On 11 November 2014, the pilot of a Cessna 210 aircraft, registered VH-MCE (MCE), conducted a charter flight from Numbulwar to Gove, Northern Territory with five passengers on board. During the cruise, about 60 NM from Gove, the ammeter gauge indicated a discharge. The pilot switched off all electrics and checked the circuit breakers, none of which had popped. About 5 minutes after completing the checks, the pilot selected the alternator master switch back to ON and the gauge indicated a positive charge.
About 10-15 NM from Gove, the ammeter again indicated a discharge. The pilot switched all electrics off including the aircraft avionics. When at about 4 NM from Gove and 1,500 ft, the pilot selected the landing gear lever to the extended position. He heard the landing gear motor activate, so assumed the gear had fully extended. As the pilot reduced the engine power, the engine ran roughly and backfired. The pilot observed the oil pressure gauge reading zero and the cylinder head temperature (CHT) decreasing. The pilot observed that the flaps had not extended, but due to the distraction of the engine malfunction, did not look outside to confirm visually whether the landing gear was extended. The pilot carried out the engine trouble checks, and as the engine problem ruled out the option to go around, committed to landing the aircraft.
The aircraft landed just beyond the threshold and on the centreline of runway 31 with the wheels retracted. When the pilot realised the wheels were retracted, he immediately selected the fuel to OFF. The aircraft sustained substantial damage and the pilot and passengers were uninjured.
A crimped electrical cable was found to have caused the alternator to stop charging the battery. The engine had not been inspected before the completion of the ATSB report and the cause of the engine issues were unknown.
On 12 April 2015, the pilot of a Cessna 404 aircraft, registered VH-JOR (JOR), conducted preflight preparations at Broome Airport, Western Australia. The planned task involved a positioning flight from Broome to Derby, before a charter flight with five passengers, from Derby to Pantijan aeroplane landing area (ALA), Western Australia. The distance from Derby to Pantijan was 117 NM, with an estimated flying time of 49 minutes. The pilot reviewed information about the Pantijan airstrip in company documentation and using Google earth (Figure 1). He also arranged for the condition of the runway to be assessed by a contact person at Pantijan and the pilot of a helicopter scheduled to arrive at Pantijan before JOR.
Figure 1: Pantijan ALA
Source: Google earth
Prior to departing Broome, the pilot received information regarding the serviceability of the airstrip at Pantijan, from the contact person at the airstrip. He was advised that the grass beside the landing area was long, with some termite mounds outside the wingspan of the aircraft. He was also advised that the threshold of runway 02 had grass cover and that midway along the strip the surface was soft. The pilot understood that the contact person had walked the strip to assess its condition, but that no vehicle had been available to drive across the landing surface. Due to rising terrain at the northern end of the airstrip, the pilot was advised to regard the strip as one-way and to land on runway 02, and depart from runway 20.
After arriving in Derby, the pilot weighed the passengers and baggage and loaded the aircraft for the flight to Pantijan. Baggage was loaded into the aircraft lockers and also stowed at the rear of the aircraft and secured with a cargo net. Some bags were placed on a rear seat and secured with seatbelts. After loading the baggage and passengers, the aircraft departed from Derby at 1346 Western Standard Time (WST).
When about 80 NM from Pantijan, the pilot of JOR heard the pilot of the helicopter, who he had spoken to prior to departure, broadcast that he was conducting an approach to the airstrip in the direction of runway 02. The pilot of JOR responded with his current position and did not receive any further communications from the pilot of the helicopter. As JOR approached Pantijan, the pilot observed fires in the area. The direction of the smoke indicated a tailwind of about 5 kt for a landing on runway 02.
At about 1430 WST, the aircraft arrived overhead Pantijan. The pilot slowed the aircraft, lowered the first stage of flap and descended to about 700 ft above ground level. He then conducted a circuit and a visual inspection of the entire length of the runway. The pilot observed that the runway was narrow and bordered by tall grass. The helicopter was parked adjacent to a shed about three quarters of the way along the runway and clear of the landing area. The sand on the airstrip appeared to be uniform in colour, with no obvious darker patches that may have indicated water. There was short grass at the threshold of runway 02 extending for about 200 m. A termite mound was located about half way along the runway and had been placed on its side and moved to the right of the runway centreline.
The pilot then conducted an approach to land on runway 02. The aircraft touched down at the pilot’s aiming point, about 50 m beyond the threshold, and the pilot applied moderate braking. The aircraft continued along the centre of the runway and, as it slowed through about 60 kt, the pilot applied left rudder to turn the aircraft slightly to the left and increase separation from the overturned termite mound. He felt the rudder pedals move to the full left position and the aircraft turned to the left. The pilot immediately applied right rudder in an attempt to counteract the turn, but the aircraft initially continued to veer left towards the edge of the runway.
The left main landing gear momentarily lifted off the ground and the aircraft tipped to the right. As the aircraft veered off the runway and entered longer grass, the pilot regained control of the aircraft and it started to turn right and return towards the runway. The nose wheel then collided with a runway marker and collapsed, resulting in the aircraft nose contacting the ground and the aircraft skidded to a stop (Figure 2). The pilot secured the aircraft and assisted the passengers to disembark. One passenger had a cut to the back of the head from a loose object and another sustained a bleeding nose. Three other passengers and the pilot were not injured, however the aircraft sustained substantial damage.
Figure 2: Accident site
Source: Aircraft operator (edited by the ATSB)
Pilot comments
Following the accident, the pilot found that where he had commenced the left turn on the runway, the ground was soft and appeared to have previously held standing water, although the surface was dry at the time. The runway marker was a 44-gallon drum, cut in half longitudinally and laid on the ground and it was obscured by long grass (Figure 3).
None of the baggage had come loose in the cabin; the only unsecured objects were phones, cameras and water bottles.
The pilot stated that when facing similar circumstances, he would select a landing path that did not require any planned directional changes during the landing roll, until the aircraft has decelerated to a safe taxi speed.
Figure 3: Drum runway marker
Source: Aircraft operator
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
Company pilots operating beyond mobile phone coverage will be issued with a satellite phone. In this incident, access to a satellite phone may have enabled the aircraft pilot to communicate with the helicopter pilot on the ground and obtain further details regarding the condition of the airstrip.
The operators of remote airstrips will be reminded to follow the company’s runway inspection guide, which required a vehicle to assess the condition of the landing surface.
All company pilots will be reminded of the importance of maintaining directional control on unimproved (sand or gravel) airstrips.
Safety message
Airfields that are used infrequently or seasonally, potentially pose significant hazards to aviation. This incident highlights the importance of identification and management of any risks that might be associated with such an airfield. Potential hazards may be hard to identify, with objects possibly obscured by vegetation. Changes in the runway surface can be hard to detect visually and without a vehicle or some means to apply a similar force to that of a landing aircraft.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
During March 2015 three aircraft operating in Indonesia were involved in separate air safety occurrences:
Runway excursion – British Aerospace ATP-F, PK-DGI at Wamena airport, Papua, Indonesia on 31 March 2015
Runway excursion – Ayres S2R, PK-ELN at The Tajur Beras Airstrip, Kalimantan, Indonesia on 13 March 2015.
Hard Landing – Sikorsky S76C+, PK-FUP at Tanjung Dewa Island, East Kalimantan, Indonesia on 21 March 2015.
Investigations into the circumstances of these occurrences are being conducted by the National Transportation Safety Committee (NTSC) of Indonesia.
The NTSC requested assistance from the ATSB in the recovery of information from flight recorder equipment that was fitted to the aircraft. To facilitate this support and to provide the appropriate protections for the recorded information, the ATSB appointed an accredited representative in accordance with paragraph 5.23 of Annex 13 to the Convention on International Civil Aviation and commenced an investigation under the Australian Transport Safety Investigation Act 2003.
The ATSB successfully recovered data relating to the PK-DGI and PK-FUP occurrences and this information was provided to the NTSC in December 2015. Attempts to recover data from the AG‑NAV unit installed in PK-ELN were finalised in July 2016, however due to a damaged memory chip, no data for that occurrence was recovered.
The NTSC is responsible for releasing the final investigation report into these occurrences and can be contacted at:
National Transportation Safety Committee Ministry Of Transportation Republic Of Indonesia Transportation Building 3rd Floor Jalan Medan Merdeka Timur No. 5 Jakarta Pusat 10110 Indonesia
On 11 April 2015, the student pilot of a Piper PA-28 aircraft, registered VH-TXH (TXH), prepared to conduct a solo, local flight, from Moorabbin Airport, Victoria. The flight was to be the pilot’s second solo to the training area, where he was to practice simulated forced landings. The pilot inspected the aircraft, including checking the oil quantity and colour. He noted that the dipstick indicated 5.5 L of oil and the oil appeared to be of a golden colour. After completing the pre-flight checks, the pilot of TXH taxied the aircraft to the run-up bay and performed engine run-ups. He noted that all indications were normal and within the required performance limits.
At 11:29:06 Eastern Standard Time (EST), the pilot made a radio call to the Moorabbin surface movement controller (SMC) on the Ground frequency, advising that he was conducting a solo flight to the training area and requested a departure from runway 35 Right (35R). The SMC cleared TXH to taxi via taxiway A for a departure from runway 35R. TXH then taxied to the holding point for runway 35R, and, at 11:36:37, the pilot of TXH contacted the aerodrome controller – east (ADC1) on the Tower East frequency. He reported ready for take-off, and ADC1 cleared TXH for take-off.
At 11:37:08, the pilot of a Cessna 172 aircraft, registered VH-EUU (EUU), contacted the SMC and requested a clearance to taxi for a local private flight, with three passengers on board. The SMC cleared EUU to taxi to runway 35R via taxiway A, and the pilot commenced taxiing.
The pilot of TXH reported that the take-off run was normal, with the engine indications in the normal range. After rotation, when about 150 ft above ground level (AGL), the engine began to run roughly. The pilot lowered the aircraft nose slightly and within 2-3 seconds, the engine regained full power and the aircraft continued to climb. When approaching 500 ft AGL, the engine again ran roughly and partially lost power. The pilot suspected a fuel issue to be the cause of the rough running, and, as the fuel pump was still on, changed the selected fuel tank. The engine returned to producing full power and the pilot initiated a right climbing turn, leaving the fuel pump switched on. As the aircraft climbed, the engine lost power again.
At 11:37:58, the pilot advised ADC1 that he had a ‘spluttering engine’ and requested a return to land. ADC1 had observed TXH in the initial climb and noted that it did not appear to be climbing out normally and was then quite low, at an estimated 300 ft AGL. ADC1 initially responded that TXH was number one for runway 35R and then offered runways 22 or 31 if required. The pilot responded that he would use runway 22 (Figure 1).
ADC1 gave TXH priority to land over all other aircraft, advised the SMC of an aircraft with engine trouble, requested runway 22, and coordinated with the SMC for release of runway 22 (see section: Air traffic control). The SMC checked the crossing taxiways, helicopter traffic and for any works in progress that may have conflicted with the use of runway 22, then handed ADC1 the green runway strip for runway 22. ADC1 then placed the strip in the runway bay on the console. ADC1 also coordinated with the aerodrome controller – west (ADC2), who instructed a couple of aircraft in the circuit for runway 35 Left (35L) to go-around to ensure they remained clear of the crossing runway. ADC1 instructed the pilots of two aircraft that were in the circuit for runway 35R to go-around and another to conduct a full stop landing. The SMC reported then focusing on checking the runways and taxiways crossing runway 22. Taxiway A did not cross runway 22, and as the SMC remained seated, was unable to see EUU on taxiway A as it was obstructed by the tower console.
Figure 1: Moorabbin Airport, aircraft tracks and collision point
Source: Google earth annotated by the ATSB
At 11:39:06, ADC1 cleared TXH to land on runway 22. The pilot of TXH conducted a tight right turn towards runway 22 and as he was concerned about clearing the buildings on the approach to runway 22, he did not select any flap. After passing over the buildings, the pilot reduced the power to idle. He reported that the aircraft touched down about one third of the way along runway 22. ADC1 observed that TXH appeared to land about half way along the runway and did not decelerate normally after touching down. The SMC observed that TXH appeared very low on final approach to runway 22 and crossed the threshold travelling very fast. The ADC1 stated to the SMC and ADC2 controllers ‘he’s landed long’ and ‘gee he’s quick’.
The pilot of TXH assessed that he was not going to be able to stop the aircraft prior to the end of the sealed runway, but that there was a suitable grassed overshoot area beyond it, and maintained the aircraft on the runway centreline. ADC2 was standing up, and sighted EUU on taxiway A. ADC2 alerted the SMC to the Cessna (EUU) on taxiway A. ADC1 observed that EUU was then still north of the extended centreline of runway 22 on taxiway A.
As TXH approached the end of runway 22, the pilot of TXH sighted EUU taxiing on taxiway A to his right, and was unsure whether it was going to stop or not. He veered TXH to the right in an attempt to pass behind EUU and avoid a collision. At 11:39:25, the SMC directed EUU to ‘hold position, STOP, STOP’. The pilot of EUU braked immediately and as his body moved forward in response to the aircraft braking, he sighted TXH in his left peripheral vision. The pilot of TXH saw EUU brake suddenly.
The pilot of EUU assessed that if he stopped there, TXH would collide squarely with EUU, so he released the brakes and progressed forwards. The left wing of TXH then struck the tail of EUU and spun EEU around through about 180°. TXH continued veering to the right for about 20 m further before coming to rest on a grassed area (Figure 2).
Figure 2: Accident site
Source: Airport Operator
The pilot of TXH observed fuel spilling from the ruptured fuel tank and immediately exited the aircraft and reported that he was not injured. The pilot of EUU reported that he momentarily lost consciousness at the time of the collision, but came to within seconds. He then observed fuel leaking, and although feeling disoriented, he conducted a normal aircraft shut down, including switching off the aircraft electrics and fuel. He and the passengers disembarked and were treated for minor injuries. Both aircraft sustained substantial damage (Figures 3 and 4).
Figure 3: Damage to VH-TXH
Source: Airport operator
Figure 4: Damage to VH-EUU
Source: Airport Operator
Pilot comments
The pilot of TXH provided the following comments:
He did not declare an emergency as he assessed that he would be able to land the aircraft safely. He remained calm and focused on his approach to, and landing on, runway 22.
He wanted to ensure that if the engine failed completely he would have sufficient height to clear the buildings in the approach path of runway 22.
He did not have sufficient altitude to continue a circuit and land on 35R.
He was unable to stop the aircraft before the end of runway 22, but if there had not been an aircraft on the taxiway, he would have been able to stop safely in the overshoot area.
The pilot of EUU commented that as he was on Ground frequency and the pilot of TXH was on Tower frequency, he was not aware of TXH until he sighted it immediately prior to the collision. He reported that if he had been directed to stop earlier, it may have averted the collision.
Controller comments
The ADC1 controller provided the following comments:
The ADC1 offered the pilot of TXH the choice of runways to land on, but did not know what was achievable for the pilot or aircraft.
The ADC1 and ADC2 controllers both stood up when the pilot of TXH reported engine trouble.
The incident was a good example of how quickly things happen; about 90 seconds after an aircraft took off it was back on the ground and at least two aircraft had to be sent around in the interim.
The SMC reported checking the works strip under the runway designators in the console. The SMC scanned the eastern helicopter area, checked the taxiways that crossed runway 22 – ‘F’, ‘B’ and ‘C’ for any aircraft waiting to taxi, and did not see anything that may pose a risk to an aircraft landing on runway 22. Taxiway A was not a crossing taxiway for runway 22. The SMC reported that these scans were performed multiple times after the pilot of TXH advised of engine trouble. The SMC further commented that if TXH had maintained the runway centreline, the aircraft would not have collided.
Moorabbin Airport and weather conditions
Runway 22 at Moorabbin was 571 m in length, runway 35R was 1335 m. The wind was from 030° at about 7 kt, resulting in a tailwind on runway 22.
Air traffic control (ATC)
There were three ATC positions active at the time; a combined surface movement controller / coordinator position (SMC), an aerodrome controller – east (ADC1), and an aerodrome controller – west (ADC2). The three controllers were seated in the tower in that order from north to south facing towards the east, and were the only people in the control tower at the time. Runways 35L and 35R were the runways in use prior to the pilot of TXH reporting engine trouble. A runway in use is a runway under the control of an aerodrome controller. All runways are considered ‘active’ and a clearance is required to cross or enter any runway. The runways other than those in use, were held by the SMC. The ADC1 therefore required the release of runway 22 from the SMC prior to clearing TXH to land. The controller places the runway strips of the runways for which they hold responsibility, in the runway bay of the console.
Engineering inspection
A post-accident inspection of the engine of TXH found a small quantity of oil on the cylinders and some fouling of the spark plugs which may have led to the rough running.
Safety message
The ATSB publication Avoidable Accidents No. 3 – Managing partial power loss after take-off in single-engine aircraft, found causes of partial power loss after take-off include fuel starvation, spark plug fouling, carburettor icing and pre-ignition conditions. A pre-flight safety brief that considers actions to take following a partial power loss after take-off, gives pilots a much better chance of maintaining control of the aircraft and of responding immediately. Such actions include landing immediately within the aerodrome, landing beyond the aerodrome, and conducting a turn back towards the aerodrome.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 0730 (CDT) on 31 March 2015, intermodal freight train 2MP9 passed No. 1 signal at the southern end of the Mile End crossing loop (South Australia). The signal was displaying a 'Calling on/Low speed’ indication. The train proceeded at low speed, but subsequently collided with the rear end of intermodal freight train 2MP1, which was stationary on the main line. The collision resulted in moderate track damage and the derailment of three wagons at the rear of train 2MP1. There were no injuries to train crews.
What the ATSB found
The ATSB determined that the signalling and communications systems were operating correctly and as designed. The investigation found that the driver of train 2MP9, on receiving a ‘Calling on/Low speed’ signal indication, proceeded at a speed not greater than 25 km/h, but was unable to stop the train, ‘within half the distance the line ahead was clear’, as prescribed by the operational rules. The driver was aware that the operational rules stipulate that ‘block ahead may be occupied or obstructed’, but did not expect that train 2MP1 was stationary on the track so close ahead. As he approached train 2MP1, some stumpy vegetation and a low fence initially obscured his view of the empty flat wagons at the rear of the train. When the driver finally saw the rear of train 2MP1, he immediately made an emergency brake application, but was unable to stop the train before it collided with 2MP1.
The ATSB noted that the pathing of a train by a network control officer (NCO) onto a line occupied by a preceding train, when an alternate route is available and not obstructed, presents an elevated level of risk. Similarly, well thought out and clear communications between an NCO and crew of an approaching train, as to the proximity of a train occupying the track ahead, can significantly enhance situational awareness and reduce operational risk.
What's been done as a result
The Australian Rail Track Corporation (ARTC) and SCT Logistics have implemented a range of proactive strategies for enhancing the safe operation of train movements when entering an occupied section of track under a ‘Proceed restricted authority’ (PRA). This includes the use of all available infrastructure to reduce risk, encouraging communications between train drivers and NCOs where clarification of operational conditions is necessary, and a review of the National Train Communications System (NTCS) for the Adelaide area.
Safety message
Train drivers should carefully consider their obligations when accepting a ‘Calling on/Low speed’ signal indication in relation to sighting constraints, train speed and occupation of the track ahead. In circumstances where sighting constraints may exist, drivers should consider requesting further information from the NCO before moving through the track ahead.
NCOs should carefully consider the pathing of trains under their control, and the communication of information that may mitigate collision risk when dispatching trains.
Context
Location
The collision occurred almost adjacent to the interstate Adelaide Parklands Terminal (APT), located at Mile End. The APT is about 2 km southwest of the Adelaide CBD, in South Australia. Leader Street and Victoria Street level crossings are located south of the Mile End crossing loop, 590 m and 1,160 m from No. 1 signal respectively. The two at-grade crossings are controlled by flashing signals, boom barriers and audible signals.
Figure 8: Site overview Train and train crew information
Source: Google Earth - Annotations by ATSB
Train 2MP9 was a regular SCT Logistics intermodal freight service that operates between Melbourne and Perth. The train was configured with three locomotives at the head of the train (SCT009 leading, then SCT011 and SCT012 trailing) followed by 61 wagons. The train had an overall length of 1,641 m and a gross mass 3,807 t.
Locomotive SCT009 was equipped with a data logger (Loco-log) used for capturing information such as date/time, speed, brake pipe pressure, throttle position and distance travelled.
Train 2MP1 was an Aurizon intermodal freight service that also operates between Melbourne and Perth. The train was configured with two locomotives at the head (6027 leading and 6006 trailing) followed by 51 wagons. The train had an overall length of 1,452 m and a gross mass 2,968 t.
Train 2MP9 – train management prior to collision
Analysis of data extracted from the Loco-log (SCT009) for train 2MP9 (Figure 9) established:
As the train approached No. 1 signal, the driver progressively reduced the train speed and reached a near crawl (1 km/h) before commencing to accelerate.
When train 2MP9 passed No. 1 signal it was travelling at a speed of 8 km/h and continued to accelerate, reaching a maximum speed of 25 km/h. The driver then set the throttle to idle.
Eight seconds later the driver applied the dynamic brakes (D8) and immediately followed this with an emergency brake application.
About 6 seconds after the emergency brake application, a sharp decrease in train speed was evident, probably coinciding with the time that train 2MP9 collided with train 2MP1.
Figure 9: Graph derived from Loco-log SCT009
Source: Data SCT Logistics, graphed by ATSB
About 15 seconds later (post-collision), train 2MP9 was at stop.
Loco-log data established that while approaching Mile End, the driver of 2MP9 was actively controlling/maintaining the train’s speed by applying a range of throttle commands.
Train crew
The driver in control of train 2MP9 commenced working in the rail industry in 1984. He was a qualified diesel/locomotive fitter before becoming a train driver in 2010. At the time of the collision, he was appropriately qualified and route certified. The observer had about six years train driving experience. He was appropriately qualified and had travelled over the route on six previous occasions. At the time of the occurrence, he was undertaking the final phase of route certification training.
Environmental conditions
At about 0730, the weather at Kent Town (2 km east of the Adelaide CBD) was fine. Temperature was about 14°C and the wind calm. No rain had fallen in the preceding 24-hour period. Sunrise occurred at 0727. The sun was almost due east and provided good visibility. Environmental conditions leading up to the occurrence were not extraordinary and were considered unlikely to have contributed to the collision.
Track information
The track from Melbourne through to Mile End (Adelaide) substantially comprised a single line (bi-directionally signalled) with crossing loops strategically located throughout its length. The crossing loop at Mile End (Figure 2) was documented[4] as having an available standing room of 1,656 m. The measured distance between signals 4 and 45 (Main Line) and between 4E and 45E (Crossing Loop) was 1,750 m.
The Mile End crossing loop was controlled by fixed colour light signals using track circuits for train detection. From No. 1 signal (Figure 3 and Figure 10) at the southern end of the Mile End crossing loop, the track leading into the collision site basically comprised two relatively tight sweeping curves, the first to the left followed by a curve to the right. The track is on a very mild down grade before entering the crossing loop. Sighting along this section of track was intermittently obstructed by fixed infrastructure (Anzac Highway Bridge and APT Access Bridge) in addition to low bushes and a small tree.
Figure 10: No. 1 signal showing position of Calling on/Low speed aspect
Source: ATSB
Code of Practice – Operational rules
ARTC’s Code of Practice for the Defined Interstate Rail Network – Glossary (Clause 3.2) defines an Occupancy authority as falling into one of two groups:
Proceed authority (PA): A formal authority for a train to proceed in the forward direction under normal operating conditions where exclusive occupancy of the track section to which it applies is guaranteed.
Proceed restricted authority (PRA): A formal authority for a train to move in the forward direction at restricted speed to enter the limits of a preceding train or track obstruction.
Clause 2.4.2 of ARTC’s Code of Practice for the Defined Interstate Rail Network – Operations and Safeworking, Rules prescribes the separation requirements for a train operating under a PRA as:
The safe working system shall allow the authorisation of a train to enter a route where one of the following conditions apply:
(a)The route is proved clear taking into account rollingstock gauge limits and an allowance for overhang.
(b)The route is occupied by another train that is not moving.
(c)The route is occupied by another train that has departed and is not returning.
At Mile End, occupancy authorities were communicated to train drivers using colour light signals. No. 1 signal at Mile End (Figure 10) controls northbound trains entering the main line (6 points set normal) and entering the crossing loop (6 points set reverse). No.1 signal comprises a group of coloured lights that convey the status of the track (block) ahead and communicates information such as permissible track speed and/or restrictions that define the way a train should be driven.
The correct display and interpretation of the signal by the train driver is essential for a train to move safely through the block ahead.
The indications and meaning that can be displayed by No. 1 signal at Mile End are described in theCode of Practice for the Defined Interstate Rail Network – Volume 3 - Operations and Safeworking Part 1: Rules, January 2013 (Table 3.1).
Table 1: Signalling Systems – Fixed Signal Indications, Meanings and Application
Source: ARTC
In Table 1, a Calling on/Low speed when given, stipulates ‘A speed which will enable a train movement to be stopped within half the distance the line is seen to be clear ahead, but which does not exceed 25 km/h’ (ARTC Code of Practice, Issue 2 May 2002). The driver in control of the train is required to be able to stop short of any obstruction on the track ahead.
With respect to this occurrence, No. 1 signal at Mile End was displaying a Calling on/Low speed indication, authorising a train (2MP9) to proceed at low speed and enter a route occupied by another stationary train (2MP1).
The signalling events were consistent with the PRA provisions documented in the ARTC Code of Practice.
Signalling and communications – Mile End crossing loop
Signals and points at Mile End were remotely operated from a network control centre located at Mile End in South Australia, using the ARTC’s Phoenix control system (Figure 11, left photo – Adelaide metro network control board). The Phoenix system is a non-vital[5] CTC[6] system that provides real time monitoring and control of field hardware including signals, points, track circuits and the associated management of train movements. The system also includes an event logger to capture signal, points, track and train movement data.
Figure 11: Adelaide metro network control board (left photo) and Harmon vital logic controller (right photo)
Source: ARTC
The fail-safe[7] interlocking functions for the Mile End crossing loop were achieved using a vital logic controller (VLC). The Harmon VLC (Figure 11, right photo) was programmed to facilitate the safe movement of trains and incorporates two distinct levels of computer coding:
The executive code, is common to each class of VLC and comprises the software routines that:
Ensure that all vital outputs are fully controlled.
Verifies the state of vital inputs and outputs.
Removes power to vital outputs in all cases where a system failure has occurred, thereby placing field equipment into a safe mode.
The manufacturer embeds the executive code within the VLC.
The geographic code depicts the track layout (geography) and the railway’s operational rules/procedures. Specialist software engineers conversant in the geographic coding language enter geographic coding. The railway owner defines the requirements for a specific track layout in a ‘Control Table’, which is a documented version of the signal interlocking requirements. Software engineers then translate and enter the control table information into the VLC.
As previously mentioned, if a train is occupying the track ahead, a Calling on/Low speed signal may only be cleared if that train is stationary. Examination of the Mile End control tables established that this interlocking requirement was achieved by verifying that the main line had been occupied for at least 3 minutes.
Examination of event logger data (Phoenix control system) established that train 2MP1 had been standing on the main line for about 27 minutes before No. 1 signal (Calling on/Low speed) was cleared for train 2MP9. The driver of train 2MP9 confirmed that No. 1 signal (Calling on/Low speed) cleared for his train as it approached No. 1 signal. He indicated the signalling system appeared to function correctly.
Based on the interview with the train driver, an examination of the signalling control tables and a review of the Phoenix event logger data files, the ATSB was satisfied that the signalling system operated correctly for train 2MP9.
Network Control Centre West (NCCW)
Mile End is the interface between two ARTC geographical areas of control, with individual NCOs being responsible for south and Adelaide metro boards (areas). The south board NCO controls train movements from (but not including) Mile End to Wolseley. The Adelaide metro board NCO controls train movements from (and including) Mile End to Dry Creek North/Dry Creek and to Pelican Point. Voice communication between trains and ARTC’s network control centre was achieved using ARTC’s National Train Communications System (NTCS).
Network control officer (NCO)
The NCO involved with the occurrence commenced his employment with the railways in 1979. He had extensive experience and had been engaged as train controller/NCO from about 1997 onwards.
The NCO’s records established that he had been assessed as meeting the medical standards prescribed by the National Standard for Health Assessment of Rail Safety Workers. He was appropriately qualified to control the Adelaide metro board. At interview, the NCO reported being in good health and well rested prior to signing on for duty on 31 March 2015. There was no evidence to suggest that the NCO’s performance was affected by fatigue.
Post derailment the NCO underwent drug and alcohol testing, the results of which were negative.
2MP9 train driver actions
The primary task for the driver of train 2MP9 was to safely negotiate the track ahead, including the correct interpretation of No. 1 signal and the correct application of the relevant operational rules. In this regard, the driver’s actions could be broadly influenced by:
the level of route knowledge, training, experience and/or task competency
factors affecting the driver’s attention to the primary task
fatigue, medical condition and/or toxicology (drugs and alcohol)
Route knowledge, training, experience and task competency
A review of the driver’s records established that he was:
Certified and current for the route – Horsham to Mile End, including the section of track from No. 1 signal through to the point of collision.
Trained and current with respect to operational rules.
Experienced as a train driver – had been driving for about 5 years. It was further established that he had a sound understanding of locomotive/train dynamics because of his background as a qualified diesel/locomotive fitter. Accordingly, it was concluded that the driver was competent to perform the driving task.
A review of Loco-log data (Figure 9) established that after passing No. 1 signal and prior to making an emergency brake application, the driver maintained a speed below 25 km/h. However, the speed of the train was such that the driver could not stop 2MP9 before colliding with the rear of train 2MP1.
During interview, the driver affirmed that he was familiar with the route and had regularly traversed the section of track where the collision occurred. He accurately explained the meaning of the Calling on/Low speed indication. The driver described that when given a Calling on/Low speed indication, the train must not exceed 25 km/h and must be controlled so that it can stop short of any obstruction, within half the visible sighting distance ahead.
Based on a review of the driver’s qualifications as well as interview evidence, it is unlikely that the driver’s route knowledge, training, experience and/or task competency were factors that contributed to the collision.
Attention: workload and distraction
Workload
Human performance is highly variable and subject to a number of influencing factors. The term ‘cognitive workload’, refers to a measure of the type or nature of work being undertaken with regard to its demands on an individual’s cognitive resources. Cognitive workload can be in overload where the demands on the working memory are excessive, or in underload, brought about by periods of relative inactivity and boredom[8]. Factors influencing workload can include the quantity and complexity of concurrent or consecutive tasks, as well as time requirements for their completion. An individual’s familiarity with a task will also influence their cognitive workload.
Distraction
Distraction can be understood as a type of inattention, where a person’s attention is diverted by a particular event or object. Driver distraction has been more specifically defined as ‘the diversion of attention away from activities critical for safe driving toward a competing activity (occurring) voluntarily or involuntarily.’[9]
Driver distraction can involve a range of factors either inside or outside a vehicle that draw on limited human physical, visual and cognitive resources, and can result in a degradation of the driver’s performance. For example, eating, drinking, operating devices integral to (or brought into) the vehicle (such as a mobile telephone), smoking, or conversing with another occupant are all activities that may distract from the driving task[10].
The lead locomotive SCT009 was fitted with an event logger. It recorded data such as date/time train speed, distance travelled, traction effort, throttle position and operation of the vigilance system.[11] The driver recalled that as train 2MP9 approached the collision site (rear end of train 2MP1), he was concentrating on driving the train, including observing the track ahead. An examination of the loco-log established that:
The driver was actively controlling/maintaining the train’s speed on approaching No. 1 signal, Mile End. He reduced the train’s speed, to a near crawl (1 km/h) before the signal cleared.
When No. 1 signal cleared – Calling on/Low speed, he accelerated the train up to the permitted speed of 25 km/h.
He maintained the train’s speed at or below 25 km/h.
He responded quickly and positively on seeing the rear end of train 2MP1, making an emergency brake application.
In this occurrence, there was no evidence to indicate that the driver’s attention to the task, and thus his capacity to perceive and interpret important information (observing train 2MP1), was negatively affected by workload or distraction.
Fatigue
In the context of human performance, fatigue is a physical and psychological condition primarily caused by prolonged wakefulness and/or insufficient or disturbed sleep.[12] Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission.[13] Fatigue impairment has been identified as causal in many transport related accidents.
The driver involved in this occurrence was based at the SCT Logistics depot, Penfield. Examination of the roster shows that he had been on annual leave for 20 days prior to commencing duty at 2100 on 29 March 2015. He worked train 6PM9 through to Horsham in Victoria – arriving about 0500 (EDT) on 30 March. He rested in Horsham before resuming duty at 0100 (EDT) on 31 March, when he joined train 2MP9. For the first part of the journey (through to Tailem Bend), he worked as the observer. At approximately 0500, he swapped with the active driver and then drove train 2MP9 from Tailem Bend through to Mile End.
At the time of collision the driver had been in control of the train for about 2 ½ hours and was about 6 ½ hours into the rostered shift. When interviewed, the driver indicated that he had obtained a good sleep and was well rested prior to commencing shift. He had not noted feeling any effects of fatigue in the period prior to, or at the time of collision.
On balance, considering the driver’s hours worked, sleep opportunity, time of day, and his recorded driving responses/actions, it is considered unlikely that the driver was impaired by fatigue at the time of the occurrence.
Medical and toxicology
The driver and observer’s health records confirmed their health assessments were current. Both drivers had been assessed as meeting the required standard prescribed by the National Standard for Health Assessment of Rail Safety Workers. The ATSB’s investigation found no evidence to suggest that any medical or physiological factors had affected the driver or observer’s performance leading up to, or at the time of the collision.
Post-collision both drivers underwent drug and alcohol testing, the results of which were negative.
Other occurrences involving Calling on/Low speed movements
The ATSB has previously investigated one similar occurrence, (RO-2010-013), at Yass Junction, New South Wales on 9 December 2010. That incident involved a Calling on signalling related incident that resulted in the collision between two-grain trains, 3234N and 8922N.
The investigation concluded:
The driver of train 3234N was operating the train at a speed too fast for the prevailing conditions and intent of the Calling on signal.
At the time of the collision, it was dark with moderate rain. Sighting distance was limited by the curvature of the track, embankments, and the effective illumination of the train’s headlight.
The driver had expected to be told by the network controller if a train was stopped ahead so he could anticipate the location of the rear end of the train and drive accordingly.
While not contributing to the incident, the ARTC definition of restricted speed (at that time) required considerable judgement on the part of train drivers.[14]
The ATSB found that the speed of the train (being too fast for the prevailing conditions), was the primary factor in the Yass Junction collision. However, the ATSB also noted that providing the train crew with information regarding the status of the track ahead, probably offers an opportunity to reduce risk, by improving train driver awareness of upcoming risks.
From the evidence available, the following findings are made with respect to the collision between freight trains 2MP9 and 2MP1 at Mile End, South Australia on 31 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The train was travelling too fast for the prevailing conditions and the driver of train 2MP9 did not see the rear of train 2MP1 in sufficient time to stop and avoid the collision.
The driver of 2MP9 was unaware, and did not expect that train 2MP1 was stationary on the track ahead.
Vegetation and a low fence adjacent the Mile End crossing loop partially obscured the view that the crew of train 2MP9 had of the empty flat wagons at the rear of train 2MP1. [Safety issue]
The practice of pathing a following train onto a line occupied by a preceding train, when an alternate route was available and not obstructed, presented an elevated level of risk. [Safety issue]
Other factors that increased risk
The practice of pathing a following train onto the same line occupied by a preceding train, without pre-warning the driver regarding the train ahead, presented an elevated level of risk. [Safety issue]
The design of the NTCS in screening Adelaide metro broadcast communications prevented the driver of 2MP9 from gaining an appreciation of activities close to his area of operation, in particular the position of train 2MP1 along the Mile End main line. [Safety issue]
Other findings
The signalling and communications systems were operating correctly and as designed.
Operational rules for a ‘Calling on/Low speed’ signal allow for the dispatch of a train into a route that is occupied by another train at stop.
Safety analysis
Based on a review of evidence gathered during this investigation, the ATSB concluded that:
There were no mechanical deficiencies with train 2MP9 which contributed to the collision.
The signalling and communication systems operated correctly and as designed.
Train 2MP9 proceeded past No. 1 signal and travelled at a speed not greater than 25 km/h.
The driver of train 2MP9 was unable to stop the train, in accordance with the operational rules, and collided with the rear of train 2MP1.
The following safety analysis focuses on factors that may have influenced the train driver’s awareness and sighting of train 2MP1.
Conspicuity of the rear of train 2MP1
Conspicuity refers to those characteristics of an object or condition that determine the likelihood that it will come to the attention of an observer. Some of the key attributes that contribute to the conspicuity of an object are its brightness, contrast and physical size. In general terms, objects that stand out from their visual background are more easily noticed, and, when all else is equal, larger objects are generally easier to see and hence more conspicuous than smaller objects[15].
The driver and observer of train 2MP9 both remarked that they had not seen the empty flat wagons at the rear end of train 2MP1, or the end-of-train (EoT) marker[16], until their train was about 110 m from the rear end of 2MP1 at which time the driver made an emergency brake application.
Train 2MP1 had been marshalled[17] with a number of empty flat wagons at the rear of the train; the last having an end-of-train (EoT) marker attached. It is common practice, and in most cases desirable[18], for lightly loaded or empty wagons to be marshalled to the rear of a train. In this case, this configuration reduced the conspicuity of the rear of train 2MP1.
It was also noted (post-collision) that the rear end of train 2MP1 was partially obscured by stumpy vegetation and a low fence (Figure 4). As is evident in Figure 4, after passing under the APT Access Bridge the train driver and observer could see parts of the track ahead as it swept gradually to the right. However, the vegetation (part of which is outside the ARTC rail corridor) and fence obscured parts of the track. It was likely that with intermittent opportunities to observe the track ahead, the empty flat wagons at the end of train 2MP1 were not sufficiently conspicuous against the visual background as to be perceived by the crew of 2MP9. Thus, the driver did not recognise the need to slow the train (below 25 km/h) as there was no apparent obstruction in his visual field.
Expectancy
Another factor, which can influence performance, is expectancy. An individual’s expectations of events can significantly influence their interpretation of information in the environment. Research has established that individuals often fail to notice unexpected events, even ones that are important. Even when objects are designed for visual distinctiveness, they will be missed if they do not fit within an individual’s expectations. Overcoming the powerfulness of expectancy is challenging, particularly because people will generally assume that, by looking in the right direction, unexpected objects and events will grab their attention.[19]
Interview evidence indicated that upon observing No. 1 signal displaying a Calling on/Low speed indication, the driver and observer believed that the train ahead of them was most likely moving out of the section. At interview after the collision, the driver and observer stated they could not understand why the NCO had attempted to path their train (2MP9) close in behind 2MP1, as there was very little room for 2MP9. The driver also commented that while the NCO was not procedurally obliged to advise them regarding the position of train 2MP1, had the NCO briefed the driver, he would have approached the site more cautiously, probably at a crawl speed. It was evident that the train crew were not expecting a train so close ahead.
Network control officers’ actions
Two of the primary tasks for a network control officer (NCO) are safe and efficient pathing of trains.
As trains 2MP1, 2MP9 and the Indian Pacific (1PA8) approached Mile End they came under the jurisdiction of the Adelaide metro network controller. The NCO examined the geographic positioning of the three trains, considered the pathing opportunities, and decided that train 2MP1 should be held at Mile End to allow the Indian Pacific (1PA8) to be pathed into the Adelaide Parklands Terminal (APT). The NCO expected these two movements to complete before train 2MP9 was to move through Mile End. He pre-selected/stored the routes accordingly. While the signalling system allows routes to be pre-selected/stored, for safety reasons, the interlocking enforces a substantial timeout period if pre-selected/stored routes are cancelled. Therefore, once the NCO had pre-selected/stored routes for 1PA8, 2MP1 and 2MP9, his decisions were somewhat locked in place.
The Indian Pacific (1PA8) did not arrive at the APT as early as the NCO had anticipated. This delay resulted in the NCO electing to hold 2MP1 on the main line within the limits of the Mile End crossing loop, with 2MP9 approaching on the main line behind.
The NCO was busy communicating with the driver of 2MP1 and was intently focussed on the timely dispatch of 2MP1 as soon as 1PA8 was within the APT limits. This was probably for two reasons; firstly to keep train 2MP1 moving and facilitate the efficient pathing of 2MP9 through the Mile End crossing loop. The second reason was to limit the time that train 2MP9 would block the Leader Street and Victoria Street level crossings during the busy morning peak. To move 2MP9 off the level crossings and onto the main line of the Mile End crossing loop, the NCO recognised the need to get 2MP1 moving and out from the crossing loop.
It was evident from network control voice recordings that all communications had been with the driver of train 2MP1 – the NCO’s perceived priority. The NCO was providing information regarding the progress of train 1PA8 to expedite the efficient pathing of all three movements, and subsequently clear train 2MP9 off the level crossings. However, there was no similar information communicated to the crew of 2MP9 until moments after the collision.
For signalled movements there was no requirement for the NCO to advise either driver of the status of the track ahead. A correctly functioning signalling system will provide protection for a ‘Proceed authority’ (PR), but it cannot do so absolutely for a ‘Proceed restricted authority’ (PRA). While a PA can only be provided if the track ahead is clear, a PRA by the nature of the operational rules allows for joint track occupation, which results in a reduction of defences against train conflicts.
While the signalling system and rules provide protection for train movements, the sweeping curve, stumpy vegetation and low fence, combined with the reduced physical conspicuity of train 2MP1 inhibited the driver of train 2MP9 from perceiving the train ahead. In the absence of any additional information alerting 2MP9’s driver as to the proximity of train 2MP1, the driver assumed the track ahead was clear, and was unable to stop in accordance with the half-distance sighting rule, to avoid the collision.
It was also evident that when pre-selecting routes for 1PA8, 2MP1 and 2MP9, the NCO had not expected a delay to 2MP1 departing the main line in Mile End. The intent was for the Indian Pacific (1PA8) to clear into the APT, for 2MP1 to continue on from Mile End and for 2MP9 to pass largely unimpeded onto the main line at Mile End.
Without presuming the contribution of other factors, an alternative and potentially safer option for the NCO may have been to path train 2MP9 onto the loop track at Mile End. This option would have removed the occupancy conflict that occurred due to the delayed departure of train 2MP1.
It is likely that adoption of defensive pathing solutions and the timely communication of information to train crew are both strategies that could reduce safety risk to rail operations.
National Train Communications System
The ARTC National Train Communications System (NTCS) was (in part) designed to emulate an open channel (‘party-line’) communication system so that train drivers and track workers could maintain awareness of activities close to their area of operation. However, due to the high volumes of radio traffic and the potential for this to cause train driver distraction, this function was not enabled for the Adelaide metro area. Consequently, due to the configuration of the NTCS system, the driver of 2MP9 did not hear any dialogue between the driver of 2MP1 and the NCO regarding the pathing of train 2MP1 and 1PA8. The driver of 2MP9 was therefore not fully aware of activities close to his area of operation – in particular the position of train 2MP1 on the Mile End main line.
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Safety issue description: Vegetation and a low fence adjacent the Mile End crossing loop partially obscured the view that the crew of train 2MP9 had of the empty flat wagons at the rear of train 2MP1.
Safety issue description: The practice of pathing a following train onto a line occupied by a preceding train, when an alternate route was available and not obstructed, presented an elevated level of risk.
Safety issue description: The practice of pathing a following train onto the same line occupied by a preceding train, without pre-warning the driver regarding the train ahead, presented an elevated level of risk.
National Train Communications System (NTCS) – Broadcast communications
Safety issue description: The design of the NTCS in screening Adelaide metro broadcast communications prevented the driver of 2MP9 from gaining an appreciation of activities close to his area of operation, in particular the position of train 2MP1 along the Mile End main line.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
The Australian Rail Track Corporation
SCT Logistics
References
ARA Glossary for the National Codes of Practice and Dictionary of Railway Terminology
Bureau of Meteorology - Weather Observations for Adelaide, South Australia (31 March 2015)
RISSB Glossary of Railway Terminology – Guideline
Code of Practice for the Defined Interstate Rail Network – Volume 2 – Glossary
Code of Practice for the Defined Interstate Rail Network – Volume 3 – Operations and Safeworking Part 1: Rules
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to:
SCT Logistics
The Australian Rail Track Corporation
The Office of the National Rail Safety Regulator
The crew of train 2MP9 and the Network Control Officer involved in the occurrence.
Submissions were received from SCT Logistics, the Australian Rail Track Corporation, the Office of the National Rail Safety Regulator and the driver of train 2MP9. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
The occurrence
The two drivers involved in the occurrence booked on for duty at the SCT Logistics Penfield Rail Freight Terminal (about 33 km north of the Adelaide CBD) in South Australia at 2100[1] on 29 March 2015. They worked train 6PM9 through to Horsham in Victoria, arriving at about 0500 (EDT) on 30 March. They rested in Horsham (motel accommodation) before resuming duty at 0100 (EDT) on 31 March. The drivers were rostered to join train 2MP9, a scheduled SCT Logistics (SCT) intermodal freight service, operating from Melbourne in Victoria through to Perth in Western Australia.
Train 2MP9 arrived in Horsham at 0208 (EDT). The crew changeover occurred as planned, with the train departing at 0216 (EDT). Train 2MP9 crossed with train 2XM2 in Tailem Bend, South Australia (120.298 km)[2]. While near Tailem Bend, the drivers of 2MP9 exchanged their respective driver/observer roles. This was the last driver exchange before the occurrence.
As train 2MP9 passed through Tailem Bend (about 0513), an Aurizon intermodal freight train (2MP1) also enroute from Melbourne to Perth was about 48 minutes ahead. Both trains continued on their journey towards Mile End (Figure 1).
Figure 1: Location map – Mile End, South Australia
Source: NatMap Railways of Australia
At about 0645, Aurizon train 2MP1 passed through Belair (22.510 km), at which time the SCT train 2MP9 was travelling the Ambleside (42.670 km) - Mt Lofty (30.972 km) section[3]. At about the same time, a change of shift was occurring at the ARTC Network Control Centre West (NCCW). The incoming Adelaide metro network control officer (NCO) familiarised himself with train movements coming under his control, which included 2MP1 and 2MP9.
At about 0700, the NCO set No. 1 signal (Figure 2) for 2MP1 to enter the Mile End crossing loop, on the main line. No. 44 signal had been pre-selected to clear for the Indian Pacific passenger train (1PA8), coming from the north, to enter the Adelaide Parklands Terminal (APT). No. 45 signal was at stop for 2MP1.
Figure 2: Mile End signal schematic
Source: ATSB
At about 0710, as train 2MP1 was transiting through the Mile End main line, train 2MP9 was passing through Belair and approaching Mile End from the south. At this time, the Indian Pacific was nearing Dry Creek (Figure 1), about 17 km to the north of Mile End. Signal No. 44 cleared to proceed at 0711:34.
2MP1 came to a stand on the main line fully within the Mile End crossing loop, about 200 m before signal No. 45. The rear end of the train was about 90 m from No. 4 signal. At about 0717 the NCO, in communication with the driver of 2MP1 (stationary Aurizon train), advised that the Indian Pacific was passing through Islington, about 8 km north of Mile End. He further advised that their train (2MP1) would be dispatched as soon as the Indian Pacific was clear of the main line and within the APT limits. At about 0723, the NCO pre-selected No. 45 signal. It was now set to automatically clear for train 2MP1 when the Indian Pacific was within the APT limits.
At about this time, train 2MP9 was passing through Hawthorn (suburb south of Adelaide), about 5 km south of Mile End. The train was now approaching NR8 signal displaying a caution/yellow aspect. This indication communicated that the next signal, No. 1 at Mile End, would be at stop. The driver continued towards No. 1 signal progressively reducing the train’s speed to a near crawl (1 km/h). At about 0738, with train 2MP9 about 500 m from No. 1 signal (Figure 3), the NCO selected the Calling on/Low speed signal so as to path 2MP9 into Mile End on the main line directly behind train 2MP1. The driver saw the No. 1 Calling on/Low speed signal clear and commenced to accelerate his train towards the maximum allowable speed of 25 km/h, but ready to stop should he see an obstruction on the track ahead.
Figure 3: Site overview near Adelaide Parklands Terminal (APT)
Source: Google Earth - annotations by ATSB
The Indian Pacific passed through Torrens Junction (3.281 km north of Mile End) at about 0737 and continued towards Mile End. As the Indian Pacific passed No. 44 signal at Mile End the NCO began to brief the driver of train 2MP1 (stationary Aurizon train) regarding the pending departure of his train.
By this time, train 2MP9 had passed under the Anzac Highway Bridge. It was traversing a sweeping left curve as it approached Mile End 6 points near the APT Access Bridge (Figure 3).
Train 2MP9 continued on a very mild down grade, reaching a speed of 25 km/h before entering a sweeping right curve. Just after clearing the APT Access Bridge, the driver was able to see the track to a distance of about 150 m ahead, which initially, to him, appeared clear (Figure 4).
Figure 4: Cab view post-collision reconstruction, about 150 m from the rear end of 2MP1
Source: SCT Logistics, annotations ATSB
After travelling, a further 40 m (Figure 5) the driver saw what appeared to be a series of empty flat wagons on the track ahead. He applied the train’s dynamic brakes (D8) and immediately followed this with an emergency brake application.
Figure 5: Cab view post-collision reconstruction, about 110 m from the rear end of 2MP1
Source: SCT Logistics, annotation ATSB
He was unable to stop the train before colliding with the rear end of 2MP1 (Figure 7) at an estimated speed of 22 km/h.
Figure 6: Cab view post image reconstruction, about 60 m from rear end of 2MP1
Source: SCT Logistics, annotation ATSB
Figure 7: Collision site - lead locomotive SCT009 in the background
Source: ATSB
About 9 seconds after the collision, the NCO contacted the driver of 2MP9 to advise that the train (2MP1) in front would be getting a signal shortly. The driver of 2MP9 responded indicating that he had already run into the back of train 2MP1.
Events post-collision
Following the collision, the NCO restored No. 45 signal to prevent the unintentional dispatch of Aurizon train 2MP1. The NCO then proceeded to close the track to other rail traffic and checked on the well-being of the drivers of both trains 2MP1 and 2MP9. The drivers of Aurizon train 2MP1 advised they were uninjured. The crew of SCT train 2MP9 advised they were shaken but otherwise uninjured. The driver of 2MP9 then de-trained, assessed the extent of collision damage and passed a damage report to the NCO and the management of SCT Logistics.
Accident investigation and recovery personnel were dispatched to site. The drivers and NCO were tested for the presence of drugs and alcohol. Recovery personnel commenced necessary restoration works with the track being re-opened to traffic later that day.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 29 March 2015, an Aeronavics SkyJib 8 remotely piloted aircraft (RPA) (Figure 1) was being used to assist with media coverage of the International Cricket Council World Cup Final, at the Melbourne Cricket Ground (MCG), Melbourne, Victoria. The RPA was being operated from the top of the south-western scoreboard of the MCG. The operating team consisted of:
a flight controller, who piloted the RPA
a ground station controller, who performed a range of functions including monitoring the position of the RPA and providing a back-up control for the flight controller
a camera gimbal controller, who controlled the camera mounted beneath the RPA.
Figure 1: RPA prepared for flight with camera mounted beneath
Source: RPA operator
The accident flight followed four earlier uneventful flights that day. The crew completed all pre-flight checks[1] and made broadcasts on appropriate air traffic frequencies, then launched the RPA at about 1430 Eastern Daylight-saving Time. On this particular flight, the operator intended to capture footage of the MCG and surrounds as the competing teams entered the MCG and during the pre-match ceremonies. The RPA’s take-off and departure were normal. The RPA was flown slowly southward toward Hisense Arena (Figure 2), climbing to a height of about 300 ft above ground level. The route was similar to that flown during earlier flights, without incident. All three control systems (flight control, ground station control and camera gimbal control) appeared to be functioning normally during the departure and transit to Hisense Arena.
About 2 minutes into the flight and soon after the competing teams entered the MCG, with the RPA over the northern roof of Hisense Arena, the camera gimbal operator lost control of the gimbal. The gimbal operator reported the loss of control to the other team members. Several seconds later, the ground station controller also lost communication with the RPA. At that point, with the RPA moving slowly southward over Hisense Arena, the flight controller made a decision to discontinue the flight and return the RPA to the top of the scoreboard. The flight controller made appropriate control inputs but found that the RPA was unresponsive, and it continued to move slowly southward.
Having lost normal control of the RPA, the flight controller commenced alternate RPA recovery procedures. The flight controller switched from GPS to attitude mode,[2] but was still unable to control the RPA. The flight controller then activated the ‘return to home’ function, but this was also ineffective. The flight controller then reverted to manual control,[3] in an attempt to recover control of the RPA, but the RPA remained unresponsive. Throughout this time, the ground station controller continued attempts to re-establish communication with the RPA, also without success.
About 20 seconds after the initial control problems, the RPA commenced travelling at medium speed in a westerly direction, and began slowly descending. The flight controller continued attempts to re-establish control by switching between control modes and again activating the ‘return to home’ function, but all attempts were unsuccessful. When the RPA reached a point south of Rod Laver Arena, it appeared to cease lateral movement and stabilise just above treetop level. Continued attempts by the flight controller to regain control were unsuccessful, and the RPA descended beneath the treetops, out of sight of the controlling crew.
The RPA collided with terrain on the median strip on Batman Avenue to the south of Rod Laver Arena, a little over 3 minutes after the flight had commenced. The operating crew had maintained line of sight with the RPA until it descended beneath the treetops. Initial control difficulties were experienced when the RPA was just over 200 m from the position of the operating crew. The collision with terrain was about 450 m from their position (Figure 2).
There were no injuries to people on the ground, and no damage to other property, but the RPA and associated equipment were substantially damaged during the collision.
Figure 2: Approximate flight path of the RPA, from the take-off location on top of the south-western scoreboard at the MCG, to where control was lost over Hisense Arena and the collision location on Batman Avenue
Source: Google Earth with additions by the ATSB
Operator’s approval and risk assessment
The operator had approval from the Civil Aviation Safety Authority to operate the RPA near people and over populous areas while taking aerial photography during the event. The approval included a number of conditions related to such things as RPA control capabilities, the operating area and the operating environment. The operator had also conducted a risk assessment relevant to the flight during which the accident occurred. This assessment included consideration of a range of environmental factors, and outlined a number of risk mitigation measures. Among other things, the risk assessment included consideration of:
weather conditions that may affect control of the RPA
light conditions that may affect the ability of the operating crew to maintain visual contact with the RPA
the intended flight path with respect to the location of people and property
the location of structures, other obstacles and other air traffic that may affect the flight
the adequacy of emergency procedures and possible equipment failure modes
the operating environment in terms of noise and possible distractions (operating crew and members of the public).
Operator’s investigation
The operator investigated the accident, with a particular focus of establishing the reasons for which control of the RPA was lost. The investigation included consideration of a number of system-related and environmental factors, and the behaviour of the RPA following the loss of control.
The operator’s report concluded that radio frequency interference was the most likely cause of the accident. The volume of radio frequency traffic at the time of the accident was probably substantial, and perhaps sufficient to override RPA control signals. Numerous fixed telecommunications facilities and mobile broadcast vehicles in the vicinity of the MCG were probably transmitting at the time of the accident. Over 93,000 people attended the event, many of whom were probably using personal mobile communication devices at about the time of the accident. Furthermore, the use of portable communication devices by event management personnel (such as security and emergency services personnel) may also have contributed to the volume of radio frequency traffic.
The operator considered that the behaviour of the RPA was consistent with signal interference or confusion, rather than signal loss. In the event that the signal was lost, the RPA would have entered a fail-safe mode. In fail-safe mode, if the RPA had a valid GPS signal it would have returned to the starting point and landed. Without a valid GPS signal, the RPA would have held position, then descend slowly in that position, until touch down. Additionally, the operator found no evidence that there was any fault with the RPA control systems or any hardware issues, which may have resulted in the loss of control.
The operator’s investigation report commented that very similar operations had been conducted without incident prior to the accident flight. On this particular flight, the scale of the event, and probably the amount of associated radio frequency traffic, were more substantial. The operator’s report also acknowledged that further testing and analysis was required before the primary cause of the accident could be confirmed beyond doubt.
Safety action
As a result of this occurrence, the RPA operator has advised the ATSB that they are planning further tests to better understand the nature of the loss of control of the RPA. A better understanding of the nature of the problem may allow identification of engineering measures to reduce the risk associated with the possibility of radio frequency interference.
The operator also intends to review procedures and update risk assessments considering the circumstances surrounding this accident.
Safety message
On this occasion, the available evidence suggests that a high volume of radio frequency traffic compromised RPA control and communication functions. This accident highlights the need for careful consideration of ‘what might be different this time’ during risk assessments, including the identification of appropriate risk mitigation strategies. Although the operator had conducted a risk assessment for the accident flight, the possible effects of a substantial increase in the volume of radio frequency traffic had not been specifically considered.
In a broader sense, this accident highlights the ongoing importance of appropriate RPA operational controls and procedures. These are particularly important where operations are intended in the vicinity of populated areas or other air traffic. The careful application of operational controls and procedures, underpinned by robust risk assessment, will become increasingly important as relevant technologies develop further and new RPA applications continue to emerge.
Important information for RPA operators, including information about relevant regulations, operational approval requirements and RPA associations, is available on the CASA website.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 14 March 2015 Malaysia Airlines Airbus A330, registered 9M-MTA, began its approach to Melbourne (Tullamarine) after a flight from Kuala Lumpur. In the final stages of the approach, at approximately 50 feet, the captain reported feeling the aircraft sink and manually increased the thrust to the engines in an attempt to slow the rate of descent. Despite this action, the aircraft experienced a hard landing of a magnitude requiring replacement of the aircraft’s main landing gear. There were no reported injuries as a result of the occurrence.
What the ATSB found
The ATSB found that as a result of the pilot flying’s control inputs after disengaging the autopilot (approximately 700 feet above the ground), the final approach had become unstable, descending below the desired vertical profile. The continuation of the approach and an inappropriate attempt to recover the situation led to a high rate of descent at touch down.
What has been done as a result
Soon after the event, the operator circulated a memorandum to their A330 flight crew highlighting the incident and advising of the relevant procedures intended to minimise the chances of a similar occurrence. The flight crew involved also undertook additional training and assessment before returning to flight duties.
Safety message
A stable approach significantly reduces the risk of a hard landing.
If an approach does become unstable, a rushed attempt to recover the approach may produce an undesirable aircraft response. There is also a risk of breaking down the shared understanding between the pilots, which in turn limits the opportunity of the other flight crew to detect or react to inappropriate actions.
When landing, pilots should maintain a safety philosophy of “if in doubt, go around”.
Safety analysis
A stable approach is a crucial element of final approach. Identifying an unstable approach and taking the appropriate corrective action is key to maintaining safety at touch down. This analysis examines the stability of the aircraft and the decision making in the final stages of the approach.
Stability of the final approach
Information published by the Flight Safety Foundation (Flight Safety Digest, August 2004, Stabilized Approach and Flare Keys to Avoiding Hard Landings) indicated that in 2004, hard landings were the highest number of recorded accidents in the preceding 10 years. The study found that a stable approach and flare were key to avoiding hard landings.
Analysis of the flight data relating to the stability of the final approach showed from 300 feet the approach was unstable due to large control inputs, erratic rates of descent and deviation below the glide path. Throughout the final approach, the PF’s sidestick inputs determined the aircraft’s vertical profile and, in the absence of any external factors, were therefore contributing to the unstable approach.
Monitoring and Communication
Researchers (Klein 1999, Kahneman, 2011) have stated that, in time-constrained environments, individuals can make decisions using intuitive reasoning where the steps are often unconscious and based on pattern recognition. For intuitive decision-making, an experienced individual will identify a problem situation as similar to a situation they have dealt with before and will extract a plan of action from memory. If time permits, they will confirm their expectations prior to initiating action. If time does not permit, actions will be initiated with uncertainty that may result in a poor decision.
In this investigation, the PM was late to recognise that the approach was unstable and as such did not encourage the PF to conduct a go-around, as per the operator’s standard operating procedures.
During the last 50 feet of the approach (4 seconds before touch down) the PF inappropriately used the thrust levers in an attempt to arrest the high rate of descent. Despite the absence of the standard phraseology of ‘go-around’ by the PF, the PM mistook this advancement of the thrust levers as the initiation of a go-around. The PM, expecting that the PF had initiated a go-around and realising that the aircraft was still descending with a nose-down attitude, placed their hand on the sidestick and applied a nose up input. A dual input was therefore recorded as the aircraft touched down.
Probably due to time constraints, neither crew member communicated their intentions. Neither the initial thrust advancement nor the subsequent thrust reversal by the PF were communicated to the PM. As a result, the PM was unclear about the action taken by the PF.
Continuation of the approach
Large and erratic pitch inputs by the PF, as well as large fluctuations in the rate of descent and visual reference of the PAPI lights provided opportunities for the crew to recognise an unstable approach. Despite this, there was no evidence of actions or support language to suggest that the unstable approach was identified. The operator’s procedures whereby an unstable approach should result in a go-around, were not followed.
The manual thrust technique used by the captain to arrest the sink and recover the approach was used on other aircraft types previously flown by the captain. There was no current approved procedure on the A330 for this technique. However, analysis of the flight data determined that this action alone did not contribute to or increase the severity of the hard landing.
The captain and first officer advised at interview that, in retrospect, they should have conducted a go-around in accordance with the operator’s training procedures. The Flight Safety Foundation publication noted earlier indicated that runway contact from a late go-around is preferable to attempting to recover an unstable approach.
Elements of an unstable approach are not unusual during flight operations. However, the actions taken by flight crew in response are key to maintaining flight safety. The training records of the crew were reviewed to establish the possibility that a training or performance issue led to the PF’s actions. Apart from the PF’s misunderstanding of the use of the thrust levers to reduce the rate of descent, there was no indication of a systemic issue with either crew member.
The occurrence
On 14 March 2015, at about 0750 EST[1] an Airbus A330-343 (A330) aircraft registered 9M-MTA and operated by Malaysia Airlines Berhad, began its final approach to runway 34 at Melbourne Airport. The flight was a regular passenger service from Kuala Lumpur, Malaysia to Melbourne, Australia. Bureau of Meteorology weather data was consistent with the flight crew’s reports of fine flying conditions. The flight crew consisted of a captain, who was the pilot flying (PF[2]) and a first officer, who was pilot monitoring (PM).
The approach to runway 34 at Melbourne airport was not equipped with an Instrument Landing System (ILS), so a non-precision approach was performed. Runway 34 had a precision approach path indicator (PAPI) system consisting of four lights that provided visual guidance for the pilots to determine if the aircraft was maintaining the correct glide path. Figure 1 shows what a crew flying using the PAPI system would expect to see depending on their relative height to the correct approach path. A crew maintaining the nominal 3° path should see two white lights and two red lights.
Figure 1: Precision approach path indicator (PAPI) system
Source: Flight Safety Australia
Melbourne airport is equipped with a precision approach path indicator (PAPI) system. The system provides a method for pilots to maintain the 3° glide path by referencing the colour of the four lights. The crew of an aircraft on the 3° glide path would see two white lights and two red lights
Unstable approach developed
Flight data showed that the PF disengaged the autopilot at approximately 700 feet above ground level (AGL) and from that point until touchdown there was an increase in the frequency and magnitude of sidestick pitch control inputs by the PF (Figure 4).
In response to these inputs the aircraft’s autothrottle system varied the engine thrust to maintain a target speed, as per system design, and the aircraft pitch angles fluctuated between approximately -0.5° nose down and +5.0° nose up. The net result of the varying thrust settings and pitch angles was a fluctuating rate of descent between approximately 380 and 960 feet per minute.
Large sidestick inputs, specifically nose-down, also have the potential to inhibit the vertical speed reduction function, which is an automated function that provides some protection against touchdown at very high vertical speeds.
The Operator’s Flight Crew Training manual included the following information about the disconnecting of the Autopilot:
----
AP Disconnect
During the final approach with the AP engaged, the aircraft will be stabilised. Therefore, when disconnecting the AP for a manual landing, the pilot should avoid the temptation to make large inputs on the sidestick.
The pilot should disconnect the autopilot early enough to resume manual control of the aircraft and to evaluate the drift before flare. During crosswind conditions, the pilot should avoid any tendency to drift downwind.
Some common errors include:
• Descending below the final path, and/or
• reducing the drift too early.
----
As the aircraft passed 300 feet above ground level (AGL) a rate of descent of 960 feet per minute was recorded. This neared the operator’s maximum stabilised approach limit of 1000 feet per minute when below 500 feet AGL. As well as a high rate of descent, actual exceedances of the operator’s stabilisation criteria included:
large changes to pitch inputted by the pilot flying, including negative pitch values,
fluctuations in the rate of descent over a large range that were abnormal for the phase of flight,
incorrect glide path. From approximately 250 feet AGL, the aircraft was trending low and continuing below the glide path. At this point the pilots would have been able to observe 3 red lights and one white light on the PAPI. This trend was allowed to continue until the aircraft was well below the desired glide path to the extent that the PAPI would have indicated 4 red lights from approximately 125 feet AGL (Figure 2). From this point the PF made numerous pitch commands which were mostly nose down. These included a full range nose down deflection at 24 feet AGL.
Figure 2: Aircraft path relative to the PAPI indications the pilots would have observed during the approach
Source: ATSB
Figure 2 displays in green the ideal glide path during an approach and the PAPI thresholds in red (low) and white (high). The yellow is the actual path of the aircraft derived from the flight data. Just below 150 feet 4 red light would have been indicated to the crew.
Unstable approach was continued
The company procedures and manufacturer’s recommendations dictated that if an approach becomes unstable below 500 feet AGL, a go-around must be initiated by the pilot flying (PF) and/or the pilot monitoring (PM) must alert the PF of the unstable approach and encourage a go-around (Figure 3).
Included in the operator’s flight crew training manual and the manufacturer’s operating philosophy of the aircraft were a set of ‘golden rules’ to be followed by flight crew at all times whilst operating the aircraft. Rule number 4 was as follows:
----
If the aircraft does not follow the desired vertical or lateral flight path, or the selected targets, and if the flight crew does not have sufficient time to analyse and solve the situation, the flight crew must immediately take appropriate or required actions, as follows:
The PF should change the level of automation:
From managed guidance to selected guidance, or
From selected guidance to manual flying.
The PNF should perform the following actions in sequence:
Communicate with the PF
Challenge the actions of the PF, when necessary
Take-over, when necessary.
----
During flight crew interviews there was no indication that the pilot not flying (PNF-now referred to as the PM) communicated with the PF about the unstable approach conditions, considered taking over from the PF, and/or encouraged the PF to conduct a go-around.
Figure 3: Extract from the operator’s Operations Manuals current at the time of the occurrence.
Source: Malaysia Airlines
Attempted recovery from unstable approach
At 60 feet AGL the captain moved the thrust levers forward momentarily into the TOGA (Take-off/Go Around) detent. The captain stated that this was done in response to a feeling that the aircraft was sinking below the path, and the intention was to reduce this sink by applying more thrust to the engines. The placement of the thrust lever into TOGA placed the aircraft automation into the go-around autopilot modes and changed the display on the primary flight display flight mode annunciator (FMA). The captain subsequently reduced the thrust levers.
The PM, on seeing the modes on the FMA change assumed that a go-around was being conducted and awaited further announcement from the captain. The PM reported noticing the thrust levers reducing and that the aircraft was not flaring and applied nose up input to the sidestick at the same time as the PF.
At the time of the occurrence there was no procedure on the A330 for the use of manual thrust for this purpose. Prior to 2009, a procedure existed in the Airbus A330 documentation that allowed a specific use of manual thrust in difficult environmental conditions. Airbus advised that after an analysis of in-service events the procedure was removed from all operational documents. A flight crew operations manual (FCOM) Bulletin was published at the time which explained the removal of the procedure
Manipulation of the thrust levers in this manner had the effect of:
disengaging the autothrottle thereby inhibiting some of the available auto flight system protections including the target speed function (which automatically maintained the desired speed and adjusted for fluctuation in the wind), and the vertical speed reduction function
causing a pitch up tendency – as underslung engines increase thrust, they typically apply an upward pitching moment to the aircraft. This usually requires a large nose down input by the pilot flying to prevent the aircraft from pitching up. At this stage in the approach applying large nose down inputs differed from the gradual nose up input normally required to complete the flare.
breaking down of the shared mental model between the pilot flying and pilot monitoring in that the pilot monitoring believed the advancement of the thrust levers was the initiation of a go-around.
Shortly after this action, the aircraft touched down at a vertical speed of approximately 700 feet per minute and a vertical acceleration of 2.61 G was recorded. The aircraft also touched down at approximately 170m (560 feet) from the landing threshold, short of the normal touchdown zone of between 304m (1000 feet) and 609m (2000 feet).
The manufacturer of the aircraft produced a complete load analysis of the event based on recorded flight data provided by the operator. The conclusion of this analysis was that several components in the left and right gear had “exceeded their design load limits and may have been detrimentally overloaded”.
The manufacturer’s analysis assessed the affected components to be unserviceable and requiring replacement before the next flight. Several supplementary inspections were also required.
There were no injuries reported as a result of the hard landing.
Figure 4: Graphical representation of the flight data from the incident approach
From the evidence available, the following findings are made about the hard landing involving an Airbus A330-343, registered 9M-MTA that occurred at Melbourne Airport, Victoria on 15 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The final approach became unstable at around 300 feet above the ground due to the control inputs from the captain.
Inadequate monitoring and communication by the crew led to a lack of recognition of the undesirable flight state and the continuation of an unstable approach.
Continuation of the unstable approach led to a high rate of descent at touchdown and resulted in a hard landing in excess of the aircraft design loads and short of the normal touchdown area.
Other safety factors
The captain used an unapproved manual thrust procedure in an attempt to recover the approach.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Flight recorder data.
Airbus
Malaysia Airlines Safety
Flight Safety Foundation
References
Klein, G. (1999). Sources of power: How people make decisions. Cambridge, MA: MIT Press.
Kahneman, D. (2011). Thinking, fast and slow. New York: Farrar, Straus and Giroux.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority (CASA), Malaysian Airlines Berhad, the Malaysian Ministry of Transport and Airbus.
Submissions were received from Airbus and CASA. The submission were reviewed and where considered appropriate, the text of the draft report will be amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 20 March 2015, at about 1140 Eastern Standard Time (EST), a Robinson R22 helicopter, registered VHHUA, departed from Stanbroke Station for a private flight to Devoncourt Station, Queensland. On board were a pilot and one passenger. The main fuel tank was filled to capacity prior to departure, with 68 L of fuel. While en route between the two stations, the pilot was assessing the water available for stock by overflying water holdings.
At about midday, while about 500 ft above ground level, the helicopter approached a gorge. To assess the water quantity in the gorge, the pilot conducted a descent to about 100 ft and slowed the helicopter to a hover. As the pilot shifted his focus outside, the rotor revolutions per minute (RPM) decreased, the low rotor RPM warning horn sounded and the helicopter commenced descending. The pilot immediately lowered the collective[1] and turned the helicopter away from the higher gorge walls in an attempt to increase forward speed and rotor RPM. He was unable to regain sufficient rotor RPM and the helicopter continued to descend.
The right skid landed heavily on uneven ground, followed by the left skid. The main rotor then collided with a rock and the helicopter rolled onto its right side. The pilot and passengers exited the helicopter and were not injured. The helicopter sustained substantial damage (Figure 1).
Figure 1: Damage to VH-HUA
Source: Aircraft operator
Local conditions
The temperature at the time was about 42 °C and the elevation of the area was about 1,000 ft above mean sea level. The pilot reported the wind was southerly at about 10-15 kt, but the gorge was sheltered and the wind in the vicinity of the accident was calm.
Pilot comments
The pilot reported that his attention was momentarily diverted outside checking the water, when he would normally be watching the gauges and monitoring the rotor RPM. He usually operated without a passenger on board, so the extra weight of the passenger had reduced the helicopter’s performance, particularly its ability to maintain a hover out of ground effect.
Power required and power available
A number of factors related to the power required and the power available may have contributed to the decaying main rotor RPM during a hover out of ground effect.[2] These factors include density altitude, take-off weight and the wind component.
Density altitude. Increasing density altitude adversely affects helicopter performance through the combined effects of reducing the power available and increasing the power required. Considering elevation and temperature, and barometric pressure in the area, the density altitude at the accident site would have been around 4,000 ft. High relative humidity would have had the effect of further increasing the density altitude.
Operating weight. Increasing the helicopter weight increases the power required. The greater lifting force demanded of the main rotor, and the requirement to counter the associated increased torque effect[3] with the tail rotor, both contribute to an increased power requirement. The weight of the helicopter at the time of the accident was less than the maximum permitted operating weight, but reduced the ability to hover out of ground effect.
Wind component. A nil wind component increases the power required because of the diminished or delayed influence of translational lift.[4]
The following references discuss factors affecting helicopter performance, and provide some guidance to pilots regarding the associated considerations:
A ‘Good Aviation Practice’ booklet titled Helicopter Performance, produced by the Civil Aviation Authority (CAA) of New Zealand. The booklet is available via the CAA website.
The Federal Aviation Administration (FAA) Helicopter Flying Handbook (chapter 7 deals with helicopter performance). The handbook is available on the FAA website.
Safety message
The Robinson R22 Pilot’s Operating Handbook includes a number of important safety tips and notices. Pilots (particularly those who fly Robinson helicopters) are encouraged to carefully reflect on these safety tips and notices – the tips are intended to improve safety, while the notices have been issued as a result of various accidents and incidents. The R22 Pilot’s Operating Handbook – Section 10 Safety Tips and Notices is available at Robinson Helicopter website.
The Robinson Helicopter Company Safety Notice SN-10: Fatal accidents caused by low rpm rotor stall, advised that a ‘primary cause of fatal accidents in light helicopters is failure to maintain rotor RPM. To avoid this, every pilot must have his reflexes conditioned so he will instantly add throttle and lower collective to maintain RPM in any emergency’.
Three other ATSB investigation reports that identified helicopter performance and low main rotor RPM as possible factors include AO-2013-203, 200600979 and 199900833. These investigation reports are available on the ATSB website.
This incident provides a reminder of the effect of density altitude, weight, and wind on helicopter performance. Pilots are encouraged to carefully and accurately assess these factors to ensure that an adequate performance margin is maintained. When performance is likely to be adversely affected by a combination of these factors, extreme caution is warranted.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 10 March 2015 Airbus A330, registered 9M-XXM and operated by Malaysian‑based airline AirAsia X, was conducting a regular passenger service from Sydney, New South Wales to Kuala Lumpur, Malaysia. On departure from runway 16R the aircraft was observed by air traffic control to enter the departure flight path of the parallel runway 16L. Following advice from air traffic control, the flight crew identified a problem with the onboard navigation systems. Attempts to troubleshoot and rectify the problem resulted in further degradation of the navigation system, as well as to the aircraft’s flight guidance and flight control systems. The crew elected to discontinue the flight but were unable to return to Sydney as the weather had deteriorated in the Sydney area and the available systems limited the flight to approaches in visual conditions. The aircraft was instead radar vectored to Melbourne, Victoria and the flight completed in visual conditions.
What the ATSB found
The ATSB found that when setting up the aircraft’s flight management and guidance system, the captain inadvertently entered the wrong longitudinal position of the aircraft. This adversely affected the onboard navigation systems however, despite a number of opportunities to identify and correct the error, it was not noticed until after the aircraft became airborne and started tracking in the wrong direction. The ATSB also found that the aircraft was not fitted with an upgraded flight management system that would have prevented the data entry error via either automated initialisation or automatic correction of manual errors.
The flight crew attempted to troubleshoot and rectify the situation while under heavy workload. Combined with limited guidance from the available checklists, this resulted in further errors by the flight crew in the diagnosis and actioning of flight deck switches.
Finally, the ATSB identified that effective monitoring and assistance by air traffic control reduced the risk to the occurrence aircraft and other aircraft in the area.
What's been done as a result
In response to this occurrence the aircraft operator undertook safety action, including:
the development of a training bulletin and package for its flight crews that emphasised the correct operation and alignment of the air data and inertial reference system
sharing the lessons learnt from the operator’s internal investigation with all pilots and reviewing the recovery procedures to be undertaken in the form of a flight safety notice.
Safety message
This occurrence highlights that even experienced flight crew are not immune from data entry errors. However, carrying out procedures and incorporating equipment upgrades recommended by aircraft manufacturers will assist in preventing or detecting such errors.
Additionally, the airborne management of this occurrence illustrates the importance of effective communication when dealing with an abnormal situation under high workload conditions. This is especially the case when there is limited guidance available to resolve the issue.
Photograph of A330-343 9M-XXM
Source: Airliners.net
Findings
From the evidence available, the following findings are made with respect to data entry and navigational issues involving Airbus A330-343, registered 9M-XXM that occurred at Sydney Airport, New South Wales on 10 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
When manually entering the coordinates of the aircraft’s position using a data entry technique that was not recommended by the aircraft manufacturer, the longitude was incorrectly entered as 01519.8 east (15° 19.8’ east) instead of 15109.8 east (151° 9.8’ east). This resulted in a positional error in excess of 11,000 km, which adversely affected the aircraft’s navigation systems and some alerting systems.
The aircraft was not fitted with an upgraded flight management system that would have negated the positional data entry error via either automated initialisation of the air data and inertial reference system, or the automatic correction of manual errors.
The aircraft’s navigation system probably detected the data entry error and displayed an associated message. However, due to the combination of that message being similar to one displayed during routine alignment of the inertial reference system, and the captain’s understanding that the same alignment-related message may be displayed twice, the error was not identified.
The first officer did not notice the error in the initialisation coordinates when crosschecking the flight management and guidance system entries after completing the pre-flight external inspection of the aircraft.
It is likely that data integrity checks detailed in the pre-flight and taxi checklists were either omitted or conducted with the navigation display selected to an inappropriate mode and/or range that concealed the aircraft’s positional error.
The instrument panels cockpit check was not carried out in accordance with the flight crew operations manual and resulted in the crew not detecting the offset error in the displayed heading.
Due to the large data entry error remaining undetected, the navigation system did not initialise relative to the aircraft’s actual position prior to take-off. This resulted in an offset error in the displayed heading and a spurious enhanced ground proximity warning system alert shortly after take‑off and again on arrival in Melbourne.
Activation of the enhanced ground proximity warning system probably distracted the crew and prevented them noticing the turn towards the active parallel runway.
Other factors that increased risk
The crew were presented with an abnormal situation that did not have associated electronic centralised aircraft monitoring or checklist guidance, and was not covered in any training or supplemental information. This increased the risk of misidentification of the situation and further degradation of the aircraft’s systems through incorrect cockpit switch selections.
Other findings
Effective monitoring and assistance provided by air traffic control reduced the risk to both the occurrence aircraft and other aircraft in the area.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Air Asia X
the flight crew of 9M-XXM
Airbus
simulator recreations
on board recorded data
Airservices Australia.
References
Airbus Flight Operations Support & Services. Getting to Grips with RNP AR. Customer Services Directorate, Airbus SAS Feb 2009.
Kirwan, B 1994,A guide to human reliability assessment Taylor and Francis, London.
Wickens, C.D and McCarley, J.S 2008, Applied Attention Theory Boca Raton CRC Press Chicago.
Sarter, N B. and Alexander, H M. 2000, Error Types and Related Error Detection Mechanisms in theAviation Domain: An Analysis of Aviation Safety Reporting System Incident Reports, The International Journal of AviationPsychology,10:2, pp. 189–206.
Thomas J.W, Petrilli R.M and Dawson D. 2004, an Exploratory Study of Error Detection Processes During Normal Line Operations, Centre for Applied Behavioural Science, University of South Australia, pp. 1–5.
Thomas, M. J. W. 2004, Predictors of Threat and Error Management: Identification of core non‑technical skills and implications for training systems design. International Journal of Aviation Psychology, 14(2), pp. 207–231.
Loukopoulos, LD, Dismukes, RK & Barshi, I. Cockpit interruptions and distractions: A line observation study. In Proceedings of the 11th International Symposium on Aviation Psychology, Columbus, OH, 14–17 March 2001.
Dismukes, RK, Loukopoulos, LD & Kobe, KK. The challenges of managing concurrent and deferred tasks.In Proceedings of the 11th International Symposium on Aviation Psychology, Columbus, OH, 14–17 March 2001.
Loukopoulos, LD, Dismukes, RK & Barshi, I. Concurrent task demands in the cockpit: challenges and vulnerabilities in routine flight operations. In Proceedings of the 12th International Symposium on Aviation Psychology, Columbus, OH, 14–17 April 2003.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew, Air Asia X, Airbus, the Bureau d’Enquêtes et d’Analyses, Airservices Australia and the Civil Aviation Safety Authority.
Submissions were received from Airbus and Air Asia X. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Standard instrument departure
DEENA 5 standard instrument departure depicting the right turn requirement and caution regarding the parallel runway.
Source: Jeppesen Airways Manuals
Appendix B – Flight crew training manual extract
The occurrence
On 10 March 2015, Airbus A330-343X (A330), registered in Malaysia as 9M-XXM, was scheduled to fly from, Sydney, New South Wales to Kuala Lumpur, Malaysia. The flight was a daily passenger service operated by the Malaysian-based airline Air Asia X.
The aircraft was scheduled to depart at 1155 Eastern Daylight‑saving Time[1] from gate 54 of the Sydney Airport International Terminal. The operating crew consisted of a captain, who was initially pilot monitoring (PM), a first officer (FO) who was initially pilot flying (PF), and eight cabin crew.[2] All crew signed on for duty 60 minutes prior to departure to allow for pre-flight preparation.
During routine operations the PF was responsible for actioning the majority of the cockpit preparation procedures once the preliminary cockpit preparations were completed by both flight crew. While this was underway the PM would typically conduct the pre-flight external inspection of the aircraft. However, on this morning the captain instructed the FO to conduct that inspection and completed the cockpit preparation procedure. The captain stated that this was because the captain’s hearing protection was not available for the external inspection. That reason was not communicated to the FO.
The cockpit preparation procedures included the alignment and initialisation of the aircraft’s air data and inertial reference system (ADIRS) (see the section titled Air navigation system). As well as other functions, the ADIRS provides much of the aircraft’s position, heading and tracking information. For 9M-XXM in particular, the flight crew operating manual procedures for initialisation of the ADIRS required the confirmation of an initial aircraft position in order to carry out these navigational functions. The operating manual also stated that the most appropriate position for this initialisation was the departure gate coordinates.
The captain reported that while carrying out the position initialisation procedure, he manually copied the gate coordinates displayed on a sign outside the cockpit window into the scratchpad of the multipurpose and control display unit (MCDU) (Figure 1). He then submitted these coordinates to the flight management and guidance system (FMGS) using the ALIGN IRS prompt on the MCDU. Flight data and analysis of the occurrence shows a data entry error occurred at this time during the entry of the longitude of the gate coordinates into the MCDU (see the section titled Aircraft heading indications).
Figure 1: At left, Gate 54 showing the coordinates sign and, at right, the MCDU used during the ADIRS initialisation with the ALIGN IRS prompt highlighted in red (Note: the MCDU does not depict the gate 54 coordinates)
Source: Sydney Airports Corporation Limited and Airbus, modified by the ATSB
The captain reported completing much of the cockpit preparation before the FO returned from the external inspection. Once the operator-determined route was entered, this included crosschecking the tracks and distances produced by the FMGS against the paper flight plan produced by flight dispatch. The captain also reported checking the progress page of the MCDU, which indicated GPS PRIMARY for position referencing and updating, and the accuracy of positioning as HIGH. The captain stated that these checks confirmed that the system was set up correctly.
The FO stated that, on return from the external inspection, the majority of the cockpit preparation had been completed. The FO then checked the data entries and switch positions as per the operator’s procedure, including crosschecking the tracks and distances as determined from the FMGS with the paper flight plan. The FO reported also checking the progress page of the MCDU, which indicated GPS PRIMARY for position referencing and updating, and the accuracy of positioning as HIGH. The FO stated that this confirmed their understanding that the system was set up correctly.
During the crosscheck of the cockpit preparation, the FO reported seeing a flag or indication flash up on the captain’s navigation display (ND), but that it was too quick to interpret. The FO did not mention this to the captain as there was no associated electronic centralised aircraft monitoring (ECAM) or STATUS message.
Both flight crew stated that a take-off brief was conducted with reference to the FMGS data and flight deck switch positions, and that the BEFORE START checklist was carried out.
The aircraft pushed back from gate 54 at 1153, 2 minutes ahead of schedule. The crew stated that, at around the time of engine start, both heard a single chime without any associated ECAM or STATUS message. A single chime is an aural alert often associated with an ECAM MASTER CAUTION message to indicate that the aircraft’s systems have detected a fault. Both flight crew stated that they did not look towards the overhead panel or MCDU and, as there was no associated ECAM or STATUS message, they continued with normal procedures.
The flight crew completed the engine start and the AFTER START checklist was actioned. The aircraft was then cleared to taxi to the full length of departure runway 16R. There were several aircraft ahead of 9M-XXM in the departure sequence, requiring the flight crew to hold on a taxiway for several minutes. The flight crew reported that, just prior to being cleared to line-up on the runway, they heard two independent chimes in close proximity. They stated that they checked the STATUS page and ECAM but that there were no other abnormal indications so they continued with the line-up.
The FO commenced take-off from runway 16R with the captain monitoring take-off parameters and thrust settings. Immediately after the aircraft was rotated, the enhanced ground proximity system (EGPWS) activated with the aural alert TERRAIN, TERRAIN. This alert would normally indicate a conflict with the ground or obstacles in the aircraft’s immediate flight path. The next phase of the EGPWS is for automated aural and visual instruction on the flight crew’s NDs to PULL UP. Although both flight crew reported the expectation that this would occur, for reasons believed to be associated with spurious activation, this did not take place.
Flight crew are trained to conduct an EGPWS escape manoeuvre in response to the second phase warning by applying up to full back pressure on the control stick and the auto‑throttle applies high levels of thrust to climb the aircraft away from any conflicting terrain in the shortest distance. The captain stated that, as it was daytime and 9M-XXM was clear of cloud, it was possible to visually confirm that no terrain conflict existed. As such, the captain instructed the FO to disregard the TERRAIN alert and continue with the normal take-off. Both crew stated that, while the alert had startled them, a full response to a spurious EGPWS warning was undesirable in the Sydney area due to an increased likelihood of conflicting with other aircraft.
Flight data of the occurrence flight identified that the autopilot was engaged at an altitude of 410 ft and that the aircraft then commenced a gradual left turn over 14 seconds onto a magnetic heading of 132°, although 170° was being incorrectly displayed on the aircraft’s main heading indicators. The captain reported their departure to air traffic control (ATC), stating they were tracking via the DEENA 5 standard instrument departure (SID), passing 900 ft and climbing to 5,000 ft as per their departure clearance (appendix A). That transmission was acknowledged by ATC and the aircraft was cleared to climb to flight level (FL) 280.[3]
A few seconds later, ATC observed the aircraft turning left, contrary to the SID, and tracking towards the flight path for the active parallel runway, runway 16L. In response, ATC contacted the crew and requested confirmation that they were tracking via the SID and would be maintaining a heading of 155° before turning right. At the same time ATC held another aircraft in the line-up position for departure from runway 16L (Figure 2).
Figure 2: During departure 9M‑XXM initially turned left, instead of right, and crossed the departure flight path of the parallel runway 16L (displayed here in blue). Note the standard instrument departure chart caution against turning left. The DEENA 5 SID is depicted in green
Source: Google earth, modified by the ATSB
ATC audio recordings indicated an initial hesitance in the captain’s reply to ATC, first confirming the heading and then asking ATC to standby as they had lost their primary instruments. During interviews the crew stated that once the EGPWS alert was assessed as spurious, and the decision not to carry out an EGPWS escape manoeuvre made, the crew noticed that all of the expected navigation waypoints and tracking information were not displayed on the ND. Instead, an amber GPS PRIMARY LOST message appeared on the NDs together with an unusual tracking line without an associated waypoint (Figure 3).
Figure 3: Photograph of an exemplar ND and the primary flight display during a simulated recreation of the flight scenario. Note the GPS PRIMARY LOST message (in yellow) at the bottom-left of the photograph and the green tracking line emanating from the white aircraft depiction at the centre of that representation
Source: Air Asia X
Following advice from the captain of the degraded flight display, ATC informed the flight crew that radar showed the aircraft was maintaining an approximate heading of 130°. The controller then instructed the flight crew to turn right onto a heading of 220° with reference to the main heading indicators. Once established on that heading, ATC requested the flight crew to report the heading displayed on the aircraft’s standby compass, to which the flight crew reported 180°. The controller confirmed that 180° matched the aircraft’s radar heading and used this heading offset to provide radar vectoring clear of other traffic in the Sydney area while also limiting the altitude of the aircraft to FL160 due to overflying conflicting traffic. The controller then requested the flight crew’s intentions, to which they replied that they would attempt to restore the aircraft’s systems before continuing on to Kuala Lumpur.
During interviews the flight crew stated that, following identification of the system problem, the captain adopted the role of PF with the autopilot engaged and managed the radio communication to allow the FO to troubleshoot the situation and attempt to restore normal system functionality. The captain advised that, as there were no ECAM or STATUS messages for guidance, the only instruction he gave the FO was to ‘Reset the nav’.
The FO stated that, in the absence of any ECAM or STATUS messages his initial reaction was to reference the UNRELIABLE AIRSPEED INDICATION checklist in the quick reference handbook (QRH). This was in order to provide the captain with attitude and thrust settings in the event that the airspeed indications were affected. This emergency checklist had been part of a recent training/checking exercise the crew had undergone in response to an occurrence involving another A330. In that occurrence, some of the aircraft’s external sensors had blocked with ice, which affected the air data reference (ADR), part of the ADIRS, and subsequently provided erroneous airspeed indications.
The FO recalled then reaching a mindset that there was an issue with the aircraft’s ADR. As part of the ADIRS, information from the ADR provided temperature, aerodynamic, and barometric information from multiple air data sources to much of the aircraft’s primary flight guidance, flight controls and engine controls. The ADR CHECK PROCEDURE is incorporated in the UNRELIABLE SPEED INDICATION checklist that was recently referenced by the FO.
The FO then attempted to program a waypoint and a radio navigation aid. Both were unsuccessful as the FMGS appeared unresponsive to inputs. The FO stated that the absence of an ECAM or STATUS indication hindered their ability to locate a checklist in the QRH that offered a resolution to the situation. As a result, the FO started searching the electronic FCOM on the company‑provided iPad™. ATC continued to provide radar vectoring, climb and stop-climb instructions and request updates of the crew’s intentions.
The FO informed the captain that, in order to attempt to reset the system, it was intended to cycle the three air data and inertial reference unit (ADIRU) rotary switches on the overhead panel from NAV to OFF (Figure 4), and that this would likely cause the autopilot to drop out. The ADIRU rotary switches influence both the ADR and inertial reference parts of the respective ADIRU, and have a greater combined effect on aircraft systems compared with the individual ADR and/or inertial reference push-buttons available on the same overhead panel (Figure 4) (see the section titled Context).
During interview the captain and FO stated that the captain’s response was simply ’Yes’. The FO recalled initially holding their hand in the vicinity of the rotary switches awaiting confirmation from the captain to cycle them to OFF. Both crew recalled that ATC instructions then disrupted the normal process of confirmation before actioning critical flight deck switches. Once the ATC instruction was acknowledged and complied with, the FO turned ADIRU 1 and 3 OFF without clarifying the captain’s confirmation for the action. In response, several flight guidance and navigation systems degraded and the autopilot disengaged. The captain instructed the FO to stop actioning the switches, with ADIRU 2 remaining in the NAV position.
Figure 4: ADIRU rotary switches and individual inertial reference and ADR fault lights and OFF push‑buttons on the A330 flight deck overhead panel
Source: Airbus
Once ADIRUs 1 and 3 were selected OFF, the captain’s primary flight display (PFD) lost all information except accurate airspeed and vertical speed, and the captain’s ND displayed the GPS PRIMARY LOST, HDG and MAP NOT AVAILABLE warning flags (Figure 5). In addition to the information remaining on the captain’s PFD, the FO’s PFD continued to display accurate airspeed, vertical speed and attitude information, but the displayed heading information was incorrect. The FO’s ND also displayed incorrect heading information and there was no usable map, waypoint or tracking information. The autopilot and autothrust systems were also unavailable, and the aircraft had reverted from ‘normal law’ to ‘alternate law’. This affected some of the aircraft’s handling characteristics and flight envelope protections (see the section titled Flight control lawsand Alternate law). The integrated standby instrument system, located on the forward instrument panel, continued to provide aircraft attitude from its own internal accelerometer and gyrometer, and uncorrected airspeed from the standby pitot and standby static probes. The standby compass provided heading information, but this was affected by any slight aircraft acceleration (Figure 5).
Figure 5: Simulator recreation of the captain’s PFD and ND after the ADIRU 1 and 3 switches were selected off. Note the GPS PRIMARY LOST message (in amber) at the base of the photographs and the HDG and MAP NOT AVAIL message (in red) at the centre-upper of the photographs
Source: Air Asia X, modified by ATSB
In consideration of the degraded flight systems, the crew notified ATC that they wished to discontinue the flight and return to Sydney Airport. However, as both NDs and the captain’s PFD were unusable, they advised that they were only capable of conducting a visual approach. In response, ATC advised that since their departure, the weather at Sydney had deteriorated to a cloud base of 1,700 ft with showers in the area and, as such, a visual approach was not possible.
After consideration of the available alternatives, ATC established that en route and arrival conditions for Melbourne Airport, Victoria (approximately 390 NM (722 km) to the south‑west of Sydney) were clear with only a few[4] clouds at 3,000 ft in the vicinity of the airport. The flight crew considered and accepted the option of recovering to Melbourne Airport and ATC coordinated with the en route, arrival, approach and Melbourne tower controllers for the flight crew to receive continuous radar vectors from the aircraft’s current position to touchdown in Melbourne.
The flight crew continued their attempts to restore the flight guidance and navigation systems while in the Sydney area. The FO then carried out the IRS ALIGNMENT IN ATT MODE checklist from the QRH, restoring some ND and PFD functions; however, the heading needed to be periodically updated to allow for inertial drift. As per system design, the aircraft also remained in alternate law, and the autopilot and autothrust systems remained inoperative.
The crew received radar vectors and climb clearances to FL 310 en route to Melbourne. The aircraft was manually-flown by the captain for the transit. The captain reported that increased sensitivity in roll was the most notable handling characteristic of alternate law. However, given the clear daylight conditions and radar coverage, the flight was manageable and the aircraft was radar vectored to short final for runway 16 at Melbourne Airport (Figure 6). During the approach, with the aircraft fully-configured for a Flap 3 landing as per the alternate law checklist, the flight crew noted the aircraft became high on approach with the airspeed too high. As a result, the crew discontinued the approach and conducted a go-around.
Both flight crew stated that, during the initial part of the go‑around, they heard an aural warning similar to a flap overspeed warning. This warning indicated the aircraft’s speed was too high for the selected flap setting. However, on checking their airspeed, both flight crew noted that it was below the maximum permissible 186 kt for the Flap 3 configuration being used. Flight recorder data indicated that the maximum recorded speed was 185 kt for 1 second while in this configuration and the post‑flight report[5] did not record any airspeed exceedances during any phase of the flight.
An EGPWS alert activated at approximately 600 ft during the initial approach at Melbourne, seconds prior to the commencement of the go‑around. An assessment of recorded parameters indicated that, as with the EGPWS alert departing Sydney, this was also a spurious warning associated with the aircraft’s incorrect position information. There was no indication that the flight crew responded to the EGPWS approaching Melbourne.
The crew conducted a visual circuit and landed runway 16 at 1403, 1 hour 54 minutes after becoming airborne in Sydney. The aircraft landed below the maximum landing weight with the use of a single thrust reverser (see the section titled Aircraft information). Fuel jettison was not necessary due to high fuel burn while troubleshooting near Sydney at relatively low altitudes. On exiting the runway, the flight crew informed ATC that emergency services were not necessary and the aircraft taxied to a terminal gate.
Extensive troubleshooting was carried out on the aircraft and its systems by ground engineering services. This included swapping around of the ADIRUs and powering down the entire FMGS to try and replicate the situation encountered by the flight crew. No faults were found.
After 2 hours 58 minutes on the ground, 9M-XXM departed for Kuala Lumpur with the original flight and cabin crew as the operating crew. The flight to Kuala Lumpur was reported as uneventful with a total duty time 14 hours 53 minutes and a total flight time of 10 hours 27 minutes over the two sectors.
Figure 6: Visual depiction of the flight from Sydney to Melbourne, including an inset of the departure from Sydney (right of the two graphics)
Both flight crew reported having 24 hours rest at a hotel in Sydney prior to the occurrence flight, and having received adequate rest and sustenance. Both reported being in good health with no external stresses or distractions.
Captain
The captain held an Air Transport Pilot (Aeroplane) Licence with an Airbus A330 command endorsement. He held a current Class 1 medical with a requirement to wear vision correction. The captain had a total of 22,580 hours flying experience, mostly on Boeing‑type aircraft flying for other operators. He had converted to the A330 as a captain approximately 18 months prior to the occurrence, when commencing employment with Air Asia X.
First officer
The first officer (FO) held a held an Air Transport Pilot (Aeroplane) Licence with an Airbus A330 P2 (copilot) endorsement. He held a current Class 1 medical without restrictions. The FO had a total of 2,200 flying hours, converting as FO to the A330 approximately 2 years prior to the occurrence, when commencing employment with Air Asia X.
Aircraft maintenance information
Maintenance status
On arrival at the aircraft, the captain and FO were met in the aircraft’s cabin by the previous flight crew. They were informed of a Minimum Equipment List (MEL) item that recorded one of the engines’ thrust reversers being inoperative, as well as a minor defect affecting one of the aircraft’s taxi lights. An inoperative thrust reverser and/or taxi light is a permissible fault with only minor impact on A330 operation and deemed not relevant to this occurrence.
Airbus service bulletin
Airbus service bulletin SB 34-3287 Enhanced ADIRU alignment on GPS position became available in 2013 and was recommended by Airbus for incorporation in the A330. This service bulletin is designed to upgrade the air data and inertial reference system (ADIRS) (see the section titled Aircraft navigation system) in various A320, A330, and A340 aircraft such that position initialisation occurs automatically using the aircraft’s global positioning system (GPS)-derived position or, in the event the initialisation is carried out manually, when the pilot-entered initialisation position is crosschecked with the GPS position. If the crosschecked positions are not consistent, the pilot-entered position is rejected. Airbus advised that the objective of this service bulletin was to reduce the time required for ADIRS alignment and to reduce positional data entry errors.
Although recommended by Airbus, this service bulletin SB 34-3287 was not mandatory. At the time of writing, approximately 46 per cent of the 515 aircraft affected by the service bulletin have completed the upgrade. Airbus records suggest that approximately two occurrences are reported per annum that are attributable to position initialisation error in aircraft that have not been upgraded.
For reasons that could not be determined, 9M‑XXM, had not received the ADIRS upgrade detailed in service bulletin SB 34‑3287.
Aircraft systems
Air data and inertial reference system
System overview
The ADIRS provides important information about the outside environment (such as air pressure and temperature), the aircraft’s state relative to the outside air (such as airspeed, altitude and angle of attack), and the aircraft’s state relative to the earth (position, motion and orientation).
To provide redundancy, the ADIRS includes three air data inertial reference units (ADIRU 1, ADIRU 2, and ADIRU 3). Each is of the same design, provides the same information, and operates independently of the other two.
Each ADIRU has two parts, an air data reference (ADR) part and an inertial reference (IR) part, which are integrated into a single unit (Figure 7).
Figure 7: ADIRS architecture
Source: ATSB investigation 200700065, available at ATSB website
Air data reference part
The ADR part of the ADIRU provides information about the aircraft’s movement through the air and atmospheric information. It obtains its inputs from sensors mounted on the aircraft’s fuselage.
Each ADIRU has its own independent sensors. An angle of attack sensor and a total air temperature probe provide data directly to the ADIRU via analogue electrical signals. In addition, a pitot probe and two static ports provide data to the ADIRU via air data modules, which convert air pressure signals to digital signals.
Inertial reference part
The IR part of the ADIRU provides information about the aircraft’s position, orientation, and velocity with respect to the earth. It obtains its data from a set of inertial instruments in each ADIRU, which continually measure acceleration in all three axes (pitch, roll and yaw) as well as rotational movement.
The IR part constantly updates the aircraft’s three-dimensional position and orientation based on the movement it senses from a known starting position and orientation. The process of determining this starting position is known as ‘position initialisation’, and occurs prior to each flight when the aircraft is stationary. Subsequent inertial measurements change the calculated position, orientation and velocity by a very small amount for each measurement cycle. As the IR parameters are dependent on previous values, an error during position initialisation would affect subsequent values. The IR parameters are also highly interdependent, and an error in one parameter would affect other parameters.
Global position inertial reference system
Each ADIRU receives GPS data from one of two multi-mode receivers to augment the inertial reference computations. The two GPS receivers can only influence the flight management and guidance system (FMGS) via the inertial reference system (IRS) in the form of a hybrid global positioning/inertial reference system (GPIRS) position, and could not provide stand-alone positional information directly to the FMGS. In the event of a gross disparity between the position calculated by the GPS receivers and the IR-calculated position, the GPS position would be invalidated and the FMGS would use the IR-only mixed position (Figure 8).
Figure 8: Hybrid GPS architecture. Note that GPS data is received via the IRSs and not directly from the GPS to the FMGS (referred to as FMS in this diagram)
Source: Airbus
ADIRS control panel
The ADIRS control panel provides local fault indications for each part of each ADIRU. If there is a fault with the IR part of an ADIRU, an amber FAULT light illuminates. The relevant part of the ADIRU can be deactivated by pressing the OFF push-button below the fault light. The ADR part of the ADIRU operates in the same manner (Figure 9).
Figure 9: ADIRS control panel containing rotary switches as well as individual IR and ADR FAULT lights and OFF push-buttons.
Source: Airbus
The panel also has an IR mode rotary selector for each ADIRU that allows flight crew to select one of three modes:
OFF, resulting in the ADIRU not being energised and the IR and ADR parts being unavailable
NAV, meaning that the ADIRU supplies full inertial data and air data to other systems (normal mode of operation)
ATT, where the ADIRU supplies full air data but limited inertial data (only attitude and heading information) to other systems.
The ADIRS control panel is located on the flight deck’s overhead panel (Figure 10)
Figure 10: Overhead panel showing the ADIRS control panel (at inset) and relative cockpit position of a number of displays and controls
Source: ATSB investigation 200700065, available at ATSB website
Aircraft heading indications
In aircraft equipped with IRSs, magnetic heading is derived from true heading, which references true north, and then adding or subtracting the magnetic variation (the difference between true and magnetic north for that geographic longitude). The magnetic variation for Sydney at the time of the occurrence was 12.56° east at a longitude of 151° 9.8’ east. The flight data recorder showed that the longitude manually entered by the captain at ADIRS initialisation was 15° 19.79’ east. This equates to a position off the coast of Cape Town, South Africa, about 11,000 km from Sydney Airport. The magnetic variation for this position is 23.57° west. The cumulative difference in magnetic variation between these two points (the actual longitude of the aircraft (Sydney Airport), and that calculated using the incorrectly entered longitude, off South Africa) equates to 36.13°. The difference between the runway direction and the magnetic heading indicated by the aircraft was approximately 38°.
The standby compass gets its reading directly from the earth’s magnetic field and therefore was not affected by the magnetic variation.
Procedural controls
In modern aircraft systems the ability to prevent, detect and/or rectify an error or fault is achieved largely through the use of procedural controls. Procedural controls include, but are not limited to, standard practices and procedures that the crew are trained to undertake throughout the flight to ensure the systems are set-up and running correctly. They are often referred to as standard operating procedures and abnormal procedures, both of which encompass such things as the standardised and coordinated order in which a series of steps are undertaken (scan action flows), and checklists to ensure that the pertinent steps are completed correctly. These scan action flows and checklists are described in the flight crew training manual (FCTM), flight crew operations manual (FCOM) amplified procedures, quick reference handbook (QRH) and flight crew operations manual supplementary procedures (FCOM SUPS). These standardised and ordered actions are supplemental to sound aircraft system knowledge and good piloting practices gained through training and experience.
Initialisation of the air data and inertial reference system
Part of the cockpit preparation procedures involved the alignment of the ADIRS. As detailed previously, this system utilised three independent ADIRUs, as well as GPS and air sensors to complete its multiple functions.
The exact procedure and requirement for ADIRS alignment varied slightly between aircraft subject to the age, manufacture and service bulletin status of the FMGS components. This status was listed in the various operating and training manuals by the Airbus manufacturer serial number for each aircraft. For 9M- XXM, this serial number was 0741.
In the case of 9M-XXM, a full alignment was carried out by first selecting all three ADIRS rotary selectors on the overhead panel to OFF for more than 5 seconds and then selecting these to NAV. The next step involved the position initialisation of the IRS. Using the multipurpose and control display unit (MCDU) position initialisation page, the crew can check/modify the MCDU coordinates before submitting these to the ADIRS.
With regard to the best position for IRS initialisation, the FCOM SUPPS included the following text:
The most appropriate coordinates for IRS position initialisation are the gate coordinates.
When the flight crew enters or modifies the origin airport (FROM) or the CO RTE, the MCDU INIT coordinates are reset to the Aerodrome Reference Point (ARP). The pilot may manually modify these coordinates.
The FCTM also included the following text applicable to 9M-XXM:
MANUAL POSITION INITIALIZATION (AIRCRAFT WITH OR WITHOUT MP S16804)
The coordinates of the departure Airport Reference Point (ARP) are displayed on the MCDU INIT page.
However, the most appropriate coordinates for IRS position initialization are the gate coordinates.
In this case, and in order to avoid entry errors, the flight crew should use the slew keys successively for latitude and longitude, instead of inserting the coordinates on the scratchpad.
The slew keys mentioned in the FCTM were two up and down keys on the MCDU that allow the pilot to incrementally adjust a value displayed on the MCDU screen, without having to retype the entire value. In the case of the ADIRS initialisation, these slew keys enabled the pilot to adjust the latitude and longitude of the initialisation position from the ARP to the gate coordinates without having to retype the entire coordinates. (Figure 11)
Figure 11: Slew key indicators on the MCDU
Source: Airbus
The FCOM also included the following text in specific reference to what will occur in the event of an initialisation error in the Honeywell flight management system 2 (FMS2) as installed in 9M‑XXM:
The Prompt REALIGN IRS is displayed on MCDU INIT Page:
Check and confirm the position initialisation coordinates on MCDU, then valid prompt.
The IRS record the last position it had the last time it was in NAV mode. The IRS are also able to estimate the present latitude during a complete alignment. They use both information to detect significant position initialisation error.
Further procedural controls are included during aircraft taxi and are designed to detect error prior to take-off, when the error can be rectified. The FCOM states:
During taxi, a good way to check the global consistency of FMGS entries (Position and flight plan) is to check the runway and the SID on the ND, in comparison to the aircraft symbol that indicates the current aircraft position. To do so, set the ND in ARC or NAV mode with a range 10 nm.
On the POSITION MONITOR page, check that the IRS are in NAV mode, and check that the distance between each IRS and the FMS position is lower than 5 nm. Select ND in ROSE-NAV or ARC mode, and confirm that then of the airport, the SID and the surrounding NAVAIDS.
GPS primary lost
System design dictated that if the GPS inputs passed both an integrity and accuracy check then the FMGS would enter GPS primary, and the GPS signals would have primacy as the source of position information. If GPS primary was active for more than 10 minutes, and if the GPS integrity or accuracy check then failed because of an anomaly with the satellite array, the GPS signal is invalidated (as described above). The IRS output then reverts to the IR-only mixed position and eventually GPS PRIMARY LOST is displayed on the ND, and cannot be cleared by the crew. (Figure 12)
Figure 12: GPS PRIMARY LOST displayed (in amber) at the bottom-left of an exemplar ND
Source: Air Asia X, modified by the ATSB
Electronic centralised aircraft monitoring
System overview
The electronic centralised aircraft monitoring (ECAM) system is a main component of the Airbus two-crewmember cockpit and takes account of the ‘dark cockpit’ and ‘forward-facing crew’ philosophies. ‘Dark cockpit’ refers to only illuminating the flight deck switches and buttons that require the pilot’s attention and ‘forward facing’ refers to ensuring that essential flight information is readily available in the pilot’s immediate field of view. These philosophies are aimed at supporting crew actions by only displaying the minimum required information and reducing nuisance alerts.
The purpose of the ECAM is to:
display aircraft system information
monitor aircraft systems
indicate required flight crew actions in most normal, abnormal and emergency situations
diagnose and respond to system faults.
As the ECAM is available in most failure situations, it is a significant step in the direction towards a paperless cockpit and the reduction of items that must be conducted from memory by the crew.
The ECAM provides information on two display units located in the centre of the instrument panel (Figure 13).
The upper unit, or engine/warning display (E/WD), presents information such as engine primary indications, fuel quantity information and slats/flap positions. The bottom part of the E/WD presents warning or caution messages when a system fault occurs and memo messages when there are no faults.
Figure 13. Engine/warning display (E/WD) showing exemplar engine parameters, fuel quantity and flap/slat positions (top of the display), take-off and landing memo messages, independent/primary warning/caution messages and required actions (bottom-left) and normal memo and secondary failure messages (bottom right)
Source ATSB investigation 200700065, available at ATSB website
The lower unit, or system display, presents more detailed information for different systems. In some cases, the ECAM automatically provides the relevant system’s information following a system fault. The flight crew can also select different system pages. In addition, the system display presents a ‘status page’, which provides an operational summary of the aircraft’s status, including a list of inoperative systems, cancelled cautions, approach procedures and relevant limitations.
Presentation of ECAM warning and caution messages
The ECAM presents a short message indicating the nature of a warning or caution in red or amber, depending on the failure level. Any required crew actions are displayed in blue text on separate lines below the relevant message.
There are seven lines available at the bottom of the E/WD to display warning and caution messages. The messages are displayed in a priority order, with the most important (Level three) messages displayed at the top. In decreasing priority, Level two messages are displayed below the Level three messages but above Level one messages. When there were multiple messages at the same level, the most recent message has the highest priority.
If the flight crew complete a displayed action, the ECAM automatically removes the action line below the relevant message. The flight crew can also clear a message by pressing the ‘clear’ push-button. If the conditions that led to the presentation of a warning or caution message are no longer present, the ECAM automatically removes the message. If the conditions for the message return, the message is again displayed.
Flight control laws
System overview
The A330’s electrical flight control system (EFCS) is a fly-by-wire system. That is, there is no direct mechanical linkage between most of the flight crew’s controls and the flight control surfaces. Flight control computers send movement commands via electrical signals to hydraulic actuators that are connected to the control surfaces. The computers sense the response of the control surfaces to these commands and adjust the commands as required.
The EFCS computes the control orders according to a ‘control law’, with different functionality provided depending on the law being used. There are three levels of control law, each providing for different functionality as follows:
Normal law. The EFCS detects when the aircraft is approaching the limits of certain flight parameters, and commands control surface movements to prevent the aircraft from exceeding these limits (that is, it prevents the aircraft from exceeding a predefined safe flight envelope). Automatic flight-envelope protections include high angle of attack protection, load factor limitation, pitch attitude protection, roll attitude protection and high speed protection.
Alternate law. The EFCS switches to alternate law if there are certain types or combinations of failures within the flight control system or related systems. Some types of protection, such as high angle of attack protection, are not provided under this law, and others are provided using alternate logic.
Direct law. The EFCS switches to direct law in situations where there are more failures of relevant, redundant systems in addition to those that led to the reversion to alternate law. No flight-envelope protections are provided, and control surface deflection is proportional to sidestick and rudder pedal movement by the flight crew.
Enhanced ground proximity warning system
In respect of the enhance ground proximity warning system activations during take-off from Sydney and again during approach in Melbourne, part of the system involved the comparison of the aircraft’s calculated position with a stored database of known terrain features and obstacles in the vicinity of major airports. System design took into account when the aircraft was likely to be on departure or arrival to these airports. It then modified the alerting functions such that there was a lower sensitivity to obstacles in the prescribed departure and/or arrival flight path when the aircraft was is the correct position, thus reducing nuisance warnings when no conflict with terrain or obstacles existed.
Master warning during the go‑around at Melbourne
During the initial part of the go‑around in Melbourne, both flight crew heard an aural alert associated with a master warning similar to a flap overspeed warning. On checking the aircraft’s airspeed, both flight crew noted that the airspeed was below the maximum permissible 186 kt for the then Flap 3 configuration. Flight data indicated the maximum recorded speed was 185 kt for 1 second whilst in this configuration and the post flight report did not record any airspeed exceedances during any phase of flight.
A further review of flight data indicated that during the go‑around the landing gear was selected up prior to the engine thrust levers reaching the take‑off/go‑around position. The flight crew reported that, in response, the captain reduced power below the take-off/go‑around position to correct a suspected flap overspeed. As the aircraft was below 750 ft above ground level, this would likely have momentarily activated the L/G GEAR NOT DOWN master warning. The flap overspeed and L/G NOT DOWN master warnings have the same aural alert.
On 11 January 2007, at about 0718 Eastern Daylight-saving Time, an Airbus A320 aircraft, registered ZK-OJB, departed runway 34L at Sydney Airport, New South Wales for Auckland, New Zealand and was assigned a radar heading by ATC. The controller noticed that the aircraft turned onto an incorrect heading and informed the flight crew. The crew checked the aircraft’s compasses and identified a heading error of about 40°and a GPS PRIMARY LOST message on the aircraft’s multi-purpose control and display unit and navigational display (ND). The crew advised ATC that they had navigational difficulties and elected to return to Sydney for landing.
When the aircraft returned to the departure gate, the flight crew noticed that the inertial reference system (IRS) was aligned to the incorrect longitude. The operator’s investigation into the incident found that the IRS had been aligned by maintenance staff prior to the crew boarding the aircraft. The incorrect alignment of the IRS was not noticed during a number of subsequent checks prior to departure.
As a result of this occurrence, the operator proposed developing a training program for all company pilots that was designed to improve discussion and guidance in relation to threat and error management issues.
ATSB occurrence report 201104899
On 13 July 2011, a Philippine Airlines Airbus A340, registered RP-C3431, departed Sydney and did not track as cleared by ATC. The flight crew reported navigation problems after crosschecking the standby and main heading indications and the aircraft returned to Sydney for a visual approach and landing.
The occurrence was reported to the ATSB and Airbus.
The crew reported to Airbus that during the take-off roll, they noticed the absence of the runway symbol on the ND and the annunciation of GPS PRIMARY LOST and NAV FM/IR POS DISAGREE on that display. Airbus included this occurrence in the number of global occurrences, detailed in the following section, relating to data entry errors during initialisation of the air data and inertial reference system.
Global occurrences and action
At the time of writing, approximately 46 per cent of the 515 aircraft affected by service bulletin SB 34-3287 Enhanced ADIRU alignment on GPS position have been updated via that bulletin such that data entry is not required for ADIRS initialisation. Despite these updates, 13 occurrences have been reported to Airbus worldwide since January 2010 that are attributable to data entry error during ADIRS initialisation on aircraft that did not have the service bulletin completed. In each occurrence, the flight crew elected to return to the departure point, or a nearby airport via a visual approach.
Safety analysis
Introduction
During pre‑flight initialisation of the aircraft’s navigation systems, the longitude of the aircraft was entered incorrectly. This data entry error was not detected prior to take‑off and resulted in disruption to various navigation and flight guidance systems. While troubleshooting was conducted by the flight crew once the aircraft was airborne, a lack of information from systems and checklists led to an incorrect diagnosis and actioning of flight deck switches. This in turn resulted in further degradation of the aircraft systems.
The following analysis will examine the aircraft systems, procedural controls, and human factors that contributed to the occurrence.
Available upgrade to aircraft navigation systems
Airbus service bulletin SB 34-3287 Enhanced ADIRU [air data inertial reference unit] alignment on GPS position was released in 2013. Embodiment of this service bulletin into affected aircraft removed the need for data entry during the initialisation of the air data and inertial reference system (ADIRS). Furthermore, in the event that flight crew did elect to enter the aircraft’s position manually, any errors resulting from that action would be automatically corrected. As such, the enhancement provided by the service bulletin removed the possibility of the ADIRS being initialised to the wrong coordinates through a data entry error.
While compliance with the service bulletin was recommended by Airbus, it was not mandatory and the occurrence aircraft had not received this upgrade. Consequently, this important defence against data entry error was not available at the time of the occurrence.
Development of the occurrence
Data entry error
Recorded aircraft flight data indicated that the ‘0’ digit of the departure gate longitude was omitted during manual entry of the aircraft’s position into the MCDU at the gate. This led to a longitude of 01519.8 east (15°19.79’ east) being entered instead of the correct value of 15109.8 east (151° 9.8’ east). That error resulted in the aircraft’s navigation systems being directed to a position near Cape Town, South Africa instead of Sydney Airport, Australia. An error in excess of 11,000 km. The magnitude of this error adversely affected the aircraft’s navigation functions, global positioning system (GPS) receivers and some electronic centralised aircraft monitoring (ECAM) alerts.
Airbus recommended that the aircraft’s position should be entered into the MCDU via that equipment’s slew keys. That method of data entry inherently limited the possibility of large errors, as the incremental nature of the slew keys required significant time to effect large changes in latitude and longitude. By contrast, the entry of latitude and longitude using the multipurpose and control display unit (MCDU) scratchpad involved the input of a sequence of 16 characters consisting of 12 numerical characters, two letters and two separate decimal points. This number of characters generally increases the likelihood for error when copying such a sequence from the gate sign to the scratchpad. On this occasion the use of the scratchpad directly facilitated the large positional error.
Kirwan (1994) examined data relating to error in tasks. The results showed a 3 per cent error rate for recall performance when recalling a six-digit sequence. While this is only partially relevant to this occurrence, the same error rate was present for entering seven-digit numbers into a key phone. Of interest, when conducting a routine operation where care is required, the error probability was 1 per cent. These error probability rates are fairly low; however, this kind of event is reasonably rare, as most data entry errors are detected in the cross-check or self-check after entry.
System error detection
Manual entry of the aircraft’s position during ADIRS initialisation routinely results in the message prompt to ALIGN IRS. As this process is carried out on virtually every flight, it becomes an automatic action for flight crew. Automatic actions are not monitored closely and as such, any errors or incorrect actions will often be missed until it's too late to change them, or an unforeseen consequence has occurred (Reason, 1990).
In addition to the ALIGN IRS prompt, the magnitude of the positional change on this occasion would normally result in the prompt to also REALIGN IRS. The captain reported that some of the A330 fleet required ALIGN IRS to be selected twice, and that he could not remember if he carried out the alignment twice on the occurrence flight. That understanding was incorrect as, in the absence of a system fault, the prompt to ALIGN IRS only occurs once.
Examination of the aircraft’s navigation system following this occurrence did not identify any system fault that would have affected normal operation. It was therefore likely that, following entry of the incorrect aircraft position, ALIGN IRS was displayed, followed by the prompt to also REALIGN IRS. Differentiation between these two prompts would be made more difficult as they were displayed in a similar colour and in close proximity.
In summary, the aircraft’s navigation system probably displayed messages that would have enabled identification of the data entry error. However, due to a combination of the captain’s understanding that the same alignment‑related message may be displayed twice, and the similarity between the messages, the error remained undetected.
Data entry crosscheck
The cockpit preparation procedure called for the pilot monitoring to check the airfield data and all flight management system (FMS) entered data. The first officer (FO) stated that on his return from the pre-flight external inspection of the aircraft, the majority of the cockpit preparation had been completed. The FO then checked the data entries and switch positions as per standard operating procedures. The FO’s check of the FMS entries was a routine action carried out at the beginning of every flight, and the FO reported that it was rare for errors to be present and/or detected.
Expectancy can influence how and where people look for information (Wickens and McCarley, 2008). Expectancy can be influenced by habit, salience, event rate and relevance, among other factors.
In addition, various studies have shown a significant number of errors made by individuals are detected only when it is too late for effective intervention and recovery. Sarter and Alexander (2000) found that slips (consistent with the data entry error) were more likely to be detected based on routine or 'suspicious' checks, wherein crew suspected a problem and went looking for it, or observed the outcome of the slip.
Thomas, Petrilli and Dawson (2004) found that 'less than half the errors committed by crews were actually detected'. Another study in 2004 by Thomas noted that the majority of errors occurred during pre-flight, take-off and descent-approach-landing.
The combination of expectancy associated with a high frequency routine check with low suspicion of error, and a low chance of error detection during pre-flight, reduced the effectiveness of the FMGS check as a control in detecting the initialisation error. That probably led to the FO not noticing the incorrect initialisation coordinates during the crosscheck of the flight management and guidance system (FMGS) entries after completing the aircraft exterior inspection.
Heading indication crosscheck
The cockpit preparation procedure included the crosschecking of the primary heading indications on the navigation displays (NDs), primary flight displays (PFDs) and digital distance and radio magnetic indicator (DDRMI) against the standby compass indication. This check was designed to detect errors such as a heading disparity between the direct‑reading standby compass and the primary heading indicators.
As the NDs, PFDs and DDRMI all receive their heading information from a respective ADIRU, on this occasion they would have displayed an equally incorrect heading as they were all influenced by the positional initialisation error. By contrast, the standby compass did not receive heading information from an ADIRU and would therefore have been reading correctly, subject to any magnetic interference. However, the standby indications are much smaller and set further away from the pilots than the indications on the ND, PFD and DDRMI and therefore less prominent. Apart from crosschecking the primary heading indicators, and in rare emergency procedures, the standby compass is rarely referenced by the flight crew.
The crew reported that the crosscheck was performed by one pilot reading out a heading and then both silently checking each heading indication against this value before saying ’Check’. This check did not include verbalising the displayed value.
In order to increase pilots’ awareness of aircraft modes and system states, aircraft manufacturers have recommended that pilots call out mode changes as they occur. While this is generally targeted at calling mode changes in-flight, the same benefit may be gained during ground checks. That is, by verbalising the indication or mode, greater attention is given by the flight crew. As a result, they are more likely to become aware of an error or discrepancy as their attention is directed toward comparing the indications.
Recorded data indicated that the ND modes selected during the pre‑flight would not have displayed the heading on both of the pilot’s NDs. As such it would not have been possible to conduct the full heading indication crosscheck during the pre‑flight, as detailed in the flight crew operations manual (FCOM).
In summary, it is likely that the disparity between the standby compass and the primary heading indications was not identified due to a combination of the:
method of crosschecking the heading indications by use of the word ‘Check’ instead of verbalising the actual indication
reduced prominence of the standby compass compared to the primary heading indications
instrument panel check not being fully carried out during pre-flight in accordance with the FCOM, as the incorrect mode was selected on the NDs.
Flight plan comparison
Following alignment of the ADIRS, the next step in the cockpit preparation was to check the FMGS‑entered flight plan. Both pilots stated that this included checking the total track nautical miles and predicted fuel usage calculated by the FMGS against the values contained on the paper flight plan provided by their flight dispatch. Given the magnitude of the positional error, the ATSB considered whether this comparison provided an opportunity to detect the data entry error.
The check of the FMGS-entered flight plan was designed to ensure the correct flight plan and standard instrument departure (SID) were loaded prior to take‑off. As such, the total track miles and fuel predictions were based the departure runway and active flight plan loaded into the flight management computer (FMC), and not influenced by the aircraft position calculated by the FMC. The total track miles and fuel predictions would therefore not differ from the paper flight plan provided by flight dispatch. As such, the comparison of total track miles in the FMC to the paper flight plan during pre-flight did not provide an opportunity to detect the initialisation error prior to take-off. Once airborne however, the total track miles and fuel predictions would have been erroneous as they incorporated the aircraft’s FMGS calculated position.
GPS accuracy check
Both flight crew stated that seeing GPS PRIMARY and accuracy HIGH on the MCDU progress page during the pre‑flight was, to them, an indication that the ADIRS was initialised and functioning correctly. Given that once airborne the crew noticed GPS PRIMARY LOST displayed on the ND, the ATSB considered whether the sequence of GPS-related messages may have provided an opportunity to detect the positional error before take‑off.
The GPS PRIMARY message is typically displayed when the GPS is capable of passing the integrity and accuracy checks by receiving an adequate number of satellites in the correct positions relative to the aircraft and horizon. When this message is active, the two GPSs interface with the respective inertial reference system (IRS) and output a combined position to the FMC. If GPS PRIMARY is active for more than 10 minutes, and the GPS integrity or accuracy check then fail because of an anomaly with the satellite array, the GPS signal is invalidated. The IRS output then reverts to a mixed IRS only position (IRMIX) and eventually GPS PRIMARY LOST is displayed on the ND. There can be a delay of a few minutes between the invalidation of the GPS signal and display of GPS PRIMARY LOST.
During the occurrence the GPS PRIMARY and accuracy HIGH displays were observed prior to pushback and provided a false confirmation that the FMGS was set up correctly. It is probable that at this time the ADIRS initialisation was either incomplete or had not had enough time to invalidate the GPS signal. Eventually the aircraft used the erroneous position from the initialisation error to compare the satellite array, and invalidated the GPS signal. That would have removed the display of GPS PRIMARY and accuracy HIGH on the MCDU progress page. However, this did not occur until the aircraft was taxiing for departure, a time when the crew would not normally be observing that page. As a result, there was limited potential to identify the error.
The aircraft‑generated post‑flight report indicated that faults associated with failure of GPS integrity checks occurred 14 and 9 minutes prior to take‑off. These failures were the result of the positional error and occurred while the aircraft was being taxied for take-off. Both of these faults are designed to have an associated single chime master caution aural alert, and the respective GPS NAV (1, 2) FAULT should appear on the engine/warning display. There were no associated ECAM messages indicating faults to either GPS.
The crew reported hearing two individual chimes during the taxi but, as there was no associated ECAM message, they continued with normal procedures and prepared for take-off. It is likely that a message associated with failure of the GPS integrity check did appear on the engine warning display but the crew did not recall seeing one.
Activation of the GPS NAV (1,2) FAULT alert would normally indicate a loss of GPS PRIMARY and result in the display of GPS PRIMARY LOST on the ND. However, due to complexity of the system there is variation in the time required to display this message. It was therefore not possible to determine if this message was displayed on the ND prior to take‑off and remained unnoticed by the crew. Alternatively, GPS PRIMARY LOST may not have been displayed until the aircraft was airborne.
A review of the message display logic identified that the ECAM warning FMS/GPS POSITION DISAGREE also normally activates when an erroneous position is entered during IRS alignment. However, there was no evidence from the flight crew, flight data or post‑flight report that this occurred. Advice from Airbus was that, similar to the above discussion regarding display of the GPS PRIMARY LOST message, there may not have been sufficient time for the message to be displayed.
Data integrity checks
The last step in the cockpit preparation procedure before conducting the take-off briefing was the ADIRS check. This check ensured that the distance between each IRS and each FMS position was less than 5 NM (9 km).
As each IRS was initialised to the same positional error, it was probable that the distances between each IRS and each FMS position were within the allowable limit. Likewise, prior to the conduct of this check there may have been sufficient time for the FMS to enter IRMIX mode and invalidate the hybrid global positioning/inertial reference system (GPIRS) position. In that case the FMS and IRS positions would not appear to differ and the error would remain unnoticed.
An FCOM requirement to review the ND during cockpit preparation and taxi provided two opportunities to identify that the ADIRS was not correctly initialised. Specifically, with the ND in NAV or ARC mode, the FMS-calculated position would be displayed but the airport, SID waypoints and surrounding navaids would not as they were significantly outside of the range of the FMS-calculated position. Although contrary to the FCOM, in the event that the ND was left in PLAN mode, the ND would display the loaded airport and SID waypoints but not the FMS‑calculated position. In this case the ND may look similar to a correctly-initialised NAV mode without the aircraft or runway symbols (Figure 13).
Recorded data indicated the captain had PLAN mode selected on his ND until after pushback and just prior to engine start. This precluded the ADIRS IRS align check being carried out in accordance with the FCOM. The FO had NAV or ARC mode selected on his ND for most of the pre-flight and then PLAN mode prior to pushback until engine start.
Based on the selected ND modes it is likely that the data integrity checks detailed in the pre‑flight and taxi procedures were either omitted or conducted with the ND selected to an inappropriate mode and/or range that concealed the aircraft’s positional error.
The recorded data also indicated that the FO selected plan mode and every available ND range during the line-up/take-off roll. This may indicate that the FO was attempting to interpret an unusual display on the ND associated with the positional error.
Figure 13: ND controls and an example of a PLAN mode display (right picture). Note that the track (in yellow) and waypoints (in green) are displayed but there is no aircraft or runway symbol
Source: Airbus, modified by the ATSB
Runway position update
In the event that GPS PRIMARY is not active at the time that take-off/go‑around thrust is applied, the aircraft normally updates its position using the stored coordinates of the runway threshold or runway intersection. As the aircraft‑generated post-flight report identified that GPS PRIMARY was not active when take-off thrust was applied, the ATSB considered why the positional update did not occur on this occasion.
Airbus explained that, despite GPS PRIMARY not being active, the aircraft was unable to update the calculated position to the runway threshold coordinates as the difference between the runway threshold coordinates and the erroneous position was too large. The required positional correction was beyond the normal capabilities of the FMGS to update between the application of take‑off/go‑around thrust and the take-off.
Airborne flight management
Due to the large data entry error remaining uncorrected, the navigation system did not initialise relative to the aircraft’s actual position prior to take‑off. This likely affected the enhanced ground proximity warning system’s (EGPWS) ability to allow for the fact the aircraft was on departure, and resulted in spurious EGPWS activation shortly after take-off from Sydney Airport.
The captain reported being initially startled by the alert and, having visually confirmed that they were clear of terrain, became concerned that the FO would conduct an EGPWS escape manoeuvre. Such a manoeuvre involves separating the aircraft from terrain in the shortest possible distance by the use of as much as full control stick back pressure and all available engine power. The captain believed such an abrupt manoeuvre would increase the risk of a traffic conflict in the busy airspace and therefore instructed the FO to disregard the alert.
The FO engaged the autopilot at an altitude of approximately 400 ft which, in accordance with the SID was around the time the aircraft was required to conduct a right turn from the runway heading of 155° and track towards waypoint DUNES (an approximate heading of 170°). However, as the positional error resulted in the application of the wrong magnetic variation, an incorrect heading was displayed on the ND, PFD and DDRMI. Flight data indicated the aircraft’s indicated heading was 193° throughout the take-off roll, compared to the actual runway heading of 155°. In following the incorrect heading indications towards waypoint DUNES, the crew inadvertently turned left onto 170° and entered the departure flight path of the active parallel runway 16L.
During studies of distraction and interruptions during normal flight operations, distraction has been noted as a factor that can increase the opportunity for error (Loukopoulos, Dismukes & Barshi, 2001). It has also been shown to detract from effective monitoring (Loukopoulos, Dismukes & Barshi, 2003). In some cases this will be as a result of the requirement for a pilot’s attention to be on multiple tasks (Dismukes, Loukopoulos & Jobe, 2001). As such, distraction will often move the focus of attention from the intended task. In this context, it is likely that the spurious EGPWS alert distracted the crew from noticing that the aircraft was turning left and contrary to the SID, once the autopilot was engaged.
Both flight crew stated that in the early stages of flight, the cognitive workload was very high. This was supported when considering the activation of the EGPWS and subsequent determination that this was a spurious warning, combined with attempts to rationalise a number of alerting mechanisms such as air traffic control (ATC) informing the crew they were on the wrong heading, GPS PRIMARY LOST displaying on the ND, and the loss of most tracking and heading information at a critical stage of flight. The crew also stated they were concerned by the amount of traffic in the Sydney area and the potential for traffic conflict given their navigation difficulties.
Shortly after the FO engaged the autopilot, the captain took over the flying and ATC communication duties. The captain stated that due to a lack of any ECAM guidance, the only instruction he could give the FO was to reset the NAV.
The FO’s initial reaction was to refer to the UNRELIABLE AIRSPEED INDICATION checklist despite no guidance to do so from ECAM and no indication of a problem with the air data computers or airspeed sensors. The FO advised that in the weeks prior to the occurrence flight he had undergone a checking and training exercise which simulated conditions of frozen pitot airspeed probes. He stated that this, combined with recent media coverage of a fatal accident involving an A330 that experienced problems with the pitot system, put him in the mindset that they may be experiencing a fault in the air data reference (ADR).
The UNRELABLE AIRSPEED CHECKLIST provided target thrust settings and aircraft attitudes to assist the crew in flying the aircraft within the operating limitations in the event that the airspeed indicators became unreliable. It also contained guidance on identifying an affected ADR, which may have also contributed to the FO’s belief that there was an issue with the aircraft’s ADRs. Although flight data indicates that there was no sign of an ADR fault, this may have led the FO to turn ADR 1 and 3 OFF, inadvertently further degrading the flight systems.
There was limited information available to the crew to identify the risk associated with selecting an ADR to OFF. The flight crew training manual listed the identified risks associated with that action (appendix B) however, there was no guidance for fault diagnosis or rectification of the condition experienced by the crew of 9M-XXM. Additionally, the flight crew training manual is not routinely referenced in-flight, unlike the quick reference handbook or ECAM guidance.
Reliance on electronic centralised aircraft monitoring
The FCTM describes the ECAM as a main component of Airbus aircraft that provides information in response to most failure situations. The captain attributed the lack of ECAM guidance before take‑off as an indicator that the aircraft systems were operating correctly, despite two aural chimes associated with master cautions. The captain further stated that they had never experienced a chime with no associated ECAM message and that their response was to continue normal procedures. This behaviour is consistent with a reliance on ECAM to identify and resolve abnormal system situations.
The crew reported that the lack of ECAM guidance once airborne was a hindrance to resolving the situation. In the absence of ECAM or engine/warning display messages the FO searched the quick reference handbook and FCOM in an attempt to diagnose the problem. The FO carried out part of an UNRELIABLE AIRSPEED CHECKLIST and part of an ADR FAULT procedure before incorrectly using the ADIRS rotary switches in an attempt to rectify the situation.
The operating philosophy and views of the flight crew indicate a high expectancy that ECAM guidance would be available to resolve most abnormal situations, including that being experienced out of Sydney. In those rare situations where this guidance is not available, it could reasonably be expected that the risk of misidentification and/or inappropriate attempts to resolve the situation would increase.
Air traffic control support
A review of the ATC response to this occurrence identified that the controllers carried out several tasks that reduced the risk to both the occurrence aircraft and other aircraft in the area. They were the first to notice and alert the crew to the tracking problem, and provided assistance to identify that the aircraft’s main heading indicators were erroneous. Additionally, ATC quickly resolved a possible conflict with another aircraft lined-up and ready to depart on the parallel runway.
Subsequently, coordination with several ATC units and the availability of continuous radar coverage provided the crew with a safe diversion alternate and vectoring from Sydney all the way to final approach in Melbourne. The captain reported that ATC had prevented the situation becoming a ‘dire emergency’ and that in many ways they had ‘saved the day’.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 20 March 2015, the pilot of a Piper PA 25-235/A9 Pawnee aircraft, registered VH-NLP, departed a private airstrip near Derrinallum to conduct insect baiting operations on a property near Darlington, Victoria. Shortly after commencing that task, the aircraft collided with terrain and was destroyed by impact forces and a post-impact fire. The pilot, who was the sole occupant, was fatally injured.
What the ATSB found
The ATSB found that while positioning the aircraft for a baiting run, the pilot inadvertently descended below the normal application height over an adjacent paddock. While recovering from this loss of height and avoiding terrain, the aircraft probably stalled and entered an incipient spin at a height from which recovery was not possible before colliding with terrain.
There was no evidence of any pre-existing mechanical defect with the aircraft or engine that could have contributed to the accident. However, the aircraft was being operated outside the flight envelope as it exceeded the design maximum take-off weight. In addition, the conditions were conducive for the formation of carburettor icing.
Safety message
Operators and pilots are reminded of the hazards associated with agricultural low-level flying and the increased risk of collision with terrain. The ATSB highlights the importance to pilots and operators of ensuring that their aircraft’s weight and balance is within specified limits, and understanding the effects of operating outside the flight envelope on the aircraft’s flying characteristics. This accident is also a reminder of the importance of monitoring environmental conditions and the associated risk of carburettor icing.
Photograph of VH-NLP
Source: The operator
Findings
From the evidence available, the following findings are made with respect to the collision with terrain involving Piper Aircraft Corporation PA-25/A9 Pawnee, registered VH-NLP, which occurred 10 km west of Darlington, Victoria, on 20 March 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
While positioning the aeroplane for a baiting run, and for reasons that could not be determined, the pilot inadvertently descended below the normal application height over an adjacent paddock before climbing and then losing control.
The aircraft probably stalled and entered an incipient spin at a height from which the pilot was unable to regain control before colliding with terrain.
Other factors that increased risk
The pilot took off with the aircraft about 102 kg over its approved maximum take-off weight, which can affect the aircraft’s handling characteristics.
Other findings
The weather at the time of the accident was conducive to carburettor icing, but the time between the accident and examination of the wreckage meant that any ice, if present, had melted.
The occurrence
On 20 March 2015, a Piper Aircraft Corporation PA-25-235/A9 Pawnee aircraft, registered VH‑NLP (NLP), was being prepared for an agricultural flight from a private airfield near Derrinallum, Victoria. A witness reported observing an estimated total of about 100–120 l of fuel on board, and load of about 450 kg of insect bait. The witness observed that the pilot appeared to be well rested and enthusiastic about the task.
The planned flight was an insect baiting operation, consisting of spreading a poison-infused wheat product. This was to be carried out on a farming property near Darlington, Victoria, over three adjoining paddocks in an east-west direction. The plan was for the pilot to conduct the bait application in a left racetrack pattern,[1] at about treetop level.
At about 0850 Eastern Daylight-saving Time,[2] NLP departed for the 10-minute flight to Darlington. The operator considered the wind to be calm at the time NLP departed Derrinallum. A witness at the accident site indicated that the conditions were calm at about 0900–0915, when they heard the aircraft. They noticed that the wind did come up later in the morning. Bureau of Meteorology weather observations were available for Mortlake, about 15 km to the west of the farming property. At about the time of the bait application operation, the Mortlake recorded weather indicated that the wind was from the west at 7 kt, the temperature was 12.3 °C and that the dewpoint[3] temperature was 10 °C.
Several witnesses observed and heard the aircraft operating in the area of the three paddocks between about 0900 and 0915. One witness, who was travelling along a nearby highway to the south-east of the three paddocks, observed NLP at treetop height, heading west. They then observed it rolling left and right before suddenly descending. Black smoke was seen by witnesses coming from a paddock in the area where NLP had been operating. The aircraft impacted terrain, out of sight of the witnesses, at about 0915.
The pilot, who was the sole occupant, was fatally injured and the aircraft was destroyed by impact forces and a post-impact fire. The accident was not considered survivable.
Operational aspects
Pilot information
The pilot was appropriately qualified for the flight, holding a Commercial Pilot (Aeroplane) Licence, a Class 2 Agricultural Rating (Aeroplane), and a Class 1 Aviation Medical Certificate. The pilot completed their agricultural rating on 9 April 2014, which included their 2-yearly flight review. The pilot had a total aeronautical experience of about 281 hours, about 17 hours of agricultural flying and about 15 hours in NLP.
After obtaining an agricultural rating in Victoria, the pilot was employed for about 4 months by an operator in Queensland. Although the pilot performed a number of training and general flights with that operator, there were no recorded agricultural flights during that period. The pilot returned to Victoria in August 2014, and performed various duties. These included agricultural operations and aerial work through until November 2014.
The pilot’s most recent aerial agricultural operations occurred about 5 months prior to the accident in October 2014. That involved three baiting flights and two flights spraying liquid chemical. The pilot then completed three general flights in January 2015. Of these, the last entry in the pilot’s logbook was for a flight on 26 January 2015. The pilot’s logbook did not include a ferry flight undertaken in NLP on the day prior to the accident.
An aerial agriculture instructor who had flown with the pilot stated that, although the pilot was conscientious and deemed safe for flying agricultural operations, there were particular situations where the pilot’s lower level of experience became evident. These situations, which were reported to sometimes be observed in other ‘junior’ agricultural pilots, included difficulty managing the aeroplane’s attitude during turns and anticipation of a pending aerodynamic stall.[4]
Aircraft information
Piper Aircraft Corporation PA-25-235 Pawnee NLP was manufactured as a single-seat aircraft in the United States in 1965, and certified in the normal category. It was converted to an ‘A9’ variant in Australia in 1983 under a Civil Aviation Safety Authority Supplemental Type Certificate, and certified the normal and agricultural categories. This conversion included the installation of a second seat, replacement of the fabric-covered wings with metal wings and a larger chemical hopper.
The last periodic inspection was carried out on 5 August 2014 at 8,762.8 flying hours.
The Supplemental Type Certificate for the PA25-235/A9 detailed a maximum take-off weight of 1,315 kg. Based on the reported fuel and insect bait on board for the flight, the ATSB estimated that the aircraft departed at about 102 kg over the approved maximum take-off weight at take-off. Similarly, based on a planning fuel use of 60 l/hr and a ‘best guess’ metered bait application rate of 15 kg/hectare, it was estimated that the aircraft was about 39 kg over its maximum take-off weight after the first bait application run. Exceeding operational limitations can affect an aircraft’s handling and performance, reducing the normal operational safety margins. Depending on the magnitude of the exceedance, it can also impose significant structural loads in excess of the aircraft’s design loads. In turn, this can reduce the aircraft’s effective service life and potentially cause structural failure.
Preparation for the operation
Several days prior to the accident, the operator contacted the property owner to discuss the planned baiting job. The operator reported also taking the opportunity to carry out an airborne survey of the paddocks that were to be baited by the pilot. The operator recalled meeting with the pilot for a briefing on the afternoon before the planned flight. The briefing was reported to include a discussion of the boundaries of the paddocks that were to be baited, the powerlines and on the pre‑programming of the aircraft’s global positioning system equipment.
On-site examination
Accident site
The wreckage was located in the eastern-most paddock of the three to be baited. Examination of the accident site indicated that NLP impacted terrain nose-down, in an almost vertical orientation. The aircraft came to rest about 7 m from the initial impact point. The forward fuselage and cockpit sustained significant damage as a result of the initial impact, and a post‑impact fire consumed the the internals of the aircraft’s global positioning system equipment, the majority of the fuselage and the inboard wing sections (Figure 1). Damage to the leading edge of each wing also indicated a vertical impact. ATSB analysis based on estimates of the aircraft’s speed, the almost vertical impact angle and the energy absorbed by the aircraft indicated that the impact forces imparted to the pilot would normally be expected to result in fatal injuries.
Examination of the propeller, along with evidence from the impact crater, indicated that the propeller was rotating under a level of power at the time of impact. Flight control continuity was confirmed. Due to the level of damage, the flap position could not be determined.
No pre‑existing anomalies were identified at the accident site that would have precluded normal operation of the aircraft.
Figure 1: Aircraft wreckage (looking east), showing the lower surface of the aeroplane. Note the significant damage to the forward fuselage and cockpit area and the extent of the fire damage to the fuselage and inboard wing sections
Source: ATSB
Insect bait was found in a straight and regular swathe along the southern fence line of the paddock, consistent with a bait application run (Figure 2). This swathe ran for the entire length of the planned baiting area and was about 36 m wide. Additionally, a bait swathe of varying width and density from the middle of the adjacent paddock was observed outside and to the top‑right of the baiting area. This continued in an arc to the initial impact point. This swathe initially decreased from about 16 m down to 7 m wide, then increased to 30 m wide before tapering off towards the accident site.
Figure 2: Area to be baited (outlined by the yellow dashed line), with dispensed bait shaded in yellow and higher-concentration bait shown as bright yellow
Source: Google earth, modified by the ATSB
Survivability and post-mortem results
The forensic pathologist who conducted the pilot’s post-mortem examination concluded that the pilot succumbed to the effects of fire and impact-related injuries. No abnormalities were identified that could have led to pilot incapacitation. Toxicology results did not identify any substances that could have impaired the pilot’s performance.
The sources of information during the investigation included the:
operator of VH-NLP
maintainer of VH-NLP
pilot’s aerial agriculture flying instructor
Bureau of Meteorology
Civil Aviation Safety Authority
Supplemental Type Certificate holder.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the pilot’s aerial agriculture flying instructor, the operator of VH-NLP, the Bureau of Meteorology and the Civil Aviation Safety Authority.
Submissions were received from the operator and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Safety analysis
Introduction
From witness information and examination of the accident site, it is evident that during the turn onto the second bait application run, the pilot lost control of the aircraft and was unable to recover before impacting the ground. The observed wing rock and descent was consistent with an aerodynamic stall and wing drop.
Examination of the aircraft and engine did not identify any anomalies that would have precluded normal operation, or that would have required the pilot to jettison the hopper load to the east of the intended bait application area. The wind at the time was not considered significant to the baiting operation.
This analysis will consider the factors with the potential to have contributed to the loss of control, including the potential influence of the aeroplane weight and loss of engine power due to carburettor icing.
Interpretation of the flight path
Set-up for and initiation of the second bait application run
Following the first bait application run, the pilot repositioned the aircraft for the next swathe along the paddocks, which was intended from east to west. The location and orientation of the bait application outside the intended area was consistent with its commencement prior to the beginning of the planned baiting run, as the pilot was finalising the repositioning turn. The spread width of the bait (see the following discussion) was consistent with the aircraft being at a lower height than for the previous run. The ‘track’ of the bait appeared to indicate that the pilot may have been attempting to avoid the tree line at the north‑eastern corner of the area to be baited. The increased bait concentration in the vicinity of those trees was consistent with the pilot jettisoning the load, as opposed to a normal application, which is at a metered rate.
Examination of the second bait application run
The spread width of the bait throughout the initial application run was about 36 m. Consistent with the aircraft owner’s standard bait application height of between treetop height and 100 ft (30 m), a witness observed VH- NLP (NLP) conducting runs at treetop height, or about 50 ft (15 m) above ground level. This reported height, and the known spread width on the first run, was used as a basis for determining the approximate height of NLP between the grain release in the adjacent paddock through to the accident site.
The spread width decreased from 16 m to 7 m, before increasing again to a width of 30 m. This indicates that NLP was below the previous application height, and continued to descend before climbing until about 70 m from the accident site. From this position the aircraft descended and impacted the ground. This is consistent with an attempt by the pilot to regain height after descending in the latter stages of the repositioning turn.
Reason for the height loss and jettison of the load
In an effort to understand the reason for the commencement of the bait application before entering the intended baiting paddock, the ATSB considered whether the pilot may have been momentarily confused by the apparent similarity of the respective tree lines immediately east of the area to be baited, or concerned with the powerlines on and near the south-eastern boundary of the area. The tree lines were each outside the area and the pilot had correctly ceased the first application run before passing over and east of the south-eastern tree line. In addition, the first application run passed close to the powerlines, and the pilot could be expected to have been aware of their location. On this basis, the ATSB concluded that it was unlikely the pilot misinterpreted the relevance of the location of the north‑eastern tree line, or would have been overly concerned with the location of the powerlines, when setting up for the application run.
In respect of the jettison of the bait, the ATSB considered whether the pilot may have unintentionally descended lower than planned or mishandled the repositioning turn. The pilot had relatively low total aeronautical experience and low and interrupted experience in agricultural operations. In addition, an aerial agricultural instructor advised that, similar to the instructor’s experience with other less-experienced agricultural pilots, the pilot at times had difficulty maintaining attitude in turns and anticipating an impending aerodynamic stall. The instructor reported that this was a particular risk when low-experience pilots were not current in agricultural‑type operations. It is not possible to quantify the effect of the pilot’s more recent, non‑agricultural flights in January 2015 on their handling of the aircraft in the baiting operation.
Another reason for the pilot to jettison the load was a loss of engine power. In this regard, although there were no engine anomalies identified that would have precluded normal operation, the ambient conditions were conducive to serious icing at any power setting. Carburettor icing can lead to a loss of engine power (see the subsequent discussion). However, the time between the accident and examination of the wreckage allowed sufficient time for any ice, if present, to have melted.
Aerodynamic stall and loss of control
Flying at low-level gives very little or no margin to recover from unexpected events, such as aerodynamic stalls or other losses of control. Height loss from a stall in general aviation aeroplanes, assuming correct recovery technique and expectancy of the pending stall, is generally 100–350 ft (30–107 m). Therefore, stall prevention (including maintaining airspeed) is essential at low heights.
One of the limitations of stall training and practice is that stalls are generally expected by students and follow a routine pattern. For unexpected or non-routine situations, a pilot will be focussed on the task at hand or perhaps a developing situation and potentially miss the available cues. In this accident, this could have included the pilot focussing on the unintended loss of height during the repositioning turn. Pilot knowledge and skill in recognising a developing stall situation, and responding effectively, is an essential element of flight safety in any operation.
NLP travelled a relatively short 70 m across the ground after the apparent attempt to regain height until impacting the ground. The physical evidence at the site indicated that the aircraft was inverted in an almost vertical, nose-down attitude at impact. The short distance between the initial point of impact with the ground and location of the main wreckage indicated low speed at that time.
Loss of control as a result of an aerodynamic stall could not be definitively proven. However, the low-level flight and manoeuvring by the pilot leading up to the loss of control increased the risk that they might miss any cues of an impending stall. The orientation of, and damage to the aircraft at impact, and low speed at that time indicated that the most probable scenario was an aerodynamic stall and subsequent right wing drop, consistent with an incipient spin. The height of the aircraft at that time was insufficient for the pilot to regain control before impacting the ground.
Weight and balance
Although the aircraft was being operated above its maximum take-off weight by about 102 kg at take‑off, and by about 39 kg at the time the pilot jettisoned the load, there was no evidence of an in-flight structural failure. There was insufficient evidence to determine what, if any, effect the overweight operation of the aircraft had on the flight characteristics or the development of the accident. Despite the overweight operation not being found to be contributory, operators and pilots are reminded that operations within the approved weight and balance envelop provide for known handling and performance characteristics.
Carburettor icing
The recorded temperature at about the time of the accident was 12.3 °C, with a dewpoint[5] of 10 °C. Given these temperatures, the probability of carburettor icing was calculated to be in the serious icing range at any power setting (see the Carburettor icing-probability chart that is available from the Civil Aviation Safety Authority website.
Increased humidity increases the likelihood of carburettor icing. If ice continues to accumulate in the carburettor, the flow of air to the engine reduces. If the process is allowed to continue, it will result in a power reduction, and eventually the engine will stop. Examination of the wreckage indicated that the engine was still operating, however, the level of power being produced was not able to be determined.
A carburettor heat control was available in NLP. If selected, warm air was directed from a heat muff[6] installed on the exhaust system to the carburettor inlet, melting any ice in the carburettor. Due to the level of damage, the ATSB could not determine the position of the carburettor heat control at the time of the accident.
As previously discussed, given the time between the accident and examination of the wreckage, there was insufficient evidence to conclude that carburettor icing occurred or affected normal engine operation.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
