On 27 October 2017, at 1410 Eastern Daylight-savings Time (EDT),[1] a captain and first officer signed on for flight duty at Brisbane Airport, Queensland. The planned duty was to operate a JetGo Embraer ERJ135 aircraft, registered VH-ZJG, on four scheduled passenger transport sectors: from Brisbane to Dubbo, New South Wales, Dubbo to Essendon, Victoria, Essendon to Dubbo, and Dubbo to Brisbane.
The aircraft was scheduled to depart Brisbane at 1510. However, the flight crew were advised of an engineering delay of up to 45 minutes for unscheduled maintenance to change a main landing gear tyre. A replacement tyre was not immediately available, which resulted in an extended delay that eventually totalled 4 hours 15 minutes.
The aircraft departed Brisbane at 1925 and, after an uneventful flight, departed Dubbo for Essendon at 2116. The first officer was the pilot flying (PF) and the captain was the pilot monitoring (PM) for the sector from Dubbo to Essendon.[2]
Prior to commencing descent, the flight crew programmed the aircraft’s flight management guidance system and briefed for an instrument landing system[3] (ILS) approach to runway 26. It was the first time either pilot had operated into Essendon at night, and therefore their preferred approach was a runway 26 ILS approach. The flight crew also discussed the possibility of receiving radar vectors[4] from air traffic control (ATC).
ATC informed the flight crew that due to aircraft traffic at neighbouring Melbourne Airport, runway 26 was unavailable. Therefore, ATC provided radar vectors for a visual approach to runway 35. As the aircraft passed abeam Melbourne Airport, the captain had Melbourne and Essendon runways in sight.
At 2220:18, ATC advised the flight crew that they would be positioned for a 5 NM (9.3 km) final approach at 2,100 ft above mean sea level (AMSL). This altitude was the radar lowest safe altitude for that sector of airspace. At 2221:48, ATC instructed the flight crew to descend to 2,100 ft.
The first officer recalled setting 2,100 ft on the aircraft’s altitude preselector. This directed the automatic flight control system (AFCS) to continue descent to 2,100 ft. He also recalled confirming the 2,100 ft set altitude on his primary flight display, as well as the flight director modes of heading and vertical speed mode. The captain recalled verifying the assigned altitude being set and flight director modes. Both flight crew recalled the autopilot was engaged at this time.
At 2223:02, as the aircraft passed about 2,300 ft on descent, ATC requested the flight crew to report sighting runway 35. At this time, the captain had lost sight of the runway. Becoming concerned that the captain could not visually identify the runway, the first officer also focused his attention looking outside the aircraft to the left to help locate the airport.
At about 2223:35, when 7.1 NM (13.1 km) from Essendon Airport and on a heading of 080°, the aircraft descended below the assigned altitude of 2,100 ft. Neither flight crew detected the aircraft was now below the radar minimum safe altitude and continuing to descend. When the captain next looked inside the aircraft at his primary flight display, he recalled seeing the altimeter indicating 1,600 ft, and he then called ’height’. The first officer also recalled seeing that they were below the assigned altitude at the same time.
At 2223:52, ATC instructed the flight crew to climb to 2,100 ft. However, that instruction was over transmitted by another aircraft and not heard by the flight crew. At 2223:58, ATC issued another instruction to climb immediately to 2,100 ft, which the flight crew acknowledged.
At 2224:05, a cleared level adherence monitoring (CLAM) alarm[5] activated (Figure 1), further alerting ATC of a difference between the aircraft’s assigned altitude and its actual altitude. ATC immediately issued a terrain safety alert, advising the flight crew that the lowest safe altitude was 2,100 ft.
Recorded radar data showed the aircraft’s lowest altitude was about 1,500 ft during 2224:05 to 2224:10 (Figure 1).
Figure 1: Image of air traffic controller’s monitoring screen showing CLAM alarm activation following the aircraft’s descent below 2,100 ft
Image shows the aircraft (JG044) with a current altitude of 1,500 ft (‘015’), a cleared altitude of 2,100 ft (‘021’), a radar vectored heading of 070° (‘H070’) and a groundspeed of 160 kt (‘16’).
Source: Airservices Australia
As the aircraft climbed above 2,100 ft, ATC advised the flight crew of their position relative to runway 35 and asked if they had the runway in sight. When they confirmed that they did, ATC asked if they wanted to continue the approach. The flight crew elected to discontinue the approach and ATC subsequently vectored the aircraft for another approach. The aircraft landed without further incident at 2236.
At 2259, the aircraft taxied for departure from Essendon and then completed the service to Dubbo and Brisbane. The flight crew finished duty in Brisbane at 0245.
Airport information
Essendon Airport is located about 8 km south-east of Melbourne Airport. The proximity of the two airports adds complexity to operations at Essendon.
The airport has two runways aligned 17/35 and 08/26, and it is bounded on two sides by freeways with substantial amber lighting and well-lit residential areas. At night, the lights around the airport present a complex picture. The published aerodrome chart had a caution note describing that amber freeway lighting may confuse flight crews when attempting to identify runway 08/26 lighting.
Runway 35 did not have an instrument approach procedure. Instead, pilots were required to conduct visual approaches to this runway. It was equipped with a precision approach path indicator light (PAPI) array to provide pilots with vertical profile guidance during visual approaches.
At the time of the occurrence, visibility was greater than 10 km, and the wind was a northerly at 14 kt.
Essendon Airport had a curfew prohibiting aircraft movements from 2300 until 0600 for all operations other than emergency services. Operators would incur financial penalties for flights arriving or departing during the curfew period.
To continue the service from Essendon to Dubbo (and then Brisbane), the aircraft had to commence taxiing for departure before the curfew. Missing curfew would result in the aircraft being grounded until 0600 the next morning, disrupting the current service and that of the following day.
The aircraft taxied for the return flight from Essendon at 2259, 1 minute before the commencement of the curfew period. Both flight crew reported feeling significant pressure to complete the service and return the aircraft to Brisbane. Both pilots reported being aware of the potential problem with the curfew prior to departing Brisbane, and the first officer reported considering the potential problem with the curfew during the visual approach into Essendon.
Air traffic control information
Airservices Australia provided an ATC service to the aircraft for the entire flight, including the descent to Essendon. The approach controller who provided radar vectors to the flight crew was also responsible for sequencing a large number of aircraft arrivals into Melbourne at the same time.
In an effort to manage the risk that neither pilot had operated at night into Essendon, the captain’s preferred arrival was to runway 26 as it was equipped with an ILS and was the longer runway. However, due to the congestion of arriving and departing aircraft at Melbourne, ATC advised this request was not available. Although the captain maintained the ability to instruct ATC that he required the ILS approach, he was likely aware that doing so would possibly result in ATC needing the aircraft to enter a holding pattern until the controller could sequence the flow of aircraft traffic at both airports.
When conducting a visual approach to a runway, ATC can provide radar vectors to the pilot until the aircraft is aligned with the runway centreline. A pilot is required to report that they have sight of, and can maintain sight of, the landing runway in order for ATC to clear a pilot to conduct the approach.
The flight crew reported that during the radar vectoring towards Essendon, they felt pressure from ATC to sight runway 35. The ATSB reviewed audio recordings between the approach controller and the flight crew. The flight crew first contacted Melbourne Approach at 2213:58. At 2223:02, the approach controller asked them to report Essendon runway 35 in sight. This was the only recorded request made by the approach controller to the flight crew to sight runway 35.
Automatic flight control system
Flight crews normally manage flight of an ERJ135 using the aircraft’s AFCS. This system consists of dual autopilots, a flight guidance controller (FGC) and flight instrument displays.
To manage the aircraft in all flight phases, pilots select various modes on the FGC. Selected descent modes included flight level change, speed hold and vertical speed.
The pilot can engage the autopilot by pressing a button on the FGC. Intentional disengagement of the autopilot by a pilot generates an audible voice AUTOPILOT alert. Failure and disconnection of an autopilot results in the same audible voice alert and generates a warning message illuminated on a separate indicating system.
In the ‘vertical speed’ (VS) selected descent mode, the AFCS will maintain a selected vertical speed. The rate of vertical speed can be changed as needed by the pilot. With the autopilot engaged, the VS mode would automatically change to altitude capture mode as the aircraft approached a preselected altitude.
An ‘altitude preselect’ (ASEL) mode armed automatically if the aircraft climbed or descended towards a preselected altitude. Altitude preselect mode would then automatically capture and cancel any existing mode at an appropriate point based on preselected altitude error and vertical speed. The system would then automatically switch to altitude hold mode after the aircraft had levelled off at the preselected altitude.
The first officer recalled selecting the descent mode to vertical speed at the time ATC commenced issuing radar vectors. The flight crew reported that the autopilot was engaged during the descent and that the AFCS failed to capture the preselected altitude (2,100 ft) as expected. Further, the flight crew recalled that no alert was heard, either for autopilot disconnect or altitude exceedance, which should have sounded when the aircraft was 200 ft below the preselected altitude.
After descending below 2,100 ft, the flight crew reported that the flight director pitch bars, which indicate the direction of the preselected altitude, were providing guidance that the aircraft should climb.
The ATSB requested the aircraft’s flight data recorder. However, at the time of the request, the data for the occurrence flight had been overwritten.
Following the flight, no technical log entry was made regarding a problem with the autopilot capturing the selected altitude. Nevertheless, an engineering inspection of the AFCS was conducted following the aircraft’s arrival back in Brisbane, and no fault was found.
The flight crew advised that they were aware of other recent AFCS problems associated with the aircraft and the operator’s other ERJ135 aircraft. A review of maintenance records for the operator’s ERJ135 fleet identified that several AFCS-related problems had been reported during the period from 3 August. However, none of those problems were similar to what occurred during the occurrence flight. In addition, no subsequent problems that were similar in nature were reported on the occurrence aircraft.
Flight crew information
The captain held an Air Transport (Aeroplane) Pilot Licence (ATPL) and had 10,100 hours total flight experience, including 155 hours on the aircraft type. The first officer held a Commercial (Aeroplane) Pilot Licence and had 2,100 hours total flight experience, including 473 hours on type.
Both flight crew had operated into Essendon on many previous occasions, but neither had operated to that airport at night.
Flight and duty times
The captain had the two previous days (2526 October) rostered off duty, and had conducted administrative work from 10001600 on the 24 October. The first officer had the four previous days rostered off duty.
On the day of the occurrence, both flight crew signed on to commence duty at 1410 EDT. Due to the delay before the first flight, they ultimately signed off duty at 0245, a duty period of 12.6 hours. However, the captain advised that he commenced administrative duties, unrelated to the subsequent flights, at about 1200 EDT. Therefore, his actual duty time was 14.8 hours.
The captain recalled waking up at about 0700 EDT on the day of the occurrence after a ‘normal’ sleep. He therefore had been awake for 15.4 hours at the time of the occurrence, and 18.8 hours at the end of the extended duty period. The first officer recalled waking up at 0630 EDT on the day of the occurrence after a ‘reasonable’ sleep, and was therefore awake for 15.9 hours at the time of the occurrence and 19.3 hours at the end of the extended duty period.
The operator managed its flight crews’ flight and duty times to comply with a standard industry exemption to Civil Aviation Order (CAO) 48.0, which was issued to the operator by the Civil Aviation Safety Authority (CASA). The exemption stated that duty included any task associated with the business of an operator.
The operator’s rostering personnel managed flight crew flight and duty times in order to comply with the exemption. The operator’s procedures required that all work-related activities for the operator be reported and considered as duty time.
The rostered flight duty limit for a pilot signing on after 1300 local time for a four-sector duty was 12 hours. However, a pilot could elect to extend a duty already started for up to 2 hours as long as they felt mentally and physically fit to continue (and they submitted a report upon completing the duty). Although the captain’s recorded duty time did not exceed 14 hours by the end of the trip, the actual duty time did exceed the limit.
During the delay on the ground in Brisbane, the crew were offered an option to stand down as they were now facing a long duty period. The captain reported that he was told his standing down would mean his four scheduled flights that day would be cancelled as there were no replacement captains available. Both pilots reported feeling fit to continue and elected to continue the flights. However, the captain later reported that he felt some pressure to operate the flights. The cabin crewmember stood herself down and was replaced.
Safety analysis
During radar vectoring to runway 35 at Essendon Airport, the aircraft descended below the radar minimum safe altitude of 2,100 ft. The flight crew reported that the autopilot was engaged and the altitude of 2,100 ft was preselected at the time of the occurrence. A subsequent engineering inspection found no fault with the AFCS. Because no flight data was able to be obtained, the ATSB was unable to confirm what the AFCS mode(s) and settings were at the time of the occurrence, or the reason why the aircraft descended below the preselected altitude.
Regardless of the reason for the aircraft descending through the prescribed altitude, flight crew have a vital role in monitoring the aircraft’s flight path, particularly during descent. In this case, the first officer (pilot flying) relied upon automation to capture the assigned altitude and diverted his attention outside of the aircraft to assist the captain (pilot monitoring) in sighting the runway. As a result, neither pilot was monitoring the aircraft’s flight instruments or descent path as it approached and subsequently descended through the assigned level, which was also the minimum safe altitude.
The flight had been significantly delayed from its scheduled time of operation. The flight crew were aware of the reduced time margin for their scheduled return flight to depart Essendon prior to the 2300 curfew. In addition, neither pilot had operated at night into Essendon Airport, and the captain’s requested option of conducting an ILS approach to runway 26 had been declined by ATC due to traffic. The captain’s subsequent difficulty in identifying runway 35 at night, the delayed arrival of the aircraft at Essendon and the proximity of the curfew time probably contributed to the first officer (pilot flying) focussing his attention outside the aircraft at a critical time of flight.
Both flight crew had the previous days off duty and had a reasonable amount of sleep the night before. Although both flight crew had been awake for 1516 hours at the time of the occurrence, there was insufficient evidence to conclude that they were operating at a level of fatigue known to influence performance at the time of the occurrence. Nevertheless, they would probably have been operating at an elevated risk of fatigue during the subsequent two flights.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
During radar vectoring to runway 35 at Essendon, the aircraft descended through the radar lowest safe altitude (2,100 ft). The extent to which there was a problem with the functioning of the aircraft’s automatic flight control system could not be determined.
Due to the captain (pilot monitoring) having difficulty sighting the runway, as well as perceived pressure to complete the flight, the first officer (pilot flying) focussed his attention outside the aircraft at a critical time during the descent.
The flight crew did not detect that the aircraft had descended through the assigned level (2,100 ft) until the aircraft reached 1,600 ft.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.
Aircraft operator
As a result of this occurrence, JetGo advised the ATSB that they had taken the following safety actions:
The flight crew involved in the incident were subsequently provided with ground and simulator training for operations into Essendon at night.
Safety message
Flight crew should be mindful that during higher workload phases of flight, such as during approach and landing at an unfamiliar airport, introducing tasks that divert both flight crew members’ attention from monitoring the aircraft’s flight profile and altitude should be minimised. Further, during a visual approach, pilots must ensure that at least one pilot monitors the aircraft’s flight path profile and energy state.
An increasing trend has been identified where pilots do not effectively manage their aircraft’s flightpath when unexpected events arise during the approach to land.
When compared to other phases of flight, the approach and landing has a substantially increased workload and is traditionally the phase of flight associated with the highest accident rate. Flight crews must continuously monitor aircraft and approach parameters, and the external environment, to ensure they maintain a stable approach profile and make appropriate decisions for a safe landing.
The selection of inappropriate autoflight modes, unexpected developments, or any confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the 18 July 2017, Pilatus PC‑12, registered VH-FDJ departed Alice Springs, Northern Territory for Adelaide, South Australia, on a routine single-pilot aeromedical patient transfer flight. During the approach into Adelaide, the pilot noted that the aircraft’s autopilot system failed to intercept the localiser for the Adelaide runway 23 instrument landing system (ILS) approach.
Unaware of why the autopilot did not intercept the localiser, the pilot then became focussed on determining the cause of the autopilot tracking issue while attempting to re-establish the aircraft back on the ILS to continue the approach. The pilot reported this resulted in high workload that was further increased by the tracking information displayed on the aircraft’s course deviation indicator not reflecting the position information being communicated by ATC.
The pilot continued the approach and commenced further descent after observing that the aircraft was close to becoming established on the localiser and that the glideslope was becoming active. Soon after, ATC notified the pilot that the aircraft was below the minimum permitted altitude for the aircraft’s position and instructed the pilot to climb the aircraft to a safe altitude. The pilot then conducted another ILS approach and landed.
What the ATSB found
The unexpected failure of the autoflight system to intercept and track the localiser resulted in the aircraft deviating from the surveyed instrument approach path and significantly increased the pilot’s workload.
The pilot’s focus on resolving the aircraft's lateral tracking and perceived autoflight issues during the localiser intercept decreased his attention on managing the aircraft’s approach profile. That led to the aircraft descending off-track below the minimum safe altitude.
Detection of the off‑track descent and subsequent intervention by the air traffic controller restored safe operation.
What's been done as a result
Following this incident, the operator amended their descent, arrival, and approach procedures, and training and checking procedures to be more prescriptive. In addition, the operator introduced dual global positioning systems, with moving map and chart overlay displays into their legacy aircraft, to improve pilot situation awareness.
Safety message
Adequate approach preparation, and management of aircraft flight profile and automation is vital to ensure pilots maintain manageable workloads and positional awareness during an approach. Additionally, pilots should not hesitate to conduct a go-around or a missed approach should the functionality of the aircraft’s automation, or the validity of positional information, be in doubt.
The occurrence
On the 18 July 2017 a Pilatus PC12, registered VH-FDJ, departed Alice Springs, Northern Territory, for a routine single-pilot aeromedical patient transfer flight to Adelaide, South Australia. The departure from Alice Springs and subsequent en-route phase of the flight was reported by the pilot to have proceeded normally.
Recorded data indicated that the aircraft reached the pilot’s calculated descent point from a cruise altitude of FL 250,[1] at about 42 NM (78 km) to the north-west of Adelaide Airport.
Before descending, the pilot reported that he obtained the available weather for Adelaide Airport and prepared the aircraft’s autoflight system for the arrival. This included programming the standard arrival route (STAR)[2] and instrument landing system (ILS)[3] approach frequency. The pilot also reported reviewing the respective arrival and approach charts displayed on the electronic flight bag screen.
At about 1240 Central Standard Time,[4] the aircraft left FL 250 to commence the Salty 1 STAR (Figure 1) and subsequently the runway 23[5] ILS. The pilot reported that as he was unfamiliar with the Salty 1 STAR, he elected to utilise the aircraft’s autoflight system and the Garmin 430 avionics system for navigation and descent.
Figure 1: Extract from the Adelaide Standard Instrument Arrival
Source: Airservices Australia modified by the Australian Transport Safety Bureau
The pilot reported that, during the descent, he noted a higher-than-normal groundspeed due to the strong westerly tailwind, however this decreased as the approach progressed to lower altitudes. As the aircraft approached the GLOBE waypoint, the pilot crosschecked the aircraft’s profile using the global positioning system (GPS) unit’s calculated profile. Noting that the aircraft was slightly high at that position, the pilot increased the selected descent rate on the autoflight system.
Just after passing the ELIZA waypoint and prior to turning inbound to intercept the localiser at GULLY, the pilot changed the primary navigation source from GPS navigation mode to a heading mode. This autoflight mode change was required to enable the pilot to set the inbound course for the ILS, to facilitate an intercept of the localiser for the runway 23 ILS approach. The pilot then recalled changing the autoflight system back to navigation mode to continue navigation to the waypoint GULLY and armed the approach mode for the ILS intercept. The estimated time available to complete these tasks was less than two minutes.
The pilot reported that the aircraft overshot the required intercept at GULLY. In response, he manipulated the autoflight system by turning the aircraft in the control wheel steering mode in an attempt to re-capture the localiser. At about that time, air traffic control (ATC) advised the pilot that the aircraft had flown through the localiser, ATC issued altitude and heading instructions to assist with a re-intercept. The pilot reported that this required him to cancel the current autoflight selections, including approach mode, to enable a heading to be selected and flown. The workload at this time was reported by the pilot to have been high as he attempted to determine the functionality of the aircraft’s autoflight and navigation systems.
Soon after, ATC gave the pilot radar information that positioned the aircraft left of the localiser. A clearance to conduct the ILS approach was then communicated, with a further request for the pilot to confirm when he was established on the approach. The pilot recalled that at that time he was still trying to determine the issues with the autoflight system and why the course deviation indicator (CDI) was giving conflicting information, indicating the aircraft was slightly right of the localiser. There was no recorded communication from the pilot reporting that the aircraft was established on the approach.
While trying to re-establish the aircraft on the localiser, the pilot observed the glideslope becoming active. As he believed that the aircraft was close to intercepting the inbound track, the descent was continued.
Recorded information confirmed that a short time later, ATC issued an altitude alert to the pilot to check his altitude. This was followed with instructions to climb to a new cleared altitude, to maintain the required terrain clearance, and to fly a different heading in anticipation of conducting another ILS approach.
The pilot reported that he followed the ATC issued radar vectors back to the commencement of the runway 23 ILS approach, where an intercept of the localiser using the autoflight system was made. The second approach was flown without issue.
Pilot information
The pilot was appropriately qualified for the flight, holding a Commercial Pilot Licence (Aeroplane). He also held an instrument rating for both multi-engine and single-engine aeroplanes. The pilot’s logbook recorded a total aeronautical experience of about 6,250 hours.
The logbook indicated that the pilot had about 5,800 hours in command of single-engine aircraft, which included about 640 hours flying Pilatus PC12 (PC12) aircraft.
The pilot had reportedly used the Garmin 430 avionics system before and had previous experience flying the PC12 legacy aircraft (see the section titled Operations). The pilots training file noted the pilot appeared to have no difficulty using the Garmin 430.
The appropriate flight reviews and proficiency checks had been conducted and the pilot was deemed competent to conduct line flying operations by the operator on the 5 July 2017.
The pilot held a valid class 1 aviation medical certificate and reported that he was well-rested prior to the flight and was in good health.
Weather
The pilot reported experiencing a strong westerly tailwind of about 57 kt during the descent and that the approach was conducted in instrument meteorological conditions. However, he noted that as the aircraft descended, the wind decreased and cloud layers were observed.
During the time of the aircraft’s arrival, the trend forecast for Adelaide Airport indicated a cloud base of 1,800 ft with broken cloud at 6,200 ft and wind from 280° M at 19 kt. There were also expected periods of up to 30 minutes duration where the weather would deteriorate, with the wind at 270° M at 22 kt gusting to 38 kt and the visibility reducing to 3,000 m in showers of rain.
Operations
The operator conducted aeromedical services throughout most regions of South Australia and the Northern Territory. The Pilatus PC12 aircraft was the only aircraft type used by the operator. The operator had three variants of the PC12, namely the PC12/45, PC12/47 and PC12/47E. The older PC12/45 and PC12/47 (sometimes referred to as the ‘legacy’) had different avionics and operating characteristics to the newer PC12/47E (referred to as the ‘NG’).
The operator had a valid Air Operator’s Certificate that enabled the use of PC12 aircraft in the charter and aerial work categories, which included the conduct of ambulance functions. The operator also had approval to conduct training and proficiency checks in accordance with the Civil Aviation Safety Regulations 1998.
The operator’s PC12 flight training manual provided basic reference material that related to initial pilot training. The flight training manual included an outline of the training syllabus, checklists and some lesson plans to assist the instructor with training preparation. The flight training manual did not provide any guidance to pilots as to the procedures and operational considerations while flying the PC12.
The flying operations manual outlined the standard operating procedures (SOPs) for a descent and approach. It included that:
At an appropriate time, the pilot is to review the intended approach procedure, including where applicable:
a. instrument or visual approach,
b. airfield information from ERSA, Jeppesen or OPS28 Airfield Register,
c. If an instrument approach procedure is required:
- correct chart, aids and frequencies, - airfield elevation and MSA [minimum sector altitude], - initial approach altitude and entry procedure, - approach procedure, - visual procedure - restrictions, runway, aircraft configuration, and - missed approach procedure.
Checklists used by pilots during flight listed that an ‘approach review’ was to be completed before transition. It was reported by the operator that in the case of longer flights, such as Alice Springs to Adelaide, an approach review and flight instrument setup actions should be completed before commencing the descent.
There was no guidance for pilots as to the operator’s expected flight instrument settings for the arrival. However, the operations manual highlighted the importance of pre-arrival planning and flight instrument set-up during the approach/landing phase. It included procedures for the conduct of a non-precision approach (other than area navigation[6]), area navigation approach and precision approach. There was no guidance to pilots as to when an approach review/brief and flight instrument setup should occur.
The operators expected instrument setup for VH-FDJ (FDJ) differed from other PC12 aircraft in the operator’s fleet due to variation in FDJ’s avionics. The operations manual required that specific familiarisation training was required for pilots flying VH-FDJ due to the differences with all other aircraft in the fleet. The pilot had conducted in-flight training in FDJ prior to the incident.
It was reported by the operator that a pilot flying FDJ should ensure that the inbound course was set on the CDI prior to commencing the STAR. This would alleviate the requirement to change between navigation modes once the STAR had commenced. It would also reduce pilot workload during the descent and arrival.
Training
The operator conducted ground theory training, endorsements, and line training for pilots flying the PC12 variants. The PC12 fleet comprised nine of the newer (NG) type aircraft fitted with ‘glass cockpit’ avionics, and eight older (legacy) type aircraft, with different avionics and operating characteristics. Training provided pilots with familiarity of both types. The occurrence pilot had significant previous experience on the legacy PC12 so the major component of his in command under supervision (ICUS) training concentrated on the NG variant.
The operator’s flight training records identified that the pilot had successfully completed all components of the operators training syllabus. However, notes made during the training identified that the pilot had difficulty at times with profile management, and approach preparation. These issues were not apparent during the pilot’s final flight check for commencement of line operations.
The pilot completed about 96 hours of in-flight training before being approved to conduct line flying operations on the 5 July 2017. The training consisted of 28 training flights, which included 24 flights with the newer PC12 NG variant and four flights with the PC12 legacy aircraft.
Following this occurrence, the pilot completed six remedial flights, two of which were in legacy aircraft. Those flights identified that the pilot required additional training with approach preparation. This included conducting more thorough approach briefings and ensuring that the approach checks and setup were not left too late in order to avoid high workload situations. The pilot’s training notes also emphasised the importance of conducting a go-around if the approach became unstable. At the end of this training the pilot was re‑checked and resumed line flying operations.
Related occurrences
A database search identified a number of occurrences with aircraft descending below the minimum safe altitude. The occurrences have primarily involved aircraft on approach to land. They include situations where pilot(s) attention has been on other tasks during higher workload phases of flight, such as during the later stages of an instrument approach. The ATSB has published the following related safety investigation reports.
AO-2015-018: Flight path management and descent toward the lower limit of controlled airspace involving Airbus A320, VH-VND, on approach to Melbourne Airport, Victoria, on 11 February 2015
On 11 February 2015, an Airbus A320 aircraft, registered VH‑VND and operated by Tiger Airways, was conducting a scheduled passenger service from Hobart Airport, Tasmania to Melbourne Airport, Victoria.
At about 1750 Eastern Daylight-saving Time, about 9 NM (17 km) north of Melbourne Airport, and after the flight crew had been cleared by air traffic control to conduct a visual approach, the aircraft descended below the minimum safe altitude, though the aircraft remained in controlled airspace.
During the descent, both flight crew became preoccupied with other tasks inside the flight deck, which had the effect of increasing their workload and distracting them from monitoring the aircraft’s flight path and altitude. About two minutes after commencing descent on the visual approach, the flight crew levelled the aircraft after realising that it appeared to be low on profile. A safety alert issued by air traffic control soon followed and in response, the aircraft was climbed to intercept the recommended visual approach descent profile. The remainder of the flight was uneventful and the aircraft landed on runway 16 at Melbourne Airport.
AO-2016-012: Descent below segment minimum safe altitude during a non-precision instrument approach involving Airbus A320, PK-AXY, 17 km WSW Perth Airport, Western Australia on 19 February 2016
On the evening of 19 February 2016, an Airbus A320 aircraft, registered PK-AXY and operated by PT Indonesia AirAsia was on a scheduled passenger service from Denpasar, Indonesia to Perth, Australia. During cruise, the captain’s flight management and guidance computer (FMGC1) failed. Due to the failure, the flight crew elected to use the first officer’s duplicate systems. For the aircraft’s arrival in Perth there was moderate to severe turbulence forecast below 3,000 ft with reports of windshear. The crew commenced an ILS approach to runway 21.
During the approach, the flight crew made a number of flight mode changes and autopilot selections, normal for an ILS approach with all aircraft operating systems available. However, some of those flight modes and autopilot selections relied on data from the failed FMGC1 and the auto-thrust system commanded increased engine thrust. The crew did not expect this engine response and elected to conduct a go-around. With an increasing crosswind on runway 21, the crew accepted a change of runway, to conduct a non-precision instrument approach to runway 06.
With the time available, the first officer programmed the new approach into his FMGC and conducted the approach briefing. During this period, the captain hand flew the aircraft and manually controlled the thrust. During the approach to runway 06, the crew descended the aircraft earlier than normal, but believed that they were on the correct flight path profile.
While descending, both flight crew became concerned that they could not visually identify the runway, and focused their attention outside the aircraft. At about that time, the approach controller received a ‘below minimum safe altitude’ warning for the aircraft. The controller alerted the crew of their low altitude and instructed them to conduct a go-around. The crew then conducted another approach to runway 06 and landed.
A number of factors lead to the pilot not being fully prepared for the arrival and subsequent instrument landing system (ILS) approach to Adelaide Airport. Although the importance of early preparation and maintenance of an appropriate flight path profile was reinforced during the pilot’s line training, the impact of not fully configuring the aircraft’s instrumentation earlier in the approach was likely not recognised by the pilot. This, combined with the effect of a tailwind during the approach, reduced the available time for the pilot prepare for the localiser intercept.
While it could not be determined why the aircraft’s autoflight system did not capture and track the localiser, it was possible that a late setup of the inbound course and arming of the approach provided insufficient time for the autopilot to turn the aircraft. From the available evidence it was likely that the pilot had less than two minutes to setup the instrumentation, arm the approach and prepare for the intercept.
It is possible that during preparation for the approach, the pilot incorrectly set the reciprocal of the inbound course on the aircraft’s course deviation indicator (CDI), resulting in displayed tracking indications that were not in the command sense. That would account for the difference between the aircraft’s position, relative to the localiser, displayed to the pilot compared to that advised by air traffic control. That discrepancy created confusion over the aircraft’s actual position and, in combination with the unexpected overshoot of the localiser, significantly increased the pilot’s workload in managing the ILS approach.
The pilot became focussed on resolving the aircraft's lateral tracking and perceived autoflight issues during the localiser intercept. His recollection of being aware that the aircraft was descending but unaware of its specific altitude was consistent with decreased attention on managing the aircraft’s approach profile. That led to the aircraft descending off-track below the minimum safe altitude until identified and remedied by the positive actions of the controller.
Pilot workload
When the aircraft did not automatically intercept the localiser as expected the pilot’s workload started to increase.
Workload has been defined by Orlady & Orlady (1999) as ’reflecting the interaction between a specific individual and the demands imposed by a particular task. Workload represents the cost incurred by the human operator in achieving a particular level of performance’.
Each individual has a finite set of mental resources which allow them to process information and identify appropriate tasks. The set is a variable trait, and will vary with many factors including the experience, training, recency and familiarity with a situation, stress and fatigue. Harris (2011) stated ’High workload is associated with increased error rates (and hence an associated decrease in safety margins) as well as having the effect of reducing overall productivity and increasing occupational stress’.
When the workload gets too high for the available set of resources, an individual will start to task shed, initially systematically and eventually indiscriminately as the workload continues to increase. Green et al. (1996) identified, ‘as the demands of the task, or the workload, are increased, the standard of our performance is achieved. Any increase in workload after this point leads to an overall degradation in performance. At extremely high levels of workload (overload), important information may be missed due to the narrowing or focussing of attention onto only one aspect of the task.’
The United Kingdom Civil Aviation Authority publication CAP 737 (2016) states workload ‘is linked to almost all other areas within cognition and performance, particularly attention, vigilance, fatigue, skills, and multi-tasking.’
Approach and landing is a well-known period of high workload for pilots. In this occurrence, the following factors had the potential to increase the pilot’s workload:
an increased ground speed
limited recent experience with the autoflight system fitted to this aircraft type
the high intrinsic workload of single-pilot IFR flight
restrictions of the single-channel autoflight system in setting up the ILS instrumentation.
While the pilot had the correct intentions for the approach, once the error arose with the aircraft tracking, the pilot became unable to effectively monitor the approach while troubleshooting the situation. Following the intervention of air traffic control, the situation was resolved and the second approach was flown without issue.
Training
The pilot’s initial training with the operator appeared to address identified approach management issues by the time he was cleared to conduct line flying operations. Recognising that subsequent remedial training identified the need for closer study and briefing of instrument approaches, it is difficult to ascertain if more approach consolidation conducted prior to the incident would have prevented it.
Despite profile management and approach preparation being reinforced during the pilot’s training, the standard operating procedures outlined in the company operations manual did not give guidance to pilots as to when and how the aircraft was expected to be configured for the approach. Although an approach review was required, information pertaining to the expected cockpit and approach setup may have benefited the occurrence pilot. More generally, the absence of such guidance increases the likelihood of greater variation in how approaches are conducted.
Safety issues and actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Royal Flying Doctor Service Central Operations
Since this occurrence, the operator has implemented the following improvements:
amended the descent, arrival and approach procedures to include more prescriptive requirements
upgraded the legacy fleet to include dual global positioning system equipment with moving map and chart overlay displays to improve pilot situation awareness
rewritten the Training and Checking manual to include more prescriptive training
strengthened the Safety Management System, including the introduction of a phased implementation of a change management program
changed the initial pilot training, which is now conducted by their recently approved Part 141 organisation.
Findings
From the evidence available, the following findings are made with respect to flight below the minimum permitted altitude involving Pilatus PC-12, registered VH-FDJ, that occurred about 19 km north‑east of Adelaide Airport, South Australia on 18 July 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The unexpected failure of the autoflight system to intercept and track the localiser resulted in the aircraft deviating from the surveyed instrument approach path and significantly increased the pilot’s workload.
The pilot’s focus on resolving the aircraft's lateral tracking and perceived autoflight issues during the localiser intercept decreased his attention on managing the aircraft’s approach profile. That led to the aircraft descending off-track below the minimum safe altitude.
Other factors that increased risk
The pilot did not initiate a missed approach despite being uncertain of the displayed navigation system information and aircraft position. This limited the opportunity for the pilot to resolve any perceived navigation issues at a safe altitude and in a more controlled environment.
Approach guidance in the operations manual did not include detail of the expected cockpit and approach setup preparation. That increased the risk that variation in the conduct of approaches may be introduced into operations.
Other findings
Detection and intervention by the air traffic controller following the off‑track descent below the minimum permitted altitude restored safe operation.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Airservices Australia
Civil Aviation Safety Authority
FlightAware
the flight crew and operator.
References
Civil Aviation Authority, 2016, CAP737 – Flight-crew human factors handbook, Civil Aviation Authority, United Kingdom.
Green RG, Muir H, James M, Gradwell, D, Green RL (1996) Human Factors For Pilots, Second Edition, Ashgate, England.
Harris, D (2011) Human Performance on the Flight Deck, Ashgate, England.
Orlady H & Orlady LM (1999) Human Factors in Multi-Crew Flight Operations, Ashgate, England.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Airservices Australia, the flight crew, the operator and the Civil Aviation Safety Authority.
A submission was received from the operator. The submission was reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
AO-2017-075
Occurrence date
18/07/2017
Location
19 km north east of Adelaide Airport
State
South Australia
Report release date
18/12/2018
Report status
Final
Investigation level
Defined
Investigation type
Occurrence Investigation
Investigation status
Completed
Mode of transport
Aviation
Aviation occurrence category
Flight below minimum altitude
Occurrence class
Incident
Highest injury level
None
Aircraft details
Manufacturer
Pilatus Aircraft Ltd
Model
PC-12/47
Registration
VH-FDJ
Serial number
861
Aircraft operator
Royal Flying Doctor Service of Australia Central Operations
On the morning of 22 February 2017, a Singapore Airlines Boeing 777-212, registered 9V-SRP, operated scheduled flight SQ291 from Singapore Changi Airport, Singapore, to Canberra Airport, Australian Capital Territory (ACT). There were 13 crew and 235 passengers on board. The instrument landing system (ILS) for runway 35 at Canberra was out of service at the expected arrival time.
Prior to descent to Canberra Airport, the flight crew reviewed the weather conditions for Canberra. Canberra weather observations indicated that the visibility was greater than 10 km and wind conditions favoured runway 35 to be used for landing. As the runway 35 ILS was not available, the flight crew prepared to conduct the Standard Arrival Route (STAR)[1] POLLI FOUR PAPA arrival (Figure 1 left) and associated RNAV-Z[2] approach[3] (Figure 2) for runway 35. As the aircraft was arriving from the west, the flight crew elected to commence the RNAV-Z approach from waypoint[4] SCBSG. The captain, acting as pilot monitoring,[5] entered the arrival and approach into the aircraft’s flight management computer (FMC).
As the aircraft descended, air traffic control (ATC) instructed the flight crew to conduct the POLLI FOUR BRAVO arrival (Figure 1 right).
The flight crew had not briefed for this arrival and the first officer, who was pilot flying, identified that the POLLI FOUR BRAVO arrival led to the runway 35 VOR approach.[6] As the POLLI FOUR PAPA and POLLI FOUR BRAVO arrivals were very similar, the flight crew elected to reprogram the POLLI FOUR BRAVO arrival into the FMC while keeping the RNAV-Z approach. The flight crew intended to request the RNAV-Z approach from ATC upon first contact with the Approach controller. As the POLLI FOUR BRAVO arrival did not lead to the RNAV-Z approach, this created a discontinuity[7] in the programmed FMC flight path between the completion of the arrival at waypoint MENZI and the commencement of the approach. To correct this discontinuity, the first officer asked the captain to connect waypoint MENZI to the approach at waypoint SCBSI. In doing so, the waypoint SCBSG was erased from the programmed FMC approach.
Figure 1: POLLI FOUR PAPA (left) and POLLI FOUR BRAVO (right) arrivals
Source: Operator (annotated by ATSB)
At 0905 Eastern Daylight-saving Time (EDT), the aircraft was about 70 km (38 NM) southwest of Canberra at flight level (FL) 120,[8] with the autopilot engaged. ATC instructed the flight crew to contact the Approach controller. After establishing contact with the flight crew, the Approach controller instructed the flight to continue descending to 9,000 ft above mean sea level (AMSL). The controller advised the flight crew to expect the VOR approach to runway 35.
After the flight crew were advised to expect the VOR approach, they immediately requested the RNAV-Z approach. ATC instructed the flight crew to track to the commencement of the RNAV-Z approach at SCBSG and to expect the RNAV-Z approach. Due to high terrain to the south and southwest of Canberra, the RNAV-Z approach via SCBSG must be commenced from an altitude at or above the minimum sector altitude (MSA) of 7,500 ft. This altitude constraint is included in the FMC programmed flight path when selecting an approach using the arrivals/departures page in the FMC.[9]
Figure 2: RNAV-Z Approach
Source: Operator (annotated by ATSB)
After the controller advised the flight crew to expect the RNAV-Z approach, the captain manually re-entered SCBSG into the FMC without detecting that the 7,500 ft MSA constraint was now missing. The captain then manually connected SCBSG to SCBSI for the continuation of the approach.
At 0908, ATC cleared the flight for the RNAV-Z approach. After receiving clearance to conduct the RNAV-Z approach, the first officer entered the final approach fix crossing altitude of 3,900 ft[10] into the autopilot altitude selector. This directed the autopilot to continue descent to 3,900 ft.[11]
At 0909.16 in visual conditions, the aircraft tracked towards SCBSG. About 7.5 NM (13.9 km) prior to SCBSG, the aircraft descended below 7,500 ft (Figure 3). At 0909.37, as the aircraft descended to about 7,000 ft, the controller contacted the flight crew and advised that they were required to maintain 7,500 ft until SCBSG. The flight crew immediately disconnected the autopilot and climbed the aircraft to 7,500 ft. After climbing to 7,500 ft, the first officer reconnected the autopilot with 7,500 ft as the selected altitude.
At 0911:24, after the aircraft passed SCBSG, the first officer selected the final approach fix crossing altitude of 3,900 ft in the autopilot altitude selector and the aircraft commenced descending. The segment minimum safe altitude (SMSA)[12] for the leg of the approach from SCBSG to SCBSI was 5,300 ft.
As the aircraft descended through about 6,000 ft, and before they had passed SCBSI, the first officer sighted the runway. The first officer advised the captain that they wished to manually fly the aircraft and conduct a visual approach to runway 35. The captain agreed and the first officer disconnected the autopilot and commenced a manual visual approach. The flight crew did not advise ATC that they were visual and had sighted the runway, or that they had elected to conduct a visual approach.
At 0912.37, about 2.1 NM (3.9 km) prior to passing SCBSI on the segment between SCBSG and SCBSI, the aircraft descended below 5,300 ft. As the aircraft descended to about 4,600 ft the captain commented that the aircraft approach profile was becoming low. At the same time, the controller contacted the flight crew and advised them that the aircraft was below the SMSA and that they were required to maintain 5,300 ft until passing SCBSI. The first officer immediately levelled the aircraft at about 4,600 ft. The flight crew advised the controller that they had the runway and terrain in sight. The controller then cleared the flight to conduct a visual approach. After being cleared for a visual approach, the first officer commenced a climb to about 5,000 ft and re-established the aircraft on the desired approach profile.
At 0917, the aircraft landed on runway 35. The aircraft was not damaged, and no persons were injured.
Figure 3: Arrival and approach profile
Source: ATSB, derived from Airservices Australia radar data
Captain comments
The captain of 9V-SRP provided the following comments:
The runway 35 ILS was not available, therefore the RNAV-Z approach was selected as this approach provided the lowest available minimum descent altitude (MDA).[13] The captain did not expect to receive, and had not prepared, for the POLLI FOUR BRAVO arrival and associated VOR approach.
After receiving the POLLI FOUR BRAVO arrival, the captain elected to delay requesting the RNAV-Z approach until in contact with the Approach controller. The captain was not sure how the clearances were coordinated between different ATC units in Australia and believed it would be simpler to request the approach directly from the Approach controller.
As the POLLI FOUR BRAVO arrival tracked via MENZI, this presented a smooth transition to the RNAV-Z approach at SCBSI. The captain did not expect ATC to instruct the flight crew to track via SCBSG as this required a left turn from their position to SCBSG, then a right turn to SCBSI, then another left turn onto final approach.
The waypoint SCBSG should have been added to the FMC programmed flight path by selecting the SCBSG transition using the arrivals/departures page of the FMC. This would have ensured the SCBSG 7,500 ft altitude constraint remained programmed into the FMC.
ATC should have been advised when they became visual and elected to conduct a visual approach.
At the time the first officer commenced the visual approach, the runway 35 T-VASIS[14] was not visible.
During the visual approach, the flight crew used runway visual perspective and attitude along with a check of expected altitudes at specified distances from the runway to assess the approach profile.
Operator report
The operator conducted an investigation into the incident which identified the following points:
The flight crew fixated on flying the RNAV-Z approach as the crew had briefed and planned for this approach. The approach briefing did not include reversion to conventional navigation.
Standard operating procedures direct the flight crew to advise ATC when the flight crew have established visual conditions and are flying a visual approach.
The company operations manual states that flight crew must check FMC waypoints against the arrival chart, the navigation display map and the control display unit. This check shall include the verification of any altitude and speed constraints.
The flight crew training manual directs flight crew to avoid making manual entries when an approach or transition is available in the FMC, to prevent input errors or omissions.
Any transition to a visual approach should only be made when the appropriate cues to ascertain vertical profile such as T-VASIS are clearly visible.
Related occurrences
A number of ATSB investigations have examined occurrences relating to deviations in flight path involving foreign crew operating within Australia. Of these, three are summarised below.
At 2019 at night on 24 July 2011, a Boeing Company 777-3D7 aircraft, operated by Thai Airways, was conducting a runway 34 VOR approach to Melbourne Airport, Victoria. During the approach, the tower controller observed that the aircraft was lower than required and asked the flight crew to check their altitude. The tower controller subsequently instructed the crew to conduct a go-around. However, while the crew did arrest the aircraft’s descent, there was a delay of about 50 seconds before they initiated the go-around and commenced a climb to the required altitude.
The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’ when the aircraft pitched up to capture the VOR approach path. As a result, the remainder of the approach was conducted using the autopilot’s flight level change mode. In that mode the aircraft’s rate of descent is unrestricted and therefore may be significantly higher than that required for an instrument approach. In addition, the flight crew inadvertently selected a lower than stipulated descent altitude, resulting in descent below the specified segment minimum safe altitude for that stage of the approach and the approach not being managed in accordance with the prescribed procedure.
On 4 and 29 May 2010, an Airbus A330-343E aircraft, was being operated by AirAsia X to the Gold Coast, Queensland. On both occasions, there was low cloud and reduced visibility on arrival at the Gold Coast.
During VOR approaches conducted at Gold Coast Airport on both days, the flight crews descended the aircraft below the segment minimum safe altitudes. As a result, the aircraft descended to an altitude where there was no longer separation assurance from terrain and aircraft operating outside controlled airspace.
On 17 December 2008, a Boeing Company 737-4MO aircraft, operated by Garuda Indonesia, made a significant diversion around weather at night while en route to Darwin, Northern Territory. The aircraft was cleared to conduct the runway 11 VOR approach via the initial approach fix NASUX. After the weather diversion, it was more convenient for the flight crew to make a pilot intercept of the 285 radial from the VOR but there was a period of misunderstanding as a result of a breakdown in the application of standard radiotelephony readbacks.
The flight crew left the previously cleared altitude of 3,000 ft on descent although they had not been cleared to do so. When this became apparent, no updated clearance for a pilot intercept of the 285 radial was issued by the controller. The aircraft continued to descend on the basis of the runway 11 VOR descent profile, even though it was not conducting the runway 11 VOR approach.
The flight crew used the position calculated by the aircraft's inertial reference system (IRS) to intercept the 285 radial, instead of using the signal from the VOR. The IRS position was not accurate enough for this, and the aircraft tracked to outside of the stipulated 5 degrees tolerance either side of the 285 radial. From then on, the aircraft was no longer 'established' on the 285 radial even though it was below the minimum sector altitude in cloud. When it broke through the cloud, the aircraft was clearly not aligned with the runway and a missed approach was carried out.
ATSB comment
Over recent years, the number of active VORs has reduced as part of the Airservices Australia Navigation Rationalisation Project. Global navigation satellite system (GPS) is now the primary means of navigation for instrument flight rules aircraft, including RNAV approaches where an ILS is not available.
Internationally, the prevalence of VOR approaches is even further reduced. This reduces the exposure of international flight crew to VOR approaches and therefore reduces the familiarity of international flight crew with the conduct of a VOR approach.
This incident, along with the previous occurrences identified above, highlight the importance of familiarity with this approach type. However, this familiarity may be reduced for foreign flight crews operating into Australia.
The air traffic services provider in Australia, Airservices Australia, advised that all of the runway connected STARs have been removed from the VOR approaches at Melbourne, Adelaide and all but one at Perth to discourage their use. While the VOR approaches are still available on request, flight crews are assigned only instrument approach procedures that are connected to STARs.
Safety analysis
The flight crew planned to conduct the POLLI FOUR PAPA arrival and RNAV-Z approach. When ATC issued instructions for the POLLI FOUR BRAVO arrival and VOR approach, the flight crew accepted the POLLI FOUR BRAVO arrival while preparing to conduct the RNAV-Z approach, instead of the associated VOR approach. This led to a discontinuity in the programmed flight path between the arrival and approach. The flight crew did not select the entry to the approach in the FMC and manually entering the waypoint SCBSG. As the waypoint was manually entered, the 7,500 ft altitude constraint was not included into the FMC programmed flight path. This missing altitude constraint was not detected by the flight crew.
The flight crew entered the altitude of 3,900 ft into the autopilot altitude selector prior to commencing the approach. With the autopilot engaged, the aircraft descended through 7,500 ft prior to commencing the approach at SCBSG. The flight crew did not detect that the aircraft had descended through the 7,500 ft MSA. The approach controller identified the error and alerted the flight crew.
Once established visual with the runway, the flight crew elected to conduct a manually flown visual approach without advising ATC and did not receive a clearance to discontinue the RNAV-Z and conduct a visual approach. The aircraft then descended below the standard profile which led to the aircraft descending below the 5,300 ft SMSA prior to passing SCBSI.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The captain manually entered the waypoint SCBSG into the FMC instead of selecting the RNAV-Z approach via waypoint SCBSG. This removed the 7,500 ft altitude constraint.
The crew did not identify the aircraft had descended below the 7,500 ft minimum sector altitude prior to passing SCBSG.
Prior to passing SCBSI, the flight crew elected to conduct a visual approach without advising air traffic control, the flight crew then descended the aircraft below the 5,300 ft segment minimum safe altitude.
The aircraft was in visual conditions at all times.
Safety message
This incident highlights the importance of preparation and communication prior to commencing a phase of flight. Requesting a preferred clearance early allows ATC to ensure that a clearance can be provided, or if not available, allows the flight crew time to prepare for a different clearance.
The Australian air traffic control provider, Airservices Australia, document: Standard Instrument Arrival Routes (STARS) provides further information to assist flight crew in adhering to clearances when conducting arrivals and approaches.
This incident also underlines the importance of adhering to standard operating procedures (SOPs). By deviating from SOPs and manually entering the waypoint, the crew removed a protection which was in place to prevent data input errors.
The ATSB has identified numerous accidents worldwide that were the result of simple human errors in data calculation or entry.
Data input errors-such as the wrong figure being used as well as data being entered incorrectly, not being updated, or being excluded-happen for many different reasons.
The consequences of these errors can range from rejected take-offs through to collisions with the ground. Errors can occur irrespective of pilot experience, operator, aircraft type, location and take-off performance calculation method.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 12 February 2017, a Boeing 747-47UF (freighter) aircraft, registered N416MC, operating from Honolulu, Hawaii, conducted an approach to Sydney Airport, New South Wales. On board the aircraft were two flight crew. The captain was the pilot monitoring (PM) and the first officer was the pilot flying (PF).[1]
The aircraft was cleared by the approach controller for the runway 16R instrument landing system (ILS) approach.[2] The autopilot was engaged[3] and the modes for localiser and approach (glideslope) were armed[4] while the aircraft was flown at 2,200 ft on a heading of 200° to intercept the 16R ILS. The aircraft captured[5] the localiser and the PF turned it left onto the 16R final approach course, while maintaining 2,200 ft, in order to intercept the glideslope from below.
Shortly after the turn onto the final approach, the PF called ‘glideslope captured’ and the aircraft started to descend. However, the PM’s primary flight display[6] was still showing the aircraft below the glideslope. The PM crosschecked the PF’s display and noticed the glideslope was captured, then checked their own display and noticed there was a failure flag displayed for the glideslope. The PM again crosschecked the PF’s display, noticed there was a failure flag for the PF’s glideslope, and instructed the PF to disconnect the autopilot and stop the descent.
As the aircraft descended through 2,100 ft, the approach controller requested confirmation that they were established on the glideslope. The PM responded that they had an interruption on glideslope and would maintain altitude until they could re-intercept. During the response, a minimum safe altitude warning (MSAW) alert appeared on the approach controller’s radar for N416MC at an altitude of 1,800 ft. The approach controller immediately issued the instruction ‘go-around, you are well below the glide-path, go-around’. The PM immediately acknowledged the instruction, and the flight crew initiated the missed approach procedure.
The lowest point on the approach was 1,559 ft from flight data (1,600 ft on radar) at about 8.0 NM (14.8 km) from runway 16R (Figure 1). This resulted in the aircraft descending about 1,000 ft below the nominal 3° glideslope at the time of the incident. The aircraft was flown on the second approach with autopilot engaged. The localiser and glideslope captured and tracked the ILS with no anomalies detected.
Figure 1: Minimum safe altitude warning for N416MC
Source: Airservices, annotated by the ATSB
ILS signal interference
Disturbances to ILS localiser and glideslope courses are caused by fixed structures, such as buildings (static distortion), and moving vehicles or aircraft (dynamic distortion). The total ILS course distortion is determined by the root square summation of static and dynamic distortion, and this is used to define critical areas[7] near each localiser and glideslope antenna (Figure 2).
Figure 2: Runway 16R glideslope antenna and critical area hold point
Source: Google earth, annotated by the ATSB
The critical areas are protected for low visibility approaches. This is when the cloud ceiling is at or below 600 ft, or the visibility is 2000 m or less. In which case, no aircraft or vehicle is permitted to enter the critical areas when an arriving aircraft is within the outer marker, or 4 NM from the threshold if there is no outer marker.
At the time N416MC intercepted the runway 16R localiser, a Boeing 787 was holding on taxiway A1, within the runway 16R glideslope critical area (Figure 3). However, the weather conditions did not require air traffic control to activate the ILS critical area, and N416MC was instructed to go‑around before reaching the outer marker.[8]
Figure 3: Infringement of the 16R glideslope critical area
Source: Airservices, annotated by the ATSB
Receiver characteristics
A moving receiver passing through a distorted ILS signal will produce a guidance error. The error produced will vary depending on the receiver characteristics, its antenna characteristics and the speed of the vehicle carrying the receiver as it passes through the distorted signal.
Similar incidents
Glideslope signal disturbances
On 17 March 2017, a Boeing 747-400 attempted to intercept the runway 16R ILS in instrument meteorological conditions using the autopilot for a coupled approach.[9] When the glideslope was captured, the indications began to oscillate, and the autopilot chased the indications. A high rate of descent developed and a ‘low on profile’ call was made on the flight deck to stop the descent. The descent was stopped at about 1,500 ft, about 7 NM (13 km) from the threshold of runway 16R. An Airbus A380 was lined up for departure on runway 16R from taxiway A1 when the Boeing 747 was about 8 NM (14.8 km) from the threshold of runway 16R.
On 23 March 2017, a Boeing 747-400 attempted to intercept the runway 16R ILS in instrument meteorological conditions using the autopilot for a coupled approach. Approaching 2,000 ft, the glideslope on the captain’s primary flight display disappeared, followed by the glideslope on the first officer’s primary flight display. The aircraft pitched nose down with an associated increased rate of descent. The captain disengaged the autopilot and stopped the descent at about 1,500 ft and 8 NM (14.8 km) on final for 16R. A minimum safety altitude alert activated, and the approach controller instructed the flight crew to conduct a missed approach. An Airbus A380 was holding on taxiway A1 at the time of the incident. A second approach was flown using the autopilot without incident. There were no aircraft in the glideslope critical area during the second approach.
Localiser signal disturbance
On 27 August 2015, a Boeing 787-800 attempted to conduct an autoland[10] to runway 34L at Sydney Airport in visual meteorological conditions. The aircraft experienced a disturbance to the localiser signal at about 100 ft and the flight crew immediately disconnected the autopilot to complete the landing. The flight crew were aware the ILS critical area was not required to be protected at the time and had not notified air traffic control they were conducting an autoland. They were aware that disturbances to the ILS signals were possible and were prepared to intervene. An Airbus A330 departed directly in front of the 34L localiser antenna at the time of the incident.
Manufacturer comments
Boeing, the aircraft manufacturer, reported that they have no reason to believe that the 747 would behave any differently to their other aircraft types. The same antenna system is installed on the 757, 767 and 777. However, there are some differences in the antenna locations. The 747 and 777 receiver antennas are located on the main landing gear doors, while the 757 and 767 antennas are located in the nose of the aircraft. The glideslope incidents might relate to a varying signal strength, rather than a distorted beam.
Aeronautical Information Publication
If a pilot advises air traffic control that an ‘autoland’ or ‘coupled approach’ is to be flown, then air traffic control will either report ‘ILS critical area not protected’ or ‘LVP[11] in force’ if the critical area is protected.[12]
Airservices Australia comments
Airservices Australia, the air traffic services provider, reported that disturbance of the glideslope signal is less for aircraft at the taxiway A holding point (holding point for glideslope critical area) than it is for the same aircraft at the holding point on taxiway A1. Airservices Australia conducted a computer simulation which indicated that an Airbus A380 aircraft stationary at holding point A1 is unlikely to have caused the large ILS signal disturbance observed in this incident.
The simulations and radar recordings indicated the observed disturbance in each case occurred after the holding aircraft was provided with its line up clearance and while taxiing between the holding point and the runway. In this respect, there will always be significant interference to approaching aircraft outside 4 NM regardless of whether the holding point on taxiway A or A1 is used at the same time as runway 16R is used for arrivals.
Safety analysis
N416MC intercepted the final approach, and the autopilot captured the ILS localiser and glideslope at the same time as a Boeing 787 (B787) was holding on taxiway A1, which lies within the critical area for the runway 16R glideslope. The presence of the 787 in the critical area likely resulted in N416MC receiving either a distorted glideslope beam or a beam of varying signal strength. This required flight crew intervention following a glideslope failure indication, which was detected by the captain crosschecking the two primary flight displays. At the time of the incident, the glideslope critical area was not required to be protected, in accordance with the manual of air traffic services.
ATSB comment
It has been previously noted by regulators and manufacturers, that it is common practice for operators to conduct coupled approaches and autoland to satisfy maintenance, training or reliability program requirements. These approaches may be conducted in weather conditions which do not require protection of the ILS signal. There have been incidents reported in which the autopilot has responded to disturbances in the ILS signal when the aircraft was close to landing. Airservices Australia advise that ILS signals may be disturbed with the consequential effect on autoland performance when weather conditions do not require protection of the ILS critical area.
For more information on ILS signal distortion and determination of protected areas following the introduction of the Airbus A380 see Assessment of ILS protection areas impact on large aircraft operations.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The descent below the nominal 3° approach glideslope was probably the result of the aircraft auto-pilot capturing a distorted glideslope beam.
The glideslope beam was probably distorted due to the presence of a Boeing 787 in the glideslope critical area, which was not required to be protected in the weather conditions which prevailed at the time of the incident.
Safety message
This incident highlights the importance of crosschecks on the flight deck and between air traffic control and the flight crew. After detecting unexpected indications on the flight deck, the flight crew intervened to stop the descent, which was then followed by an instruction from air traffic control to initiate a go-around.
The aircraft manufacturer and regulators have recommended that flight crew remain vigilant for ILS disturbances with resulting unexpected flight control movements and be prepared to immediately disconnect the autopilot, particularly during autoland operations.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 23 September 2016, the ATSB commenced an investigation into the descent below segment minimum safe altitude involving Airbus A330-343X, 9M-XXI, near Gold Coast Airport, Queensland, on 11 September 2016.
The aircraft was cleared to conduct a RNAV-Z (GNSS) instrument approach to runway 14 (Figure 1) at Gold Coast Airport in visual meteorological conditions. During the approach, the aircraft was observed to descend below the 1,700 ft segment minimum safe altitude between the instrument approach’s intermediate fix (OOLNI) and a position 2.5 NM from the final approach fix (OOLNF).
The ATSB interviewed the flight crew and also examined the operator’s policies and procedures for the conduct of the RNAV-Z type approach. The flight crew reported that they had briefed the approach. That briefing included identification that the 2.5 NM position was not included in the aircraft’s navigation data base and that there was a segment minimum safe altitude requirement associated with this position.
The approach was flown using the autoflight system in a managed mode. As the aircraft approached the OOLNI, the aircraft was in a shallow descent and the flight crew commenced configuring the aircraft for landing (Figure 2). At OOLNI the aircraft was fully configured for landing and at a speed of 150 kt. As the aircraft passed through OOLNI, the autopilot pitched the aircraft down. The flight crew attempted to recover the speed through the application of speed brake. However this, coupled with the aircraft pitching down, resulted in an increased rate of descent, which in turn led to the penetration of the 1,700 ft segment minimum safe altitude. The aircraft subsequently returned to its targeted flight profile by OOLNF and continued the approach for landing.
Figure 2: The instrument approach vertical profile
Source: Jeppesen
The Flight Crew Training Manual (FCTM) for the A330 stated that the activation of the approach phase will initiate a deceleration towards the approach speed or a speed constraint inserted into the Final Descent Point (FDP). The FDP was defined as the capture point of the final descent segment coded into the navigation data base. The two approach techniques for the final descent segment were the decelerated approach and the early stabilised approach.
For the decelerated approach, the vertical flight profile was managed by the aircraft’s Flight Management Guidance and Envelope System (FMGES) using data in the aircraft’s navigation database, modified as required by the flight crew. This was described as using the autoflight system in a ‘managed mode’. The deceleration profile targeted having the aircraft at 1,000 ft above the landing point, in the landing configuration and at the approach speed. This profile generally equated to the aircraft being configured with the first stage of flap/slat and at the required speed at the FDP. In the discussion on the use of a managed vertical profile for a non-precision approach, the FCTM noted that for some non-precision approaches, ‘the final approach flies an “idle descent” segment from one altitude constraint to another, followed by a level segment’.
The early stabilised approach technique required the flight crew to have the aircraft in the landing configuration and at the approach speed at the FDP. The final descent segment was then flown using a selected vertical profile mode, such as the Flight Path Angle (FPA) mode.
The ATSB obtained the navigation database used by the FMGES for the RNAV-Z (GNSS) Rwy 14 approach. That database included initial (OOLNI) and final (OOLNF) approach fixes and their associated altitude limits, but did not include the point 2.5 NM from OOLNF and its associated segment minimum safe altitude limitation. The database also included a three degree approach profile from the OOLNF, but did not include a three degree profile before OOLNF.
The operator’s investigation into the occurrence identified that, as the three degree glide path started at OOLNF, the aircraft would conduct a stepped descent between OOLNI and OOLNF. The stepped approach profile was reflected by the autopilot pitching the aircraft down as it passed through OOLNI. In a stepped approach, on passing an altitude constrained position (such as OOLNI), the autopilot will fly an idle descent to the new altitude constraint and then fly level until the completion of that segment. The operator also noted that the step down limitation between OOLNI and OOLNF was not coded into the database due to specific coding rules. In response to the occurrence event, the operator custom coded the RNAV-Z (GNSS) Rwy 14 approach to include a 3 degree slope from OOLNI. The operator also issued a memorandum to all pilots requiring all non-precision approaches into Australia to be conducted using the selected vertical guidance Flight Path Angle mode only. Based on this information, the ATSB determined that it was unlikely that further ATSB investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 23 September 2016, the ATSB commenced an investigation into the descent below segment minimum safe altitude involving Airbus A330-343X, 9M-XXI, near Gold Coast Airport, Queensland, on 11 September 2016.
The aircraft was cleared to conduct a RNAV-Z (GNSS) instrument approach to runway 14 (Figure 1) at Gold Coast Airport in visual meteorological conditions. During the approach, the aircraft was observed to descend below the 1,700 ft segment minimum safe altitude between the instrument approach’s intermediate fix (OOLNI) and a position 2.5 NM from the final approach fix (OOLNF).
The ATSB interviewed the flight crew and also examined the operator’s policies and procedures for the conduct of the RNAV-Z type approach. The flight crew reported that they had briefed the approach. That briefing included identification that the 2.5 NM position was not included in the aircraft’s navigation data base and that there was a segment minimum safe altitude requirement associated with this position.
The approach was flown using the autoflight system in a managed mode. As the aircraft approached the OOLNI, the aircraft was in a shallow descent and the flight crew commenced configuring the aircraft for landing (Figure 2). At OOLNI the aircraft was fully configured for landing and at a speed of 150 kt. As the aircraft passed through OOLNI, the autopilot pitched the aircraft down. The flight crew attempted to recover the speed through the application of speed brake. However this, coupled with the aircraft pitching down, resulted in an increased rate of descent, which in turn led to the penetration of the 1,700 ft segment minimum safe altitude. The aircraft subsequently returned to its targeted flight profile by OOLNF and continued the approach for landing.
Figure 2: The instrument approach vertical profile
Source: Jeppesen
The Flight Crew Training Manual (FCTM) for the A330 stated that the activation of the approach phase will initiate a deceleration towards the approach speed or a speed constraint inserted into the Final Descent Point (FDP). The FDP was defined as the capture point of the final descent segment coded into the navigation data base. The two approach techniques for the final descent segment were the decelerated approach and the early stabilised approach.
For the decelerated approach, the vertical flight profile was managed by the aircraft’s Flight Management Guidance and Envelope System (FMGES) using data in the aircraft’s navigation database, modified as required by the flight crew. This was described as using the autoflight system in a ‘managed mode’. The deceleration profile targeted having the aircraft at 1,000 ft above the landing point, in the landing configuration and at the approach speed. This profile generally equated to the aircraft being configured with the first stage of flap/slat and at the required speed at the FDP. In the discussion on the use of a managed vertical profile for a non-precision approach, the FCTM noted that for some non-precision approaches, ‘the final approach flies an “idle descent” segment from one altitude constraint to another, followed by a level segment’.
The early stabilised approach technique required the flight crew to have the aircraft in the landing configuration and at the approach speed at the FDP. The final descent segment was then flown using a selected vertical profile mode, such as the Flight Path Angle (FPA) mode.
The ATSB obtained the navigation database used by the FMGES for the RNAV-Z (GNSS) Rwy 14 approach. That database included initial (OOLNI) and final (OOLNF) approach fixes and their associated altitude limits, but did not include the point 2.5 NM from OOLNF and its associated segment minimum safe altitude limitation. The database also included a three degree approach profile from the OOLNF, but did not include a three degree profile before OOLNF.
The operator’s investigation into the occurrence identified that, as the three degree glide path started at OOLNF, the aircraft would conduct a stepped descent between OOLNI and OOLNF. The stepped approach profile was reflected by the autopilot pitching the aircraft down as it passed through OOLNI. In a stepped approach, on passing an altitude constrained position (such as OOLNI), the autopilot will fly an idle descent to the new altitude constraint and then fly level until the completion of that segment. The operator also noted that the step down limitation between OOLNI and OOLNF was not coded into the database due to specific coding rules. In response to the occurrence event, the operator custom coded the RNAV-Z (GNSS) Rwy 14 approach to include a 3 degree slope from OOLNI. The operator also issued a memorandum to all pilots requiring all non-precision approaches into Australia to be conducted using the selected vertical guidance Flight Path Angle mode only. Based on this information, the ATSB determined that it was unlikely that further ATSB investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
On 17 June 2016 at about 0055 Eastern Standard Time, a Boeing 737-376, registered VH-XMO and operated by Express Freighters Australia, departed Melbourne Airport, Victoria, on a freight service to Launceston, Tasmania. After arriving overhead Launceston, the flight crew proceeded to conduct an instrument approach for runway 32L. However, due to adverse weather condition, the crew were unable to land and a missed approach was conducted.
On completion of the missed approach, the captain (CA) initiated a left turn to re-position the aircraft for a second approach. A short time later, while responding to a call from the airport groundsman about the weather conditions, the CA handed control of the aircraft to the first officer (FO).
While the captain instructed the FO to maintain the turn, subsequent manoeuvring had not been discussed. The resultant flight path led to the aircraft entering an area with a minimum permitted altitude of 5,800 ft. While the crew had commenced a climb, the aircraft had not reached that minimum altitude and entered the area at about 4,400 ft. In response, air traffic control issued a safety alert for terrain and instructed the crew to climb the aircraft above the minimum safe altitude.
What the ATSB found
The ATSB found that the instrument approach briefing conducted by the flight crew did not ensure that there was a shared understanding of how the aircraft would be manoeuvred on completion of the published missed approach. That resulted in the aircraft being operated in an area below the prescribed minimum safe altitude.
The ATSB also identified that flight path monitoring and safety alerts issued by air traffic control, provided the flight crew with clear and timely minimum altitude requirements and ensured the aircraft was operated well clear of terrain.
What's been done as a result
In response to this occurrence the operator issued a flight standing order that drew flight crew’s attention to the runway 32L instrument approach procedure’s missed approach and the requirements for subsequent manoeuvring. In addition, the approach briefing requirements were amended to include intentions for manoeuvring following the completion of a published missed approach.
The effective management and manipulation of the aircraft, following a missed approach, was included as a discussion item and exercise in the operator’s recurrent simulator training program.
Safety message
This occurrence highlights the value of having a clear, and where appropriate, shared plan. A common understanding between flight crew prevents additional workload associated with clarifying intentions during busy events, such as during and after missed approaches.
Operators and flight crew should consider including appropriate missed approach considerations, such as intended flight path, crew actions, terrain clearance and air traffic control requirements, into their approach briefings, regardless of the existing environmental conditions.
Safety analysis
Flight below the minimum sector altitude (MSA) occurred following a missed approach that was conducted due to poor weather conditions. While the flight crew assessed that the safety of the aircraft was never in doubt, there was confusion as to how the aircraft was to be manoeuvred on completion of the missed approach.
This analysis will examine the aircraft’s flight path following the missed approach, and factors that contributed to the flight below MSA.
Prior to commencing descent, the crew conducted a normal approach briefing. The prevailing weather conditions at Launceston airport were such that the flight crew were required to conduct an instrument landing system (ILS) approach. The weather conditions also meant that it was reasonably foreseeable that they would need to conduct a missed approach. While an instrument approach briefing was conducted prior to descent, and covered the standard components including the missed approach segment, there was no discussion of how the aircraft would be subsequently manoeuvred.
A missed approach following an ILS approach is not common as the associated low weather minima usually permits the landing to be completed. As such, planning how the aircraft is to be manoeuvred in the event of a missed approach may not always be considered in detail. Additionally, tracking and altitude requirements following a missed approach are often provided by air traffic control (ATC), particularly in the case of larger commercial aircraft such as VH‑XMO.
Additionally, with the exception of situations such as simulator training, missed approaches are often unexpected. Consequently, the safe conduct of a go‑around and subsequent manoeuvring relies on a shared appreciation to avoid the need to clarify intentions during an already busy period. Irrespective of the weather conditions, a thorough go‑around briefing, that gives consideration to factors such as initial and subsequent flight paths, crew actions and co‑ordination, terrain clearance and ATC requirements, offers an effective means of ensuring that a common appreciation exists.
Although air traffic control (ATC) services were available en route and during descent, Launceston Tower was closed when the aircraft arrived. Consequently, the normally tower‑controlled Class D airspace below 1,500 ft became non-controlled Class G airspace. This meant that, in the event of a missed approach, the aircraft would re-enter Launceston Class C and D controlled airspace at 1,500 ft and an ATC clearance would be required prior to manoeuvring beyond the published missed approach.
The approach and missed approach flight paths were aligned to enable the aircraft to descend and climb clear of terrain. The missed approach path positioned the aircraft within a sector that had an MSA of 3,200 ft. Any manoeuvring outside of that sector required the crew to climb the aircraft to the relevant sector MSA prior to entry. In this case, the left turn was towards a sector that had an MSA of 5,800 ft. Alternatively, climbing straight ahead on the missed approach track to 5,800 ft would have enabled the crew to manoeuvre the aircraft as required within 10 NM (19 km) of the airport.
On completion of the missed approach, the captain commenced a left turn with the intention of positioning the aircraft for a second approach. While a continuous left turn may have maintained the aircraft within the 3,200 ft sector, this manoeuvre had not been discussed during the approach briefing. As a result, when the CA handed control of the aircraft to the FO, the left turn was stopped on a south-easterly heading.
The south-easterly flight path resulted in the aircraft tracking towards a sector with a MSA of 5,800 ft while at an altitude of 3,200 ft. Although the crew had commenced a climb, the aircraft had only achieved an altitude of 4,400 ft when it entered the 5,800 ft sector. As a result, ATC issued a safety alert for terrain proximity. ATC also issued instructions for an immediate climb to 5,800 ft and later, to 6,300 ft.
Although the aircraft was never in immediate danger of colliding with terrain, it was operated over an area and at an altitude less than that prescribed for safe flight. Had the required clearance been obtained prior to manoeuvring, ATC would have provided the crew with appropriate tracking and altitude requirements. Additionally, without the flight path monitoring and timely altitude alerts provided by ATC, the risk of collision with terrain may have increased.
Had the approach briefing included a discussion about subsequent manoeuvring, both crew members would have had a shared understanding of the expected flight path. Such a discussion would have provided the crew with an opportunity to discuss alternative tracking, minimum safe altitude requirements, and the need to obtain a clearance.
Findings
From the evidence available, the following findings are made with respect to the flight below lowest safe altitude involving Boeing 737, registered VH-XMO at Launceston Airport, Tasmania on 17 June 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The instrument approach briefing conducted by the flight crew did not ensure there was a shared understanding of how the aircraft would be manoeuvred following completion of the published missed approach.
The absence of an established, and shared, manoeuvring plan, resulted in the aircraft being operated in an area below the prescribed minimum safe altitude.
On completion of the missed approach, the flight crew did not obtain an onwards airways clearance prior to further manoeuvring. That negated the terrain clearance assurance that would otherwise have been provided and increased the risk of conflict with other aircraft.
Other findings
The flight path monitoring and safety alerts issued by air traffic control, provided the flight crew with clear and timely minimum altitude requirements and ensured the aircraft was operated well clear of terrain.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
flight crew
aircraft operator
Airservices Australia.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew and operator of VH-XMO, Airservices Australia and the Civil Aviation Safety Authority (CASA).
Submissions were received from CASA and the aircraft operator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
The occurrence
On 17 June 2016 at about 0055 Eastern Standard Time[1], a Boeing 737-376, registered VH-XMO and operated by Express Freighters Australia, was scheduled to operate a freight service from Melbourne, Victoria, to Launceston, Tasmania. The flight crew consisted of a training captain (CA) as the pilot flying[2] and a first officer (FO) under training as the pilot monitoring. This flight was the FO’s ninth sector operating the B737 aircraft.
The flight crew signed on for duty in Melbourne at about 1910. The duty included a return flight to Sydney, New South Wales, followed by a return flight to Launceston. A review of the weather for the duty indicated relatively benign conditions for Melbourne and Sydney. However, the Launceston forecast included cloud at 1,500 ft above the ground and periods of light rain. A temporary reduction in visibility to 4,000 m and cloud down to 1,000 ft were also forecast, together with heavier rain showers. Those weather conditions required the flight crew to carry an alternate. In this case, the aircraft carried sufficient fuel to operate to Launceston and return to Melbourne.
The flight to Sydney and return was uneventful. Approaching Melbourne, the flight crew obtained a weather update for Launceston. That update forecast cloud at 1,000 ft, reducing temporarily to 500 ft with continuing rain showers. Automated weather observations for Launceston at 0000, recorded visibility of 5,000 m in rain and overcast cloud at 100 ft. While the observed weather conditions were below those required to land, the CA reported that adverse weather conditions at Launceston historically fluctuated.
The flight departed Melbourne for Launceston at about 0055. On board the aircraft was sufficient fuel to operate the flight to Launceston, conduct three instrument approaches and, if required, return to Melbourne. The flight crew continued to monitor the Launceston weather conditions en route. Subsequent automated observations showed little or no improvement to the weather.
Prior to descent, the flight crew conducted an approach briefing for Launceston. That briefing included discussions covering the expected instrument landing system[3] (ILS) approach for runway 32L (Figure 1), and the missed approach should it be required. The operator’s low visibility procedures were also covered. Those procedures required that, approaching the minima, the CA was to scan both the aircraft instruments and outside for the runway. The FO’s primary task was to monitor instruments and the aircraft’s flight path.
Descent was commenced at about 0125. Automated weather observations for Launceston at 0113, recorded visibility of 9,000 m in rain showers and overcast cloud at 200 ft. At about 0131, air traffic control (ATC) advised the crew that, based on the latest automated weather observations, conditions on the ground were, 300 m visibility and overcast cloud at 200 ft. The crew were subsequently cleared to leave controlled airspace on descent and to conduct an instrument approach to runway 32L.
Launceston tower control services were generally available between the hours of 0600 and 2200. As the tower was closed, the controlled Class D airspace below 1,500 ft above mean sea level (AMSL) had reverted to non‑controlled Class G airspace. In the event of a missed approach, the aircraft would re-enter Launceston Class C and D controlled airspace above 1,500 ft AMSL and a clearance would be required prior to any subsequent manoeuvring on completion of the published missed approach.
The aircraft passed overhead Launceston at about 0136. The flight crew then proceeded to descend the aircraft in accordance with the prescribed ILS approach procedure. The minimum altitude for landing of 750 ft (202 ft above the runway threshold) was reached at about 0145. As the crew could not see the runway, a missed approach was conducted.
At about 0147, the aircraft levelled off at the missed approach altitude of 3,200 ft. About 20 seconds later, the CA initiated a left turn by selecting the autopilot heading bug to a south‑westerly heading. The CA’s intention was to continue the left turn and position the aircraft overhead the airport for a second instrument approach. The FO reported being surprised by the turn and immediately thought that they should climb the aircraft.
Figure 1: Launceston instrument landing system approach chart for runway 32L with relevant minimum safe altitudes required for manoeuvring, in instrument meteorological conditions or at night, circled in red.
Source: Airservices Australia modified by the ATSB
After advising ATC that they had conducted a missed approach, ATC asked the crew to confirm that they were on the published missed approach. The flight crew confirmed this and advised ATC that they were turning back towards Launceston. At about the same time, the CA responded to a radio call from the Launceston Airport groundsman and handed control of the aircraft to the FO. While the CA did instruct the FO to keep the turn going, to where, or onto what heading was not discussed.
While the CA was talking to the groundsman about the weather, the FO observed the radio altimeter become active. The radio altimeter provides an indication of aircraft height above the ground up to 2,500 ft. In response to the radio altimeter activation, the FO advised the CA that they should climb the aircraft.
By about 0148, the aircraft was turning left through a heading of 140 degrees and climbing through 3,900 ft. The aircraft was also approaching the boundary of the 3,200 ft minimum sector altitude[4] (MSA). At about the same time, ATC asked the crew to confirm that they would be remaining within the 3,200 ft sector and advised that otherwise they needed to be at 5,800 ft. The crew responded by advising they were climbing to 5,800 ft.
The aircraft subsequently entered the 5,800 ft MSA sector at about 4,400 ft, on a steady heading of about 110 degrees, and about 3.5 NM (6.5 km) southwest of the airport. As the aircraft was below the required MSA, ATC issued a safety alert for terrain and instructed the crew to climb immediately to 5,800 ft.
In response, at about 0149, the crew advised ATC that they were climbing to 6,000 ft. ATC acknowledged the call and asked the crew if they would be entering the holding pattern overhead Launceston. The crew reported that they were maintaining 6,000 ft and asked ATC to standby.
At about 0150, the aircraft was in a left turn, maintaining 6,000 ft and about 5 NM (9 km) to the southeast of the airport. ATC advised the crew that they were about to enter an area with a higher MSA and to climb immediately to 6,300 ft or higher. The crew acknowledge the altitude requirement and advised ATC that they would be returning to Melbourne. A short time later, as the aircraft had not yet reached 6,300 ft, ATC reissued the instruction to climb immediately to 6,300 ft.
The aircraft was subsequently cleared to climb to its cruise altitude and returned to Melbourne.
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
The aircraft operator, Express Freighter Australia, has made the following amendments to their training and procedures:
A flight standing order was issued that drew flight crew’s attention to the runway 32L instrument approach procedure’s missed approach and the requirements for subsequent manoeuvring.
The approach briefing requirements were amended to include intentions for manoeuvring following the completion of a published missed approach.
A ‘Hot Topic’ discussion item – post missed approach manoeuvring and management, was added to the recurrent simulator training program.
The recurrent simulator training program, released in December 2016, included exercises that reinforce the enhanced arrival and approach briefing requirements. Crews were required to demonstrate appropriate inflight management and manipulation subsequent to completion of a published missed approach.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the evening of 19 February 2016, an Airbus A320 aircraft, registered PK-AXY and operated by PT Indonesia AirAsia was on a scheduled passenger service from Denpasar, Indonesia to Perth, Australia. During cruise, the captain’s flight management and guidance computer (FMGC1) failed. Due to the failure, the flight crew elected to use the first officer’s duplicate systems. For the aircraft’s arrival in Perth there was moderate to severe turbulence forecast below 3,000 ft with reports of windshear. The crew commenced an instrument landing system (ILS) approach to runway 21.
During the approach, the flight crew made a number of flight mode changes and autopilot selections, normal for an ILS approach with all aircraft operating systems available. However, some of those flight modes and autopilot selections relied on data from the failed FMGC1 and the autothrust system commanded increased engine thrust. The crew did not expect this engine response and elected to conduct a go-around. With an increasing crosswind on runway 21, the crew accepted a change of runway, to conduct a non-precision instrument approach to runway 06.
With the time available, the first officer programmed the new approach into his FMGC and conducted the approach briefing. During this period, the captain hand flew the aircraft and manually controlled the thrust. During the approach to runway 06, the crew descended the aircraft earlier than normal, but believed that they were on the correct flight path profile.
While descending, both flight crew became concerned that they could not visually identify the runway, and focused their attention outside the aircraft. At about that time, the approach controller received a “below minimum safe altitude” warning for the aircraft. The controller alerted the crew of their low altitude and instructed them to conduct a go-around. The crew then conducted another approach to runway 06 and landed.
What the ATSB found
The ATSB identified that the flight crew were unsuccessful in resolving the failure of the FMGC and had a limited understanding of how the failure affected the aircraft’s automation during the ILS approach. This resulted in the unexpected increase in engine thrust, which prompted a go-around.
The flight crew had a significant increase in workload due to the unresolved system failures, the conduct of a go-around and subsequent runway change. This, combined with the crew’s unfamiliarity and preparation for the runway 06 instrument approach, meant they did not effectively manage the descent during that approach.
The flight crew’s focus of attention outside the aircraft distracted them during a critical stage of flight. The crew did not detect that they had descended the aircraft below the specified segment minimum safe altitude.
The flight crew commenced their descent for the second runway 06 instrument approach later than normal, initially necessitating an increased rate of descent and at 300 ft the engine thrust reduced briefly to idle.
Safety message
Handling of approach to land is one of the ATSB’s SafetyWatch priorities. Unexpected events during the approach and landing can substantially increase what is often a high workload period. Adherence to standard operating procedures and correctly monitoring the aircraft and approach parameters provides assurance that the instrument approach can be safely completed. A go-around should be immediately carried out if the approach becomes unstable or the landing runway cannot be identified from the minimum descent altitude or missed approach point.
Context
Personnel information
The captain
The captain was an Indonesian national and held an Indonesian Airline Transport Pilot Licence (ATPL) and had accumulated about 13,500 hours of aeronautical experience. Of these, about 9,250 hours were in command and about 5,200 hours were on the A320. The captain reported flying into Perth 3 to 4 times a month (including a night approach on 13 February 2016), and conducting a VHF Omni Directional Radio Range (VOR) approach on runway 06 previously, although not often. The captain had conducted a VOR approach on 18 February, the day prior to the occurrence and reported that he regularly conducted non-precision VOR approaches into his home port of Denpasar.
The captain’s proficiency check records indicated that during the 6-month period prior to the occurrence he had successfully completed a non‑precision approach during his cyclic simulator training. His training record for September 2015 recorded competency with managing a flight management and guidance computer (FMGC) or instrument failure. The captain had been assessed as meeting the requirements of the International Civil Aviation Organization (ICAO) English language proficiency[28] at a level 4 standard.
The captain held the relevant Indonesian Certificate of Medical, First Class. That certificate required the pilot to wear corrective lenses for vision.
The first officer
The first officer, a Japanese national, held an Indonesian Commercial Pilot (Aeroplane) Licence (CPL) and had accumulated about 4,200 hours of aeronautical experience, with approximately 3,100 hours on the A320. The first officer had flown into Perth previously, but the occurrence flight was the first time he had conducted an approach into Perth at night, and it was his first runway 06 VOR approach. The first officer had conducted a VOR approach on the day prior to the incident and reported that he regularly conducted VOR approaches into Denpasar.
The first officer’s proficiency check records indicated that during the 6-month period prior to the occurrence he had successfully completed a non‑precision approach during his cyclic simulator training, including a non-precision approach and landing. The first officer had been assessed as meeting the requirements of the ICAO English language proficiency at a level 5 standard.
The first officer held the relevant Indonesian Certificate of Medical, First Class. That certificate required the pilot to wear lenses that correct for distance vision and possess glasses that correct for near vision.
Fatigue considerations
The flight crew reported feeling alert during the approaches. The ATSB reviewed their flight and duty times and 72-hour history prior to the occurrence, and found no evidence that they were likely to be affected by fatigue at the time of the incident.
Approach speed
The approach speed (VAPP) was computed for the crew by the flight management guidance computer (FMGC) and was based on the aircraft’s stall speed in the selected landing configuration, plus one third of the headwind component calculated from the airport wind entered by the flight crew into the FMGC.[29]
When operating in managed speed mode and to assist with maintaining the energy state of the aircraft in changing wind conditions, the FMGC also continuously calculated a target speed that took into account the instantaneous wind being experienced by the aircraft. That resulted in the target airspeed displayed to the crew on their primary flight displays increasing with strengthening headwind gusts and decreasing with weakening headwind or tailwind gusts (but not below VAPP). If the wind entered by the crew into the FMGC was the same as the instantaneous wind, then the target speed would be VAPP.
For the non-precision approaches to runway 06, the crew were operating the aircraft without the autopilot, autothrust engaged and consequently, were in selected speed mode, and the target speed displayed to the flight crew was VAPP.
Weather
At the time of the approaches, moderate to severe turbulence was forecast below 3,000 ft and ATC had received reports of windshear below 1,600 ft (see Table 1).
Table 1: Actual weather conditions as reported by successive ATIS reports at around the time of the flight by PK-AXY
Moderate to severe turbulence reported below 3,000 ft
B737 reported moderate undershoot and overshoot windshear below 1,600 ft on final approach, runway 21 at 1330
Moderate to severe turbulence reported below 3,000 ft
Windshear warning
Moderate to severe turbulence reported below 3,000 ft
Analysis of the recorded information confirmed that turbulent conditions existed in the vicinity of Perth Airport at the time of the aircraft’s arrival. However, there were no activations of the aircraft’s windshear warning system[31] nor activation of the aircraft’s low-speed flight envelope protection systems.
Airport beacon and runway 06 lighting
The control tower at Perth Airport was equipped with a rotating aerodrome beacon, used to indicate the location of the airport from the air. The beacon alternated between a white and green flashing light, once every 6 seconds.
Runway 06/24 was equipped with high intensity runway lighting, selectable by the tower controller to six stages of intensity. It was also equipped with medium intensity runway lighting, selectable to three stages of intensity. There was no high intensity approach lighting for runway 06 or other lighting[32] to assist pilots identify the runway threshold, and nor was such lighting required. The high intensity runway lighting was selected to stage six (maximum intensity) for the crew’s second approach to runway 06.
Flight management guidance system failure
During the cruise, the flight crew received a red text message on the captain’s blank navigation display (ND) stating MAP NOT AVAIL and the first officer’s multipurpose control and display unit (MCDU2) displayed INDEPENDENT OPERATION. The captain’s ND remained inoperative, with the MAP NOT AVAIL message for the remainder of the flight.
The operator’s Flight Crew Operating Manual (FCOM) indicated that a ND may display a MAP NOT AVAIL message for several reasons:
The MODE CHANGE or RANGE CHANGE message has been displayed more than 6 seconds, or
The FMGC has failed, or
The FMGC has delivered an invalid aircraft position.
The MCDU may display an INDEPENDENT OPERATION message when the FMGCs operate independently of each other. In this case, the flight directors (FD) will also operate independently from one another, with the captain’s FD receiving data from FMGC1. The flight crew had access to the aircraft’s Quick Reference Handbook (QRH) and FCOM during flight. These documents were available for the crew to reference in the event of an aircraft system issue, such as a flight management guidance system (FMGS) failure.
Quick reference handbook
Within the ‘Abnormal and emergency procedures’ section of the QRH, under auto flight there is only one listed procedure, ‘Loss of FMS Data in Descent / Approach (Severe Reset)’. This procedure would not have been relevant at the time of the failure, as it occurred during cruise. However, the computer reset table located in the ‘Miscellaneous procedures’ section was relevant. The crew could not explain why they were unable to locate the relevant information.
The Airbus A320 QRH included a procedure to address one locked or blank MCDU, and another for both MCDUs locked (or blank) or FMGC malfunction. The inflight procedure for one locked/blank MCDU was to ‘Pull the CB [circuit breaker] for the locked or blank MCDU and push it back after 10 s[econds]’. The QRH procedure for both MCDU’s locked / FMGC malfunction was:
Short FMGC Reset: …
In flight:
‐ FD 1(or 2) (OFF)
‐ Pull the CB [circuit breaker] of the affected FMGC
‐ Reset it after 10 s[econds].
Long FMGC Reset: …
In flight:
‐ FD 1(or 2) (OFF)
‐ Pull the CB of the affected FMGC
‐ Reset it after 15 min[utes].
Note: Consider a long FMGC reset only if a short FMGC reset has no effect.
In this instance, the crew recognised that the frozen MCDU1 screen and other system indications suggested a FMGC failure, but conducted neither procedure.
Flight crew operating manual
The FCOM contained a number of different types of FMGS failures and related procedures. These were located in the Procedures section, under ‘Supplementary Procedures’. The table of contents for the supplementary procedures contained a section on auto flight with a subsection related to ‘FMGS Reset and Other Abnormal procedures’. The crew could not explain why they were unable to locate the relevant information.
The failure mode that most closely represented the messages the crew received, related to one flight management system (FMS) failing and latching, but with the FMS continuing to send valid but frozen guidance targets, corresponding to the last valid targets sent before the FMS failed. With this type of failure, the autopilot and FD on the affected side may remain available, and the failed FMGC continues to guide the aircraft using the frozen targets. The FCOM stated that the procedure for this failure is to:
DISREGARD the information coming from the failed side
DO NOT USE the AP [autopilot] on the affected side
- If the AP is engaged on the affected side:
FLY the aircraft back on the intended path
ENGAGE the AP on the operative side, according to the Recommended Practice for
Autopilot Engagement (Refer to FCTM/OP-030 Autopilot/Flight Director)
- If time permits:
PERFORM a long reset of the failed FMGC
Refer to PRO-SUP-22-10 Manual FMGS Reset - Manual Reset of One FMGC
- If the failure affects FMGC1, and if the FMGC1 is still failed and latched before the approach:
DO NOT USE AP1 for the approach
- Before disconnecting AP2:
REVERT to selected speed
DISCONNECT A/THR [autothrust]
Note: It prevents the A/THR from switching to the frozen speed target of the failed FMGC1 when the flight crew disconnects the AP2 for landing.
Dual control inputs on the sidestick
On the A320, each pilot has a sidestick that they can use to manually control the pitch and roll attitude of the aircraft. When the autopilot is engaged, the sidesticks are locked in the neutral position. If a pilot applies a force above a specific threshold, the sidestick becomes free and the autopilot disengages.
The handgrip on the sidestick contains a takeover push button. This button can be used to disconnect the autopilot or takeover from the opposite sidestick.
When the pilots move both sidesticks simultaneously, neither takes priority, and instead the system adds the signals of both sidesticks, with the total limited to the maximum deflection of a single sidestick. If there is a simultaneous deflection of both sidesticks, with a 2º off-neutral deflection, the two green ‘sidestick priority’ lights in the instrument panel’s glareshield illuminate and there will be a ‘dual input’ voice message.
Either pilot can deactivate the other sidestick and take full control by pressing and holding down the priority takeover pushbutton. If the takeover pushbutton is depressed for 40 seconds, the other sidestick is deactivated. It can be reactivated by momentarily pressing the pushbutton of either sidestick.
There was no record of either the captain or the first officer pushing the priority takeover pushbutton during the ILS approach, go-arounds, or during the remainder of the flight.
Handover/takeover procedures
To transfer controls the FCOM stated that the crewmembers must use the following callouts:
‐ To give control: The pilot calls out “YOU HAVE CONTROL”. The other pilot accepts this transfer by calling out “I HAVE CONTROL”, before assuming PF duties.
‐ To take control: The pilot calls out “I HAVE CONTROL”. The other pilot accepts this transfer by calling out “YOU HAVE CONTROL”, before assuming PM duties.
In addition, the Flight Crew Training Manual (FCTM) stated that ‘If the PM (or Instructor) needs to take over, the PM must press the sidestick takeover pushbutton, and announce: “I have control”.’
Types of dual control inputs
Airbus has analysed dual sidestick input events that have been reported to them. In Safety First, The Airbus Safety Magazine (December 2006), Airbus reports that they have found that there are three types of occurrences:
The “Spurious” Dual Stick inputs
Typically due to an inadvertent movement of the stick by the PNF [PM].
For example when grabbing the FCOM or when pressing the R/T [radio].
A spurious dual stick input only marginally affects the aircraft behavior due to only time limited & small inputs.
The “Comfort” Dual Stick inputs
Typically due to short interventions from the PNF [PM] who wants to improve the aircraft’s attitude or trajectory:
These are generally experienced in approach, during a capture (altitude localizer), or in flare, and have minor effects on the aircraft’s altitude/trajectory.
However, as the PF is not aware of the PNF’s [PM] interventions, he may be disturbed and may counteract the PNF’s [PM] inputs.
The “Instinctive” Dual Stick Inputs
Typically due to a “reflex” action on the part of the PNF [PM] on the stick. This instinctive reaction may come about when an unexpected event occurs, like for example an AP disengagement, an overspeed situation or a dangerous maneuver.
Such interventions are more significant in terms of stick deflection and duration. Usually in such situations, both pilots push the stick in the same direction, which may lead to over control, a situation illustrated by the above occurrence.
Autothrust system
Autothrust can be activated when the thrust levers are in the climb detent and the flight crew press the autothrust pushbutton on the flight control unit (FCU). When active the autothrust controls either airspeed or engine thrust as appropriate.
instinctive disconnect button on the thrust lever is pressed
both thrust levers are set to idle.
The thrust lock function is activated when the thrust levers are in the climb detent and either of the flight crew pushes the autothrust pushbutton on the FCU, or the autothrust disconnects due to a failure. When this occurs, the thrust is locked at its level prior to disconnection. Moving the thrust levers out of the climb detent suppresses the thrust lock and associated warnings and gives the crew manual control with the thrust levers.
When the thrust lock function is active:
THR LK flashes amber on the flight mode annunciator (FMA)
electronic centralised aircraft monitor (ECAM) displays ENG THRUST LOCKED and this message flashes every 5 seconds
ECAM displays THR LEVERS …... MOVE
A single chime sounds and the master caution light flashes every 5 seconds.
Stabilised approach criteria
The FCOM specified that in visual conditions the approach should be stabilised at 500 ft above ground level (AGL). In order to be stabilised all of the following conditions had to be verified and meet at the stabilisation height:
the aircraft is on the correct lateral and vertical flight path
the aircraft is in the desired landing configuration
the thrust is stabilised, usually above idle, in order to maintain the target approach speed along the desired final approach path
there is no excessive flight parameter deviation.
If the aircraft was not stabilised by 500 ft AGL in visual conditions the crew were required to conduct a go-around, unless the flight crew estimated that only small corrections were necessary to rectify minor deviations from stabilised conditions due, amongst others, to external perturbations.
Non-precision instrument approach
The Flight Crew Training Manual (FCTM) indicated that the overall strategy for conducting a non-precision instrument approach was to fly it ‘ILS alike’ with the same mental image or representation and similar procedure. The use of autopilot was recommended for all non-precision approaches as it reduced flight crew workload and facilitated monitoring of the procedure and the aircraft’s flight path. If the flight crew correctly programmed the FMGC, the autopilot and FD would ensure lateral and vertical managed guidance was available to conduct the approach.
Depending on whether the autopilot was being used, the PF either monitored the progress of the approach or provided the manual inputs to manage the aircraft’s lateral and vertical navigation, normally using the guidance targets displayed on the FD. In addition, the FCTM indicated that when conducting a non-precision instrument approach, the PF ‘should expand the instrument scan to include outside visual cues’ as the aircraft approached the minimum descent altitude.
The operator’s FCTM stipulated setting the go-around altitude on the FCU when the aircraft was established on final approach and if in a selected mode, the current aircraft altitude was below the missed approach altitude. The FCTM also prohibited setting the minimum descent altitude as the target altitude on the FCU, which could cause a spurious altitude capture and destabilisation of the approach at a critical stage.
Communication and standard callouts
The FCTM stated that if, for any reason, one parameter deviates from stabilised approach conditions, the PM will make the appropriate callout as follows:
Parameter
Exceedance
Callout
Indicated airspeed
Speed target +10 kt / -5 kt
“SPEED”
Vertical speed
Descent rate exceeds 1,200 ft/min
“SINK RATE”
Pitch altitude
+10º / -2.5º
“PITCH”
Bank angle
7º
“BANK”
ILS Only
Localiser
Excess deviation
½ dot PFD
“LOC”
Glideslope
½ dot PFD
“GLIDE”
Non precision approach
Cross track error greater than 0.1 NM
“CROSS TRACK”
Vertical deviation greater than ½ dot
“V/DEV”
Course greater than 2.5º (VOR)
“COURSE”
Course greater than 5º (Automatic direction finder)
“COURSE”
Altitude distance check
“___FT HIGH (LOW)”
Altitude callouts were also to be made by the PM through to landing. Neither the captain nor first officer recollected any callouts being made.
Related occurrences
A search of the ATSB database for similar occurrences in the last 5 years was conducted. The search did not identify any occurrences where a flight crew had difficulty locating Perth Airport or the runways in CAVOK conditions.
The database contained six occurrences where an enhanced ground proximity warning system (EGPWS) glideslope warning had occurred during the runway 06 VOR approach. Of these, four related to the inadvertent selection of the ILS for another runway. There were a further 25 cases of glideslope warnings where the runway was not identified in the occurrence details. There was one record of an EGPWS terrain warning occurring at Perth although the approach involved was not identified. The occurrence details in that case suggested the terrain warning was spurious. There were no occurrences recorded in the ATSB occurrence database where an minimum safe altitude warning was issued by ATC during a runway 06 approach.
On 4 and 29 May 2010, an Airbus A330 aircraft, operated by AirAsia X was involved in two separate occurrences on approach to the Gold Coast, Queensland, where the aircraft were descended below the segment minimum safe altitudes.[34] On both occasions, there was low cloud and reduced visibility on arrival at the Gold Coast. The ATSB found that these events were indicators of a minor safety issue regarding the operator's training of its flight crews, in relation to non-precision approaches.
On 24 July 2011, a Boeing Company 777-3D7 aircraft, operated by Thai Airways, was conducting a runway 34 VOR approach to Melbourne Airport, Victoria.[35] During the approach, the tower controller observed that the aircraft was lower than required and asked the flight crew to check its altitude. The tower controller subsequently instructed the crew to conduct a go-around. However, while the crew did arrest the aircraft’s descent, there was a delay of about 50 seconds before they initiated the go-around and commenced a climb to the required altitude.
The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’ when the aircraft pitched up to capture the VOR approach path. As a result, the remainder of the approach was conducted using the autopilot’s flight level change mode, where the aircraft’s rate of descent may be significantly higher than required. In addition, the flight crew inadvertently selected a lower than stipulated descent altitude, resulting in descent below the specified segment minimum safe altitude for that stage of the approach.
On 30 June 2011, an Airbus A320 aircraft, operated by Tiger Airways Australia conducted a go-around procedure at Avalon Airport, Victoria, after an unsuccessful approach to runway 18.[36] While re-positioning the aircraft for another approach, this time on the reciprocal runway 36, the aircraft descended without further ATC clearance to below the assigned altitude. The flight crew was subsequently cleared for a visual approach; however, the aircraft descended to below the minimum permitted altitude of 2,000 ft, to 1,600 ft. The ATSB investigation found that the flight crew’s understanding of the aircraft’s position during the second approach was probably influenced by the workload associated with the runway change.
On 11 September 2016 an Airbus A330 aircraft, operated by AirAsia X descended below the segment minimum safe altitude, near the Gold Coast Airport, Queensland.[37] The flight crew were cleared to conduct a RNAV-Z (GNSS) instrument approach to runway 14 at Gold Coast Airport in visual meteorological conditions. During the approach, the aircraft was observed to descend below a segment minimum safe altitude. At the time of publication, the ATSB investigation was ongoing.
The sources of information during the investigation included the:
aircraft operator, PT Indonesia AirAsia
aircraft flight crew
provider of air traffic services, Airservices Australia
manufacturer of the aircraft, Airbus.
References
Dismukes, R.K., and Berman, B. (2010). Checklists and monitoring in the cockpit: Why crucial defences sometimes fail. NASA/TM-2010-216396, NASA Ames Research Centre, Moffett Field, CA.
Kahneman, D. (2011). Thinking, fast and slow. Allen Lane: London, UK.
Klein, G. (2008). Naturalistic decision making. Human Factors, Vol 50, No.3, pp.456-460.
Orlady, H.W., and Orlady, L.M. (1999). Human factors in multi-crew flight operations. Ashgate: Aldershot, UK.
PARC/CAST Flight Deck Automation Working Group. (2013). Operational use of flight path management systems. US Federal Aviation Administration.
Staal, M.A. (2004). Stress, cognition, and human performance: A literature review and conceptual framework. NASA/TM-2004-212824, NASA Ames Research Centre, Moffett Field, CA.
UK Civil Aviation Authority. (2013). Monitoring matters: Guidance on the development of pilot monitoring skills. Loss of Control Action Group, CAA Paper 2013/02, West Sussex, UK.
Wickens, C.D., and Hollands, J.G. (2000). Engineering psychology and human performance (Third edition). Prentice Hall: New Jersey, US.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to PT Indonesia AirAsia, the aircraft flight crew, Airservices Australia, the Civil Aviation Safety Authority, Airbus and the French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile.
Submissions were received from PT Indonesia AirAsia, Airservices Australia, the Civil Aviation Safety Authority, Airbus and the French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Safety analysis
During the flight, the captain’s flight management guidance computer (FMGC1) failed. The flight crew’s response to this and their utilisation of FMGC1 during the runway 21 instrument landing system (ILS) approach, resulted in an unexpected increase in engine thrust and subsequent go-around. After conducting the go-around, they were required to change runways due to increased crosswind and conduct a VHF Omni Directional Radio Range (VOR) approach onto runway 06. During this VOR approach, air traffic control (ATC) received a minimum safe altitude warning, prompting the controller to alert the crew of their low altitude and instructed them to conduct a go-around. Subsequently, the flight crew made another approach for runway 06 and the aircraft landed safely.
The following analysis discusses the crew’s understanding and management of the FMGC failure, their systems knowledge, and the human performance factors that affected the management of the approaches, which resulted in two go-arounds.
Crew response to the flight management guidance system failure
During the cruise, when the captain identified that his multipurpose control and display unit (MCDU1) had frozen and the navigation display (ND) map became unavailable, the flight crew correctly identified an FMGC1 failure. However, they could not locate any information about how to resolve it in the aircraft’s manuals. Had they found the MCDU and FMGC reset procedures in the Quick Reference Handbook (QRH), the crew may have been able to rectify the failure. This would have provided normal operation of the captain’s navigation display ND and MCDU. With an operational MCDU, the captain would have been able to input the approach and aerodrome data into the FMGC1 and the unexpected increase in engine thrust would not have occurred.
Additional information on the failure mode was available in the Flight Crew Operating Manual (FCOM), but the flight crew did not find this information in that manual. The investigation was unable to determine why the crew did not locate the relevant information. This failure to find and action the QRH and FCOM, meant the aircraft systems remained degraded for the rest of the flight.
Understanding of system interactions and subsequent crew decision making during the runway 21 ILS approach
The flight crew discussed the FMGC1 failure during their first approach briefing and decided to use the first officer’s functioning MCDU (MCDU2) and ND on the descent. Because the crew had not previously found the information in the FCOM relating to the failure, they did not understand how it could affect the interactions between the aircraft systems and hence the conduct of the descent. They were therefore unaware that both autopilots, and in particular autopilot 1 (AP1), should not have been engaged during the instrument approach. The reason for not engaging AP1 was that FMGC1 took primacy over the first officer’s FMGC (FMGC2) when both autopilots were used and the data in FMGC1 had frozen at the time of failure.
When the flight crew engaged AP1 during the first approach, they did not recognise that the subsequent cabin pressure fault was related to the engagement of AP1 and its utilisation of FMGC1 data. Additionally, the crew did not realise that the FMGC1 target speed at the time of failure (253 kt) would be utilised when the speed mode was changed from a selected mode (which had a target speed of 160 kt at the time), to a managed mode after AP1 was engaged.
The issue of flight crew understanding systems interactions is not limited to this occurrence. In response to the increase in incident and accident reports of flight crew experiencing difficulties using flight path management systems, a United States Federal Aviation Administration-led Flight Deck Automation Working Group analysed several data sources to produce findings and recommendations for the use of automation on modern flight decks. The working group found that operators had concerns with the level of flight crew skills required for managing automated system malfunctions and/or failures. The working group was cognisant that it was impossible to train pilots in all possible malfunction situations or failure scenarios. They stated that pilots needed to be prepared to recognise the results of partial and complete system failures and intervene appropriately (PARC/CAST Flight Deck Automation Working Group, 2013).
Crew’s understanding of systems interactions and dual control inputs
In this case, the flight crew’s lack of understanding of how the systems interacted led to inappropriate system selections and resulted in the increase in engine thrust. Although the failure of FMGC1 had not been resolved by the flight crew prior to the aircraft commencing descent, FMGC2, MCDU2, autopilot 2 (AP2) and engine autothrust were all capable of normal operation and could have been used to complete the approach normally.
Although the flight crew elected to conduct a go-around when the engine thrust unexpectedly increased, there was a period of 25 seconds where dual sidestick control inputs occurred, prior to the captain taking over control of the aircraft. These dual control inputs indicate a level of confusion and lack of communication regarding conduct of the go-around and about which pilot was in control of the aircraft. There were other instances of dual control inputs of short duration (less than 5 seconds). While these inputs did not affect the flight, there have been other instances where sustained dual control inputs have had a detrimental effect on the control of the aircraft.
Reaction to automation functionality and decision making
Following the go-around and without understanding the reason for the increase in engine thrust or the effect the FMGC1 failure had on the system, the flight crew briefly re-engaged AP1. Due to doubts about the functionality of the automation, the captain then elected to reduce the level of automation, and manually fly the aircraft. This decision presented as being intuitively derived from patterns of behaviour the captain had used successfully in the past. The decision had the effect of removing the potentially problematic automation, but it also increased the crew’s workload.
Researchers (Klein 2008, Kahneman, 2011) have stated that, in time-constrained environments, individuals can make decisions using intuitive reasoning where the steps are often unconscious and based on pattern recognition. For intuitive or naturalistic decision-making, an experienced individual will identify a problem situation as similar or familiar to a situation they have dealt with before and will extract a plan of action from memory. If time permits, they will confirm their expectations prior to initiating action. If time does not permit, actions will need to be initiated with uncertainty that may result in a poor decision.
Crew workload after the initial go-around
Workload has been defined by Orlady and Orlady (1999) as:
…reflecting the interaction between a specific individual and the demands imposed by a particular task. Workload represents the cost incurred by the human operator in achieving a particular level of performance (p.203).
The available cognitive resources are finite and will vary depending on the experience and training of the individual as well as the level of stress and fatigue experienced. Workload is managed by balancing task demands such that, when workload is low, tasks are added and when workload becomes excessive, tasks are shed (Orlady and Orlady, 1999). Tasks, such as internal and external communication, can be shed in an efficient manner by eliminating low priority tasks or they can be shed inefficiently by abandoning important tasks. The task demands can be influenced by the mental and physical requirements of the task, as well as the time available (Wickens and Hollands, 2000).
Factors increasing crew workload
After the first approach, the flight crew’s workload increased substantially with the following conditions:
although the engine autothrust, AP2 and FMGC2 were still operating normally, the crew became uncertain about the automation’s functionality and elected to manually control the engine thrust and fly the aircraft using raw data.
the crew had limited experience, outside of simulator sessions, flying approaches manually.
the turbulent conditions increased the attention required by the captain to maintain desired heading, pitch attitude and airspeed.
the unexpected runway change meant the crew needed to program the approach into the first officer’s MCDU, review the approach and conduct a briefing prior to the approach.
the unexpected runway change and reduced timeframes limited the time available for the crew to review the approach charts.
the captain’s ND was still in operating in a degraded mode and was not displaying lateral tracking guidance for the VOR approach nor the information from the distance measuring equipment (DME). For that information, the captain needed to refer to the first officer’s ND on the other side of the cockpit instrument panel.
the captain’s flight director (FD) was still referencing the frozen FMGC1 and was not providing valid FD attitude guidance targets.
while the crew were experienced in flying non-precision VOR approaches, they had limited experience flying the Perth runway 06 VOR approach at night. The first officer reported never having flown the approach before.
Recorded data indicates that there was 8 minutes from making the decision to conduct the VOR approach to when the flight crew confirmed they were established on the approach, at 10 NM. The limited time available to prepare for the approach, combined with the degraded systems, would have further increased their workload.
Effect of increased workload
Workload and time pressure can lead to a reduction in the number of information sources an individual may access, and the frequency or duration of time these sources are checked (Staal, 2004). Amongst other effects, a high workload can result in individuals not understanding the implications of the information they are presented with.
In this occurrence, the captain’s workload was increased due to the decision to hand-fly the aircraft using the first officer’s ND for lateral tracking guidance and distance information during the VOR approaches. This increased workload made it more likely that, in the visual conditions, he would try and continue the approach using external visual reference.
The flight crew’s workload impacted their ability to manage the approaches and was evidenced by the shedding of tasks, such as:
reviewing the approach charts,
monitoring of the flight profile,
descending the aircraft without confirming the aircraft position,
neither crew member observing the DME distance,
breakdown in the crews’ use of standard operating procedures, such as selecting altitudes other than the missed approach altitude on the flight control unit, while conducting the non-precision instrument final approach.
Had the flight crew elected to hold and prepare prior to conducting the approach, they may have reduced their workload, improved their preparations and conducted a thorough briefing prior to conducting the unfamiliar approach.
Preparation and conduct of the first runway 06 VOR approach
During the first runway 06 VOR approach, the flight crew’s focus of attention was outside the aircraft, attempting to locate the runway. Although the crew were conducting the instrument approach in visual conditions, more attention should have been given to maintaining the aircraft on the prescribed instrument approach flight path profile, until reference was made to the runway landing environment and/or the instrument approach was discontinued. The following content explains how the crew's ability to monitor and maintain the correct flight profile and altitude during the approach was likely hindered. This resulted in the aircraft descending below the specified minimum safe altitude without being detected by the crew.
Crew focus of attention
The captain could not identify the runway and requested assistance from the first officer. Both flight crew then focused on locating the runway, with neither appearing to monitor the aircraft’s flight profile. The crew first became aware of the altitude constraint and that the aircraft had descended below it when advised by ATC. This indicates that both crew were distracted and neither was monitoring the approach at this time. Further indications that the crew was distracted from monitoring the approach included:
the captain took the first officer’s question about when to initiate descent as a prompt to descend without confirming the aircraft’s position.
the lack of detection that the aircraft was descended early.
the first officer thought aircraft was on correct profile because he observed an appropriate initial descent rate.
the descent rate increased substantially above that necessary for a 3-degree approach.
neither crew member observed the DME distance, after initiation of descent.
the first officer could not recall communicating altitude or distance information during the approach.
Crew ability to monitor the approach
Monitoring is an extensive set of behavioural skills that all flight crew are expected to have. This skill set is specified in the aircraft operator’s standard operating procedures and involves the primary roles of monitoring the aircraft’s flight path, communications and the activities of the pilot flying. The UK Civil Aviation Authority (UK CAA) (2013) has defined monitoring as:
The observation and interpretation of the flight path data, configuration status, automation modes, and on-board systems appropriate to the phase of flight. It involves a cognitive comparison against the expected values, modes, and procedures. It also includes observation of the other crew member and timely intervention in the event of deviation. (p.9)
The difficulties that flight crew have with maintaining effective monitoring are thought to be due to not directly controlling the system being monitored. Humans are inherently poor at maintaining vigilance for infrequent events and equipment failures in modern airline operations are rare. Flight crew rarely receive direct feedback on the effectiveness or consistency of their monitoring unlike the feedback they would receive when they may fly an aircraft manually (UK CAA, 2013).
Researchers (Dismukes & Berman, 2010) found that in most instances where flight crew were failing to monitor the aircraft state or position, there were competing concurrent task demands on the crew’s attention. Humans have a limited ability to divide attention amongst tasks and generally, have to switch attention back and forth between tasks. This leaves an individual vulnerable to losing track of the status of one task while being engaged in another.
Other factors affecting awareness of the flight profile
Believing they were on the correct profile, based on the vertical speed the first officer observed early in the descent, combined with the night conditions, and unfamiliarity with the approach reduced the visual cues outside of the cockpit available to the crew regarding the aircraft’s position. The reduced external visual cues along with the crew not utilising the available internal visual cues, such as the course deviation indicator, distance information and multifunction display, led to the crew not understanding where they were on the flight profile or where they were with respect to the runway.
Communication during the approach
The flight crew missed opportunities to identify the early descent, higher than normal rate of descent and descent below the segment minimum safe altitude because they were focused outside the cockpit rather than monitoring their primary flight instruments. The first officer did not provide the captain with the standard altitude and distance callouts, nor with an alert about the rate of descent, which resulted in the aircraft flying below the flight profile. This potentially reduced the captain’s awareness of the deviations from the standard approach and limited his ability to correct it. That communication was particularly important given that the crew had not optimised the aircraft’s remaining systems, with the captain attempting the approach without his ND and FD attitude guidance targets on his primary flight display.
Preparation and conduct of the second runway 06 VOR approach
During the vectoring for the second runway 06 VOR approach, the captain took on the pilot monitoring role. This gave the captain the opportunity to review the approach data and familiarise himself with the required flight profile. The captain returned to the role of pilot flying soon after the initial approach fix and elected to obtain visual contact with the runway prior to initiating the descent. Due to the late descent, the aircraft’s rate of descent was greater than 1,200 ft/min for a period of the approach (although it was stabilised by 1,000 ft).
Due to the captain manually controlling the engine thrust and the turbulence, the engine thrust was briefly at idle at about 300 ft above ground level, which did not meet the stabilised approach criteria and was coincident with an increasing rate of descent. Unstable approaches are known to increase risks in landing, although in this instance the landing was completed without further incident.
Appendices
Appendix A – Runway 21 ILS approach, aircraft track and flight data
Figure A1: Runway 21 ILS approach with aircraft track (blue)
Source: Naviga (modified by the ATSB)
Figure A2: Flight data showing autopilot and mode selections with a resulting thrust and speed increase during the runway 21 ILS approach. The descent depicted is from 3,000 ft to 2,000 ft.
Note:
1. At 2143:04 AP1 was engaged
2. At 2144:37 the auto speed was changed to a managed mode resulting in an increase in the target airspeed (to 253 kt)
3. At 2144:51 the go-around was initiated
Source: ATSB
Appendix B – First runway 06 VOR approach, aircraft track and flight data
Figure B1: First runway 06 VOR approach with aircraft track (blue) and approximate location of go-around (red cross)
Source: Naviga (modified by the ATSB)
Figure B2: Flight data from first runway 06 VOR approach from 2,500 ft to 1,473 ft
Note:
1. At 2200:45 descent initiated
2. At 2201:57 the go-around was initiated, at an altitude of 1,473 ft
The target CAS is the speed target that would appear on the speed tape of the primary flight display.
Source: ATSB
Appendix C – Second runway 06 VOR approach, aircraft track and flight data
Figure C1: Second runway 06 VOR approach with aircraft track (blue)
Source: Naviga (modified by the ATSB)
Figure C2: Flight data from second runway 06 VOR approach from 2,500 ft to landing
Note:
1. At 2215:20 descent was initiated, at about 5 DME
Source: ATSB
Safety issues and actions
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out.
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence
As a result of this occurrence, PT Indonesia AirAsia have taken the following proactive safety action:
Implemented additional classroom sessions on aircraft line-check into the re-training program.
Incorporated the incident as a subject of the SPOT (Special Orientation Training) in the simulator syllabus.
Findings
From the evidence available, the following findings are made with respect to the operational event involving an Airbus A320, registered PK-AXY and operated by PT Indonesia AirAsia that occurred 17 km west-south-west of Perth Airport, Western Australia on 19 February 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The flight crew’s diagnosis of the captain’s failed flight management guidance computer was accurate, but after they did not find the procedure to follow, the failure was not appropriately managed. This resulted in degraded systems capability for the approach.
The flight crew had a limited understanding of how the captain’s failed flight management guidance computer would affect the use of the aircraft’s automated systems during the instrument landing system approach. This meant that their decision to engage autopilot 1 resulted in the frozen data stored in the failed guidance computer being utilised by the auto flight system, leading to an unexpected increase in engine thrust and prompted the crew to conduct a missed approach.
The unresolved system failures, combined with the conduct of a missed approach procedure and the subsequent runway change increased the flight crew's workload. This likely reduced their ability to analyse the actual extent to which their automation was degraded, and effectively manage the subsequent approaches.
During the first runway 06 non-precision approach, the flight crew’s focus of attention was outside the aircraft, attempting to locate the runway. This distraction, along with their unfamiliarity with the approach procedure, inhibited their ability to monitor and maintain the correct flight profile and altitude during the approach. The flight crew did not detect that the aircraft had descended below the segment minimum safe altitude for that stage of the approach.
Other safety factors
During the flight, multiple dual control inputs occurred, which in other circumstances have resulted in aircraft responding in an unexpected manner.
The aircraft's flight path profile was not adequately monitored or communicated between the flight crew during the non-precision instrument approaches to runway 06. This reduced the captain’s awareness of any deviation from the prescribed approach and limited his ability to correct it.
The second runway 06 non-precision instrument approach did not meet the stabilised approach criteria for a short period during the final approach, increasing the safety risk of the landing.
The occurrence
On the evening of 19 February 2016, an Airbus A320 aircraft, registered PK-AXY and operated by PT Indonesia AirAsia was on a scheduled passenger service from Denpasar, Indonesia to Perth, Australia. The aircraft was operated by two flight crew, four cabin crew and carried 96 passengers.
For the flight to Perth, the captain was the pilot flying (PF), with the first officer the pilot monitoring (PM).[1] A late requirement to change aircraft delayed the departure of the flight by 2 hours and the updated arrival time into Perth was estimated to be about 2130 Australian Western Standard Time.[2]
Departure and cruise
On departure from Denpasar Airport, the aircraft climbed to the cruise altitude of FL 370.[3] The flight proceeded normally until the aircraft was just over an hour from Perth when, at approximately 2024, the crew noticed that the captain’s multipurpose control and display unit (MCDU1)[4] had frozen and the captain’s navigation display (ND)[5] had the advisory message MAP NOT AVAIL. In addition, the first officer’s MCDU (MCDU2) displayed the message INDEPENDENT OPERATION, which indicated to the crew that the captain’s flight management and guidance computer (FMGC1)[6] had failed. Figure 1 depicts the location and interaction between the various equipment.
Figure 1: Schematic of A320 cockpit, depicting the location and interaction between various equipment
Source: Airbus Flight Crew Operating Manual
At the time of the FMGC1 failure, flight data indicated the aircraft was flying at a calibrated airspeed of 253 kt. A short time later, the captain recalled disengaging autopilot 1 (AP1)[7] and engaging autopilot 2 (AP2).
The flight crew reported that in an attempt to resolve the issues associated with the frozen MCDU1 screen and apparent FMGC1 failure, they referred to the Quick Reference Handbook (QRH) and the Flight Crew Operating Manual (FCOM) but they determined that there was no specific action for the failures. Instead, as the first officer’s FMGC (FMGC2) appeared to be operating normally, they decided to continue to Perth using his ND and MCDU, because these utilised the functioning FMGC. At 2040, about 15 minutes after the failure occurred, the crew climbed the aircraft to FL 380. The remaining 30 minutes of the cruise was uneventful.
Pre-descent planning and approach
Prior to the descent, the flight crew reviewed and briefed the approach altitude minima, planned arrival route, weather, go-around procedures, as well as conducting other normal pre-descent activities. For the aircraft’s arrival in Perth, moderate to severe turbulence was forecast below 3,000 ft, with visibility greater than 10 km and no significant cloud below 5,000 ft. As the crew had not identified any specific procedure for managing the FMGC failure, and the first officer’s duplicate systems appeared to be operating normally, his MCDU was used to program the arrival procedure and instrument landing system (ILS)[8] approach. The crew briefed that the first officer would take over as PF during the approach, as they believed it was better for the PF to have the functioning ND and MCDU.[9] The crew later reported that they did not identify or conduct further investigation to determine how the FMGC failure may affect continued flight operation or the conduct of the approach.
At about 2115, the flight crew commenced descent into Perth to conduct the JULIM 2A standard instrument arrival[10] and ILS approach to runway 21.[11] As the aircraft descended through 9,000 ft, the captain took over the role of PM while the first officer became PF.
The flight crew selected managed lateral and vertical descent modes[12] with AP2 selected. At about 2140 while descending through 5,000 ft, the crew received the first of three speed restrictions from air traffic control (ATC), which required a change from a managed speed mode to a selected speed mode,[13] to control the aircraft’s speed.
At about 2143, with the approach mode armed, the flight crew engaged AP1 and received a CAB PR LDG ELEV warning.[14] The warning was a result of engaging AP1 with an inoperative FMGC1.[15] This was because with both autopilots engaged, FMGC1 took precedence over FMGC2. The data programmed into FMGC1 at that time did not include the landing and approach data required for the aircraft’s flight management system to determine the cabin’s pressurisation schedule for the descent and landing. To resolve the cabin pressure warning, the crew set the cabin pressure to manual and continued the approach.
ILS approach to runway 21 and go-around
See Figure 2 for a profile view of the runway 21 ILS approach. At about 2144, the aircraft intercepted the localiser and the glideslope for the runway 21 ILS (Appendix A contains the aircraft track overlaid on the approach chart along with the flight data for the approach). At 2144:38, after reducing the aircraft’s selected speed to 160 kt and establishing the aircraft on the ILS, the selected altitude on the flight control unit (FCU)[16] was set to the go-around altitude, consistent with the operator’s standard operating procedure. A short time later, the flight crew elected to select a managed speed mode. This change resulted in the auto flight system attempting to capture the speed target contained in FMGC1 when it failed (which was 253 kt) and the autothrust system commanded an increase in engine thrust.
The flight crew recognised the increasing engine thrust and airspeed but they did not understand why it occurred. The captain told the first officer, ‘make a go-around’[17] and then advised ATC that they were conducting a go-around. From 2144:57, there was a period of 25 seconds where dual sidestick control inputs occurred. During this time, the autopilot automatically disengaged and the captain disconnected the autothrust system.[18] The recorded data indicated that neither the captain nor first officer pressed the priority takeover button[19] during this period. The captain recalled that at about 2,500 ft, at the flap 0 speed, he stated ‘okay, my control’ and took over as PF with the first officer taking the PM responsibilities. Recorded data indicates the captain had sole control of the aircraft at 2145:24, at an altitude of about 2,500 ft.
Figure 2: Profile view of the runway 21 ILS approach with aircraft flight profile (blue). The aircraft was on the ILS profile until the increase in engine thrust and go-around
Source: Naviga (modified by the ATSB)
After the go-around and vectoring for the runway 06 VOR approach
After taking control of the aircraft, the captain reconnected the autopilot and autothrust. The recorded flight data indicates that the AP1 was engaged for 12 seconds, with the autothrust engaged and active for 10 seconds. The captain then decided to disconnect the autothrust to manually fly the aircraft, due to his uncertainty over the thrust increase during the previous approach and failure of FMGC1. The recorded data indicates that when the autothrust was disconnected the thrust lever was below the climb detent. This positioning of the thrust lever meant that it was unlikely the flight crew received a thrust lock (further information is provided in the Autothrust system sub-section in the Context).
At 2146, the first officer requested ATC provide radar vectors for another ILS approach to runway 21. ATC provided radar vectoring and issued clearance for the approach. However, about 4 minutes later, ATC advised the flight crew that the crosswind for runway 21 had increased to 22 kt, with gusts to 25 kt. Due to the increased crosswind, ATC offered the crew the option of conducting a VHF Omni Directional Radio Range (VOR)[20] approach and landing on runway 06.[21] At 2152, after confirming the crew’s preference to land on runway 06, ATC vectored them to the final approach track to conduct the VOR approach.[22] The captain considered there was sufficient time to prepare for the approach, so did not perceive a need to enter a holding pattern to complete the briefing. At 2156, ATC informed the crew that a new ATIS was current and that there was moderate to severe turbulence below 3,000 ft.
The first officer later recalled programming FMGC2 for the VOR approach, and briefing the captain for the approach. The first officer also cross-referenced the information in the FMGC with his paper copy of the instrument approach chart. The captain stated that they conducted a short briefing instead of a full briefing because the situation was moving so quickly.
VOR approach to runway 06 and subsequent go-around
At 2200, ATC asked the flight crew twice if they were established on the 248 radial (which was the inbound track for the VOR procedure) and the first officer responded that they were 10 NM from the runway. ATC again asked the crew to confirm they were established, and the first officer replied stating, that they were ‘established on the inbound radial 068’.[23] In response, ATC cleared the crew to conduct a VOR runway 06 approach, with 10 NM to touchdown. Shortly after, the captain recalled the first officer asking, ‘do we descend now captain?’ In response, captain initiated a descent from 2,500 ft when the aircraft was at 9 DME[24] (Figure 3). Soon after, the landing gear was extended and the first officer selected 1,600 ft on the FCU for the next descent altitude limit. However, the operator’s Flight Crew Training Manual (FCTM) required that the go-around altitude be set on the FCU when established on final approach.[25] Coincidentally, 1,600 ft was the corresponding segment minimum safe altitude for the runway 03 VOR approach, whereas the published altitude for that stage of the runway 06 approach was 1,900 ft.
The captain elected to continue manually flying the aircraft using his primary flight display (PFD) and the first officer’s ND, and manually controlling the engine thrust due to the apparent automation failures. The first officer continued to monitor the descent gradient and vertical speed, and later recalled believing that they were on the correct descent profile. However, for most of the descent, the aircraft’s rate of descent exceeded the recommended rate (700 ft/min) that was published on the approach chart for the aircraft’s groundspeed. The maximum recorded rate of descent briefly reached 1,550 ft/min.
As the approach continued, the flight crew became concerned that they could not see the runway, and both crew became focused on locating the runway. The first officer later reported that because of this, he was no longer monitoring the approach segment minimum safe altitude constraint or was aware of the aircraft’s below flight path deviation during the descent. Although the FCU altitude was set to 1,600 ft, the autopilots were not engaged and the aircraft descended through the selected altitude without capturing the target altitude.
To assist in locating the runway, the first officer asked ATC if they were on the ‘left side of the runway or right side of the runway’. At about the same time, the ATC radar displayed a minimum safe altitude warning (MSAW). In response, the approach controller instructed the flight crew to ‘go round, you are low, low altitude alert, go round’. The flight crew acknowledged the alert and immediately conducted a missed approach. The aircraft had descended to an altitude of 1,473 ft, before the climb was initiated, which was about 400 ft below the segment minimum safe altitude (Figure 3). Aircraft track and flight data for the approach is available in Appendix B.
Figure 3: Profile view of first runway 06 VOR approach with aircraft flight profile (blue). The flight profile shows the crew descending the aircraft below the 2,500 ft segment minimum safe altitude and continuing below the 1,900 ft segment minimum safe altitude before conducting a go-around.
Source: Naviga (modified by the ATSB)
Preparation and conduct of the second runway 06 VOR approach
After completing the go around, ATC radar vectored the flight crew for another VOR approach for runway 06. At around 2204, while the aircraft was being radar vectored, the captain requested that the first officer take over as PF so he could review the approach chart.
At about 2208, the flight crew engaged the autothrust. It remained engaged and active for about 4 minutes, before the FCU autothrust pushbutton was pressed at 2212 and the thrust lock became active until the thrust levers were moved from the climb detent.[26] The crew re-engaged the autothrust about a minute later, and it remained active for 25 seconds before being disengaged, again via the FCU autothrust push button and resulting in a second thrust lock. The crew again moved the thrust levers clearing the thrust lock warning. The crew did not re-engage the autothrust for the remainder of the flight.
During the second VOR approach while the first officer was the PF, there were four occasions where the captain made sidestick control inputs. These inputs were between 2 and 3 seconds in duration and the recorded data indicates that they were not sufficiently large to activate the dual input alert. Neither of the flight crew could recall why the dual inputs occurred.
At about 2212, the captain requested ATC turn on the high intensity lighting on runway 06 as they were still having difficulty seeing the runway. ATC responded that there were no high intensity runway lights for that runway. At 2214, when the aircraft was at an altitude of 2,500 ft, inbound on the final approach track of the VOR and at about 8 DME, the captain took over as PF and the first officer resumed the PM role. At about the same time, ATC asked the crew if they had the runway in sight and informed them that the tower had increased the runway lighting intensity. Approaching 6 DME, the flight crew selected the FCU altitude to the minimum descent altitude for the VOR approach, again contrary to the operator’s procedure for conducting a non-precision instrument approach. The captain confirmed to ATC that the runway was in sight, and at about 5 DME, initiated descent from 2,500 ft to land on runway 06 (see Figure 4 for the profile view of their second approach to runway 06).
Due to the late commencement of the descent from 2,500 ft, the aircraft exceeded the recommended rate of descent (700 ft/min) for the aircraft’s groundspeed until 1,100 ft above the height of the runway threshold. In addition, the aircraft’s rate of descent was greater than 1,200 ft/min[27] for a period of 40 seconds, from an altitude of about 2,100 ft to 1,200 ft. In this period, the rate of descent averaged 1,380 ft/min. When the aircraft was 1,000 ft above the height of the runway threshold, the rate of descent was below 700 ft/min. For a period of 22 seconds, from 430 ft to 120 ft above ground level (AGL), the aircraft’s vertical speed exceeded 700 ft/min and increased to a maximum of 1,100 ft/min. As this decent rate was below 1,200 ft/min, it did not require a callout by the first officer. At 300 ft AGL, the engine thrust reduced briefly to idle and at this point, the aircraft did not meet the stabilised approach criteria. Aircraft track and flight data for the approach is available in Appendix C.
Recorded flight data indicated dual sidestick control inputs occurred, one at 300 ft AGL for one second, then three times from 120 ft AGL until landing with durations of 3 to 5 seconds, these inputs would have resulted in a dual control input alert. However, the aircraft landed without further incident.
Figure 4: Profile view of second runway 06 VOR approach with aircraft flight profile (blue)
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the evening of 5 July 2015, land and hold short operations (LAHSO) were in effect at Melbourne Airport, Victoria. This allowed for simultaneous landings on crossing runways, with the requirement that one aircraft stops well before the intersection of the runways. On this evening, an Emirates Boeing 777 was cleared for an immediate take-off from runway 34 while two Qantas Boeing 737s were on approach to runways 34 and 27. This resulted in the crew of the Boeing 737 on approach to runway 27 initiating a missed approach, followed by the crew of the Boeing 737 on approach to runway 34 being instructed by air traffic control (ATC) to go-around. The Boeing 737 on approach to runway 34 was then radar vectored by ATC below the minimum vector altitude.
What the ATSB found
The ATSB found that, since 2011, Airservices Australia had been aware of the hazard associated with the inability to separate aircraft that were below the appropriate lowest safe altitude at night but had not adequately mitigated it. This resulted in a situation where, in the event of a simultaneous go-around at night during LAHSO at Melbourne Airport, there was no safe option available for air traffic controllers to establish a separation standard and to ensure a mid-air collision did not occur when aircraft were below minimum vector altitude. Though Airservices Australia had implemented a number of preventative controls prior to this occurrence in response to concerns expressed by the Civil Aviation Safety Authority (CASA), a recovery control was not implemented until 2016.
Additionally, the compromised separation recovery training provided to the air traffic controllers employed in the Melbourne ATC Tower did not include a night scenario for missed approaches during LAHSO.
What's been done as a result
Airservices Australia has received an exemption from CASA to radar vector aircraft below the minimum vector altitude at night at Melbourne Airport under certain conditions. Airservices Australia has also instigated a stagger procedure for land and hold short arrival pairs such that aircraft will not come into unsafe proximity in the event of a missed approach. Training in compromised separation recovery at night during LAHSO has also been introduced for Melbourne ATC Tower controllers.
Safety message
Though air traffic controllers have a duty of care to intervene in a situation where they believe that the safety of an aircraft may be in doubt, such interventions can have unintended consequences. When assessing possible actions to address a hazard, the air traffic service provider should consider both preventative and recovery controls. Additionally, simulator training is useful for developing emergency response skills and, as such, should address all credible compromised separation recovery scenarios.
Safety issue and actions
The safety issue identified during this investigation is listed in the Findings and Safety issue and actions sections of this report. The ATSB expects that the safety issue identified by the investigation should be addressed by the relevant organisation. In addressing this issue, the ATSB prefers to encourage the relevant organisation to initiate safety action proactively, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Hazard associated with the inability to separate aircraft below the appropriate lowest safe altitude at night
The hazard associated with the inability to separate aircraft that are below the appropriate lowest safe altitude at night was identified but not adequately mitigated. This resulted in a situation where, in the event of a simultaneous go-around at night during land and hold short operations at Melbourne Airport, there was no safe option available to air traffic controllers to establish a separation standard when aircraft were below minimum vector altitude.
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions by Airservices Australia in response to this occurrence:
Training in night-time compromised separation recovery during LAHSO was completed by all Melbourne Tower controllers in March 2016.
On 10 March 2016, an arrival stagger was introduced for LAHSO arrival pairs to ensure that, in the event of a missed approach, the aircraft would not be in unsafe proximity at the runway intersection.
Additional details
Melbourne Aerodrome Control On-the-job Training Instructor details
The sources of information during the investigation included:
Airservices Australia
the Civil Aviation Safety Authority
the airlines involved
flight crew from VH‑VXS, VH‑VYE and A6‑EBU
the air traffic controllers involved.
References
Arthur, W., Bennett, W., Stanush, P.L. & McNelly, T.L., 1998, ‘Factors that influence skill decay and retention: A quantitative review and analysis,’ Human Performance, vol. 11, pp. 57-101.
Gibb, R., Gray, R. & Scharff, L., 2010, Aviation visual perception, Ashgate, Surrey, England.
Isaac, A. R. with Ruitenberg, B., 1999, Air traffic control: human performance factors, Ashgate, Aldershot, England.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
Submissions were received from Airservices Australia, the Civil Aviation Safety Authority, the airlines involved, the flight crew from VH‑VXS and VH‑VYE, the Dubai Civil Aviation Authority and the involved air traffic controllers. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
The occurrence
At 1808 Eastern Standard Time[1] on 5 July 2015, an Emirates Boeing 777‑31HER (B777), registered A6‑EBU and flight number 405, conducting a scheduled passenger flight to Changi Airport, Singapore was issued instructions to line up on runway 34[2] (Figure 1) at Melbourne Airport. The instruction was issued by a trainee Melbourne Aerodrome Controller (trainee tower controller)[3] following discussion with her on‑the‑job training instructor (tower OJTI). Also in the Tower were the Melbourne Tower Coordinator (coordinator) and a controller providing both Melbourne Surface Movement Control and Airways Clearance Delivery. At the same time, two Qantas Boeing 737‑838s (B737s) were about 5 NM (9 km) from the threshold of their respective runways under land and hold short operations (LAHSO):[4]
the B737 on final for runway 27, registered VH‑VXS (VXS) and flight number 449, was conducting a scheduled passenger flight from Sydney, New South Wales
the B737 on final for runway 34, VH‑VYE (VYE) and flight number 819, was conducting a scheduled passenger flight from Canberra, Australian Capital Territory.
Under LAHSO, the B737 tracking to land on runway 34 was required to land and stop before the intersection with runway 27, allowing the other B737 to land on the full length of runway 27.
About 30 seconds later, as the B777 continued to taxi towards the runway, the aircraft was cleared for an immediate take-off.[5] In one continuous movement, the B777 flight crew followed the taxiway lights onto the runway and executed a 90˚ turn to line up on the runway centre line prior to commencing the take-off roll.[6] This manoeuvre took longer than the trainee tower controller and the tower OJTI had anticipated and, by the time the B777 had commenced the take-off roll at 1810, VXS was at about 2.5 NM (5 km) from the runway 27 threshold passing 1,300 ft above mean sea level (AMSL)[7] on descent and VYE was less than 2 NM (4 km) from the runway 34 threshold passing 1,100 ft on descent.
Due to the slower than anticipated speed by the B777 commencing its take-off roll, the trainee tower controller requested the flight crew of VXS to reduce to minimum speed. The flight crew responded that they were at minimum speed. The tower OJTI then asked the trainee tower controller to inform the flight crew of VXS that, in the event of a missed approach, the flight crew were to expedite climb to 4,000 ft as there was ‘traffic departing the crossing runway.’ In response to this transmission, at 1810, the flight crew of VXS advised that they were going around.[8] At that time, VXS was about 1.2 NM (2.2 km) from the runway 27 threshold passing 900 ft on descent and VYE was about 1 NM (2 km) from the runway 34 threshold passing 800 ft on descent.
Figure 1: Melbourne Airport diagram with runways 27 and 34 indicated (green and blue respectively) and the location where the B777 entered runway 34 indicated by a purple arrow
Source: Airservices Australia, modified by the ATSB
The coordinator expressed concern that the departing B777 was still occupying runway 34 and that a runway separation standard would not be maintained with the arriving VYE.[9] Receiving what he deemed an unsatisfactory response from the tower OJTI, the coordinator then instructed the trainee tower controller to send VYE around.[10] At the same time as the trainee tower controller instructed the flight crew of VYE to go around, at 1811, a runway 34 occupancy caution activated in the Tower because the B777 was still on runway 34 and VYE was less than 15 seconds flight time from the threshold.[11] Two seconds later, the caution upgraded to a warning as VYE was now less than 10 seconds flight time from the threshold descending through 500 ft and the B777 was still on the runway, passing taxiway FOXTROT (Figure 2). At that time, VXS was less than 1 NM (2 km) from the runway 27 threshold climbing through 1,100 ft.
Figure 2: Melbourne Airport diagram with runways 27 and 34 indicated (green and blue respectively), and the location of the B777 (purple arrow) passing taxiway FOXTROT (yellow) at 1810:34
Source: Airservices Australia, modified by the ATSB
Seconds later the flight crew of VYE reported that they had commenced the go-around. Surveillance data showed that the B777 was still on runway 34, south of the intersection with runway 27. The trainee tower controller then advised the flight crew of VYE that a B737 (i.e. VXS) was going around on runway 27 but used the incorrect runway identification – runway 34 instead of runway 27.
At 1810:43, as VYE flew over the threshold of runway 34, surveillance data showed the aircraft climbing through 600 ft with the B777 still on the runway, still south of the intersection with runway 27, with VXS less than 0.3 NM (0.6 km) from the threshold of runway 27 climbing through 1,200 ft.
Nine seconds later at 1810:52, as VYE left 1,000 ft on climb overhead runway 34 (Figure 3), the trainee tower controller was instructed to tell the flight crew to turn right onto a heading of 360˚ while the aircraft was below the minimum vector altitude (MVA) of 2,000 ft.[12] At that time, surveillance data showed the B777 north of the runway 27 intersection climbing through 800 ft and VXS overhead runway 27 climbing straight ahead through 1,700 ft. Shortly afterwards, the trainee tower controller issued a wake turbulence caution to the flight crew of VYE[13] in relation to the B777 departing runway 34.
Figure 3: Melbourne Airport diagram showing the location and height of the B777 (purple), VH‑VXS (green) and VH‑VYE (blue) at 1810:52
Source: Airservices Australia, modified by the ATSB
Fourteen seconds later at 1811:18, VYE was just south of runway 27 and climbing through 2,100 ft – now above the MVA of 2,000 ft. All aircraft were now tracking well clear of each other and their flight paths were diverging, with the B777 continuing to Changi and the two 737s being re-sequenced to land at Melbourne Airport without further incident.
At no time was traffic information[14] provided to the flight crew of the B777 regarding either B737.
Airservices Australia (Airservices) surveillance data showed that separation between the two B737s reduced to about 0.9 NM (2 km) and 900 ft as VXS crossed runway 34 in front of VYE, climbing in the missed approach on runway 27. At that time, VYE was also climbing, conducting a go-around from runway 34. The tower controller was responsible for maintaining a separation standard and the only available standard was visual.[15] However, due to the limitations of human vision at night[16] and the disposition and trajectory of traffic at the time, visual separation could not be assured.
Melbourne Aerodrome Control on-the-job training instructor (tower OJTI)
Melbourne Coordinator (coordinator)
a controller performing the combined duties of the Melbourne Surface Movement Controller and the Melbourne Airways Clearance Delivery Controller.
With the exception of the trainee tower controller, each controller was correctly endorsed and no fatigue‑related issues were identified. The tower OJTI and the coordinator were also endorsed in all Tower control positions.
The trainee tower controller was on her fourth under-training shift and had not used or observed land and hold short operations (LAHSO) before. Though she had 11 years’ experience working in busy control towers overseas, the trainee tower controller held no endorsements at Melbourne Airport.
All controllers had completed the Tower-specific compromised separation recovery training.[17]
The flight crew from the three involved aircraft were correctly licenced and fit for duty.
Entering runway 34
A senior Tower controller reported that, during the day, most aircraft line up on runway 34 by following the runway 16 taxi-off markings (in yellow on Figure 4), entering the runway via a curve. Some aircraft also follow this path at night, but some follow the taxiway lighting onto runway 34, resulting in a 90˚ turn to line up in the departure direction (in orange on Figure 4).
Figure 4: Threshold of runway 34 at Melbourne Airport, showing the curved line-up track in yellow, and the track in orange that follows the taxiway lighting
Source: Google Maps, modified by the ATSB
The trainee tower controller and the tower OJTI both reported that, when issued with a clearance for an immediate take-off, they had expected the Boeing 777‑31HER (B777) to line up via the curved entry to runway 34. The controllers believed that by entering runway 34 via a 90˚ turn, the B777’s take-off was delayed.
‘Cleared for an immediate take-off’, is an internationally used phrase that requires the flight crew to taxi onto the runway and take off in one continuous movement. It does not specify the runway entry technique.
The B777 flight crew later reported that they did taxi out and take off in one continuous movement and recorded data supports this. Further, the operator advised that, as performance calculations required the full length of the runway, the 90-degree line up manoeuvre was required.
Missed approach and go-around
When, for any reason, flight crew judge that an approach cannot be continued to a successful landing, a missed approach or go-around is flown. For this reason, a clearance to land authorises the flight crew to go-around or carry out a missed approach. An approach may be discontinued for a number of reasons including:
The required visual references have not been established by the decision altitude/height or minimum descent altitude/height or is acquired but is subsequently lost.
The approach is, or has become, unstable.
The aircraft is not positioned so as to allow a controlled touchdown within the designated runway touchdown zone with a consequent risk of aircraft damage with or without a runway excursion if the attempt is continued.
The runway is obstructed.
Landing clearance has not been received or is issued and later cancelled.
A go-around is being flown for training purposes.
A missed approach procedure is designed for each instrument approach to provide terrain and obstacle protection. When flight crew conduct a missed approach from a visual approach, they must initially remain on runway track and remain visual until re-cleared by the controller. As the flight crew must reconfigure the aircraft during the missed approach, workload can be high.
Land and hold short operations
To improve airport capacity and air traffic system efficiency, LAHSO involves aircraft landing and holding short of an intersecting runway (see Figure 1 for the runway configuration at Melbourne Airport) while another aircraft takes off or lands on an intersecting runway. At Melbourne Airport, the landing rate during LAHSO is about 44 aircraft per hour, and about 24 when LAHSO is not in use. Also used in Canada and the US, in Australia LAHSO is only available to operators who have received authorisation from the Civil Aviation Safety Authority to participate in the procedure. During LAHSO, the aircraft issued a hold short requirement is classified as the ‘active participant’, and the aircraft which has unrestricted use of the full length of the crossing runway is classified as the ‘passive participant’. Under LAHSO, simultaneous take-off and landing is permitted only during the day, but simultaneous landings are permitted day and night. In Australia, with the exception of one operator, foreign-operated aircraft are not permitted to participate in LAHSO.
LAHSO has been used in Australia for over 20 years and, at the time of the occurrence, was used at Adelaide, Darwin and Melbourne airports. The procedure is used by day only at Darwin Airport[18] as the crossing runway, runway 18/36, is not lit at night. Following an Airservices review of this occurrence, LAHSO is no longer used at night at Adelaide Airport. At Melbourne Airport, on the day of the occurrence, end of civil twilight was 1743, about half an hour prior to the occurrence.
LAHSO was only conducted when certain cloud base and visibility conditions existed – the cloud base, or ceiling, must not be less than the minimum vector altitude (MVA) within 8 NM (15 km) of the Airport and the visibility not less than 8 km. With an elevation of 434 ft and the highest MVA within 8 NM (15 km) being 2,400 ft, the minimum cloud base for LAHSO at Melbourne Airport was 2,000 ft above ground level. Documentation also required that the Automatic Terminal Information Service broadcast include advice that LAHSO was in progress and stipulate which runway was in use for both arriving and departing aircraft, and which was for arriving aircraft only. All of these requirements were met on the night of this occurrence.
On occasions, an aircraft may require the ‘landing only’ runway for departure, referred to as an off‑mode departure. Managing arriving and departing aircraft operating under LAHSO is made more complex when an off-mode departure is required.
To ensure LAHSO participants are aware of the other aircraft, specific phraseology is stipulated. When landing is approved for an active participant during LAHSO, the following phraseology is used:
Controller: ‘(callsign) (other aircraft type) departing (or landing) on crossing runway, hold short runway (number) cleared to land runway (number)’
Flight crew: ‘hold short runway (number) cleared to land runway (number) (callsign)’
The phraseology used for the passive participant is:
Controller: ‘(callsign) (other aircraft type) landing on crossing runway will hold short cleared to land (or to take-off) runway (number)’
Flight crew: ‘cleared to land (or take-off) runway (number) (callsign)’
Additionally, during LAHSO, the tower controller is responsible for maintaining visual separation in the event of a missed approach or a dual missed approach. This is until such time as another separation standard can be applied, either 3 NM (6 km) or 1,000 ft.
Runway separation standard
For the aircraft involved in this occurrence, separation standards require that the aircraft landing behind a departing aircraft cannot cross the runway threshold until the preceding aircraft is airborne and:
has either commenced a turn, or
is beyond the point on the runway at which a landing aircraft could be expected to complete its landing roll and there is sufficient distance to enable the landing aircraft to manoeuvre safely in the event of a missed approach.
Wake turbulence separation standard
In addition to providing runway separation, wake turbulence[19] standards must also be applied for aircraft departing or going around behind another aircraft. Separation is either time- or distance-based, and is determined by the wake turbulence categories of the aircraft involved. The maximum take-off weight of the B777 place the aircraft in the heavy aircraft category, and the B737‑838 in the medium category. The time-based standard between the aircraft was 2 minutes, and the applicable distance standard is 5 NM (9 km). As Melbourne is a radar tower environment, only the distance standard was applicable.
A wake turbulence standard is not required between an aircraft landing behind an aircraft taking off on the same runway. If the landing aircraft, however, conducts a missed approach behind one departing, the aircraft in the missed approach is considered a departing aircraft. As the trainee tower controller did on this occasion, the controller should issue a wake turbulence caution to the flight crew of a following aircraft when less than the applicable wake turbulence standard exists.
Traffic information
Traffic information is issued by an air traffic controller to alert flight crew to other known or observed traffic. This traffic may be in proximity to the position or intended route of the aircraft, and the issued traffic information helps the flight crew avoid a collision. Traffic information should be provided when, in the controller’s judgement, one aircraft may observe another aircraft and could be uncertain of their intention.
Traffic information should be concise and, to assist flight crew in identifying other aircraft, may include the following information if deemed relevant by the controller:
aircraft identification
type and description, if unusual
position information
direction of flight or route of the aircraft
level
intentions of the pilot.
The provision of traffic information, and the content of that information, is reliant on the controller’s assessment of the underlying need.
Compromised separation recovery training
Compromised separation recovery actions are important emergency response actions. They need to be implemented by controllers promptly and accurately when determined that separation standards have been, or will shortly be, compromised. To ensure emergency response actions are conducted effectively, they need to be regularly practiced. Skill decay is more likely to occur when tasks are rarely performed (Arthur et al., 1998), as is the case for compromised separation recovery actions during actual controlling.
Controllers are required to issue safety alerts to pilots of aircraft as a priority when the controller becomes aware that aircraft are considered to be in unsafe proximity. This is the case unless a pilot advises that action is being taken to resolve the situation, or that the other aircraft is in sight. No safety alerts were issued by the trainee tower controller during this occurrence.
An ATSB investigation into a loss of separation assurance near Tindal, Northern Territory in 2014 found that Airservices had not provided controllers with effective simulator-based compromised separation recovery training. This report, ATSB investigation AO-2014-074 – Loss of separation assurance involving A 330 9V‑STQ and A320 VH‑VFH near Tindal, Northern Territory on 24 April 2014, available on the ATSB website, was not released until May 2016, after the occurrence under investigation here.
Vision at night
The tower controller can provide heading information to flight crew to establish and/or ensure separation in the event of a missed approach and, if the aircraft is below the MVA, by day the controller can transfer the responsibility for terrain clearance to the flight crew. As the human visual perceptual system, however, is physiologically limited in perceiving within a night-time environment (Gibb et al., 2010), the responsibility for terrain clearance when an aircraft is being radar vectored at night must remain with the controller.
Another issue discussed by Gibb et al. relates to flight crew susceptibility to glare from bright city lights during approach and landing at night. A review of US investigation reports into accidents and incidents from 1978 to 2005 found 58 documented vision-related accidents and incidents, with 93 per cent occurring during the approach and landing phase.
Additionally, because of the absence of any size cues at night (i.e. at night the apparent size of an object is related to its brightness rather than its image size) the judgement of distance is extremely difficult (Isaac and Ruitenberg, 1999). In providing visual separation, controllers should rely primarily on azimuth; for example, one aircraft to the northwest and another to the northeast. To ensure that aircraft are not in close proximity, caution should be exercised when using a judgement of relative distance or height for visual separation.
Though flight crew can sight and monitor another aircraft at night, the physiological limitations limit their ability to visually separate. These same physiological limitations hinder a controller’s ability to monitor aircraft at night visually, both when attempting to separate visually and in determining if an aircraft is on the runway or airborne.
Controller best judgement and duty of care
The Civil Aviation Safety Regulations Part 172 contains the standards for the provision of air traffic services. The regulations include advice that:
…the provider may deviate from the standards if an emergency, or other circumstance, arises that makes the deviation necessary in the interests of aviation safety.
Best Judgement. Do not allow anything in these instructions to preclude you from exercising your best judgement and initiative when:
a. The safety of an aircraft may be considered to be in doubt: or
b. A situation is not covered specifically by these instructions.
The Airservices National Air Traffic Service Procedure Manual[21] includes:
Duty of care. Upon becoming aware of information such that it would be reasonable to conclude that an unsafe situation has, or may occur, it would be expected that all necessary action is taken to remove that risk.
Note: The extent of the action required will be driven by professional judgement given the particular circumstances and would include an assessment of the likelihood of the event occurring and the potential severity of the outcome.
Further, the National Air Traffic Service Procedure Manual includes:
Reasonable assurance. A controller’s professional judgement that they have ‘reasonable assurance’ of achieving a particular separation standard requires them to be certain that:
a. The disposition and relative performance of all aircraft, vehicle or persons concerned are such that at all times and under normal operation the separation between them will not be less than that mandated;
b. If the anticipation of an aircraft, vehicle or person operating in the expected way is essential to achieving separation then that aircraft, vehicle or person is provided with sufficient information to make them aware of the dependency; and
Any equipment, the continued operation of which is necessary to assure separation, is operating within normal parameters and there is no reason to expect that the serviceability or performance will change.
On-the-job instruction
Air traffic control training comprises theoretical, simulator and on-the-job components. On-the-job instruction is conducted in the workplace by specially trained instructors. The trainee may move through control positions in a hierarchical manner – for example Surface Movement Control then Aerodrome Control (tower), although the trainee involved in this occurrence had started as a tower trainee.
Airservices stated that the overriding principle for an OJTI is that safety must never be compromised. The training for OJTI also included information about the types of errors to be expected:
Those that must be prevented as they would compromise safety
Those that must be corrected immediately
Those where correction can be delayed as the trainee could learn from the outcome
Those that result from a lack of experience where correction is not necessary.
Intervention strategies for an OJTI range from questioning the trainee, to suggesting an alternate course of action, to directing the trainee, and finally to intervening by taking over or overriding the trainee. Intervention is the last resort and only used to ensure safety.
While conducting training, overall responsibility for the provision of a safe and efficient air traffic service resides with the OJTI, as the trainee is either not licenced or not endorsed. During the training period, the trainee will be given more and more responsibility for the control and separation of aircraft, but the OJTI must monitor the trainee’s performance and ensure that any errors or omissions that may impact safety can be corrected in a timely manner. To facilitate this, the communication system provides a facility to enable the OJTI to override the trainee’s transmissions.
Advanced Surface Movement Guidance Control System
The Melbourne Tower is fitted with an integrated tower automation suite that presents information to controllers by way of a number of computer screens. Different integrated tower automation suite installations exist to incorporate the differing automation available in control towers across Australia. The Melbourne Airport integrated tower automation suite incorporates an Advanced Surface Movement Guidance Control System – a system that provides the controller with surveillance data for vehicles and aircraft on the ground, and airborne aircraft in the immediate vicinity of the Airport. The Advanced Surface Movement Guidance Control System generates aural alerts based on two logics:
Time to threshold for an arrival on a single runway if the Advanced Surface Movement Guidance Control System detects a vehicle or aircraft (targets) on that runway:
Caution: 15 seconds from that runway’s threshold
Warning: 10 seconds from that runway’s threshold.
Target to target where a collision risk exists between two targets.
In addition to the aural caution and warning, the controller also received a visual representation of the caution and warning alerts.
On receipt of an Advanced Surface Movement Guidance Control System caution or warning, the controller is required to scan the aerodrome traffic immediately to assess the integrity of the alert. If required, the controller should then issue traffic advice, control instructions and/or a safety alert. Though the controller did not issue any traffic or safety alerts, she had already instructed the B737 on final for runway 34 to go around prior to the activation of the caution and the warning.
Airborne collision avoidance system limitations
Regular public transport aircraft are fitted with airborne collision avoidance systems (ACAS) that, independently of any ground-based air traffic control system, provide collision avoidance protection by advising flight crew of traffic in their immediate area. Traffic advisories (TAs) provide a visual representation of the proximate traffic to assist flight crew to sight that aircraft. Resolution advisories (RAs) provide recommended vertical escape manoeuvres (either climb or descend) to either increase or maintain existing vertical separation between aircraft. When the two aircraft involved are capable of RAs, ACAS uses data from both aircraft to determine the best solution and issues coordinated and complimentary RAs to the flight crew – one to climb and the other to descend. Consequently, flight crew are taught to respond to an RA regardless of any instruction from a controller.
The collision system logic is complex and is based on sensitivity levels, time intervals to the closest point of approach and the size of the protected volume around the aircraft. Critically, the sensitivity level is based on the altitude of the aircraft and, below 1,000 ft above ground level, RAs are inhibited and TAs are only issued when the proximate aircraft is within 20 seconds to the closest point of approach. In this occurrence, with Melbourne Airport at 434 ft, RAs would not have been issued when the aircraft were below 1,434 ft, i.e. during the time of their closest proximity.
ACAS is considered the last line of defence against a mid-air collision and should not be relied on as a separation method.
Terrain awareness and warning systems
Regular public transport aircraft are also fitted with terrain awareness and warning systems (TAWS). This system relates aircraft position, which should be from a GPS source which can be internal to the equipment or fed from the aircraft flight management system, to an almost worldwide terrain/obstacle/airport database which the equipment manufacturer regularly updates. A comprehensive set of reliable cautions and warnings can be generated which use both the radio altimeter and relative position. TAWS provides a forward looking terrain avoidance function that looks ahead of the aircraft along and below its lateral and vertical flight path and provides suitable alerts if a potential controlled flight into terrain threat exists.
Like the ACAS, a TAWS is considered the last line of defence against controlled flight into terrain and should not be relied on as a separation method.
Previous occurrences
In October 2011, at Melbourne Airport, at night and during LAHSO, an aircraft on final to land on runway 34 conducted a missed approach while another aircraft was landing on runway 27. As the aircraft in the missed approach was below the MVA, the controller was unable to issue a radar vector to ensure separation. The occurrence was reported but ATSB did not investigate.
At night on 5 July 2015, three aircraft came into unsafe proximity during take-off and landing at Melbourne Airport, Victoria. Shortly afterwards, one aircraft was radar vectored in a missed approach while below the minimum vector altitude (MVA). This analysis discusses the relevant controller actions and the organisational issues identified during the investigation.
Use of runway 34 for off-mode departures
Sequencing for arriving aircraft at Melbourne Airport has been computerised to ensure consistency and efficiency. The sequencing tool, MAESTRO, is used by Airservices at a number of airports and uses the actual position and speed information from their surveillance system to determine each aircraft’s landing runway and position in the sequence. This information is displayed to the controllers to enable them to use speed control, vectoring or holding to achieve an orderly traffic flow.
When land and hold short operations (LAHSO) are in place for runways 27 and 34, both runways are available for arriving aircraft, but only runway 27 is available for departing aircraft. Some larger aircraft, however, require runway 34 for departure due to its greater length. Additionally, runway 34 can be more attractive to departing aircraft due to a shorter taxi distance, or the runway being better aligned to their departure direction.
MAESTRO builds a gap into the runway 27 arrival sequence to allow for departing aircraft. Aircraft departing from runway 34 are considered off-mode during LAHSO, and a controller must fit departures into the arrival sequence based on their best judgement. For the aircraft involved in this occurrence, runway separation requires that a landing aircraft cannot touch down until the preceding departing aircraft, using the same runway, is airborne.
On the night of this occurrence, in the gap between arrivals sequenced to runway 34, one off‑mode departure had already used runway 34 prior to the B777 being lined up. Though the flight crew of the B777 had received the current Automatic Terminal Information Service[22] stating that LAHSO were in use, being an international operator, the flight crew may not have been aware that both runways at Melbourne Airport were being used for simultaneous arrivals and they were not told about the B737s on final for both runways.
In a statement, the captain of the aircraft on final for runway 27, VH‑VXS (VXS), reported he had heard the instruction to the B777 for an immediate departure. After observing the preceding aircraft depart from runway 34, he believed that his aircraft would be in close proximity to the B777 when they landed, so he had asked the first officer to prepare for a missed approach. Shortly after, and having determined that there was insufficient spacing with the B777, the captain instructed the first officer to initiate a missed approach as the B737 was approaching 500 ft above ground level.
The coordinator became concerned about the sequence when he realised that the flight crew of the B777 had not been advised of the B737 (VXS) going around from final runway 27. Due to the limitations of human vision at night, judgement of distance is extremely difficult, and the coordinator was concerned that the B777 flight crew may have elected to initiate a rejected take-off if they perceived the B737 as a possible threat. If the B777 had rejected the take-off and remained on the runway, there may have been insufficient runway behind that aircraft for the landing roll of the B737 on final for runway 34, VH‑VYE (VYE). Additionally, the coordinator was concerned that there was a high probability that the runway separation standard would not be achieved between the B777 and VYE.
The coordinator communicated his concerns to the trainee tower controller and the tower OJTI. On receiving what he deemed an unsatisfactory response, and believing the situation to be safety‑ and time‑critical, the coordinator instructed the trainee tower controller to send VYE around. The trainee tower controller and the tower OJTI later reported that, as the B777 commenced the take-off roll, they also had concerns about the sequence and the potential for a loss of separation between the two aircraft using runway 34. However, immediately prior to that they both thought that the sequence, while ‘tight’, would work. In that context, if separation relies on an expected rate of aircraft ground movement that may not occur, it is prudent to have an alternative plan. This is more important if the involved aircraft is large and/or operated by international flight crew who may be less familiar with the airport. However, on this occasion the actions of the B777 flight crew were appropriate.
Given the specific LAHSO phraseology required to be used by the Tower controller, and the necessity for a read back by the flight crew of VYE of the restriction to hold short, there may have been insufficient time available for the trainee tower controller to clear both arriving aircraft to land. The trainee tower controller, on her first exposure to LAHSO, had about 29 seconds to:
issue a landing clearance to the flight crew of VYE, including the restriction to hold short of runway 27
receive a correct read back of the restriction from the flight crew
issue a landing clearance to the flight crew of VXS, including advice that VYE was landing on runway 34 but would hold short of runway 27.
Had the line-up and take-off clearance for the B777 been delayed, the two B737s would have landed under LAHSO and the B777 could have then departed without any time pressure. Alternatively, the provision of traffic information on the two B737s to the flight crew of the B777 would have made them aware of the traffic situation and provided the option of expediting their departure or remaining clear of the runway.
Unsafe proximity
Two aircraft arriving simultaneously for different runways during LAHSO are separated by the requirement that one aircraft lands and stops prior to the intersection of the runways. When one or both aircraft however, conduct a missed approach, another separation standard is required. The only available standard was visual. As both aircraft were tracking towards the runway intersection, the controller could not be assured that visual separation would be maintained as the judgement of distance at night is limited by the physiology of the human eye.
Airservices surveillance data showed that separation between the two B737s reduced to about 0.9 NM (2 km) and 900 ft as VXS crossed runway 34 in front of VYE, as VXS climbed in the missed approach on runway 27. At that time, VYE was also climbing, conducting a go-around from runway 34. The tower controller was responsible for maintaining visual separation; however, due to the limitations of its application at night, a surveillance (radar) separation standard of 3 NM (6 km) or 1,000 ft was arguably more appropriate.
As a clearance to land is also a clearance to conduct a missed approach, controllers should have a plan for such an eventuality and act on that plan in a timely manner.
The action of the coordinator in instructing the trainer tower controller to send VYE around changed what was a potential loss of runway separation into a loss of separation between airborne aircraft.
Radar vectors
Though VYE, while going around on runway 34, did not fly through the flight path of the B777 as it executed the go-around, it was 1.5 NM (3 km) behind the B777 instead of the required wake turbulence standard of 5 NM (9 km). The radar vector and caution were issued by the trainee tower controller to expedite the re-establishment of a standard. Additionally, the radar vector increased the divergence between the flight paths of the two B737s when VXS was 0.9 NM (2 km) ahead of VYE and 900 ft above, passing from the right to left.
When an aircraft is vectored by a controller, the responsibility for navigation and terrain clearance is transferred from the flight crew to the controller. A MVA is calculated to ensure terrain clearance at the stated minimum levels and vectoring below the MVA would only be conducted in an emergency situation. At the time of the occurrence, the coordinator believed that the situation was both time- and safety-critical, and he deemed that issuing a radar vector below MVA was the only course of action available, and that action had earlier been sanctioned by his manager.[23] As such, he told the trainee controller to issue the radar vector to the flight crew of VYE.
Hazard assessment and mitigation strategies
Following correspondence from the Civil Aviation Safety Authority (CASA) prior to October 2011 about concerns in relation to separating aircraft below the appropriate lowest safe altitude at night during two-runway operations at Brisbane Airport, Airservices had suspended that type of operation at Brisbane. As stated earlier,[24] in 2011 one of a LAHSO arrival pair at Melbourne Airport conducted a go-around at night and the controller was unable to radar vector to ensure separation. The day after the 2011 occurrence at Melbourne Airport, CASA again wrote to Airservices requesting an explanation as to:
… what safety precautions are in place to ensure the safety of aircraft participating in LAHSO at night and why this procedure should not be suspended at night until the safety study … is completed.
In a letter to Airservices a week later, CASA stated:
… the (air traffic management) system should not rely, as a primary means of defence, on vectoring or heading changes for (instrument flight rules) category aircraft at night that are below the appropriate minimum altitude.
The safety study referenced in CASA’s initial letter was published by Airservices in October 2012 and included two relevant hazards:
Hazard 901/1 – a go-around at night causing a loss of the ability of controllers to provide separation.
Hazard 901/10 – two aircraft perform a go-around.
At the time of the safety study’s publication, two controls had been put in place to address Hazard 901/1:
cloud ceiling increased to the MVA
the visibility standard increased to 8 km (4 NM).
Only the first of the following controls identified for Hazard 901/10, however, had been met:
Only conduct LAHSO at aerodromes and at times when a reasonable benefit is being realised and these times or conditions to be identified in (local instructions).
Formalise sequencing intervals or cut off distances to reduce likelihood of go-arounds during LAHSO caused by an occupied runway.
Implement procedures to reduce pilot initiated go-arounds due to unstable approach for which there is (a controller) attribution.
CASA continued to express concern in relation to aircraft separation following a go-around at night, early in 2013 providing a discussion paper again articulating concerns about the safety of aircraft below MVA and providing options, including the instigation of a stagger between LAHSO arrival pairs. In April 2013, Melbourne Tower controllers also expressed concerns and were advised by management that radar vectoring below MVA at night was acceptable as a last resort.
In January 2015, following a CASA audit of LAHSO at Melbourne Airport, they made the following observation:
To reduce the risk of aircraft in close proximity, CASA requests that Airservices review the procedures to achieve separation assurance following a double go-around, especially the ability of the tower controller to provide visual separation in certain meteorological conditions.
Airservices ‘noted’ the finding and determined that the issue was being considered in an extant review of LAHSO at Melbourne Airport.
Airservices suspended night LAHSO at Melbourne Airport in November 2015, 4 months after this occurrence. An Airservices survey of obstacles later confirmed that limited radar vectors below MVA did not pose a hazard to aircraft at night, and, in April 2016, CASA issued an exemption to Airservices to radar vector below MVA at night at Melbourne Airport as long as a number of conditions were met. The CASA exemption is limited to aircraft involved in LAHSO. That day, night LAHSO was reintroduced at Melbourne Airport. Another control instigated by Airservices in early 2016, though recommended by CASA in early 2013, was a stagger for arriving LAHSO pairs:
to reduce the risk of two aircraft being in ‘unsafe proximity’ (i.e. passing the runway intersection within 20 seconds of each other) in the case of a double go-around.
Though Airservices was aware of the hazard from at least October 2011, as noted by CASA, in early 2013 the only controls put in place or proposed were preventative in nature i.e. designed to reduce the risk of an aircraft conducting a missed approach at night during LAHSO at Melbourne Airport. Not until 2016 did Airservices put in place a recovery control[25] – a surveyed area where aircraft could be radar vectored when below MVA at night. Had Airservices pursued a recovery control after the 2011 occurrence, the radar vector issued by the trainee tower controller would have been in accordance with documented procedure and training, and would not have resulted in a breakdown of separation with terrain.
Compromised separation recovery training
At the time of this occurrence, the compromised separation recovery training for Melbourne Tower controllers was conducted in a simulator, using various scenarios relevant to Melbourne Airport.
Though one training scenario involved aircraft conducting missed approaches from both runways under LAHSO, the scenario was during daylight hours. As LAHSO is only conducted in visual meteorological conditions, during the day the controller can assign the responsibility for terrain clearance to the flight crew when radar vectors were issued below the MVA.
At night when radar vectoring, the controller must retain the responsibility for terrain clearance. No LAHSO-related simulator training scenarios were at night, though night-time scenarios have now been added.
From the evidence available, the following findings are made with respect to the unsafe proximity and radar vector while below the minimum vector altitude involving a Boeing 777‑31HER, registered A6-EBU, and two Boeing 737‑838s, registered VH‑VXS and VH‑VYE, at Melbourne Airport on 5 July 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The decision to clear the flight crew of A6‑EBU for an immediate take-off, combined with the aircraft’s slower than anticipated rate of movement, resulted in it coming into proximity with VH‑VXS and VH‑VYE.
The proximity between A6‑EBU, VH‑VXS and VH‑VYE resulted in the flight crew of VH-VXS on final for runway 27 electing to go around and the flight crew of VH-VYE on final for runway 34 being instructed to go around on the direction of the Melbourne Coordinator.
Although initiated due to a safety concern, the decision by the Melbourne Coordinator to instruct the crew of VH‑VYE to go around resulted in an airborne loss of separation compared to a potential loss of separation on the ground.
The simultaneous go-arounds conducted by VH-VYE and VH-VXS, sequenced to land on intersecting runways under land and hold short operations at Melbourne Airport, resulted in the controller issuing a radar vector to the flight crew of VH-VYE while the aircraft was below minimum vector altitude to assure surveillance and wake turbulence separation.
The radar vector issued at night to the flight crew of VH-VYE when no other options were available, though intended to ensure wake turbulence and surveillance separation behind A6‑EBU and separation assurance with VH-VXS, did not assure terrain and obstacle clearance.
The hazard associated with the inability to separate aircraft that are below the appropriate lowest safe altitude at night was identified but not adequately mitigated. This resulted in a situation where, in the event of a simultaneous go-around at night during land and hold short operations at Melbourne Airport, there was no safe option available forair traffic controllers to establish a separation standard when aircraft were below minimum vector altitude. [Safety issue]
Other factors that increased risk
The lack of night-time compromised separation training scenarios for the Melbourne Air Traffic Control Tower controllers increased the risk of the controllers responding inappropriately when aircraft were in proximity at night.
The automated sequencing system used by Airservices Australia at Melbourne Airport (MAESTRO) did not ensure that two aircraft would not arrive at the intersection of the runways at the same time during land and hold short operations, increasing the risk of unsafe proximity at the intersection.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 3 August 2015 at about 0410 Eastern Standard Time (EST), a Cessna 441 aircraft, registered VH-EQU, departed Scone Airport for a positioning flight to Illawarra Regional Airport (Wollongong Airport), New South Wales. The flight was to be conducted as a multi-crew operation with the pilot flying (PF) occupying the left seat, and the pilot monitoring (PM) occupying the right seat.
Prior to departure, the pilots conducted a pre-flight briefing noting that the weather forecast for the Wollongong area included a warning for severe turbulence below 8,000 ft. The departure and cruise were uneventful. After commencing descent into Wollongong, the PF briefed the PM for an area navigation (RNAV) instrument approach and landing to runway 16 (Figure 1). The approach was planned to be hand flown in darkness under clear skies with a westerly wind of 25–30 kt, reducing to a light breeze on the ground.
The aircraft arrived overhead position WOLND (Figure 1) at about 5,000 ft on descent to 3,700 ft. Due to the strong westerly wind, flying conditions were turbulent and the PF reported that it was quite difficult keeping the aircraft’s wings level. Approaching WOLNI, the PF levelled the aircraft and maintained 3,700 ft as planned. The aircraft was then slowed down to permit the extension of flap and landing gear.
Figure 1: Cessna 441, VH-EQU
Source: Aircraft owner, modified by the ATSB
In accordance with the approach, the PF recommenced descent at 2.2 NM prior to position WOLNF. Due to the steeper than normal approach path angle (3.7 degrees as opposed to the usual 3.0 degrees), the PF reported establishing a descent rate of about 1,000 feet per minute (fpm). The PM reported that they were expecting a descent rate of about 900 fpm. Air traffic control surveillance data showed the descent rate established was somewhere between 1,000 and 1,500 fpm.
Shortly before WOLNF and as the aircraft approached 2,700 ft, the PM called ‘two thousand seven hundred’ with the expectation that the PF would maintain that altitude until passing WOLNF. However, the descent continued and a few seconds later, the terrain alerting and warning system (TAWS)[1] generated visual and aural ‘CAUTION-TERRAIN’ alerts. These alerts were generated as the system detected that the flight path was projected to come within 300 ft of an obstacle or terrain.
Figure 2: Wollongong RNAV(GNSS) approach to RWY 16 showing approximate flight path profile (green/red dotted line) based on air traffic control surveillance data
Source: Airservices Australia, modified by the ATSB
Pilot flying comment
The PF’s company duties included aircraft charter pilot and flight instructor. The PF’s flying experience included 230 hours operating Cessna 441 aircraft (16 hours in the last 90 days) and 6,930 total flying hours.
The PF recalled working hard trying to keep the aircraft’s wings level, which may have distracted them from monitoring the descent profile adequately. The PF recalled thinking that they may have been slightly low on profile approaching WOLNF, but was startled when the terrain warning sounded. The PF had not participated in any TAWS training, even though they had flown the aircraft (fitted with TAWS equipment) for the previous 12 months.
Pilot monitoring comment
The PM company duties included aircraft charter pilot and flight instructor. The PM’s flying experience included 350 hours operating Cessna 441 aircraft and 3,400 total flying hours.
The PM believed that the when the TAWS alert activated, the aircraft was at an altitude somewhere between 2,600 ft and 2,500 ft and about 0.5 NM before WOLNF. The time between being below 2,700 ft, having the TWAS alert and an appropriate response was less than 10 seconds.
The PM reported having completed TAWS training with a previous employer. The PM believed that following the TAWS warning, they should have applied full power, climbed at maximum rate and conduct a missed approach in accordance with the operator’s procedures.
Fatigue management
Prior to the flight, both pilots had completed 2 days free of duty. They reported being well rested and obtaining about 8 hours sleep each night.
On the morning of the flight, the pilots reported waking up around 0300. They advised that they generally found it counterproductive to try and get to sleep early and therefore only received about 5 hours of sleep.
Despite the limited amount of sleep, both pilots reported being alert during all stages of the flight.
ATSB comment
The aircraft was fitted with a terrain awareness and warning system (TAWS) designed to reduce the risk of flight into terrain. While a TAWS was not required for the particular type of operation, the lack of TAWS training probably explains the nature of the PFs response to the terrain alert.
Pilots and operators of aircraft are encouraged to be appropriately trained in the use of all equipment fitted to their aircraft.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that all pilots now receive TAWS training.
Safety message
Due to the early start combined with inadequate sleep the night before, despite reporting otherwise, the pilots were likely fatigued. Pilots need to be aware that obtaining less than 7-8 hours sleep a night increases the risk of operating with a level of fatigue known to have a demonstrated effect on performance.
Pilots also need to consider the effect flying in the early hours of the morning has on their performance. Their body is in a circadian low period which could lead to periods of impaired alertness and delayed reaction times.
The ATSB continues to be concerned about flight below minimum descent altitudes. When conducting an approach in instrument meteorological conditions, which includes darkness, pilots must ensure the approach is conducted in accordance with the prescribed procedure. In this case, the pilots were required to manage the vertical profile to ensure the aircraft remained at or above the minimum descent altitude, thereby ensuring clearance from terrain and obstacles.
Descent below the minimum descent altitude compromises the minimum terrain clearance requirements and increases the risk of controlled flight into terrain (CFIT).
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
