The ATSB has completed its technical analysis report of the flight recorder data from the Boeing Co. 737-2H6, registration PK-CJG on behalf of the Indonesian National Transportation Safety Committee. The aircraft was operating a flight from Jakarta to Jambi, Indonesia on 27 August 2008 when it overran runway 31 at Jambi airport. The aircraft impacted an occupied house near the end of the runway and came to rest in a field. A number of people on the ground were seriously injured and some aircraft occupants were injured during the subsequent evacuation. The aircraft was substantially damaged.
The National Transportation Safety Committee (NTSC) of Indonesia is responsible for investigating this occurrence. The NTSC requested assistance from the Australian Transport Safety Bureau (ATSB) in the recovery and analysis of information from the flight data recorder and cockpit voice recorder. In accordance with clause 5.23 of Annex 13 to the Convention on International Civil Aviation, the ATSB appointed an Accredited Representative to assist the NTSC and initiated an investigation under the Transport Safety Investigation Act 2003.
The ATSB''s Technical Analysis Report has been sent to the NTSC to assist its ongoing investigation. The NTSC is responsible for releasing a final investigation report regarding this occurrence.
National Transportation Safety Committee Ministry Of Transportation Republic Of Indonesia Transportation Building 3rd Floor Jalan Medan Merdeka Timur No. 5 Jakarta Pusat 10110 Indonesia
On 23 October 2008 at 2357 Eastern Standard Time, a British Aerospace BAe 146-300 aircraft, registered VH-NJM, operating a freighter flight, had a tail strike on landing at Brisbane Airport, Qld.
The aircraft and crew had commenced duty earlier that evening at Adelaide, SA and had flown via Sydney, NSW to Brisbane. The aircraft and crew then did the reverse sectors back to Adelaide. It was only after landing at Adelaide that the crew became aware of the tail strike.
Damage to the aircraft consisted of abrasion to the tail strike indicator through to the fuselage skin and abrasion to the fuselage skin. There was also damage to the aircraft's structural frame under the tail strike indicator.
The aircraft manufacturer had identified an increase in the number of BAe 146-300 tail strikes and has recommended a number of procedural changes for flight crew. The aircraft operator has implemented those changes and issued notices to flight crew highlighting the risks and conditions for tail strike.
On 16 October 2008, at about 0615 Eastern Standard Time, the pilot of a Fairchild Industries SA227, registered VH-UZA, took off from runway 32 at Mackay Airport, Qld. At the same time, the flight crew of another Fairchild Industries SA227, registered VH-EEO, was conducting a backtrack on the active runway 32.
The crews of both aircraft took avoiding action.
There were a number of opportunities for the departing pilot to have confirmed that his aircraft radio was operating correctly, and to have verified the actual position of the backtracking aircraft. Had the departing pilot availed himself of those opportunities, he would have been afforded an increased level of assurance that the runway was clear.
Confirmation that runway 32 was clear prior to commencing the departure was attempted, but not obtained, by the departing pilot.
On 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. While the aircraft was in cruise at 37,000 ft, one of the aircraft's three air data inertial reference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Two minutes later, in response to spikes in angle of attack (AOA) data, the aircraft's flight control primary computers (FCPCs) commanded the aircraft to pitch down. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment.
Basic animation using data from the Digital Flight Data Recorder
Although the FCPC algorithm for processing AOA data was generally very effective, it could not manage a scenario where there were multiple spikes in AOA from one ADIRU that were 1.2 seconds apart. The occurrence was the only known example where this design limitation led to a pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraft manufacturer subsequently redesigned the AOA algorithm to prevent the same type of accident from occurring again.
Each of the intermittent data spikes was probably generated when the LTN-101 ADIRU's central processor unit (CPU) module combined the data value from one parameter with the label for another parameter. The failure mode was probably initiated by a single, rare type of internal or external trigger event combined with a marginal susceptibility to that type of event within a hardware component. There were only three known occasions of the failure mode in over 128 million hours of unit operation. At the aircraft manufacturer's request, the ADIRU manufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmission failures.
At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. The injury rate and injury severity was substantially greater for those who were not seated or seated without their seat belts fastened.
The investigation identified several lessons or reminders for the manufacturers of complex, safety‑critical systems.
Executive Summary
Key investigation outcomes
The in-flight upset on 7 October 2008 occurred due to the combination of a design limitation in the flight control primary computer (FCPC) software of the Airbus A330/A340, and a failure mode affecting one of the aircraft’s three air data inertial reference units (ADIRUs). The design limitation meant that, in a very rare and specific situation, multiple spikes in angle of attack (AOA) data from one of the ADIRUs could result in the FCPCs commanding the aircraft to pitch down.
When the aircraft manufacturer became aware of the problem, it issued flight crew procedures to manage any future occurrence of the same ADIRU failure mode. The aircraft manufacturer subsequently reviewed and improved its FCPC algorithms for processing AOA and other ADIRU parameters. As a result of this redesign, passengers, crew and operators can be confident that the same type of accident will not reoccur.
The investigation identified several lessons or reminders for the manufacturers of complex, safety-critical systems. With the knowledge that systems are becoming increasingly complex, it also identified a need for more research into how design engineers and safety analysts evaluate system designs, and how their tasks, tools, training and guidance materials could be improved to minimise design errors.
Although in-flight upsets are very rare events, the accident on 7 October 2008 also provided a salient reminder to all passengers and crew of the importance of wearing their seat belts during a flight whenever they are seated.
Summary of the occurrence
At 0132 Universal Time Coordinated (0932 local time) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. At 0440:26, while the aircraft was in cruise at 37,000 ft, ADIRU 1 started providing intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Soon after, the autopilot disconnected and the crew started receiving numerous warning and caution messages (most of them spurious). The other two ADIRUs performed normally during the flight.
At 0442:27, the aircraft suddenly pitched nose down. The FCPCs commanded the pitch-down in response to AOA data spikes from ADIRU 1. Although the pitch-down command lasted less than 2 seconds, the resulting forces were sufficient for almost all the unrestrained occupants to be thrown to the aircraft’s ceiling. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment. The FCPCs commanded a second, less severe pitch-down at 0445:08.
The flight crew’s responses to the emergency were timely and appropriate. Due to the serious injuries and their assessment that there was potential for further pitch-downs, the crew diverted the flight to Learmonth, Western Australia and declared a MAYDAY to air traffic control. The aircraft landed as soon as operationally practicable at 0532, and medical assistance was provided to the injured occupants soon after.
FCPC design limitation
AOA is a critically important flight parameter, and full-authority flight control systems such as those equipping A330/A340 aircraft require accurate AOA data to function properly. The aircraft was fitted with three ADIRUs to provide redundancy and enable fault tolerance, and the FCPCs used the three independent AOA values to check their consistency. In the usual case, when all three AOA values were valid and consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs for their computations. If either AOA 1 or AOA 2 significantly deviated from the other two values, the FCPCs used a memorised value for 1.2 seconds. The FCPC algorithm was very effective, but it could not correctly manage a scenario where there were multiple spikes in either AOA 1 or AOA 2 that were 1.2 seconds apart.
Although there were many injuries on the 7 October 2008 flight, it is very unlikely that the FCPC design limitation could have been associated with a more adverse outcome. Accordingly, the occurrence fitted the classification of a ‘hazardous’ effect rather than a ‘catastrophic’ effect as described by the relevant certification requirements. As the occurrence was the only known case of the design limitation affecting an aircraft’s flightpath in over 28 million flight hours on A330/A340 aircraft, the limitation was within the acceptable probability range defined in the certification requirements for a hazardous effect.
As with other safety-critical systems, the development of the A330/A340 flight control system during 1991 and 1992 had many elements to minimise the risk of a design error. These included peer reviews, a system safety assessment (SSA), and testing and simulations to verify and validate the system requirements. None of these activities identified the design limitation in the FCPC’s AOA algorithm.
The ADIRU failure mode had not been previously encountered, or identified by the ADIRU manufacturer in its safety analysis activities. Overall, the design, verification and validation processes used by the aircraft manufacturer did not fully consider the potential effects of frequent spikes in data from an ADIRU.
ADIRU data-spike failure mode
The data-spike failure mode on the LTN-101 model ADIRU involved intermittent spikes (incorrect values) on air data parameters such as airspeed and AOA being sent to other systems as valid data without a relevant fault message being displayed to the crew. The inertial reference parameters (such as pitch attitude) contained more systematic errors as well as data spikes, and the ADIRU generated a fault message and flagged the output data as invalid. Once the failure mode started, the ADIRU’s abnormal behaviour continued until the unit was shut down. After its power was cycled (turned OFF and ON), the unit performed normally.
There were three known occurrences of the data-spike failure mode. In addition to the 7 October 2008 occurrence, there was an occurrence on 12 September 2006 involving the same ADIRU (serial number 4167) and the same aircraft. The other occurrence on 27 December 2008 involved another of the same operator’s A330 aircraft (VH-QPG) but a different ADIRU (serial number 4122). However, no factors related to the operator’s aircraft configuration, operating practices or maintenance practices were found to be associated with the failure mode.
Many of the data spikes were generated when the ADIRU’s central processor unit (CPU) module intermittently combined the data value from one parameter with the label for another parameter. The exact mechanism that produced this problem could not be determined. However, the failure mode was probably initiated by a single, rare type of trigger event combined with a marginal susceptibility to that type of event within the CPU module’s hardware. The key components of the two affected units were very similar, and overall it was considered likely that only a small number of units exhibited a similar susceptibility.
Some of the potential triggering events examined by the investigation included a software ‘bug’, software corruption, a hardware fault, physical environment factors (such as temperature or vibration), and electromagnetic interference (EMI) from other aircraft systems, other on-board sources, or external sources (such as a naval communication station located near Learmonth). Each of these possibilities was found to be unlikely based on multiple sources of evidence. The other potential triggering event was a single event effect (SEE) resulting from a high-energy atmospheric particle striking one of the integrated circuits within the CPU module. There was insufficient evidence available to determine if an SEE was involved, but the investigation identified SEE as an ongoing risk for airborne equipment.
The LTN-101 had built-in test equipment (BITE) to detect almost all potential problems that could occur with the ADIRU, including potential failure modes identified by the aircraft manufacturer. However, none of the BITE tests were designed to detect the type of problem that occurred with the air data parameters.
The failure mode has only been observed three times in over 128 million hours of unit operation, and the unit met the aircraft manufacturer’s specifications for reliability and undetected failure rates. Without knowing the exact failure mechanism, there was limited potential for the ADIRU manufacturer to redesign units to prevent the failure mode. However, it will develop a modification to the BITE to improve the probability of detecting the failure mode if it occurs on another unit.
Use of seat belts
At least 60 of the aircraft’s passengers were seated without their seat belts fastened at the time of the first pitch-down. Consistent with previous in-flight upset accidents, the injury rate, and injury severity, was substantially greater for those who were not seated or seated without their seat belts fastened.
Passengers are routinely reminded every flight to keep their seat belts fastened during flight whenever they are seated, but it appears some passengers routinely do not follow this advice. This investigation provided some insights into the types of passengers who may be more likely not to wear seat belts, but it also identified that there has been very little research conducted into this topic by the aviation industry.
Investigation process
The Australian Transport Safety Bureau investigation covered a range of complex issues, including some that had rarely been considered in depth by previous aviation investigations. To do this, the investigation required the expertise and cooperation of several external organisations, including the French Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile, US National Transportation Safety Board, the aircraft and FCPC manufacturer (Airbus), the ADIRU manufacturer (Northrop Grumman Corporation), and the operator.
Passenger safety
A key safety message for passengers in the AO-2008-070 final report is the importance of wearing seat belts when seated in flight, even when the seat-belt sign is not illuminated. As stated in the report:
At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. Consistent with previous in-flight upset accidents, the injury rate, and injury severity, was substantially greater for those who were not seated or seated without their seat belts fastened.
Further information on the wearing of seat belts and other advice for minimising injury risk during turbulence and other in-flight upsets is also available in the ATSB Aviation Safety Bulletin Staying safe against turbulence.
Public safety advice about the importance of wearing seat belts on aircraft has also been provided by the Australian Civil Aviation Safety Authority.
A video showing the effects of not wearing seat belts during a simulated in-flight upset is available on the US Federal Aviation Administration website. The video simulates a turbulence event, whereas the in-flight upset on 7 October 2008 near Learmonth, Western Australia was due to pitch-down commands from the aircraft's flight control system.
Regardless of why an upset occurs, the message is the same: Wearing a seat belt during all phases of a flight, and having the seat belt fastened low and firm, will significantly minimise the risk of injury in the unlikely event of an in-flight upset.
Second interim report
Report release date: 18/11/2009
This report provides an update to the first Interim Factual Report on this occurrence that was released on 6 March 2009.
The interim report should be read in conjunction with the first interim report. The contents of this second interim report focus on summarising new activities conducted since the previous report, providing information on relevant topics not released in the previous report, and updating information on relevant topics where there have been significant changes. Further details of new and ongoing activities will be provided in the Australian Transport Safety Bureau's (ATSB) final report.
The information contained in this interim factual report is derived from the ongoing investigation of the occurrence. Readers are cautioned that there is the possibility that new evidence may become available during the remainder of the investigation that alters the circumstances as depicted in this report.
The investigation is continuing.
First interim report
Report release date: 06/03/2009
At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. From about the same time there were various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down and descended about 400 ft during this second event.
At 1249, the crew made a PAN urgency broadcast to air traffic control and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.
One flight attendant and 11 passengers were seriously injured, and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened or were standing. As there were serious injuries, the occurrence constituted an accident.
The investigation to date has identified two significant safety factors related to the pitch-down movements. Firstly, immediately prior to the autopilot disconnect, one of the air data inertial reference units (ADIRUs) started providing erroneous data (spikes) on many parameters to other aircraft systems. The other two ADIRUs continued to function correctly. Secondly, some of the spikes in angle of attack data were not filtered by the flight control computers, and the computers subsequently commanded the pitch-down movements.
Two other occurrences have been identified involving similar anomalous ADIRU behaviour, but in neither case was there an in-flight upset.
Preliminary report
Report release date: 14/11/2008
At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. That was accompanied by various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down and descended about 400 ft during this second event.
At 1249, the crew made a PAN emergency broadcast to air traffic control and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin crew of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.
Currently available information indicates that one flight attendant and at least 13 passengers were seriously injured and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened. This constituted an accident under the ICAO definition outlined in Annex 13 to the Chicago Convention and as defined in the Transport Safety Investigation Act 2003.
Examination of flight data recorder information indicates that, at the time the autopilot disconnected, there was a fault with the inertial reference (IR) part of the air data inertial reference unit (ADIRU) number 1. From that time, there were many spikes in the recorded parameters from the air data reference (ADR) and IR parts of ADIRU 1. Two of the angle-of-attack spikes appear to have been associated with the uncommanded pitch-down movements of the aircraft.
On the morning of 16 October 2008, a Gippsland Aeronautics GA-8 Airvan, registered VH-WRT, was being operated on a freight charter flight from Elcho Island and return, Northern Territory. At about 1230, it was realised that the aircraft was missing. A witness reported seeing the aircraft during the early stages of the flight and, shortly afterwards, a column of dark black smoke rising from the eastern side of the Napier Peninsula. On 17 October 2008, items of wreckage from the aircraft were found in the south-western part of Buckingham Bay. The pilot, who was the sole occupant of the aircraft, and the main wreckage of the aircraft have not been found. After consideration of the available evidence, the investigation was unable to identify any factor that contributed to the accident.
Although the investigation did not identify any issues that had the potential to adversely affect the safety of future operations, the operator took proactive safety action in response to the accident. That action included changed procedures in the areas of cargo restraint and the carriage of dangerous goods, the supervision and oversight of flights, and to the operator's flight following requirements. In addition, the operator has acted to reduce pilot workload.
Preliminary report
Preliminary report released 19 December 2008
On the morning of 16 October 2008, a Gippsland Aeronautics GA-8 Airvan, registered VH-WRT, being operated on a freight charter flight, was reported missing near Elcho Island, NT. Subsequently, items of wreckage from the aircraft were found in Buckingham Bay. The pilot, who was the sole occupant of the aircraft, was assumed to be fatally injured.
At about 1440 Eastern Standard Time on 29 September 2008, the pilot of a Piper Aircraft PA36-375 Pawnee Brave, registered VH-FXE, was conducting aerial baiting operations in the Pilton Valley, Queensland when the aircraft collided with terrain. The aircraft was seriously damaged by impact forces and a post-impact, fuel and magnesium-fed fire. The pilot was fatally injured.
The pilot had flown the aircraft for about 3 hours that day, conducting baiting operations at a number of properties in the region.
The investigation found that the topography of the area in which the pilot was operating, and the strong gusty wind conditions at the time, probably resulted in turbulence that increased the hazardous nature of the low-level application task.
It is likely that the pilot lost control of the aircraft as a result of that turbulence, at a height from which recovery was not possible before the aircraft struck the ground.
On 19 September 2008, during a flight from Fitzroy Falls to Rosehill, NSW, the pilot of a Eurocopter AS350 BA helicopter, registered VH-BUK, experienced the onset of severe vibration within the tail rotor controls and made an emergency landing at Casula High School. Subsequent examination of the aircraft revealed that one of the tail rotor pitch change links had fractured, resulting in lateral movement of the tail rotor and damage to the tail boom and tail cone.
The pitch link had fractured from fatigue cracking that was the result of stresses induced in the link by excessive play in the heavily worn spherical bearing. It was probable that bearing wear outside of maintenance manual limits existed, but was not detected, during the most recent after last flight (ALF) inspection.
As a result of this occurrence, the helicopter manufacturer released Safety Information Notice (No. 2000-S-65) and the Civil Aviation Safety Authority released an Airworthiness Bulletin (AWB 27- 009) to remind operators, pilots and maintenance personnel of the requirements for ALF inspections for pitch link condition and bearing play.
On 24 September 2008, at about 1605 Eastern Standard Time, a Liberty Aerospace XL2 aircraft, registered VH-CZX, with one occupant, collided with terrain 2 km south of Luddenham, NSW. The aircraft descended through trees and impacted the ground, fatally injuring the student pilot. The aircraft sustained serious damage.
Summary
On 24 September 2008, at about 1606 Eastern Standard Time, a Liberty Aerospace Inc. XL2 aircraft, registered VH-CZX, descended through trees and collided with terrain 2 km south of Luddenham, New South Wales. The sole occupant, a student pilot, was fatally injured and the aircraft sustained serious damage.
Air traffic control radar data recordings indicated that the aircraft departed straight and level flight from about 3,000 ft above ground level and descended very steeply at a high rate of descent to below the radar's minimum detection height. Witness observations, aircraft damage and wreckage distribution were consistent with a steep, low-speed collision with terrain.
The investigation was unable to determine the reasons for the departure from straight and level flight or establish the aircraft's movements in the period of time between the loss of radar information and the witnesses' visual observations.
No evidence of any mechanical fault that could have contributed to the accident was found. The weather was benign. A post-mortem examination of the pilot did not identify any pre-existing medical conditions that may have contributed to the accident.
Traces of a cannabis metabolite were present in the pilot's blood, indicating previous use of, or exposure to cannabis. There was no evidence that the pilot was impaired by cannabis at the time of the accident; however, there is extensive evidence that the use of cannabis increases the risk of the impairment of pilot performance.
The investigation did not identify any organisational or systemic issues that might adversely affect the future safety of aviation operations. However, following the accident, the flying school proactively modified its training syllabus to include additional instructional flights on the aircraft type prior to authorising extended solo flights.
On 25 September 2008, a Bell Helicopter Co 407 helicopter, registered VH-NSH, with a pilot and six passengers onboard, lifted off from the helideck of the cruise ship True North on a 45-minute tourist flight. As the pilot moved the helicopter clear of the right of the ship, and at a height of about 10 m above the surface of the sea, a loud bang was heard followed by a total power loss. The helicopter rapidly descended to the water, where it rolled onto its side before inverting.
Despite two of the occupants, one of whom was unconscious, requiring assistance to exit the partially-submerged aircraft, all of the occupants survived the accident. Sometime later, the helicopter sank.
The investigation found that there had been a 'burst' failure of the engine outer combustion case as a result of ongoing high-cycle fatigue cracking during normal engine operation.
As a result of this occurrence, the engine manufacturer conducted a computerised analysis of the design of the combustion case in an effort to more effectively address the relevant areas of high stress. In response to this, and a similar failure in another helicopter 2 weeks earlier, the Civil Aviation Safety Authority released an Airworthiness Bulletin highlighting the circumstances of the occurrence to Australian helicopter operators.
The operator of the helicopter has also advised its intention to change a number of the operational procedures employed during shipborne helicopter operations to better ensure passenger safety.
On 18 September 2008, a Boeing Company 717-200 aircraft, registered VH-NXE, was being operated on a scheduled passenger service from Cairns, Qld, to Alice Springs, NT, with six crew and 70 passengers. During a visual approach to runway 30 at Alice Springs Airport, the pilot in command reported that the aircraft stick shaker momentarily activated during the final turn to the runway. The crew completed the landing and taxied the aircraft to the terminal without further incident.
Summary
On 18 September 2008, a Boeing Company 717-200 (717), registered VH-NXE, was being operated on a scheduled passenger flight from Cairns, Queensland to Alice Springs, Northern Territory. There were 70 passengers, four cabin crew and two flight crew on board. During the manually-flown visual approach by the pilot in command (PIC) to runway 30 at Alice Springs Aerodrome, the stickshaker activated. The pilot flying lowered the nose while continuing the turn onto final. The stickshaker activated again before the flight crew stabilised the approach to within the operator's criteria and landed without further incident.
The investigation found that the stickshaker activated because of a combination of bank angle, high nose-up pitch change rate and airspeed slightly below the approach speed. The aircraft was higher, faster and closer to the aerodrome than was suitable for the direct-to-final approach being attempted. The autothrottle was inadvertently not engaged by the flight crew after the automatic flight system was disconnected earlier in the approach, which contributed to the airspeed reduction. The PIC's response to the stickshaker did not conform to the aircraft manufacturer's procedures.
The investigation also found that the PIC's judgement and monitoring ability were probably adversely affected by personal and work stress and associated fatigue, although the duty roster met the necessary standards. Pilots operating within flight and duty time limitations can still experience fatigue. Responsibility for adequate flight crew wellbeing before flight rests with both operators and their pilots.
The investigation did not identify any organisational or systemic issues that might adversely affect the future safety of aviation operations. However, in response to this occurrence, the operator proactively issued a number of notices to pilots to enhance pilot flight mode annunciator and auto mode awareness in the 717, to highlight the aircraft's buffet protection system and to discuss recent stickshaker events, and to describe the stall recovery procedure in the 717. In addition, the operator amended a number of its command upgrade and recurrent simulator training requirements and worked with the aircraft manufacturer to reduce the incidence of stickshaker events across the operator's 717 fleet.
