ATSB response to WA Coroner

On 29 September 2010, the Western Australia Deputy State Coroner, Ms Evelyn Vicker, handed down her findings in the inquest into two deaths arising from a Robinson R22 helicopter accident that occurred on 28 September 2003 near Derby in Western Australia.  The ATSB had previously investigated this accident and published its finding on the ATSB website: ATSB investigation 200304074.  The Coroner fully agreed with the ATSB's findings.

The ATSB's key findings in the helicopter accident were:
1.    The failure of the A166 clutch shaft, involving torsional fatigue cracking, which was due to the inappropriate assembly of the shaft to the A907 yoke.
a.    a non approved jointing compound was used during the assembly; and
b.    the bearing blocks were installed over the painted yoke surface

2.    A loss of main rotor drive which was most likely to have occurred at a combination of height and speed that was insufficient to enable the pilot to conduct a successful auto rotation.

Two recommendations from the Coroner affect the ATSB:

Recommendation 3

CASA [Civil Aviation Safety Authority] seek input from the ATSB as to the reasonableness of mandatory inspection of both yoke and clutch shaft attachments in helicopters operating at low height for evidence of fretting in view of the fact this seems to have been a factor in failure of the A166 component in an R22 in 1992, 2003 and 2005.

ATSB Response:

The ATSB wishes to draw attention to the safety actions on page 10 of the ATSB's accident investigation report.  As a result of an ATSB recommendation on 6 November 2003, CASA issued Airworthiness Directive AD/R22/51 which mandated inspections of the A166 shaft to A907 yoke on all R22 helicopters operating in Australia.

CASA also issued AD/R44/019 on 28 November 2003, mandating the same inspection on those R44 helicopters that had the C166 shaft to C907 yoke disassembled since installation at the factory.

On 7 May 2009 the Airworthiness Directives were cancelled by CASA because the instructions contained in them with respect to mandatory inspections were introduced by Robinson Helicopters into the maintenance manuals for the R22 and R44 models.

The ATSB has been advised by CASA:

"In light of the fact that the relevant maintenance manuals were updated to adequately reflect the maintenance practices required by the ADs, it was considered that the ADs were no longer required and they were subsequently withdrawn.

The ADs were no longer considered necessary because person's performing maintenance on Australian Aircraft are required to do so in accordance with the instructions contained in the applicable approved maintenance data (which includes the manufacturer's maintenance manual) - see r.42V of the Civil Aviation Regulations 1988."

The review of the maintenance manuals for the R22 and R44 helicopters in light of this accident and the findings of the ATSB led CASA to the conclusion that there was a heightened risk of improper maintenance practices being employed in the assembly of the clutch shafts in these types of helicopter. CASA addressed this risk by promulgating the ADs which were later adopted by the Robinson Helicopter Company. CASA considers that this risk is now adequately addressed via the amendments which have now been made to the manufacturer's maintenance manuals for both helicopter types."

The ATSB notes that it is normally CASA that would make an assessment as to the reasonableness of the implementation of a specific recommendation after a safety issue has been identified.  In this instance the ATSB issued the initial recommendation on 6 November 2003.  The ATSB is satisfied with CASA's response that the inspection requirement to address improper maintenance practices is contained in the Robinson Maintenance Manuals and mandated through the application of regulation 42V of the Civil Aviation Regulations 1988.

Recommendation 5

ATSB continue to circulate relevant investigation findings to the industry to remind operators and maintenance engineers manufactures recommendations are made for sound technical reasons.

ATSB Response:

The ATSB wishes to draw attention to section 12AA of the Transport Safety Investigation Act 2003 (TSI Act) which outlines that the ATSB's function is to improve transport safety through means that include:
-    Identifying factors that have contributed to transport safety matters;
-    Identifying factors that might affect transport safety;
-    Communicating those factors to relevant sectors of the transport industry and the public.

Through its investigation and research and analysis activities the ATSB is committed to fostering safety awareness, knowledge and action.  During the course of an ATSB investigation or research project the ATSB works with the relevant sectors of the industry to encourage safety action as safety issues are identified.  The final report is always published on the ATSB's website and hard copies made available as required.  Further, the ATSB regularly issues media releases and alerts to provide notification of the Bureau's activities.

Education materials are also supported and issued by the ATSB.

Cooperation with Coroners

ATSB investigations are conducted with the objective of providing findings that can be used to improve transport safety in the future.  Coronial Inquests are a separate process to the ATSB investigation and they are usually supported by their own investigation and brief of evidence.  However, as Inquests also have the objective of seeking to prevent a death occurring again, the ATSB provides cooperation through the explanation of the ATSB's findings in its report.  The ATSB appreciates the interest of Coroners in working with the ATSB in the interests of improving future safety.

Questions concerning the inquest findings should be directed to the Coroner's Court in Western Australia:
Western Australian Coroner's Court
Level 10
Central Law Courts
501 Hay Street
PERTH WA 6000



 

FINDINGS

The investigation identified the following contributing safety factors.

• The part number A44700-009 roll spoiler actuator, as fitted to TNG, was susceptible to fatigue cracking as a result of deficiencies within the design of the actuator cylinder base
• The actuator ruptured as a result of fatigue cracking initiated due to the design deficiency and the accumulation of a sufficient number of flight cycles
• Rupture of the actuator allowed the loss of fluid contents from the number 2 hydraulic system, and the subsequent failure of that system.

SAFETY ACTION

Aircraft manufacturer

On 18 August 2004, the manufacturer issued In-Service Activity Report (ISAR) 2004-07-2760 advising that it considered the overall risks associated with the failure of the actuator as low, and to raise operator awareness of the actuator failure mechanism.

Transport Canada

Transport Canada, being the certification authority for the Dash 8 series of aircraft, conducted its own investigation of the issues associated with actuator failure. In communication with the ATSB, Transport Canada concurred with the aircraft manufacturer's risk management position and agreed that on the basis of current failure rates, no additional action was warranted.

Australian Transport Safety Bureau

The ATSB reviewed the responses and positions of the aircraft manufacturer, Transport Canada and the aircraft operator in relation to the potential for roll spoiler actuator failure to affect operational safety of the Dash 8. While it supports the risk management approach adopted by the manufacturer and Transport Canada, the ATSB believes that the issue of landing performance limitations imposed by a hydraulic system failure is not adequately addressed by this approach. Therefore, the ATSB issues the following safety advisory notice.

Safety Advisory Notice SAN20050012

The Australian Transport Safety Bureau notifies operators of Dash 8 aircraft fitted with part number A44700-007 and/or A44700-009 roll spoiler actuator components, of the increased risk of the cracking and/or rupture failure of the actuator cylinder section as the actuators accumulate service cycles. Failures have been sustained by actuators with service lives ranging from 27,909 to 41,716 cycles. Cracking or rupture of an actuator cylinder results in the loss of contents and subsequent failure of the associated aircraft hydraulic system. Given that the loss of an aircraft hydraulic system will result in extended landing distance requirements, operators are advised to consider the safety implications of operating affected aircraft to regions where the increased landing distance requirements may not be easily accommodated by available primary or alternate aerodromes.

ANALYSIS

Actuator failure

The investigation determined that the roll spoiler actuator from TNG had failed as a result of the growth of fatigue cracking from within the actuator cylinder. Originating from the internal threads at the end of the cylinder, the cracking propagated under service pressure cycles to a point where it compromised the cylinder wall and subsequently caused the rupture of the housing.

ATSB research found records of 16 actuator failures within the world fleet, of the type and nature sustained by TNG. All such failures had occurred in part number A44700-007 or -009 actuators and all had occurred in units that had accumulated over 27,000 flight cycles. There was no record of failures of the newer part number 1556000-1 actuators.

On the basis of the investigation findings, it was apparent that the design of the A44700-007 and -009 actuators renders the units susceptible to fatigue cracking and failure under service conditions. The nature of design influenced fatigue failures is such that they typically present a range of cycles-to-failure that is characterised by a lower threshold value and an increasing number of failures as cumulative cycles increase. The distribution of known actuator failures reflects these features and as such, it is a reasonable expectation that the number of future failures will increase with the age of the Dash 8 fleet equipped with the A44700 series actuators.

Operational implications

Following the TNG actuator failure and increasing awareness of the actuator deficiencies, the aircraft manufacturer reviewed the issues from a risk management perspective and elected not to pursue any direct course of safety action, on the basis that the probability and risks presented by the events were low. From the information available, it was not apparent whether the aircraft manufacturer, in its decision not to implement any direct safety action, had considered the likelihood of an increasing frequency of actuator failure as the number of component flight cycles build across the fleet. Nor is it known if the manufacturer had considered the performance implications of actuator failure and hydraulic system loss where the aircraft was being operated into areas with limited runway distance availability.

Shortly after reaching a cruising altitude of 12,000 ft (FL120), the flight crew of a de Havilland Canada DHC-8-102 (Dash 8), registered VH-TNG, that was operating a scheduled passenger service from Brisbane to Roma (Queensland), were alerted to the failure and rapid loss of contents from the number-2 hydraulic system. Electing to return the aircraft to Brisbane, the flight crew carried out the relevant quick-reference handbook (QRH) checks, and after some initial difficulty, manually extended the landing gear.

The following factors were identified as significant to the development of the incident.

1. The tail rotor control servo unit developed a hydraulic fluid leak, with some of the lost fluid entering the pitch change shaft bearing space.
2. Migration of hydraulic fluid into the bearing diluted the grease, affecting the lubricant efficacy and producing accelerated wear and break-up of the bearing cage.
3. The bearing grease was soluble in the hydraulic fluid.
4. The bearing was allowed to remain in service following the discovery and rectification of the hydraulic leak.
5. The pitch change shaft inboard (servo end) nut was a conventional ( right-hand) thread, allowing it to be loosened and unscrewed by torque from the rotating tail rotor drive shaft.
6. Disconnection of the pitch change shaft from the servo actuator caused control of the tail rotor to be lost.

The investigation found that the loss of tail rotor control reported by the flight crew of VH-BHY occurred as a result of the disconnection of the tail rotor pitch change servo from the control rod. That disconnection was a direct result of a breakdown in the anti-friction properties of the tail rotor pitch change shaft bearing, allowing the rotational torque along the pitch change shaft to overcome the assembly torque and locking assembly of the servo end shaft nut. The rotating shaft subsequently unscrewed the nut, allowing it to drop into the tail structure from where it was recovered.

The tail rotor pitch change shaft bearing failure occurred as a result of the contamination and dilution of the grease lubricant, leading to the internal mechanical breakdown of the bearing cage and the partial seizure of the assembly. Testing showed that the bearing grease was contaminated by hydraulic fluid, which likely released from a leaking tail rotor servo-actuator unit identified and replaced 22 days before the incident. The bearing was inspected at the time of the leak discovery and was found to be satisfactory for further service. At that time, there was no requirement to change the bearing in the event of the leakage of hydraulic fluid into the bearing space.

History of the flight

At approximately 1715 on 29 August 2003, the crew of a Eurocopter AS332L 'Super Puma' helicopter, registration VH-BHY, being operated on an offshore commuter flight from Karratha, Western Australia, reported feeling a sudden airframe jolt, followed by a pitch up, roll, and a left yawing motion. Finding they had lost tail rotor control, the crew stabilised the aircraft using pitch and roll control inputs, before declaring a MAYDAY to air traffic services. After assessing the helicopter's condition and vibration levels, the crew elected to return to Karratha where a run-on landing could be performed. The MAYDAY condition was downgraded to a PAN and, after assessing the helicopter's performance during a precautionary approach, a safe run-on landing was conducted.

The aircraft was carrying a flight crew of two and six passengers who were uninjured.

Damage to the aircraft

Damage to the helicopter was limited to the tail rotor pitch change assembly and the tail boom lower keel fairing, which had pulled out several attachment screws. During the initial post-incident inspection, the operator's ground maintenance personnel found the nut and lock washer disconnected from the servo end of the pitch change rod, allowing the rod to move freely within the servo body. The nut and washer were subsequently found in the tail structure beneath the tail rotor drive shaft. The rod (P/N 332A33-0043-00) had sustained circumferential gouging and scoring around the surfaces adjacent to the inboard side of the pitch change spider bearing (P/N 330A33-9903-20). The bearing itself showed evidence of gross mechanical failure, with break-up of the ball cage and dislodgement of the outboard and inboard seals. The outboard bearing retention nut and lock washer remained in-place and secure (figure 2).

Aircraft information

Manufacturer Aerospatiale (Eurocopter)
Model AS332L 'Super Puma'
Serial Number 2129
Registration VH-BHY
Year of manufacture 1984
Total airframe hours 13,525 (approx, at time of incident)

Tail rotor assembly information

The Super Puma helicopter tail rotor control was effected by a hydraulic servo-actuator that applies control force to the tail rotor blades via a central shaft and spider assembly. A locking nut and lock washer secured the actuator to the shaft, assembled to a nominal 266 - 443 pound-inches ( 30 - 50 Newton-metres) dry torque. At the spider end, the connection was similar, with a nominal dry torque of 115 - 266 pound-inches (13 - 30 Newton-metres). The Super Puma tail rotor turns in a counter-clockwise direction when viewed from the right side of the aircraft. The securing nut on the servo end of the pitch change shaft had a conventional thread, while the nut on the spider end of the rod had a left-hand thread. Figures 3 and 4 illustrate the tail rotor assembly and pitch change shaft location.

Maintenance history

The failed tail rotor bearing was first fitted to VH-BHY in June 2000, as part of a complete replacement tail rotor gearbox (TRG) assembly. The gearbox, including bearing, had 199 hours time since overhaul (TSO) when installed. Replacement of the pitch change bearing is normally carried out during gearbox overhaul, however documentation to confirm that action was not available to the investigation.

In June 2003, maintenance action was carried out on the gearbox in response to elevated lateral vibration levels recorded by the helicopter's integrated health and usage monitoring system (IHUMS). Subsequently, on 7 August 2003, the tail servo was replaced after the discovery of leaked hydraulic fluid inside the boot between the tail rotor hub and the pitch change spider. It was evident that the fluid had travelled from the tail servo, through the tail rotor drive shaft and into the boot, bringing the fluid into close proximity with the inboard end of the tail rotor pitch change shaft bearing. The gearbox and assembly had accrued 1,888 hours TSO at that time. During the weeks following the hydraulic leak, the pitch change shaft bearing was inspected as required by service bulletin SB05-00-29 Rev. 3 and accepted for further service. At the time of failure on 29 August 2003, the TRG and pitch change shaft bearing had operated for 1,959 hours since overhaul.

Bearing failure

The bearing fitted to the tail rotor pitch change assembly on VH-BHY was a single race, fully sealed ball bearing, manufactured by SNFA, France. The bearing carried the following identifying marks:

330A33990320 8020141 SNFA FRANCE V80I24K14

ATSB laboratory examination of the bearing confirmed the mechanical failure and break-up of the bearing cage, allowing the circumferential movement of the balls relative to each other and the resultant development of abnormal race loading and frictional conditions (figure 5). The bearing internal surfaces were dry and in most places covered with an adherent black compound (figure 6) that was sampled for later analysis. There was no evidence of any viscous bearing grease remaining within the bearing confines. All rolling contact surfaces of the bearing showed bruising and particle indentation damage (figure 7), however there was no indication of spalling or other rolling contact fatigue type breakdown. None of the bearing components showed evidence of gross overheating or frictional seizure. The bearing cage showed gross levels of wear and metal loss in areas exposed to contact with the rolling elements (figure 8 ). Several fracture surfaces showed evidence of fatigue cracking. The external surfaces of the bearing outer race showed fretting corrosion and wear to the extent of seating within the pitch change spider assembly ( figure 9). There was no evidence of circumferential scoring or other indications of race rotation within the housing or on the bearing seat. Traces of light oil were found on the bearing seat. The odour and appearance of the oil were typical of hydraulic fluid.

Bearing construction

The ATSB examined the tail rotor pitch change bearings from two other AS332L helicopters maintained by the same operator. Both of those bearings and their integral seals were found to be in serviceable condition and showed none of the characteristic indications of failure presented by the bearing from VH-BHY. The service lives of both examined bearings were comparable to the failed unit from VH-BHY. A sample of grease from one of the serviceable bearings was subject to a solubility test with a small quantity of hydraulic fluid recovered from the tail rotor servo fitted to VH-BHY at the time of the incident. With a small amount of manual agitation, the grease proved miscible within the hydraulic fluid, producing a liquid with a characteristic viscosity not appreciably greater than the original hydraulic fluid. Weighing the bearing before and after cleaning found the unit carrying 1.88 grams of grease, which the aircraft manufacturer indicated was a nominal quantity.

Bearing contaminant analysis

Samples of the remnant lubricant from inside the failed bearing, the uncontaminated grease from a serviceable bearing and the hydraulic fluid from VH-BHY were forwarded to an analytical laboratory to determine whether any trace of the hydraulic fluid could be detected within the material from the failed bearing.

Results from that analysis confirmed the presence of characteristic spectral peaks from the hydraulic fluid to exist within the remnants of the grease from the failed bearing. These peaks did not exist within the sample of uncontaminated grease from the serviceable bearing.

The incorrect adjustment of the NLG actuator microswitch would not have been readily apparent to pilots of the aircraft, due to the arrangement of the microswitch in series with the NLG overcentre microswitch. As such, all landing gear operation and indications would have appeared normal.

The flat washer installed on the nose gear actuator rod end was significantly different from, and mechanically inferior to, the OEM design intended item. The use of a flat washer on the assembly meant that the locking tang was exposed to considerable sideways loads when the lock nut was being tightened or loosened, as a result of friction between the mating surfaces producing a tendency for the washer to rotate. It is probable that these loads led to the premature failure of the washer tang and the loss of security. The absence of a mechanism for securing locking wire between the lock nut and washer was also anomalous and was further evidence that the use of the installed lock washer was inappropriate.

The lack of adequate security of the lock nut on the actuator rod end would allow the rod end to turn within the hydraulic actuator rod and change the rigged position of the actuator. If the rigging changed to the point where the actuator's internal mechanical locking mechanism was prevented from engaging every time the NLG was lowered, then, combined with external dynamic loads, it would be possible for the NLG to collapse.

Advice from the aircraft manufacturer confirmed that the installation of the incorrect NLG actuator rod-end locking device, combined with a incorrectly adjusted NLG actuator microswitch, could lead to a NLG collapse if the dynamic loads experienced during take-off overcame the overcentre mechanism of the NLG drag brace assembly.

Alternatively, the hydraulic landing gear system power is removed once all three landing gear downlock microswitches are activated. It is also possible that, with the nose landing gear actuator microswitch incorrectly adjusted to the `down and locked' position, hydraulic power was removed from the landing gear system after activation of the two main landing gear down lock microswitches. If this occurred prior to the NLG actuator internal locking devices engaging, the NLG may have been held in the down position by the overcentre mechanism of the drag brace assembly. Had this occurred, then external dynamic loads would be able to collapse the NLG.

From the supplied aircraft documentation, the investigation was unable to determine when the incorrect NLG actuator locking washer was installed or the NLG actuator microswitch was incorrectly adjusted.

On 22 August 2003, a Reims F406 aircraft, registered ZK-VAF, was being operated on a passenger charter flight from Darwin to Tindal, NT. At approximately 85-90 kts during the take-off roll, the nose landing gear (NLG) collapsed. The aircraft slid to a stop, the pilot shutdown the engines and all occupants evacuated the aircraft uninjured. Prior to this occurrence, on 2 and 19 June 2003, pilots reported difficulties obtaining a `down and locked' indication for the NLG. Maintenance actions rectified the problems at that time.

An examination of the aircraft following the NLG collapse revealed that no damage was evident to any NLG components, or the NLG attachment structure. The NLG rigging was checked and reported to be within tolerances. Damage to the aircraft included abrasion damage to the lower forward fuselage and NLG doors. Both propellers were substantially damaged from ground contact.

The NLG hydraulic actuator was removed from the aircraft for further examination by the ATSB and was taken to a specialist hydraulic facility for functional testing prior to disassembly. The actuator passed all required functional tests, however, it was noted that the integral microswitch had been incorrectly adjusted to the point that it did not obtain switchover during operation of the hydraulic actuator. The microswitch was effectively always providing a signal indicating that the actuator was `down and locked'. However, as the actuator microswitch was wired in series with the NLG overcentre microswitch on the aircraft, the landing gear indications would have appeared normal. The aircraft landing gear hydraulic system was powered during landing gear extension, however hydraulic power was removed once all three landing gear downlock microswitches were activated.

Disassembly of the NLG actuator revealed that all internal components were in good condition, with only minor wear evident. The actuator rod-end was noted to have an incorrect locking washer fitted. A detailed examination of the actuator components revealed that the installed locking washer did not conform to the part no. NAS 559-1 locking device specified by the actuator Original Equipment Manufacturer (OEM). Refer to Appendix A, Figure 1.

Comparison against Original Equipment Manufacturer component

An OEM locking device was obtained and compared against the installed washer. The OEM item was a key-like component and utilised a completely different mechanism for securing the assembly from the installed washer. The installed washer was placed between the rod-end and the lock nut and had a small tang that fitted into the rod-end shank keyway, but was not lockwired. The OEM item fitted into the keyway completely, lying underneath the lock nut and engaged with the slotted end of the actuator rod when the lock nut was tightened. The OEM item also provided for the installation of a locking wire between the drilled rod-end lock nut and the locking tab. Refer to Appendix A, Figure 2.

Damage to the installed washer

The washer that was installed to the rod-end assembly showed clear evidence of rotation against the underside of the lock nut and the actuator rod-end face. Two sides of the washer had been bent in opposing directions, against the respective flats of the nut and rod-end. The bent areas showed damage consistent with repeated manipulation and re-bending of the `tabs'. The small locking tang on the internal diameter of the washer had fractured, allowing the washer to freely rotate on the threaded rod-end shank. The fractured key tang was recovered from the rod-end keyway and cleaned to allow stereomicroscopic examination, which showed that the tang had broken away from the washer under sideways bending overload, such as would be produced by forces acting to twist the washer around the rod-end shank.

1. The driver of the catering vehicle became disorientated and entered runway 34L.

When the ADC issued the take-off clearance to the crew of the Airbus, the catering vehicle was a significant distance from both the Airbus and runway 34L. In the circumstances the ADC would have had no indication that the vehicle was likely to enter the runway and pose a potential collision threat to the Airbus.

There was little, if any, action that the ADC could have taken to resolve the situation when it became apparent to him that the vehicle would enter the runway because:

• The catering vehicle was not radio equipped;
• The Airbus crew was committed to the take-off, if not already airborne; and
• Any alert provided to the crew of the Airbus by the ADC may have exacerbated the problem, given the relative position of the aircraft to the vehicle at that time.

While a runway incursion by a vehicle driven by the holder of a category 2 ADA may have been reasonably unforeseeable, this occurrence has identified a significant risk to the safety of operations at Sydney airport.

A means of detecting knowledge gaps and evaluating the ongoing proficiency of qualified drivers may have identified a knowledge deficiency in the area of taxiway and runway markings recognition and in other areas of knowledge that may have contributed to this incursion. Such quality assurance would enable SACL, as the authority responsible for the management and control of surface vehicles operating on, or in the vicinity of, the airside area of the airport, to recognise and address systemic deficiencies in driver competence on an ongoing basis. That would give SACL the opportunity to mitigate any resultant risks.

The driver of the catering vehicle was properly licensed, and had been driving on perimeter roads and apron areas of the airport for two years. Despite her training, the driver may not have been operationally familiar with taxiway and runway markings because she had not operated on runways or taxiways since she obtained her ADA.

None of the training programs included advice to drivers about recommended actions they could take that might assist them should they become lost or disorientated while driving airside. Such a procedure may have reduced the risk of a collision with the departing Airbus in these circumstances by:

• reducing the likelihood of a runway incursion in the first instance; and
• reducing the time the catering vehicle remained on the runway following the incursion.

Sequence of events

On 24 August 2003, at about 0935 Eastern Standard Time, a motor vehicle involved in catering duties on the international apron area at Sydney airport entered runway 34 left (34L) at taxiway Golf without the driver having first received a clearance from air traffic control to enter the runway. At that time, an Airbus A330-341(Airbus) aircraft had just become airborne from runway 34L. The aircraft passed directly over the vehicle while it was on the runway. The runway incursion by the vehicle resulted in an infringement of runway separation standards.

The driver of the vehicle was authorised to drive only on the perimeter roads, airside roads and apron areas. The driver was not aware that she had entered the runway and was not authorised, or trained, to drive on taxiways or runways. The driver eventually realised that she had entered an area of the airport with which she was not familiar. She attempted to return to the apron and was subsequently escorted from the movement area by an airport operations officer.

Sydney Airport Corporation Limited (SACL)

SACL was the airport licence holder and operator of Sydney airport at the time of the occurrence. In accordance with the legislation current at the time of the occurrence, SACL was ultimately responsible for the proficiency of drivers operating airside at Sydney Airport.

Under the Airports (Control of On-Airports Activities) Regulations 1997, part 4, division 4, s124, the airport operator was required to publish an Airside Vehicle Control Handbook (AVCH) for the airport over which it had control. The Sydney airport AVCH contained particulars for the management and control of surface vehicles operating on, or in the vicinity of, the airside area of Sydney airport. The stated 'intent of the requirements for airside operation of vehicles set out in the AVCH [was] to ensure the safe and orderly movement of staff, passengers, aircraft and vehicular traffic'.

SACL was responsible for issuing an authority to drive airside (ADA) to a driver who had an employment requirement to operate a vehicle airside. That responsibility could be delegated to an 'Approved Issuing Authority' (AIA).

'An Approved Issuing Authority is a company or organisation to which SACL delegated the responsibility to carry out the training, testing, and issuance of an ADA for the Airport' and was generally delegated to those organisations that employed airside drivers. SACL maintained overall responsibility for the training and testing standards of Approved Issuing Authorities at Sydney airport. The AVCH stated that AIAs 'must:

• Provide the SACL Manager Safety with reasonable access to its records and premises to enable the SACL Manager Safety to carry out audits to ensure that the AIA is maintaining satisfactory standards in the carrying out of its functions as an AIA; and
• Train and test its employees and employees of its Subsidiaries to drive Airside to the standard required by the SACL Manager Safety'.

Training

Training for a category 2 ADA included information on the recognition of perimeter roadway markings, apron roadway markings, live taxiway crossing markings, runway and taxiway markings. It did not require the driver to be trained in the use of a radio. The catering vehicle was not equipped, nor was it required to be equipped, with a radio suitable for use on an airport to enable two-way communication with air traffic control.

The driver of the vehicle held a current category 2 ADA, having been trained about 2 years previously. A category 2 ADA authorised the driver of an authorised vehicle to operate the vehicle on perimeter roads, airside roads and apron areas of the airport in accordance with the AVCH.

The AVCH specified the prerequisites for applying for the category 2 ADA. They included a requirement for drivers to hold a current State or Territory driver's licence and complete at least 4 hours of driving airside either as an observer or preferably as the driver under the supervision of another driver with at least a category 2 ADA.

Drivers were also required to demonstrate 12 practical and theoretical competencies to an approved training officer.

Category 2 ADA training did not include recommended actions or guidelines for drivers should they become lost or disorientated while driving airside.

Driver reference materials

The airport operator, SACL, produced a pocketbook for use by drivers with a category 2 ADA, and another for use by drivers with either a category 3 or a category 4 ADA. Holders of a category 3 ADA were authorised to operate an authorised vehicle on all movement areas excluding runway strips. Holders of a Category 4 ADA were authorised to operate on all airside areas which included an authorisation to enter a runway strip in accordance with airport procedures. The pocketbooks were intended to be 'a quick reference guide to explain the main rules which apply to all drivers operating airside'. The driver involved in this runway incursion had been provided with a copy of the category 2 driver's pocketbook.

The Category 2 pocketbook did not include recommended actions or guidelines for drivers should they become lost or disorientated while driving airside.

Air traffic control (ATC)

Air Traffic Controllers provided an Air Traffic Service to aircraft on that part of the Sydney aerodrome used for take-off, landing and taxying, excluding the apron areas, for the purpose of preventing collisions between aircraft and obstructions. The aerodrome controller (ADC) was responsible for authorising aircraft, personnel and vehicles to cross a runway or to operate on a runway strip.

The Manual of Air Traffic Services required ADCs to visually scan the length of the runway prior to issuing a take-off clearance and immediately before the take-off is commenced to confirm that the runway was free from obstacles including vehicles and other aircraft. Vehicle operators and pilots were also required to obtain a clearance from ATC prior to entering an active runway, and air traffic controllers operating from the control tower maintained a routine visual surveillance of the manoeuvring area of the airport.

A review of the recorded radar data showed that, when the controller issued a clearance to the crew of the Airbus to enter the runway, the vehicle was in the vicinity of bay 59 on the international apron. That was approximately 2.78 km from the Airbus and approximately 0.83 km from the intersection of taxiway Golf and runway 34L. When the Airbus commenced its take-off roll, the vehicle was near the intersection of taxiway Golf and taxiway Yankee. That was approximately 2.77 km from the Airbus and 0.5 km from the intersection of taxiway Golf and runway 34L.