History of the flight

The Airbus A330-341 aircraft was operating a scheduled international fare-paying passenger service from Adelaide to Melbourne and the pilot in command was the handling pilot for the flight. During the initial descent into Melbourne, the crew configured the auto flight system to the approach mode. That action armed the auto flight system localiser and glideslope modes for the runway 16 instrument landing system (ILS), and permitted the crew to engage the second autopilot for the approach. As the aircraft descended through 2,500 ft, the crew placed the ground spoiler handle to the armed position. Shortly after, the radio altimeter indications disappeared from both pilots' electronic flight instrument displays. Both autopilots then disengaged. About 20 seconds later, both flight directors disengaged from the localiser and glideslope modes but re-engaged in the basic modes of current vertical speed and heading.

The pilot in command elected to continue the approach and to manually fly the aircraft, because he considered that he would be able to control the aircraft without auto flight system approach commands or radio altimeter information. The autothrust was unaffected by the disengagement of the autopilots, and remained engaged.

At the completion of the landing approach, the pilot in command flared the aircraft for the landing, and retarded both thrust levers, which disengaged the autothrust system. The aircraft landed on the left and right main landing gears, bounced, and became airborne for four and a half seconds before touching down again on both main landing gears. The aircraft bounced again, became airborne for one second, and then touched down for a third time on both main landing gears. The right main landing gear then lifted off the runway for about one second, after which the aircraft settled onto both main landing gears. Two seconds later, the thrust levers were advanced to go-around power, and after a further five seconds, the aircraft became airborne again. The nose landing gear remained airborne throughout this sequence. Additionally, the ground spoilers did not deploy, and the thrust reversers did not activate.

The pilot in command repositioned the aircraft for another approach onto runway 16. During the second landing, the aircraft again bounced following the touchdown, then settled onto the runway. Four seconds later, the ground spoilers deployed; however, the thrust reversers did not activate when selected by the crew. The landing rollout was completed without further incident, and the aircraft was taxied to the terminal.

There were no injuries to any persons on board the aircraft.

Aircraft information

The aircraft was a fly-by-wire type. Three flight control primary computers and two flight control secondary computers controlled the flight control system. The computers processed crew and autopilot inputs to provide appropriate electrical output signals to the hydraulically powered flight control surfaces.

Crew input to the flight control computers was made via electrical signals from either of the two side stick controllers, and autopilot input was made via an interface with the aircraft's Flight Management and Guidance System.

The inputs to the flight control computers were processed in accordance with respective flight control 'laws'. Regardless of the pilot's inputs, the control computers will prevent excessive manoeuvres and/or exceedance of the safe flight envelope. Those laws were dependent on whether the aircraft was in the ground, flight or flare mode of flight. In the ground mode, there was a direct relationship between sidestick deflection and the flight control surfaces. In the flight mode, deflection of the flight control surfaces was governed to achieve a load factor proportional to sidestick deflection, independent of speed. Flight mode provided 3-axis control of the aircraft, and provided flight envelope protection and manoeuvre load alleviation.

In the flight mode, the normal laws were:

• Nz law for pitch control, including load factor protection. (Nz law is vertical acceleration in the normal axis of the aircraft);
• lateral normal law for lateral control (roll and yaw), including bank angle protection; and
• protection against high speed (VMO), pitch angle (theta), and stall (angle of attack).

In flare mode, the normal laws were:

• flare law in place of Nz law for pitch control to allow for conventional flare;
• lateral normal law for lateral control (roll and yaw) including bank angle protection; and
• protection against stall.

Flare mode permitted crews to use the same landing technique as for non-fly-by-wire aircraft. Transition from flight mode to flare mode occurred when the aircraft's radio altimeters sensed that the aircraft altitude was less than 100 ft above ground level.

If faults were detected in both radio altimeters, switching from flight mode to flare mode would occur when the landing gear was extended, provided the autopilot was off. If the autopilot was engaged, switching from flight mode to flare mode would occur when the autopilot was disengaged, provided the landing gear was extended.

The manufacturer reported that flight tests for the A330 type included landing in flight mode. ie without transition to flare mode. Landing in that condition was not considered difficult, however, it required a different handling technique than would otherwise apply for non-fly-by-wire aircraft. In such circumstances, a pilot would need to apply back pressure on the sidestick to initiate the landing flare, then release that back pressure to maintain the desired pitch attitude until touchdown.

The aircraft was equipped with two radio altimeter systems that provided information about the aircraft height above ground level. Data from the radio altimeters was also used by many of the aircraft systems' logic sequences to determine whether certain operating parameters had been met to permit operation of a particular system. The radio altimeter antennas were located along the keel of the aft fuselage of the aircraft, and were connected to the aircraft electronic system by coaxial cables. Inspection of the radio altimeter system antennas subsequent to the occurrence revealed that they had sustained water ingress at the antenna coaxial cables. The water ingress into the radio altimeter antennas resulted in the radio altimeter signals being interpreted as out of range signals, rather than as a failure of the radio altimeters.

During the period 11 June 2001 to the date of the occurrence, there were 19 entries in the aircraft's maintenance log reporting problems with the radio altimeters fitted to the aircraft. Repairs had been carried out on the radio altimeters, including replacement of a transceiver unit and cleaning of components due to water ingress.

The aircraft was equipped with autoflight and flight director systems. Radio altitude signals from the aircraft radio altimeters were used to engage the autoflight system into the LAND mode when the aircraft altitude was 400 ft above ground level. The loss of valid radio altimeter signals in LAND mode would result in the loss of both autopilots and the flight directors reverting to the basic modes of vertical speed and heading. The autopilot also used radio altitude signals to adapt the autopilot gains during an ILS approach, with the required gain being dependent upon the distance of the aircraft from the runway threshold. Any involuntary disconnection of the autopilot triggered an AP OFF INVOLUNTARY warning message to the crew.

The aircraft was equipped with wing mounted ground spoilers. The ground spoilers would arm when the crew placed the speed brake control lever to the armed position, and would activate after landing provided certain parameters had been met. Those parameters included both main landing gears transitioning from flight to ground ('weight on wheels'), and a radio altitude of less than 6 ft or a wheel speed higher than 72 kts on the front and rear wheels of the main landing gears.

The aircraft's engines were equipped with thrust reversers. Deployment of the thrust reversers would not occur unless the aircraft was on the ground with the ground spoilers extended, radio altitude less than 6 ft, and the engine thrust levers in the reverse position.

The aircraft was equipped with an Allied Signal solid state digital flight data recorder. The recorded data was examined and revealed that each of the flight control primary and secondary computers had operated normally throughout the flight. The recorded data revealed that during both approaches, the autopilots oscillated in the lateral and longitudinal axes.

Both autopilots disconnected simultaneously, but an AP OFF INVOLUTARY warning did not accompany the disconnection. The LAND mode engaged at 400 ft radio altitude. One second later, both flight directors disengaged from the localiser and glideslope modes, then re-engaged in the basic modes of current vertical speed and heading. The recorded data also revealed that the signals from both radio altimeters were invalid throughout most of both approach sequences into Melbourne.

The investigation was unable to determine the relevant experience and training of the crew.

The Bell Jetranger 206B (III) helicopter was engaged in aerial firefighting operations utilising an external water bucket and staging out of a nearby national park campground. The pilot reported that he started flying at approximately 0750 EST after completing a pre-flight check of the helicopter which included draining the fuel sump, inspecting the fuel and confirming 106 L or 27.9 United States Gallons (USG) of total indicated fuel. At approximately 0825, while engaged in water bucket operations, he discussed his fuel status with other company pilots on a common radio frequency and noted 38 L (10 USG) of indicated fuel remaining. He finished a swath run of the fire area, dropping water and then decided to complete one more swath run before returning to refuel.

Approaching the fire line, the helicopter entered a left turn at approximately 200 ft above ground level (AGL). The pilot reported that the helicopter was buffeted by strong turbulence, which caused the helicopter to yaw left and go out of trim. He reported that the engine power then began surging and, subsequently, an engine flameout occurred. He continued the left turn, jettisoned the water and initiated a power-off autorotation to a heavily wooded area.

During the autorotation, the helicopter's main rotor blades contacted nearby trees, damaging the blades and displacing the main rotor transmission. The helicopter then came to rest on its right side, on a 45 degree slope. The pilot exited the helicopter and was picked up by another company helicopter and transported to hospital for observation. The pilot suffered minor injuries and the helicopter was substantially damaged. There was no evidence of any in-flight or post-accident fire.

The pilot reported that he had no recollection of any illuminated caution advisory lights during or prior to the event, or of the position of the switches and circuit breakers of the fuel boost pumps. He stated that he followed flight manual checklists when starting the helicopter and preparing for takeoff.

Wreckage examination

The helicopter sustained damage to the main rotor blades and controls, main rotor transmission, transmission to engine driveshaft, tail rotor driveshaft, pilot's perspex and right side forward fuselage. Examination of the engine revealed no external damage or damage to the compressor.

Fuel system examination and background

After the helicopter was repositioned upright, the fuel gauge indicated approximately 19 L (5 USG). The fuel in the fuel tank was examined and appeared to slightly cover the base of the fuel boost pumps. Examination of the airframe fuel filter revealed full fuel in the filter bowl and no contamination. Examination of the engine fuel filter revealed a small amount of fuel and no contamination. The forward fuel boost pump circuit breaker was noted as disengaged.

Unusable fuel was defined as, `Fuel that cannot be used in flight with wings level and at cruise angle of attack (or nose 3 degrees up)'. Of the total fuel on board, 4 L (1 USG) were unusable. Upon removal from the accident site, the helicopter's fuel system was drained and 23.5 L (6.2 USG) of fuel were removed. The fuel correction card annotated, `gauge indicates 38 L (10 USG) for an actual of 45.6 L (12 USG)'. The fuel correction card values were verified by adding measured amounts of fuel.

An option on that model helicopter was a FUEL LOW caution advisory light that illuminated with approximately 76 L (20 USG) of total fuel remaining. The helicopter was not equipped with that advisory light. It was equipped with two electrically operated submerged fuel boost pumps located in the fuel cell and connected in parallel to the engine's fuel supply line. Those pumps were located on the helicopter's centre-line. Both boost pumps were examined following the accident and they were determined to be serviceable.

Fuel consumption

According to the operator's operations manual, the fuel consumption rate of the Bell 206B (III) helicopter was 110 L (28.9 USG) per hour. In the 35 minutes of operating time that the pilot reported prior to the accident, approximately 64 L (16.8 USG) of fuel should have been consumed, leaving approximately 30.8 L (8.1 USG) of useable fuel remaining. That amount should have been sufficient for approximately 17 minutes of engine operating time.

Engine auto-reignition

The helicopter was not fitted with an optional engine auto-reignition system. Because of the low height AGL at the time of the engine surging and flameout, the pilot did not have an opportunity to attempt a manual restart of the engine.

Engine testing

The Rolls-Royce Allison model 250-C20B engine, serial number CAE 840551, was removed from the helicopter and transported to an engine test cell for testing. Following motoring and priming, the engine started on the first attempt with Turbine Operating Temperatures, N1 (gas generator speed) and N2 (power turbine speed) values within normal operating parameters. Engine deceleration and acceleration tests were conducted in order to simulate power changes experienced during flight. The results of the testing indicated that the engine was serviceable at the time of the accident.

Helicopter manoeuvring in turns and flight manual requirements

During coordinated turns, centrifugal force acting on the helicopter and fuel tank causes the fuel to collect evenly in the bottom of the fuel tank. It is then available for pick up by the fuel boost pumps at the boost pump inlets and through to the inlet of the main fuel supply line and to the engine. During uncoordinated turns, centrifugal force may not displace the fuel to the bottom of the tank evenly and instead fuel sloshing may take place.

The helicopter's flight manual contained a warning regarding flight with one fuel boost pump inoperative. It stated, `Due to possible fuel sloshing in unusual attitudes or out of trim conditions and one or both fuel boost pumps inoperative, the unusable fuel is ten [US] gallons'.

Component testing

The forward fuel boost pump circuit breaker was removed and tested. Aircraft system 28 DC voltage was applied and varying amperes were introduced to the circuit breaker in an attempt to determine its serviceability. The circuit breaker operated normally up to its rated 10 ampere rating with no anomalies noted.

Pilot's shoulder harness

The pilot's left shoulder harness had broken and separated at a point just forward of and below the pilot's shoulder. The manufacturer's date stamped on the harness belt was March 1973. The pilot's seat belt had an inspection tag attached with the inspection date 11/99 annotated. Details of the inspection were not annotated in the helicopter's documentation.

Pilot shoulder harness testing

The pilot's left shoulder harness was sent to an independent belt and harness testing and repair organisation for testing. The webbing was identified as MIL-T-50368 Type IV, 2 inch Nylon Webbing, rated at 2,000 pounds strength. The rated assembly strength of the harness assembly was 1,500 pounds. Testing revealed that the webbing failed at a value of 391 pounds, or less than 20 percent of the original strength of the material. Factors contributing to the loss of original strength were ageing related to ultraviolet light exposure, abrasion damage and contamination by turbine oil.

Seat belt and shoulder harness standards

Australian Civil Aviation Order (CAO) Part 108, Section 108.42, contained specifications for aircraft safety belts (seat belts), harnesses (shoulder harnesses) and inertia reels manufactured in Australia. Contained within CAO Part 108, Section 108.42 was a reference to Technical Standard Order (TSO)-C22g, which specified minimum performance standards of aircraft seat belts when new.

CAO Part 108, Section 108.42, also contained a reference to British Air Registration Board (ARB)/Civil Aviation Authority (CAA) Specification Number four (issue two). That document specified minimum performance standards for British manufactured aircraft shoulder harnesses when new and was not applicable to equipment manufactured in the United States of America (USA) such as the separated harness in this occurrence.

The Australian Civil Aviation Safety Authority (CASA) Airworthiness Directive, AD/RES/29 amendment 1, mandated identification of aircraft seat belts to indicate that the part was an item approved by the manufacturer. Part of that directive mandated appropriate identification to demonstrate compliance with CAO Part 108, Section 108.42.

The helicopter was manufactured in 1979 in the US under the requirements of the US Federal Aviation Administration (FAA), Federal Aviation Regulations. FAA Technical Standard Order (TSO)-C22g (amended 1993) outlined minimum performance standards for aircraft seat belts when new. TSO-C114 (initial issue 1987) outlined minimum performance standards for aircraft torso restraints (shoulder harnesses) when new. Prior to 1987, there were no requirements for shoulder harnesses. Only TSO-C22 was in effect when the occurrence helicopter was manufactured.

At the time of the occurrence, there were no requirements to confirm compliance to applicable design standards of shoulder or seat belt harnesses while in service, or to specifically identify shoulder harnesses.

An Aero Commander Division 500-S (Shrike) had departed runway 35 at Essendon aerodrome. The pilot had been issued a clearance to overfly Melbourne airport and then track to Fentons Hill Very High Frequency Omni-direction Radio Range navigation (VOR) beacon, 10 NM north of Melbourne, and to climb to 3,000 ft. A Boeing 767-336 (B767) was on final approach to runway 27 at Melbourne and passing 1,400 ft on descent, when the crew received a Traffic Alert and Collision Avoidance System (TCAS) traffic advisory (TA) with an aircraft 600 ft below. The TCAS then issued a resolution advisory (RA) indicating an aircraft 300 ft below. The B767 crew initiated a TCAS climb and conducted a go around in accordance with company operating procedures.

The clearance issued to the Shrike pilot was in accordance with an overhead Melbourne departure procedure. That procedure had been implemented to facilitate departures from either runway 26 or 35 at Essendon aerodrome when there were arrivals to runway 27 or 34 at Melbourne. A letter of agreement between Melbourne tower and terminal, and Essendon tower detailed the procedure, including coordination requirements and separation responsibilities. The procedure relied upon the application of either radar, visual, or procedural separation being applied by the Melbourne or Essendon Aerodrome Controller subject to a number of conditions. The procedure was limited to a few approved Essendon operators.

The Shrike pilot had planned a flight from Essendon to Shepparton, about 80 NM north-northwest of Melbourne. The pilot reported that he had selected the transponder code and switched the unit to "On" prior to departing. Once airborne, and after transferring to the Melbourne Aerodrome Control frequency, he was advised that the transponder was not operating. The pilot was sure that the indicator light on the transponder was operating. He recycled the transponder.

The B767 crew first saw the Shrike on their aircraft's TCAS as they passed 3,000 ft on final approach. After the RA, it disappeared from the TCAS as the B767 passed 2,000 ft on climb. The crew was subsequently vectored for a landing on runway 34 via a left base. During the go around, cabin crew in the B767 saw the Shrike pass below and make a right climbing turn.

After the B767 pilot reported going around, the Melbourne Aerodrome Controller instructed the Shrike pilot to turn right and to pass behind the B767. The Melbourne Aerodrome Controller was not required to issue the B767 crew with traffic information on the Shrike.

The Melbourne Aerodrome Controller was using visual separation procedures to separate the aircraft. Visual separation enabled controllers to provide less vertical or lateral displacement between the aircraft than what would be required using a radar or vertical separation standard. Aerodrome controllers regularly used visual separation procedures to separate aircraft in the vicinity of aerodromes.

The TCAS is an independent on-board collision avoidance system that continually surveys the airspace around an aircraft, seeking replies from other aircraft in the vicinity via their transponders. The system determines the range, relative bearing, and relative altitude of other aircraft and uses that information to predict flight paths. If a flight path is predicted to penetrate the collision area surrounding the TCAS fitted aircraft, the system informs the crew by visual and aural annunciations. Depending on the closure speed TCAS issued either a RA or a TA alert.

Analysis of recorded radar data during the investigation revealed an inconsistency in the altitude readout from the Shrike. As the B767 descended between 1,500 ft and 1,400 ft, the Shrike's altitude changed from 1,250 ft to 736 ft and then to 1,650 ft over a 35 second period. A second altitude inconsistency was recorded after the RA alert. The investigation did not establish the reason for the inconsistent altitude readout. The operator of the Shrike reported that transponders could require up to five minutes warm-up prior to operation.

The recorded radar data showed that, at the closest point of approach, the Shrike was about 1.5 NM to the south and 300 ft below the B767. That was just as the B767 commenced the go around. At about the same time, the track of the Shrike changed from north-westerly to northerly.

The Agusta/Bell 47G-2A1 helicopter departed from Maroochydore airport at about 1420 Eastern Standard Time (EST) on a solo navigation exercise. The pilot intended to track via Somerset Dam, Kenilworth, Nambour and return to Maroochydore under the Visual Flight Rules (VFR), with an expected enroute flight time of about 1.9 hours. A flight plan was not submitted to Airservices Australia by the pilot. However, a flight notification form was retained by the company for search and rescue (SAR) purposes. Shortly before take-off, the pilot was cleared by the Maroochydore Tower controller to track direct to Somerset Dam via The Big Pineapple initially at 1,500 ft above mean sea level (AMSL).

Air Traffic Services (ATS) primary radar intermittently tracked the helicopter at a position 7 NM northeast of the accident location about 40 minutes after departure. The primary "paint" ceased about that time and location. A witness reported seeing the helicopter near the northern side of Mount Archer at about 1515 EST and flying in a manner consistent with the pilot experiencing controllability difficulties. A subsequent aerial search located the wreckage at a position about 1 NM right of the direct track from Maroochydore to Somerset Dam and on the north-north-eastern slope of Mount Archer. The helicopter sustained severe impact damage. The pilot received fatal injuries.

Some notes containing pre-flight navigation planning calculations and small pieces of the perspex cockpit bubble were found several hundred metres before the accident site. The notes contained navigation calculations that did not take into account the forecast enroute winds. Personnel at the flight training school did not recall discussing at length the forecast weather conditions with the pilot and, in particular, they did not recall briefing the pilot about the forecast mountain waves prior to the navigation exercise. The personnel at the flight training school also reported that helicopter pilots had been flying throughout the day in the Maroochydore region without experiencing any controllability difficulties induced by the forecast and actual strong winds.

The ATSB investigation team did not attend the accident site but viewed video footage and police photographs of the wreckage. The video footage had been recorded by the search and rescue helicopter crew at the time the wreckage was located. Damage to the helicopter structure was extensive and the tail boom was severed. According to the search and rescue helicopter crew, the helicopter's emergency locator transmitter (ELT) did not activate. The pilot also carried a portable ELT but it was damaged during the impact and did not activate.

The pilot held a Student Pilot Licence and a Restricted Private Pilot (Aeroplane) Licence. At the time of the accident the pilot had accumulated a total of 72.5 flying hours in helicopters, including 21.5 hours on Bell 47G helicopters. The pilot's aeroplane flight time records were not available to the investigation.

At the time the accident report was compiled, the pilot toxicology and autopsy results were not available. Consequently, the investigation was unable to comment on whether the pilot's performance was adversely affected by any pre-existing physiological condition.

There were no known maintenance deficiencies and the helicopter was considered capable of normal flight prior to the accident.

A Bureau of Meteorology (BOM) area forecast, issued at 1338 EST on the day of the accident, indicated isolated severe turbulence and mountain waves below 9,000 ft. The BOM examination of the available data indicated that the wind between 1,000 ft and 5,000 ft above ground level (AGL) in the Mount Archer area was constant with height at about 250 degrees True in the range 25 to 30 kts. The surface wind speed was estimated to be around 15 to 20 kts with frequent gusts in the range 25 to 30 kts. The relative orientation of the ridge and wind direction were conducive to mountain waves and possible rotor effects (see Attachment A) to the northeast of Mount Archer. The helicopter impacted terrain on the north-north-eastern slope of Mount Archer. The search and rescue helicopter pilot's report of actual meteorological conditions in the vicinity of the accident site was consistent with the BOM forecast.

Initial video and photographic evidence indicated that the helicopter probably encountered severe turbulence from mountain waves or rotors in flight while approaching the lee of Mount Archer. The evidence suggested that the main rotor blades may have severed the tailboom approximately 1 m forward of the tail rotor assembly. This accident signature is consistent with excessive blade flapping. The evidence indicated that a divergence of the main rotor blade from its normal plane of rotation probably occurred as a result of severe turbulence generated by mountain wave or rotor activity, and a main rotor blade contact with the tailboom and cockpit area ensued, resulting in a loss of control of the helicopter.

It is also possible that the collective lever friction may have been overcome by the severe turbulence that caused the non-powered collective lever to suddenly drop. The collective lever drop would have induced a sudden nose down attitude and this may have caught the pilot by surprise. The pilot may have instinctively and rapidly applied aft cyclic to correct the aircraft's attitude. The rapid application of aft cyclic in this situation may have been sufficient to induce main rotor blade contact with the tailboom.

A further discussion of mountain wave phenomena is provided in Attachment A.

Shortly after landing at Perth and taxiing clear of the runway, the crew of the Metroliner observed smoke accumulating and increasing in intensity in the cockpit. The crew stopped the aircraft on the taxiway, shutdown the engines, notified air traffic services of the problem and commenced disembarkation of the aircraft. After the passengers had safely disembarked, the pilot in command re-entered the aircraft and observed that, with the engines stopped, the smoke had begun to dissipate from the cabin and cockpit.

The operator's maintenance investigation found that the right air cycle machine (ACM) had leaked oil into the air conditioning system, that had then entered the cabin as smoke and fumes. The ACM turbine had seized. The Chief Engineer reported that the company conducted a fleet wide analysis to see if a failure trend could be identified for the ACM units. They determined that the Metro fleet had used a total of ten ACM's since 1999, with six being used by the incident aircraft alone. The usage was evenly distributed between left and right installations of the units. The conclusion was that the air delivery system to the ACM's might have a partial blockage leading to the premature failures.

An external examination by the operator's engineers found damage to the left engine turbine blades and shrapnel damage to the exhaust nozzle. The operator removed the engine and sent it to an approved workshop for examination and repair. The Australian Transport Safety Bureau (ATSB) did not attend the examination, but requested that all damaged components be forwarded to the ATSB for detailed examination.

After the engine was disassembled, the ATSB was advised that the engine failure was precipitated by a failure of the turbine first stage disc rotating air seal. The rotating air seal's outer rim was missing and the downstream turbine components received damage consistent with fragments of the rotating air seal passing though the turbine. The failed rotating air seal, the first, second and third stage turbine wheels and nozzle guide vane assemblies were forwarded to the ATSB for further examination.

Engine and component history

The Allied Signal TPE331-12UHR-701G turboprop engine, serial number P-70210, had accumulated 9,139.8 hours and 15,585 cycles since new and 3,066.9 hours since overhaul. In May 1997, it had Allied Signal service bulletin TPE331-72-2002 incorporated, which detailed replacement of the inner baffle with a new inner baffle part number 3108039-2. Service bulletin TPE331-72-2030, that detailed replacement of the compressor interstage seal assembly support, was incorporated in July 1999, at 6,073 hours, during engine overhaul, after overhaul, the engine was installed into DMI where it remained until the failure.

The rotating air seal, part number 3103839-3, serial number 2-23315-945, appeared to have been installed in the engine since new as its time and cycles since new were identical to those applicable to the engine. During the engine overhaul in 1999, it was inspected in accordance with the requirements current at that time and found serviceable.

The ATSB was advised that cracking of the rotating air seals had occurred in the past, but that it was rare to see a cracked rotating air seal on engines that have the requirements of the engine manufacturer service bulletins TPE331-72-2002 and TPE331-72-2030 incorporated.

Rotating air seal examination

The examination of the rotating air seal and other components from the failed engine is detailed in the ATSB's technical analysis report number 40/01. The examination revealed that the entire outer rim of the rotating air seal had separated from the flanged section. About seventy percent of the rim circumference was recovered and most material from the outer ten millimetres of the plate flange was lost.

One location, where the loss of material was substantially greater, exhibited a short length of fracture showing evidence of fatigue crack propagation. Heat tinting over the area of fatigue indicted that it was present prior to the event failure. The seal had no evidence of material or manufacturing anomalies.

Examination of the turbine components

The turbine disks and nozzle guide vane assemblies showed evidence of random impact damage to the blade leading edges. The damage was consistent with the separated pieces of the failed rotating air seal passing through the turbine.

A copy of the ATSB's technical analysis report, number 40/01, is available on the ATSB web site at or from the ATSB on request.

Engine manufacturer's action

The engine manufacturer reported a number of documented in-flight shutdowns due to separation of the rotating air seal plate rim. Their investigation into the events concluded that cracking in the rim area was due to elevated rim operating temperatures, primarily due to hot gas leakage from deteriorated first stage stator assembly hardware. To alleviate the problem, the manufacturer introduced service bulletins TPE331-72-2002 and TPE331-72-2030 and revised the engine maintenance manual to improve inspection of the relevant components at hot section inspection with the intention of preventing hardware prone to gas path leakage from returning to service.

Shortly after take-off, and in accordance with standard procedure, the flight crew selected engine bleed air as the source of air for the aircraft's two air conditioning packs. Subsequently, the cabin staff reported a strong smell of fumes in the cabin. As there was also a smell of fumes entering the flight deck, the flight crew donned their oxygen masks in accordance with the non-normal procedure for suspected cabin air contamination.

The flight crew then proceeded to identify the source of the fumes using a contamination source location schedule. That procedure involved selecting different combinations of engine air and air conditioning packs. During normal operation, bleed air from engines one and two was fed to pack one, which in turn supplied conditioned air to the flight deck and cabin. Bleed air from engines three and four was fed to pack two, which normally only supplied air to the cabin. Additionally, bleed air from the Auxiliary Power Unit (APU) was used by either pack during the take-off and landing phases or when air conditioning was required during ground operations. It was determined that with pack two selected off, the fumes dissipated. The flight was continued with only pack one supplying conditioned air to the cabin and flight deck. The two cabin staff and several passengers were affected by the fumes with symptoms of sore eyes, sore throat and headache.

On arrival of the aircraft in Brisbane, a Licensed Aircraft Maintenance Engineer (LAME) addressed the reported defect in accordance with the Civil Aviation Safety Authority airworthiness directive AD/BAe146/086 and the British Aerospace Systems Information Service Bulletin (ISB) 21-150. The ISB required certain actions to be performed whenever a cabin air quality problem was identified which was suspected of being associated with oil contamination of the air supply from the air conditioning packs. The engineer's inspection of the air conditioning system, engines and APU revealed no signs of oil contamination or oil leaks. The defect was therefore cleared and the aircraft resumed service.

The following day, the same aircraft but with a different crew was involved in a similar occurrence. A strong smell of fumes was noticed, mainly in the cabin, during the cruise. The flight crew donned oxygen masks as a precautionary measure. Symptoms of sore eyes, sore throat and headache were reported by both the crew and passengers. The pilot in command, who had been affected by fumes on previous occasions, received medical attention after landing.

Engineering inspection revealed oil contamination in the number 3 engine bleed band. The defect was deferred in accordance with the aircraft's approved Minimum Equipment List that allowed the aircraft to be flown with only the number one air conditioning pack in use. No further fumes were evident during following flights. Subsequent engineering investigation of the number 3 engine revealed that the oil leak was a result of a worn number one bearing seal. The number 3 engine was replaced, and the defect was cleared.

Evidence from previous incidents of air system contamination on this type of aircraft had indicated that the fumes were associated with engine or APU oil contamination of the air conditioning system. As a result, operators have incorporated various modifications to the cabin air system, APU, and engines. They have also introduced improved maintenance practices to further address the issue. However, that action has not completely solved the problem. The air supplied to the air conditioning packs was protected from contamination by oil seals in the engines and APU. A technical defect arising in one of the seals can result in oil entering the cabin air conditioning system, with the first signal of the defect being an awareness of fumes by the members of the crew. The difficulty of identifying the origin of the contamination is exacerbated by the often-intermittent nature of the fumes events.

A Boeing 737-377 (B737) was inbound to Canberra for a landing on runway 35. The crew had established the aircraft on the extended runway centreline from 10 NM (18.5 km). At approximately 4 NM the aerodrome controller (ADC) instructed the crew that they were clear to land. As the aircraft was about 1.85 km from the runway threshold, the ADC saw a truck enter taxiway Delta. Taxiway Delta was approximately 1427 m from the threshold of runway 35. The ADC considered that the truck was unlikely to stop and instructed the crew to go around. The crew acknowledged the instruction and conducted a missed approach, a left circuit and then landed.

The driver of the truck had entered the runway strip without a clearance and had not complied with procedures. Later analysis of recorded radar data showed that the B737 had descended to 310 ft above the aerodrome elevation during the approach and go around.

Air traffic control

The air traffic control tower operating positions faced south-south-west, overlooking the Royal Australian Air Force (RAAF) Fairbairn aircraft apron, the intersection of the runways and the runway 35 threshold. The tower had three operating positions: ADC, tower coordinator (COORD) and surface movement controller (SMC). The ADC operating position was situated on the north-western end of the console with the COORD to the left and then the SMC position on the south-eastern end of the console. All positions were staffed at the time of the occurrence. The COORD and SMC saw the truck approaching and enter the apron from the south before turning left onto taxiway Delta. The ADC was conducting the final scan of runway 35 prior to the B737 landing when the SMC advised that the truck was going to enter the runway. Simultaneously, as the COORD suggested to the ADC to instruct the crew to go around, the ADC issued the instruction to the B737 crew.

The SMC saw the truck stop on taxiway Delta, after crossing the holding point and entering the runway strip, and then reverse as the B737 went around. The SMC notified an airport safety officer who then drove to Delta and spoke to the truck driver.

Runway 35/17

Runway 35/17 was bounded by the runway strip that was an area around the runway, up to 75 m either side of the runway centre line and included the runway clearways that extend 60 m from the thresholds. The purpose of the runway strip was to reduce the risk of damage to aircraft inadvertently running off the runway and to protect them when flying over it during take-off, landing or missed approaches. Gable markers indicated the limit of a runway strip. On taxiways the limit of a runway strip was marked as a holding point. A clearance from air traffic control was required before personnel, vehicles or machinery could enter a runway strip. Personnel, vehicles or machinery were normally excluded from a runway strip when a runway was in use or a pilot had a clearance that enabled an aircraft to use the runway.

Runway 35/17 was 45 m wide and the position the truck reached before stopping could not be accurately established. Reports from the driver and witnesses indicated that the truck reached a position somewhere between 35 m to 65 m from the runway centreline.

Canberra airport works

Canberra airport was halfway through a period of major works to construct:

- 7.5 m shoulders on runway 35/17;
- a turning node on the northern end of runway 35/17;
- drains along runway 35/17; and
- widened turn fillets at runway/taxiway intersections for runway 35/17.

The works also included the replacement of runway lights.

The airport operator had awarded the contract to a company that had recently completed similar major works at another capital city airport. That company was the prime contractor (contractor) and the task was scheduled for completion by 31 August 2001. Planning was fast tracked to meet the schedule and both the airport operator and the contractor believed it was achievable. The truck driver's company was a sub-contractor to the contractor.

Management of the works site was a joint responsibility between the airport operator and contractor. The contractor was responsible for managing the works area while the airport operator was responsible for managing the interaction of works and airport activities.

A method of work plan (MOWP) was prepared by the airport operator and was provided to the contractor to assist in the development of their work method statement and project management plan. The airport operator reviewed the project management plan. The MOWP detailed how areas would be delineated to ensure airport users and contractor activities did not conflict. The airport operator also arranged for aeronautical information circular (AIC) H7/01 to be issued on 14 June 2001. The AIC detailed the scope of the work during the four work stages, operational restrictions required during each stage and advised that the dates and times of activation of each stage would be advised by a notice to airmen (Notam). The AIC included draft Notams for each stage.

The contractor was working on stages 1 and 2. The MOWP stated that taxiway Delta would be unavailable during stage 2 between 2200 Eastern Standard Time and 0600 (overnight hours). The MOWP did not have any restrictions on the use of taxiway Delta during the period from 0600 to 2200 (daylight and early evening hours). Seven Notams, that described the work stages and the operational restrictions, were current at the time of the occurrence. Those Notams were in accordance with the MOWP except there was no Notam regarding taxiway Delta overnight.

The airport operator prepared and conducted a site induction brief for the contractor and associated sub-contractor staff prior to commencing the work. That briefing included aspects of site safety including movement of persons and vehicles, "no-go" areas, contractor vehicle routes and that contractor staff were to comply with any directions from an airport safety officer. Following the initial induction, the contractor assumed responsibility for ensuring that all persons employed on the works underwent a one hour induction briefing and that copies of the induction brief were made available to staff. The contractor was also responsible for maintaining a record of the staff who had been briefed. Those records indicated that the truck driver had received an induction brief on 27 June 2001. The truck driver later reported that he was aware of the need for vigilance when working on the airport and had often consulted the maps provided that detailed approved routes for works vehicles and staff.

Effect of the works on runway 35/17

A displaced threshold for runway 17 had been imposed to enable work on the northern end of runway 35/17. Taxiway Alpha, parallel to the runway and taxiway Foxtrot that linked Alpha and the runway were both closed to aircraft operations for this stage. The runway 17 displaced threshold was located south of taxiway Foxtrot.

The contractor had implemented a new route for works vehicles for the current stage of works. The route had been used for 10 days by trucks to cart soil from the runway 17 undershoot (at the northern end of the runway 35/17) to an area outside the airport at the south-western end (adjacent to the southern end of the runway 35/17). That route was marked with stanchions and used taxiways Foxtrot and Alpha, across the intersection of Alpha/Delta and the RAAF apron, along a gravel road parallel to runway 30, around the eastern end of runway 30 and then along the perimeter fence to the dump area. The route was sign posted with a speed restriction of 40 kph with a reduction to 25 kph in the area near the runway 30 threshold.

The segment of the route across the intersection of taxiway Delta and the RAAF apron was not marked. The contractor considered that the gap in markers at Delta was sufficiently small for staff to appreciate route continuation, and that the intersection was referred to in the induction brief and was marked on the maps. Taxiway Delta remained open to enable aircraft to use the RAAF apron. There was no restriction on vehicles crossing taxiway Delta but generally drivers of vehicles stopped or slowed when approaching that taxiway to check for aircraft before continuing.

Truck driver

The truck driver had been on the site for five weeks and generally worked a 12-hour day. Prior to the week of the occurrence he had had four days leave as a result of rain that prevented work being carried out. He had little previous experience of operating on airports. He had worked from 0700 to 1900 Eastern Standard Time on Monday, 0630 to 1730 on Tuesday and had started at 0600 on the day of the occurrence. The truck driver was supervising two work teams. One team was at the northern end of runway 35/17, while the other team was working outside the eastern runway strip near the intersection of runways 35/17 and 30/12. He started the team at taxiway Alpha near the northern end of runway 35 and then commenced a task himself at about 1700 in the northern area. Shortly after, he received a request to provide equipment to the team near the runway intersection. He drove to the north-western boundary of the airport to get the equipment and then travelled via the northern and eastern route to the team's location. He delivered the equipment and was returning to the northern area when he drove onto taxiway Delta and entered the runway strip.

The truck driver reported that he had a lot on his mind at the time. His last break had finished at 1330. The truck driver knew that he had insufficient time in which to complete the job he had started and that he had to supervise the clean up by his teams before finishing work that afternoon. He had been warned to watch for aircraft and consequently, whenever he was crossing a taxiway, would check for aircraft. As he turned onto taxiway Delta he was watching the approaching B737 through the passenger's window of the truck but thought he was turning onto the northern works area via taxiway Foxtrot. He became aware that there were no markers in the area and that he was on the wrong taxiway. He stopped the truck and reversed as quickly as possible off taxiway Delta back onto taxiway Alpha. The truck driver reported that he had used the designated route about 25 times previously on the day of the occurrence.