At 2019 Eastern Standard Time on 24 July 2011, a Thai Airways International Boeing Company 777-3D7 aircraft, registered HS-TKD, was conducting a runway 34 VOR approach to Melbourne Airport, Victoria. During the approach, the tower controller observed that the aircraft was lower than required and asked the flight crew to check their altitude. The tower controller subsequently instructed the crew to conduct a go-around. However, while the crew did arrest the aircraft’s descent, there was a delay of about 50 seconds before they initiated the go-around and commenced a climb to the required altitude.
What the ATSB found
The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’ when the aircraft pitched up to capture the VOR approach path. As a result, the remainder of the approach was conducted using the autopilot’s flight level change mode. In that mode the aircraft’s rate of descent is unrestricted and therefore may be significantly higher than that required for an instrument approach. In addition, the flight crew inadvertently selected a lower than stipulated descent altitude, resulting in descent below the specified segment minimum safe altitude for that stage of the approach and the approach not being managed in accordance with the prescribed procedure.
What has been done as a result
In response to this occurrence, Thai Airways International issued a notice to flight crews that emphasized the importance of constant angle non-precision approaches and adherence to the segment minimum safe altitudes. Other actions included a review of the training in support of non-precision approaches and the provision of additional information relating to the use of the aircraft’s autopilot flight director system.
Safety message
This occurrence highlights the risks inherent in the conduct of non-precision approaches and reinforces the need for flight crews to closely monitor the aircraft’s flight path to ensure it complies with the prescribed procedure.
Modern air transport aircraft are equipped with ever increasing levels of automation that, when used appropriately, can greatly reduce flight crew workload. While flight crews retain the option of flying the aircraft manually, the use of automation is generally preferred and often provides increased levels of safety and efficiency. To effectively manage the aircraft and flight path, however, flight crews need to maintain a thorough understanding of the relevant automatic flight systems. Worldwide, errors associated with the use and management of automatic flight systems have been identified as causal factors in more than 20% of approach and landing accidents.
Section 21 (2) of the Transport Safety Investigation Act
2003 (TSI Act) empowers the Australian Transport Safety Bureau
(ATSB) to discontinue an investigation into a transport safety
matter at any time. Section 21 (3) of the TSI Act requires the ATSB
to publish a statement setting out the reasons for discontinuing an
investigation.
On 1 April 2011, the ATSB commenced an investigation into an
operational event that occurred at about 1910 Eastern
Daylight-saving Time on 29 March 2011 involving a Bombardier
DHC-8-402 aircraft, registered VH-QOP. The initial report indicated
that, during the descent into Canberra, at an altitude of about
9,000 ft, a turn was commenced in preparation for the approach.
During the turn, the aircraft bank angle was reported as
approaching 45º, before returning to normal.
The ATSB conducted an analysis of the aircraft's flight data
recorder, and along with crew interviews, identified that the
maximum bank angle in the turn was 40º. The crew did not receive a
'bank angle' warning from the aircraft's enhanced ground proximity
warning system (EGPWS). The crew interviews also indicated that the
pilot flying was very experienced.
The ATSB's primary focus is on enhancing safety with respect to
fare-paying passengers and, in particular, those transport safety
matters that may present a significant threat to public safety or
are the subject of significant public concern. The ATSB therefore
directs considerable attention to identifying systemic failures in
the aviation, marine, and rail modes of public transport.
The ATSB considered there was limited potential to enhance
transport safety by continuing this investigation, and has elected
to discontinue it. However, the data already collected may be used
by the ATSB for future statistical analysis and safety research
purposes.
On 8 March 2011, an Eastern Australia Airlines operated (the operator) Bombardier Inc. DHC-8-315 aircraft, registered VH-SBI, departed Melbourne, Victoria on a scheduled passenger service to Devonport, Tasmania.
On arrival at Devonport, a runway 24 area navigation global navigation satellite system (RNAV (GNSS)) approach was commenced. The crew did not become visual with the runway at the minima due to the prevailing weather conditions and a missed approach was conducted. The aircraft was climbed to 3,100 ft and a holding pattern conducted.
A second approach was commenced, during which time, the aircraft's speed decayed. The pilot in command (PIC) made two airspeed advisory calls and the copilot responded immediately by increasing power on each occasion. The two power applications failed to accelerate the aircraft, and the crew observed the airspeed reduce to 107 kts. The PIC called assertively for more power to be applied, and the copilot immediately responded by applying power. During the recovery, the aircraft's engines were over-torqued to 120% for about 2 seconds. The operator and engine manufacturer transient over-torque limits were not exceeded.
A second missed approach was conducted, and the flight was diverted to Launceston, Tasmania where the aircraft landed without further incident.
In response to this incident, and a stickshaker warning event involving a Eastern Australian Airlines Bombardier Inc. DHC-8-315 aircraft on 1 March 2011 (ATSB investigation AO-2011-036), the operator issued a safety alert stating that the primary consideration for pilots is to maintain an awareness of the aircraft's speed, altitude and position; and controlling its flight path.
On 23 October 2010, a De Havilland Canada DHC-2 MK 1 floatplane, registered VH-PCF, was being operated on a charter passenger flight from Green Island to Cairns, Queensland.
During the take-off, the pilot applied right rudder to counteract the aircraft's engine torque component and right aileron to compensate for the crosswind. Immediately after becoming airborne, the aircraft began turning to the left. The pilot rejected the take-off and the aircraft landed heavily, sustaining serious damage. The pilot could not recall if the aircraft had encountered a gust of wind after becoming airborne.
Shortly after, a boat arrived from Green Island and the passengers were assisted to shore. None of the aircraft occupants received injuries.
At the time of the accident, the wind conditions experienced at Green Island were close to the maximum operational limitations stipulated by the aircraft operator.
This accident is a reminder of the challenging conditions that pilots operating in an open water environment may be faced with. It is crucial that pilots have an appreciation of the existing wind conditions prior to the take-off, and in the event of unexpected wind gusts during the take-off, the pilot responds appropriately. Under these circumstances, it is important for pilots to not only be aware of aircraft and operator limitations, but also their own personal limitations.
Occurrence summary
Investigation number
AO-2010-082
Occurrence date
23/10/2010
Location
Green Island, Cairns
State
Queensland
Report release date
28/01/2011
Report status
Final
Investigation level
Short
Investigation type
Occurrence Investigation
Investigation status
Completed
Mode of transport
Aviation
Aviation occurrence category
Control - Other
Occurrence class
Accident
Highest injury level
None
Aircraft details
Manufacturer
De Havilland Canada/De Havilland Aircraft of Canada
On 30 May 2010, an Airbus Industrie A320-232 aircraft, registered VH-VQZ, departed Sydney, New South Wales (NSW) on a scheduled passenger service to the Gold Coast, Queensland (Qld). The copilot, who was under training, was designated as the pilot flying for the flight.
The aircraft arrived at the Gold Coast and an instrument approach was commenced. During the landing, the flare was initiated early and the aircraft floated along the runway. The pilot in command (PIC) instructed the copilot to lower the nose of the aircraft; however, the aircraft appeared to maintain a level pitch attitude. The PIC determined that the landing could not be achieved and assumed control of the aircraft. The PIC initiated a go around, during which time the aircraft's main landing gear momentarily contacted the runway. The missed approach procedure was commenced, and a second approach was made without further incident.
The failure to identify or execute a go around/missed approach procedure has been cited by the Flight Safety Foundation as one of the major causes of approach-and-landing accidents. This incident highlights the importance of recognising when a go around should be initiated and supports the safety benefits of being 'go-around-prepared' and 'go-around-minded'.
On 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. While the aircraft was in cruise at 37,000 ft, one of the aircraft's three air data inertial reference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Two minutes later, in response to spikes in angle of attack (AOA) data, the aircraft's flight control primary computers (FCPCs) commanded the aircraft to pitch down. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment.
Basic animation using data from the Digital Flight Data Recorder
Although the FCPC algorithm for processing AOA data was generally very effective, it could not manage a scenario where there were multiple spikes in AOA from one ADIRU that were 1.2 seconds apart. The occurrence was the only known example where this design limitation led to a pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraft manufacturer subsequently redesigned the AOA algorithm to prevent the same type of accident from occurring again.
Each of the intermittent data spikes was probably generated when the LTN-101 ADIRU's central processor unit (CPU) module combined the data value from one parameter with the label for another parameter. The failure mode was probably initiated by a single, rare type of internal or external trigger event combined with a marginal susceptibility to that type of event within a hardware component. There were only three known occasions of the failure mode in over 128 million hours of unit operation. At the aircraft manufacturer's request, the ADIRU manufacturer has modified the LTN-101 ADIRU to improve its ability to detect data transmission failures.
At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. The injury rate and injury severity was substantially greater for those who were not seated or seated without their seat belts fastened.
The investigation identified several lessons or reminders for the manufacturers of complex, safety‑critical systems.
Executive Summary
Key investigation outcomes
The in-flight upset on 7 October 2008 occurred due to the combination of a design limitation in the flight control primary computer (FCPC) software of the Airbus A330/A340, and a failure mode affecting one of the aircraft’s three air data inertial reference units (ADIRUs). The design limitation meant that, in a very rare and specific situation, multiple spikes in angle of attack (AOA) data from one of the ADIRUs could result in the FCPCs commanding the aircraft to pitch down.
When the aircraft manufacturer became aware of the problem, it issued flight crew procedures to manage any future occurrence of the same ADIRU failure mode. The aircraft manufacturer subsequently reviewed and improved its FCPC algorithms for processing AOA and other ADIRU parameters. As a result of this redesign, passengers, crew and operators can be confident that the same type of accident will not reoccur.
The investigation identified several lessons or reminders for the manufacturers of complex, safety-critical systems. With the knowledge that systems are becoming increasingly complex, it also identified a need for more research into how design engineers and safety analysts evaluate system designs, and how their tasks, tools, training and guidance materials could be improved to minimise design errors.
Although in-flight upsets are very rare events, the accident on 7 October 2008 also provided a salient reminder to all passengers and crew of the importance of wearing their seat belts during a flight whenever they are seated.
Summary of the occurrence
At 0132 Universal Time Coordinated (0932 local time) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. At 0440:26, while the aircraft was in cruise at 37,000 ft, ADIRU 1 started providing intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Soon after, the autopilot disconnected and the crew started receiving numerous warning and caution messages (most of them spurious). The other two ADIRUs performed normally during the flight.
At 0442:27, the aircraft suddenly pitched nose down. The FCPCs commanded the pitch-down in response to AOA data spikes from ADIRU 1. Although the pitch-down command lasted less than 2 seconds, the resulting forces were sufficient for almost all the unrestrained occupants to be thrown to the aircraft’s ceiling. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment. The FCPCs commanded a second, less severe pitch-down at 0445:08.
The flight crew’s responses to the emergency were timely and appropriate. Due to the serious injuries and their assessment that there was potential for further pitch-downs, the crew diverted the flight to Learmonth, Western Australia and declared a MAYDAY to air traffic control. The aircraft landed as soon as operationally practicable at 0532, and medical assistance was provided to the injured occupants soon after.
FCPC design limitation
AOA is a critically important flight parameter, and full-authority flight control systems such as those equipping A330/A340 aircraft require accurate AOA data to function properly. The aircraft was fitted with three ADIRUs to provide redundancy and enable fault tolerance, and the FCPCs used the three independent AOA values to check their consistency. In the usual case, when all three AOA values were valid and consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs for their computations. If either AOA 1 or AOA 2 significantly deviated from the other two values, the FCPCs used a memorised value for 1.2 seconds. The FCPC algorithm was very effective, but it could not correctly manage a scenario where there were multiple spikes in either AOA 1 or AOA 2 that were 1.2 seconds apart.
Although there were many injuries on the 7 October 2008 flight, it is very unlikely that the FCPC design limitation could have been associated with a more adverse outcome. Accordingly, the occurrence fitted the classification of a ‘hazardous’ effect rather than a ‘catastrophic’ effect as described by the relevant certification requirements. As the occurrence was the only known case of the design limitation affecting an aircraft’s flightpath in over 28 million flight hours on A330/A340 aircraft, the limitation was within the acceptable probability range defined in the certification requirements for a hazardous effect.
As with other safety-critical systems, the development of the A330/A340 flight control system during 1991 and 1992 had many elements to minimise the risk of a design error. These included peer reviews, a system safety assessment (SSA), and testing and simulations to verify and validate the system requirements. None of these activities identified the design limitation in the FCPC’s AOA algorithm.
The ADIRU failure mode had not been previously encountered, or identified by the ADIRU manufacturer in its safety analysis activities. Overall, the design, verification and validation processes used by the aircraft manufacturer did not fully consider the potential effects of frequent spikes in data from an ADIRU.
ADIRU data-spike failure mode
The data-spike failure mode on the LTN-101 model ADIRU involved intermittent spikes (incorrect values) on air data parameters such as airspeed and AOA being sent to other systems as valid data without a relevant fault message being displayed to the crew. The inertial reference parameters (such as pitch attitude) contained more systematic errors as well as data spikes, and the ADIRU generated a fault message and flagged the output data as invalid. Once the failure mode started, the ADIRU’s abnormal behaviour continued until the unit was shut down. After its power was cycled (turned OFF and ON), the unit performed normally.
There were three known occurrences of the data-spike failure mode. In addition to the 7 October 2008 occurrence, there was an occurrence on 12 September 2006 involving the same ADIRU (serial number 4167) and the same aircraft. The other occurrence on 27 December 2008 involved another of the same operator’s A330 aircraft (VH-QPG) but a different ADIRU (serial number 4122). However, no factors related to the operator’s aircraft configuration, operating practices or maintenance practices were found to be associated with the failure mode.
Many of the data spikes were generated when the ADIRU’s central processor unit (CPU) module intermittently combined the data value from one parameter with the label for another parameter. The exact mechanism that produced this problem could not be determined. However, the failure mode was probably initiated by a single, rare type of trigger event combined with a marginal susceptibility to that type of event within the CPU module’s hardware. The key components of the two affected units were very similar, and overall it was considered likely that only a small number of units exhibited a similar susceptibility.
Some of the potential triggering events examined by the investigation included a software ‘bug’, software corruption, a hardware fault, physical environment factors (such as temperature or vibration), and electromagnetic interference (EMI) from other aircraft systems, other on-board sources, or external sources (such as a naval communication station located near Learmonth). Each of these possibilities was found to be unlikely based on multiple sources of evidence. The other potential triggering event was a single event effect (SEE) resulting from a high-energy atmospheric particle striking one of the integrated circuits within the CPU module. There was insufficient evidence available to determine if an SEE was involved, but the investigation identified SEE as an ongoing risk for airborne equipment.
The LTN-101 had built-in test equipment (BITE) to detect almost all potential problems that could occur with the ADIRU, including potential failure modes identified by the aircraft manufacturer. However, none of the BITE tests were designed to detect the type of problem that occurred with the air data parameters.
The failure mode has only been observed three times in over 128 million hours of unit operation, and the unit met the aircraft manufacturer’s specifications for reliability and undetected failure rates. Without knowing the exact failure mechanism, there was limited potential for the ADIRU manufacturer to redesign units to prevent the failure mode. However, it will develop a modification to the BITE to improve the probability of detecting the failure mode if it occurs on another unit.
Use of seat belts
At least 60 of the aircraft’s passengers were seated without their seat belts fastened at the time of the first pitch-down. Consistent with previous in-flight upset accidents, the injury rate, and injury severity, was substantially greater for those who were not seated or seated without their seat belts fastened.
Passengers are routinely reminded every flight to keep their seat belts fastened during flight whenever they are seated, but it appears some passengers routinely do not follow this advice. This investigation provided some insights into the types of passengers who may be more likely not to wear seat belts, but it also identified that there has been very little research conducted into this topic by the aviation industry.
Investigation process
The Australian Transport Safety Bureau investigation covered a range of complex issues, including some that had rarely been considered in depth by previous aviation investigations. To do this, the investigation required the expertise and cooperation of several external organisations, including the French Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile, US National Transportation Safety Board, the aircraft and FCPC manufacturer (Airbus), the ADIRU manufacturer (Northrop Grumman Corporation), and the operator.
Passenger safety
A key safety message for passengers in the AO-2008-070 final report is the importance of wearing seat belts when seated in flight, even when the seat-belt sign is not illuminated. As stated in the report:
At least 60 of the aircraft's passengers were seated without their seat belts fastened at the time of the first pitch-down. Consistent with previous in-flight upset accidents, the injury rate, and injury severity, was substantially greater for those who were not seated or seated without their seat belts fastened.
Further information on the wearing of seat belts and other advice for minimising injury risk during turbulence and other in-flight upsets is also available in the ATSB Aviation Safety Bulletin Staying safe against turbulence.
Public safety advice about the importance of wearing seat belts on aircraft has also been provided by the Australian Civil Aviation Safety Authority.
A video showing the effects of not wearing seat belts during a simulated in-flight upset is available on the US Federal Aviation Administration website. The video simulates a turbulence event, whereas the in-flight upset on 7 October 2008 near Learmonth, Western Australia was due to pitch-down commands from the aircraft's flight control system.
Regardless of why an upset occurs, the message is the same: Wearing a seat belt during all phases of a flight, and having the seat belt fastened low and firm, will significantly minimise the risk of injury in the unlikely event of an in-flight upset.
Second interim report
Report release date: 18/11/2009
This report provides an update to the first Interim Factual Report on this occurrence that was released on 6 March 2009.
The interim report should be read in conjunction with the first interim report. The contents of this second interim report focus on summarising new activities conducted since the previous report, providing information on relevant topics not released in the previous report, and updating information on relevant topics where there have been significant changes. Further details of new and ongoing activities will be provided in the Australian Transport Safety Bureau's (ATSB) final report.
The information contained in this interim factual report is derived from the ongoing investigation of the occurrence. Readers are cautioned that there is the possibility that new evidence may become available during the remainder of the investigation that alters the circumstances as depicted in this report.
The investigation is continuing.
First interim report
Report release date: 06/03/2009
At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. From about the same time there were various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down and descended about 400 ft during this second event.
At 1249, the crew made a PAN urgency broadcast to air traffic control and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.
One flight attendant and 11 passengers were seriously injured, and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened or were standing. As there were serious injuries, the occurrence constituted an accident.
The investigation to date has identified two significant safety factors related to the pitch-down movements. Firstly, immediately prior to the autopilot disconnect, one of the air data inertial reference units (ADIRUs) started providing erroneous data (spikes) on many parameters to other aircraft systems. The other two ADIRUs continued to function correctly. Secondly, some of the spikes in angle of attack data were not filtered by the flight control computers, and the computers subsequently commanded the pitch-down movements.
Two other occurrences have been identified involving similar anomalous ADIRU behaviour, but in neither case was there an in-flight upset.
Preliminary report
Report release date: 14/11/2008
At 0932 local time (0132 UTC) on 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA, departed Singapore on a scheduled passenger transport service to Perth, Australia. On board the aircraft (operating as flight number QF72) were 303 passengers, nine cabin crew and three flight crew. At 1240:28, while the aircraft was cruising at 37,000 ft, the autopilot disconnected. That was accompanied by various aircraft system failure indications. At 1242:27, while the crew was evaluating the situation, the aircraft abruptly pitched nose-down. The aircraft reached a maximum pitch angle of about 8.4 degrees nose-down and descended 650 ft during the event. After returning the aircraft to 37,000 ft, the crew commenced actions to deal with multiple failure messages. At 1245:08, the aircraft commenced a second uncommanded pitch-down event. The aircraft reached a maximum pitch angle of about 3.5 degrees nose-down and descended about 400 ft during this second event.
At 1249, the crew made a PAN emergency broadcast to air traffic control and requested a clearance to divert to and track direct to Learmonth. At 1254, after receiving advice from the cabin crew of several serious injuries, the crew declared a MAYDAY. The aircraft subsequently landed at Learmonth at 1350.
Currently available information indicates that one flight attendant and at least 13 passengers were seriously injured and many others experienced less serious injuries. Most of the injuries involved passengers who were seated without their seatbelts fastened. This constituted an accident under the ICAO definition outlined in Annex 13 to the Chicago Convention and as defined in the Transport Safety Investigation Act 2003.
Examination of flight data recorder information indicates that, at the time the autopilot disconnected, there was a fault with the inertial reference (IR) part of the air data inertial reference unit (ADIRU) number 1. From that time, there were many spikes in the recorded parameters from the air data reference (ADR) and IR parts of ADIRU 1. Two of the angle-of-attack spikes appear to have been associated with the uncommanded pitch-down movements of the aircraft.
At 2108 Eastern Standard Time on 09 August 2005, a Boeing Company 737-700 aircraft, registered VH-VBD, completed a scheduled flight from Melbourne, Victoria to Sydney, NSW. The pilot then reported that the aircraft had 'heavy' flight controls. An inspection by maintenance engineers revealed that the left lower rear elevator cable was incorrectly routed around a stiffener and that the stiffener and cable section had been damaged as a result of contact between them. The aircraft was withdrawn from service for repairs.
In the last week of July 2005, a contract maintenance organisation had replaced eight elevator control cable sections during a scheduled heavy aircraft maintenance check. The cables were replaced to comply with Boeing Company service bulletin 737-27-1254 revision 1.
While preparing the rear elevator control cables for removal, a cable end was not secured at the lower left rear elevator input quadrant, before removing the cable keeper. When the cable keeper was removed, the unsecured cable section slipped from sight. While recovering the cable, it was inadvertently misrouted around a fuselage stiffener. When the new cable was pulled into place it followed the same incorrect route around the stiffener. This resulted in contact between the cable and the stiffener.
As a result of the occurrence, the contract maintenance organisation implemented a number of changes to improve maintenance planning and documentation.
At approximately 1703 Western Standard Time, on 1 August 2005, a Boeing Company 777-200 aircraft, (B777) registered 9M-MRG, was being operated on a scheduled international passenger service from Perth to Kuala Lumpur, Malaysia. The crew reported that, during climb out, they observed a LOW AIRSPEED advisory on the aircraft’s Engine Indication and Crew Alerting System (EICAS), when climbing through flight level (FL) 380. At the same time, the aircraft’s slip/skid indication deflected to the full right position on the Primary Flight Display (PFD). The PFD airspeed display then indicated that the aircraft was approaching the overspeed limit and the stall speed limit simultaneously. The aircraft pitched up and climbed to approximately FL410 and the indicated airspeed decreased from 270 kts to 158 kts. The stall warning and stick shaker devices also activated. The aircraft returned to Perth where an uneventful landing was completed.
The aircraft’s flight data recorder (FDR), cockpit voice recorder and the air data inertial reference unit (ADIRU) were removed for examination. The FDR data indicated that, at the time of the occurrence, unusual acceleration values were recorded in all three planes of movement. The acceleration values were provided by the aircraft’s ADIRU to the aircraft’s primary flight computer, autopilot and other aircraft systems during manual and automatic flight.
Subsequent examination of the ADIRU revealed that one of several accelerometers had failed at the time of the occurrence, and that another accelerometer had failed in June 2001.
Graphical and animated representation of flight data
Various representations of key parameters were prepared from the 9M-MRG downloaded flight data to assist in the analysis.
Graphical representation of relevant recorded data
General parameters over a 60-minute period containing the entire incident flight are displayed, see figure 6. Other relevant parameters are displayed over a 5-minute period incorporating the upset event, see figures 7-10.
Animated representation of relevant recorded data
An animation of the incident was prepared using Insight Animation™ software and is part of this report. A file containing the animation in Insight View™ format (.isv) is available for download from the ATSB website. This file requires the installation of an Insight Viewer that can be downloaded from www.flightscape.com at no charge. A still screen capture of the animation is shown at figure 11.
Download animated representation of flight data [4.4Mb.zip] please see the information above regarding the playing of this file.
The Australian Transport Safety Bureau did not conduct an on-scene investigation of this occurrence. The report presented below was derived from information supplied to the Bureau.
On 20 July 2004, a Cessna Aircraft Company 206, registered VH-DSP, struck trees while the pilot was attempting to land at Medlow Bath airfield (Katoomba) in the Blue Mountains, NSW. The aircraft was being operated on a private flight carrying two passengers from Canberra to Katoomba.
The pilot reported that on arrival at Katoomba, he overflew the airfield. After observing the surface wind direction from the windsocks, he elected to land on the south-west strip. The pilot extended the aircraft wing flaps to 10 degrees for the approach and landing. During the landing flare, when the aircraft was about 8 ft above the ground, it began to drift to the right because of crosswind. The pilot applied left rudder to counter the drift and to regain control of the aircraft, but the drift continued. The pilot then decided to discontinue the landing, and applied go-around power. Moments later, the aircraft impacted a pile of felled trees adjacent to, and to the right of, the landing strip. The aircraft came to rest in an inverted attitude and was extensively damaged. The three occupants received minor injuries but were able to exit the aircraft unaided.
Figure 1: Aerial view of the Medlow Bath airfield showing the aircraft wreckage.
The Bureau of Meteorology (BoM) provided an assessment of the surface wind conditions at Katoomba airstrip on the day of the occurrence. BoM analysed the wind data recorded by the Mt Boyce automatic weather station (AWS), which was located near Katoomba airstrip. The recorded data revealed that the surface wind was from the south-southwest at 5 to 8 kts (mean) for most of the day, with gusts to 11 kts. BoM reported that stronger gusts probably occurred, but because of their transient nature, they were not recorded by the AWS.
A witness at Katoomba airstrip observed the accident and reported that a crosswind gust of about 15 to 20 kts occurred as the aircraft was landing. The witness observed the aircraft rolling to the right before cartwheeling into the timber.
The pilot's attempt to counter the unexpected and sudden increase in the crosswind was unsuccessful. The investigation concluded that the aircraft's continued drift to the right of the runway while still airborne, and the late attempt by the pilot to discontinue the landing, resulted in its inadvertent impact with the pile of felled trees.
The Australian Transport Safety Bureau recommends that the Rottnest Island aerodrome operator and the Bureau of Meteorology evaluate the feasibility of transmitting the one minute data from the Rottnest Island AWS on a discrete VHF radio frequency.
Significant Factors
Strong crosswinds existed during the attempted take-off, which on the information available had probably exceeded the maximum permitted crosswind limit for the aircraft type.
The aircraft encountered wind gusts and turbulence during the take-off roll and probably became airborne at an airspeed less than that required for safe flight.
The pilot continued the takeoff attempt without adequate control of the aircraft, and the aircraft did not attain the performance required to avoid collision with objects.
Analysis
The circumstances of the accident were consistent with the pilot being unable to maintain control of the aircraft, while attempting to take-off in strong crosswind conditions. On the information available, these conditions were probably in excess of the stipulated crosswind limits for the aircraft. The damage to the trailing edge of the right aileron confirmed that the pilot had applied aileron into wind. However, that control deflection could not prevent the aircraft rolling to the right during the take-off and the right wingtip struck the ground.
The difficulty experienced by the pilot in maintaining directional control could also have been influenced by the local effects of the strong wind flowing around the sand hills immediately to the south of the runway. The pilot had probably underestimated the strength of the wind when interpreting the aerodrome's windsock prior to deciding to attempt to takeoff, having determined that the crosswind was within the published limits for his aircraft.
The distance between the runway threshold and the point where the aircraft commenced to diverge from the runway centreline, the absence of a significant headwind component and the passenger recollections of a short ground roll and low ground speed were each consistent with the aircraft becoming airborne at a low speed. It was possible that the inability of the aircraft to climb clear of the ground was affected by the aircraft becoming airborne at a lower than normal airspeed, which also contributed to the reported ineffectiveness of the aircraft's flight controls. The passenger recollection of a red flashing light on the instrument panel was also consistent with activation of the stall warning light, which would have illuminated if the aircraft's nose was pitched up to initiate a climb and the airspeed was below about 60 - 65 kts.
The aerodrome forecasts issued by BoM generally described the observed conditions at Rottnest Island for the day of the accident. The forecasts predicted the existence of strong southerly winds during the afternoon, which exceeded the aircraft's maximum permitted crosswind component. The weather reports issued by the Bureau during the day were available to the pilot from a number of sources and could have assisted the pilot to assess the strength of the prevailing wind.
Pilots can expect to regularly encounter strong crosswinds during operations at Rottnest Island. During some months of the year the crosswind component will regularly exceed the stipulated crosswind limits of most light aircraft.
The decision by the pilot to attempt a takeoff was made without access to all available information, which included data from the Rottnest Island AWS. It was probable that the pilot would not have attempted to takeoff had he realised that the wind conditions were so extreme.
Summary
The pilot of the Piper PA 32-260 was conducting the return sector of a charter flight for five passengers from Rottnest Island to Jandakot, WA.
The pilot reported that a strong and gusty southerly wind was blowing almost directly across the runway, but favoured a departure from runway 27. He used the indications from the aerodrome's windsock to assess the wind strength and determined that it was within acceptable limits for his aircraft.
Shortly before 1600 WST, the pilot taxied the aircraft to the threshold of runway 27. The pilot reported that he used a conventional crosswind technique for the take-off, with full aileron deflection into wind and use of rudder to maintain the aircraft on the runway centreline. The pilot reported that the airspeed indicator was reading about 65 - 70 kts when he positively rotated the aircraft nose for the initial climb. However, the aircraft did not respond to these control inputs and started drifting to the right. Despite applying full deflection of the rudder and aileron controls, the pilot reported that he was unable to maintain directional control of the aircraft.
The aircraft continued to diverge from the runway centreline, departing to the right of the runway strip and passing over a sealed taxiway and sandy scrub terrain. The right main landing gear collided with a tree stump on the edge of a shallow salt-water lake adjacent to the aerodrome. The aircraft briefly became airborne before coming to rest in the lake, in water that was less than 1 m deep. The pilot and passengers were not injured and vacated the aircraft without assistance. Although the aircraft was carrying an inflatable life jacket for each person on board, nobody was wearing one at the time of the accident and nor was this required by regulation.
Examination of the aircraft did not reveal any defect that could have affected its normal operation. Damage to the propeller blades was consistent with the engine operating at a high-power setting on impact with the water. Marks on the lower surface of the right wingtip were consistent with the tip of the right wing dragging across a hard sealed surface. The outboard portion of the right aileron also exhibited evidence of contact with a hard sealed surface.
The passengers recalled that the aircraft started to become airborne at a ground speed that seemed slower than the speed achieved during take-off from Jandakot earlier that day. They also reported that the ground roll along the runway seemed shorter. One of the passengers also described seeing a flashing red light on the instrument panel during the take-off attempt.
The pilot reported that following the accident he returned to the terminal building and was watching the aerodrome's windsock. During this period, he reported that the wind direction occasionally seemed to favour a departure from runway 09.
Examination of the runway revealed marks that indicated the aircraft commenced diverging from the runway centreline approximately 270 m from the threshold of runway 27. The aircraft's ground track was evident as it departed the runway strip and crossed the sealed taxiway. The ground track included abrasion marks from the tip of the right wing and the trailing edge of the right aileron, together with the track of the right main wheel. The marks on the right wingtip indicated that the aircraft was in a sideslip at the time and the nose was displaced right of the actual track across the ground. The aircraft came to rest about 530 m from the runway threshold and 120 m to the right of the runway centreline.
The aerodrome forecast issued by the Bureau of Meteorology (BoM) and current at the time of the accident forecast a wind from 190 degrees true (T) at 25 kts. BoM also issued routine half-hourly weather reports of the recorded conditions at the Rottnest Island automatic weather station (AWS). The report issued at 1530 indicated that the wind was 190 degrees T at 30 kts, gusting to 38 kts. These conditions were consistent with other reports issued on the afternoon of the accident.
The AWS for Rottnest Island is situated approximately 2 NM to the west of the aerodrome, on higher terrain about 160 ft above the aerodrome elevation. The site for the AWS is an exposed part of the island, and consequently, the recorded wind speeds could be expected to exceed those that would be experienced at the aerodrome.
Information from the AWS was not broadcast on either a discrete very high frequency radio or the Rottnest Island non-directional beacon navigation aid. The half-hourly reports issued by BoM could be obtained by pilots during pre-flight briefing and on request in-flight from air traffic services' Flightwatch frequency.
Minute by minute data from the Rottnest Island AWS indicated that during the 5 minutes prior to the accident, the maximum recorded wind speed was 38 kts, minimum wind speed 25 kts, from directions between 181 and 198 degrees T.
The east-west orientation of the runway at Rottnest Island and a series of sand hills to the south of the runway can significantly influence operations at the aerodrome, particularly at times when strong southerly winds prevail. This can include the effects of low-level wind shear, low-level turbulence in the lee of the sand hills and other conditions due to the behaviour of strong winds as they flow over and around the terrain.
Climatology studies of Rottnest Island conducted by BoM indicate that the runway is not aligned with the prevailing winds, and consequently, pilots can expect to frequently encounter crosswind conditions when operating at the aerodrome. In general terms, the strongest southerly crosswind components are more prevalent during the afternoons of the summer months. Strong northerly crosswinds appear to be more prevalent during the afternoons of the winter months. Records indicate that the runway crosswind component regularly exceeds 20 kts.
The pilot reported that he did not obtain a weather forecast for the day of the accident, but had received an operational briefing by telephone from the company chief pilot, prior to departing Jandakot on the first flight of the day. This briefing had included information obtained by the chief pilot on the weather conditions forecast for the day. The pilot did not obtain additional information or update the briefing received from the chief pilot during the course of the day.
The investigation calculated that the aircraft's operating weight at the time of the accident was below the maximum permitted take-off weight, with the centre of gravity in the vicinity of the published aft limit.
Forces acting on the aircraft during the initial stages of its take-off roll would cause the nose to yaw to the left as engine power was applied. In addition to this effect, at low speed during a crosswind take-off, the stability of the aircraft was such that the fuselage had the tendency to weathervane into wind. Control of the aircraft in those conditions required the application of a crosswind take-off technique to safely control the aircraft. From the perspective of aircraft controllability, a crosswind from the left (as was the case for the accident flight) was the more significant. This was due to the tendency of the aircraft nose to yaw left due to the crosswind, combining with the tendency of the aircraft nose to yaw left due to the application of engine power. The tendency of the aircraft nose to yaw is counteracted by the pilot applying right rudder, with the required amount of rudder input generally reducing as the aircraft accelerates and the rudder becomes more effective. During the later stages of the take-off roll, some left rudder input may have been required to maintain the aircraft on the runway centreline.
The investigation could not positively determine the airspeed of the aircraft at the time the pilot attempted to rotate the aircraft's nose to initiate the climb from the runway.
The US Federal Aviation Administration approved flight manual for the PA32-260 indicates that the demonstrated take-off or landing crosswind component is 20 miles per hour (17 kts). The Civil Aviation Safety Authority approved flight manual for the aircraft type stipulates a maximum permissible crosswind component of 20 kts.
