FINDINGS

During the flight, the amount of generated VIA BITE data exceeded the memory size. As a result, BITE data from the event that initiated the FMS problem was overwritten and lost.

The available BITE data showed that FMC 2 was unable to sequence the ‘400 ft course to altitude’ leg associated with the SWIFT SIX SID. Eventually, FMC 2 performed a software reset but was unable to recover and latched.

A similar progression then occurred for FMC 1 but, in accordance with its design, FMC 1 did not latch and was available for use but with the flight plan information cleared.

ANALYSIS

The FMS performance reported by the crew was consistent with FMC 2 performing a progressive series of resets before it latched. A similar progression of resets then occurred for FMC 1 but, in accordance with its design, it did not latch and was available for use but with the flight plan information cleared. During the resetting process, the FMS response would have been confusing to the crew and consistent with the crew’s observation of the ‘FMS locking us out’.

With FMC 2 latched, the MENU page would have been displayed on the copilot’s multi-function control and display unit (MCDU) but with the FMC 2 prompt missing from the top left data field. The standby navigation/radio (STANDBY NAV/RAD*) prompt would also have been displayed on the MCDU and ‘MAP FAIL’ displayed on the copilot’s navigation display. Once the resetting was completed, then an ILS frequency could be tuned using the STANDBY NAV/RAD page on either the pilot in command’s (PIC) or copilot’s MCDU.

The PIC was the handling pilot during the flight. Normally the PIC’s MCDU will interact with FMC 1 and the copilot’s MCDU will interact with FMC 2. With FMC 2 latched, it was necessary for the copilot to change his source select switch to ‘FO ON 1’ to access FMC 1.

During the investigation the VIA manufacturer advised that no other FMS problems of this nature had been reported.

The Boeing 717-200 was taxiing at Cairns Qld for a scheduled service to Brisbane Qld. As part of the preparation for the flight, the crew had entered flight plan details into the aircraft's flight management system (FMS). While taxiing, due to intermittent rain showers at Cairns, the 717 crew then programmed the FMS with wet runway speed figures for take-off.

The crew reported that late in the take-off roll the manually entered wet speeds were lost from the airspeed tape on the primary flight display and FMS-generated speeds were displayed. At rotation 'MAP FAIL' appeared on both navigation displays.

The investigation found that flight management computer (FMC) 2 was unable to sequence the '400 ft course to altitude' leg associated with the SWIFT SIX standard instrument departure. Eventually, FMC 2 performed a software reset but was unable to recover and became unavailable for use by the crew. A similar progression then occurred for FMC 1 but, in accordance with its design, FMC 1 remained available for use but with the flight plan information cleared.

Eventually the crew were able to enter the instrument landing system frequency, but FMS operation did not appear to be reliable. The aircraft was radar vectored for a return to Cairns while maintaining visual meteorological conditions. The crew conducted a visual approach to runway 15 and the aircraft landed 32 minutes after take-off.

1. Meteorological conditions were conducive to wind shear, mechanical turbulence or a combination thereof.
2. The pilot took off in a crosswind that exceeded the limitations specified in the Pilots Operating Handbook.

The environmental conditions at the time of the accident required the pilot to take particular account of the prevailing sea conditions and the wind direction and speed, when selecting the area for, and direction of, the take-off. This led to the pilot making a compromise that placed emphasis on an area with a more favourable sea state rather than directly into the prevailing wind.

The local effects of the terrain gave the impression to the pilot that the wind at surface level in the area selected for the take-off was from the north-north-east. Therefore, he assessed that that wind direction was suitable for the take-off. However, it is likely that the aircraft encountered a crosswind during the take-off that exceeded the limitations in the Pilots Operating Handbook (POH). It was also likely that wind shear or mechanical turbulence, or a combination of both these effects, was encountered by the pilot shortly after take-off. At the point where the angle of bank of the aircraft exceeded 45 degrees, it is likely that the aircraft stalled causing it to strike the water.

The pilot reported that he was able to exit the aircraft quickly because of his previous underwater escape training. The Australian Transport Safety Bureau encourages all operators in this environment to ensure that their flight crews have completed similar training. The actions of the rear seat passenger were significant in enabling the remaining occupants to exit the aircraft.

The pilot and passengers did not have the time to retrieve their life jackets from under their seats before exiting the aircraft. This was also the case in the floatplane accident in Tasmania in 2001 (BO/200105932). Although the carriage of life jackets and the stowage of them below each of the seats was in accordance with Civil Aviation Order (CAO) 20.11 parts 5.1.4 and 5.1.5, the wearing of life jackets was not required by CAO 20.11 part 5.1.8, and as a consequence, their availability was not assured after the occupants of the floatplane had exited the aircraft into the water.

The lack of time available to retrieve and don life jackets in the event of an accident when operating close to, or on the water, has the potential to adversely affect the survivability of aircraft occupants after they have exited an aircraft. As highlighted in Federal Aviation Administration Advisory Circular (AC) 91-69A, it is extremely difficult for a person to don a life jacket when they are already in the water, and practically impossible to do so if the person is injured.

At 1735 eastern summer time on 20 January 2005, a Cessna Aircraft Company A185F floatplane, registered VH-SBH, with one pilot and three passengers on board was taking off on a water departure for a charter flight from Rose Bay aircraft landing area (ALA) to Palm Beach, NSW. Shortly after becoming airborne, the aircraft rolled 45 degrees to the left causing the left wing to strike the water. The aircraft became inverted and was substantially damaged. The four occupants escaped with minor injuries.

The pilot had positioned the floatplane to the eastern side of the ALA, approximately 200 m from the shoreline and to the west of a headland, to achieve more favourable sea conditions for a take-off to the north-north-west. The pilot reported that the wind direction was 010 degrees M at a speed of 20 kts. The intended take-off path ran approximately parallel to the headland in a direction of 350 degrees M.

The pilot reported selecting 20 degrees of flap for the take-off. As the aircraft was about to leave the surface, he selected 30 degrees of flap. This technique was used to help get the aircraft off the surface of the water quickly in difficult sea and/or weather conditions. He also reported that the aircraft took longer than he expected to reach take-off speed. The aircraft became airborne at 45 to 50 kts and he then selected 20 degrees of flap. At approximately 30 ft above the water, the aircraft commenced an uncommanded left roll that he was able to correct with full right aileron input. The aircraft then commenced a second uncommanded left roll that he was unable to correct with control inputs. The pilot, passengers and witnesses, all reported that the aircraft rolled more than 45 degrees to the left before the left wing struck the water.

The floatplane came to rest inverted and shortly after the cabin became submerged. The pilot reported that he had completed Helicopter Underwater Escape Training (HUET) previously, and that he thought that assisted him to exit the cabin quickly through the pilot's door, located on the left of the cabin. The passenger in the copilot's seat, located on the right of the cabin, was momentarily disorientated, but managed to undo his seat belt while the passenger in the middle row was attempting to locate and undo his seatbelt. The rear seat passenger was able to swim towards the front passenger and reported kicking open a door with her foot before pushing the front passenger out of the aircraft. She then returned to the middle row passenger and unfastened his seat belt buckle before pushing him out of the aircraft and then exiting the submerged cabin herself. One passenger reported that he was initially disoriented after the aircraft entered the water. In addition, given the rapid nature of the event and the need to exit the inverted cabin quickly, the passengers did not retrieve the life jackets which were stowed underneath their seats. It was likely that all passengers exited the floatplane via the pilot's door, because the co-pilot's door was still locked closed when the aircraft was recovered.

The floatplane stayed inverted with its floats remaining buoyant. After exiting the aircraft, the passengers were picked up by a passing boat. The pilot remained with the aircraft and secured it to a boat.

The load chart for the flight showed that the aircraft was within weight and balance limitations. The pilot was appropriately licensed and endorsed for the operation and was experienced in floatplane operations in Sydney Harbour. The aircraft was capable of normal operations before flight and there were no known maintenance issues.

A Bureau of Meteorology (BoM) report of the weather in Sydney Harbour at the time of the accident, showed that the prevailing wind around the time of the accident was from the north-east, averaging 26 to 29 kts, with gusts reaching 37 kts. The report also suggested that:

…in considering the wind shear that would have been experienced by a plane taking off from Rose Bay, the sheltering effect of the surrounding topography, especially the shielding of Rose Bay from north easterlies by the southern headland of Sydney Harbour, needs to be taken into account. It is conceivable that in passing from the relatively sheltered inshore waters of Rose Bay to a more exposed location, either through ascent or forward motion or both, that significant wind shear may have been experienced.

The pilot advised that he used a number of cues to determine the wind velocity, particularly the orientation of moored boats and flags, the BoM forecast and the water conditions.

Mountain waves and their turbulence can occur downwind of any obstacle, including an isolated hill a few hundred feet high. If the wind at the altitude of the top of the obstacle is 20 kts or more, there will be noticeable wave turbulence and significant downdrafts. This turbulence will be greatest in the rotor zone in the lee of the obstacle and will be at a maximum at about the same altitude as the top of the obstacle.¹

The company ALA register notation for Rose Bay warned that 'Dumping will be encountered in winds over 20 kts from the North-East, South and West'. The significant downdrafts described in the previous paragraph are what the operator's ALA register referred to as 'dumping'.

A fact sheet on mountain wave turbulence that accompanied Australian Transport Safety Bureau (ATSB) report BO/200104092 into an accident involving mechanical turbulence stated in part that:

In addition to generating turbulence that has demonstrated sufficient ferocity to significantly damage aircraft or lead to loss of control, the more prevailing danger to aircraft in the lower levels in Australia seems to be the effect on an aircraft's climb rate. General Aviation aircraft rarely have the performance capability sufficient to enable the pilot to overcome the effects of a severe downdraft generated by a mountain wave, or the turbulence or the windshear² generated by the rotor.

The Pilots Operating Handbook (POH) for the Cessna 185 indicated that the stalling speed in a 20 degree flap configuration, at a mid-range centre of gravity, was 55 kts. The POH also indicated a maximum demonstrated crosswind velocity for take-off and landing of 13 kts. The investigation determined that the crosswind for the accident flight would have been between 19 and 24 kts.

In December 2001, the ATSB investigated an accident involving a floatplane in Tasmania where the occupants had insufficient time to don life jackets before exiting the aircraft (see ATSB report BO/200105932). That accident investigation highlighted that regulations governing the use of life jackets, do not reflect the operational realities of exiting from an inverted submerged cabin.

Civil Aviation Order (CAO) 20.11 part 5.1.4 stated that:

Amphibious aircraft when operating on water, helicopters equipped with fixed flotation equipment when operating on water, and all seaplanes and flying boats on all flights shall be equipped with:
(a) 1 life jacket for each occupant; and
(b) an additional number of life jackets (equal to at least one-fifth of the total number of occupants) in a readily accessible position near the exits.

CAO 20.11part 5.1.4 stated that:

Life jackets shall be so stowed in the aircraft that 1 life jacket is readily accessible to each occupant and, in the case of passengers, within easy reach of their seats.

CAO 20.11 part 5.1.8 stated that:

Where life jackets are required to be carried in accordance with paragraph 5.1.4 each occupant of a single engine aircraft shall wear a life jacket during flight over water when the aircraft is operated beyond gliding distance from land or water, as appropriate, suitable for an emergency landing. However, occupants need not wear life jackets when the aircraft is taking off or landing at an aerodrome in accordance with a normal navigational procedure for departing from or arriving at that aerodrome, and occupants of aeroplanes need not wear life jackets during flight above 2 000 feet above the water.

Federal Aviation Administration Advisory Circular (AC) 91-69A contained recommendations and revised information for the safe operation of seaplanes. The AC stated that:

Life jackets in sealed pouches can be awkward to remove and don in a flooded aircraft. When a survivor attempts to put on a jacket in the water, it may be difficult to find and fasten its straps and hooks. It would take considerable effort to accomplish the combined maneuver [sic] of pulling a lifejacket over one's head while in the water trying to stay afloat. If a life preserver is not worn before flight, it is practically impossible for a survivor with an injured arm, for example, to don the life preserver in time for it to be effective for survival. Wearing an uninflated TSO C13f life preserver at all times in the seaplane and inflating it only after exiting the seaplane would seem to be the best protection.

Furthermore, the AC stated that after a seaplane accident:

and especially while submerged inverted in water, the passengers are likely to become disoriented and panic.

It also stated that:

Maneuvring [sic] while holding flotation devices can also be disorienting because it occupies the hands, making swimming or treading water difficult.

Additionally the AC stated in Section 1.b. (1)

For-hire operators must use FAA-approved PFD's. A PFD should be worn by each occupant while on the seaplane.

1. Modern Airmanship, Eighth Edition, Van Nostrand Reinhold Company, New York, 1999.

2. A change of wind velocity with distance along an axis at right angles to wind direction, specified vertically or horizontally. Recognised as an extremely dangerous phenomenon because encountered chiefly at low altitude (in squall or local frontal systems) in approach configuration at speed where it makes sudden and potentially disastrous difference to airspeed and thus lift.

The pilot had experienced difficulty with securing the locker door on previous occasions as it could not be placed into a position that was flush with the fuselage. This created a potential for air flowing under the nose locker door to open it. Damage to the recovered components was not consistent with failure of the lock mechanism; however, failure of the other lock may not be discounted. Given the difficulty in securing the nose locker door, it is likely that it had not been properly secured prior to the occurrence flight.

The main cabin door/locker door warning annunciator was continuously illuminated and was therefore no longer effective as a warning. Consequently, the operational safety intent of the original door warning system design had been negated by the engineering for the modified door.

On 21 January 2005 at about 0830 Eastern Daylight-saving Time, a de Havilland Canada DHC6-200 Twin Otter aircraft, registered VH-JEA, was engaged in commercial skydiving operations at Wilton, NSW, with one pilot and 12 parachutists on board.

The left main landing gear actuator's thrust bearing was very likely incorrectly reinstalled during the recent maintenance of that component. As a result, increased torque was required to rotate the screw jack actuator in order to retract the landing gear. That increased torque most probably tripped the landing gear electric motor's 60 amp circuit breaker during the flight immediately prior to the accident flight. However, in that instance, the pilot was able to manually extend the landing gear.

The torque applied to the screw jack actuator during the functional test before the accident flight was probably below that necessary to trip the 60 amp circuit breaker. In addition, that maintenance action failed to identify the incorrectly installed thrust bearing, and underlying increased torque required to rotate the actuator. When the pilot attempted to retract the landing gear during the accident flight, the increased torque resulting from the incorrectly installed thrust bearing, together with air loads would have combined to overload the systems. The result was that the landing gear electric motor's circuit breaker tripped, and the pilot was unable to either electrically or manually extend the landing gear.

The puncture of the aircraft's fuel tank increased the risk of a post-impact fire, or of another fuel-related hazard during the landing and subsequent emergency disembarkation. Despite the lack of a declaration of a Local Standby condition, the action by the Rescue and Fire Fighting services to board their vehicles facilitated a rapid emergency response.

At about 1512 Western Standard Time on 18 January 2005, a Beech Aircraft Corp B200 (Super King Air) aircraft, registered VH-SGT, sustained damage when its main landing gear collapsed on touch down on runway 24 at Perth Airport, WA. The aircraft had earlier departed the aerodrome on a charter flight with one pilot and seven passengers on board.

The pilot had elected to return to the aerodrome after detecting a problem during the retraction of the aircraft's landing gear. He attempted to manually extend the landing gear but was unable to confirm that the landing gear had locked in position for the subsequent precautionary landing. The main landing gear collapsed as the aircraft touched down.

In the absence of the declaration of a Local Standby condition by either the pilot in command or the Air Traffic (ATS) services personnel, the on-airport Rescue and Fire Fighting services (RFF) were not placed in that condition of readiness for the landing. However, on receiving advice from ATS of the circumstances of the aircraft's return for landing, the RFF services personnel boarded their vehicles in preparation for a possible emergency response.

Examination of the aircraft landing gear by the aircraft operator revealed an incorrectly installed thrust bearing in the hydraulic actuator for the left main landing gear. The result was that the axial loads normally carried by the thrust bearing were transferred to the actuator's pinion gears which fractured under abnormal operational loads. That damage seized the actuator and prevented the manual extension of the aircraft's landing gear by the pilot.

ANALYSIS

The investigation concluded that there was no infringement of separation standards, because the Albury aerodrome controller reported that he maintained a visual separation standard, in accordance with the Manual of Air Traffic Services (MATS), between the Saab and the Dash 8, until the Hume controller advised that he had 'just over 7 miles' between the two aircraft.

The Albury aerodrome controller did not establish a step-climb procedure between the two aircraft in accordance with the terms of the clearance as coordinated with the Hume controller. The aerodrome controller should have advised the Hume sector controller that he was unable to comply with the terms of that clearance. Both controllers could then have coordinated another mutually acceptable clearance before the aerodrome controller transferred control of the aircraft to the Hume controller. The establishment of a step-climb procedure would have ensured that a procedural separation standard continued to exist between the aircraft until such time as the Hume controller established a radar separation standard and accepted responsibility for the aircraft.

The Albury aerodrome controller was required to establish a procedural separation standard between the two aircraft and to have that standard in place before transferring the responsibility for separation to the Hume controller.

The aerodrome controller's use of visual separation technically complied with the separation provisions stated in the MATS for Albury tower procedural separation purposes. However, use of that procedure did not meet the Hume controller's requirements for procedural separation and would not have ensured that separation continued to exist in the event that the aerodrome controller lost sight of one or both of the aircraft. Furthermore, it did not demonstrate 'the proactive application of separation standards to avoid rather than resolve conflicts' as stated in the MATS.

The ability of a sector controller to apply a separation standard using radar may be influenced by factors such as the sector controller's workload, or a failure of an aircraft's transponder, for example. Therefore, aerodrome controllers cannot anticipate when a sector controller may be able to establish a radar separation standard. In the event that the sector controller could not establish a radar standard, the application of an appropriate procedural separation standard that could be used by both controllers would have ensured that separation continued to exist. Such a procedure would have complied with the separation assurance provisions of the MATS.

Technical adherence to the provisions of one separation standard may not guarantee that separation will continue to exist. In this circumstance, the aerodrome controller relied on being able to continue to apply an interpretation of visual separation between the two aircraft until he anticipated that the sector controller could separate the aircraft using radar. While only one separation standard needs to be applied for separation to exist, contingencies such as controller workload and other traffic might preclude the application of another form of separation before the minima of that one standard are infringed. The application of the tactical separation assurance provisions specified in the MATS should assist controllers to anticipate such contingencies and, in doing so, help avoid, rather than resolve, conflicts.

On 17 January 2005, at 0633 Eastern Daylight-saving Time, a Saab Aircraft Company AB SF-340B (Saab) departed Albury Airport on a scheduled passenger service to Sydney, NSW. The aircraft was being operated under the instrument flight rules (IFR). The crew had been authorised by the Albury Tower aerodrome controller to track via Yass on the 043 degree radial from the Albury very high frequency omni-directional radio range (VOR) navigation aid and to climb to flight level (FL) 170. At 0636, a de Havilland Canada DHC-8-102 (Dash 8) aircraft departed Albury Airport on a scheduled passenger service to Sydney, also under the IFR. The crew of the Dash 8 were issued with a clearance by the aerodrome controller to track via the 055 degree radial from the Albury VOR and to climb to FL200.

Aviation Safety Recommendations

| Air Safety Recommendation R20050010 | Air Safety Recommendation R20050011