. The crew however, did not notice any consequences related to the failed bearing journal.

The train continued travelling south for about 35 km and cleared a speed restriction at about the 965 km point. The driver then started to increase speed to the normal operating track speed of 110 km/h. The wheelset/bogie side-frame continued to slide, resulting in minor markings on some rail fastenings, scarring on the head of the rail, damage to a cattle grid and starting several small spot fires.

Figure 1: Map of locality of the occurrence, the journal, and the derailment site

Figure 1 illustrates the locality of the derailment in relation to Alice Springs. The callout box on the left illustrates where the journal was located. The callout box on the right illustrates where the train derailed. Source: Natmap annotated by the ATSB

Approximately 50 km after the journal separated from the axle, the wheelset climbed across the railhead and derailed (951 km point). The wheelset continued for an additional 11 km before the bogie completely dislodged from under the wagon body, resulting in significant damage to three following wagons and track (940 km point).

At about the same time (1153), the driver noticed a subtle pull on the train. The driver checked the gauges, looked in the locomotive rear-view mirrors, and noticed a small amount of dust at the rear of the train. The driver asked the observer (co-driver) if he could see any dust from his side of the train. Initially the observer reported nothing. However, shortly after the observer noticed some dust on his side of the train. The driver applied the brake, resulting in the train decelerating.

In the last few hundred meters of travel, after the brake application, the driver noted a further drop in brake pipe pressure, indicating a physical disruption in the brake system before the train came to a stand.

Figure 2 shows an illustration of the sequence of events.

Figure 2: Sequence of event against track speed

Figure 2 illustrates the position of key events leading up the derailment against the permitted track speeds (speed restrictions). The illustration is not scale. Source: ASTB

The observer was tasked to go and inspect the rear of the train. As he walked towards the rear of the train, he found that the rear bogie on wagon FQWY 12-F (fourth-to-last wagon) had dislodged from the platform and was located alongside the track approximately 500m from the rear of the train (Figure 3). The remaining three 2-pack wagons remained upright with all bogies derailed, with some completely removed from their associated platforms. Several containers from the derailed wagons had broken away from the train and landed in the rail corridor. The derailment had also caused significant damage to 12 km of track resulting in mostly cracked sleepers and damage to rail fasteners. There was no spillage of any dangerous goods.

Figure 3: Photo of derailment site with the screwed journal axle in the foreground

Figure 3 shows the derailment site. The axle in the foreground is the lead axle from the trailing bogie (refer to figure 2) of wagon FQWY12-F which was found to have the screwed journal. The callout box depicts the flat wheel due to the wheel jamming as a result of the screwed journal. Also pictured is the mated bearing on the journal. Obscured from view on the axle is the screwed journal. Source GWA

__________

2. The 24-hour clock is used in this report and is referenced from Central Standard Time (CST)
3. Distance in kilometres from the reference point located at Coonamia, South Australia.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Appendices

Appendix A – Condition monitoring systems

Hot-box detectors

Hotbox detectors are a reactive method of condition monitoring. They usually detect the infrared signature of bearing components and alarm if the temperature exceeds a predetermined setting. However, there are a number of variables that can affect their performance on a mixed freight/passenger rail corridor. These variables include but are not limited to:

• train loading
• train speed
• weather conditions.

Consequently, hotbox detection is usually used as a ‘last line of defence’ to protect railway infrastructure assets critical to production processes such as coal and ore carrying railways.

Due to the potentially unreliable performance of hotbox detectors under mixed freight/passenger conditions, more effort has been directed towards predictive condition monitoring of railway rolling stock travelling on the interstate main lines.

Bearing Acoustic Monitoring

Bearing Acoustic Monitoring (BAM) is a predictive condition monitoring system that ‘listens’ to the acoustic signature of bearings and can detect faults as they develop. It is the primary method for detecting potential bearing faults on rolling-stock travelling on the interstate main line. Recorded data from each train is stored in a database allowing evaluation, trending, and maintenance scheduling of rolling-stock based on predicted bearing condition.

BAM uses sensitive acoustic arrays to record the sounds emanating from wheels and bearings passing through the monitoring site. The recordings are processed for the sound characteristics that are unique to specific types of bearing faults. BAM is best at detecting faults on rolling surfaces such as the inner and outer raceways, and rollers in rolling-stock bearings. BAM can also detect looseness or fretting faults and ‘noisy’ wheels (flanging and wheel flats).

BAM systems are usually installed and maintained by infrastructure managers. However, the data is made available to rolling stock operators through a web interface. The BAM database categorises potential bearing faults in the form of levels of severity (1, 2, and 3 with level 1 being the most critical). The database allows operators to analyse bearing fault history and trends in order to plan their preventative maintenance strategies.

As for any monitoring system, there are some limitations. For example, BAM is a system that ‘listens’ for bearing noises, and under some conditions, other noises (rubbing equipment, tread defects or flanging wheels) may affect the results. However, being a predictive condition monitoring system, multiple passes of potentially defective bearings allows true fault trends to be clearly identified and actioned before a defect reaches a critical level.

It is evident that predictive condition monitoring and a pro-active approach by train operators has become an integral tool for managing the risk of bearing defects on freight rolling stock, especially in relation to rolling surface defects. For example, the ARTC BAM site at Nectar Brook showed a reduction in the number of level 1 rolling surface faults from about 0.5% in 2002 to about 0.05% in 2010. However, Level 1 looseness or fretting (LF1) faults have not experienced the same improvement. In 2002, LF1 faults were about 1.2%, reducing down to about 0.6% in 2005 before rising back to 1.0% in 2009 and 2010.

On-board condition monitoring

In the past, condition monitoring of rolling-stock has been the realm of trackside equipment (Hotbox, RailBAM, etc.), usually fixed at a specific geographical location. While predictive systems may provide a broader level of protection, reactive systems are limited to protection of equipment and infrastructure in the immediate vicinity.

The next evolution of condition monitoring would be one that continuously monitored each wagon for developing faults (predictive) and immediately communicated any critical conditions to the train drivers (reactive). This type of system is referred to as an on-board condition monitoring system. While various limitations (functional and economic) have prevented these systems being widely used on railway freight operations in the past, recent technological developments have now made the concept more attractive. However, at the time of this incident, only limited developmental work had been started within Australia.

What happened

On the afternoon of 2 November 2015, a Eurocopter AS350-BA helicopter, registered VH-SFX, was performing a low-altitude aerial weed spotting operation over dense forest in the Whyanbeel Valley, Queensland. On board the helicopter were the pilot, a navigator and two aerial spotters.

While conducting the work, the helicopter yawed twice in an uncommanded manner. In response, the pilot climbed and increased the helicopter’s forward airspeed and attempted to return to his base of operations. Subsequently, the engine failed, which required the pilot to conduct an autorotation and emergency landing.

The passengers adopted the brace position and the helicopter landed heavily with the skids digging into the uneven terrain and breaking off. The navigator in the front seat received minor injuries and the pilot received serious back injuries from the impact forces.

What the ATSB found

The ATSB found that the emergency landing was handled in a competent and proficient manner. The pre-departure briefing gave the passengers the necessary knowledge to prepare for the emergency by adopting the brace position and exiting the helicopter only when it was safe to do so.

Analysis of the engine identified that the aircraft lost power due to a front bearing failure in the turbine module. The failure was due to an accumulation of coke particles in an oil jet. The ATSB was unable to conclude specifically why the coke particles had formed.

The severity of the engine failure was increased through the fracture of the power turbine shaft and the subsequent separation of the turbine disc. This was due to a lack of adhesive on the splined nut that was threaded to the rear of the power turbine shaft.

A service information bulletin issued by the helicopter manufacturer in 2010 recommended that AS350 helicopter operators consider the safety benefits of installing energy-absorbing seats. Had these seats been installed, the forces imparted to the pilot during the accident sequence may have been reduced.

What's been done as a result

The engine manufacturer (Safran Helicopter Engines) has amended their procedure manual to include systematic cleaning of the power turbine front bearing assembly oil jet and oil jet supply pipe. Safran HE have initiated a number of training and process changes to ensure the adhesive bonding between the power turbine and the rear nut is maintained during service.

Safety message

This investigation highlights that responding to an emergency in a timely and proficient manner can minimise the consequences of an accident. Similarly, providing emergency procedures briefings enables passengers to react appropriately in an emergency.

In this occurrence, the reason for the engine oil jet coking leading to the engine failure was not specifically determined. However, a range of factors can affect engine oil coking. These factors should be considered to ensure normal ongoing engine operation.

Context

Pilot training and experience information

The pilot held a valid Commercial Pilot (Helicopter) Licence that was issued on 6 January 2004 and a valid Class 1 Aviation Medical Certificate. The pilot’s last flight review was issued on 17 February 2014 and was valid until 29 February 2016.

The pilot had a total flying experience of about 6,200 hours, of which over 3,000 hours were in the AS350 series helicopter. This included a substantial amount of experience conducting low-level operations. In the previous 90 days, the pilot had flown 9 hours on type, and in the previous 24 hours the pilot had flown 6 hours on type. The pilot reported feeling rested and alert prior to the occurrence flight.

Helicopter information

The helicopter was a Eurocopter AS350-BA helicopter, manufactured in 1981 and first registered in Australia on 16 June 2005. At the time of the occurrence, the airframe had accumulated approximately 10,518 hours total time in service (TTIS).

Wreckage and impact information

The on-site examination found that the helicopter struck the ground tail rotor first, with the skids subsequently digging into the uneven terrain and separating from the fuselage (Figure 2).

The engine had sustained damage consistent with a high-energy failure. The power turbine separated from the disc and the containment shield was twisted and deformed. The exhaust duct was bulged and puncture marks from internally liberated engine debris was evident (Figure 3).

Figure 2: VH-SFX at the accident site

Source: ATSB

Figure 3: View of the helicopter engine at the accident site

Source: ATSB

Engine information

The helicopter was powered by a Turbomeca^[3] Arriel (model 1B) engine, located above and to the rear of the passenger compartment. The Arriel 1B engines feature a modular design with the major modules consisting of an axial and centrifugal compressor, an annular combustion chamber, a two-stage axial turbine, a single-stage axial power turbine and a reduction gearbox (Figure 4). This occurrence related to a failure within the power turbine.

Figure 4: General arrangement of a Turbomeca Arriel 1B turboshaft engine showing the locations of the major sub-components

Source: Turbomeca, modified by the ATSB

Power turbine information

Gases from the two-stage axial turbine are directed downstream to the power turbine. The power turbine disc and shaft is a cantilevered design supported by front and rear bearings (Figure 5). Surrounding the power turbine is a containment shield to prevent high-energy engine debris from exiting the engine in the event of a blade fracture or disc separation from the shaft. The fractured turbines blades did not penetrate the containment shield in this occurrence.

Figure 5: General arrangement of the power turbine showing the relative location of the major parts including the guide vanes, labyrinth seal, power turbine shaft, rear nut, and the front and rear bearings

Source: Turbomeca, modified by the ATSB

Engine examination

The engine was removed from the helicopter and a preliminary examination was completed at the engine manufacturer’s facilities in Sydney, New South Wales. The power turbine shaft assembly of the engine was subsequently transported to the manufacturer’s facilities in France. The assembly was inspected in detail under the supervision of the French aviation investigation agency, the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile (BEA). The examination determined that:

• The power turbine disc had fractured in overstress and separated from the power turbine shaft (Figure 6). The power turbine disc sustained a complete loss of power and the turbine blades had separated from their respective stations. Fracture of many of the blade inter-recesses within the disc had also occurred.
• The front bearing of the power turbine shaft had totally seized (Figure 7). Evidence of roller skidding, metal contamination and gross overheating was found within the bearing assembly. The accumulation of hardened coking products and varnish deposits from oil degradation was also found within the rolling elements.
• As a result of extreme frictional heating, the oil-air labyrinth seal, just forward of the front bearing, had melted and fused with the power turbine shaft.
• Metallurgical analysis of the power turbine shaft showed that it had been exposed to temperatures in excess of 1,300C. That temperature was several hundred degrees above the normal maximum operating temperature of the engine.
• Examination of the oil jet and surrounding oil ducts to the front bearing of the power turbine shaft identified that the jet outlet was blocked with an accumulation of coke particles (Figure 8).
• Examination of the splined nut that was threaded to the rear of the power turbine shaft assembly revealed evidence that it had tightened. The location of the nut determined the position of the shaft and any potential axial preload of the shaft bearings. No evidence was found of the adhesive that was required to have been applied between the threads on the rear shaft and the nut (Figure 9).

Figure 6: Cross-section through the power turbine assembly from the engine showing that the disc had separated from the shaft and the blades had fractured

Source: Turbomeca, modified by the ATSB

Figure 7: The seized front bearing and labyrinth seal, showing blackening from severe heat distress, flattening of the rollers, deformation of the cage and sealing fins

Image source: Turbomeca, modified by the ATSB

Figure 8: Close up of the blockage (circled) at the oil jet to the front bearing, as positioned in the general arrangement view

Image source: Turbomeca, modified by the ATSB

Figure 9: Cross-section of the rear splined nut contacting the rear bearing inner race

Source: Turbomeca

Power turbine rear nut adhesive bonding

The engine manufacturer had intended for an adhesive to be used in order to secure the rear nut into position. The adhesive was only applied during maintenance at a Turbomeca overhaul facility when the power turbine was overhauled.

Failure to adequately bond the nut could result in a tightening of the rear nut when abrupt changes in torque occur, leading to axial displacement of the turbine shaft in excess of the designed amount. This displacement would result in contact between the turbine shaft and the front bearing inner race, resulting in frictional heating, and damage to the turbine shaft.

The engine examination identified that the rear nut fitted to the rear of the power turbine shaft had not been adhesively bonded, as required.

Oil coking

The observed coking of the front bearing and its oil jet duct was likely a result of the engine oil exposure to abnormally high temperatures in the area. While there were clogging inspection procedures of the power turbine rear bearings, no preventative maintenance actions existed that allowed for the identification of coking within the front bearing.

Coking is an artefact from exposure to abnormally high temperatures that leads to oxidation and chemical breakdown of the oil. Coking can form as a thin-film layered deposit (as was the case in the oil duct) or in thicker clumps (which resulted in the clogging of the oil jet). It forms within the oil distribution channels and pipes, and can shed from the wall surface leading to reduced or obstructed oil flow. Determining the initiating source of coke formation is difficult as it can be attributed to a combination of influences, including:

• operational conditions such as hot shutdown
• design traits such as abrupt changes in oil flow direction and areas of low fluid velocity that can lead to reduced oil flow rates
• low-drainage areas resulting in conductive or convective oil temperature increases post-shutdown
• reductions in cross-sections such as scavenge ports that increase the likelihood of blockage
• prolonged aircraft inactivity leading to moisture absorption of coke deposit.

The manufacturer of Arriel engines had published guidance for the thermal stabilisation of engines at shutdown. The guidance involved throttling the engine back until the engine was at ground idle for at least 30 seconds prior to shutdown. Stabilising an engine after operation allows for the temperature to reduce and thermally balance, while maintaining sufficient oil-scavenging capability and oil flow rates to minimise the potential for coke formation. Non-compliance with the manufacturer’s stabilisation recommendations may lead to coking.

The helicopter operator’s manual referred to the correct shutdown procedure in the AS350 flight manual. However, an appendix to the operator’s manual included a checklist that referred to a two-minute idle time before shutdown. The engine manufacturer advised that a two-minute shutdown would not adversely affect the formation of coke particles.

The engine manufacturer reported that a design trait of the power turbine is that the fluid velocity is lower at the bottom of the oil jet duct to the front bearing. For a given volume, this trait can lead to increased convective heating of the oil and depending on the temperatures in that region, may lead to coking.

In the period January 2000 to September 2015, there were 13 cases of Arriel engine deterioration in the power turbine shaft front bearing due to oil jet clogging. However, this is the only accident that has resulted in the failure of the turbine shaft.

Engine maintenance

The most recent significant maintenance involved removal of the engine from the airframe for repair after it sustained foreign object damage in February 2015 (7,786 hours TTIS). The centrifugal compressor and gas generator were replaced in May 2015. The engine was not operated during this period.

The last scheduled engine maintenance was performed on 30 October 2015 (8,060 hours TTIS), two days prior to the accident. Among the maintenance actions performed at that time, a clogging check of the gas generator rear bearing was conducted along with an inspection of the oil return line strainer. No anomalies were recorded in the maintenance documentation. The helicopter subsequently accumulated an additional 5 hours flight time up until the accident. There was no overdue maintenance requirements or declared defects.

Oil and filter analysis program

The helicopter operator had been monitoring the internal health of the engine components by participating in a spectrometric oil and filter analysis program (SOAP). That program relied on detecting the type and quantity of wear-material products within the engine oil and oil filter. The wear-material is generated from the breakdown mechanisms of internal engine components. SOAP checks were recommended by the engine manufacturer at intervals not exceeding 100 hours of service.

The most recent oil sample was collected and analysed approximately 10 hours prior to the engine failure. The previous sample to that was taken approximately 100 hours prior to the failure. Those checks indicated no unusual trends or signs that internal damage had been developing.

Emergency Procedures

The AS350 flight manual defined the emergency procedures for the illumination of the ‘ENG CHIP’ chip detector light and an autorotation landing. As per the AS350 flight manual, upon the Illumination of the ‘ENG CHIP’ caution light the pilot was required to:

“Land as soon as possible: land at the nearest site at which a safe landing can be made.”

A successful autorotation is dependent on the pilot’s airmanship and the helicopter’s speed and altitude relative to the airspeed-height envelope.

Airspeed-height envelope

The airspeed-height envelope defines a region within the helicopter’s flight envelope where there is insufficient energy (height and/or airspeed) for a successful autorotation to be completed. Section 5.1 of the AS350 flight manual defines the airspeed-height envelope for the helicopter. The envelope is determined using the density altitude and weight of the helicopter. The resulting envelope outlines the avoidance zone (Z); operating in the avoidance zone as defined in the FAA Rotorcraft Flying Handbook (FAA-H-8083-21A) ‘“may not allow enough time or altitude to enter a stabilised autorotative descent.’

Helicopters are not restricted from conducting operations in the avoidance zone, however, a pilot should always evaluate the risk of the manoeuvre versus the operational value.

In this case, the helicopter was equipped with a Garmin GPSMAP 195 portable device capable of storing track data for flights. During the operational portion of the flight, the helicopter was inside the avoidance zone. This was due to the aircraft being required to travel at a low airspeed and altitude such that the aerial spotters were able to identify the noxious plants.

The GPS track data for the accident ended while the aircraft was still airborne. At the time of the last track point, the aircraft was approximately 295 ft above the terrain travelling at approximately 65 kts groundspeed. This was outside the avoidance zone defined as per the flight manual.

Survival aspects

The passengers had received the pre-departure briefing and adopted the brace position. The navigator in the front seat received minor injuries and the pilot received serious back injuries from the impact forces. No objects were located underneath the front or rear seats.

Helicopter seating

The helicopter was fitted with the original seats installed by the manufacturer (Figure 10). The rear passenger seats had deformed during the accident and likely absorbed some of the energy during the impact. The seat-belt attachments remained intact during the accident sequence. There was no observable deformation to the front seats of the helicopter.

In 1999, the helicopter manufacturer released a service letter (SL No. 1424-25-99) to inform all helicopter operators of the optional availability of redesigned seating for the pilot and copilot. The improved seat design increased the strength of the seat and attachments, and depending on the installed option, introduced energy-absorbing seat installations.

The manufacturer also published a service bulletin (EC SB AS350 No. 25.00.57) recommending the installation of the energy-absorbing seats on AS350 helicopters. A European Aviation Safety Authority (EASA) safety information bulletin, SIB 2010-05, reiterated the safety benefits associated with the installation of energy absorbing seats.

According to the EASA SIB, the modification of the helicopter in accordance with the SL would:

increase the pilot and co-pilot’s seat strength and crashworthiness and thus to provide an increased level of protection to the occupants in case of impact during an accident.

Figure 10: VH-SFX front seats (left) and rear passenger seats (right)

Emergency equipment

The helicopter was fitted with an emergency locator transmitter (ELT) that could be activated by a switch on the instrument panel, an emergency position indicating radio beacon, and a first aid kit. Just prior to touchdown the pilot activated the ELT. After the landing, two passengers proceeded on foot to search for persons/households to contact emergency services. About 30-45 minutes after the accident occurred, the passengers were met by emergency services, who were responding to the ELT transmissions. The pilot received medical treatment onsite and was transported to hospital for further treatment. There were no other communication devices available, such as a satellite phone, for contacting emergency services.

__________

3. Turbomeca is now known as Safran Helicopter Engines (Safran HE)

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Safran Helicopter Engines (formerly Turbomeca)
• Airbus Helicopters (formerly Eurocopter)
• the Civil Aviation Safety Authority
• the aircraft operator
• the pilot
• the passengers.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the pilot, the passengers, the aircraft operator, the Civil Aviation Safety Authority, Airbus helicopters, Safran Helicopter Engines ,and the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile (BEA).

Submissions were received from the pilot, the aircraft operator, Safran Helicopter Engines, the Civil Aviation Safety Authority and the BEA. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

The occurrence

On 2 November 2015, a Eurocopter AS350-BA helicopter, registered VH-SFX, was performing aerial work to identify noxious plants in dense forest within the Whyanbeel Valley (Figure 1), Queensland (Qld). The nature of the aerial work required the helicopter to operate at a low altitude and airspeed. On board the helicopter was the pilot, a navigator and two aerial spotters. The base of operations was in Mossman, Qld.

At approximately 1620 Eastern Standard Time,^[1] during the fourth flight of the day, the helicopter momentarily yawed twice within a short period in an uncommanded and unusual way. The pilot, concerned with the uncommanded movements, ceased the operation, climbed and increased the helicopter’s forward airspeed. The pilot then elected to head back towards the base of operations (approximately 11km away) and, if required, land along the way if a suitably safe area along the flight path presented.

Shortly after, the chip detector light^[2] illuminated on the instrument panel, prompting the pilot to search for a suitable landing area. As the helicopter continued to climb through approximately 200 ft, the engine stopped producing power.

The pilot identified the most suitable area to land, given the limited available height and airspeed, and commenced an emergency autorotation. The identified area was uneven, overgrown with plants, and surrounded by tall trees. During the landing sequence, the skids of the helicopter dug into the terrain and were broken off. The helicopter came to rest about 10 m after first touching down. The passengers received nil to minor injuries and waited until the rotor blades had ceased turning before evacuating the helicopter. The passengers then assisted the pilot who had received serious back injuries. The helicopter was substantially damaged.

Figure 1: The helicopter’s GPS track, arriving in the area of operations, its flight path around the forested terrain in the Whynabeel valley, and the accident site

Source: Google earth, modified by the ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. A device, often a permanent magnet that is used to gather metallic fragments from the engine or transmission lubrication oil. Depending on the configuration, the chip detector can be linked to an in-cockpit indicating light.

Safety issues and actions

Proactive safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

The engine manufacturer (Safran Helicopter Engines) has amended their practices to include:

• Periodic cleaning of the power turbine front bearing assembly oil jet and oil jet supply pipe. This reduces the occurrence probability for oil jet clogging by removing any accumulated deposits from these locations.
• Degreasing of the threaded surfaces prior to application of the adhesive bonding and assembly of the parts. Maintenance and overhaul personnel have been informed of the importance of degreasing the surfaces before bonding the nut to the power turbine shaft.

Safran Helicopter Engines is also studying the use of heating equipment to obtain a more repeatable polymerization.

Findings

From the evidence available, the following findings are made with respect to the engine failure involving a Eurocopter AS350BA helicopter, registered VH-SFX that occurred in the Whyanbeel Valley, Queensland on 2 November 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The helicopter lost power due to a failure of the Arriel 1B engine. The failure was a result of coke particles that had clogged the front oil jet from the power turbine shaft, preventing oil flow, and leading to a total seizure of the front bearing. The specific source that led to the coke formation and oil clogging of the front oil jet could not be determined.
• The rear-splined rear nut had not been adhesively bonded to the power turbine shaft, as required. When the front bearing failed, the lack of adhesive led to a progressive tightening of the nut and additional frictional heating of the shaft from contact with the static engine components. The consequential reduction in material strength from the heating allowed the power turbine shaft to fracture and the disc to separate, further increasing the severity of the engine failure.

Other factors that increased risk

• The helicopter was not fitted with energy absorbing front seats, which may have reduced the risk of injury to occupants during an accident.

Other findings

• The ATSB found that the emergency landing was handled in a competent and proficient manner. The decision by the pilot to increase forward airspeed and altitude, after the uncommanded and unusual yaw movements, removed the helicopter from within the avoidance zone and likely prevented serious injuries to the passengers.

Safety analysis

Introduction

While conducting aerial weed spotting operations at low level, the helicopter’s engine failed necessitating an emergency landing into unfavourable terrain. The ground impact resulted in substantial damage to the helicopter. The pilot received serious injuries and the passengers sustained nil to minor injuries.

This analysis will examine why the engine failed, why an impending failure was not detected, the pilot’s handling of the emergency, and how occupant injuries can be reduced in the event of a hard landing.

Engine failure

The uncommanded yawing of the helicopter was the result of the engine failing from a seizure of the front bearing to the power turbine. The failure commenced rapidly when the oil supply to the front bearing became obstructed due to clogging of the bearing’s oil jet by the accumulation of coke particles (a solid residue from the breakdown of the engine oil).

During this period of transient engine operation, it is likely that the abrupt changes in torque from the power turbine and the lack of adhesive, led to a progressive tightening of the rear nut (fitted to the rear of the shaft). The tightening resulted in an axial coupling between the front bearing, stop, and labyrinth seal. That contact generated additional frictional heating and a further temperature rise within the shaft.

The combined effects of the front bearing seizure and the axial coupling of the components led to excessive heating and a subsequent critical reduction in mechanical properties for the shaft. Consequently, the turbine shaft was unable to sustain the operating stresses and it eventually fractured at the interconnection with the disc.

Oil coking

Coke formation is influenced by a range of complex factors (as mentioned in the coke formation section). The engine had been removed from the aircraft due to foreign object damage early in 2015 and spent several months out of operation. The ATSB was not able to determine if coke deposits were present at this point in time. Similarly, it was unknown if inactivity had impacted on moisture absorption of any coke deposits. The manufacturer has subsequently added an additional operation in their maintenance procedures which include the systematic cleaning of the turbine shaft front bearing assembly oil jet and oil jet supply.

While non-compliance with the stabilisation time before engine-shutdown can result in coke formation, the operator’s procedures, included a stabilisation time of not less than 30 seconds and it was reported that flight crew followed these procedures. As such, the ATSB was unable to determine to what extent (if any) the compliance with stabilisation times affected the formation of coke particles.

The service history of the Arriel-series engine indicates there have been multiple instances of deterioration of the turbine shaft front bearing as a result of the front oil jet clogging. The geometry around the oil jet was such that in the event of front bearing degradation due to clogging, temperature rises in this area would occur. This induced variations in the oil fluid velocity and led to conditions that were favourable to coking and the formation of hardened deposits. The use of the manufacturer specified oil and continuous monitoring for metal particles should have limited the effect of this phenomenon. However, the metal particle detection checks (SOAP) were not intended for assessing the presence of coke particles, but rather the breakdown of engine components. In this instance, clogging of the oil jet likely occurred before the breakdown of the engine components. The ATSB was unable to determine to what extent the geometry of the area affected the formation of coke particles.

Due to the complex combination of factors that can affect coke formation, the ATSB was unable to determine a specific source that led to the coke formation and oil clogging of the front oil jet.

Adhesive bonding of the power turbine rear nut

The engine manufacturer had intended for an adhesive be used in order to secure the rear nut into position. The adhesive was only applied during maintenance at a Turbomeca overhaul facility when the power turbine was overhauled. The engine examination identified that the rear nut fitted to the rear of the power turbine shaft had not been adhesively bonded, as required.

The engine would still have ceased operating if the appropriate adhesive had been present on the rear splined nut. However, the likelihood of the shaft failing would have been reduced and the failure sequence less severe. The failure sequence would likely have been extended, allowing greater time for the pilot to respond to the failing engine.

Flight operation

The operation necessitated the helicopter to operate at a low altitude and airspeed. At the time of the uncommanded yaw movements and subsequent ‘ENG CHIP’ light illumination, the helicopter was inside the avoidance zone. According to the helicopter operating manual, an ‘ENG CHIP’ light illumination necessitates the pilot to land the helicopter ‘as soon as possible’. This should be interpreted as soon as safe landing is possible. The pilot immediately increased airspeed and altitude and brought the aircraft out of the avoidance zone. This allowed the pilot to conduct a successful autorotation when the engine failed.

At the time, the helicopter was over densely forested and steep terrain, making it unsuitable for a safe landing. The pilot had elected to head back towards the base of operations (approximately 11 km away) and land if there was a suitably safe area along the flight path. Given the location of the helicopter and the surrounding terrain, returning to a known safe landing area (the base of operations), with the possibility of identifying a safe landing area during transit, provided an appropriate option in the difficult circumstances.

The pilot’s actions while responding to the emergency situation likely prevented serious injuries to the passengers.

Helicopter seating crashworthiness

The rear passengers had adopted the brace position prior to the impact and the seats had absorbed some of the energy from the hard landing. These passengers received nil injuries. Similarly, the passenger in the front seat braced for the landing and received only minor injuries.

The helicopter was fitted with the original front basic seats installed when it was manufactured. The basic seats complied with the minimum performance standard of the applicable certification bases.

As aerospace technology and design has evolved since the original certification, new certification rules have been enacted to better protect the occupant’s safety in the event of an accident. The manufacturer of the helicopter had installation options available to operators to install energy-absorbing seats. Energy absorbing seats reduce the amount of energy transferred to their occupants in the event of an accident.

In the case of this accident, there was not enough information on the impact forces and dynamics to determine whether energy-absorbing seats would have reduced the injury severity to the pilot.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 29 May 2015, at about 1145 Eastern Standard Time (EST), a Victa 115 Airtourer aircraft, registered VH-MUV (MUV), departed from Leongatha Airport, Victoria, for crosswind circuit training, with an instructor and student on board.

The student pilot was flying the first circuit. The instructor reported that the circuit was normal and the approach was stable up to about 100 ft above ground level (AGL) when the student put the final stage of flap out. As the aircraft flared to land on runway 22, a strong gust of wind blew the aircraft off the runway centreline to the left and the aircraft bounced hard. The student initiated a go-around, applying full power, with the aircraft still drifting further to the left. As the aircraft was not climbing, the instructor called “taking over” and the student handed over control of the aircraft. The instructor lowered the nose of the aircraft to gain airspeed.

The aircraft continued to drift further away from the runway centreline. The student noticed the flaps were in the down position and, thinking that it would assist and without checking with the instructor, retracted the flaps to the up position. The aircraft descended and about 100 m past the threshold of runway 22, the aircraft collided with the airport perimeter fence. After a further 20 m, the aircraft flipped over the fence and came to rest upside down. The instructor and student exited the aircraft quickly through the broken canopy, as fuel was gushing from the fuel tanks. The instructor and student pilot received minor injuries and the aircraft was substantially damaged (Figure 1).

Figure 1: VH-MUV inverted after flipping over the airport perimeter fence

Source: Aircraft operator

Instructor comment

The instructor reported that the purpose of the flight was to instruct the student in crosswind landing techniques and then to conduct further flight training in the training area. The instructor indicated that, as they were planning to conduct 2 hours of flight training, the aircraft had full fuel on board and was near the aircraft maximum take-off weight.

The instructor described the wind as gusting between 15 to 22 kt at 270 degrees, with a crosswind component of between 10 to 15 kt.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Flight training organisation

As a result of this accident, the flight training organisation advised the ATSB that they are taking the following safety actions:

• The instructor has been briefed on the importance of making sure students understand not to touch any of the aircraft’s controls when the instructor is in control of the aircraft.
• The instructor has been briefed on the handing over and taking over procedures with the emphasis on handing over and taking over controls procedures.

Safety message

It is important in flight training to have a positive exchange of flight controls. The US Federal Aviation Administration (FAA) has found that numerous accidents have occurred due to a lack of communication or misunderstanding regarding who had actual control of the aircraft, particularly between students and flight instructors. The FAA publication Aviation Instructor’s Handbook, includes a section on the Positive Exchange of Flight Controls. The handbook provides guidance to use for the positive exchange of flight controls (Figure 2).

Figure 2: FAA Positive exchange of Flight Controls

Source: US Federal Aviation Administration

Aviation Short Investigations Bulletin Issue 44

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

 

What happened

On 3 November 2015, at about 1400 Western Standard Time (WST), a pilot of a Eurocopter AS365 N3 (Dauphin), registered VH-WPX, conducted a maintenance test flight at Jandakot Airport, Western Australia.

The test flight was the third that day, to conduct track and balancing of the main rotor, following reports of vibration.

During the post-flight inspection following this test flight, one of two Licenced Aircraft Maintenance Engineers (LAMEs) involved in the test flight, noticed two large gouges to the leading edge of one of the main rotor blades (Figure 1).

A spanner that had been used during the third track and balance related adjustments could not be located. It was later located on an adjacent taxiway about 43 m from the hangar. Due to the scuff marks and scratches found on the spanner, it was determined that it had been left in the rotor head area and was likely ejected during the aircraft start up.

Figure 1: Damage to leading edge of a main rotor blade on VH-WPX

Source: Aircraft operator

Events leading up to the foreign object damage

Prior to the event, the main rotor head bolts (bolts) had approached their scheduled life limit. So on 26 October the maintenance organisation replaced the bolts, in accordance with the Airbus Helicopters AS365^[1] Maintenance Manual. The maintenance manual required that a main rotor blade track and balance be performed following this replacement.

Helicopter vibration was automatically monitored using the Honeywell Chadwick Helmuth Vibration Expert (VXP), which was installed in the helicopter. The VXP data generated was automatically sent to an external diagnostics organisation for trend monitoring. Additionally, LAMEs could access this data for rotor track and balancing requirements.

The operator advised that when the bolts were replaced, a work pack^[2] was generated for the task.^[3] Prior to the required track and balancing flights, one of the two LAMEs tasked with the job (LAME 2), transferred the main rotor blade track and balancing procedure to the aircraft technical log^[4] and ground run/test flight sheet.^[5]

However, due to non-availability of flight crew, the test flights were not conducted until 28 October. The ground run/test flight record indicated that the results of the track and balance procedure were satisfactory, and the aircraft was returned to service the same day.

The aircraft continued in service, and flew about 14 hours between 28 October and 3 November. During this period, the maintenance organisation reported that a 4P vibration^[6] (within manufacturer tolerance) was being monitored and a pilot advised of a vibration. However, this information was not formally recorded on technical documentation.

On 2 November, the external diagnostics company that monitored the aircraft VXP data, advised the operator of a rising vibration trend. This rising vibration trend was still within tolerance, and supported the pilot reported vibration that was being monitored by the maintenance engineers. At this time, the Chief Engineer advised the other LAME (LAME 1) to conduct further main rotor track and balancing during the following few days, subject to pilot availability.

Further track and balancing, and smoothing, was conducted on 3 November. The two LAMEs’ recollections and observations of the task are detailed below.

LAME 1

• Reported that a work pack had not been created for the subsequent track and balancing job, however, they (LAME 1) endorsed the ground run/test flight sheet and annotated the corresponding number on the technical log prior to the test flights.
• Reported that the Chief Engineer had discussed the required maintenance with them.
• Reported that although not formally assigned the role, thought they were most likely the Job Coordinator.
• LAME 1 had tagged out a socket and a screwdriver. Prior to each test flight, LAME 1 placed the tools being used into a metal tray, and then placed the tray on top of the toolbox. As the job was ongoing, there had been no documented requirement to place the tools back into their assigned location. LAME 1 had visually checked the tools in the metal tray prior to the third test flight, but did not use the tag procedure (refer Tool Control Procedure).
• LAME 1 had performed adjustments to the main rotor pitch links and blade weights, and had asked LAME 2 to perform an independent inspection^[7] of the work after the second test flight. LAME 1 reported that the request had been for LAME 2 to both perform the independent inspection, and to check that no tools had been left on the helicopter.
• LAME 1 was not aware that the spanner that they had been using had been left on top of the main rotor blades.

LAME 2

• Also reported that a work pack had not been created for the job.
• Stated that prior to the third test flight, they (LAME 2) had completed an independent inspection of the maintenance tasks, performed by LAME 1.
• LAME 2 did not notice that the spanner had been left on top of a main rotor blade. They noted that the blade was very flat, and that it would not be possible to see it on top of the rotor blade from the ground.
• LAME 2 had tagged the spanner and several other tools out earlier in the day. The tools had not been returned to the toolbox during the day, as it was expected that further adjustments would be required.

Pre-flight inspection

The daily inspection had been certified in the aircraft technical log by an engineer prior to the first flight. Additionally, the pilot reported conducting a ‘walk-around inspection’ in accordance with the flight manual procedures. The pilot was aware that flight control maintenance had been conducted by the engineering group. The pilot signed the aircraft technical log and ‘accepted’ the aircraft prior to each of the three test flights.

The pilot reported that the aircraft handled normally throughout the three test flights.

Tool control procedure

While there was a practice of tool control in place prior to the incident, formal procedures had not been documented and incorporated in the maintenance organisation manual (MOM).

The tool control practice in place, prior to this incident, required that that each tool removed from the toolbox be tagged out by the person removing the tool. Each engineer was assigned a series of numbered tags of a certain colour, and the tag was placed into the ‘empty’ location (cut out) of the tool being used (Figure 2). A review of both the toolbox and the engineer’s assigned tags would quickly identify if any tools were still in use.

Figure 2: Tool control procedure showing coloured number replacing tool in use by the engineer assigned the blue coloured tags

Source: Operator

Operator procedures

The MOM stated that induction training of all staff shall be carried out on all new maintenance staff. This training was to provide staff with sufficient information to enable them to integrate into the company and to ensure compliance with the policies and procedures of the organisation. However, there was no written record of any such induction training having taken place.

ATSB comment

The organisation involved conducted a thorough internal investigation after this occurrence. There were a range of other issues identified in regard to training and documentation procedures, and the company have initiated remedial action in all these areas. These other issues do not fall within the scope of this investigation.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

The operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

Tool control procedure

A tool control procedure was in place at the time of the incident, however, the procedure had not been documented in the MOM. Additionally, there was no documented procedure requiring the tools to be returned to the toolbox prior to the aircraft being started.

The operator will incorporate the tool control procedure into the MOM. This procedure requires that all tools used during any aircraft maintenance are returned to the tool storage location prior to any of the company aircraft being started.

A tool control procedure will be implemented for any maintenance that occurs away from the main base. Additionally, a tool control procedure will be implemented to ensure external maintenance providers (for example avionics specialists) adopt the company tool control procedure.

Training for maintenance personnel

All maintenance personnel be provided with sufficient training and information to enable them to understand the workings of the organisation, its policies, manuals, procedures and their individual responsibilities.

Aviation Short Investigations Bulletin - Issue 48

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The Eurocopter Group was renamed Airbus Helicopters in January 2014.
2. The operator’s maintenance organisation manual required that a work pack for maintenance tasks be created by the Maintenance Controller
3. Refer to comments under LAME 1 and 2 who advise a work pack was not generated for this maintenance
4. The technical log provides a method of efficiently recording information, on one page, relating to the operation and maintenance status of the helicopter. It is accessible to flight crew and maintenance personnel.
5. The ground run/test flight sheet is used to record requirements for ground runs and check flights. The sequential number of the record is annotated in the appropriate section of the aircraft technical log.
6. 6The AS365 has a rotor system consisting of four main rotor blades. A 4P vibration is one that has a frequency of 4 per each revolution of the main rotor.
7. Civil Aviation Regulation CAR 42G required an independent inspection be conducted if any part of the flight control system has been disturbed

What happened

On 29 October 2015, a pilot who held a restricted pilot licence, and a flight instructor, prepared for a training flight at Camden Airport, New South Wales. The plan was to conduct circuits at Camden, in a Liberty XL-2 aircraft, registered VH-CZS (CZS). The pilot conducted a pre-flight inspection of the aircraft, with no defects found.

At about 1140 Eastern Daylight-saving Time (EDT), after the pilot had completed the normal pre-flight checks, and received the required air traffic control clearances, the aircraft took off for the first circuit. The pilot completed two normal circuits with touch-and-go landings on runway 06, and climbed out on runway heading for the third circuit.

During the initial climb, the pilot felt backward pressure on the control stick, and selected the electric pitch trim to a slightly nose down position. The aircraft was then in a stable climb, at an airspeed of 75 to 80 kt. As the aircraft passed about 500 ft above mean sea level (AMSL), the pilot retracted the flaps.

Passing about 700 ft, the pilot commenced a climbing turn onto the downwind leg. As the pilot rolled the wings level on downwind, the aircraft was still about 100 ft below the circuit altitude of 1,300 ft AMSL. The pilot therefore continued a shallow climb with the wings level, at an airspeed of about 95 kt. Suddenly, the control stick came back towards the pilot, and the aircraft pitched to a nose-up attitude.

The pilot pushed forward on the stick with both hands, to a full forward position. They also asked the instructor to adjust the pitch trim to a more nose-down position, to try to return the aircraft to a level attitude. The pilot stated there was something wrong and handed control of the aircraft to the instructor, who also assessed that there was a control issue. The aircraft descended rapidly in a nose-up attitude, and the aircraft then pitched nose-down.

The aircraft descended to about 700 ft, and the pilot broadcast a Mayday^[1] to the Camden tower controller advising them of a control issue. The controller asked whether they could make it back to land on runway 06, and the pilot replied ‘negative’. The pilot and instructor elected to conduct a precautionary landing in a paddock ahead of the aircraft. The instructor sighted powerlines and overflew them before extending full flap and landing in the paddock.

During the landing roll, the aircraft collided with two fences and came to rest in a stand of trees. The pilot and instructor were uninjured, and the aircraft sustained substantial damage (Figure 1).

Engineering inspection

An engineer conducted a post-accident inspection of the aircraft, and did not find any obvious defect that may have contributed to the control issue.

Figure 1: Accident site

Source: Insurance assessor

Pilot comments

The pilot and instructor provided the following comments:

• Once they had moved the trim to the full nose-down position, the instructor elected to leave it there and not try to move it, in case it made controlling the aircraft more difficult.
• The pilot initially assessed there was a problem with the stabilator, as it felt as if something had jammed in it.
• They assessed that it was preferable to land with a slight tailwind in the paddock, than to attempt to turn the aircraft and land into wind.
• At the commencement of the flight, the aircraft was about 20 kg below the maximum take-off weight and within the normal centre of gravity range.
• The aircraft flight manual included a checklist for partial control failure or malfunction, but they did not have sufficient time to access the manual during the incident. The checklist advised the pilot to check the trim setting and the circuit breakers, to control the aircraft with power and whichever controls were operational, and to land as soon as possible. The instructor also stated that they did not have time to check the circuit breakers, which were on the right side of the instrument panel.
• The instructor reported that as well as the pitch, or elevator, control issue, the aileron, or roll control felt overly sensitive. When the instructor applied light pressure to roll the aircraft to the left, it was overly responsive. This influenced the decision to land in the paddock ahead, rather than attempt to turn the aircraft into wind or to return to land on the runway.

Operator comments

The operator assessed that the way the pilots used the trim may have led to the control difficulties.

Safety message

The pilot and instructor both commented that their communication during the incident was very good, and that played a key role in getting the aircraft safely to the ground. Faced with an abnormal situation, the pilots communicated effectively, and collaborated to share the workload.

Aviation Short Investigations Bulletin Issue 46

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Mayday is an internationally recognised radio call for urgent assistance.

 

What happened

On 21 October 2015, a Gippsland Aeronautics GA-8 aircraft, registered VH-FGN (FGN), was conducting parachute operations at Busselton Airport, Western Australia (Figure 1). Prior to commencing the day’s operations, a company pilot conducted a pre-flight inspection of the aircraft, with no defects found.

Figure 1: VH-FGN

Source: Aircraft operator

At about 1500 Western Standard Time (WST), FGN took off from Busselton Airport with a pilot and seven parachutists on board. As the aircraft climbed through about 2,000 ft, the pilot observed a decrease in the engine manifold pressure. The manifold pressure was still in the green arc, or normal operating range, but indicating about 30 inches. The normal manifold pressure during the climb was about 38 inches. The fuel flow also increased from about 120 L/hr to 154 L/hr. As the aircraft was tracking south towards forested terrain, the pilot elected to turn back towards the aerodrome, and continue the climb, in case the engine issue worsened. The pilot conducted the standard engine checks, but the engine continued to produce only partial power. The pilot broadcast a Mayday^[1] on the Melbourne Centre air traffic control (ATC) frequency.

The pilot advised the parachutists that they would establish the aircraft in the drop run overhead the aerodrome at about 4,000 ft (instead of the planned FL 140^[2]) to allow the parachutists to exit the aircraft. As the pilot subsequently reduced engine power to allow the parachutists to exit the aircraft, the engine ran roughly. Six of the parachutists exited normally and landed safely at the drop zone, while the seventh, who was also a company pilot and seated in the front passenger seat, remained in the aircraft with the pilot in command.

The pilot then increased the aircraft’s power until the engine ran smoothly, although only producing partial power, while continuing the descent to the aerodrome. The pilot also advised ATC that they did not require immediate assistance and downgraded to a PAN^[3], as the engine continued to produce some power. The aircraft landed safely at Busselton at about 1514.

After shutting down the engine, the pilot consulted with the maintainer, and found that the intake tube on the No. 4 cylinder was loose.

Aircraft maintenance and engineering inspection

On 10 October 2015, a licensed aircraft maintenance engineer had completed a 100-hourly inspection on the aircraft, including a ‘top overhaul’ of the engine.

After the incident, the engineer completed the following:

• removed the bolts and inspected the wire thread (Helicoil) inserts, and found no damage
• fitted a new intake gasket and o-ring to the intake tube, and resecured the tube to the No. 4 cylinder with new spring washers
• checked the torque of all other intake tube bolts, and found none loose.

Safety message

This incident highlights the importance of having thoroughly rehearsed emergency procedures, particularly for parachute operations. The parachutists had, in accordance with standard procedures, removed the single point restraints during the climb, and were prepared to exit the aircraft quickly.

For pilots, this provides a reminder that constant monitoring of the engine instruments can provide early indication of a problem. Acting quickly on this information may reduce the impact of partial or total power loss on flight safety.

The ATSB publication Avoidable Accidents No. 3 – Managing partial power loss after take-off in single-engine aircraft, provides information also relevant to partial losses of power in flight as well as after take-off. Following a complete engine failure, a forced landing is inevitable. For a partial power loss, pilots are faced with deciding whether to continue the flight or land immediately.

Aviation Short Investigations Bulletin Issue 46

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Mayday is an internationally recognised radio call for urgent assistance.
2. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 140 equates to 14,000 ft.
3. An internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

 

What happened

On 10 September 2015, at about 0930 Eastern Standard Time (EST), an instructor and student pilot of a Cessna 172M aircraft, registered VH-EJM (EJM), were conducting circuits at Townsville Airport, Queensland.

The student was flying the aircraft and on mid-final for a touch-and-go landing on runway 07, when the instructor noticed a truck on the perimeter road, near the threshold to runway 07. The truck had not held at the stop sign. The stop sign required all vehicles to stop, look for aircraft, and not proceed unless there was no aircraft landing (Figure 1).

Shortly after the instructor sighted the truck, the Townsville Tower air traffic controller advised the pilots of EJM that there was a truck on the perimeter road. The instructor acknowledged the controller and they proceeded with the landing.

The aircraft conducted a touch-and-go and continued with several more circuits without incident.

Figure 1: Townsville airport perimeter road near runway 07

Source: Google earth, modified by the ATSB

Instructor and aircraft operator comments

The instructor commented that another vehicle on the perimeter road, ahead of the truck, also did not stop at the stop sign.

The operator reported this could potentially have been a more serious issue if the student pilot was conducting their first solo flight, as there would be greater risk that the student might get low on the approach and might not see the truck.

Department of Defence investigation

The Department of Defence conducted an investigation into the serious incident. They determined that a contractor, driving a truck on the western perimeter road, failed to stop at the stop sign near the threshold of runway 07. VH-EJM missed the top of the truck by about 4 to 5 metres and the aircraft landed without incident.

The Department of Defence also conducted a subsequent investigation into an incident where a contractor driving a truck on the western perimeter road failed to stop at the stop sign near the threshold of runway 07. The pilot of a Cessna C172RG aircraft that was on short final, saw the truck coming towards their approach path and informed air traffic control. Air traffic control acknowledged the transmission. The truck stopped almost directly under the path of the arriving aircraft and the aircraft landed without incident.

The investigation determined that the stop signs located on the perimeter road on approach to runway 07 provided drivers with clear direction to stop, observe and give way to approaching aircraft. The failure of the drivers of the vehicles in these incidents to observe those protocols created the potential for a collision between the vehicle and the aircraft.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Department of Defence

As a result of this occurrence, the airport operator has advised the ATSB that they are taking the following safety actions:

• briefing material for contractors has been updated placing greater emphasis on safety around runways.
• flashing lights have been installed on the stop signs, for the under-run service road, to improve observation of the sign by drivers.

ATSB comment

At the time of writing this report, two other similar events occurred on 8 and 10 December 2015. The occurrences were subsequent to the update of briefing material for contractors and the installation of flashing lights on the stop signs. The Department of Defence are conducting a review of their safety actions to see if there are any other options to prevent a re-occurrence.

Safety message

The International Civil Aviation Organization (ICAO) has identified runway safety as one of its priorities and has been working with countries and aviation organisations globally to reduce runway safety accidents. ICAO has developed a runway safety website, which offers a range of information and products to assist the aviation community to improve runway safety.

In addition, ICAO has published a Manual on the Prevention of Runway Incursions Doc 9870 AN/463, available from the ICAO website. The manual includes information on the prevention of runway incursions. The manual discusses that deficiencies in design, training, technology, procedures, regulations and human performance can result in a system break down and safety being compromised. A pilot, as part of the last line of defence, cannot assume that anyone will do the right thing, like the driver of the truck stopping at the stop sign, and they need to be prepared to re-evaluate the planned flight.

Additional information on runway safety is also available from the Airservices Australia webpage Runway safety.

In addition, Airservices Australia has published a guide for airside drivers, The Airside Drivers Guide to Runway Safety, which focuses on four aspects of operating safely on an aerodrome:

1. planning your aerodrome operation
2. aerodrome procedures
3. communications
4. aerodrome markings, signs and lights.

Aviation Short Investigations Bulletin Issue 46

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.