Pacific National train 9337N left Moss Vale bound for Narrandera, NSW. The train consisted of two locomotives (8113 and 8109) hauling 15 empty wagons for a total length of 295.2 m and weight of 634.6 gross tonnes.
While travelling towards Junee, the train crew’s attention was drawn towards the track works on the Down Main line. Consequently, the crew did not notice the distant Warning sign located at the 482.000 km point, 2000 m prior to the Stop sign. At about 0955, while approaching Junee at a speed of approximately 50 km/h, the train crew observed the Stop sign ahead and immediately placed the brake handle into the emergency position. The train passed over the 3 detonators placed at the Stop sign and came to a stand approximately 75 m past their limit of authority.
The Network Controller (located in Junee) was advised of the incident and the train crew relieved. Both drivers were tested at Cootamundra which proved negative for the presence of alcohol or drugs.
The train crew had been distracted by the track works on the Down Main line between the 479.500 km and 483.500 km points. As a result, they did not see the Warning sign. It is likely that had they noticed the Warning sign they would have taken appropriate action to stop train 9337N at or prior to the Stop sign.
Safety message
The ATSB SafetyWatch initiative highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns is safe work on rail.
This occurrence demonstrates the importance of train crews remaining vigilant while carrying out the driving task, especially where a method of special working has been implemented due to track work.
At about 0834 on 10 August 2013, freight train 9101 derailed at a failed mechanical rail joint between Tempy and Bronzewing in Victoria. Nine wagons located mid-consist derailed and separated from the consist with three wagons ending on their side. The two locomotives and the leading 21 wagons and the last 10 wagons remained on the track. Approximately 300 m of track was destroyed as a result of the derailment. There were no injuries to train crew in the incident.
What the ATSB found
The ATSB found that the mechanical rail joint failed due to the development of fatigue cracks in both fishplates resulting in their subsequent overload fracture. The fatigue cracks had originated in the top surface of each fishplate and it is possible that differential sleeper support may have contributed to higher than normal cyclic tensile stress in the fishplates. Lower than required fishbolt torque was also identified and it is possible that movement within the joint may also have contributed to the development of the fatigue cracks, and the subsequent joint failure.
The fatigue cracks had developed over a period of time and the overload fractures had occurred prior to train 9101. Movement of the separated rail ends during the passage of train 9101 resulted in a lateral discontinuity in the running rail at the joint and the train’s derailment.
The ATSB found that the degraded and deteriorating condition of the rail joint was not detected by track inspections. In the 27 months preceding the derailment, visual inspections of this section of track had been conducted solely from rail vehicles and track walking inspections had not been conducted at intervals specified by maintenance procedures.
What's been done as a result
V/Line has updated its maintenance system to generate automated work orders for track walking inspections. In order to improve the detection of track defects, maintenance staff have been provided with specific inspection criteria for track infrastructure including joints and fastenings in their work orders.
Safety message
The implementation of effective inspection and maintenance regimes for the early detection and management of track defects is critical to the safety of rail operations.
On 15 August 2013, a Boeing 777 aircraft, registered VH-VPF and operated by Virgin Australia International Airlines, was conducting a visual approach to runway 34 at Melbourne Airport, Victoria. During the approach and after the waypoint SHEED, the aircraft descended below the approach path to about 500 ft above ground level. Upon recognising the descent profile error, the captain disengaged the autopilot and flew the aircraft level, re-intercepting the profile and continuing the approach to land.
What the ATSB found
The ATSB found that during the construction of the visual approach in the aircraft’s flight management system, the captain inadvertently entered an erroneous height against a waypoint, which was lower than required for that point. This resulted in the aircraft increasing the descent rate to meet this constraint, during which time it descended below profile. While the ATSB was not able to determine what led to the erroneous data entry or the error not being detected, a number of factors were identified that may have influenced the non-detection.
The ATSB also found that, due to extended wakefulness, the crew were probably experiencing fatigue at a level that has been demonstrated to affect performance, although fatigue could not be confirmed as contributing to the error in developing the approach profile. In addition, the ATSB noted that the guidance provided in the operator’s Route and Airport Information Manual increased the potential for the incorrect altitude to be entered into the aircraft’s flight management system for the waypoint.
What's been done as a result
The ATSB has been advised by Virgin Australia International Airlines that the SHEED approach is no longer available for use by its Boeing 777 crews.
Safety message
This occurrence highlights the factors that can influence the accuracy of data entry in critical systems and any associated checks. In addition, it reinforces the importance of monitoring descent profiles, irrespective of any expectation that the descent is being appropriately managed by the autoflight system, and taking appropriate action when a deviation from the desired profile is detected.
Context
Personnel information
The flight crew consisted of a captain, a first officer (FO) and, due to the duration of the flight, two cruise relief FOs. The captain and FO were in the operating seats during the take-off and landing.
The flight was a long-range flight that was rostered as a 17-hour duty, with a 15hour flight time. Given the duration of the flight, Virgin Australia Airlines (Virgin) provided rest periods for the operating crew during the cruise. The role of a cruise relief FO was to replace an operating crew member to allow them to rest as required in the flight crew rest compartment when established in cruise. The flight was operated according to Virgin’s fatigue risk management system, which was approved by the Civil Aviation Safety Authority. A review of the fatigue risk management system found that it met the current best practice guidance available from the International Civil Aviation Organization.
Captain
The captain held an Air Transport Pilot (Aeroplane) Licence (ATPL(A)) and was endorsed to operate B777 aircraft. They held a valid Class 1 Aviation Medical Certificate with a restriction that reading correction was to be available whilst exercising the privileges of the licence.
The captain’s aeronautical experience is outlined in Table 1.
Table 1: Captain's aeronautical experience
Total flying hours
12,500
Total flying hours on the B777
6,423
Total flying hours in the last 90 days
131.9
Total flying hours in the last 30 days
47.6
Total flying hours in the last 7 days
28.8
In addition to their operational flight duties, the captain was also an approved check and training captain. The captain reported having recently completed a visual approach via the SHEED waypoint to runway 34 in the simulator and once during line operations 4–5 months prior.
The captain had 10 days off, followed by a rostered standby day with no duty, prior to operating the outbound flight from Sydney to Los Angeles on 12 August 2013. Prior to commencing duty for the occurrence flight, the captain had about 35 hours free of duty in Los Angeles and reported obtaining about 13 hours sleep during that time. On the occurrence flight, they obtained 3 hours sleep during a rest break, which was described as ‘good quality’. There was an additional rest break taken during the flight, however no further sleep was obtained. The captain reported feeling tired as the aircraft approached Melbourne but considered this ‘normal’ for the length of the flight.
First Officer
The FO held an ATPL(A) and was endorsed to operate B777 aircraft. They held a valid Class 1 Aviation Medical Certificate with nil restrictions.
The FO’s aeronautical experience is outlined in Table 2.
Table 2: FO’s aeronautical experience
Total flying hours
10,176
Total flying hours on the B777
2,658
Total flying hours in the last 90 days
141
Total flying hours in the last 30 days
28
Total flying hours in the last 7 days
28
In addition to their operational flight duties, the FO was also an approved training FO, and was providing training to one of the cruise relief FOs during the flight.
The FO reported that they had flown into Melbourne on four previous occasions, but that this was their first experience of a visual approach to Melbourne Airport runway 34 via the SHEED waypoint. They had previously conducted the approach in the simulator, but reported that they had not done so for over 18 months.
Prior to operating the outbound flight to Los Angeles, the FO had 2 rostered days off and a standby day with no duty. They also had about 35 hours free of duty in Los Angeles and reported obtaining about 16 and a half hours sleep. The FO reported this as ‘good quality’ sleep and that they obtained about an hour’s sleep during the first inflight rest break and about an hour and a half during the second rest break. The FO reported feeling alert at the start of the flight and tired on arrival at Melbourne, which was considered ‘normal’ given the flight time. The FO felt that the provision of training to one of the cruise relief FOs increased the FO’s level of tiredness.
Cruise relief First Officer 1
The first of the cruise relief FOs held an ATPL(A) and was endorsed to operate B777 aircraft. They held a valid Class 1 Aviation Medical Certificate with a restriction that distance vision correction must be worn whilst exercising the privileges of the licence.
The first cruise relief FO’s aeronautical experience is outlined in Table 3.
Table 3: Cruise relief first officer 1’s aeronautical experience
Total flying hours
3,190
Total flying hours on the B777
1,025
Total flying hours in the last 90 days
217
Total flying hours in the last 30 days
86
Total flying hours in the last 7 days
44.5
The first cruise relief FO was occupying the FO’s seat during the FO’s rest period.
Cruise relief First Officer 2
The second cruise relief FO held an ATPL(A) and was endorsed to operate B777 aircraft. They held a valid Class 1 Aviation Medical Certificate with nil restrictions. This cruise relief FO was undergoing line training during the flight.
The second cruise relief FO’s aeronautical experience is outlined in Table 4.
Table 4: Cruise relief first officer 2’s aeronautical experience
Total flying hours
3,641
Total flying hours on the B777
56
Total flying hours in the last 90 days
56
Total flying hours in the last 30 days
56
Total flying hours in the last 7 days
29
Aircraft information
Flight control
The Boeing 777 can be manually controlled by the pilots via a conventional set of flight controls, or automatically using the aircraft‘s autopilot flight director system (AFDS). The AFDS can make a number of control inputs depending on the mode selected. These modes range from holding a selected heading and/or altitude to complete control through a pre-programmed flight management system (FMS) flight path in lateral flight path (LNAV) and vertical flight path (VNAV) modes. The AFDS is controlled through the AFDS mode control panel, located on the instrument panel glare shield in front of the pilots.
Altitude, heading, vertical speed, flight path angle and/or airspeed can all be set by the flight crew through the mode control panel and either automatically controlled by the autopilot or displayed to the flight crew on the flight director on the flight displays. Alternatively, guidance information for a pre-determined flight path can provided to the AFDS through the FMS.
Flight management system
The FMS is an integrated electronic system that provides the flight crew with various functions including navigation, performance optimisation and fuel monitoring, and cockpit displays. The FMS contains functions that manage the aircraft’s lateral and vertical navigation. The FMS incorporates a navigation database that contains the necessary pre-programmed waypoints to fly routes, standard instrument departures (SID), standard arrival routes (STAR) and other standard flight procedures.
A flight plan of the lateral, vertical and speed profiles for a flight can be either uploaded into the FMS as a complete plan or manually constructed by the flight crew using the waypoints contained in the navigation database in the FMS. The FMS then uses the aircraft’s current position and supporting system data to calculate commands for flight path control, which are sent to the AFDS. Map and route data are sent by the FMS to the navigation displays for visual presentation to the flight crew.
The commands for flight path control are presented to the flight crew through the flight director, which provides command bars on the primary flight display. The flight crew can make manual inputs to the aircraft’s flight controls to attain the flight director commands, or they can be automatically accomplished by engaging the autopilot.
The flight crew’s primary interface with the FMS is via the control display units (CDUs). Three CDUs are located in the centre pedestal, one each for the captain and FO (Figure 3), and a third at the rear of the pedestal, as a backup. Each CDU contains a screen for presenting FMS information and a keypad to allow the flight crew to navigate through the various pages and enter and modify FMS data. The screen contains a number of lines of information with line selection keys that allow each line to be selected to either enter or modify the data in that line. Data is entered into the CDU via the scratchpad, using the keypad at the bottom of the screen. The scratchpad is also used to present messages to the flight crew in relation to the operation of the FMS (Figure 4).
Figure 3: Captain and FO CDUs
Source: ATSB
Figure 4: CDU detail
Source: ATSB
Meteorological information
Observations from the Melbourne Airport automatic weather station were recorded every half hour. The surface weather conditions recorded at 0800 were a temperature of 9 °C, wind direction of 350° at 8 kt, QNH[9] 1019 hPa, with Few[10] cloud at 3,600 ft and visibility greater than 10 km with only a negligible change observed by 0830.
As sunrise was at 0705, and given the observed weather, the approach and landing occurred during daytime visual conditions.
Aids to navigation
Melbourne Airport runway 34 had three approaches available, an RNAV GNSS[11], a VOR[12] and a visual approach. Only the visual approach could be conducted using the LIZZI 7V STAR, as the other two approaches required the use of a different STAR that routed the aircraft over the BOLTY waypoint. BOLTY was further to the south of Melbourne Airport, before turning onto the final approach heading.
The LIZZI 7V STAR commenced at the LIZZI waypoint north-east of Melbourne Airport, and sequenced through the waypoints MAITE, IGPON, MONTY and EGEKA before completing at SHEED (Figure 1). SHEED was located overhead Essendon Airport, to the southeast of Melbourne Airport, and had a minimum altitude requirement of 2,500 ft to prevent conflict with traffic around Essendon Airport. All of these waypoints were stored in the database in the FMS.
The flight crew were using maps and charts that were provided by Virgin. The ATSB determined that the chart for the LIZZI 7V STAR/visual approach was valid for the time of the occurrence. The chart showed that the visual segment consisted of a right turn to align with runway 34. The elevation of the runway threshold was 330 ft.
Approach aids
Visual guidance to runway 34 was provided by sequenced lead-in strobe lights to assist crews conduct a visual turn onto final and a precision approach path indicator (PAPI) system, which provided glide path guidance. The PAPI consists of four indicator lights adjacent to the runway that can be either red (indicating low on approach) or white (indicating high on approach) and provides visual vertical guidance to the flight crew to assist them on attaining the appropriate glide path angle.
Melbourne Airport runway 34 has a PAPI on the left and right sides of the runway that are set to provide a glide path angle of 3°. The flight crew reported that the PAPI was not visible until they were on the right turn to align with the runway, which is when they would normally start using it for glide path reference.
Recorded data
The ATSB obtained a copy of the data recorded on the aircraft’s quick access recorder (QAR), including of the occurrence flight. Selected parameters from that data are provided in Figure 5.
Figure 5: Selected QAR data showing the occurrence after passing SHEED
Tests and research
In November 2013, the ATSB participated in a session in Virgin’s B777 full flight simulator to observe the differences in a Melbourne Airport runway 34 visual approach via the LIZZI 7V STAR with the correct and incorrect data entered into the FMS. The following observations were made:
Approach with the correct data in the FMS
During the approach with the correct data in the FMS it was found that after passing SHEED, the rate of descent increased to 1,450 ft/min before it decreased, settling at about 850 ft/min.
Approach with incorrect data in the FMS
During an approach using the data entered by the crew in this occurrence, it was found that:
after passing SHEED, the rate of descent increased to about 1,900 ft/min, before settling to about 1,850 ft/min[13]
the PAPI was not distinguishable until around 1,000 ft and about to commence the turn onto final. At that point, the PAPI was displaying 4 red lights.[14]
Organisational and management information
Operational information
Virgin provided the following information regarding the Melbourne Airport runway 34 visual approach from the LIZZI 7V STAR in their Route and Airport Information Manual (Figure 6).
Figure 6: Presentation of information regarding the visual approach via SHEED in the operator’s Route and Information Manual
An approach and landing on Melbourne Airport runway 34 using a visual approach via SHEED was included as part of Virgin’s refresher training program. In this respect the Instructor Guide for simulator refresher training included the runway visual approach via SHEED as part of a two session refresher training package that included numerous other items of training. The training was structured such that an FO under training would be the pilot flying the visual approach.
The Instructor Guide provided the same information as that contained in the Route and Airport Information Manual, but because the formatting differed from that manual the line break at the end of the second point occurred at a different point within the text and all information about the runway extension was contained on the one line (Figure 7).
Figure 7: Presentation of information regarding the visual approach via SHEED in the operator’s Instructor Guide for refresher training
On 28 July 2013, Virgin’s Flight Training/Standards branch released a Briefing Paper regarding the visual approach via SHEED.[15] The Briefing Paper was released when an analysis by Virgin of a number of occurrences of high rates of descent during the approach were found to result from (in part):
Delayed descent from SHEED
Autopilot disconnect during the turn onto final
FMC programming resulting in an above path PAPI indication when established on final.
A number of recommendations were included in the Briefing Paper in an attempt to prevent recurrence, although none of these had been included in operational procedures at the time of the occurrence. Those recommendations included:
Crew who are tired or fatigued should plan for and require the RNAV GNSS Approach
Briefing for the approach should cover AP [autopilot] use, the likelihood of increased decent rates and the requirement for a delayed stabilisation (500 ft Above Aerodrome Level), including the associated calls
The FMC should be programmed in accordance with the C1 [Route and Airport Information Manual] with a hard altitude at the 2.8nm extension that places the aircraft on a 3° approach (1,270 ft) rather than leaving the higher FMC calculated value
With the FMC programmed, the AP in LNAV/VNAV is available for the approach through the turn to final down to 200 ft AGL. While closely monitoring for acceptable performance – AP use is recommended for the approach.
Vertical path corrections with modes other than VNAV is not recommended – any unacceptable behaviour of LNAV/VNAV must be corrected manually with the AP disconnected of [or] a go-around commenced.
The Briefing Paper also included expanded FMC configuration information (Figure 8).
On 10 January 2013, the crew of an Embraer Regional Jet 170 was conducting a scheduled passenger service from Darwin to McArthur River Mine, Northern Territory. Shortly after passing navigational waypoint SNOOD, 125 NM (232 km) north-west of McArthur River Mine, the aircraft’s flight path started diverging from its planned track. The problem was identified by air traffic control and the crew were advised.
The ATSB found that, while updating the aircraft’s flight management system for the descent into McArthur River Mine, the crew unintentionally omitted entering an intended navigational waypoint that was located 25 NM (46 km) north-west of McArthur River Mine. This omission resulted in the aircraft’s autopilot tracking the aircraft direct to the initial approach fix instead of first tracking to the intended waypoint. The crew’s crosschecking processes were not effective in identifying the data input error.
From the evidence available, the following findings are made with respect to the descent below the approach path involving the Boeing 777-3ZGER VH-VPF near Melbourne Airport, Victoria on 15 August 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
When programming the approach into the flight management computer, the captain inadvertently entered the runway threshold crossing altitude into the runway extension waypoint, resulting in the flight management system calculating a vertical flight path that was below the intended approach path and a consequential high descent rate after passing the SHEED waypoint.
When checking the flight management system, the first officer did not detect that the runway threshold crossing altitude had been entered into the runway extension waypoint, missing the opportunity to prevent the unintended approach path and resulting high descent rate after passing the SHEED waypoint.
After passing the SHEED waypoint, the captain's attention became focused on the high rate of descent instead of monitoring external flight path cues as part of the visual approach, causing the first officer to shift their attention to the external cues and leading to a delayed recognition and response to the aircraft's position below the intended approach path.
Other factors that increased risk
The flight crew were probably experiencing a level of fatigue known to have a demonstrated effect on performance.
The presentation of the runway 34 visual approach procedure in the operator's Route and Airport Information Manual increased the potential for the runway threshold crossing altitude to be entered into the runway extension waypoint. [Safety issue]
Safety analysis
Introduction
Data input errors when programming a flight management system (FMS) are not uncommon (PARC/CAST Flight Deck Automation Working Group 2013). They are usually detected by the flight crew before there is any effect on the aircraft’s flight path or performance. On rare occasions, programming errors can lead to problems with the aircraft’s flight path or performance,[18] and on very rare occasions contribute to aircraft accidents.[19]
Although data-entry error has the potential to become a hazard to flight safety, the risk associated with the high descent rate on the occurrence flight was minimal given the approach was in visual conditions and the crew were not experiencing any significant workload or other difficulties.
This analysis examines the various human performance factors identified during the investigation as having influenced the flight crew’s actions and ability to detect the erroneous data.
Data input error and error detection
During the entry of the visual approach into the FMS, the captain inadvertently entered the runway threshold crossing altitude of runway threshold elevation + 50 ft into runway extension waypoint RX34, instead of into the intended RW34. RW34 corresponded with the runway threshold. This resulted in the aircraft descending after SHEED to meet this erroneous waypoint altitude constraint, which was 2.8 NM or about 5 km from the runway threshold and therefore necessitated a higher than normal descent rate to achieve the RX34 altitude constraint as set.
The erroneous entry of the runway threshold crossing altitude at the RX34 waypoint was almost certainly a skill-based error known as a ‘slip’, which is an error in the execution of an action (Reason 1990). Skill-based actions are those which have become so rehearsed and automatic that the individual does not need to closely monitor each stage of the action sequence in the way that they would if the task was less familiar or unknown. Due to this reduced monitoring, the individual will generally not realise that they have carried out an incorrect action until it is either too late to change, or there has already been an unforeseen consequence.
An observational study of airline operations examining error detection and recovery noted that ‘less than half the errors committed by crew were actually detected’ (Thomas, Petrilli and Dawson 2004). A number of factors may have increased the likelihood of the crew not detecting the error on this occasion.
The captain reported that the cruise relief first officer (FO) conducted a crosscheck of the FMS data, but did not ‘validate’ the data against the approach chart or Route and Airport Information Manual. This check was intended to be a gross error check only, and the operational FO was expected to check and validate the data upon their return from a break in the flight crew rest compartment. However, the operational flight crew’s checks may have been degraded because they unintentionally and unconsciously felt that this crosscheck would have detected any error in the data. Although not intended as a formal validation of the data input by the captain, this gross error check by the cruise relief FO was an opportunity for the error to have been identified.
The operational FO had just returned from a rest break and was not expecting to conduct a visual approach. The FO initially questioned the decision to conduct a visual approach, primarily because it required a level of precision which added complexity at the end of a 15-hour flight. However, the captain explained that they had conducted this approach in the simulator and had flown one during line operations. Together with the FO’s perception of the captain’s experience and reputation, this made the FO comfortable enough to accept the captain’s decision to conduct a visual approach.
On review of the FMS, the operational FO identified that, contrary to their expectation, the glide path angle was not displayed. The FO queried this with the captain. While this issue was quickly resolved, it is possible that exploring this issue distracted the FO from the check. The FO recalled checking the Route and Airport Information Manual and that the runway threshold crossing altitude was in the FMS. Regardless, the erroneous position of that altitude was not detected. Although the ATSB was not able to precisely determine what led to the erroneous data entry not being detected, a number of factors were identified that may have influenced the non-detection.
The operator’s Route and Airport Information Manual contained guidance on conducting a visual approach to runway 34 via the SHEED waypoint. The presentation of this information as a sentence that was broken over a number of lines was such that it was possible to associate the words ‘and altitude 0380’ with the runway extension waypoint (RX34), rather than the intended runway threshold waypoint (RW34). This increased the potential for this incorrect altitude to be entered against RX34, rather than the ‘“hard” altitude’ of 1,270 ft as recommended in the Virgin briefing paper.
The possible association of the altitude of 380 ft with RX34 was not the intention of the guidance, nor the deliberate action of the flight crew on this occasion. However, the ATSB noted that if the crew had been able to directly compare the altitudes in the FMS with the associated waypoint in a more graphical presentation, such as the table presented in the Briefing Paper and the accompanying expanded flight management computer configuration information (Figure 8), the probability of detecting the error would have been increased. This would have resulted from the crew’s improved awareness of the three altitudes to check (SHEED, RX34 and RW34), and their ability to individually check each against the appropriate waypoint.
Previous data entry error occurrences have highlighted the role of expectancy in influencing flight crew error detection. On this occasion, the similarity of the waypoint names RW34 and RX34 increased the likelihood that the crew could misinterpret one waypoint for the other when entering and/or checking the data.
The high descent rate after the aircraft passed the SHEED waypoint was initially identified by the operational FO. The captain believed that this was a normal aircraft response (as confirmed by the ATSB in the operator’s simulator) and that the descent would stabilise at a lower rate. When it did not stabilise as expected, the captain’s attention became focused on monitoring the rate of descent on the aircraft’s instruments instead of including in their scan the external flight path cues necessary for conducting a visual approach. Noting the captain’s change of focus, the FO changed attention from monitoring the approach on the aircraft instruments to monitoring the external visual cues. This led to a delayed recognition of, and reaction to, the aircraft’s descent below the intended approach path. It was not until the FO alerted the captain to the approach appearing to be too low, that the result of the descent rate was identified, and action taken by the captain to regain the correct approach profile.
Crew fatigue
The International Civil Aviation Organization (ICAO 2011) defined fatigue as:
A physiological state of reduced mental or physical performance capability resulting from sleep loss or extended wakefulness, circadian phase, or workload (mental and/or physical activity) that can impair a crew member’s alertness and ability to safely operate an aircraft or perform safety related duties.
Fatigue can have a range of adverse influences on human performance. These include slowed reaction time, decreased work efficiency, reduced motivational drive and increased variability in work performance, lapses or errors of omission (Battelle Memorial Institute 1998).
While research indicates that less than 6 hours sleep in the previous 24 hours can increase risk (Thomas and Ferguson 2010), the captain had about 10 hours sleep in the 24 hours prior to departure and the operational FO had about 12 and a half hours. In addition, the flight crew reported obtaining adequate ‘good quality’ sleep during the layover in Los Angeles and feeling well rested at the commencement of the flight. However, the effect of extended wakefulness for both crew and workload due to training duties for the FO meant that both crew were probably experiencing a level of fatigue known to have a detrimental effect on performance.
A fatigue risk management system (FRMS) is designed to manage the fatigue risk associated with operations, including long-haul flights. However, it is not designed eliminate fatigue, such as that experienced by the flight crew. Rather, the FRMS sits within a broader safety management system, which seeks to mitigate the effects of fatigue on performance. In this instance, selection of an instrument approach would have been an example of a mitigation to the fatigue of the crew, rather than conducting the visual approach via SHEED.
The types of errors made by the crew, the slip and then the non-detection of the incorrect waypoint RX34 altitude constraint, are broadly consistent with the effects of fatigue. However as discussed above, there are other possible influences on the development and non-detection of the error and, as such, it is difficult to conclude that fatigue actually contributed to the error and lack of detection on this occasion.
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Guidance material
The presentation of the runway 34 visual approach in the operator's Route and Airport Information Manual increased the risk of the runway threshold crossing altitude being entered into the runway extension waypoint.
The sources of information during the investigation included:
Virgin Australia International Airlines (Virgin)
the primary flight crew
the Bureau of Meteorology
the Civil Aviation Safety Authority (CASA).
References
Battelle Memorial Institute 1998, An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, US Federal Aviation Administration.
International Civil Aviation Organization 2011, Fatigue risk management systems (FRMS): Implementation guide for operators, 1st edition.
Performance-based operations Aviation Rulemaking Committee/Commercial Aviation Safety Team Flight Deck Automation Working Group 2013, Operational use of flight path management systems. Available from www.faa.gov.
Reason, J 1990, Human Error, Cambridge University Press, Cambridge, United Kingdom.
Thomas, MJW & Ferguson, SA 2010, ‘Prior sleep, prior wake, and crew performance during normal flight operations’, Aviation, Space, and Environmental Medicine, vol. 81, pp. 665–670.
Thomas, MJW, Petrilli, RM & Dawson, D 2004, ‘An exploratory study of error detection processes during normal line operations’, Proceedings of the 26th conference of the European Association for Aviation Psychology, Lisbon, Portugal.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the primary flight crew, Virgin, Boeing and CASA.
Submissions were received from the primary flight crew, Boeing and Virgin. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
The occurrence
On 15 August 2013, a Boeing 777-3ZGER (B777), registered VH-VPF and operated by Virgin Australia International Airlines (Virgin), was on a scheduled flight from Los Angeles, United States to Melbourne, Victoria with 17 crew[1] and 272 passengers on board. The flight was cleared for an approach and landing on runway 34 at Melbourne Airport via the LIZZI SEVEN VICTOR (LIZZI 7V) standard arrival route (STAR) via the MAITE, IGPON, MONTY, EGEKA and SHEED waypoints (Figure 1). The captain was the pilot flying and the first officer (FO) was the pilot monitoring the approach.
Figure 1: Aeronautical chart for Melbourne LIZZI 7 STAR
Source: Virgin
During the STAR, the aircraft was fully configured for the final approach with the landing gear down and landing flaps set. The autopilot was engaged in both vertical and lateral navigation modes.[2] At about 0810 Eastern Standard Time,[3] after passing waypoint SHEED,[4] the final waypoint in the STAR, the autopilot increased the rate of descent from about 700 ft/min to about 1,500 ft/min. This was greater than the crew were expecting and the FO alerted the captain to the high descent rate. As the captain expected it to reduce and stabilise at the anticipated rate, they decided to continue the approach and monitor the aircraft’s rate of descent.
Noting that the captain was concentrating on the information presented on the aircraft’s flight instruments, the FO turned their attention outside of the cockpit to visually monitor the approach to the runway, which they had sighted to the right of the aircraft. The FO noted that the approach appeared to be too low and alerted the captain, who agreed and attempted to reduce the rate of descent by engaging the vertical speed mode of the autopilot flight director system. The captain then disconnected the autopilot and took manual control of the aircraft. The aircraft was levelled off at about 700 ft above mean sea level (AMSL), or about 500 ft above ground level, and turned to the right to align with the runway. The FO alerted the captain to the precision approach path indicator (PAPI)[5], which was showing four red lights, indicating that they were well below the correct glide path.
The aircraft was flown level until re-established on the correct glide path for a normal approach and landing. Figure 2 shows the aircraft’s flight path during the approach and landing.
Figure 2: Approach flight path into Melbourne Airport
Source: Google earth, modified by the ATSB
Preparation for the approach
Prior to descent into Melbourne, while the FO was on a rest break in the flight crew rest compartment, the captain decided that, although runway 27 was the active runway for arrivals, they would land on runway 34. The captain reported that this decision was based on the increased landing distance available with runway 34 and on more favourable crosswind conditions for the landing. A number of routes were available for the approach and landing on runway 34, including a visual approach, which the captain elected to conduct via the LIZZI 7V STAR.
In accordance with Virgin standard operating procedures, as the pilot flying, the captain selected the runway 34 waypoint (RW34)[6] from the database in the aircraft’s flight management system (FMS) and the LIZZI 7V STAR from the available approach options for that runway. The LIZZI 7V STAR ended at the SHEED waypoint, which is not aligned with the runway 34 centreline. This meant that connecting the flight plan directly from SHEED to RW34 (representing the runway threshold) would have resulted in a final approach that did not track along the runway centre-line. To account for this and more appropriately align the final approach with the runway centre-line, the captain used a feature in the FMS that produced an additional waypoint (labelled RX34) that was offset back along an extended runway centre-line.
The target altitude for RX34 was automatically calculated by the FMS based upon the position and altitudes of the RW34 and SHEED waypoints. In accordance with the advice in the Virgin Route and Airport Information Manual,[7] the captain entered a runway extension of 2.8 NM (about 5 km) into the FMS, which created RX34 (see the section titled Briefing paper). They also intended to amend the altitude of the RW34 waypoint to 380 ft as per the recommendation in the manual, although the altitude was inadvertently entered into RX34 rather than RW34.
The captain reported that the cruise relief FO, who had replaced the FO during their rest break and was occupying the right seat at the time, checked the information that was entered into the FMS before the flight plan was activated. The captain also reported not specifically requesting the cruise relief FO to validate the data entered into the FMS.[8]
When the FO returned to the flight deck after their rest break, and as part of the before descent checks, they checked and validated the arrival and approach data entered into the FMS. The FO reported some confusion during those checks as a result of noticing that the FMS did not present the expected glide path angle for the final legs of the approach. The FO queried this with the captain, who informed the FO that the FMS did not present that information for a manually constructed approach. The FO accepted this explanation and continued with the before descent checks. The FO recalled reviewing the Route and Airport Information Manual during the checks and checking that the altitude value of 380 ft was correct, but did not identify that the altitude had been entered into RX34 rather than the intended RW34.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 15 August 2013, at about 1130 Eastern Standard Time, the pilot of a Bell 47G helicopter, registered VH-RTO, was returning to Essendon, Victoria. The pilot was instructed by air traffic control (ATC) to conduct one orbit due to traffic in the area. After completing the orbit, ATC further instructed the pilot to conduct a second orbit.
While maintaining 1,400 ft above mean sea level (AMSL), the second orbit was commenced. Shortly after, the helicopter began to vibrate severely, yaw from side to side in an oscillating motion, and the rotor revolutions per minute (RRPM) decreased. In response, the pilot lowered the collective in attempt to increase the RRPM, rolled on throttle, and manipulated the anti-torque pedals to counteract the yaw. However, the intensity of the vibrations increased, and the oscillating yaw continued.
The pilot continued to manipulate the controls; however, as the helicopter was unable to maintain altitude and RRPM, he elected to conduct an autorotation. The pilot observed a park to his left and broadcast a ‘MAYDAY’ call.
With some power remaining, the helicopter landed in the park with nil injuries or damage sustained.
An engineering inspection identified that a spring in the distributor block of the left magneto was missing, which resulted in cross firing in the distributor and an associated loss of power.
A partial engine power loss presents a more complex situation to the pilot than a complete power loss. This incident highlights the importance of making timely decisions when a situation develops and the benefits of landing as soon as possible, before the situation deteriorates further.
On 2 August 2013, at 1400 Eastern Standard Time, the student of a Cessna 172R aircraft, registered VH‑IMS (IMS), conducted a solo navigation flight from Archerfield to Sunshine Coast via Caboolture, Queensland. After landing at Sunshine Coast Airport, the student taxied the aircraft to the general aviation apron.
Other aircraft were operating in the area and the pilot wanted to ensure he remained clear of them. The pilot noted a fence and power pole on his left, and then focused on an aircraft taxiing in front of IMS. While the pilot was watching the other aircraft taxiing, he advised that IMS may have rolled forward unnoticed. When the pilot commenced a right turn, the aircraft was past the end of the fence and as he turned the aircraft, the left wing collided with a power pole.
The pilot reported that he had learnt a valuable lesson from the accident, in that the flight is not over until the aircraft has been shut down and secured. This incident also highlights the need to keep a good look out during taxi as well as in flight.
On 24 July 2013, the pilot of a Cessna 404 aircraft, registered VH-HVR, was preparing for a charter flight from Darwin to the Pigeon Hole aeroplane landing area (ALA), Northern Territory.
The pilot used the operator’s electronic flight planning system to generate the flight plan, which also provided coordinates for the ALA and stated that the runway direction was 18/36. The coordinates for the ALA had been previously entered into the GPS, which was to be used throughout the flight for navigation assistance.
When at 5 NM, on final approach to Pigeon Hole, the pilot noticed that the runway surface appeared overgrown with vegetation. The pilot configured the aircraft for landing. At about 300 ft above ground level, the pilot noted that there were no runway strip markers or windsock. The pilot then realised that the airstrip was closed, but due to the aircraft’s altitude, elected to continue the landing. During the landing, the aircraft struck vegetation, but the pilot did not believe the aircraft had collided with anything.
After landing, the pilot assessed the situation and elected to take off. During the take-off, the pilot confirmed that the engines were operating normally and after becoming airborne, observed the correct ALA about 2 km south-west of the Pigeon Hole Township.
The aircraft landed there without further incident. Minor damage had been sustained to the leading edge of the right wing and propeller.
This incident highlights the importance of reviewing all available information appropriate to the intended operation, including the condition and suitability of the selected landing area/s, and ensuring that operational documents are current. It also demonstrates the benefits of overflying an airstrip to assist with determining the suitability of the landing area and the need to be go-around prepared and go-around minded.
On 10 August 2013, an Airbus A320-232, registered VH-VGR (VGR) and operated by Jetstar Airways Pty Ltd was holding short of gate D2 at Melbourne Airport, Victoria. At the same time, a Boeing B737-800, registered VH-YID (YID) and operated by Virgin Australia Airlines Pty Ltd. (Virgin) was approved by air traffic control for a pushback from bay E1 once VGR was on the gate at bay D2. The dispatcher for YID assessed VGR was on the gate and commenced the pushback. During the pushback, the left wingtip of YID collided with the tail cone of VGR, damaging both aircraft. There were no injuries.
What the ATSB found
The ATSB found that the dispatcher for YID could not visually confirm the position of VGR relative to gate D2 and assessed that because the aircraft hadn’t moved, it was on the gate. The pushback ground staff followed the normal practice for a pushback from bay E1. However, this practice did not allow for visual monitoring of the left side of the aircraft, such as by using a wing walker. This meant it was not possible for the dispatcher to identify the collision risk in time to prevent the collision.
What's been done as a result
Virgin advised that following this occurrence, they issued a local instruction to ground staff, mandating the use of wing walkers from certain bays at Melbourne Airport, including bay E1.
Safety message
This occurrence highlights the importance of ensuring that adequate clearance exists prior to commencing pushback. This includes using sufficient personnel to ensure visibility of each side of the aircraft at all times.
Findings
From the evidence available, the following findings are made with respect to the collision during pushback between Boeing B737-8FE, registered VH-YID, and Airbus A320‑232, registered VH‑VGR, at Melbourne Airport, Victoria on 10 August 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The dispatcher of the B737 could not visually confirm the position of the A320 relative to its assigned gate and incorrectly assessed that, as the aircraft was stationary, it was at the gate.
The pushback of the B737 was commenced with insufficient clearance from the A320, which was not identified prior to the collision as the dispatcher's position to the right-front of the B737 prevented observation of its left wing.
Appendices
The occurrence
On 10 August 2013, Airbus A320, registered VH-VGR (VGR) and operated by Jetstar Airways Pty Ltd (Jetstar), was flown from Sydney, New South Wales to Melbourne, Victoria. Upon arrival, the crew of VGR were cleared by the air traffic control surface movement controller (ground controller) to taxi to gate D2.
At 0930 Eastern Standard Time[1], VGR entered the apron en route to gate D2, when a Boeing B737-800, registered VH-YID (YID), requested pushback approval from gate E1 (Figure 1). YID was being operated by Virgin Australia Airlines Pty Ltd. on a flight to Maroochydore, Queensland. The controller advised the crew of YID that a Jetstar A320 was entering the apron behind them for bay D2 and that when that traffic was ‘on the gate’[2], pushback from bay E1 was approved.
The flight crew of YID reported that they saw VGR (the Jetstar A320) pass behind them from the reflection in the terminal window in front of their parked aircraft. The captain of YID relayed the pushback approval to the dispatcher, including that it could only commence once the A320 was on the gate. The dispatcher was standing to the right of the aircraft’s nose.
At 0931:34, as VGR approached the gate on bay D2, the automatic nose-in guidance system (NIGS) displayed a message ‘STOP-WAIT’. In response the flight crew stopped the aircraft short of the gate. The dispatcher on YID reported looking under the aircraft and observing that VGR was stopped. The dispatcher reported then waiting for about 15–20 seconds to confirm the aircraft remained stationary. As it did, the dispatcher was satisfied that VGR was on the gate and the pushback of YID could commence. Pushback began at 0931:46.
At 0931:58, the crew of VGR transmitted to the controller that they were holding short of the bay because of the NIGS. However, that message was over‑transmitted by another aircraft. Forty seconds later, the crew re‑transmitted the same message. The message was acknowledged by the controller, who requested to be advised when the aircraft was at the gate.
Neither the crew of VGR nor the controller mentioned the gate number during the transmissions. The crew of YID later reported they did not hear these transmissions.
At 0933:03, the left wingtip of YID contacted the tail cone of VGR immediately aft of the operating auxiliary power unit. The tail cone of VGR immediately aft of the auxiliary power unit separated from the aircraft and fell to the ground. The left wingtip of YID was damaged during the collision.
Following the collision, YID was towed back to gate E1 and VGR was marshalled to gate D2.
There were no injuries as a result of the collision.
Figure 1: Position of A320 VGR (in green), holding short of gate D2, and B737 YID (in grey) during pushback from Bay E1 at the time of the collision. The position of the dispatcher and tug for YID are also shown
The collision between the two aircraft occurred when the B737, VH-YID (YID) was being pushed back from gate E1. At that time the A320, VH-VGR (VGR) was holding short of gate D2 due to a STOP-WAIT indication from the guidance system. The following analysis will examine the factors leading to the collision.
Pushback approval and commencement
The ground controller issued a pushback approval to YID that required VGR to be on gate D2 before commencement. While this was accurately conveyed to the dispatcher by the captain of YID, from the dispatcher’s position at the front-right of YID, there were insufficient visual cues for the dispatcher to accurately determine that VGR had stopped at gate D2. While VGR was actually holding short of the gate, the dispatcher formed the opinion that the aircraft was on the gate based on the observation that it had been stationary for a period of time. This was consistent with their experience and as a result, they did not move to a position from where they could accurately assess VGR’s location.
After observing that VGR was stationary for a period of time, the dispatcher signalled the pushback driver to commence YID’s pushback. From the dispatcher’s walking position, it was not possible to see the clearance lines for bay D2 marked on the apron. It was also not possible for the dispatcher to see VGR’s fuselage or its position in relation to the gate. From the dispatcher’s perspective, YID obscured most of VGR. The operator’s standard operating procedures required the dispatcher to have ‘clear visibility of the aircraft wingtips or wing walkers and potential obstructions at all times’.
As was reported to be normal practice, a wing walker was not used in this case for a pushback from bay E1. In the absence of a wing walker, the dispatcher was not able to ensure the aircraft would not collide with potential obstructions during the pushback as there was no visibility of the left side of YID. Following this occurrence, Virgin Australia Airlines Pty Ltd. provided a local instruction to Melbourne Airport ground staff that stipulated the gates that required the presence of a wing walker prior to push back. Gate E1 was included in that list of gates.
Communication
The flight crew of YID did not recall hearing the transmissions between VGR and the ground controller. There were a number of factors that may have affected the crew being alerted by the communication:
the surface movement control radio frequency was very congested in the time leading up to the occurrence, being in use for about 96 per cent of the time
during the 2 minutes and 20 seconds between issuing pushback approval and the collision, the ground controller participated in sequences of transmissions between seven different aircraft and one ground tug
VGR’s transmissions were abbreviated and fast, likely as a result of the frequency congestion discussed above
VGR’s crew did not mention the gate number in their holding short transmission, nor were they required to as it was included in the ground controller’s initial contact with the crew
the pilots’ expectation that in the radio environment, messages would be directly addressed between the controller and a specific aircraft, and not broadcast generally. Pilots will therefore pay more attention to transmissions directed to their aircraft.
Given these factors, it is not reasonable to expect that the transmission from VGR could have alerted the crew of YID to the collision risk. In addition, in the lead up to the collision, the crew of VGR were communicating with their company to resolve the issue with the nose‑in guidance system at the gate. This limited their ability to identify and therefore react to the collision risk.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the flight crew of YID and VGR
the dispatch ground staff for YID
recorded data from both aircraft
recorded data from Melbourne Airport
Virgin Australia Airlines Pty Ltd. (Virgin)
Airservices Australia.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Airservices Australia, flight crew and ground staff from Virgin, flight crew from Jetstar Airways Pty Ltd and the Civil Aviation Safety Authority.
Submissions were received from the captain of VGR, the dispatcher of YID and Virgin. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Context
Communications
During the pushback from Bay E1, the dispatcher of YID communicated with the aircraft captain via a headset that was plugged into the nose of the aircraft on the first officer’s (FO) (right) side. The dispatcher communicated with the tug driver by hand signal.
When the ground controller issued the conditional approval for a pushback to the crew of YID, it was acknowledged by the FO. The captain heard the transmission and relayed it to the dispatcher. In turn, once the dispatcher was satisfied of VGR’s location at Bay D2, they communicated the commencement of the pushback to the tug driver using hand signals.
The surface movement control radio frequency was used for communication between the ground controller and aircraft. This frequency was not normally used for direct communication between aircraft. During this period, the crew of YID were also monitoring other communication channels, including the cabin interphone, the company radio frequency and the dispatcher.
When VGR had to hold short of the gate at bay D2, the flight crew notified the ground controller. While not required to do so, this displayed good judgement and communication in an effort to ensure a common understanding of their situation.
Aerodrome information
Control of aircraft during airport ground operations
While flight crew need a clearance from the ground controller to be allowed to move their aircraft on the apron, responsibility for separation between a moving aircraft and any obstacles rests with the flight crew and supporting company staff (see Appendix A).
There are taxi lines marked for aircraft to follow when entering or departing from any bay/gate. Guidance lines also show pushback limits and where to disconnect from a tug after a pushback.
Clearance lines indicate the limit of an area on the apron where an aircraft may park and, once located ‘on the gate’, be assured of adequate clearance. An aircraft holding short of a designated gate may not be wholly beyond the clearance line and may therefore present a collision risk.
Nose-in guidance system
A nose-in guidance system (NIGS) is an automatic system for accurately guiding aircraft to the gate. The NIGS at bay D2 had a function that identified the shape of an approaching aircraft. Using this feature, the NIGS only provided guidance to the specific aircraft type that was programmed into the NIGS at that time.
If the NIGS did not identify an approaching aircraft as the correct type, it would not provide guidance. Instead, it would display a message ‘STOP-WAIT’ when the aircraft was about 20 m short of the gate.
Recorded information
Recorded flight data was obtained from both aircraft. The cockpit voice recording was available from VGR; however, the recorded audio from YID had been overwritten.
Audio recordings of the surface movement control radio frequency and data from the surface movement radar were also obtained.
Wreckage and impact information
The left wingtip of YID was damaged during the collision (Figure 2).
Figure 2: Damage to the left wingtip of YID
Source: ATSB
The tail cone of VGR aft of the auxiliary power unit (APU) and the APU exhaust duct separated from the aircraft (Figure 3). The bulkhead aft of the APU was buckled and there was also minor localised damage to the external skin.
Figure 3: Damage to the tail cone of VGR aft of the APU, looking from left to right of the aircraft
Source: ATSB
No other damage was identified on either aircraft.
Pushback procedures
Dispatcher
Under Virgin Australia Airlines Pty Ltd. (Virgin) operating procedures, the dispatcher was responsible for the guidance of the aircraft and for the avoidance of obstructions when the aircraft was under tow. They were responsible from the time that voice communications were first established with the cockpit, until the flight crew indicated the aircraft was clear to start taxiing under its own power.
The standard operating procedures stated:
The aircraft dispatcher is to stand in a position that gives clear visibility of aircraft wingtips or wing walkers and potential obstructions at all times.
From the dispatcher’s position to the front-right of YID on the day of the occurrence, it was not possible to see the left side of the aircraft during the pushback (Figure 4). During the ATSB’s observation of operations at Bay E1 the following day, it was similarly noted that the dispatcher’s position meant that the dispatcher could not see the left side of the aircraft (Figure 5).
Figure 4: Screenshot of YID during pushback,5 seconds before thecollisionwith VGR and showing the position of the tug and the dispatcher
Source: Melbourne Airport, modified by the ATSB
Figure 5: Pushback of the same Virgin flight from bay E1 on the next day
Source: ATSB
Once YID was pushed back from bay E1 on the day of the occurrence, it was turned slightly ‘tail left’ from the pushback driver’s point of view. The geometry of the aircraft and the tug meant the pushback driver was positioned well to the right of the aircraft’s nose. The dispatcher reported they could not safely change from one side of the aircraft to the other while the aircraft was moving. However, the dispatcher could walk on the side that gave a bigger field of view during any expected turn. In this occurrence, the dispatcher could have walked on the left side of the aircraft during the pushback.
The dispatcher reported that it was normal practice to walk on the side of the aircraft where the headset sockets were located, which for the 737 was the right side. The dispatcher reported they had never walked on the other side of the aircraft during a pushback before. It was also reported as being normal for the 737 to be pushed back from bay E1 without using a wing walker. This meant that normally only one wingtip could be monitored visually during pushback.
Before starting a pushback, dispatchers normally visually assessed the area for potential obstacles behind the aircraft. In this occurrence, the dispatcher did this by looking under and around the engines.
Pushback driver
The pushback driver reported that their attention was focussed on controlling the aircraft and the tug. As such, they were not concentrating on any collision potential during the pushback.
Wing walkers
The dispatcher was required to use a wing walker if they did not have clear visibility of the aircraft wingtips.
If a wing walker was used, the wing walker was responsible for monitoring the wingtip and tail clearances on that side of the aircraft.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 11 July 2013, a Sikorsky S-76C helicopter, registered VH-EXU, departed the heliport at Longford, Victoria on the first of a series of passenger ferry flights to a number of offshore platforms that were located throughout the Bass Strait oil and gas fields.
On departure from the Snapper platform for a return to Longford, the right engine failed. The helicopter descended rapidly toward the surface of the water.
The crew controlled the helicopter and secured the failed engine. In addition, in response to a right engine fire warning, the crew discharged fire extinguisher agent into the right engine compartment. A positive rate of climb was established and the helicopter was flown away before being escorted back to Longford by other company helicopters for a single-engine landing.
What the ATSB found
The engine failure was attributed to the fracture of a second-stage, high-pressure turbine blade. The liberated blade impacted and damaged adjacent blades with the resulting loss of power and associated increased vibration.
The engine and failed blade structure were inspected by the engine manufacturer. The manufacturer concluded that the failure was due to a combination of metal fatigue, blade creep and oxidation deposits. While a definitive cause for the blade fracture has yet to be determined, blade material, dimensional and quality assurance checks have ruled out any deficiencies.
In the absence of published data from the helicopter manufacturer, the operator had established helideck flight departure and approach profiles consistent with the performance capabilities of the helicopter. In this case, the lift-off from the helideck followed the operator’s standard departure profile. Given this profile, the helicopter descended to within 30 ft (9 m) of the sea surface during the recovery to stabilised flight.
What's been done as a result
In the absence of a conclusive cause of the blade fracture and remedial information, the operator imposed a service life limitation on their helicopters’ engine turbine assemblies that were fitted with the same blades. In addition, the engine manufacturer issued notifications to operators and introduced specific inspection requirements relevant to potentially affected turbine assemblies.
At the time of writing, the engine manufacturer was continuing its investigation into the cause of the blade fracture.
Safety message
This occurrence highlights how a situation can quickly change from normal operations to one where the flight crew have to deal with an in-flight emergency. In this respect, effective crew interaction, thorough pre-briefing and anticipation of what can go wrong has been shown to increase the likelihood of a successful outcome. Recovery from the engine failure and potential ditching, and return of the helicopter to Longford, reaffirms the benefits of those preparatory actions.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the flight crew of VH-EXU
the helicopter operator
Safran SA Turbomeca
the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew of VH-EXU, the helicopter operator, Safran SA Turbomeca, the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile and the Civil Aviation Safety Authority.
Submissions were received from the helicopter operator, Safran SA Turbomeca and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Context
Pilot information
Qualifications, experience and training
Both pilots held an Airline Transport Pilot Licence (Helicopter), an endorsement on the Sikorsky S‑76C (S-76C) helicopter and a valid Class 1 Aviation Medical Certificate. Both were designated by the operator as captains of the S76C helicopter type.
The captain of the helicopter, the more senior of the two pilots that day, was seated in the right seat. The copilot was seated in the left seat and maintained control of VH-EXU (EXU) throughout the emergency and return to the Longford heliport.
The operator maintained a training and checking organisation to manage aircrew flight competency with checks conducted on a 6-monthly basis. These checks included pilot response to a single-engine failure on reaching the take-off committed point. Examination of the pilots’ most recent training records showed that both had passed all of their competency checks.
The operator’s pilots were also required to complete S-76C simulator endorsement training. The copilot commented that the emergency training in the simulator and during their competency checks was invaluable in identifying and managing the engine failure on departure from Snapper platform.
The relevant aeronautical experience of the flight crew is outlined in Table 1 and Table 2.
Table 1: Copilot's aeronautical experience and relevant training
The S-76C is a four-blade, twin-engine, transport category helicopter capable of carrying two flight crew and up to 12 passengers (Figure 2). It is often used for offshore oilfield support due to its long range.
EXU was manufactured in the United States in 1995 and first registered in Australia on 21 July 1995. It had accumulated 13,084 hours total time in service and 73,192 landings at the time of the engine failure. In the event of a ditching, EXU was equipped with:
As EXU was operated in the private category, a flight data recorder was not fitted, nor was it required by regulation. The operator had installed an aftermarket condition monitoring system that recorded vibration data of critical components including the main and tail rotors, rotor drive systems and engines.
Figure 2: Sikorsky S-76C
Source: Helicopter operator
Engine information
EXU was powered by two Safran SA Turbomeca (Turbomeca) Arriel 1S1 turboshaft engines located above and to the rear of the passenger compartment. These engines consist of five modules, with the gas generator (GG) turbine located in Module 3.
Examination of the engine records for the right engine in EXU showed that Module 3 had accumulated 2,275 hours in service and 2,664 cycles since the last overhaul.
Turbomeca service bulletin (SB) 292 72 0151 was issued in June 1992 and specified the incorporation of modification TU-204 across all variants of the Arriel engine. This modification involved corrosion and erosion protection of the second stage, GG high pressure (HP2) turbine blades via application of a low-pressure plasma coating. Modification TU-204 was incorporated in Arriel 1S1 engines at manufacture.
Following reports of several uncommanded in-flight engine shutdowns attributed to HP2 turbine blade failures, the engine manufacturer implemented internal documentation and procedures to remove all TU-204 HP2 turbine blades during overhaul of Module 3. Consequently, SB 292 72 0151 was amended on 18 August 2000, to recommend removal of all TU-204 modified blades.
Subsequently, Turbomeca released SB 292 72 0347, effective from July 2008, which referenced the incorporation of modification TU‑347. This modification incorporated a redesigned HP2 turbine that was in accordance with the latest design standards.
The changes to the GG high pressure HP2 turbine as a result of the incorporation of TU-347 are illustrated in Figure 3 and include:
an increased turbine disc thickness
changes in the design of the blade locking system, fir tree root and blade
changes in the turbine disc materials
the addition of a damper device between the blade base and turbine disc.
Figure 3: TU-347 detail
Source: Turbomeca, modified by the ATSB
The HP2 turbine of the right engine in EXU had TU-347 incorporated when the Module 3 was last overhauled.
Airworthiness directive AD 2009-0236R1 was issued in November 2009 and required repetitive inspections to be carried out on the HP2 turbine in Arriel engines. Incorporation of SB 292 72 0347 terminated the requirements of the airworthiness directive.
Examination of the right (failed) engine
The failed right engine was removed from EXU and shipped to the engine manufacturer’s facility in Sydney, New South Wales where it was partially disassembled under the supervision of the ATSB. Module 3 of the engine and the oil pump assembly were subsequently transported to the engine manufacturer’s facilities in France. Here, the engine and oil pump were inspected under the supervision of the French aviation investigation agency, the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile.
The examination of Module 3 revealed significant damage in the turbine area. This included fracture of the No. 26 blade of the GG high pressure turbine assembly second stage wheel (HP2) with resulting impact damage to, and loss of material from a number of adjacent blades. The GG turbine rear bearing also exhibited signs of significant damage associated with heavy rubbing on the races and flattening of the bearing rollers.
Examination of the failed blade by the engine manufacturer revealed a fracture resulting from a combination of static and dynamic stresses associated with bending loads during operation. The fracture occurred on the aerofoil section about 6 mm above the platform.
Inspection of the fracture surface revealed two distinct regions nominated as area A and area B. Area B included the leading edge and accounted for approximately 83 per cent of the fracture surface. Area A included the trailing edge and covered the remaining 17 per cent of the fracture surface (Figure 4).
The fracture surface was examined using a scanning electron microscope. In addition, metallurgical testing of blade No. 26 was conducted, along with blade No. 27 for comparative purposes.
The blade No. 26 area B fracture surface was typical of overstress and sudden fracture. Several isolated areas of fatigue crack propagation near the trailing edge of the blade (Area A) were noted; however, the origin could not be determined. There was no evidence of blade creep or sign of foreign object damage.
The blade No. 27 fracture surface was consistent with static overstress resulting from the impact of blade No. 26. This phenomenon also explained the damage observed on a number of the other blades. No significant metallurgical discrepancies were identified between the blades that were examined.
The fractured No. 26 blade and adjacent damaged blades are shown in Figure 5.
Figure 5: Blade No. 26 and damage to the adjacent blades
Source: Turbomeca, modified by the ATSB
Examination of the engine oil pump and apparent damage to the GG turbine rear bearing determined that any damage to those items was consistent with secondary damage associated with the blade fracture. The loss of the blade resulted in the unbalance and rapid deterioration in efficiency of the GG assembly, and a loss of engine power.
The internal rub marks on the rotating parts were a result of the unbalanced state combined with the natural modes of vibration encountered during the engine slowdown.
Right (failed) engine maintenance history
Aside from an early morning observation during the pre-take-off checks that the GG speeds were difficult to match for both engines, the crew reported that, up to the point when the right engine failed, there was no pre-indication of a significant abnormality. As was normal, an engine performance trend check was conducted prior to the first departure from Longford and no significant deviations were apparent.
Depending on the modification status of the engine, the manufacturer required the operator to perform a periodic inspection of the GG turbine rear bearing for clogging. The inspection involved measurement of the quantity of lubricating oil exiting from the rear bearing housing. If this quantity was less than the 50 ml specified in the maintenance manual, remedial action was necessary. Maintenance records for the right engine indicated that the oil flow checks were consistently within limits.
The operator’s system of maintenance for its Arriel engines specified that the measurement and recording of engine vibration data was to be conducted at 300- and 750-hour operating intervals. The data was recorded using an externally-mounted, calibrated instrument and sensor that recorded the vibration sample from the engine ‘rear point’, on the Module 3 external casing.
Examination of the rear point vibration recordings for the right engine found that they were below the maximum limits published by the engine manufacturer and were certified acceptable by the operator.
Due to the sampling rate periods of the aftermarket condition monitoring system, the engine operating parameters, including vibration levels, nearest to the time of the engine failure were not logged.
Recording and monitoring engine cycles
To ensure engine serviceability and monitor necessary service life limits of the engine’s rotating components, the engine manufacturer required operators to monitor and record engine operating cycles. The definition of a cycle varied with the rotating component and, in the case of the GG in the Arriel engine, complete[8] and partial[9] operating cycles were recorded.
The operator of EXU used a software program to record and monitor engine cycles. This required pilots to add relevant flight information based on sectors flown and their attendant engine power settings. The software program was designed to calculate the cycle particular to the rotating component and recorded the progressive cycle count. The results of the engine recording/monitoring were documented in the operator’s maintenance records.
An independent assessment of the operator’s methodology and cycle count totals was conducted by the engine manufacturer following the occurrence. The assessment concluded that the process and records were satisfactory.
Weight and balance
The S-76C has a maximum take-off weight of 5,307 kg (11,700 lb). The operator’s load sheets indicated that EXU had 590 kg (1,300 lb) of fuel on board at Longford prior to departure. With the weight of the fuel, the occupants and their equipment, the take-off weight at Longford was calculated to be 5,196 kg (11,455 lb), which was 111 kg (245 lb) below the maximum take-off weight.
The take-off weight of EXU at Snapper platform was estimated to be about 5,026 kg (11,080 lb), including about 286 kg (630 lb) of fuel for the flight back to Longford. The estimated take‑off weight was 281 kg (619 lb) below the maximum take-off weight and within the operator’s allowable weight restrictions given the ambient air temperature and pressure.
Meteorological information
The crew reported the conditions for the departure from Snapper platform as including a westerly wind of 5 kt (10 km/h), no visible cloud or adverse weather and an ambient temperature of 12 °C. The QNH[10] was reported as 1,034 hPa.
Platform/helideck operations
Snapper platform
Snapper platform is located approximately 40 NM (74 km) east of the Longford heliport and is one of a number of offshore oil and gas production platforms within the Bass Strait region.
Snapper platform was constructed with a helideck large enough to cater for two S-76C helicopters (Figure 6). The helideck is about 44 m (145 ft) above the sea surface and is constructed to provide an obstacle free zone when the correct take-off profile is flown.
Figure 6: Snapper platform and helideck, looking east
Source: Helicopter operator, modified by the ATSB
Helicopter performance
The operator’s fleet of S-76C helicopters was the primary means of transport for personnel working offshore, allowing the oilfield workforce to be ferried from Longford to the Bass Strait platforms, or transferred from one platform to another. The operator conducted over 4,000 S-76C flights per year in this role.
The operator conducted its flights in the S-76C in either of two multi‑engine helicopter performance categories:
Category A operations were those where, in the event of an engine failure, the helicopter had adequate performance to safely continue or reject the take-off or landing. In order to meet these criteria, a reduced take-off weight may be required. However, Category A operations could not be conducted from elevated platforms due to performance limitations.
Category B operations did not meet the operator’s Category A criteria. In the event of an engine failure during Category B operations, performance was available to enable the helicopter to safely continue the flight, except when the failure occured early in the take-off or late in the landing. In these cases, a forced landing may be required. The operator’s helicopter flights to the Bass Strait offshore platforms were conducted as Category B operations.
The operator’s Flying Operations Manual described a Category B departure profile employed for all helideck departures in the S-76C. In the course of the departure, a committed point is determined. This point is defined as the height above the helipad from which the helicopter can sustain an engine failure and continue the departure with one engine inoperative. If the take-off is rejected prior to the committed point, the helicopter is landed back on the platform.
The Category B departure profile requires the crew to establish the helicopter in a 5 ft (1.5 m) hover above the helideck before checking the available engine power. The pilot flying then climbs the helicopter vertically to at least 25 ft (7.5 m) above the helideck and confirms a minimum rate of climb of 200 ft/min passing through that height. The pilot flying makes a decision and ‘commits’ to continuing the departure. A rejected take-off will no longer be attempted. The pilot flying rotates the helicopter to a nose-down attitude of 15° and accelerates to the take-off safety speed while climbing to 250 ft above mean sea level. From this height, the helicopter is climbed at the best rate of climb speed.
In all cases, payload is offset against helicopter performance taking into account the ambient conditions and operational requirements.
Figure 7 provides a representation of the operator’s Category B departure from an offshore platform with all engines operating and an estimation of EXU’s profile following the engine failure.
Figure 7: Elevated helideck profile showing a representation of the operator’s Category B departure with all engines operating (in black) and an estimation of the departure profile for the occurrence flight (in red)
Source: ATSB
Operator activity
The operator’s activities were characterised by short-distance flights between offshore platforms and multiple flight sectors. Such operations result in engine cycle counts accumulating faster than operating hour limitations. An increased frequency of cycle-based maintenance results.
Engines are maintained in accordance with the engine manufacturer’s requirements with emphasis on engine operating cycle counting for service life tracking of critical rotating components. Engine rinsing was conducted at the end of the day’s flying, supplemented by periodic chemical cleaning of engine compressors and turbines as per the engine manufacturer’s requirements.
Related occurrences
Australian occurrences
The operator had three occurrences of HP2 blade failure between 1996 and 2001, all involving Arriel 1S1 engines. All were investigated by the ATSB and involved earlier-modification engines (pre TU-347) than those in EXU.
All of the ATSB investigation reports are available from the ATSB website.
On 9 September 1996, an S-76C helicopter experienced an in-flight engine failure of the right engine while taking off from an oil platform. A loud noise was heard before the engine failure. The right engine was shut down and the crew completed an uneventful single-engine return to the operator’s Longford base. There was no associated engine fire. The right engine was removed and sent to the manufacturer for disassembly and examination.
The manufacturer provided the operator with a final report noting the rupture (separation) of one GG turbine blade and subsequent rear bearing damage and GG seizure. The report stated that the separation was suspected to be the result of blade rubbing with the second stage nozzle guide vanes. There was no sign of fatigue as a factor, or abnormal over temperature operation of the engine.
On 7 February 2001, an S-76C helicopter with two crew and 10 passengers on board, was in a hover as the flight crew completed their before take-off checklist. The pilot reported that while trimming the engines, a ‘pop’ was heard. The left engine turbine gas temperature was noted in excess of 1,000 °C. The helicopter was landed uneventfully. The flight crew reported that the only other cockpit indication of a problem was the almost simultaneous illumination of the left engine chip (magnetic particle) detector advisory.
The manufacturer's final report noted a separation of the No. 6 turbine blade of the GG second stage disc. The blade separated above the ‘fir tree’ attachment point but below the blade platform, before puncturing the second stage nozzle guide vane turbine ring.
On 11 July 2001, an S-76C helicopter was in cruise flight with the automatic flight control system engaged, when the flight crew noted a loud noise and the helicopter yawed and rolled to the left and pitched nose-down. The right engine-out and fire‑warning annunciators illuminated and the engine-out aural warning sounded. The right engine GG RPM reduced to zero and extremely high turbine outlet temperature was indicated. The crew activated the right engine fire bottles and closed the fuel firewall shut-off valve before completing a single-engine landing at their base.
Disassembly and preliminary examination of the engine revealed the separation of one GG second stage turbine blade. Blade No. 16 was separated above the blade ‘fir tree’ attachment point but below the blade platform, and punctured the second stage nozzle guide vane turbine ring. The rear bearing of the GG had collapsed and was significantly damaged.
International occurrences
French Direction générale de l’aviation civile
The French Direction générale de l’aviation civile advised of a further three occurrences involving GG turbine blade failures. All occurred in earlier-modification engines (pre TU-347) than those in EXU.
Engine manufacturer
The engine manufacturer advised of four GG turbine blade failures in the second stage high pressure turbine of engines incorporating TU-347-modified turbine assemblies. This modification was incorporated in the engines in EXU.
The failures were attributed to foreign/domestic object damage[11] (two events) and an isolated failure associated with blade creep[12]. The fourth failure was attributed to a combination of blade creep and fatigue. Of the failures associated with blade creep or fatigue, oxidation was also present on the blade surfaces. All of the blade failures were isolated to individual blades with varying impact on engine operation. The blade failures did not result in in-flight engine shutdowns.
The engine manufacturer advised that since inception in July 2008, there were in excess of 2,400 modules in service with modification TU-347 incorporated and that the fleet had accumulated 4.1 million flight hours. Given the low number of failures, the risk of further failures can be considered to be low.
A review of a number of international accident databases was also conducted by the ATSB. This review showed no clear indication of TU-347-related engine issues or failures.
At 0730 Eastern Standard Time[1] on 11 July 2013, a Sikorsky S-76C helicopter, registered VH‑EXU (EXU), departed the operator’s heliport at Longford, Victoria on the first of a series of passenger ferry flights to a number of offshore platforms that were located throughout the Bass Strait oil and gas fields. This involved dropping off and picking up passengers at each stage. The flight duration between platforms was relatively short, ranging between 3 and 11 minutes.
At around 0835 the flight crew landed on Snapper platform for the final passenger drop-off/pick-up before returning to the Longford heliport. On board the helicopter for the flight to Longford were 10 passengers and two flight crew. The captain was the pilot monitoring and the copilot the pilot flying.[2]
After the passengers and their baggage were loaded, the flight crew completed their pre‑take‑off checks and commenced lift-off at around 0843. With all cockpit indications normal, the helicopter was established in a low hover above the helideck for final systems checks prior to departure. The copilot commenced a vertical climb from the hover and, after achieving the required rate of vertical climb and height above the helideck, reached the take-off ‘committed point’[3]. At this point, the copilot selected a nose-down attitude and commenced flying away in a standard, descending profile.
The engine failure and recovery
The crew recalled that immediately after setting the nose-down attitude, there was a loud bang accompanied by significant airframe vibration. The helicopter yawed about 5° to the right and descended toward the sea surface. Numerous lights illuminated on the master warning panel and an aural warning alerted the crew of a significant problem.
Coincident with the loud bang, the captain noted an immediate split in torque between the two engines and a decay in the main rotor speed. The captain identified that the right engine had failed and transmitted a MAYDAY[4] radio call to the operator’s search-and-rescue (SAR) service via the Longford flight following facility.
Following the engine failure, electrical power to the flight and navigation displays on each pilot’s instrument panel was disrupted, momentarily shutting down both primary electronic flight information system screens. Among other information, these screens display the attitude of the helicopter. The loss of attitude information required the copilot to revert to flying the helicopter with reference to the natural horizon.
The captain recalled that during the emergency the helicopter descended to around 30 ft (9 m) above the sea surface. Due to uncertainty of whether sufficient performance could be restored before an emergency ditching, the captain was ready to activate the emergency flotation system until the helicopter regained altitude and safe flight was assured.
The copilot recalled a positive airspeed trend through 45 kt and, at 60 kt, commenced a gradual climb with a recovery of the main rotor speed. Control of the aircraft was maintained and the crew were able to stabilise the main rotor speed at 107 per cent. The crew decided that the best option was to fly direct to the coastline.
After stabilising at 500 ft, the flight crew completed the engine failure checklist and secured the right engine. A follow-up radio call to the Longford flight following facility by the captain updated the operator on the situation. The crew elected to continue the climb to a target altitude of 1,000 ft.
During the climb, and despite the engine already being shut down, the crew were alerted to fire indications in the exhaust region of the right engine. The crew reported that the exhaust temperature increased rapidly until it was ‘off the scale’. In response, the crew carried out the engine fire checklist. This included activating the engine’s fire handle, which discharged fire‑extinguishing agent into the right engine compartment. The exhaust temperature reduced to zero. A third radio call to Longford advised of the engine fire and that it had been extinguished.
As part of their ongoing checks, the flight crew determined that the available fuel quantity in the tank that was feeding the left engine was approaching a low level as the helicopter approached the coastline. In response, the crew activated the cross-feed function to supply fuel from the right tank to the operating left engine. This ensured adequate reserves for the remainder of the flight to Longford. A depiction of the approximate flight track is provided in Figure 1.
Figure 1: Approximate flight track from Snapper platform to the operator’s heliport at Longford
Source: Google earth, modified by the ATSB
Operator’s SAR capability and response
The operator maintained a SAR capability at their Longford heliport that used a dedicated Sikorsky S-76C helicopter from within their fleet. A rostered crew remained prepared and on call during normal operations throughout the day.
Following the crew’s MAYDAY call the SAR helicopter was deployed to intercept EXU along its return track. Another of the operator’s helicopters that was en route to a nearby platform was contacted by the Longford flight following facility to divert and escort EXU for the return flight. The crew of this helicopter conducted a visual assessment of EXU and advised that no external damage was evident.
At 0913 the flight crew of EXU conducted a single-engine approach and landing at the Longford heliport.
From the evidence available, the following findings are made with respect to the engine failure sustained by Sikorsky S-76C helicopter, registered VH-EXU, near Snapper Platform helicopter landing site, Bass Strait, Victoria on 11 July 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The No. 26 blade separated from the right engine high pressure turbine assembly second stage wheel, impacting adjacent blades and resulting in a significent loss of engine power.
The significant power loss of the right engine considerably reduced the helicopter’s performance during a critical phase of flight.
Other factors that increased risk
While the engine manufacturer identified that the No. 26 blade of the high-pressure turbine assembly second stage wheel fractured due to a combination of fatigue, creep and oxidation, the specific factor leading to the fracture has yet to be determined.
Other findings
In combination, the operator’s focus on crew and simulator training in the management of single engine emergencies, and the crew’s actions in response to the engine failure in VH‑EXU, increased the likelihood of a successful outcome.
Safety analysis
Introduction
Flight operations to offshore platforms present unique challenges in terms of the physical environment, characteristics of the platform and helicopter performance. In addition, more involved and generally frequent maintenance is carried out on aircraft undertaking such operations. In this respect, no deficiencies in the operator’s maintenance practices were identified that may have contributed to the engine failure.
In this occurrence, the engine failure occurred at the most critical point during the departure from the platform, resulting in a significant loss of engine power and helicopter performance and the helicopter coming to within 30 ft (9 m) of the sea surface before flying away. This analysis will examine the nature of the engine failure and a number of operational aspects that increased the likelihood of a successful recovery from the failure.
Engine failure
Service Bulletin 292 72 0347 referenced the incorporation of modification TU‑347 in Arriel 1S1 engines. This modification, which incorporated a redesigned high pressure turbine assembly second stage (HP2) wheel that accorded with the latest design standards, had been incorporated in the engines in VH-EXU (EXU).
In an effort to understand the associated risk, the ATSB’s occurrence database and reports from the French Direction générale de l’aviation civile and the engine manufacturer were reviewed. This review indicated that, apart from an overseas engine failure involving a TU‑347‑modified engine that is still under investigation, the loss of the blade from the HP turbine and ensuing engine failure in EXU was the first involving a TU-347-modified Arriel 1S1 engine. The review also identified four previous occurrences that, while they did not result in engine failure or an in-flight shutdown, they did impact on engine operation. The manufacturer determined that in two of the events, creep/metal fatigue and oxidation deposits were factors.
The engine’s vibration monitoring system did not capture the engine vibration levels immediately preceding and after the blade fracture. This was a consequence of the system’s vibration sampling rate. The availability of vibration data closer to the blade fracture had the potential to better inform the investigation as to the nature of the fracture.
At the time of writing this investigation report, the engine manufacturer’s examination of Module 3 and the oil pump assembly from the right engine of EXU has identified no clear evidence of the cause of the blade fracture. The fatigue cracking to blade No. 26 was not discernible ahead of the blade fracture and assessment of the other blades in the affected engine did not reveal discernible defects.
In the absence of a conclusive cause, the engine manufacturer has continued its investigation into the blade fracture. This includes an examination of the manufacturing processes and a number of environmental and operational factors. Several potential contributing factors related to materials, dimensional and quality checks have been eliminated. The engine manufacturer acknowledged that the TU-347 blades were implicated in this occurrence, with the fracture being linked to the geometry of the aerofoil.
As of the date of this report, the engine manufacturer’s investigation concluded that the fracture occurred due to a combination of metal fatigue, blade material creep characteristics and oxidation origins. However, the definitive cause of the fracture remained unknown. The manufacturer reported that blades within excess of 2,000 operating hours or 2,300 cycles may be more susceptible to failure. The manufacturer is in the process of identifying potentially affected blades. Given the number of TU-347-modified modules in service and the amount of hours flown, the rate of failures is low. The associated safety risk is therefore considered to be low.
Aircraft operator
The operator’s Category B departure profile allowed crews to use their discretion and vary the committed point based on ambient conditions and aircraft payload. In this respect, the aircraft’s payload is adjusted to suit the characteristics of the specific platform.
In the event of an engine failure after passing the committed point, crews aim to convert height to speed while maintaining rotor RPM within limits using the available emergency power from the operative engine.
The operator’s Flying Operations Manual directed pilots to assess whether performance is improving or deteriorating during a one engine inoperative departure. In the case of a deteriorating situation, crews prepare for ditching. Where performance is improving or static, one engine inoperative power limits are observed and airspeed is monitored before being set at the best rate of climb speed with the landing gear retracted.
In combination, the operator’s focus on crew and simulator training in the management of single‑engine emergencies, and the crew’s actions in response to the engine failure in EXU, increased the likelihood of a successful outcome.
Safety issues and actions
The ATSB did not identify any organisational or systemic issues that might adversely affect the future safety of aircraft operations. However, whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Proactive safety action taken by the helicopter operator
The helicopter operator advised that, in response to this occurrence, they reviewed the reliability of the Arriel 1S1 engine second stage, gas generator high-pressure turbine blades in their fleet of Sikorsky S-76C helicopters. In particular, the operator examined those turbine blades that have been modified in accordance with the engine manufacturer’s service bulletin SB 292 72 0347. As a result of that examination, while the manufacturer’s published service life for the turbine blades is 6,000 hours, the helicopter operator has imposed its own life limit of 2,000 hours.
Proactive safety action taken by the engine manufacturer
The engine manufacturer initiated a series of actions in response to the engine failure, including:
issuing Service Letter No. 2888/13/AR1S in July 2013, which advised operators of the occurrence and the manufacturer’s preliminary lines of enquiry
issuing Information Letter Arriel1/002/14 in November 2014, which advised field technicians and maintenance centres to pay close attention to TU-347 blades for damage and report the results (at the time of this report, the manufacturer had received no reports of damaged TU‑347 blades)
issuing Service Bulletin 292 72 0845 on 19 January 2015, which required a one-off visual inspection of the free (power) turbine blades in Arriel 1 series engine variants
amendment of the Arriel 1 series engine Repair Manual, effective mid-2015, to specify a dye penetrant inspection of TU-347 blades whenever an engine was returned for repair.
In addition, the engine manufacturer advised that it was in the process of developing a service bulletin for distribution to operators once any potentially affected TU-347 blades were identified.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 5 August 2013, a Cirrus SR22T aircraft, registered VH-LBQ, was being operated on a private flight from Archerfield to Kingaroy, Queensland.
On approach to Kingaroy, at about 500 above ground level (AGL), the pilot extended the flaps and shortly after, disconnected the autopilot (AP). Upon disconnecting the AP, the pilot reported that the aircraft pitched-up violently due to trim runaway. The AP pitch trim was trimming the aircraft for a nose-up position, even though the AP was disconnected. This required the pilot to use a large amount of forward physical force to maintain stable flight. He attempted to resolve the problem by pressing and holding the autopilot disconnect switch (AP DISC), however, this had no effect. The pilot conducted a go-around.
He then used the manual electric trim (MET) hat switch located on the control yoke, in an attempt to trim the aircraft nose-down. The pilot was able to regain sufficient control of the aircraft and land safely at Kingaroy.
On the basis of the evidence available to the ATSB, it was not possible to determine, with any certainty, the reason for the pitch-up event.
This occurrence highlights the safety benefit to be gained from going around, which allowed the pilot time to troubleshoot and prepare for landing with the pitch trim difficulties. This decision helped ensure the aircraft landed safely.
At about 2121 on 14 July 2013, Pacific National intermodal freight train 6MP5 overran the limit of its authority at Blamey, Western Australia. The train travelled 23 km into the Blamey to Curtin section before the crew realised the overrun had occurred and stopped the train.
The crew did not immediately report the overrun to the Network Control Officer as required. Instead, they provided misleading information about the train’s location and that they were having problems with the on board communication systems. Unaware of the authority overrun, the Network Control Officer issued a Train Authority for train 6MP5 to proceed from Blamey to Parkeston.
The train crew signed off duty at Parkeston and after reflecting on their actions reported the occurrence to the Pacific National Kalgoorlie Depot Manager the following day.
What the ATSB found
The ATSB found that during the safety critical period approaching the limit of authority at Blamey, the train crew had focused their attention on planning for the upcoming refuelling at Parkeston. As a result, they were distracted from the primary task of driving the train and missed vital cues and information that identified the limit of the current train authority.
The investigation also found that there were inconsistencies in the instructions contained in the various Pacific National procedural documents relating to refuelling at Parkeston.
What's been done as a result
Pacific National has amended procedures related to the arrangements for refuelling trains at Parkeston to remove inconsistencies and ensure that ancillary tasks do not have the potential to distract train crews from undertaking safety critical work.
Safety message
Train crews must be cognisant of and apply the operational procedures intended to prevent or control the consequence that may arise from an overrun of authority.
Rail transport operators should ensure that any ancillary tasks undertaken by a train crew do not have the potential to divert attention away from the safe operation of a train.
