Skip to main content

British Aerospace Plc BAe 146-200A, VH-JJX

Safety Action

The operator replaced both right wing aileron trim cables and chains on the aircraft. As a result of this incident the operator carried out an aileron trim cable inspection of its fleet of twelve BAe146 aircraft. Notable corrosion in the rib 14 pulley area was found in both wings of another aircraft. All aileron trim (wing loop) cables of that aircraft were subsequently replaced.

On 27 July 2000 the operator issued an Engineering Release (ER) that required a more thorough inspection of aileron trim cables for corrosion at each C check. The inspection aimed to ensure that any hidden corrosion at pulley locations did not pass through major checks undetected. Inspection highlighted the need to operate flight controls over their complete range of movement allowing inspection of cable obscured by pulleys. The ER also called for cleaning and lubrication of cables, paying particular attention to the lengths of cable passing through the pulley bank.

Summary

During climb-out from Darwin, passengers on the British Aerospace Bae146 advised the cabin manager that about 3 metres of cable was trailing from the trailing edge of the right wing. After the first officer had conducted a visual inspection, the crew advised Darwin ATC that they had a problem and required a return for landing. Fuel was burnt off to achieve maximum landing weight. Controllability checks found no handling problems with the aircraft, which was landed safely.

An inspection identified the trailing cable as an aileron trim cable (upper). Failure of the cable had occurred at the outboard pulley located at wing rib 14. The cable was found to have failed as a result of significant corrosion between the pulley bank and the wing rear spar. Corrosion was also present on the failed cable coinciding with the location of the inboard pulley at wing rib 14. No corrosion was found on the left-wing aileron trim cables. Previous inspection of the area was reportedly carried out during a 6C check in May 1999, 3,495 flight hours earlier.

The aileron trim cable material was zinc coated carbon steel (MIL-W-83420, Type 1, Composition A). Stainless steel trim cables were not available from the aircraft manufacturer.

No other reported failures of BAe146 aileron trim cables were found in a search of the Civil Aviation Safety Authority major defect and ATSB incident databases. The operator advised that corroded cables and seized pulleys at that location had been recorded on various BAe146 aircraft since 1992. The aircraft maintenance manual required special attention for corrosion during inspection of cable sections in contact with pulleys.

Occurrence summary

Investigation number 200002622
Occurrence date 22/06/2000
Location 28 km E Darwin, Aero.
State Northern Territory
Report release date 25/05/2001
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Aviation occurrence category Flight control systems
Occurrence class Incident
Highest injury level None

Aircraft details

Manufacturer British Aerospace
Model BAe 146
Registration VH-JJX
Serial number E2127
Sector Jet
Operation type Air Transport High Capacity
Departure point Darwin, NT
Destination Gove, NT
Damage Minor

Fairchild SA227-DC, VH-ANY

Safety Action

Local safety action

The Darwin Australian Defence Air Traffic System software was upgraded on 14 June 2000 to allow a "second look" access to controllers at each console.

Significant Factors

  1. The Brisbane sector controller did not ensure separation between two aircraft that were on his radio frequency and in airspace that was under his jurisdiction.
  2. The Brisbane sector controller did not provide a "no restrictions" hand-off to the Darwin controller.
  3. The Darwin approach trainee authorised a level change without ensuring separation.
  4. The introduction of a software change that would have enabled the Darwin trainee to view the relative positions of the aircraft, was scheduled for implementation the day after the occurrence.

Factual Information

History of the flights

A Metroliner had departed Darwin on a flight to Dili, East Timor. The crew had climbed to flight level (FL) 180 and were maintaining that altitude. They had been under the control of Darwin Air Traffic Control for the first 60 NM and had transferred to Brisbane Control in accordance with normal procedures. They had established two-way radio communication with Brisbane sector control.

The Airbus A330 (A330) was on a flight from Kuala Lumpur, Malaysia to Darwin and the crew had commenced descent to FL210 in accordance with instructions from Brisbane Control.

When the A330 was approximately 97 NM from Darwin, the crew requested further descent. The Brisbane controller immediately activated the intercom line to Darwin Approach and informed the Darwin controller of the position of the A330. The Metroliner was 81 NM from Darwin at that time.

The Darwin controller, who was under training, only had access to a 60 NM radius display screen. He had already handed off the outbound Metroliner to the Brisbane controller and authorised descent to FL 120 for the A330 in the belief that the Brisbane controller would separate the two aircraft. The trainee was not immediately aware of the relative positions of the aircraft as the conflict was not shown on his display.

The training officer immediately realised that separation had not been assured by the coordination interaction and looked to one side where he had set up a second screen display on an adjacent console. He had selected a greater range scale on the console, that showed the position of the two aircraft. As he was briefing the trainee on urgent action to remedy the situation, the crew of the A330 reported on the Darwin Approach radio frequency that they were on descent to FL120. While that radio exchange was occurring, the trainee had selected the longer range scale on his console and the display had now appeared on his screen. It showed that the aircraft were approximately 9 NM apart in a nose-to-nose conflict. He immediately issued an amended instruction to the crew of the A330 to maintain FL190. The crew was able to carry out that instruction before the vertical separation standard of 1,000 ft was infringed.

A few moments later the captain of the Metroliner saw the A330 pass immediately overhead. He reported that there was insufficient time to draw the co-pilots attention to the aircraft before it passed. He was of the opinion that there would have been insufficient time to initiate an evasive manoeuvre if it had been required.

The A330 crew saw the Metroliner but took no action as the aircraft were obviously going to miss. The traffic alert and collision-avoidance system was serviceable but did not activate.

Radar analysis indicated that the aircraft passed with approximately 1,300 ft vertical separation but with no horizontal difference.

At the Brisbane sector console, the short term conflict alert activated approximately 20 seconds prior to the time of passing. The controller immediately checked the radar display and found that a separation standard was being applied by Darwin approach control and took no further action.

Darwin approach control

The Darwin approach unit controlled airspace to 60 NM, in the north-west quadrant, up to and including FL200. At the time of the coordination from Brisbane sector, both aircraft were outside those parameters and, therefore, not subject to direct control by Darwin.

Local procedures required that arriving aircraft be assigned no lower than FL210 by Brisbane Control. Therefore Darwin Control was required to approve any further descent despite the aircraft being in Brisbane's airspace. When the Brisbane controller coordinated the position of the A330, the trainee read into the tone of the voice that a request was being made for further descent even though the actual words used did not state that intent. The trainee was not immediately aware of the confliction because it was outside his area of jurisdiction and not within the range of his selected display. The trainee also had the impression that, as the aircraft were in Brisbane's airspace, he was only approving descent in Darwin's airspace and that the Brisbane controller was still responsible for the separation of the aircraft.

Radar hand-off was the subject of a specific instruction in the Manual of Air Traffic Services Supplement (MATS Supp) which stated: "Aircraft handed off by radar between Darwin ATC and Brisbane/Tindall Sectors shall be subject to `no restrictions' unless otherwise advised."

The adjacent console was not in use and had been positioned so that the controllers could view the display screen, albeit at a distance of 2 - 3 m. The range was selected at a longer distance than the 60 NM in use at their primary screen. That selection meant that the position of the aircraft could be seen but the details in the information blocks could not be read. A software change was scheduled for introduction the next day that would have allowed the trainee to view the longer range (second look) on his own console rather than having to look across to the second screen.

When the trainee had approved descent for the A330, the Brisbane controller de-selected the intercom line before the training officer could intervene to cancel the approval. The training officer immediately briefed the trainee to maintain the A330 at FL190 because he expected the crew to change frequency quickly as, in his experience, they normally did. The training officer was prepared to go back to Brisbane via the intercom line, but the broadcast by the crew of the A330 made that option redundant.

Brisbane sector control

The controller coordinated the position of the A330 with Darwin Control and expected an instruction from Darwin regarding descent. When they issued approval for FL120 he assumed that they were separating the aircraft, even though he thought that he may not have looked at his display at the time of carrying out the coordination and may have, momentarily, overlooked the actual position of the Metroliner. He then issued the descent instruction and told the crew to change radio frequency to Darwin Approach.

Shortly after, the short term conflict alert activated and the controller immediately checked the display. He saw that there was no infringement of separation standards and took no further action.

The controller had been rated on The Australian Advanced Air Traffic System (TAAATS) for 4 months but had just returned from a month's leave. He received 2 days familiarisation and had performed 4 active shifts prior to the occurrence. He stated that he was well rested and that the workload was moderate. However, he said that he was a bit `rusty' and that the 2 days familiarisation was a bare minimum for adequacy.

Short term conflict alert

The activation of the alert was to warn the controller that the aircraft were predicted to pass within 600 ft and 4.1 NM. Analysis of the performance of the alert indicates that it operated in accordance with the parameters and provided approximately 20 seconds warning of the conflict.

Analysis

Airspace management

The general control technique to ensure separation on this route was for Darwin to assign FL200 (or below) for departures and for Brisbane to only assign FL210 for descent; therefore ensuring the 1,000ft separation standard.

In accordance with MATS Supp, when an aircraft was handed off from one controller to the other, that aircraft shall be subject to "no restrictions" unless otherwise stated. In the case of the A330, the Brisbane controller had not mentioned any restrictions for its descent and had, therefore, incorrectly coordinated the aircraft with Darwin. Darwin Control had correctly coordinated the Metroliner with Brisbane Control and had transferred the crew to the Brisbane controller's radio frequency before that aircraft had left their area of responsibility. As the Metroliner had passed outside 60 NM from Darwin, it was under the control of the Brisbane controller. Had the crew of the A330 been slow with their radio frequency transfer, neither controller would have been able to prevent the A330 descending through the level of the Metroliner.

Darwin approach control

The trainee controller made a decision to allow the A330 further descent based on a belief that the Brisbane controller would separate the aircraft that were in that controller's airspace. However reasonable that belief may have been, the approval left open a possibility for an infringement in separation standards. Phraseologies to ensure separation were available and would have clarified that the descent was subject to the Brisbane controller's separation of the aircraft.

The intended action of the training officer was appropriate and timely, but the broadcast from the crew of the A330 made his plans redundant.

Had the software change that was to be implemented the next day been available at the time, the trainee would have had a better opportunity to see the relative positions of the aircraft and, therefore, observe the developing air traffic situation and take more appropriate action.

Brisbane sector control

When the response from Darwin Control was for descent to FL120, the controller accepted the level and issued descent to that level to the crew of the A330 when the aircraft were approximately 16 NM apart and with a closing speed of approximately 12 NM per minute. Irrespective of the response from Darwin, the Brisbane controller still had responsibility for separation of the aircraft outside the 60 NM arc and the aircraft were obviously going to pass in that controller's airspace. The controller also had both aircraft on his radio frequency and the instruction to the crew of the A330 gave away both separation and radio contact. However, the crew of the A330 made a timely and successful change of frequency to the Darwin controller. Had this transfer taken longer to take place, the only solution would have been for the Brisbane controller to issue emergency instructions to the crew of the Metroliner. As the controller had considered that Darwin were separating the aircraft at the time of issuing the A330 descent, it is unlikely that such action would have been taken in time.

Summary

A Metroliner had departed Darwin on a flight to Dili, East Timor. The crew had climbed to flight level (FL) 180 and were maintaining that altitude. They had been under the control of Darwin Air Traffic Control for the first 60 NM and had transferred to Brisbane Control in accordance with normal procedures. They had established two-way radio communication with Brisbane sector control.

Occurrence summary

Investigation number 200002485
Occurrence date 13/06/2000
Location 167 km NW Darwin, Aero.
State International
Report release date 02/11/2001
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Occurrence class Incident
Highest injury level None

Aircraft details

Manufacturer Fairchild Industries Inc
Model SA227
Registration VH-ANY
Serial number DC-840B
Sector Turboprop
Operation type Air Transport Low Capacity
Departure point Darwin, NT
Destination Dili, East Timor
Damage Nil

Aircraft details

Manufacturer Airbus
Model A330
Registration 9M-MKC
Sector Jet
Operation type Air Transport High Capacity
Departure point Kuala Lumpur, Malaysia
Destination Darwin, NT
Damage Nil

Cessna 172P, VH-THO

Summary

The privately operated Cessna 172 was being used to muster cattle on a station near Halls Creek in Western Australia. One of the station workers said that the pilot reported by radio that he had found some cattle in timber country that he could not move. The worker, who was not aviation qualified, advised the pilot to "bomb them". He meant the pilot should fly low and scare the cattle. About 2 minutes later, he heard a bang and saw a cloud of dust about 500 m to the east, but did not see the accident. The pilot was fatally injured. The ATSB did not conduct an on-site investigation into the accident.

The wreckage trail extended about 22 m from where the aircraft had hit a tree and just 12 m from where it first hit the ground. An inspection of the wreckage revealed no pre-existing mechanical fault that may have contributed to the accident.

The pilot was inexperienced; having a total of just over 400 flying hours, acquired over about 10 years. He had about 330 flying hours in aeroplanes, of which about 125 hours were in command or in command under supervision. Although the pilot finished training for the mustering qualification about 1 month before the accident, at that time he had insufficient in-command flying hours to apply for an approval from the Civil Aviation Safety Authority (CASA). Subsequently, the pilot conducted several flights with the station manager, who was a qualified mustering pilot, to gain sufficient flying hours for the approval. He applied for a mustering approval 8 days before the accident, but the CASA representative advised the pilot that there would be a delay in processing the paperwork and issuing the approval. The CASA representative reported that she also advised him not to conduct mustering until the approval was issued. The station manager reported that the pilot did not tell him of the CASA advice.

According to the station manager, the pilot began flying mustering operations as the pilot in command the day after the documentation was submitted to CASA. The station manager also said he thought that the pilot had received sufficient guidance and training to operate in the conditions on the day without supervision.

The approved pilot who trained the pilot to conduct mustering operations reported that the pilot was an excellent student who seemed eager to please. He also reported that during training, the pilot appeared to be overly concerned about achieving required standards within a certain amount of time. The station manager also reported that the pilot appeared to be very eager, with an unquestioning approach to learning the job.

The weather report indicated that wind conditions at the time were fresh and gusty from the east with a significant wind shear in the lower levels. The wind speed at 2,000 ft above sea level was 22 kts, and at 3,000 ft was 46 kts. The surface wind at the time of the accident was reported to be about 15 kts, but had become blustery and gusting to about 35 kts within about an hour of the accident. Consequently, it is likely that the wind strength and direction were variable and unpredictable at the heights at which the pilot was operating.

In the absence of any associated aircraft mechanical fault, the evidence was consistent with the pilot losing control of the aircraft while manoeuvring at low level in adverse wind conditions. The pilot's eagerness and lack of experience may have influenced him to operate the aircraft in a manner inappropriate for the weather conditions at the time.

Occurrence summary

Investigation number 200002383
Occurrence date 14/06/2000
Location 100 km E Halls Creek, Aero
State Western Australia
Report release date 08/12/2000
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Aviation occurrence category Collision with terrain
Occurrence class Accident
Highest injury level Fatal

Aircraft details

Manufacturer Cessna Aircraft Company
Model 172
Registration VH-THO
Serial number 17275223
Sector Piston
Operation type Private
Departure point Flora Valley Station, WA
Destination Flora Valley Station, WA
Damage Destroyed

British Aerospace Plc BAe 146-300 , VH-NJL

Summary

The co-pilot reported that during the BAe 146 handover, the previous crew stated that the aircraft had an air-conditioning contamination problem and that it appeared to emanate from the No. 2 air-conditioning pack. On entering the aircraft the co-pilot noted that only the No. 2 pack was operating and the ambient air was contaminated. The crew switched off the No. 2 pack until the engines were started and the aircraft had taxied to the runway holding point.

After take-off, the co-pilot reported that he began to feel nauseous and had developed a headache. After discussing the problem with the aircraft captain, he donned an oxygen mask and gradually felt better. During the flight, a flight attendant entered the cockpit and reported a soreness of the head, and that she felt nauseous.

On the return flight, the crew left the No. 2 pack switched off. They reported that the contamination was far less noticeable than the previous flight.

Inspection by the company maintenance personnel did not initially find any evidence of contamination. However, the co-pilot reported that subsequent replacement of the aircraft auxiliary power unit appeared to have rectified the air contamination problem.

Occurrence summary

Investigation number 200002431
Occurrence date 30/04/2000
Location 56 km N Perth, Aero.
State Western Australia
Report release date 20/11/2000
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Aviation occurrence category Air/pressurisation
Occurrence class Incident
Highest injury level None

Aircraft details

Manufacturer British Aerospace
Model BAe 146
Registration VH-NJL
Serial number E3213
Sector Jet
Operation type Air Transport High Capacity
Departure point Perth, WA
Destination Paraburdoo, WA
Damage Nil

Airbus A320-211, VH-HYX

Safety Action

R20000285

As a result of the investigation the Australian Transport Safety Bureau recommends that Airservices Australia develop risk management protocols that improve its ability to recognise and track controllers' fitness for operational duty.

Significant Factors

  1. The crews were not using the same air traffic control frequency at the same time.
  2. An assessment of the controller's fitness for duty did not include due consideration of the cumulative effects of stress.
  3. The controller was probably unaware of the harmful effect of stress on individual performance.
  4. The management of staff by a number of different managers did not aid Airservices Australia to readily identify the controller's fitness for duty.
  5. The operation of traffic alert and collision avoidance systems and aircraft secondary surveillance radar transponders by the crews were valuable defences for the aviation system.

Analysis

There were opportunities for both crews to be alerted that they were assigned the same level. However, these were missed because:

- the B767 crew had been instructed to monitor the Woomera sector frequency and did not hear the controller approve the A320 crew to climb to FL280,
- the controller's transmission about the A320 interrupted the B767 crew's on-frequency report that would have included their level,
- the controller did not include the assigned level for the opposite direction aircraft in the sighting and passing report transmission to both crews, and
- the presentation of system data reinforced the controller's view that vertical separation had been applied between the aircraft.

High levels of stress can increase the likelihood of individuals failing to complete actions or recognise a situation. For example, stress promotes slips and lapses by narrowing the focus of attention. Slips most often occur when an individual is performing an automated task in familiar surroundings, but is distracted by external events or internal thoughts. A preoccupation with personal problems can divert attentional resources, particularly at times of low workload. Such conditions are ideal for inducing a slip.

The controller's inability to appreciate the use of the wrong level and its relationship with his traffic management plan, and the indicators available to him from the air traffic system was consistent with him being preoccupied. An increased state of stress was probably the prime reason for the lack of concentration or preoccupation by the controller. This then led him to instructing the A320 crew to climb to the wrong level and causing the separation standard to be infringed. This was consistent with the controller's stressful state while under a low workload.

Research literature on occupational stress strongly supports giving priority to person-job fit issues as a strategy to prevent work stress. Also, a change to the work environment has the potential to cause health problems if not managed well. Airservices Australia had not been able to address the controller's concerns about occupational opportunities. Nor were they able to either understand or reduce the controller's increasing reaction to these stressors. The result was an organisational climate that contributed to the controller's stress levels. Concurrently, the controller had significant difficulty adjusting to the changes in vocational circumstances. These organisational and personal factors combined to produce increased stress in the controller.

The impact of stress on the controller's performance was one that needed consideration and action as advised in the CATSOAM. Airservices knew the controller had personal and vocational problems but seemed unable to reduce the individual's occupational discontent. It is probable the change in management staff during the TAAATS transition limited the organisation's ability to recognise the extent of the controller's stress and consequent potential effect on safety. This lack of organisational understanding and the use of various managers, in addressing the issues, may have limited the centre manager's ability to decide on the controller's fitness for duty. Without a full understanding of the controller's situation and current susceptibility to stress related conditions the manager had to assess whether the controller was able to work. The ability to readily access a controller's complete history or the use of a protocol, that ensured vocational and personal details were considered with any commensurate safety risk, would have enabled the manager to make a more informed decision. As it was, the centre manager tried to mitigate the situation by briefing the flight information region manager and the team leader. However, the flight information region manager and the team leader lacked a full understanding of the situation and were less able than the centre manager to assess the controller's fitness for duty.

Had either a more encompassing risk protocol or a better system of monitoring a controller's career been in place it is likely the cumulative stress from the controller's job discontent, the two recent unfavourable briefings and his family problem would have been recognised. If there had been a better understanding of either the controller's situation or the potential risk to safety, the centre manager would have probably removed the controller from duty until a formal evaluation of fitness for duty was done.

Accurate work and rest times were not available to assess the level of fatigue for the controller but it is likely the controller was tired before the occurrence. The controller's overall heightened stress, preoccupation and fatigue made him unlikely to be capable of making a coherent and rational decision about his fitness for operational tasks.

Radio facilities to enable crews under the jurisdiction of the Alice Springs sector to maintain continuous radio communications with that controller would reduce the possibility for similar events.

Summary

A Boeing 767 (B767) was en route from Sydney to Jakarta, Indonesia, on the two-way air route A576 and was estimating overhead Alice Springs at 1255 Central Standard Time at flight level (FL) 280. The crew of an Airbus Industrie A320 (A320) taxiing at Alice Springs had also flight planned via A576, in the opposite direction to the B767, for Sydney. The A320 crew had planned the flight at FL370 but the Alice Springs sector controller, operating from the Melbourne air traffic control centre, intended to issue a clearance of FL270 to the crew. This would have provided the required 1,000 ft vertical separation standard between the A320 and the B767. The A320 departed at 1218 on climb initially to FL200 and the crew contacted the controller at 1225. The controller entered FL270 in the air traffic system but told the crew to climb to FL280. The crew correctly read back FL280.

The estimated time of passing of the two aircraft was 1237. The controller told both crews the opposite direction aircraft was 1,000 ft above or below them respectively and to report sighting the other aircraft. At 1236 the A320 crew reported to the controller that they were descending because of a traffic alert and collision avoidance system resolution advisory. The controller acknowledged the report and then queried the B767 crew about the traffic alert and collision avoidance system event. The B767 crew confirmed that their aircraft's systems had received a traffic alert and collision avoidance system resolution advisory to climb.

Later analysis of aircraft data showed that both aircraft had been maintaining FL280 on reciprocal tracks. The combined closing groundspeed of the aircraft was 920 kts and they were about 9 NM apart when the traffic alert and collision avoidance system activated. As the crews complied with the resolution advisory the A320 crew saw the B767 pass above them when the vertical spacing and lateral distance between the aircraft was 900 ft and 0.5 NM respectively. There was an infringement of separation standards.

Controller background

The controller had over 10 years experience in en route and five years in tower control. Following a staff rationalisation exercise the controller reluctantly moved from Moorabbin to the Melbourne centre in mid-1998. Since that time, he had experienced increasing levels of stress because of:

- dissatisfaction with career opportunities,
- problems with undertaking night duty,
- personal problems with supervisory staff,
- unsuccessful applications for positions in the tower, and
- a recent diagnosis of the critical illness of a family member.

For example, on the day before the occurrence the controller was told that he had again been unsuccessful in a recent selection exercise for positions in the tower or terminal area streams. This was a source of stress to the controller.

Day of the occurrence

The controller reported that he did not have breakfast because of the early start and woke at 0400 after about 5 hours sleep. He began work at 0530. He later said he felt "somewhat tired" on the day of the incident and that he did not feel his limited period of sleep influenced his performance. Individuals suffering mild to moderate fatigue are generally unaware of decreasing levels of performance.

This was to be the controller's last working shift before starting leave. The controller had been approved to take 2 weeks leave to be able to be with his family because of the illness of the family member.

About 3 hours before the occurrence the controller was relieved at the position to enable him to meet with the centre manager. The centre manager advised that a claim of harassment by the controller had been investigated and was dismissed. This information distressed the controller. The centre manager told him to take time to compose himself before going back to the console or operations room. During this exchange the controller advised the centre manager of the strain he was under because of the recent diagnosis of a family member with a terminal illness. Before this meeting the centre manager was unaware of the illness in the controller's family. The centre manager told him that he didn't have to return to the console - it was his choice.

Airservices' Australia (Airservices) Civil ATS Operations Administration Manual (CATSOAM) provides guidance material on stress awareness for Airservices' staff. It states in part that "routine tasks with monotonous or minimum workload can cause some people to run over previous events or issues and, if they have been unpleasant or difficult, then concentration on the task being performed may deteriorate". It also warns that "stress is cumulative and can affect performance at work" and includes a caution that "professional guidance should be sought in case of doubts concerning mental state and fitness for work". With illness, injury or medication the manual places the onus on individuals to ensure that they are able to undertake rostered duties. It states, "a person having any doubt about their fitness to perform at the correct level for a full tour of duty must tell the appropriate supervisor. They should be stood down from operational duties until they feel fit to resume duty, or until the matter has been resolved by a medical practitioner".

The controller later reported that he had felt similarly distraught on other occasions and had performed satisfactorily and believed he would be able to do so again. Also, he felt that he had little choice but to return to the operator position. The controller spent 30 to 40 minutes recovering from the meeting and returned to the position after an absence of about 90 minutes.

The centre manager advised the flight information region manager in the operations room and the controller's team leader of the outcome of the meeting. The centre manager briefed the flight information region manager to stand the controller down from operational tasks should there be any doubt about that individual's ability to control. The flight information region manager saw the controller on two occasions during the 40 - 50 minute period following the return to the operating position. The flight information region manager's impression was the controller was managing the position and did not need relief.

Organisational issues

During the last decade, there has been an increased rate of organisational change within Airservices. This has led to increased changes in work practices and a tendency toward expanding many job roles through multiskilling.

Research shows that perceived major causes of stress in Australian workplaces include the rate of change and poor organisational communication. Similar factors were also reported during the investigation.

Despite the strong influence of organisational climate factors on employee stress levels, operational demands also contribute to psychological stress. Also, stress is more likely to be reported where morale is lower than normal.

During 1998 and 1999 the Melbourne Centre was undergoing significant change in preparation for and during the transition to The Australian Advanced Air Traffic Control System (TAAATS). Because of this change, during late 1999 and early 2000 the controller had five different managers. The management of the controller within the centre was such that operational, health and career management and other issues were handled by a number of different managers. This arrangement relied on a high level of coordination and communication between managers for each to maintain an understanding of the progress of staff specific issues. The investigation did not establish the degree to which the controller's issues had been passed on to the relevant individuals during the changeover in management staff.

Air traffic system

Alice Springs sector is a non-radar sector that uses procedural control methods to separate aircraft. Controllers use a combination of a presentation of aircraft positions on an air situation display and lists of electronic flight progress strips to manage and separate aircraft. The air traffic system updates aircraft positions based on limits, including aircraft performance data, meteorological data and the flight data record created for each flight from a flight plan. Controllers update aircraft flight data records after receiving position reports from flight crew.

The label for each aircraft depicted on the air situation display includes a field for operational data. After the controller had been told the A320 had left Alice Springs he annotated the operational data field to show the crew had planned at FL370 and that an amended level of FL270 was needed. When the A320 crew reported on frequency, the controller selected FL270 in the cleared flight level field of the label but told the crew to climb to FL280. When the crew read back FL280 the controller did not detect the error and accepted FL270 in the aircraft's flight data record. Shortly after, the controller deleted the amended FL270 note from the operational data field. Later analysis of the recorded data confirmed the controller had correctly entered FL270 into the system but had issued a wrong level, FL280, to the A320 crew.

The controller had a similar event with a Boeing 737 that left Alice Springs five minutes after the A320 on the same route. The crew of this aircraft also needed to be assigned FL270 to ensure separation from the B767. The controller initially assigned FL280 but corrected it to FL270 during the same radio transmission to the B737 crew. The B737 crew sought clarification of the assigned level from the controller and the controller confirmed the required level was FL270

Pilot - controller communication

Because of very high frequency (VHF) radio coverage limits, air traffic controllers needed to tell crews to change frequency at a position about 250 NM south-east of Alice Springs when operating below FL310. As the B767 was at FL280 the controller told the crew to transfer to 132.9 Mhz, which was a frequency, used by the adjacent Woomera sector. This was to ensure that the crew maintained VHF communications with Melbourne centre. Responsibility for the separation of the flight remained with the Alice Springs sector controller while the crew was monitoring the Woomera sector frequency. The Alice Springs sector controller could not monitor 132.9 Mhz. During the period the crew were monitoring the Woomera sector they did not hear the Alice Springs sector controller tell the A320 crew to climb to FL280. Shortly after, the B767 crew returned to the Alice Springs sector frequency.

The Manual of Air Traffic Services (MATS) states that a reply to a voice call shall consist of the identification of the calling unit, the identification of the called unit and the words "Go ahead" or "Standby" as appropriate. However, while "communications should normally start with a call and reply, when reasonably sure that the call will be received, the calling unit may go ahead without waiting for a reply". In a situation similar to this occurrence, the resulting report from a crew would include the altitude or level being maintained. However, following the B767 crew's on-frequency report the controller immediately told them to report sighting and passing the A320. The controller did not ask nor did the crew report the flight level being maintained.

Occurrence summary

Investigation number 200002379
Occurrence date 09/06/2000
Location 222 km SSE Alice Springs, (VOR)
Report release date 08/05/2001
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Aviation occurrence category Loss of separation
Occurrence class Incident
Highest injury level None

Aircraft details

Manufacturer Airbus
Model A320
Registration VH-HYX
Serial number 288
Sector Jet
Operation type Air Transport High Capacity
Departure point Alice Springs, NT
Destination Sydney, NSW
Damage Nil

Aircraft details

Manufacturer The Boeing Company
Model 767
Registration VH-OGS
Serial number 28725
Sector Jet
Operation type Air Transport High Capacity
Departure point Sydney, NSW
Destination Jakarta, INDONESIA
Damage Nil

Boeing Co 767-238, VH-EAM

Summary

Prior to the top of the descent, the crew of the Boeing 767 monitored the Perth Airport automatic terminal information service, which indicated low mist patches in the airport area. The approach controller indicated to the crew that fog was rapidly obscuring both runways. However, a short time later, the tower controller indicated that the visibility on runway 21 was 800 metres. At the minimum descent altitude, the crew reported to the tower controller that they could see the runway. The crew later reported that during the landing roll, visibility reduced to less than 600 metres. The aircraft landed at 2156 WST on runway 21.

The Bureau of Meteorology issued a terminal area forecast at 1838 which forecast a 30% probability of fog from 0200-0800 the next morning. An amended terminal area forecast was issued at 2045 which forecast a 40% probability of fog from 0000-0900 the next morning. The current airport trend type forecast indicated periods of reduced visibility to 4,000 metres for 30 minutes or less. The onset of fog occurred 2.5 hours prior to the forecast time.

A report from the Bureau of Meteorology Perth office indicated that the assessment was that fog would be a possibility depending on how quickly the showers and cloud cleared, the wind speed decreased and stabilisation of the dewpoint occurred. At 2040 a pilot landing at Jandakot Airport, about 16 kilometres from the Perth Airport, advised that fog patches were forming at that airport. At 2050 the duty Senior Supervising Meteorologist conducted a `rooftop' observation from the Regional Forecasting Centre and noted that the Perth control tower, about 12 kilometres, and lights on the Darling escarpment, about 19 kilometres, were visible. The observed conditions confirmed that fog from 0000 seemed a reasonable possibility. The Bureau of Meteorology indicated that experience had shown that it was rare for fog to occur as early as it had. The early occurrence of fog at Perth always follows precipitation in the preceding daylight hours. The passage of a front in the afternoon, accompanied by precipitation is a good precursor of early fog at Perth. The frontal passage was in the early evening at 1930. While fog can form almost immediately after a frontal passage, as it did on this occasion, experience has shown that it is rare for this to happen. The number of fogs forming at 2200 or earlier, over a 26 year period at Perth Airport is approximately 20 out of a total of 340 or 5% of occasions. The forecasting team on duty that night were surprised by the onset of fog, earlier than expected, once the showers had cleared.

The Bureau of Meteorology advised that the soon to be implemented Bureau of Meteorology Research Centre Fog Project at Perth Airport will assist with the knowledge and the quality of aviation fog forecasting.

Occurrence summary

Investigation number 200002305
Occurrence date 31/05/2000
Location Perth, Aero.
State Western Australia
Report release date 01/08/2000
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Aviation occurrence category Navigation - Other
Occurrence class Incident
Highest injury level None

Aircraft details

Manufacturer The Boeing Company
Model 767
Registration VH-EAM
Serial number 23309
Sector Jet
Operation type Air Transport High Capacity
Departure point Sydney, NSW
Destination Perth, WA
Damage Nil

Supplementary report, collision with water, Piper PA-31-350, VH-MZK, on 31 May 2001

Summary

Supplementary report:

Since the release by the ATSB on 19 December 2001 of Report 200002157 on the fatal accident involving Piper Chieftain VH-MZK in Spencer Gulf in South Australia on 31 May 2000, further events have taken place, and additional information has become available, regarding issues that were examined in ATSB Report 200002157. The ATSB formally re-opened its investigation in November 2002 under the provisions of Part 2A of the Air Navigation Act in order to test the significance of the new evidence.

From July 2002 until July 2003, the South Australian Coroner conducted a public inquest into the accident. The Coroner delivered his findings on 24 July 2003 and disagreed with the conclusions in ATSB Report 200002157 and was critical of the ATSB investigation. The Coroner concluded that the left and right engines had failed independently. He found that the right engine overheated and was damaged during the climb from Adelaide, and developed a hole in the No 6 piston 8 minutes into the cruise phase of the flight. He concluded that the left engine subsequently independently failed because of fatigue cracking initiated by a sub-surface manufacturing defect in the crankshaft.

Between 1 February and 16 September 2002 (after ATSB Report 200002157 was released), the engine manufacturer issued Mandatory Service Bulletins 550, 552, and 553 concerning potential crankshaft defects. The serial number of the MZK left engine crankshaft appeared in Service Bulletin 553. It has been reported that of the crankshafts that were subject to that service bulletin, almost 70 percent of those tested were not defective and were permitted to continue in service after testing.

As stated in ATSB Report 200002157, initial examination of the crankshaft by the ATSB indicated that it complied with the proprietary standards set by the engine manufacturer. Based on their examination of a sample that had been cut from the crankshaft by the ATSB and stored for 18 months, academics from a local university commissioned by the Coroner, along with a US firm acting for the plaintiffs in civil damages litigation, reported the existence of 'massive' high temperature oxide 'inclusions' in the crankshaft material. However, later examination by the same experts and destructive testing of the crankshaft in the vicinity of the fatigue crack origin did not reveal any evidence of massive inclusions. Nevertheless, the opinion of the US firm concluded that a manufacturing defect (rather than a thermal crack as suggested in ATSB Report 200002157) was responsible for initiating the fatigue crack. They stated that while no large foreign body manufacturing inclusion was found at the crack initiation site, it may have 'fallen out' as the crack propagated. Detailed examination of the crankshaft material and the fracture area, including both sides of the fracture surface by the ATSB (in the presence of independent observers) in March 2003 did not reveal any irregularity in the crankshaft steel that could have initiated the fatigue fracture under normal engine operating conditions. No evidence of any large inclusions or of any 'honeycomb feature' as suggested in material associated with the service bulletins was found. Without receiving expert advice, the Coroner in his findings stated that the ATSB's 50 page test report 'takes the matter no further' and chose to rely on earlier opinion and circumstantial evidence.

The ATSB does not agree with the Coroner's findings and is strongly of the view that the engine failure mechanisms and the sequence of events contained in ATSB Report 200002157 remain the most likely explanation of the circumstances of the accident, based on the limited factual information that was available. This Supplementary Aviation Safety Investigation Report includes the ATSB's detailed response to the Coroner's findings. The report also includes further explanation of the main issues addressed in ATSB Report 200002157, as well as matters of major interest that arose during the inquest, including:

  • The possibility that the failure of the VH-MZK left engine crankshaft was linked to a manufacturing defect,
  • The possibility of an engine failure sequence that differed from that advanced in Report 200002157,
  • The extent and timing of the left engine No 6 connecting rod big end bearing 'failure',
  • The operation of the turbocharger on the Textron Lycoming TIO-540 engine,
  • The maximum single engine speed the aircraft could achieve.

In summary, the ATSB explanation for the initiation of the fatigue crack in the left engine crankshaft about 50 flights before the accident was a thermal crack caused by localised surface heating when a bearing insert failed to operate as designed and a bearing edge interfered with the crankshaft surface. This resulted from some combination of excessive engine pressures probably caused by preignition from incandescent lead oxybromide deposits (linked to fuel leaning, eg in the climb but within the aircraft manufacturer's guidelines) and bearing slippage assisted by an anti-galling lubricant. In addition to MZK, this was based on the ATSB's observations of damage in a number of engines (now more than a dozen) including two from another engine manufacturer. The ATSB concluded that the holing of the right engine No. 6 piston was the result of detonation in response to the left engine failure (the right engine damage was therefore a dependent failure). As the ATSB stated when releasing Report 200002157 on 19 December 2001, it is not appropriate to 'blame' the young pilot in this scenario given the paucity of evidence and the ATSB did not do so.

The ATSB does not agree with the Coroner that MZK's pilot was likely to have allowed, ahead of any stressful situation, his right engine to overheat to a point 8 minutes into the cruise of melting a hole in a piston (especially as the temperature probe is atop the melted No. 6 piston cylinder) and then be unlucky enough that a deep-seated long-term progressive fatigue crack problem in the left engine crankshaft would have suddenly caused that engine to independently fail.

Following the release of ATSB Report 200002157, the ATSB received responses from the US FAA concerning Recommendations R20010254 and R20010255 that dealt with combustion chamber deposits and anti-galling compounds. The FAA advised that it would review the effect of anti-galling compounds on bearing insert retention, and that it was conducting an extensive evaluation of the detonation characteristics of high performance reciprocating engines and would include an examination of deposit formation as part of that evaluation.

In July 2002, the ATSB issued Safety Recommendation R200220149 for CASA to examine the potential safety benefits of devices that monitor aircraft fuel and engine system operation and whether those systems should be fitted to general aviation aircraft engaged in air transport operations. CASA advised that it did not consider the safety benefits of those devices warranted their fitment being made mandatory. However, CASA did not have any concern with operators voluntarily fitting such equipment.

While maintaining that the engine failure mechanisms and the sequence of events contained in ATSB Report 200002157 remain the most likely scenario, the Bureau examined carefully a range of scenarios. In particular, an assessment was made of any safety action that might be required if an accident as a result of a less likely scenario was to be prevented in the future.

The Coroner included five recommendations in his findings:

  1. As suggested in the ATSB's submissions, the Coroner sought clarification of engine operating procedures between different versions of pilot operating handbooks and flight manuals for piper Chieftain aircraft to ensure that engine detonation limits are not exceeded. The ATSB has written to CASA supporting the Coroner's recommendation and requesting that CASA seek clarification of detonation limits from the US FAA, and examine how engine operating procedures for operators of more than one model of a particular aircraft type take proper account of differences in versions of operating manuals and handbooks.
  2. The Coroner sought improved lines of communication between international aviation regulation and safety investigation agencies, even where litigation might be threatened. The ATSB already enjoys close working international relationships, but agrees that the flow of information could be improved in some instances. However, there are practical limitations that apply in other countries and through multilateral agencies over which the ATSB has no control.
  3. The Coroner sought that CASA mandate the fitment of on-board recorders in aircraft carrying fare-paying passengers. The ATSB considers that its Safety Recommendation R200220149, referred to above, addressed that issue.
  4. The Coroner sought the carriage of life jackets and/or life rafts in fare-paying passenger operations over water, which is supportive of earlier ATSB recommendations. ATSB Report 200002157, Section 4.4, detailed Safety Recommendations R20000248 and R20000249 concerning the carriage of life jackets and emergency and life saving equipment. R20000248 was accepted by CASA and Civil Aviation Order 20.11 amended to require life jackets to be carried on all passenger flights over water. As regards R20000249, CASA has advised that it was considering a number of issues regarding emergency and life saving equipment in twin engine aeroplanes in the context of the proposed CASR Part 121B, Air Transport Operations - Small Aeroplanes. The draft regulations included in a Notice of Proposed Rule Making (NPRM) released by CASA in July 2003 for this Part includes various requirements for emergency cabin lighting and carriage of items such as of life jackets and other flotation devices, life rafts, ELTs (Emergency Locator Transmitters) or EPIRBs (Electronic Position Indicating Radio Beacons) and other survival equipment, including provisions.
  5. The Coroner proposed a research program concerning self-deploying ELT units. The ATSB's recommendation to CASA R20000249 encompasses enhanced emergency and life saving equipment such as ELTs and the Bureau believes that CASA, AusSAR (AMSA) and Defence are best placed to progress the issue.

Occurrence summary

Investigation number 200002157A
Occurrence date 31/05/2000
Location 28 km SE Whyalla Airport
State South Australia
Report release date 28/10/2003
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Occurrence class Accident
Highest injury level Fatal

Aircraft details

Model PA-31-350
Registration VH-MZK
Serial number 31-8152180
Sector Piston
Departure point Adelaide, SA
Destination Whyalla, SA
Damage Destroyed

Collision with water, Piper PA31-350 Chieftain, VH-MZK, Spencer Gulf, South Australia, on 31 May 2000

Summary

Original report:

On the evening of 31 May 2000, Piper Chieftain, VH-MZK, was being operated by Whyalla Airlines as Flight WW904 on a regular public transport service from Adelaide to Whyalla, South Australia. One pilot and seven passengers were on board. The aircraft departed at 1823 central Standard Time (CST) and, after being radar vectored a short distance to the west of Adelaide for traffic separation purposes, the pilot was cleared to track direct to Whyalla at 6,000 ft. A significant proportion of the track from Adelaide to Whyalla passed over the waters of Gulf St Vincent and Spencer Gulf. The entire flight was conducted in darkness.

The aircraft reached 6,000 ft and proceeded apparently normally at that altitude on the direct track to Whyalla. At 1856 CST, the pilot reported to Adelaide Flight Information Service (FIS) that the aircraft was 35 NM south-south-east of Whyalla, commencing descent from 6,000 ft. Five minutes later the pilot transmitted a MAYDAY report to FIS. He indicated that both engines of the aircraft had failed, that there were eight persons on board and that he was going to have to ditch the aircraft, but was trying to reach Whyalla. He requested that assistance be arranged and that his company be advised of the situation. About three minutes later, the pilot reported his position as about 15 NM off the coast from Whyalla. FIS advised the pilot to communicate through another aircraft that was in the area if he lost contact with FIS. The pilot's acknowledgment was the last transmission heard from the aircraft. A few minutes later, the crew of another aircraft heard an emergency locater transmitter (ELT) signal for 10-20 seconds.

Early the following morning, a search and rescue operation located two deceased persons and a small amount of wreckage in Spencer Gulf, near the last reported position of the aircraft. The aircraft, together with five deceased occupants, was located several days later on the sea-bed. One passenger remained missing.

On 9 June 2000, the wreckage of the aircraft was recovered for examination. Aside from the engines, no fault was found in the aircraft that might have contributed to the accident. Both engines had malfunctioned due to the failure of components of the engines.

The crankshaft of the left engine fractured at the Number 6 connecting rod journal. Fatigue cracking was initiated by the presence of a planar discontinuity in the journal surface. It was evident that the discontinuity had been caused by localised thermal expansion of the nitrided journal surface following contact with the edge of the Number 6 connecting rod big end bearing insert. The crankshaft failed approximately 50 flights after fatigue crack initiation.

The Number 6 bearing insert was damaged during engine operation through the combined effect of:

  • high bearing loads created by lead oxybromide deposit induced preignition, and
  • lowered bearing insert retention forces associated with the inclusion of an anti-galling compound between the bearing inserts and the housings.

Fatigue cracking in the Number 6 connecting rod big end housing had developed following the gradual destruction of the bearing insert. The left engine probably continued to operate for 8-10 minutes after the final fracture of the Number 6 connecting rod housing before the final disconnection of the Number 6 journal of the crankshaft. It is likely that the engine would have displayed signs of rough running and some power loss during this time. The final disconnection of the crankshaft resulted in a loss of drive to the magnetos, fuel pump, camshaft and, consequently, the sudden stoppage of the engine. The left propeller was in the feathered position when the aircraft struck the water, confirming that the engine was not operating at that time.

The physical damage sustained by the right engine was restricted to the localised melting of the Number 6 cylinder head and piston. The piston damage had allowed combustion gases to bypass the piston rings. The overheating of the right engine combustion chamber components was a result of changes in heat transfer to cylinder head and piston surfaces created by combustion end-gas detonation. The carbonaceous nature of the residual deposits on the piston crowns indicated that detonation had occurred under a rich fuel-air mixture setting. Rich mixture settings are used with high engine power settings.

The damaged piston would have caused a loss of engine oil and erratic engine operation, particularly at higher power settings. Engine lubrication was still effective at impact, indicating that oil loss was incomplete and that the piston holing occurred at a late stage of the flight.

Examination of the right propeller indicated that the blades were in a normal operating pitch range (i.e. not feathered) when the aircraft struck the water. It could not be confirmed that the right engine was operating when the aircraft struck the water, although it most probably was operating when radar contact was lost as the aircraft descended through 4,260 ft when 25.8 NM from Whyalla.

The aircraft was not fitted with a Flight Data Recorder (FDR) or a Cockpit Voice Recorder (CVR), nor was it required to be. Analysis of recorded radar data confirmed that the aircraft performed normally during the flight until the latter stages of the cruise segment when the speed gradually decreased. Speed variations, accompanied by track irregularities, then became more pronounced. Analysis of recorded voice transmissions revealed that propeller (and engine) RPM during the climb from Adelaide was 2,400. The RPM was 2,200 after the aircraft levelled at 6,000 ft. These were normal climb and cruise engine settings used by the company and the performance achieved by the aircraft during these segments was consistent with normal engine performance. Just prior to the commencement of descent, an RPM of 2,400 was identified. That was not a normal engine power setting for that stage of the flight.

The aircraft speed and propeller RPM information, coupled with the engine failure analysis, was consistent with the following likely sequence of events:

  • The power output from the left engine deteriorated during the first third of the cruise segment of the flight after the Number 6 connecting rod big end housing had fractured. The engine ceased operating completely 8-10 minutes later.
  • In response to the failure of the left engine, the pilot increased the power setting of the right engine.
  • Increased combustion chamber component temperatures via detonation within the right engine led to the Number 6 piston being holed. That resulted in the erratic operation of the right engine with reduced power and controllability and left the pilot with little alternative but to ditch the aircraft.
  • The double engine failure was a dependent failure.

Examination of eight failures of Textron Lycoming engines from a number of operators that had occurred over the period January 2000 to November 2001 revealed that deposits of lead oxybromide on combustion chamber surfaces were not restricted to the engines from MZK; seven other engines had such deposits. The inclusion of a copper-based anti-galling compound between the bearing insert and big end housing was noted in three of the engines examined. The quantity of anti-galling compound present varied between those engines.

Lead oxybromide deposits and anti-galling compounds act in different ways to weaken the defences for reliable engine operation. The relative contribution to engine failure of the factors cannot be predicted easily because of variations in the extent of each effect and the complexity inherent in engine assembly and operation. It is likely that the formation of lead oxybromides that cause deposit induced preignition is linked to the temperature of the fuel-air charge temperature in the combustion chamber just prior to the passing of the flame front. Leaning the mixture during climb, and using near "best economy" cruise power settings appeared to favour the formation of lead oxybromide deposits that resulted in deposit induced preignition. Mixture settings of "full rich" mixture during climb and "best power" cruise settings appeared to favour reactions that resulted in less extensive and different deposits being formed. The Whyalla Airlines procedure was to lean the mixture during climb, and to use a cruise power setting close to "best economy". Those procedures were in accordance with the US Federal Aviation Administration (FAA) approved Pilot's Operating Handbook for the Piper Chieftain aircraft.

The combination of the use of leaded aviation gasoline, mixture leaning during climb, and leaning for best economy during cruise was not restricted to Lycoming engines. The ATSB also found evidence of high combustion loads and lead oxybromide deposits during the examination of components from two Teledyne Continental TIO-520 engines that were defective.

Anecdotal reports indicated that there were fewer engine problems (including component failures) in engines that were operated full rich during climb, and "best power" during cruise, compared with those where the mixture was leaned during climb and "best economy" cruise power was used. A comparison of the engine operating procedures of twelve other operators of Piper Chieftain aircraft revealed considerable disparity in procedures, particularly for climb and cruise. In fact, no two operators used the same procedure.

The incidence of lead oxybromide deposits in engines that had experienced defects, coupled with the range of fuel leaning techniques used, indicated a deficiency in the operation and maintenance of those engines, at least among some of the operators of high-powered piston engine aircraft in Australia.

On 30 October 2000, the ATSB issued a recommendation that the Civil Aviation Safety Authority alert operators regarding the risks of detonation, and encourage the adoption of conservative fuel leaning practices. This report includes further recommendations addressing the following:

  • the engine operating conditions under which combustion chamber deposits that may cause preignition are formed (addressed to the US Federal Aviation Administration);
  • the effect on engine reliability of the use of anti-galling compounds between connecting rod bearing inserts and housings (addressed to the US Federal Aviation Administration and the engine manufacturer); and
  • the reliability of high-powered aircraft piston engines operated in Australia (addressed to CASA).

This accident was the first recorded ditching involving a Piper Chieftain aircraft in Australia. Available records world-wide of previous Piper Chieftain engine failure/ditching events illustrate that, in most instances, successful night ditchings occurred in better visibility and weather conditions than those confronting the pilot of MZK. The relatively minor injuries suffered by the occupants of the aircraft indicated that the pilot demonstrated a high level of skill in ditching the aircraft. The report includes a recommendation to CASA regarding guidance material for pilots on ditching.

It is likely that the survival prospects of the occupants would have been enhanced had the passenger seats been fitted with upper body restraints, and life jackets or equivalent flotation devices had been available to the occupants. As a result of a separate investigation, the Bureau issued a recommendation concerning upper body restraints on 31 March 1999. On 30 October 2000, arising from the Whyalla investigation, the ATSB issued recommendations to the Civil Aviation Safety Authority concerning the provision of adequate emergency and life saving equipment for the protection of fare-paying passengers in smaller aircraft during over-water flights.

Full details of safety action including the CASA response to recommendations made on 31 March 1999 and 30 October 2000 are in Section 4 of this report.

The investigation included a detailed examination of the regulatory history of Whyalla Airlines from June 1997 to June 2000. In common with the published findings of other reports on CASA surveillance activities, there was a significant under-achievement of surveillance of the company against CASA's planned levels during that period. However, there was insufficient information to conclude that the level of surveillance achieved was of significance with respect to the accident.

With regard to Whyalla Airlines itself, issues were identified in the company that had the potential to adversely influence safety. There was insufficient information to conclude that any of these issues were of significance with respect to the accident.

As a result of the accident and ATSB's investigation, improved refuelling procedures were introduced nationally by the refuelling organisation to reduce the chance of error.

  • Supplementary report was released on 28 October 2003

Occurrence summary

Investigation number 200002157
Occurrence date 31/05/2000
Location 28 km SE Whyalla Airport
State South Australia
Report release date 19/12/2001
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Occurrence class Accident
Highest injury level Fatal

Aircraft details

Manufacturer Piper Aircraft Corp
Model PA-31
Registration VH-MZK
Serial number 31-8152180
Sector Piston
Operation type Air Transport Low Capacity
Departure point Adelaide, SA
Destination Whyalla, SA
Damage Destroyed

Boeing 747SP-38, VH-EAB

Summary

While at approximately 8,000 ft after departure from Sydney, the crew heard a loud bang from the left side of the aircraft. The number 1 engine pressure ratio (EPR) had dropped slightly while the compressor speed (N1), exhaust gas temperature and fuel flow indications increased. The engine vibration level remained within limits. A flight attendant reported seeing something entering into or flaying around the engine intake. After discussions with ground maintenance, the aircraft was returned to Sydney, where an uneventful landing was made after about 50,000 kg of fuel had been jettisoned off the coast.

Examination of the engine by the operator revealed evidence of a bird strike. Blood was found on the engine fan exit nozzle, and the glass-reinforced plastic of the ice impact panel was damaged. About 90 per cent of the circumference of the ice impact panel that covered the acoustic liner aft of the fan was found to be missing

The fan was inspected for damage and the remains of the ice impact panel were removed. (The engine maintenance manual allows the ice impact panel to remain damaged beyond limits or missing for up to 125 hours, or until the next aircraft maintenance inspection.) The EPR probes and their lines were flushed clean and appropriate line connectors were replaced.

A subsequent engine ground run found EPR indications had returned to normal and the engine was cleared back to line operations.

Occurrence summary

Investigation number 200002130
Occurrence date 13/05/2000
Location Richmond
State New South Wales
Report release date 27/09/2000
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Aviation occurrence category Birdstrike
Occurrence class Incident
Highest injury level None

Aircraft details

Manufacturer The Boeing Company
Model 747
Registration VH-EAB
Serial number 22672
Sector Jet
Operation type Air Transport High Capacity
Departure point Sydney, NSW
Destination Manila, Philippines
Damage Minor

Boeing 737-377, VH-CZA

Safety Action

As a result of the investigation, the Australian Transport Safety Bureau issues the following recommendations:

R20000301

That Airservices Australia review the documentation in relation to air traffic controller recency requirements, in particular, the methodology of how individuals can meet the requirements.

R20000302

That the Civil Aviation Safety Authority review the requirements for air traffic controller recency, such as the number of hours required, shifts that do or do not qualify for such recency, and documentation for recording such recency.

Related safety action

Related issues have been found in several Australian Transport Safety Bureau investigation reports and the Bureau is developing recommendations in respect of the affect of personal stress on controllers.

Significant Factors

  1. The Inverell controller was experiencing personal stress factors that may have affected his work performance.
  2. The Inverell controller had minimal recency time on the sector, which may have affected his performance.
  3. The crew of CZA requested and were approved to climb to non-standard level FL370.
  4. The Inverell controller did not implement a separation assurance plan when he became aware of the likelihood of a conflict.
  5. The Inverell controller allowed secondary considerations to override separation actions.
  6. The short-term conflict alert activated in sufficient time to allow remedial action by the controller.
  7. The TCAS on each of the aircraft provided each crew with an alert indicating a required positive separation action.

Factual Information

Sequence of events

A Boeing 737, VH-CZA, departed Maroochydore for Sydney and was tracking southbound on air route H62. The crew planned to cruise at flight level (FL) 350 but experienced turbulence at that level. Several other aircraft had encountered turbulence at various levels up to FL350 but those at FL370 were in smooth flying conditions. Consequently, the crew had obtained approval from air traffic control to climb to non-standard level FL370 well before the aircraft was handed off to the Inverell sector controller.

A Boeing 737, VH-CZX, departed Melbourne for Brisbane, tracking via air route H29 and on climb to the flight planned level, FL370.

The air routes crossed near the Gibraltar non-directional navigation beacon.

The crew of CZA reported maintaining FL370 to the Inverell sector controller at 1322 Australian Eastern Standard Time.

At 1323, CZX was identified to the Inverell sector controller by the previous sector controller. The crew of CZX made radio contact at 1327, and reported that they were maintaining FL370. Between 1327 and 1329, the controller issued arrival and sequencing information to the crew. This information did not change the aircraft's current route or flight level.

The operational shift supervisor commenced a conversation with the Inverell sector controller at 1330 regarding the selection and testing of radio frequency outlets for that sector. The controller was performing other tasks and said that he would call the supervisor back. Between 1330 and 1332, the controller spoke with the crews of seven aircraft, including asking one of them for a radio check of readability after changing the radio outlet settings.

At 1332:30, the controller contacted the supervisor to discuss the selection of primary and secondary transmitters and receivers. During this exchange, the short-term conflict alert activated at 1333:22 due to confliction between CZA and CZX. The supervisor deselected the intercom line without further conversation.

The controller immediately issued a radar vector to the crew of CZX to effect avoiding action. The crew commenced the turn as instructed and received a traffic alert and collision-avoidance system (TCAS) resolution advisory to climb. They carried out the TCAS climb during the turn.

In the next 15 seconds, the controller passed traffic information on CZX to the crew of CZA. The crew of CZX then informed the controller that they were initiating a TCAS climb, and the crew of CZA broadcast that they were descending in accordance with a TCAS resolution advisory.

Analysis of the radar display data indicated that the radar vector took CZX across the flight path of CZA at 1333:46 while maintaining FL370. At that time, CZA was 10 NM north of CZX and also at FL370.

The point of closest proximity was 3.9 NM at 1334:11, when CZA was descending through FL369 and CZX was maintaining FL370. The required separation for that situation was either 5 NM horizontally or 2,000 ft vertically.

Traffic alert and collision-avoidance system (TCAS)

Each aircraft's TCAS functioned in accordance with design parameters. They activated at about the same time, and assisted the crews to respond appropriately.

The first warning the crew of CZX received was an instruction from the controller to turn right immediately. They commented to each other that the controller sounded worried and commenced the turn without delay. As they started the turn they received a TCAS traffic advisory and then a resolution advisory to climb. The pilot in command remembered seeing a "00" indication, which meant the aircraft were at the same height. The crew did not see the other aircraft, due to the turn manoeuvre, but carried out a climb in accordance with company standard operating procedures. They received a "clear of conflict" message after climbing 400 ft. The aircraft remained within a 500 ft excursion of its cleared level.

The crew of CZA had asked for FL370 due to uncomfortable turbulence at FL350. They had been at FL370 for some time and were unaware of the approaching aircraft until the TCAS activated a traffic information advice at the 12 NM extremity of the TCAS display. The pilot in command only had time to consider that advice before the traffic advisory activated and he looked up to see the other B737 straight ahead and in a turn. He heard the controller issue a right turn instruction to CZX and was confident that he could maintain visual separation behind that aircraft. However, when the resolution advisory activated, he commenced a descent in accordance with company standard operating procedures. The aircraft remained within a 500 ft excursion of its cleared level.

Air route and airspace design

Air routes H62 and H29 were subject to heavy air traffic movements and had to cross at some point. Air route design ensured that they crossed in the middle of the Inverell sector while at cruising levels. That design had the effect of producing a common crossing conflict in the centre of the display screen that provided the controller maximum time to recognise and rectify a conflict.

Inverell sector controller

The controller operating the Inverell sector was experienced in the position and reported that the traffic level at the time was moderate. The controller also reported experiencing significant personal factors that would have been likely to cause him considerable stress in the weeks prior to the incident.

The controller had taken several days off duty in the previous two weeks due to illness. He was current in only two of the four positions for which he held a rating, having registered 9.5 hours on the Inverell sector in the past 22 days and 3.5 hours in the last 15 days. The currency requirement was for at least 2 hours every 14 days for each rating.

The Civil Air Traffic Services Operations Administration Manual (CATSOAM) parts 5.2 and 5.3 outline the recency requirements for maintaining a valid air traffic control licence. In practice it was possible for some of the time logged to fulfil the recency requirements for a particular control position to be worked during times of low traffic levels. For example, working a nightshift where several positions were combined may have allowed a controller to credit the hours worked to more than one position.

In the 14 days before the day of the incident, the controller had worked only one shift; a night shift involving combined sectors for which he held ratings. That shift enabled him to meet the recency requirements to exercise the privileges of his air traffic control licence on two of his four ratings, including the control position he occupied at the time of the incident.

During the controller's absence, the Byron Group of sectors was moved to a different aisle within the Brisbane Centre. Although each sector was a stand-alone unit, the sectors each side of Inverell were then different. The controller reported that the repositioning of the sectors made the "feel" of the surroundings seem unusual when he arrived at the console.

When the controller arrived to start work at 1100, he had no immediate console function to perform and decided to read the documentation relevant to his ratings to catch up on the latest changes. While on that break a personal distraction resulted in him having to leave the console. Consequently, he did not take over the sector until approximately 1310.

A short time later (1324:30), the controller gave an instruction to the crew of a Dash 8 that they did not read back correctly. That was not recognised by the controller and was rectified only after an enquiry by the crew.

The controller received the correct coordination in respect of both CZA and CZX. He realised the potential conflict and checked, on at least two occasions, the relative distance of each aircraft from the intersection of the air routes, but did not subsequently take any positive action to ensure separation; even though the aircraft were 10 minutes from that intersection.

The controller was asked by the supervisor to check the radio system and, although initially saying that he had some other tasks to perform and that he would call the supervisor back, he commenced the radio checks soon after receiving the request and during a period of comparatively busy radio activity. The controller reported that he felt under pressure to complete the task without delay. That pressure was largely self-imposed as the supervisor had left the timing of the task to the controller's discretion. However, the controller was aware that the technicians were waiting at a remote location for the check to be performed and he wanted the task completed.

During that time the controller also changed the transmitter and receiver functions on the voice switching and communication system, thinking he was carrying out the changes requested by the supervisor. However, equipment-fail "bleeps" were evident as he was asking a pilot to comment on the quality of the radio transmission. Those bleeps indicated that the selections made were not correct and the controller's discussion with the supervisor confirmed that he had made an incorrect selection.

The controller stated that although he had acknowledged that CZA was at FL370, he was not fully aware that the aircraft was at a non-standard level. He was concentrating on the voice switching and communication system and the potential problems for sequencing aircraft that were soon to enter his airspace.

The controller stated that had allowed his "scan" to be diverted and, when the short-term conflict alert activated, he knew immediately what the problem was and acted to rectify the infringement of separation standards. He was unable to explain either his poor task prioritisation or his memory lapse.

Short-term conflict alert

The short-term conflict alert was designed to activate when the system checks determined that the aircraft were within 1 minute of coming within 4.1 NM and 600 ft. Analysis of the recording medium indicated that the alarm provided approximately 16 NM warning of the point of closest proximity. As the closing speed was approximately 15 NM/min, indications were that the system activated within reasonable tolerances.

Operational shift supervisor

The supervisor was dealing with radio frequency outlet problems on two sectors. He tasked the other sector first, as Inverell was the busier. Radio technicians at Point Lookout found equipment that needed replacement, but the task required the primary transmitter to be unavailable for about 24 hours. Before authorising its removal, the supervisor needed to check that the standby arrangements for the Inverell sector were satisfactory, and contacted the controller to have them checked. When the controller replied that he was busy, the supervisor waited for his return call. Two minutes later, the controller returned the call. The supervisor said that he thought that it was acceptable to the controller to commence conversation, otherwise he would not have returned his call. During that conversation the supervisor heard an alarm and immediately terminated the call. Although he did not know the nature of the alarm at the time, it was the short-term conflict alert that the supervisor heard.

Analysis

Both aircraft crews acted in accordance with company procedures and followed the TCAS resolution advisories.

The incident occurred at a well-known point of conflict within an en-route sector. The experienced controller was operating a control position with which he was familiar and with traffic volume and complexity that should have been well within his ability. However, he did not take action to ensure separation between two aircraft that he had earlier recognised as being in potential conflict. That was most likely the result of a number of predisposing factors, including the effects of stress, limited recency, distraction, and not using a memory aid.

At the time of the occurrence the controller was testing the serviceability of the secondary radio transmitter. That was a routine and relatively unimportant task. However, the controller felt under pressure, largely self-imposed, to complete it without undue delay. Initially the controller was mistaken as to the exact test required and that led to some confusion on his part. Consequently, he was distracted for longer than anticipated and his awareness of the developing traffic situation was compromised.

Correct prioritisation is fundamental to any complex operating task. The controller was faced with several competing demands for his attention. In addition to monitoring the conflicting aircraft he carried out routine tasks such as issuing instructions to aircraft and transferring aircraft to or from other control sectors, and attempted to assist the supervisor with the radio checks.

Inadequate prioritisation committed the controller to remembering the unresolved aircraft conflict in order to deal with it in a timely manner. However, distraction and a subsequent memory lapse left the conflict unresolved until the activation of the short-term conflict alert.

There were other aspects of the controller's performance that, while not significant in isolation, were possibly indicative of a lower general level of performance at the time of the occurrence. When the southbound aircraft entered the controller's airspace, he did not appreciate that the aircraft was at a non-standard flight level, even though he was well familiar with the airways route. Later, approximately 10 minutes before the incident, the controller did not correct an oversight by a Dash 8 crew. Further, when asked by the supervisor to carry out a frequency check, the controller had some difficulty with what was a relatively straightforward task.

Recency

Using low traffic movement periods to combine sectors in order to maintain adequate work levels may result in an individual meeting the formal recency requirements, but not actually having sufficient exposure to a particular sector to warrant meaningful traffic practice. In this occurrence, the amount and type of recent control work that the controller had completed may not have been sufficient to ensure performance to the standard that the recency requirements were intended to maintain; taking into consideration the variation in the level/complexity of traffic during different periods. It is possible that the controller's performance was affected by the relatively short time he had worked in the control position during the previous fortnight.

Stress and performance

At the time of the incident the performance of the Inverell controller may have been adversely affected by stress. Recent significant personal factors may have been likely to cause him considerable chronic stress. The extent to which stress related to non-work factors can affect work performance is often underestimated. Major life events can markedly affect stress levels. In addition, the acute stress of leaving work to attend to an urgent personal matter may also have influenced the controller's performance.

Individuals are often unaware of the extent to which their performance is affected by stress. They may try to "work on" despite problems or difficulties. Individuals may be reluctant to admit, even to themselves, that they are suffering from stress because of a perception that this will be seen as a sign of weakness or failure.

Research has shown that stress can produce errors such as inappropriately delaying necessary actions and forgetting to carry out required actions at a time of high workload or distraction. Stress can result in perceptual and cognitive narrowing, where attention and decision making are focussed on a restricted range of information and tasks. For example, a controller's scan pattern may be disrupted. Stress can also lead to task shedding. This can result in the neglect of crucial matters while time may be spent on tasks of lesser importance. Memory can be significantly inhibited by stress.

In this incident, stress may have reduced the controller's capacity to handle what would normally have been a moderate workload. The controller allowed himself to be distracted by testing the radio equipment, to the detriment of his primary task; that of managing air traffic.

Memory aids

Because the potential conflict remained unresolved, the controller had to keep the task in short-term memory. Omitting to carry out planned actions - a failure of prospective memory - is one of the most common forms of memory lapse. A necessary condition for a memory lapse to occur is that attention is captured by either an external distraction or an internal preoccupation. The use of an appropriate memory aid would have guarded against the separation task being forgotten and a number of such methods were available to controllers.

Summary

A Boeing 737, VH-CZA, departed Maroochydore for Sydney and was tracking southbound on air route H62. The crew planned to cruise at flight level (FL) 350 but experienced turbulence at that level. Several other aircraft had encountered turbulence at various levels up to FL350 but those at FL370 were in smooth flying conditions. Consequently, the crew had obtained approval from air traffic control to climb to non-standard level FL370 well before the aircraft was handed off to the Inverell sector controller.

Occurrence summary

Investigation number 200002060
Occurrence date 23/05/2000
Location 19 km S Gibraltar, (NDB)
State New South Wales
Report release date 02/11/2001
Report status Final
Investigation type Occurrence Investigation
Investigation status Completed
Mode of transport Aviation
Aviation occurrence category Loss of separation
Occurrence class Incident
Highest injury level None

Aircraft details

Manufacturer The Boeing Company
Model 737
Registration VH-CZA
Serial number 23653
Sector Jet
Operation type Air Transport High Capacity
Departure point Maroochydore, QLD
Destination Sydney, NSW
Damage Nil

Aircraft details

Manufacturer The Boeing Company
Model 737
Registration VH-CZX
Serial number 24029
Sector Jet
Operation type Air Transport High Capacity
Departure point Melbourne, VIC
Destination Brisbane, QLD
Damage Nil
Subscribe to
Return focus to the top of the page