Safety summary

What happened

At 2026^[1] on 8 November 2014, train 735, a TasRail intermodal freight service, departed Burnie bound for Brighton in Tasmania. The train travelled to Conara Junction and stopped to complete a scheduled change of driver. At 0303 on 9 November 2014, train 735 resumed its journey to Brighton.

After passing through the Rhyndaston tunnel, the train commenced its descent into Colebrook. During the descent, the driver noted that the train was travelling at below the track speed limit at 20 km/h and took actions to speed the descent. Subsequently, the train rapidly accelerated to above the track speed limit, and at 0521 it derailed at the 64.7 km mark near Colebrook after failing to negotiate a left curve in the track.

The derailment caused extensive damage to both locomotives, the nine wagons and the track.

What the ATSB found

The ATSB found that the driver’s delayed reaction to the acceleration of train 735 allowed it to travel at an excessive speed of 65 km/h in a section of track with a 35 km/h speed limit around a track curve located at the 64.7 km mark. The train’s excessive speed as it traversed the curve, created forces that caused the locomotives and wagons to roll over and derail. It was apparent that the driver of train 735 made inappropriate decisions regarding managing the momentum of descent.

Examination of TasRail’s driver training, competency assurance and fatigue management processes found no inadequacies that could be held as contributory to the driver’s handling of the train during the descent. Accordingly, and based on the available evidence, it appeared that the erroneous train handling techniques applied in this case were atypical and not reflective of training delivered by TasRail or the broader capabilities of its drivers.

What's been done as a result

TasRail has developed further strategies to ensure train drivers have, and are able to maintain, adequate route knowledge, situational awareness and train management skills. TasRail also implemented an advanced train control system, which provides for improved monitoring of rail vehicles, including train handling (over-speed) alarms/alerts to both the driver and train controller.

Safety message

Safely negotiating a train’s passage over undulating terrain relies heavily on the train driver closely and continually monitoring the train’s performance; proactively applying the appropriate handling techniques and driving strategy to ensure train speeds remain within prescribed limits at all times.

Location map – Tasmania

Source: NatMap Railways of AustraliaTasRail Network

__________

1. The 24-hour clock used in this report is Australian Eastern Daylight Time (EDT).

The occurrence

At 2026^[2] on 8 November 2014, train 735, a scheduled intermodal freight service operated by TasRail as a driver-only operation^[3], departed Burnie, bound for Brighton (south of Brighton) in Tasmania. At 0300 on 9 November, there was a scheduled change of drivers at Conara Junction, with the new driver to take the train through to Brighton.

Conara Junction is approximately 140 km from Brighton by rail and most of the journey is over rolling tablelands with gentle grades. The last 40 km of the journey includes a 13 km descent into the Coal River Valley, most of which has a posted track speed of 35 km/h due to the steep grades and tight radius curves.

The passage of train 735 from Conara Junction to Rhyndaston Tunnel (the top of the descent) was uneventful. At 0512, the driver called Train Control, reported the train clear of the tunnel, and then commenced descending the grade using the locomotive dynamic brake^[4].

At 0516, the train crossed the level crossing at Mud Walls Rd, at a speed of 30 km/h. The train’s data logger showed that shortly thereafter, the speed had dropped to 20 km/h and the driver disengaged the dynamic brake and increased the throttle.

Once in power, it took 34 seconds for the train to accelerate to 39 km/h, and in an attempt to slow the acceleration, the driver reduced the throttle. This action did not slow the train and it continued accelerating.

At a speed of 54 km/h, the driver attempted to regain control of the train by moving the throttle from power into dynamic brake. During the transition from power to dynamic brake, the train continued to accelerate and reached a speed of 58 km/h before the recorded data showed a partial service brake application.

At around 0521, train 735 entered a series of adjoining curves with both the service and dynamic brakes applied. The train continued to accelerate and gain momentum; reaching a peak speed of 65 km/h as it crossed a short bridge near the exit of a curve at the 64.7 km mark near Colebrook.

As train 735 traversed the curve at speed, it was unable to maintain normal contact with the rail. Consequently, both locomotives and the following four wagons rolled onto their sides and came to a rest in the cess drain on the right hand side of the track. The force generated during the derailment sheared the draft gear of locomotive TR07, which detached it from TR10. That same force also caused locomotive TR07 to uncouple from the rest of the train. At some stage, during the derailment, the train brake pipe was severed which initiated an emergency brake application.

A further five wagons also derailed, but remained within the ballast area of the track formation. Many of the containers from the derailed wagons sustained damage and some were cast down the railway embankment. The remaining seven wagons at the end of the train did not derail and were undamaged.

Figure 1: Locomotives TR10 and TR07 with wagons of train 735 at the derailment site

Image shows the lead locomotive (TR10) and trailing wagons having tipped onto their side after attempting to traverse a left-hand curve. The driver (who sustained minor injuries) was able to exit the locomotive via the front windscreen, which is designed as an emergency exit. Source: ATSB

Events post-derailment

The TR class locomotives include a feature that automatically notifies train control of an emergency brake application. Having received that alert from locomotive TR10 resulting from the derailment, the train controller^[5] attempted to call the driver of train 735. The driver reported hearing the call, but was unable to find the radio microphone within the overturned locomotive cab and was unable to respond. However, the driver did subsequently locate a mobile phone and used it to contact the train controller and report the emergency. During the conversation, the driver advised having sustained minor injuries.

The driver reported being able to escape the locomotive cabin through an emergency exit^[6], with the train’s dangerous goods cargo manifest in hand. The train controller commenced notifying emergency services and TasRail first responders, while the driver checked the train to ascertain the extent of damage and the state of the dangerous goods freight. Subsequently, the driver notified train control that a quantity of leaded petrol had been spilled, however there had not been a fire. Train control informed the Tasmania Fire Service, which dispatched a team to manage the spill.

__________

2. The 24-hour clock used in this report is Australian Eastern Daylight Time (EDT).
3. Driver-only operation means there is only one person in the cab of the locomotive who is responsible for the operation of the train.
4. Dynamic brake is the use of the locomotive’s traction motors to effect braking. The traction motors become generators and the power generated is converted to heat that is dissipated through fan-cooled resistor grids in the locomotive.
5. The train controller was located at the TasRail Train Control Centre in Launceston, Tas.
6. TR class locomotive windscreens are designed for removal as an emergency exit. In this case, the driver had some trouble removing one window due to a dash-mounted camera, but managed to push out the other window, against the dirt piled up on the outside.

Context

Incident location

The derailment occurred at the 64.7 km mark on the Tasmanian South Line, approximately 2 km north of Colebrook and approximately halfway down the 13 km descent that starts at the Rhyndaston Tunnel.

The posted track speed alternates between 35 and 40 km/h over the course of the descent. The approach to the derailment site had a listed track speed of 35 km/h, increasing to 40 km/h soon after exiting the curve.

Environmental conditions

Recorded weather observations for the morning of 8 November 2014 from the Bureau of Meteorology weather station located at Tunnack, Tasmania showed a maximum temperature of 18.1°C at 0900 with strong Northerly winds gusting to 72 km/h.

The ATSB discussed these conditions with the driver of train 735 and determined that it was unlikely that they had contributed to the derailment.

Train information

Train 735 was a regular freight service operated by TasRail between Burnie and Brighton. The TR class locomotives generally hauled these trains.

On 8 November 2014, train 735 departed Burnie with two locomotives (TR10 leading, TR07 trailing) and 30 wagons. The majority of the wagons were new TQAY two-unit^[7] vehicles, with the remainder a mixture of older container wagons, including QLE and QL types. At Western Junction, en route to Brighton, the train crew decoupled 14 wagons and then continued the journey with the remaining 16 wagons. Four of the 16 wagons remaining in the consist were the older QLE or QL types. These wagons have a different brake application and release rate to the new TQAY wagons and thus the Train Manifest Report included the following train operational advice:

DANGER – INCREASED RISK OF DERAILMENT

Due to differing brake application and release rates your train may be subject to high in train forces.

DO NOT release brake applications of less than 100kPa at less than 20 km/h – Wait for the train to stop.

The train has a high power/weight ratio. You must consider shutting down or turning off excess power.

The train has a high-proportion of dual-stage brake wagons, brake applications greater than minimum will be required to control the train.

All wagons were loaded and conventionally arranged such that the heavier wagons were to the front of the consist and the lighter wagons to the rear. Two of the heavier wagons were carrying containers filled with leaded petrol (classed as a dangerous good); one of these wagons derailed and leaked after the derailment. None of the wagons on train 735 had any defects identified for repair.

Driver information

At the time of the derailment, the driver of train 735 had been working with TasRail for 13 months; having previously trained as a driver and driven trains in Queensland. At the time of the derailment, the driver held all necessary competencies and authorisations.

After the derailment, the driver underwent drug and alcohol testing, the results of which were negative.

Track information

The Tasmanian South Line opened in November 1876 and consists of narrow gauge track that has sections of steep gradients and sharp curves.

The descent from the Rhyndaston Tunnel into Colebrook and the Coal River Valley has many tight radius curves and drops 200 m over its 13 km length, with grades ranging from 1:125 to 1:31^[8].

The 1500 m of track leading into the derailment site flattens in grade from 1:41 to 1:100. The derailment occurred at the end of the 1:41 grade where it flattens out to 1:125.

The derailment occurred on a compound curve^[9] of 190 m radius, tightening to 110 m radius in the direction train 735 was travelling.

The mandated track speed though the compound curve was 35 km/h.

Track design

The track on which a train travels is an alignment and is described in two dimensions. First, the horizontal alignment defines where the track goes. The second component is vertical alignment, which defines the track’s elevation (rise and fall).

A railway is a guided transportation system. That is, a train driver only has direct control over the speed and forward/reverse directional aspects of train movement over an alignment defined by the track.

As any rail vehicle in motion traverses a curve, the vehicle transmits a centrifugal force to the rail at the point of wheel contact. This force is a function of the curve radius and superelevation^[10], speed and mass (weight) of the vehicle, and acts at the centre of gravity of the rail vehicle.

To determine track speed limits, operators and infrastructure managers consider both the type of rail traffic and the track alignment. To ensure the safe passage of rolling stock, operators/drivers formulate driving strategies and apply the necessary train handling skills to ensure the train speed remains within the track limits.

The importance of remaining within track speed limits is particularly relevant when traversing a track curve. By travelling at, or below the maximum allowable track speed, the vehicle stays within the tolerances allowed for centrifugal force. The faster a vehicle travels the more likely it is to derail, either through flange-climb or through overturning.

The point of derailment for train 735 was at the 64.7 km mark, on the exit of a 110 m radius track curve with a maximum allowable speed of 35 km/h.

In 2013 and 2014, a capital works project upgraded the track in the area leading up to the point of derailment. During those works, TasRail installed concrete sleepers and replaced the existing rail with continuously welded 41 kg/m rail. Taking into account the maximum allowable speed of 35 km/h, the ATSB considered that the specifications for the track infrastructure and curve were adequate to facilitate normal operations. There was no evidence to indicate that the track had any existing defects or anomalies that could have contributed to the derailment.

The derailment of train 735

Figure 2: Sequence of events for the derailment of train 735

The image shows an aerial view of the track from Richmond Road (top) and a track geometry graph showing gradient, curvature and posted track speeds. The annotations show driver actions and track speed (obtained from locomotive data loggers) at the key points during the train’s descent and subsequent derailment (bottom). Source: Google Earth and TasRail

At 0519 on 9 November 2014, train 735 traversed the track section between the Rhyndaston Rd and Richmond Rd level crossings – a fall in elevation of about 90 m over a distance of approximately 4 km. It crossed Richmond Rd at a speed of 35 km/h with its speed slowed by the locomotives’ dynamic brake. At this time, the train was travelling within the maximum speed limit of 35km/h and was under the driver’s control.

About 500 m later in its descent, the train travelled through a short section of flat terrain and slowed to 21 km/h. The driver chose to move out of dynamic braking and into throttle position 3 and, in doing so, caused the train to accelerate (Figure 2).

Train 735 accelerated from 21 km/h to 54 km/h over a distance of about 700m, before the driver moved the throttle from position 3 to 1. At 54 km/h, train 735 was travelling at 19 km/h over the maximum allowed track speed and in the midst of a track curve with a 179 m radius. The high train speed combined with the track curve radius significantly increased the risk of derailment.

By the time the driver actively attempted to slow the train, it had reached 58 km/h. At this time, the driver moved the throttle from position 1 into full dynamic brake and made a ‘service’ application of the train brakes.

The movement of the throttle from position 1 to full dynamic brake at a speed of 58 km/h did not allow sufficient time for the locomotive to go through the required transitional set-up phase. During this transition phase, the dynamic brake does not take effect, as the locomotive needs to reverse the polarity of its traction motors and effectively turn them into generators before being able to retard the momentum of the train.

Further, the service application of the train brake requires time for the air pressure to reduce in the train brake pipe and allow the wagon brakes to take effect.

By the time the driver attempted to slow the train, it was out of control and rapidly descending the grade towards Scotts Rd.

The train reached a maximum speed of 65 km/h as it exited the compound track curve located at the 64.7 km mark. It was at this location that the wagon immediately behind the locomotives derailed by rolling off the track. The rolling of this wagon transferred forces through the couplers to the locomotives ahead and the wagons immediately following it. This rolling force, in conjunction with the outward centrifugal forces acting on the vehicles themselves allowed both the locomotives and the three wagons following to roll onto their sides and derail to the right hand side of the track on the outside of the curve.

Driver performance

The sequence of events in the moments leading up to the derailment suggested the driver had a delayed response to visual indications of the train’s performance and speed. Further, the driver’s decision-making in relation to train handling appeared to lack an appropriate consideration or understanding of the train’s braking characteristics. The ATSB explored possible reasons for this and reviewed the driver’s operational knowledge, work schedule and the effects of fatigue on human performance.

Fatigue

In the context of human performance, fatigue is a physical and psychological condition primarily caused by prolonged wakefulness and/or insufficient or disturbed sleep.^[11] Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, increased errors of omission and an increase in the level of acceptable risk that is tolerated.^[12] Fatigue impairment has been identified as a causal factor in many rail accidents and incidents.

It is generally agreed that most people need at least 7 to 8 hours of sleep each day to achieve and maintain maximum levels of alertness and performance. In this case, the derailment occurred on what was the driver’s third successive night shift. The driver had finished work at 0815 on 8 November and started the next shift (in which the derailment occurred) at 2359. The driver reported that during the intervening rest break on 8 November, they had obtained approximately 9.5 hours of good quality sleep, in two blocks from 1030 to 1400 and from 1930 to 2200. They reported obtaining approximately 6.5 hours of sleep during the rest break on 7 November, totalling 16 hours of sleep for the 48 hours before the occurrence. The driver reported feeling alert at the start of the shift.

Based solely on sleep obtained, the driver would not appear to have been at an increased risk of fatigue-impaired performance. However, while hours of sleep is a primary determinant of fatigue impairment, there are other factors which can influence fatigue, including time of day of both sleep and work. To assist with assessing fatigue likelihood based on these factors, the driver’s work schedule and reported sleep were modelled using biomathematical fatigue prediction modelling software^[13]. The analysis suggested that a person exposed to this work and sleep schedule would, during the entire occurrence shift, be at least mildly affected by fatigue and be deteriorating as the shift progressed. The modelling suggested that a reaction time in the range of 1.4-times that of a well-rested person could be expected at the time of the derailment.

Considering these factors, it appears possible that the driver’s performance was mildly affected by fatigue – attributable to time of day effects after driving continuously for 5.5 hours through the night. This to some extent might explain the driver’s slowed response to the visual cues presented during the critical moments of the train’s descent. However, it is important to note that the actions required for managing a train’s descent through this area is largely not time-critical whereby reaction time has a significant influence, and considering the driver’s reported alertness, the ATSB considered that driver fatigue impairment was not a factor in the development of this occurrence.

Operational knowledge

While the driver had a good general operational understanding, they did lack some technical knowledge of the train’s specific characteristics which may have contributed to the decision-making process during the descent and immediately prior to the derailment. This was especially evident in the driver’s management of the locomotive throttle and dynamic brake.

The driver’s decision to move from dynamic brake application to throttle position 3 took place at a critical point in the descent. The driver, upon reflection on the incident, believed that had they not moved into throttle, the train would have slowed to a stop. Records of other train descents of the same grade suggest otherwise.

Records of descents made by other trains show that those drivers controlled their train’s descent, by modulating the dynamic brake or using a combination of service brake and dynamic brake. In doing so, the train maintained a reduced speed for a short period before accelerating down the falling grade with the driver countering the acceleration by increasing the level of dynamic braking.

In summary, it was apparent that the driver of train 735 made inappropriate decisions regarding managing the momentum of descent, especially with respect to the train braking techniques required when descending the grades from the Rhyndaston Tunnel into Colebrook. This ultimately led to the train’s derailment at the 64.7 km mark near Colebrook, Tasmania.

__________

7. A wagon consisting of two permanently coupled platforms, each platform independently supported on a pair of bogies.
8. The grade of the railway is expressed as the vertical rise (or fall) per unit of distance.
9. A compound curve comprises of two or more differing radii but in the same direction.
10. The height difference, at a common location, between the running surfaces of two rails. Similar to the camber of a roadway.
11. National Transport Commission, 2008. National Rail Safety Guideline. Management of Fatigue in Rail Safety Workers.
12. Battelle Memorial Institute 1998, An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, US Federal Aviation Administration.
13. The Fatigue Avoidance Scheduling Tool (FAST), and the Fatigue Risk Index (FRI).

Safety analysis

Train handling

The management of a train’s movement along a track alignment is the core skill set of train drivers and commonly referred to as ‘train handling’.

In essence, good train handling is the accurate use of locomotive controls to limit the amount of in-train forces while moving the train in a specific direction at a designated speed. Accurate use of the locomotive controls requires the driver to have sound technical and practical knowledge of a locomotive’s capabilities. A driver’s knowledge base is formed at the beginning of their career. It is then developed over time by working with different types of locomotives over varying networks.

Train 735’s driver had worked for another operator and driven trains for 5 years prior to arriving at TasRail. Those trains were consistent in length and weight and operated over the same track sections for every journey. The typical type of learning undertaken by the driver prior to arriving at TasRail relied on the acquisition of knowledge by rote learning^[14]. This is in contrast to learning with comprehension and understanding, where a driver is equipped to apply knowledge to tasks requiring a particular or unique solution, rather than one that has been learned only by repetition.

This form of learning from their previous role may have influenced the driver’s actions during the descent toward Colebrook. However, when transferring to a different rail operator, drivers are normally required to undertake further training to ensure competency against operator specific safety management systems, including the operational environment. The ATSB examined TasRail’s training systems in relation to route knowledge and train handling through the area of the derailment.

TasRail training

To supplement the driver’s knowledge of the locomotive controls and improve train-handling ability, drivers routinely complete route knowledge training.

Route knowledge training involves the driver trainee travelling (as an observer) over designated routes with a more experienced and competent driver. During each journey, an instructor^[15] will provide train handling advice and other general information relating to the section traversed. At the commencement of the training program, the instructor or training coordinator provides the driver with documentation containing route maps and other necessary information relevant to the sections over which the driver will be operating. During the training, the driver can make notes that are relevant to the driving strategy they have developed by combining their train handling ability with the learned route knowledge.

At the completion of the training program, the driver will demonstrate train handling ability and route knowledge during a practical assessment. At the completion of the assessment, the driver is debriefed and, in consultation with the instructor, decides whether they are confident and competent to commence full mainline operations. To ensure skill maintenance and development, a driver will complete ongoing annual assessments of route knowledge competency and driving strategy.

The ATSB’s review of TasRail’s training documentation for train 735’s driver indicated that the training methodology described had been followed and the driver recorded as achieving satisfactory competencies.

During initial enquiries, the driver of train 735 informed the ATSB of signing the route knowledge and competency documentation. Further, the driver stated that they were confident in their ability to safely manage the journey of a train over the TasRail network.

However, at interview, and after having time to reflect on the incident, the driver advised the ATSB that they probably should not have signed the competency. The driver attributed this to the:

• undulating terrain,
• age of the infrastructure,
• constant change in instructor during the training period
• questions about the time taken, and
• lack of opportunity to drive during the training period.

At the commencement of the training period, the driver recalled being supplied with route maps and gradient diagrams by an instructor. However, the single page (A3) document provided limited detail. Over the subsequent 21 trips during this training period, the driver considered the document to be hard to read especially while driving, so chose not to use it.

The ATSB made further enquiries to verify TasRail’s practical application of its training methodology and driver accreditation practice. The ATSB found TasRail’s training documentation and training delivery to be generally consistent with industry practice and sufficient for training drivers operating over their network.

In the months leading up to the derailment, after signing off as having learned the route, the driver made multiple trips in varying train types and lengths along the network section where the derailment occurred. The driver made these journeys without incident and did not report any difficulties in negotiating the section. Further, TasRail did not have, nor did the driver produce, any evidence to suggest the driver had trouble driving trains along any part of the TasRail rail network.

The ATSB compared records of descents by other trains, down the same grade by other drivers, in the days prior to the derailment. Records indicate that all other drivers routinely applied a similar driving strategy and were able to control train speeds predominantly by use of the locomotives’ dynamic brake.

The locomotive operational data (from multiple descents) suggested that TasRail drivers generally apply consistent and appropriate train handling techniques when traversing that track section.

However, the strategy applied to the train 735’s descent on 9 November 2014 was different. The driver placed the locomotive throttle into position 3 at a critical time in the descent and allowed the train’s speed to increase to 54 km/h before taking any corrective action. Further, the action taken was not sufficient to arrest the train’s acceleration and it reached a maximum speed of 65 km/h before derailing as it traversed the curve.

Consideration was given to the fact that the derailment occurred over a section of track where the driver of train 735 had safely negotiated the descent of multiple trains in the six months prior to the derailment. It was only in this specific instance that evidence suggested the driving strategy was different and that proved to be critical to the derailment of train735.

Despite the ATSB’s inquiries, it was unclear why the driver had handled the train in this manner during the descent on 9 November 2014.

__________

14. Rote learning is the memorization of information based on repetition.
15. A suitably qualified and experienced train driver or driver trainer.

Findings

From the evidence available, the following findings are made with respect to the derailment of train 735 near Colebrook, Tasmania on 9 November 2014. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• Train 735 derailed due to excessive speed through a track curve at the 64.7 km mark.
• The driver of train 735 did not demonstrate effective train handling techniques at critical moments when descending the grades from the Rhyndaston Tunnel into Colebrook. This was especially evident in the application of locomotive throttle at a critical point in the descent.

Other findings

• The ATSB found no evidence to suggest that the driver of train 735 had received insufficient training or had previously experienced any difficulty in driving trains along any part of the TasRail network.
• There was no evidence of any defects or anomalies in the track at the 64.7 km mark that could have contributed to the derailment.
• There was no evidence of any fatigue-related issues that may have contributed to the inappropriate train handling techniques applied by the driver in this case.
• The locomotive data logs from a number of previous descents, by other trains and drivers, demonstrated consistent and appropriate train handling techniques.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence

Proactive safety action taken by TasRail

1. In response to the derailment near Colebrook, TasRail has taken the following action:
2. Following the derailment, TasRail developed strategies to ensure train drivers have, and are able to maintain, adequate route knowledge, situational awareness and train management skills. TasRail also implemented a regular audit of data from locomotive data loggers and developed a policy with respect to the use of electronic mobile devices.

• TasRail has since invested in an Advanced Network Train Control System (ANCS). The benefits include:
• Fully automated system, reducing input/output errors and substantially reducing safe working breaches
• Provides full visibility of all vehicles on the network in real time
• Enables early intervention to prevent incidents from occurring or to reduce the severity of incidents
• Reduces the risk of an on-track collision and/or derailment
• Improves train speed compliance through recording of speed and location data. Will send train handling alarms/alerts to the Locomotive Driver (and the Train Controller) – for example if a train is travelling over speed limits
• Improved capacity to manage and monitor track work and train working by streamlining the transmission and authorisation of network access authorities
• Increases productive track access time, significantly improving the efficiency of infrastructure maintenance and upgrade activities
• Fuel savings from reduced track access downtime
• GPS positioning increases the accuracy of information
• Operational efficiencies from improved freight movements and reliability of train operations
• Capability to introduce a ‘track and trace’ data facility for customers
• Provides Train Controllers with an improved working environment (previous system required an excessively high reliance on procedural compliance)

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Bureau of Meteorology
• TasRail
• National Guideline Glossary of Railway Terminology Version 1.0, 3 December 2010 Railway Industry Safety and Standards Board of Australia (RISSB)

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the driver of train 735, TasRail, and the Office of the National Rail Safety Regulator (ONRSR).

Submissions were received from TasRail, and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Contact with the wharf by Big Glory

A limited-scope, fact-gathering investigation into this occurrence was conducted in order to produce this short summary report and allow for greater industry awareness of potential safety issues and possible safety actions.

What happened

At 0706[1] on 20 November 2014, two port pilots boarded Big Glory (cover) off Cape Flattery (Figure 1), where the ship was to berth for loading silica sand.[2] The pilot assigned to the pilotage task was very experienced and had performed about 70 pilotages into the port, including about 15 on Big Glory. As he was returning after 6 months leave, procedures required that he undergo a check pilotage.

Figure 1: Cape Flattery

Source: ATSB

Figure 2: Big Glory’s planned and actual positions

Source: Maritime Safety Queensland with ATSB annotations

Once on the ship’s navigation bridge, the pilot exchanged information with the master and discussed the pilotage plan (Figure 2). The pilot advised that the current in the area was flowing northeast[3]  at 0.2 knots[4] and high tide was at 0755. The wind at the time was from the southeast at 15 knots. The master confirmed that all the ship’s equipment, including the main engine, was in order. The officer of the watch and the seaman steering the ship were the other members of the bridge team.

At 0715, the pilot took over the conduct of Big Glory with the check pilot observing. He manoeuvred the ship onto the line of the approach leads using visual cues and the ship’s radar while progressively reducing its speed.

By 0740, the ship was positioned along the line of the approach leads about five ship lengths (about 1 km) from the wharf (Figure 2). Its speed was about 3.4 knots and decreasing with the main engine stopped. The pilot established radio contact with the loading supervisor on the wharf and asked him to report as the ship’s bow passed each breasting dolphin (BD) there. [5]

At 0744½, the ship’s speed had decreased to about 2.6 knots and the main engine was run dead slow ahead. Two work boats also arrived near the ship to assist, mainly to assist running mooring ropes when berthing. The port has no tugs and the workboats have limited tug ability.[6]

By 0746½, Big Glory’s speed had increased to about 3.5 knots. The main engine was stopped and then run dead slow astern. The pilot felt that the ship’s speed was not decreasing as expected and he was concerned the ship would overshoot the planned anchor let go position. Hence, main engine power was progressively increased, including about 30 seconds at full astern.

At 0749, the main engine was stopped and the ship was no longer moving ahead. At about this time, the wharf supervisor reported to the pilot that the bow was in line with BD1 (Figure 2). The pilot asked the master to have the crew standby to let go the port anchor.

At this stage, the pilot observed Big Glory being ‘rapidly set on to the wharf’ and considered aborting the berthing. He decided against aborting because he was certain that the ship’s ‘stern would make substantial contact with the wharf’.

A few seconds after 0749, the main engine was run ahead in an attempt to gain headway and manoeuvre Big Glory to the planned anchor let go position some 150 m ahead. The engine was run ahead at up to half power until shortly before 0751, when it was stopped. The ship’s bow was now about 60 m from the wharf and about 100 m away from the planned anchor let go position.

At 0751, the pilot asked for the port anchor to be let go and held on to with two shackles[7] on deck. The main engine was ordered astern and power progressively increased to full astern before it was stopped shortly after 0752. The ship’s headway reduced as it moved towards the wharf.

At about 0754, Big Glory made contact with the dolphin (Figures 2 and 4). The ship’s hull, at the aft end of number one cargo hold, was damaged about 1.5 m above the ballast water line. The shell plating was set-in in two locations about 1 m apart (Figure 3). Part of a steel bracket on the dolphin penetrated the plating leaving a hole about 180 mm x 60 mm. The bracket was partially torn off and the deck plating on the dolphin was dislodged (Figure 4).

Figure 3: Damage to the ship’s hull Source: Maritime Safety Queensland

Figure 4: Damage to the dolphin Source: Maritime Safety Queensland

Shortly afterwards, the wharf supervisor asked the pilot to move the ship clear of the wharf to allow an inspection of the damage to the dolphin. At 0756, the pilot began manoeuvring the ship off the wharf using the workboat forward to push on the starboard bow while heaving the anchor.

At 0810, Big Glory was clear of the wharf. The pilot handed over conduct of the ship to the check pilot and the ship was moved to a safe location within port limits.

At 1306, after some minor repairs to the dolphin were complete, the check pilot started manoeuvring the ship back to the berth. By 1420, the ship was all fast alongside the wharf.

On 25 November, temporary repairs to Big Glory’s hull to allow it to sail on the next voyage were completed. Subsequently, the ship loaded its cargo.

Maritime Safety Queensland investigation

Maritime Safety Queensland (MSQ), the regulatory agency responsible for pilotage at Cape Flattery, conducted an internal investigation into the incident that concluded that the pilot’s loss of situational awareness and error of judgment were the main contributing factors to the incident.

ATSB comment

As Big Glory approached the planned anchor let go position, astern propulsion was used for 90 seconds because the pilot felt that the ship’s speed was not decreasing. However, its speed was decreasing, and the ship stopped 150 m short of the anchor let go position. Ahead propulsion was then used for 90 seconds before the port anchor was let go in a position much closer to the wharf than planned (60 m instead of 150-160 m). The particular combination of the ships’ main engine and rudder movements in the prevailing wind and current resulted in a lateral movement (to starboard) towards the wharf. The use of two shackles of anchor cable as planned suggests that adjusting anchor/cable use to recover from the uncontrolled situation was not considered. Subsequently, the ship’s hull contacted the mooring dolphin with sufficient force to damage its shell plating and the dolphin. The pilot’s perception of the ship’s movement during the critical stages of the approach to the wharf is indicative of his situational awareness at the time.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Maritime Safety Queensland

As a result of its investigation, MSQ’s safety action included the following recommendations:

Pilotage procedures

• A review of the Cape Flattery pilotage plan to include an ‘abort’ position and a more accurate track to the ‘anchor position’.
• Portable pilotage unit (PPU) usage to be made compulsory for all Cape Flattery berthings.
• A requirement for pilots returning from leave exceeding 4 months to complete at least three mentored trips (inward) before undergoing a check pilotage.

Safety message

Bridge resource management (BRM) is critical to safely managing risks in a pilotage. Key elements of BRM include proper planning, execution and monitoring using all available resources. The use of electronic aids to navigation to support traditional methods of pilotage and navigation can significantly enhance the position monitoring ability and situational awareness of the bridge team and, thus, reduce the risk of an incident.

The ATSB SafetyWatch initiative highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. Maritime pilotage is one of the safety concerns, with further information available from the ATSB’s website.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     All times referred to in this report are local time, Coordinated Universal Time (UTC) + 10 hours. Wherever possible, these times are as recorded by Big Glory’s voyage data recorder (VDR).

[2]     Cape Flattery is the world’s largest silica sand export port currently exporting about 1.7 million tonnes per year.

[3]     The current was actually flowing southwest (the graph provided to the pilots by the port before they boarded indicated that the direction and speed of the current at 0530 that day was 225º at 0.15 knots).

[4]     One knot, or one nautical mile per hour, equals 1.852 kilometres per hour.

[5]     A dolphin is a structure separate to the wharf, against which a ship can lie or its mooring lines can be run to.

[6]     The bollard pull of the workboats attending the ship forward and aft was 17 t and 12 t, respectively.

[7]     One shackle equals 90 feet or 27.43 m.

What happened

On 18 November 2014, at about 1728 Central Standard Time (CST), a Robinson R22 helicopter, registered VH-HPH (HPH), departed from La Belle Downs Station, Northern Territory, for a local flight to check the progress of a bush fire, with the pilot and one passenger on board.

About two minutes into the flight, on climb and at about 300 ft above ground level, the pilot felt a vibration through the tail rotor pedals. The pilot decided to return to La Belle Downs station, turned the helicopter to the right and started a descent. The pilot was unable to stop the turn and the helicopter continued to descend and turn to the right. The helicopter started to spin in a tight circle and completed between five and six rotations before landing hard, bouncing once and then coming to a stop. The pilot performed the shutdown procedure and the pilot and passenger exited the helicopter. The pilot and passenger were uninjured. The helicopter was substantially damaged, including damage to the tail boom and both skids.

Pilot comment

After landing, the pilot observed that the tail rotor pitch link^[1] had failed (Figure 1).

Prior to the first flight of the day, the pilot reported carrying out a daily inspection without finding any defects. The pilot had then flown HPH for approximately 2 hours, prior to the accident flight.

Figure 1: Failed tail rotor pitch link

Source: Aircraft operator, annotated by the ATSB

Operator investigation

An examination of the tail rotor pitch links was conducted on behalf of the helicopter operator by a consultant in engineered-system failure analysis and the following was found (Figure 2):

• Alternating stress in the failed pitch link resulted in the initiation and propagation of a fatigue crack.
• The alternating stress in the pitch link resulted from failure of the spherical bearing to provide a low friction connection between the end of the tail rotor blade and the pitch link.
• The failed pitch link spherical bearing attached to the tail rotor had extensive wear. Axial wear of the spherical bearing was measured to be about 0.108 inch (2.743 mm).
• The intact pitch link spherical bearing attached to the tail rotor also showed signs of extensive wear. Axial wear of the spherical bearing was measured to be about 0.041 inch (1.041 mm).
• The factors that influence the rate of wear in the spherical bearing that attaches the tail rotor blade to the pitch link would not be expected to vary from helicopter to helicopter.
• No physical explanation was found as to why the specified inspection procedures (R22 Maintenance Manual, Chapter 2 Inspection, section 2.410) failed to detect bearing wear. Possible explanations beyond what could be ascertained by the examination were that the helicopter was operated in an exceptionally abrasive environment or the Teflon bearing lining was affected by some cleaning action.

Figure 2: HPH tail rotor pitch links

Source: Aircraft operator, annotated by the ATSB

HPH maintenance documentation

About 443 hours prior to the accident, at a 50 hourly inspection, the tail rotor pitch links (part number B345-3) were found to be unserviceable. Two new pitch links, with the same part number, were installed. The pitch link had failed about 2 hours prior to the next scheduled 100 hourly inspection. The maintenance release indicated that all the required daily inspections had been carried out and that there were no outstanding maintenance issues.

Manufacturer comment

The helicopter manufacturer was only aware of one other similar failure that occurred about 10 years ago. The manufacturer believed that the failure was as a result of the axial wear (about five times more than permitted) allowed binding to occur, with resultant fatigue failure to the pitch link.

Pilot operating handbook

Robinson Model R22 Pilot’s Handbook, Section 4 Normal Procedures Daily or Prefight checks, dated 20 April 2007 page 4-3, included an item to check the tail rotor pitch links for “No looseness”.

Robinson maintenance manual

The Robinson Maintenance Manual Model R22 contains inspection requirements to be conducted at the 100-hour or annual inspection. Section 2.410 Inspection procedures and checklist item 12. Rotor Hub Hinge Bolts, dated October 2014, required the condition of the pitch links and rod ends to be inspected. This inspection was to be in accordance with section 2.120 Push-Pull Tubes, Rod Ends, and Spherical Bearings (dated October 2014), with reference to Figure 2-1 (reproduced below in Figure 3). The inspection needed to meet the following conditions:

• the maximum allowed axial play of 0.020 inch (0.508 mm). The axial play of HPH’s failed pitch link was about 0.108 inch (2.743 mm) and the intact pitch link was about 0.041 inch (1.041 mm)
• the maximum radial play of 0.010 inch (0.254 mm) for the rod end spherical bearings
• with no looseness between the bearing outer race and the rod end housing.

The maintenance manual also contained a caution that the Teflon-lined bearings must not be lubricated or cleaned with solvent.

Figure 3: Robinson maintenance manual spherical bearing limits

Source: Robinson

ATSB comment

CASA SDR database search

The operator reported to the ATSB that the R22 helicopter tail rotor pitch links had been failing regularly in mustering operations. CASA provided information from their Service Difficulty Report (SDR) database from 1983 to 2014. The database showed three previously reported defects with the same part number tail rotor pitch link as HPH where the pitch link had failed (Table 1). Two of the failures had occurred in flight.

Table 1: CASA SDR database - Tail rotor pitch link failures

CASA reported two important points in relation to the CASA SDR system:

in the case of the Robinson R22, there is no legislation requiring the manufacturer to be notified of the tail rotor pitch link failures in Australia that have been reported to CASA. While there is no requirement to provide this information, CASA usually provides data dumps of defect reports on an annual basis to North American NAAs [National Airworthiness Authorities including the US Federal Aviation Administration and Transport Canada].

CASA encourages the industry to pass the defect information to the approval holder [manufacturer] and, as part of any follow up action CASA is likely to send the information to the approval holder [manufacturer], foreign or domestic.

Safety message

Continuing airworthiness relies on inspections identifying damage so that parts can be repaired or replaced prior to failure. Therefore, scheduled maintenance inspections and the pilot’s daily inspection are a central element of the continuing airworthiness of the aircraft.

Regulators and aircraft manufacturers depend on accurate data to ensure the ongoing continued airworthiness of the aircraft. It is important that defects are reported to CASA through the Service Difficulty Reports (SDR) system, and to the manufacturer, so issues can be identified and rectified.

Aviation Short Investigations Bulletin - Issue 42

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. There are two tail rotor pitch links, one for each tail rotor blade. The pitch link connects the blade to the tail rotor pitch control assembly. The tail rotor pitch control assembly is connected via push pull controls to the pedals in the cockpit, which the pilot moves for directional control.

The helicopter was operating a Night VFR medical evacuation flight. The patient to be evacuated was a 15 year old adolescent who had suffered a dislocated elbow.

Initial advice of the requirement for the evacuation was telephoned by the tasking hospital at about 2030 EST and after obtaining weather forecasts and readouts of the present weather in the area of the destination, the aircraft departed for the short flight to the hospital at 2108.

At the hospital, the pilot checked with the medical staff as to the need to conduct the evacuation and was advised that the flight was necessary. After emplaning a doctor the aircraft departed for its destination.

As the flight proceeded the pilot checked the weather conditions at the island with persons at the destination and at a location to the south of the destination. Checks were also made through the Flight Service operator with the meteorological radar service in Brisbane. The weather report received from the destination indicated a complete overcast with a south-easterly wind of 15-20 kts and no rain.

The flight continued along the eastern side of Fraser Island and the pilot reported that he had the lights at the destination in sight. Enroute, over the island, the helicopter was forced to descend to about 1000 feet to remain below the overcast. As the helicopter approached the destination it entered rain and the pilot commenced a descent. The rain became heavier and the pilot lost sight of all but one of the three light sources at the destination. He continued with the descent and decided that because of the conditions he would be unable to conduct a turn to clear the area.

The helicopter subsequently struck a tree and began to vibrate. After it struck another tree the pilot closed the throttle and flared the helicopter, which came to rest upright about 400 m prior to the threshold of the Orchid Beach airstrip.

Weather reports received by the pilot prior to and during the flight indicated that visual flight was possible to the destination. However, the reports also indicated that the heavy showers to the north of the destination were moving to the south.

SIGNIFICANT FACTORS

• There was pressure on the pilot to complete the evacuation.
• The weather conditions in the area of the destination deteriorated rapidly.
• The pilot continued with the flight into non-visual conditions.

What happened

At about 0600 Central Daylight-saving Time (CDT) on 7 November 2014, a Boeing 737-800, registered VH-VUR and operated by Virgin Australia, departed Adelaide, South Australia, on a scheduled service to Brisbane, Queensland. The captain was the pilot flying and the first officer was the pilot monitoring.

The crew were cleared via the SEDAN 9 Standard Instrument Departure (SID). As the aircraft climbed through about 4,400 ft during the SID, air traffic control re-cleared the aircraft to track direct to waypoint UVUPU (north-east of Mildura, Victoria), and cancelled the standard airspeed restriction of 250 kt below 10,000 ft. The crew made appropriate changes in the Flight Management Computer (FMC),^[1] following which the captain selected Lateral Navigation (LNAV)^[2] and Vertical Navigation (VNAV) auto-flight modes (see VNAV mode). In these modes, the aircraft commenced tracking directly to waypoint UVUPU, and accelerated to the FMC-programmed airspeed of 280 kt.

The climb proceeded normally until the aircraft was passing about flight level (FL) 250^[3] when the captain selected Level Change (LVL CHG) vertical auto-flight mode (see LVL CHG mode), and commanded a continued climb at the existing airspeed of 280 kt. The captain recalled that LVL CHG mode may have been selected to manage continued climb through a layer of turbulence. The crew intended to re-select VNAV mode when LVL CHG mode was no longer required, but inadvertently overlooked that selection, and the climb continued in LVL CHG mode at 280 kt.

Soon after the selection of LVL CHG mode, as the aircraft climbed through about FL 265, the auto-flight system sequenced automatically from climb at a constant airspeed, to climb at a constant Mach number,^[4] consistent with normal system behaviour. Climb then continued above FL 265 at a constant Mach number of 0.69, which was the Mach number corresponding to 280 kt at the time the changeover occurred. As the aircraft continued to climb at the constant Mach number, the airspeed slowly reduced (as a function of the characteristics of the atmosphere and the relationship between Mach number and airspeed).

The slowly reducing airspeed went unnoticed by the crew until the auto-flight system was levelling the aircraft at the planned cruise altitude of FL 390. At about that time, the captain noticed that the magenta airspeed bug^[5] on the primary flight display (PFD) airspeed indicator was at the top of the minimum manoeuvre airspeed amber bar. At that point, the top of the amber bar corresponded to an airspeed of about 216 kt. The crew also noticed a ‘buffet alert’ advisory message appear in the scratchpad of Control Display Unit (CDU).^[6]

In response to the low airspeed condition, the captain selected Mach 0.77 on the Mode Control Panel (MCP)^[7] to initiate acceleration towards the FMC-programmed cruise Mach number. As the aircraft accelerated through about Mach 0.74, the captain selected VNAV and the auto-flight system engaged in VNAV Path (VNAV PTH) (see VNAV mode), allowing the aircraft to continue accelerating to the FMC-programmed cruise Mach number of Mach 0.77 while maintaining FL 390. Under the existing conditions, a Mach number of 0.77 corresponded to an airspeed of about 240 kt. Having accelerated to Mach 0.77, the flight continued to Brisbane without further incident.

Figure 1 provides a graphical illustration of some relevant flight parameters and auto-flight system vertical modes from FL 200 until the aircraft had accelerated to Mach 0.77 in cruise flight at FL 390. Of particular note is the change from VNAV mode to LVL CHG mode soon after 1952 UTC.^[8] The figure also shows the near constant Mach number and gradually decreasing airspeed from about 1953 UTC, until the aircraft reached the planned cruise altitude soon after 2001 UTC. The airspeed dips beneath the minimum manoeuvre airspeed for a short time as the crew initiated acceleration, reaching a minimum recorded airspeed of about 211 kt. From that point, the aircraft accelerates to the planned cruise Mach number of Mach 0.77, with VNAV re-engaged just before 2004 UTC. Note that the minimum operating airspeed referred to in Figure 1 is the same as the minimum manoeuvre airspeed (see below). The computed airspeed referred to in Figure 1 is the same airspeed that would have been displayed on the captain’s PFD.

Figure 1: Selected flight parameters and auto-flight system modes

Source: ATSB

Relevant technical information

The auto-flight system consists of an auto-pilot flight director system (AFDS) and an auto-throttle system. The AFDS and auto-throttles are controlled using the FMC and the MCP. The auto-flight system operates in various vertical modes according to the phase of flight, operating environment and crew requirements. Two commonly used vertical modes relevant to this occurrence are VNAV mode and LVL CHG mode.

VNAV mode

During a climb in VNAV mode, the auto-flight system guides the aircraft along the FMC-programmed vertical profile, at the speed (airspeed or Mach number) computed by the FMC, modified and selected by the crew as required according to operational circumstances. During normal operations, the FMC speed profile holds the airspeed at 250 kt up to 10,000 ft (normal procedural requirement in Australian airspace) followed by acceleration to the FMC-programmed climb airspeed (commonly the economy-optimised speed schedule computed by the FMC). As climb continues at a constant airspeed, Mach number increases as a function of the characteristics of the atmosphere and the relationship between Mach number and airspeed. Climb continues at the FMC-programmed airspeed until the Mach number reaches the FMC-programmed Mach number, from which point climb continues at that Mach number. The crew can change FMC-programmed climb speeds as required, by making the required changes on the appropriate page of the CDU. During this occurrence, the recorded data indicates that, had the crew continued to climb in VNAV mode (rather than selecting LVL CHG), the aircraft would have maintained 280 kt to about FL 320, from which point climb would have continued at a constant Mach 0.77.

VNAV mode is selected by pressing the VNAV pushbutton on the MCP. When selected, a green bar on the VNAV pushbutton illuminates. During a climb in VNAV mode, the flight mode annunciator (FMA)^[9] indication at the top of each pilot’s PFD indicates N1^[10] as the auto-throttle mode and VNAV SPD (speed) as the vertical auto-flight mode (Figure 2). During a climb in VNAV mode, the FMC-programmed speed is displayed on the PFD, and the indicated airspeed/Mach number (IAS/MACH) window on the MCP is blank.

When the aircraft levels at the FMC-programmed cruise altitude, the auto-flight system vertical mode sequences to VNAV PTH (path) to maintain the cruise altitude, and the auto-throttle mode sequences to FMC SPD (speed) to hold the FMC-programmed cruise speed (Mach number). Similar annunciations appear when the auto-flight system levels the aircraft temporarily at an intervening FMC-programmed altitude constraint (there were no intervening altitude constraints relevant to this occurrence).

LVL CHG mode

During a climb in LVL CHG mode, the auto-flight system controls the aircraft pitch attitude in a manner that maintains the speed selected by the crew on the MCP. LVL CHG mode is sometimes used during a climb to allow a more active and typically short-term approach to vertical profile management. For example, rather than allowing the aircraft to accelerate in VNAV mode in accordance with the FMC-programmed speed profile, the crew may elect to temporarily retard acceleration or reduce speed using LVL CHG mode. Temporarily retarding acceleration or reducing speed may generate a higher short-term rate of climb, thereby facilitating an expedited climb through a layer of cloud or turbulence.

LVL CHG mode is selected by pressing the LVL CHG pushbutton on the MCP. Like the VNAV pushbutton, a green bar illuminates on the pushbutton when LVL CHG is selected. The speed control knob on the MCP is then used to select the required climb airspeed or Mach number, which is displayed in the corresponding IAS/MACH window. When LVG CHG mode is selected, the FMA indicates N1 as the auto-throttle mode and MCP SPD (speed) as the vertical auto-flight mode (Figure 2).

Figure 2: Relevant example FMA annunciations (VNAV upper example and LVL CHG lower example)

Source: ATSB

Minimum manoeuvre airspeed

The minimum manoeuvre airspeed is represented as the top of an amber bar on the PFD airspeed indicator. Minimum manoeuvre airspeed is defined in the operator’s Flight Crew Operations Manual (FCOM) as the airspeed that provides:

• 1.3g^[11] manoeuvre capability to the stick shaker below approximately 20,000 ft.
• 1.3g manoeuvre capability to the low airspeed buffet (or an alternate approved manoeuvre capability entered into the FMC maintenance pages) above approximately 20,000 ft.

The FCOM adds the following caution:

Reduced maneuver capability exists when operating within the amber regions below the minimum maneuver speed or above the maximum maneuver speed. During non-normal conditions the target speed may be below the minimum maneuver speed.

During this occurrence, the crew noticed that the airspeed was near the minimum manoeuvre airspeed on the PFD, and noticed the ‘buffet alert’ message on the CDU scratchpad, and responded accordingly. Other more salient system alerts and levels of protection were available had the crew not responded when they did, and the airspeed had continued to reduce. These include an aural ‘airspeed low’ alert and, following further airspeed reduction, a stick-shaker system.^[12] Under some conditions the auto-flight system may also command a reduction in the aircraft pitch attitude (accepting a reduction in the rate of climb in return for airspeed management), if the airspeed reaches the minimum manoeuvre airspeed.

Crew comments

During the operator’s investigation into the incident, the crew commented that a number of distractions may have contributed to the incident. The crew commented that sun glare was particularly problematic – the glare was directly through the windscreen for the duration of the climb. The crew also commented that they may also have been distracted by air traffic control and cabin-related communication requirements, and other air traffic in their vicinity. Additionally, both pilots consumed breakfast during the climb (at separate times), which may have provided a source of distraction.

ATSB comment

In a similar occurrence involving the same aircraft type, the crew inadvertently allowed the aircraft to continue to climb in LVL CHG mode at a constant Mach 0.62. On that occasion, the crew noticed the ‘buffet alert’ message and a small pitch attitude reduction as the aircraft climbed through about FL 350 and the airspeed neared the minimum manoeuvre airspeed. A copy of the report associated with that incident is available on the ATSB website.

A recent report by the FAA Performance-based Operations Aviation Rulemaking Committee, (Commercial Aviation Safety Team Flight Deck Automation Working Group) titled Operational Use of Flight Path Management Systems made a number of findings and recommendations dealing broadly with vulnerabilities associated with flight crew management of automated systems. Further to a 1996 FAA report titled The Interfaces Between Flightcrews and Modern Flight Deck Systems, the more recent report commented that ‘…autoflight mode selection, awareness and understanding continue to be common vulnerabilities’. Both the 1996 report and the later Automation Working Group report are available on the FAA website.

ATSB Research Investigation B2004/0324 titled Dangerous Distractions found that pilot distraction contributed to 325 occurrences involving Australian-registered aircraft between 1997 and 2004. The report concluded:

… the findings have shown that distractions have the potential to significantly threaten flight safety across all sections of the industry and during all phases of flight. Clearly, strategies to minimise pilot distraction need to be developed and designed with particular attention to the operations being undertaken.

The report, which includes some strategies for reducing pilot distraction, is available on the ATSB website.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Aircraft operator

As a result of this occurrence, the aircraft operator intended to highlight relevant human factors issues, such as the potential distractions associated with sun glare and communications, in future training programs.

Safety message

For flight crew, this incident highlights the importance of continued auto-flight system mode and aircraft energy state awareness. The incident also highlights the manner in which various distractions have the potential to adversely affect such awareness. For operators, the incident highlights the importance of robust auto-flight management procedures, supported by appropriately focussed crew training and standardisation.

In 2010, the European Aviation safety Agency issued a Safety Information Bulletin on the subject of Flight Deck Automation Policy – Mode Awareness and Energy State Management. The bulletin included a number of recommendations to operators addressing automation policies, procedures and training. A copy of the bulletin is available at European Aviation Safety Agency. Operators of highly automated aircraft are encouraged regularly review their own automation policies, procedures and training in the context of the recommendations included in the bulletin, and with the benefit of lessons learned from this and similar incidents.

Aviation Short Investigations Bulletin - Issue 41

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The FMC uses information entered by the crew, aircraft systems data, and navigation and performance databases, to provide auto-flight and auto-throttle guidance and control.
2. In LNAV mode, the auto-flight system guides the aircraft along the FMC-programmed lateral track.
3. At altitudes above 10,000 ft in Australia, the height of an aircraft above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
4. Mach number is the ratio of true airspeed to the speed of sound in the surrounding air.
5. In LVL CHG mode, the magenta airspeed bug on the PFD airspeed indicator points to the speed selected by the crew in the Indicated Airspeed (IAS)/Mach number (MACH) window on the Mode Control Panel (see later description).
6. Two identical CDUs (one available to each pilot) are used by the flight crew to enter data and control the FMC, and to display FMC data and messages. The scratchpad refers to the bottom line of the CDU screen, used among other things to display FMC advisory messages. When an advisory message such as ‘buffet alert’ appears, a message light on both CDUs also illuminates to draw attention to the CDU message. The operator’s Flight Crew Operations Manual states that the ‘buffet alert’ message appears when the manoeuvre margin is ‘less than specified’.
7. The MCP is used by the crew to control flight parameters such as altitude, speed and heading, and to select auto-flight and auto-throttle system operating modes.
8. UTC refers to Coordinated Universal Time. UTC is the time zone used for civil aviation. Local time zones around the world can be expressed as positive or negative offsets from UTC. At the time of this occurrence, CDT was UTC plus 10 hours and 30 minutes. For example, 1952 UTC on 6 November 2014 was 0622 CDT on 7 November 2014.
9. Auto-flight modes are displayed on the FMA at the top of the PFD. Engaged modes are displayed at the top of the FMA in green letters. Armed modes are displayed in smaller white letters beneath the engaged modes. The mode annunciations, from left to right, are auto-throttle, roll (or lateral) mode, and pitch (or vertical) mode.
10. N1 auto-throttle mode engages automatically when LVL CHG or VNAV modes are engaged during climb. The auto-throttles then maintain engine speed at the N1 limit selected on the CDU.
11. 1.3g represents 1.3 times the force of gravity. In this context, 1.3g means that the aircraft can be manoeuvred at up to 1.3g without activating the stick shaker or generating a low airspeed buffet. Approximately 1.3g will be experienced during a level turn at 40 degrees angle of bank.
12. A stick-shaker is a device that physically shakes the control column through a small angle in the fore and aft plane, providing an artificial warning of an approaching aerodynamic stall.

What happened

On 14 November 2014, at about 1230 Eastern Daylight-saving Time (EDT), a de Havilland Canada DHC-1 (Chipmunk) aircraft, registered VHRVY (RVY), departed from Luskintyre Airfield, New South Wales, for a post-maintenance flight with the pilot and one passenger on board. The flight plan was to conduct the flight near the airfield and at a safe altitude. The aircraft had a history of ongoing problems with both the engine revolutions per minute (RPM) governing system as well as the rear vertical speed indicator (VSI). The passenger who was seated in the rear seat was to monitor and report any engine RPM fluctuations and observe the VSI indication.

After about 10 minutes of straight and level flight, as well as climbs and descents, with no fluctuations in the engine RPM, the pilot commenced some gentle aerobatics. These aerobatics were to ensure the selected engine speed was maintained through a range of flight attitudes and airspeeds. As everything appeared to be functioning correctly, the pilot then progressed to some more advanced aerobatic manoeuvres.

As the aircraft was exiting the bottom of a modified loop manoeuvre, at around 140 kt indicated airspeed (IAS), the engine began to over speed without warning.^[1] The pilot reduced the engine power and commenced trouble shooting the problem.

At the time, RVY was about 1 km north of Luskintyre Airfield (Figure 1), heading east at about 3,000 ft above ground level (AGL). The westerly wind was reported to be gusting at around 2030 kt. The pilot joined downwind for a landing on runway 30, noting the groundspeed was around 150-160 kt. While on downwind, the pilot advanced the throttle lever and noted that at about 1/3 lever movement the engine speed was at about 3,000 RPM (maximum continuous RPM at sea level pressure altitude is 2,700). Despite the engine speed, the aircraft was not able to maintain altitude. In an attempt to ‘get back’ to the airfield the pilot turned from a slightly extended downwind onto a ‘base leg’. As the aircraft turned, the engine stopped producing power. The pilot unsuccessfully attempted to restart the engine.

When RVY turned onto a final approach, the aircraft was still descending. At about 500 ft AGL, the pilot determined that they would not make the runway, so he elected to land in a paddock about 500 m east of the airfield (Figure 1). During this manoeuvre, the right wing stalled and dropped slightly. To recover, the pilot lowered the nose of the aircraft to gain more airspeed. The pilot reported that due to the high outside air temperature and gusting wind, the conditions were quite turbulent near the ground. The pilot flared the aircraft in preparation for landing and noted airframe buffeting, with little to no response from the elevator. The aircraft landed heavily, travelling through an electric fence before the aircraft stopped on a drive way just short of the selected landing area (Figure 1).

The pilot exited the aircraft quickly as the right wing fuel tank had ruptured during the landing and fuel had spilt onto the ground. The pilot tried to assist the passenger, but due to the pilot’s injuries he was unable to provide any physical assistance. After a short time, the passenger exited the aircraft. The pilot and passenger sustained serious injuries and the aircraft was substantially damaged (Figure 2).

Figure 1: Accident location

Source: Google™ earth, annotated by the ATSB

Figure 2: VH-RVY

Source: New South Wales Police Force

Aircraft information

The aircraft was manufactured in the United Kingdom in 1951 and was first registered in Australia in 1954. The aircraft had been modified by the previous owner, between 1978 to 1983, where the de Havilland Engine Company Gipsy Major engine and fixed pitch propeller instillation was replaced with a Lycoming IO-360A1B6 engine, constant speed propeller, propeller governor and an accumulator installation.

Pilot comment

The pilot worked for the maintenance organisation and had flown the aircraft after its last maintenance in 2013. The pilot indicated that at the annual maintenance inspection in 2013, small fluctuations in the selected engine RPM had been reported. Both the propeller and propeller governor were sent to be overhauled and reinstalled on the aircraft, however there continued to be slight RPM fluctuations. After the annual inspection conducted just prior to the accident, it was found that there was about a 100 engine RPM fluctuation, during gentle climbing and descending. The propeller governor and accumulator were again sent to be overhauled. The components were returned serviceable with no defects found. The pilot reported that during the overhaul some adjustments were made to the internal operating pressures of the propeller governor. The components were reinstalled on RVY and ground tested with no defects found.

The pilot believed that coming out of the modified loop manoeuvre the propeller had gone into full fine pitch, resulting in the engine entering an “overspeed” condition.

The pilot reported that apart from the strong gusty winds, the temperature was about 39°C.

Owner investigation

An investigation was conducted on behalf of the owner that found the following:

• After the accident, the engine, propeller, propeller governor and accumulator were removed from the aircraft and were inspected and tested to identify any defects.
• The engine was functionally tested on an engine test truck and no defects were found.
• The propeller was inspected at a propeller overhaul facility and did not find any evidence of damage or failure within the propeller that would explain an uncommanded movement to fine pitch.
• The propeller governor was functionally tested at an aircraft component overhaul facility and no defects were identified.
• The accumulator was functionally tested at an aircraft component overhaul facility and no defects were identified. The engineering order that approved the installation of the accumulator was reported to specify an accumulator air charge pressure of about 250 PSI. The overhaul facility test equipment was only capable of testing the accumulator to about 100 PSI.

The investigation determined that there was no conclusive reason why the engine suffered an overspeed and ceased to operate. It was suggested that the overspeed may have been a result of lack of oil pressure to the propeller when the engine of RVY was inverted, during the aerobatic manoeuvre resulting in the propeller moving to fine pitch.

Safety message

Engine failure in flight

This accident is a timely reminder to pilots to consider the effect an in-flight engine failure at different altitudes and in the given conditions can have on the options available to manage that failure and to identify a suitable forced landing area. The combination of two people on board and the high temperature would have adversely affected the aircraft’s performance on the day.

The ATSB booklet Avoidable Accidents No. 3 - Managing partial power loss after take-off in single-engine aircraft contains information that is also relevant to a complete engine power loss.

The booklet highlights the importance of:

• pre-flight decision making and planning for emergencies and abnormal situations for the particular aerodrome including a thorough pre-flight self-brief covering the different emergency scenarios.
• taking positive action and maintaining aircraft control either when turning back to the aerodrome or conducting a forced landing until on the ground, while being aware of flare energy and aircraft stall speeds.

Aviation Short Investigations Bulletin - Issue 42

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. An engine overspeed is a condition in which an engine is allowed or forced to rotate beyond its design limit.

The operator had received approval to carry out certain low level operations, including power line inspections, during nominated periods of emergency. The approval was subject to a number of conditions, which included requirements that such flights be authorised by the State Emergency Services and that only persons essential to the operation be carried. As suitably qualified commercial pilots were not normally available, two private pilot members of the aero club who had more than 1000 hours flying experience had been specifically approved to conduct these flights. Before receiving this approval, the pilots had been required to complete specialised low flying training and testing. The procedure used in conducting power line inspection flights was to fly at approximately 200 feet above ground level, maintaining about 90 knots airspeed with one or two stages of flap lowered and with the aircraft tracking left of the line to assist inspection by the observer in the right seat.

The aircraft struck the spur line with its propeller and nose gear. The line did not break and the aircraft was pitched vertically to the ground.

Examination of the wreckage found no evidence of mechanical defect or malfunction which might have contributed to the accident.

What happened

On 11 November 2014, at about 1130 Eastern Standard Time (EST), a Cessna 210 aircraft, registered VH-JGA (JGA), departed from Cairns Airport, Queensland, for a scenic flight over Green Island and Arlington Reef with the pilot and four passengers on board.

After about half an hour of local flying, the pilot returned JGA to Cairns Airport. During the approach, at about 1,000 ft above ground level, the pilot selected the landing gear down, however, the green landing gear down indicator light did not illuminate. The pilot observed via an inspection mirror that the left main landing gear was just out of the landing gear recess and not in the down and locked position. The nose landing gear and right main landing gear appeared to be in the down position. The pilot advised the Cairns Tower air traffic controller that JGA would conduct a missed approach and requested a clearance to hold over the sea to determine the reason for the malfunction.

While holding over the sea, in the vicinity of Cairns Airport, at about 1,000 ft, the pilot conducted a landing gear emergency extension, but the left main landing gear still did not lock in the down position. The pilot contacted the operator and maintenance organisation via a mobile phone and conducted extensive troubleshooting, but was unable to get the left main landing gear to lock in the down position.

JGA was then returned to Cairns Airport and the pilot conducted a low level pass over the runway so that the landing gear could be observed. The nose landing gear and right main landing gear were observed to be in the down position, while the left main landing gear was observed to be out of the landing gear recess and only extended to about a 45 degree angle. The pilot elected to hold over the sea and reduce the amount of fuel on board, before conducting a landing. The pilot consulted with the operator and the maintenance organisation and decided to land on the grass area, abeam runway 33, with the landing gear retracted.

The pilot of JGA conducted two practice approaches to assess the aircraft configuration and landing area before beginning the approach for a wheels-up landing. The pilot extended the flaps to help slow the aircraft and, after turning onto a long final, briefed the passengers for the landing and instructed them to take up the brace position. Just prior to touchdown, the pilot turned off the master switch and moved the engine mixture control to the cut-off position. At about 1416, the aircraft landed on the fuselage underside on the grass area abeam runway 33 and came to a stop. The pilot and four passengers were uninjured and the aircraft was substantially damaged (Figure 1).

Figure 1: Damage to JGA

Source: Aircraft operator

Pilot comment

The pilot had flown the aircraft on a previous flight that day and had not noticed anything unusual. The pilot commented that there was sufficient fuel on board the aircraft so that there was time to investigate the malfunction and to plan and prepare for the landing.

When conducting the emergency extension, the nose and right main gear went straight to the down and locked position before the emergency extension hand pump was used. The hand pump had no effect on moving the left main landing gear.

Operator comment

The operator conducted an investigation into the accident and determined that the housing of the left main landing gear had fractured (Figure 2), resulting in the gear not extending to the down and locked position. The operator reported that they conducted a visual inspection of the left and right main landing gear actuators for cracks and checked the tightness of the actuator mounting bolts at the periodic (100 hourly or 12-month) maintenance inspections with the actuator in-situ. The last inspection was conducted about 50 hours prior to the accident, with no defects found.

JGA was manufactured in 1981 and, at the time of the accident, the aircraft had about 12,882 hours total time in service. The aircraft was maintained under the Civil Aviation Safety Authority (CASA) maintenance schedule (Civil Aviation Regulations 1988 (CAR) Schedule 5). The left main landing gear was a non-lifed component and had been on the aircraft since new. There was no record that the actuator had been overhauled.

Figure 2: JGA left main landing gear actuator showing the fractured housing

Source: Aircraft operator

Cessna service manual

The Cessna 210 aircraft service manual contained a Supplemental Inspection Document (SID) 32-10-01 (temporary Revision Number 10 dated 1 August 2011) with a compliance date by 31 December 2013 that directly related to the removal and detailed inspection of the main landing gear retraction system. The inspection was to be carried out initially every 3,000 hours total time in service or 10 years whichever occurred first and repeated every 500 hours or 5 years whichever occurred first (JGA was manufactured in 1981 and had about 12,882 hours total time in service). The SID also required verification that Cessna Service Bulletin SEB01-2 Main Landing Gear Actuator Inspection has been accomplished. The Cessna 200 series SIDs were introduced in August 2011 and the CASA current compliance dates have been extended until 30 June 2015 for aerial work and charter operations and 31 December 2015 for private operations to allow for sufficient time for full compliance.

Cessna Service Bulletin SEB01-2 Main Landing Gear Actuator Inspection revision 2 dated 4 June 2007, required the inspection of the main landing gear actuators for the presence of cracks. Indicating that non-compliance with the service bulletin could result in failure of the main landing gear actuator. The service bulletin required the removal and disassembly of the main landing gear actuators and a fluorescent penetrant inspection of the actuator body to be carried out using black light and a magnifying glass to detect any cracks (Figure 3). The inspection was to be carried out initially every 3,000 hours total time in service within the next 100 hours operation and subsequent inspections every 500 hours total time in service thereafter.

Figure 3: Cessna Service Bulletin SEB01-2 Fracture located in JGA main main landing gear actuator inspection area landing gear actuator

Source: Cessna Aircraft operator

Aircraft maintenance

The aircraft operator reported that all Service Letters and Service Bulletins are reviewed by the maintenance organisation and implemented based on experience and at their request.

Information provided to the operator by the aircraft maintenance organisation was that the actuator fractured in what appeared to be one clean break and not a crack that slowly progressed, and that type of crack could occur in a sudden overload situation during the take-off when the landing gear is selected up and the wheels contact the ground. The maintenance organisation also recommended that the Service Bulletin requirements be carried out on aircraft that have exceeded 5,000 airframe hours.

ATSB comment

ATSB investigation AO-2011-115

The ATSB investigation AO-2011-115 Flight control system event involving Cessna 210N, VHJHF, 48 km West of Bourke Airport, NSW, 12 September 2011 found that reported elevator control input difficulties resulted directly from the fracture of the aircraft’s two horizontal stabiliser rear attachment brackets. The nature of the failures was typical of the damage sustained by aircraft as they age and move beyond the manufacturer's originally intended design life.

The investigation found at the time, that some aircraft registration holders believed that their aircraft was exempt from the manufacturer’s supplemental inspections, such as the Cessna SIDs when their aircraft was maintained using the CASA maintenance schedule (Civil Aviation Regulations 1988 (CAR) Schedule 5). While the CASA maintenance schedule did not make any specific reference to the incorporation of the manufacturer’s supplemental inspections, it was a CAR requirement that all aircraft be maintained in accordance with approved maintenance data that, by definition, included those inspections.

The ATSB investigation report AO-2011-115 is available at the ATSB website.

CASA Airworthiness Bulletin (AWB) 02-048

CASA issued Airworthiness Bulletin (AWB) 02-048 Compliance with Cessna Supplemental Inspection Documents (SIDs) on 7 April 2014 to clarify the requirement to comply with Cessna SIDs. The AWB comprised Aviation Ruling 01/2014, which stated that compliance with the Cessna SIDs was mandatory, irrespective of the category of operation or the elected maintenance schedule for the aircraft, be it:

• CAR 42A Manufacturer’s Maintenance Schedule,
• CAR 42B CASA Maintenance Schedule (Schedule 5), or
• CAR 42C Approved System of Maintenance.

The AWB also stated that:

Significantly, the SIDs were developed on the assumption that the aircraft had been maintained using the Manufacturer’s Maintenance Schedule, or equivalent (including the incorporation of all applicable Service Bulletins), and do not necessarily take into account modifications or repairs made to the aircraft since manufacture. Therefore, all relevant Service Bulletins need to be incorporated to be in compliance with the SIDs inspections.

Since the accident involving JGA, CASA released Issue 2 to AWB 02-048, dated 10 April 2015, to clarify that those service bulletins listed in the SIDs are required to be incorporated and confirmed that, where specified in the SIDs, on-going inspections are also required to be complied with.

The AWB further stated that:

Therefore, all Service Bulletins that directly relate to the structural integrity of the aircraft need to be incorporated to be in compliance with the SIDs inspections. Please note that some Service Letters and other information referred to in the SIDs requirements were originally discretionary in nature. These documents are now considered mandatory if referred to as part of the SIDs inspections requirements in relation to [principal structural elements (PSEs)] PSEs.

Further information can be found in AWB 02-048, which is available at www.CASA.gov.au.

US Federal Aviation Administration (FAA) Service Difficulty Reporting (SDR) database

A search of the US Federal Aviation Administration (FAA) Service Difficulty Reporting (SDR) database found about 65 entries dated from 1995 to 2014 of reported crack or cracks in the main landing gear actuator/s, in the same crack location as specified in the service bulletin or in that area and with the same part number as JGA’s actuator or one of the actuator part numbers listed in the service bulletin. Five entries had originated from Australia. About 20 reports resulted in an inflight incident and eight mentioned landing with the landing gear in the up position or without both main landing gear in the down position.

Although most reports indicated that the crack or cracks were located in the same area specified in the service bulletin, about 15 indicted they originated from one or more of the actuator attachment bolt holes. About 13 cracks had been located while carrying out the requirements of the service bulletin and the same number again were located while conducting a fleet inspection of the actuator. Several mentioned that this is an ongoing issue and suggested that the actuator be redesigned. One report mentioned a loose actuator attachment bolt, while two mentioned that the bolts were correctly torqued.

Although some entries lacked details, about seven specifically mentioned they were found during a scheduled inspection. One mentioned that the actuator had failed 25 hours after a 100 hourly inspection, which specifically checked the actuators externally for cracks. About three entries reported that the actuator had failed subsequently from conducting the requirements of the service bulletin. One reporter indicated that an inspection should be conducted on the actuator any time that the landing gear contacts the ground in other than the fully extended or fully retracted position.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

Maintenance action

The operator’s Cessna 210 aircraft fleet will undergo further examination to see if there is any evidence of other potential failures within the fleet.

Safety message

This accident highlights the importance of comprehensive, periodic maintenance inspections and the role of supplemental inspections in maintaining ageing aircraft. As aircraft age, the original maintenance schedules may not be sufficient to ensure the aircraft’s ongoing safety. It is important to review the aircraft’s maintenance schedule to ensure it is appropriate for the aircraft and that it adequately provides for the continuing airworthiness of the aircraft.

In 2007, the ATSB released research report B20050205 - How Old is Too Old? The impact of ageing aircraft on aviation safety. The report found that some aircraft manufacturers have recognised that the original maintenance schedules may not be sufficient to ensure the aircraft’s (ongoing) safety and have developed supplementary inspection programs (such as the Cessna SIDs); other aircraft do not have the same level of airworthiness support. The report concluded that adequate maintenance of ageing aircraft requires the participation and ongoing cooperation of aircraft manufacturers, regulatory authorities, owners, operators and maintainers.

In addition, further information is detailed in CASA’s Ageing Aircraft Management Plan (AAMP).

CASA Flight safety Australia June 2014 Doing it right is available at: www.flightsafetyaustralia.com/2014/06/

CASA Flight Safety Australia December 2014 SIDS program finds dangerous defects.

Aviation Short Investigations Bulletin - Issue 41

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2015 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 7 October 2014, a Robinson R44 helicopter, registration ZK-HBQ, collided with terrain in the Kahurangi National Park, near Nelson, New Zealand.

The New Zealand Transport Accident Investigation Commission (TAIC) is conducting an investigation into the circumstances of the accident. As part of its investigation, TAIC requested technical assistance from the Australian Transport Safety Bureau (ATSB) in the recovery of data from a damaged GPS unit recovered from the wreckage. To protect the information supplied by TAIC to the ATSB and the ATSB's investigative work to assist TAIC, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003.

The ATSB successfully recovered data from the GPS unit and has provided the data to TAIC to assist with their investigation.

Enquiries relating to the accident investigation should be directed to TAIC at: www.taic.org.nz

______________

Released in accordance with section 25 of the Transport Safety Investigation Act 2003.

What happened

On 31 October 2014, the pilot of a de Havilland DHC-2 aircraft, registered VH-AWD (AWD), conducted a scenic charter flight from Hayman Island Water Landing Area, Queensland. The pilot of AWD broadcast on the common traffic advisory frequency (CTAF) when passing Pinnacle Point. The broadcast from AWD was heard by the pilot of a Gippsland Aeronautics GA-8 aircraft, registered VH-NOQ (NOQ), which had departed from Shute Harbour Airport for a scenic charter flight. Although he heard the broadcast, the pilot of NOQ did not know where Pinnacle Point was as it was not labelled on the visual terminal chart (VTC).

The pilot of NOQ broadcast on the CTAF after passing Tongue Point and heading south along Whitehaven Beach. The pilot of AWD heard a broadcast on the CTAF, possibly that of the pilot of NOQ at Tongue Point, but did not hear the contents of the broadcast. As he missed the broadcast, the pilot of AWD then broadcast his position and intentions, and did not receive a response.

NOQ tracked to the southern end of Whitehaven Beach, turned and headed north returning to Tongue Point. When just south of Tongue Point for the second time, the pilot of NOQ broadcast on the CTAF and advised that he was changing to Hamilton Island air traffic control (ATC) Tower frequency. The pilot then commenced a left turn, selected the Tower frequency and was no longer monitoring the CTAF.

At about 1354 Australian Eastern Standard Time, and 1,300 feet, when approaching Tongue Point from Dumbell Island, the pilot of AWD sighted NOQ on a reciprocal track and estimated the aircraft passed on his right about 50 m away and about 50 feet above AWD.

This incident highlights the importance of broadcasting radio calls on, and monitoring, the appropriate frequency, to alert pilots and assist in see-and-avoid practices. It serves as a reminder to keep a good lookout for other aircraft, particularly around high traffic areas and radio frequency zone boundaries.

Aviation Short Investigations Bulletin - Issue 38