On the 18 July 2017, Pilatus PC‑12, registered VH-FDJ departed Alice Springs, Northern Territory for Adelaide, South Australia, on a routine single-pilot aeromedical patient transfer flight. During the approach into Adelaide, the pilot noted that the aircraft’s autopilot system failed to intercept the localiser for the Adelaide runway 23 instrument landing system (ILS) approach.
Unaware of why the autopilot did not intercept the localiser, the pilot then became focussed on determining the cause of the autopilot tracking issue while attempting to re-establish the aircraft back on the ILS to continue the approach. The pilot reported this resulted in high workload that was further increased by the tracking information displayed on the aircraft’s course deviation indicator not reflecting the position information being communicated by ATC.
The pilot continued the approach and commenced further descent after observing that the aircraft was close to becoming established on the localiser and that the glideslope was becoming active. Soon after, ATC notified the pilot that the aircraft was below the minimum permitted altitude for the aircraft’s position and instructed the pilot to climb the aircraft to a safe altitude. The pilot then conducted another ILS approach and landed.
What the ATSB found
The unexpected failure of the autoflight system to intercept and track the localiser resulted in the aircraft deviating from the surveyed instrument approach path and significantly increased the pilot’s workload.
The pilot’s focus on resolving the aircraft's lateral tracking and perceived autoflight issues during the localiser intercept decreased his attention on managing the aircraft’s approach profile. That led to the aircraft descending off-track below the minimum safe altitude.
Detection of the off‑track descent and subsequent intervention by the air traffic controller restored safe operation.
What's been done as a result
Following this incident, the operator amended their descent, arrival, and approach procedures, and training and checking procedures to be more prescriptive. In addition, the operator introduced dual global positioning systems, with moving map and chart overlay displays into their legacy aircraft, to improve pilot situation awareness.
Safety message
Adequate approach preparation, and management of aircraft flight profile and automation is vital to ensure pilots maintain manageable workloads and positional awareness during an approach. Additionally, pilots should not hesitate to conduct a go-around or a missed approach should the functionality of the aircraft’s automation, or the validity of positional information, be in doubt.
The occurrence
On the 18 July 2017 a Pilatus PC12, registered VH-FDJ, departed Alice Springs, Northern Territory, for a routine single-pilot aeromedical patient transfer flight to Adelaide, South Australia. The departure from Alice Springs and subsequent en-route phase of the flight was reported by the pilot to have proceeded normally.
Recorded data indicated that the aircraft reached the pilot’s calculated descent point from a cruise altitude of FL 250,[1] at about 42 NM (78 km) to the north-west of Adelaide Airport.
Before descending, the pilot reported that he obtained the available weather for Adelaide Airport and prepared the aircraft’s autoflight system for the arrival. This included programming the standard arrival route (STAR)[2] and instrument landing system (ILS)[3] approach frequency. The pilot also reported reviewing the respective arrival and approach charts displayed on the electronic flight bag screen.
At about 1240 Central Standard Time,[4] the aircraft left FL 250 to commence the Salty 1 STAR (Figure 1) and subsequently the runway 23[5] ILS. The pilot reported that as he was unfamiliar with the Salty 1 STAR, he elected to utilise the aircraft’s autoflight system and the Garmin 430 avionics system for navigation and descent.
Figure 1: Extract from the Adelaide Standard Instrument Arrival
Source: Airservices Australia modified by the Australian Transport Safety Bureau
The pilot reported that, during the descent, he noted a higher-than-normal groundspeed due to the strong westerly tailwind, however this decreased as the approach progressed to lower altitudes. As the aircraft approached the GLOBE waypoint, the pilot crosschecked the aircraft’s profile using the global positioning system (GPS) unit’s calculated profile. Noting that the aircraft was slightly high at that position, the pilot increased the selected descent rate on the autoflight system.
Just after passing the ELIZA waypoint and prior to turning inbound to intercept the localiser at GULLY, the pilot changed the primary navigation source from GPS navigation mode to a heading mode. This autoflight mode change was required to enable the pilot to set the inbound course for the ILS, to facilitate an intercept of the localiser for the runway 23 ILS approach. The pilot then recalled changing the autoflight system back to navigation mode to continue navigation to the waypoint GULLY and armed the approach mode for the ILS intercept. The estimated time available to complete these tasks was less than two minutes.
The pilot reported that the aircraft overshot the required intercept at GULLY. In response, he manipulated the autoflight system by turning the aircraft in the control wheel steering mode in an attempt to re-capture the localiser. At about that time, air traffic control (ATC) advised the pilot that the aircraft had flown through the localiser, ATC issued altitude and heading instructions to assist with a re-intercept. The pilot reported that this required him to cancel the current autoflight selections, including approach mode, to enable a heading to be selected and flown. The workload at this time was reported by the pilot to have been high as he attempted to determine the functionality of the aircraft’s autoflight and navigation systems.
Soon after, ATC gave the pilot radar information that positioned the aircraft left of the localiser. A clearance to conduct the ILS approach was then communicated, with a further request for the pilot to confirm when he was established on the approach. The pilot recalled that at that time he was still trying to determine the issues with the autoflight system and why the course deviation indicator (CDI) was giving conflicting information, indicating the aircraft was slightly right of the localiser. There was no recorded communication from the pilot reporting that the aircraft was established on the approach.
While trying to re-establish the aircraft on the localiser, the pilot observed the glideslope becoming active. As he believed that the aircraft was close to intercepting the inbound track, the descent was continued.
Recorded information confirmed that a short time later, ATC issued an altitude alert to the pilot to check his altitude. This was followed with instructions to climb to a new cleared altitude, to maintain the required terrain clearance, and to fly a different heading in anticipation of conducting another ILS approach.
The pilot reported that he followed the ATC issued radar vectors back to the commencement of the runway 23 ILS approach, where an intercept of the localiser using the autoflight system was made. The second approach was flown without issue.
Pilot information
The pilot was appropriately qualified for the flight, holding a Commercial Pilot Licence (Aeroplane). He also held an instrument rating for both multi-engine and single-engine aeroplanes. The pilot’s logbook recorded a total aeronautical experience of about 6,250 hours.
The logbook indicated that the pilot had about 5,800 hours in command of single-engine aircraft, which included about 640 hours flying Pilatus PC12 (PC12) aircraft.
The pilot had reportedly used the Garmin 430 avionics system before and had previous experience flying the PC12 legacy aircraft (see the section titled Operations). The pilots training file noted the pilot appeared to have no difficulty using the Garmin 430.
The appropriate flight reviews and proficiency checks had been conducted and the pilot was deemed competent to conduct line flying operations by the operator on the 5 July 2017.
The pilot held a valid class 1 aviation medical certificate and reported that he was well-rested prior to the flight and was in good health.
Weather
The pilot reported experiencing a strong westerly tailwind of about 57 kt during the descent and that the approach was conducted in instrument meteorological conditions. However, he noted that as the aircraft descended, the wind decreased and cloud layers were observed.
During the time of the aircraft’s arrival, the trend forecast for Adelaide Airport indicated a cloud base of 1,800 ft with broken cloud at 6,200 ft and wind from 280° M at 19 kt. There were also expected periods of up to 30 minutes duration where the weather would deteriorate, with the wind at 270° M at 22 kt gusting to 38 kt and the visibility reducing to 3,000 m in showers of rain.
Operations
The operator conducted aeromedical services throughout most regions of South Australia and the Northern Territory. The Pilatus PC12 aircraft was the only aircraft type used by the operator. The operator had three variants of the PC12, namely the PC12/45, PC12/47 and PC12/47E. The older PC12/45 and PC12/47 (sometimes referred to as the ‘legacy’) had different avionics and operating characteristics to the newer PC12/47E (referred to as the ‘NG’).
The operator had a valid Air Operator’s Certificate that enabled the use of PC12 aircraft in the charter and aerial work categories, which included the conduct of ambulance functions. The operator also had approval to conduct training and proficiency checks in accordance with the Civil Aviation Safety Regulations 1998.
The operator’s PC12 flight training manual provided basic reference material that related to initial pilot training. The flight training manual included an outline of the training syllabus, checklists and some lesson plans to assist the instructor with training preparation. The flight training manual did not provide any guidance to pilots as to the procedures and operational considerations while flying the PC12.
The flying operations manual outlined the standard operating procedures (SOPs) for a descent and approach. It included that:
At an appropriate time, the pilot is to review the intended approach procedure, including where applicable:
a. instrument or visual approach,
b. airfield information from ERSA, Jeppesen or OPS28 Airfield Register,
c. If an instrument approach procedure is required:
- correct chart, aids and frequencies, - airfield elevation and MSA [minimum sector altitude], - initial approach altitude and entry procedure, - approach procedure, - visual procedure - restrictions, runway, aircraft configuration, and - missed approach procedure.
Checklists used by pilots during flight listed that an ‘approach review’ was to be completed before transition. It was reported by the operator that in the case of longer flights, such as Alice Springs to Adelaide, an approach review and flight instrument setup actions should be completed before commencing the descent.
There was no guidance for pilots as to the operator’s expected flight instrument settings for the arrival. However, the operations manual highlighted the importance of pre-arrival planning and flight instrument set-up during the approach/landing phase. It included procedures for the conduct of a non-precision approach (other than area navigation[6]), area navigation approach and precision approach. There was no guidance to pilots as to when an approach review/brief and flight instrument setup should occur.
The operators expected instrument setup for VH-FDJ (FDJ) differed from other PC12 aircraft in the operator’s fleet due to variation in FDJ’s avionics. The operations manual required that specific familiarisation training was required for pilots flying VH-FDJ due to the differences with all other aircraft in the fleet. The pilot had conducted in-flight training in FDJ prior to the incident.
It was reported by the operator that a pilot flying FDJ should ensure that the inbound course was set on the CDI prior to commencing the STAR. This would alleviate the requirement to change between navigation modes once the STAR had commenced. It would also reduce pilot workload during the descent and arrival.
Training
The operator conducted ground theory training, endorsements, and line training for pilots flying the PC12 variants. The PC12 fleet comprised nine of the newer (NG) type aircraft fitted with ‘glass cockpit’ avionics, and eight older (legacy) type aircraft, with different avionics and operating characteristics. Training provided pilots with familiarity of both types. The occurrence pilot had significant previous experience on the legacy PC12 so the major component of his in command under supervision (ICUS) training concentrated on the NG variant.
The operator’s flight training records identified that the pilot had successfully completed all components of the operators training syllabus. However, notes made during the training identified that the pilot had difficulty at times with profile management, and approach preparation. These issues were not apparent during the pilot’s final flight check for commencement of line operations.
The pilot completed about 96 hours of in-flight training before being approved to conduct line flying operations on the 5 July 2017. The training consisted of 28 training flights, which included 24 flights with the newer PC12 NG variant and four flights with the PC12 legacy aircraft.
Following this occurrence, the pilot completed six remedial flights, two of which were in legacy aircraft. Those flights identified that the pilot required additional training with approach preparation. This included conducting more thorough approach briefings and ensuring that the approach checks and setup were not left too late in order to avoid high workload situations. The pilot’s training notes also emphasised the importance of conducting a go-around if the approach became unstable. At the end of this training the pilot was re‑checked and resumed line flying operations.
Related occurrences
A database search identified a number of occurrences with aircraft descending below the minimum safe altitude. The occurrences have primarily involved aircraft on approach to land. They include situations where pilot(s) attention has been on other tasks during higher workload phases of flight, such as during the later stages of an instrument approach. The ATSB has published the following related safety investigation reports.
AO-2015-018:Flight path management and descent toward the lower limit of controlled airspace involving Airbus A320, VH-VND, on approach to Melbourne Airport, Victoria, on 11 February 2015
On 11 February 2015, an Airbus A320 aircraft, registered VH‑VND and operated by Tiger Airways, was conducting a scheduled passenger service from Hobart Airport, Tasmania to Melbourne Airport, Victoria.
At about 1750 Eastern Daylight-saving Time, about 9 NM (17 km) north of Melbourne Airport, and after the flight crew had been cleared by air traffic control to conduct a visual approach, the aircraft descended below the minimum safe altitude, though the aircraft remained in controlled airspace.
During the descent, both flight crew became preoccupied with other tasks inside the flight deck, which had the effect of increasing their workload and distracting them from monitoring the aircraft’s flight path and altitude. About two minutes after commencing descent on the visual approach, the flight crew levelled the aircraft after realising that it appeared to be low on profile. A safety alert issued by air traffic control soon followed and in response, the aircraft was climbed to intercept the recommended visual approach descent profile. The remainder of the flight was uneventful and the aircraft landed on runway 16 at Melbourne Airport.
AO-2016-012:Descent below segment minimum safe altitude during a non-precision instrument approach involving Airbus A320, PK-AXY, 17 km WSW Perth Airport, Western Australia on 19 February 2016
On the evening of 19 February 2016, an Airbus A320 aircraft, registered PK-AXY and operated by PT Indonesia AirAsia was on a scheduled passenger service from Denpasar, Indonesia to Perth, Australia. During cruise, the captain’s flight management and guidance computer (FMGC1) failed. Due to the failure, the flight crew elected to use the first officer’s duplicate systems. For the aircraft’s arrival in Perth there was moderate to severe turbulence forecast below 3,000 ft with reports of windshear. The crew commenced an ILS approach to runway 21.
During the approach, the flight crew made a number of flight mode changes and autopilot selections, normal for an ILS approach with all aircraft operating systems available. However, some of those flight modes and autopilot selections relied on data from the failed FMGC1 and the auto-thrust system commanded increased engine thrust. The crew did not expect this engine response and elected to conduct a go-around. With an increasing crosswind on runway 21, the crew accepted a change of runway, to conduct a non-precision instrument approach to runway 06.
With the time available, the first officer programmed the new approach into his FMGC and conducted the approach briefing. During this period, the captain hand flew the aircraft and manually controlled the thrust. During the approach to runway 06, the crew descended the aircraft earlier than normal, but believed that they were on the correct flight path profile.
While descending, both flight crew became concerned that they could not visually identify the runway, and focused their attention outside the aircraft. At about that time, the approach controller received a ‘below minimum safe altitude’ warning for the aircraft. The controller alerted the crew of their low altitude and instructed them to conduct a go-around. The crew then conducted another approach to runway 06 and landed.
A number of factors lead to the pilot not being fully prepared for the arrival and subsequent instrument landing system (ILS) approach to Adelaide Airport. Although the importance of early preparation and maintenance of an appropriate flight path profile was reinforced during the pilot’s line training, the impact of not fully configuring the aircraft’s instrumentation earlier in the approach was likely not recognised by the pilot. This, combined with the effect of a tailwind during the approach, reduced the available time for the pilot prepare for the localiser intercept.
While it could not be determined why the aircraft’s autoflight system did not capture and track the localiser, it was possible that a late setup of the inbound course and arming of the approach provided insufficient time for the autopilot to turn the aircraft. From the available evidence it was likely that the pilot had less than two minutes to setup the instrumentation, arm the approach and prepare for the intercept.
It is possible that during preparation for the approach, the pilot incorrectly set the reciprocal of the inbound course on the aircraft’s course deviation indicator (CDI), resulting in displayed tracking indications that were not in the command sense. That would account for the difference between the aircraft’s position, relative to the localiser, displayed to the pilot compared to that advised by air traffic control. That discrepancy created confusion over the aircraft’s actual position and, in combination with the unexpected overshoot of the localiser, significantly increased the pilot’s workload in managing the ILS approach.
The pilot became focussed on resolving the aircraft's lateral tracking and perceived autoflight issues during the localiser intercept. His recollection of being aware that the aircraft was descending but unaware of its specific altitude was consistent with decreased attention on managing the aircraft’s approach profile. That led to the aircraft descending off-track below the minimum safe altitude until identified and remedied by the positive actions of the controller.
Pilot workload
When the aircraft did not automatically intercept the localiser as expected the pilot’s workload started to increase.
Workload has been defined by Orlady & Orlady (1999) as ’reflecting the interaction between a specific individual and the demands imposed by a particular task. Workload represents the cost incurred by the human operator in achieving a particular level of performance’.
Each individual has a finite set of mental resources which allow them to process information and identify appropriate tasks. The set is a variable trait, and will vary with many factors including the experience, training, recency and familiarity with a situation, stress and fatigue. Harris (2011) stated ’High workload is associated with increased error rates (and hence an associated decrease in safety margins) as well as having the effect of reducing overall productivity and increasing occupational stress’.
When the workload gets too high for the available set of resources, an individual will start to task shed, initially systematically and eventually indiscriminately as the workload continues to increase. Green et al. (1996) identified, ‘as the demands of the task, or the workload, are increased, the standard of our performance is achieved. Any increase in workload after this point leads to an overall degradation in performance. At extremely high levels of workload (overload), important information may be missed due to the narrowing or focussing of attention onto only one aspect of the task.’
The United Kingdom Civil Aviation Authority publication CAP 737 (2016) states workload ‘is linked to almost all other areas within cognition and performance, particularly attention, vigilance, fatigue, skills, and multi-tasking.’
Approach and landing is a well-known period of high workload for pilots. In this occurrence, the following factors had the potential to increase the pilot’s workload:
an increased ground speed
limited recent experience with the autoflight system fitted to this aircraft type
the high intrinsic workload of single-pilot IFR flight
restrictions of the single-channel autoflight system in setting up the ILS instrumentation.
While the pilot had the correct intentions for the approach, once the error arose with the aircraft tracking, the pilot became unable to effectively monitor the approach while troubleshooting the situation. Following the intervention of air traffic control, the situation was resolved and the second approach was flown without issue.
Training
The pilot’s initial training with the operator appeared to address identified approach management issues by the time he was cleared to conduct line flying operations. Recognising that subsequent remedial training identified the need for closer study and briefing of instrument approaches, it is difficult to ascertain if more approach consolidation conducted prior to the incident would have prevented it.
Despite profile management and approach preparation being reinforced during the pilot’s training, the standard operating procedures outlined in the company operations manual did not give guidance to pilots as to when and how the aircraft was expected to be configured for the approach. Although an approach review was required, information pertaining to the expected cockpit and approach setup may have benefited the occurrence pilot. More generally, the absence of such guidance increases the likelihood of greater variation in how approaches are conducted.
Safety issues and actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Royal Flying Doctor Service Central Operations
Since this occurrence, the operator has implemented the following improvements:
amended the descent, arrival and approach procedures to include more prescriptive requirements
upgraded the legacy fleet to include dual global positioning system equipment with moving map and chart overlay displays to improve pilot situation awareness
rewritten the Training and Checking manual to include more prescriptive training
strengthened the Safety Management System, including the introduction of a phased implementation of a change management program
changed the initial pilot training, which is now conducted by their recently approved Part 141 organisation.
Findings
From the evidence available, the following findings are made with respect to flight below the minimum permitted altitude involving Pilatus PC-12, registered VH-FDJ, that occurred about 19 km north‑east of Adelaide Airport, South Australia on 18 July 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The unexpected failure of the autoflight system to intercept and track the localiser resulted in the aircraft deviating from the surveyed instrument approach path and significantly increased the pilot’s workload.
The pilot’s focus on resolving the aircraft's lateral tracking and perceived autoflight issues during the localiser intercept decreased his attention on managing the aircraft’s approach profile. That led to the aircraft descending off-track below the minimum safe altitude.
Other factors that increased risk
The pilot did not initiate a missed approach despite being uncertain of the displayed navigation system information and aircraft position. This limited the opportunity for the pilot to resolve any perceived navigation issues at a safe altitude and in a more controlled environment.
Approach guidance in the operations manual did not include detail of the expected cockpit and approach setup preparation. That increased the risk that variation in the conduct of approaches may be introduced into operations.
Other findings
Detection and intervention by the air traffic controller following the off‑track descent below the minimum permitted altitude restored safe operation.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Airservices Australia
Civil Aviation Safety Authority
FlightAware
the flight crew and operator.
References
Civil Aviation Authority, 2016, CAP737 – Flight-crew human factors handbook, Civil Aviation Authority, United Kingdom.
Green RG, Muir H, James M, Gradwell, D, Green RL (1996) Human Factors For Pilots, Second Edition, Ashgate, England.
Harris, D (2011) Human Performance on the Flight Deck, Ashgate, England.
Orlady H & Orlady LM (1999) Human Factors in Multi-Crew Flight Operations, Ashgate, England.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Airservices Australia, the flight crew, the operator and the Civil Aviation Safety Authority.
A submission was received from the operator. The submission was reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
AO-2017-075
Occurrence date
18/07/2017
Location
19 km north-east of Adelaide Airport
State
South Australia
Report release date
18/12/2018
Report status
Final
Investigation level
Defined
Investigation type
Occurrence Investigation
Investigation status
Completed
Mode of transport
Aviation
Aviation occurrence category
Flight below minimum altitude
Occurrence class
Incident
Highest injury level
None
Aircraft details
Manufacturer
Pilatus Aircraft Ltd
Model
PC-12/47
Registration
VH-FDJ
Serial number
861
Aircraft operator
Royal Flying Doctor Service of Australia Central Operations
On the morning of 22 February 2017, a Singapore Airlines Boeing 777-212, registered 9V-SRP, operated scheduled flight SQ291 from Singapore Changi Airport, Singapore, to Canberra Airport, Australian Capital Territory (ACT). There were 13 crew and 235 passengers on board. The instrument landing system (ILS) for runway 35 at Canberra was out of service at the expected arrival time.
Prior to descent to Canberra Airport, the flight crew reviewed the weather conditions for Canberra. Canberra weather observations indicated that the visibility was greater than 10 km and wind conditions favoured runway 35 to be used for landing. As the runway 35 ILS was not available, the flight crew prepared to conduct the Standard Arrival Route (STAR)[1] POLLI FOUR PAPA arrival (Figure 1 left) and associated RNAV-Z[2] approach[3] (Figure 2) for runway 35. As the aircraft was arriving from the west, the flight crew elected to commence the RNAV-Z approach from waypoint[4] SCBSG. The captain, acting as pilot monitoring,[5] entered the arrival and approach into the aircraft’s flight management computer (FMC).
As the aircraft descended, air traffic control (ATC) instructed the flight crew to conduct the POLLI FOUR BRAVO arrival (Figure 1 right).
The flight crew had not briefed for this arrival and the first officer, who was pilot flying, identified that the POLLI FOUR BRAVO arrival led to the runway 35 VOR approach.[6] As the POLLI FOUR PAPA and POLLI FOUR BRAVO arrivals were very similar, the flight crew elected to reprogram the POLLI FOUR BRAVO arrival into the FMC while keeping the RNAV-Z approach. The flight crew intended to request the RNAV-Z approach from ATC upon first contact with the Approach controller. As the POLLI FOUR BRAVO arrival did not lead to the RNAV-Z approach, this created a discontinuity[7] in the programmed FMC flight path between the completion of the arrival at waypoint MENZI and the commencement of the approach. To correct this discontinuity, the first officer asked the captain to connect waypoint MENZI to the approach at waypoint SCBSI. In doing so, the waypoint SCBSG was erased from the programmed FMC approach.
Figure 1: POLLI FOUR PAPA (left) and POLLI FOUR BRAVO (right) arrivals
Source: Operator (annotated by ATSB)
At 0905 Eastern Daylight-saving Time (EDT), the aircraft was about 70 km (38 NM) southwest of Canberra at flight level (FL) 120,[8] with the autopilot engaged. ATC instructed the flight crew to contact the Approach controller. After establishing contact with the flight crew, the Approach controller instructed the flight to continue descending to 9,000 ft above mean sea level (AMSL). The controller advised the flight crew to expect the VOR approach to runway 35.
After the flight crew were advised to expect the VOR approach, they immediately requested the RNAV-Z approach. ATC instructed the flight crew to track to the commencement of the RNAV-Z approach at SCBSG and to expect the RNAV-Z approach. Due to high terrain to the south and southwest of Canberra, the RNAV-Z approach via SCBSG must be commenced from an altitude at or above the minimum sector altitude (MSA) of 7,500 ft. This altitude constraint is included in the FMC programmed flight path when selecting an approach using the arrivals/departures page in the FMC.[9]
Figure 2: RNAV-Z Approach
Source: Operator (annotated by ATSB)
After the controller advised the flight crew to expect the RNAV-Z approach, the captain manually re-entered SCBSG into the FMC without detecting that the 7,500 ft MSA constraint was now missing. The captain then manually connected SCBSG to SCBSI for the continuation of the approach.
At 0908, ATC cleared the flight for the RNAV-Z approach. After receiving clearance to conduct the RNAV-Z approach, the first officer entered the final approach fix crossing altitude of 3,900 ft[10] into the autopilot altitude selector. This directed the autopilot to continue descent to 3,900 ft.[11]
At 0909.16 in visual conditions, the aircraft tracked towards SCBSG. About 7.5 NM (13.9 km) prior to SCBSG, the aircraft descended below 7,500 ft (Figure 3). At 0909.37, as the aircraft descended to about 7,000 ft, the controller contacted the flight crew and advised that they were required to maintain 7,500 ft until SCBSG. The flight crew immediately disconnected the autopilot and climbed the aircraft to 7,500 ft. After climbing to 7,500 ft, the first officer reconnected the autopilot with 7,500 ft as the selected altitude.
At 0911:24, after the aircraft passed SCBSG, the first officer selected the final approach fix crossing altitude of 3,900 ft in the autopilot altitude selector and the aircraft commenced descending. The segment minimum safe altitude (SMSA)[12] for the leg of the approach from SCBSG to SCBSI was 5,300 ft.
As the aircraft descended through about 6,000 ft, and before they had passed SCBSI, the first officer sighted the runway. The first officer advised the captain that they wished to manually fly the aircraft and conduct a visual approach to runway 35. The captain agreed and the first officer disconnected the autopilot and commenced a manual visual approach. The flight crew did not advise ATC that they were visual and had sighted the runway, or that they had elected to conduct a visual approach.
At 0912.37, about 2.1 NM (3.9 km) prior to passing SCBSI on the segment between SCBSG and SCBSI, the aircraft descended below 5,300 ft. As the aircraft descended to about 4,600 ft the captain commented that the aircraft approach profile was becoming low. At the same time, the controller contacted the flight crew and advised them that the aircraft was below the SMSA and that they were required to maintain 5,300 ft until passing SCBSI. The first officer immediately levelled the aircraft at about 4,600 ft. The flight crew advised the controller that they had the runway and terrain in sight. The controller then cleared the flight to conduct a visual approach. After being cleared for a visual approach, the first officer commenced a climb to about 5,000 ft and re-established the aircraft on the desired approach profile.
At 0917, the aircraft landed on runway 35. The aircraft was not damaged, and no persons were injured.
Figure 3: Arrival and approach profile
Source: ATSB, derived from Airservices Australia radar data
Captain comments
The captain of 9V-SRP provided the following comments:
The runway 35 ILS was not available, therefore the RNAV-Z approach was selected as this approach provided the lowest available minimum descent altitude (MDA).[13] The captain did not expect to receive, and had not prepared, for the POLLI FOUR BRAVO arrival and associated VOR approach.
After receiving the POLLI FOUR BRAVO arrival, the captain elected to delay requesting the RNAV-Z approach until in contact with the Approach controller. The captain was not sure how the clearances were coordinated between different ATC units in Australia and believed it would be simpler to request the approach directly from the Approach controller.
As the POLLI FOUR BRAVO arrival tracked via MENZI, this presented a smooth transition to the RNAV-Z approach at SCBSI. The captain did not expect ATC to instruct the flight crew to track via SCBSG as this required a left turn from their position to SCBSG, then a right turn to SCBSI, then another left turn onto final approach.
The waypoint SCBSG should have been added to the FMC programmed flight path by selecting the SCBSG transition using the arrivals/departures page of the FMC. This would have ensured the SCBSG 7,500 ft altitude constraint remained programmed into the FMC.
ATC should have been advised when they became visual and elected to conduct a visual approach.
At the time the first officer commenced the visual approach, the runway 35 T-VASIS[14] was not visible.
During the visual approach, the flight crew used runway visual perspective and attitude along with a check of expected altitudes at specified distances from the runway to assess the approach profile.
Operator report
The operator conducted an investigation into the incident which identified the following points:
The flight crew fixated on flying the RNAV-Z approach as the crew had briefed and planned for this approach. The approach briefing did not include reversion to conventional navigation.
Standard operating procedures direct the flight crew to advise ATC when the flight crew have established visual conditions and are flying a visual approach.
The company operations manual states that flight crew must check FMC waypoints against the arrival chart, the navigation display map and the control display unit. This check shall include the verification of any altitude and speed constraints.
The flight crew training manual directs flight crew to avoid making manual entries when an approach or transition is available in the FMC, to prevent input errors or omissions.
Any transition to a visual approach should only be made when the appropriate cues to ascertain vertical profile such as T-VASIS are clearly visible.
Related occurrences
A number of ATSB investigations have examined occurrences relating to deviations in flight path involving foreign crew operating within Australia. Of these, three are summarised below.
At 2019 at night on 24 July 2011, a Boeing Company 777-3D7 aircraft, operated by Thai Airways, was conducting a runway 34 VOR approach to Melbourne Airport, Victoria. During the approach, the tower controller observed that the aircraft was lower than required and asked the flight crew to check their altitude. The tower controller subsequently instructed the crew to conduct a go-around. However, while the crew did arrest the aircraft’s descent, there was a delay of about 50 seconds before they initiated the go-around and commenced a climb to the required altitude.
The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’ when the aircraft pitched up to capture the VOR approach path. As a result, the remainder of the approach was conducted using the autopilot’s flight level change mode. In that mode the aircraft’s rate of descent is unrestricted and therefore may be significantly higher than that required for an instrument approach. In addition, the flight crew inadvertently selected a lower than stipulated descent altitude, resulting in descent below the specified segment minimum safe altitude for that stage of the approach and the approach not being managed in accordance with the prescribed procedure.
On 4 and 29 May 2010, an Airbus A330-343E aircraft, was being operated by AirAsia X to the Gold Coast, Queensland. On both occasions, there was low cloud and reduced visibility on arrival at the Gold Coast.
During VOR approaches conducted at Gold Coast Airport on both days, the flight crews descended the aircraft below the segment minimum safe altitudes. As a result, the aircraft descended to an altitude where there was no longer separation assurance from terrain and aircraft operating outside controlled airspace.
On 17 December 2008, a Boeing Company 737-4MO aircraft, operated by Garuda Indonesia, made a significant diversion around weather at night while en route to Darwin, Northern Territory. The aircraft was cleared to conduct the runway 11 VOR approach via the initial approach fix NASUX. After the weather diversion, it was more convenient for the flight crew to make a pilot intercept of the 285 radial from the VOR but there was a period of misunderstanding as a result of a breakdown in the application of standard radiotelephony readbacks.
The flight crew left the previously cleared altitude of 3,000 ft on descent although they had not been cleared to do so. When this became apparent, no updated clearance for a pilot intercept of the 285 radial was issued by the controller. The aircraft continued to descend on the basis of the runway 11 VOR descent profile, even though it was not conducting the runway 11 VOR approach.
The flight crew used the position calculated by the aircraft's inertial reference system (IRS) to intercept the 285 radial, instead of using the signal from the VOR. The IRS position was not accurate enough for this, and the aircraft tracked to outside of the stipulated 5 degrees tolerance either side of the 285 radial. From then on, the aircraft was no longer 'established' on the 285 radial even though it was below the minimum sector altitude in cloud. When it broke through the cloud, the aircraft was clearly not aligned with the runway and a missed approach was carried out.
ATSB comment
Over recent years, the number of active VORs has reduced as part of the Airservices Australia Navigation Rationalisation Project. Global navigation satellite system (GPS) is now the primary means of navigation for instrument flight rules aircraft, including RNAV approaches where an ILS is not available.
Internationally, the prevalence of VOR approaches is even further reduced. This reduces the exposure of international flight crew to VOR approaches and therefore reduces the familiarity of international flight crew with the conduct of a VOR approach.
This incident, along with the previous occurrences identified above, highlight the importance of familiarity with this approach type. However, this familiarity may be reduced for foreign flight crews operating into Australia.
The air traffic services provider in Australia, Airservices Australia, advised that all of the runway connected STARs have been removed from the VOR approaches at Melbourne, Adelaide and all but one at Perth to discourage their use. While the VOR approaches are still available on request, flight crews are assigned only instrument approach procedures that are connected to STARs.
Safety analysis
The flight crew planned to conduct the POLLI FOUR PAPA arrival and RNAV-Z approach. When ATC issued instructions for the POLLI FOUR BRAVO arrival and VOR approach, the flight crew accepted the POLLI FOUR BRAVO arrival while preparing to conduct the RNAV-Z approach, instead of the associated VOR approach. This led to a discontinuity in the programmed flight path between the arrival and approach. The flight crew did not select the entry to the approach in the FMC and manually entering the waypoint SCBSG. As the waypoint was manually entered, the 7,500 ft altitude constraint was not included into the FMC programmed flight path. This missing altitude constraint was not detected by the flight crew.
The flight crew entered the altitude of 3,900 ft into the autopilot altitude selector prior to commencing the approach. With the autopilot engaged, the aircraft descended through 7,500 ft prior to commencing the approach at SCBSG. The flight crew did not detect that the aircraft had descended through the 7,500 ft MSA. The approach controller identified the error and alerted the flight crew.
Once established visual with the runway, the flight crew elected to conduct a manually flown visual approach without advising ATC and did not receive a clearance to discontinue the RNAV-Z and conduct a visual approach. The aircraft then descended below the standard profile which led to the aircraft descending below the 5,300 ft SMSA prior to passing SCBSI.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The captain manually entered the waypoint SCBSG into the FMC instead of selecting the RNAV-Z approach via waypoint SCBSG. This removed the 7,500 ft altitude constraint.
The crew did not identify the aircraft had descended below the 7,500 ft minimum sector altitude prior to passing SCBSG.
Prior to passing SCBSI, the flight crew elected to conduct a visual approach without advising air traffic control, the flight crew then descended the aircraft below the 5,300 ft segment minimum safe altitude.
The aircraft was in visual conditions at all times.
Safety message
This incident highlights the importance of preparation and communication prior to commencing a phase of flight. Requesting a preferred clearance early allows ATC to ensure that a clearance can be provided, or if not available, allows the flight crew time to prepare for a different clearance.
The Australian air traffic control provider, Airservices Australia, document: Standard Instrument Arrival Routes (STARS) provides further information to assist flight crew in adhering to clearances when conducting arrivals and approaches.
This incident also underlines the importance of adhering to standard operating procedures (SOPs). By deviating from SOPs and manually entering the waypoint, the crew removed a protection which was in place to prevent data input errors.
The ATSB has identified numerous accidents worldwide that were the result of simple human errors in data calculation or entry.
Data input errors-such as the wrong figure being used as well as data being entered incorrectly, not being updated, or being excluded-happen for many different reasons.
The consequences of these errors can range from rejected take-offs through to collisions with the ground. Errors can occur irrespective of pilot experience, operator, aircraft type, location and take-off performance calculation method.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 12 February 2017, a Boeing 747-47UF (freighter) aircraft, registered N416MC, operating from Honolulu, Hawaii, conducted an approach to Sydney Airport, New South Wales. On board the aircraft were two flight crew. The captain was the pilot monitoring (PM) and the first officer was the pilot flying (PF).[1]
The aircraft was cleared by the approach controller for the runway 16R instrument landing system (ILS) approach.[2] The autopilot was engaged[3] and the modes for localiser and approach (glideslope) were armed[4] while the aircraft was flown at 2,200 ft on a heading of 200° to intercept the 16R ILS. The aircraft captured[5] the localiser and the PF turned it left onto the 16R final approach course, while maintaining 2,200 ft, in order to intercept the glideslope from below.
Shortly after the turn onto the final approach, the PF called ‘glideslope captured’ and the aircraft started to descend. However, the PM’s primary flight display[6] was still showing the aircraft below the glideslope. The PM crosschecked the PF’s display and noticed the glideslope was captured, then checked their own display and noticed there was a failure flag displayed for the glideslope. The PM again crosschecked the PF’s display, noticed there was a failure flag for the PF’s glideslope, and instructed the PF to disconnect the autopilot and stop the descent.
As the aircraft descended through 2,100 ft, the approach controller requested confirmation that they were established on the glideslope. The PM responded that they had an interruption on glideslope and would maintain altitude until they could re-intercept. During the response, a minimum safe altitude warning (MSAW) alert appeared on the approach controller’s radar for N416MC at an altitude of 1,800 ft. The approach controller immediately issued the instruction ‘go-around, you are well below the glide-path, go-around’. The PM immediately acknowledged the instruction, and the flight crew initiated the missed approach procedure.
The lowest point on the approach was 1,559 ft from flight data (1,600 ft on radar) at about 8.0 NM (14.8 km) from runway 16R (Figure 1). This resulted in the aircraft descending about 1,000 ft below the nominal 3° glideslope at the time of the incident. The aircraft was flown on the second approach with autopilot engaged. The localiser and glideslope captured and tracked the ILS with no anomalies detected.
Figure 1: Minimum safe altitude warning for N416MC
Source: Airservices, annotated by the ATSB
ILS signal interference
Disturbances to ILS localiser and glideslope courses are caused by fixed structures, such as buildings (static distortion), and moving vehicles or aircraft (dynamic distortion). The total ILS course distortion is determined by the root square summation of static and dynamic distortion, and this is used to define critical areas[7] near each localiser and glideslope antenna (Figure 2).
Figure 2: Runway 16R glideslope antenna and critical area hold point
Source: Google earth, annotated by the ATSB
The critical areas are protected for low visibility approaches. This is when the cloud ceiling is at or below 600 ft, or the visibility is 2000 m or less. In which case, no aircraft or vehicle is permitted to enter the critical areas when an arriving aircraft is within the outer marker, or 4 NM from the threshold if there is no outer marker.
At the time N416MC intercepted the runway 16R localiser, a Boeing 787 was holding on taxiway A1, within the runway 16R glideslope critical area (Figure 3). However, the weather conditions did not require air traffic control to activate the ILS critical area, and N416MC was instructed to go‑around before reaching the outer marker.[8]
Figure 3: Infringement of the 16R glideslope critical area
Source: Airservices, annotated by the ATSB
Receiver characteristics
A moving receiver passing through a distorted ILS signal will produce a guidance error. The error produced will vary depending on the receiver characteristics, its antenna characteristics and the speed of the vehicle carrying the receiver as it passes through the distorted signal.
Similar incidents
Glideslope signal disturbances
On 17 March 2017, a Boeing 747-400 attempted to intercept the runway 16R ILS in instrument meteorological conditions using the autopilot for a coupled approach.[9] When the glideslope was captured, the indications began to oscillate, and the autopilot chased the indications. A high rate of descent developed and a ‘low on profile’ call was made on the flight deck to stop the descent. The descent was stopped at about 1,500 ft, about 7 NM (13 km) from the threshold of runway 16R. An Airbus A380 was lined up for departure on runway 16R from taxiway A1 when the Boeing 747 was about 8 NM (14.8 km) from the threshold of runway 16R.
On 23 March 2017, a Boeing 747-400 attempted to intercept the runway 16R ILS in instrument meteorological conditions using the autopilot for a coupled approach. Approaching 2,000 ft, the glideslope on the captain’s primary flight display disappeared, followed by the glideslope on the first officer’s primary flight display. The aircraft pitched nose down with an associated increased rate of descent. The captain disengaged the autopilot and stopped the descent at about 1,500 ft and 8 NM (14.8 km) on final for 16R. A minimum safety altitude alert activated, and the approach controller instructed the flight crew to conduct a missed approach. An Airbus A380 was holding on taxiway A1 at the time of the incident. A second approach was flown using the autopilot without incident. There were no aircraft in the glideslope critical area during the second approach.
Localiser signal disturbance
On 27 August 2015, a Boeing 787-800 attempted to conduct an autoland[10] to runway 34L at Sydney Airport in visual meteorological conditions. The aircraft experienced a disturbance to the localiser signal at about 100 ft and the flight crew immediately disconnected the autopilot to complete the landing. The flight crew were aware the ILS critical area was not required to be protected at the time and had not notified air traffic control they were conducting an autoland. They were aware that disturbances to the ILS signals were possible and were prepared to intervene. An Airbus A330 departed directly in front of the 34L localiser antenna at the time of the incident.
Manufacturer comments
Boeing, the aircraft manufacturer, reported that they have no reason to believe that the 747 would behave any differently to their other aircraft types. The same antenna system is installed on the 757, 767 and 777. However, there are some differences in the antenna locations. The 747 and 777 receiver antennas are located on the main landing gear doors, while the 757 and 767 antennas are located in the nose of the aircraft. The glideslope incidents might relate to a varying signal strength, rather than a distorted beam.
Aeronautical Information Publication
If a pilot advises air traffic control that an ‘autoland’ or ‘coupled approach’ is to be flown, then air traffic control will either report ‘ILS critical area not protected’ or ‘LVP[11] in force’ if the critical area is protected.[12]
Airservices Australia comments
Airservices Australia, the air traffic services provider, reported that disturbance of the glideslope signal is less for aircraft at the taxiway A holding point (holding point for glideslope critical area) than it is for the same aircraft at the holding point on taxiway A1. Airservices Australia conducted a computer simulation which indicated that an Airbus A380 aircraft stationary at holding point A1 is unlikely to have caused the large ILS signal disturbance observed in this incident.
The simulations and radar recordings indicated the observed disturbance in each case occurred after the holding aircraft was provided with its line up clearance and while taxiing between the holding point and the runway. In this respect, there will always be significant interference to approaching aircraft outside 4 NM regardless of whether the holding point on taxiway A or A1 is used at the same time as runway 16R is used for arrivals.
Safety analysis
N416MC intercepted the final approach, and the autopilot captured the ILS localiser and glideslope at the same time as a Boeing 787 (B787) was holding on taxiway A1, which lies within the critical area for the runway 16R glideslope. The presence of the 787 in the critical area likely resulted in N416MC receiving either a distorted glideslope beam or a beam of varying signal strength. This required flight crew intervention following a glideslope failure indication, which was detected by the captain crosschecking the two primary flight displays. At the time of the incident, the glideslope critical area was not required to be protected, in accordance with the manual of air traffic services.
ATSB comment
It has been previously noted by regulators and manufacturers, that it is common practice for operators to conduct coupled approaches and autoland to satisfy maintenance, training or reliability program requirements. These approaches may be conducted in weather conditions which do not require protection of the ILS signal. There have been incidents reported in which the autopilot has responded to disturbances in the ILS signal when the aircraft was close to landing. Airservices Australia advise that ILS signals may be disturbed with the consequential effect on autoland performance when weather conditions do not require protection of the ILS critical area.
For more information on ILS signal distortion and determination of protected areas following the introduction of the Airbus A380 see Assessment of ILS protection areas impact on large aircraft operations.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The descent below the nominal 3° approach glideslope was probably the result of the aircraft auto-pilot capturing a distorted glideslope beam.
The glideslope beam was probably distorted due to the presence of a Boeing 787 in the glideslope critical area, which was not required to be protected in the weather conditions which prevailed at the time of the incident.
Safety message
This incident highlights the importance of crosschecks on the flight deck and between air traffic control and the flight crew. After detecting unexpected indications on the flight deck, the flight crew intervened to stop the descent, which was then followed by an instruction from air traffic control to initiate a go-around.
The aircraft manufacturer and regulators have recommended that flight crew remain vigilant for ILS disturbances with resulting unexpected flight control movements and be prepared to immediately disconnect the autopilot, particularly during autoland operations.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 23 September 2016, the ATSB commenced an investigation into the descent below segment minimum safe altitude involving Airbus A330-343X, 9M-XXI, near Gold Coast Airport, Queensland, on 11 September 2016.
The aircraft was cleared to conduct a RNAV-Z (GNSS) instrument approach to runway 14 (Figure 1) at Gold Coast Airport in visual meteorological conditions. During the approach, the aircraft was observed to descend below the 1,700 ft segment minimum safe altitude between the instrument approach’s intermediate fix (OOLNI) and a position 2.5 NM from the final approach fix (OOLNF).
The ATSB interviewed the flight crew and also examined the operator’s policies and procedures for the conduct of the RNAV-Z type approach. The flight crew reported that they had briefed the approach. That briefing included identification that the 2.5 NM position was not included in the aircraft’s navigation data base and that there was a segment minimum safe altitude requirement associated with this position.
The approach was flown using the autoflight system in a managed mode. As the aircraft approached the OOLNI, the aircraft was in a shallow descent and the flight crew commenced configuring the aircraft for landing (Figure 2). At OOLNI the aircraft was fully configured for landing and at a speed of 150 kt. As the aircraft passed through OOLNI, the autopilot pitched the aircraft down. The flight crew attempted to recover the speed through the application of speed brake. However this, coupled with the aircraft pitching down, resulted in an increased rate of descent, which in turn led to the penetration of the 1,700 ft segment minimum safe altitude. The aircraft subsequently returned to its targeted flight profile by OOLNF and continued the approach for landing.
Figure 2: The instrument approach vertical profile
Source: Jeppesen
The Flight Crew Training Manual (FCTM) for the A330 stated that the activation of the approach phase will initiate a deceleration towards the approach speed or a speed constraint inserted into the Final Descent Point (FDP). The FDP was defined as the capture point of the final descent segment coded into the navigation data base. The two approach techniques for the final descent segment were the decelerated approach and the early stabilised approach.
For the decelerated approach, the vertical flight profile was managed by the aircraft’s Flight Management Guidance and Envelope System (FMGES) using data in the aircraft’s navigation database, modified as required by the flight crew. This was described as using the autoflight system in a ‘managed mode’. The deceleration profile targeted having the aircraft at 1,000 ft above the landing point, in the landing configuration and at the approach speed. This profile generally equated to the aircraft being configured with the first stage of flap/slat and at the required speed at the FDP. In the discussion on the use of a managed vertical profile for a non-precision approach, the FCTM noted that for some non-precision approaches, ‘the final approach flies an “idle descent” segment from one altitude constraint to another, followed by a level segment’.
The early stabilised approach technique required the flight crew to have the aircraft in the landing configuration and at the approach speed at the FDP. The final descent segment was then flown using a selected vertical profile mode, such as the Flight Path Angle (FPA) mode.
The ATSB obtained the navigation database used by the FMGES for the RNAV-Z (GNSS) Rwy 14 approach. That database included initial (OOLNI) and final (OOLNF) approach fixes and their associated altitude limits, but did not include the point 2.5 NM from OOLNF and its associated segment minimum safe altitude limitation. The database also included a three degree approach profile from the OOLNF, but did not include a three degree profile before OOLNF.
The operator’s investigation into the occurrence identified that, as the three degree glide path started at OOLNF, the aircraft would conduct a stepped descent between OOLNI and OOLNF. The stepped approach profile was reflected by the autopilot pitching the aircraft down as it passed through OOLNI. In a stepped approach, on passing an altitude constrained position (such as OOLNI), the autopilot will fly an idle descent to the new altitude constraint and then fly level until the completion of that segment. The operator also noted that the step down limitation between OOLNI and OOLNF was not coded into the database due to specific coding rules. In response to the occurrence event, the operator custom coded the RNAV-Z (GNSS) Rwy 14 approach to include a 3 degree slope from OOLNI. The operator also issued a memorandum to all pilots requiring all non-precision approaches into Australia to be conducted using the selected vertical guidance Flight Path Angle mode only. Based on this information, the ATSB determined that it was unlikely that further ATSB investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
On 17 June 2016 at about 0055 Eastern Standard Time, a Boeing 737-376, registered VH-XMO and operated by Express Freighters Australia, departed Melbourne Airport, Victoria, on a freight service to Launceston, Tasmania. After arriving overhead Launceston, the flight crew proceeded to conduct an instrument approach for runway 32L. However, due to adverse weather condition, the crew were unable to land and a missed approach was conducted.
On completion of the missed approach, the captain (CA) initiated a left turn to re-position the aircraft for a second approach. A short time later, while responding to a call from the airport groundsman about the weather conditions, the CA handed control of the aircraft to the first officer (FO).
While the captain instructed the FO to maintain the turn, subsequent manoeuvring had not been discussed. The resultant flight path led to the aircraft entering an area with a minimum permitted altitude of 5,800 ft. While the crew had commenced a climb, the aircraft had not reached that minimum altitude and entered the area at about 4,400 ft. In response, air traffic control issued a safety alert for terrain and instructed the crew to climb the aircraft above the minimum safe altitude.
What the ATSB found
The ATSB found that the instrument approach briefing conducted by the flight crew did not ensure that there was a shared understanding of how the aircraft would be manoeuvred on completion of the published missed approach. That resulted in the aircraft being operated in an area below the prescribed minimum safe altitude.
The ATSB also identified that flight path monitoring and safety alerts issued by air traffic control, provided the flight crew with clear and timely minimum altitude requirements and ensured the aircraft was operated well clear of terrain.
What's been done as a result
In response to this occurrence the operator issued a flight standing order that drew flight crew’s attention to the runway 32L instrument approach procedure’s missed approach and the requirements for subsequent manoeuvring. In addition, the approach briefing requirements were amended to include intentions for manoeuvring following the completion of a published missed approach.
The effective management and manipulation of the aircraft, following a missed approach, was included as a discussion item and exercise in the operator’s recurrent simulator training program.
Safety message
This occurrence highlights the value of having a clear, and where appropriate, shared plan. A common understanding between flight crew prevents additional workload associated with clarifying intentions during busy events, such as during and after missed approaches.
Operators and flight crew should consider including appropriate missed approach considerations, such as intended flight path, crew actions, terrain clearance and air traffic control requirements, into their approach briefings, regardless of the existing environmental conditions.
The occurrence
On 17 June 2016 at about 0055 Eastern Standard Time[1], a Boeing 737-376, registered VH-XMO and operated by Express Freighters Australia, was scheduled to operate a freight service from Melbourne, Victoria, to Launceston, Tasmania. The flight crew consisted of a training captain (CA) as the pilot flying[2] and a first officer (FO) under training as the pilot monitoring. This flight was the FO’s ninth sector operating the B737 aircraft.
The flight crew signed on for duty in Melbourne at about 1910. The duty included a return flight to Sydney, New South Wales, followed by a return flight to Launceston. A review of the weather for the duty indicated relatively benign conditions for Melbourne and Sydney. However, the Launceston forecast included cloud at 1,500 ft above the ground and periods of light rain. A temporary reduction in visibility to 4,000 m and cloud down to 1,000 ft were also forecast, together with heavier rain showers. Those weather conditions required the flight crew to carry an alternate. In this case, the aircraft carried sufficient fuel to operate to Launceston and return to Melbourne.
The flight to Sydney and return was uneventful. Approaching Melbourne, the flight crew obtained a weather update for Launceston. That update forecast cloud at 1,000 ft, reducing temporarily to 500 ft with continuing rain showers. Automated weather observations for Launceston at 0000, recorded visibility of 5,000 m in rain and overcast cloud at 100 ft. While the observed weather conditions were below those required to land, the CA reported that adverse weather conditions at Launceston historically fluctuated.
The flight departed Melbourne for Launceston at about 0055. On board the aircraft was sufficient fuel to operate the flight to Launceston, conduct three instrument approaches and, if required, return to Melbourne. The flight crew continued to monitor the Launceston weather conditions en route. Subsequent automated observations showed little or no improvement to the weather.
Prior to descent, the flight crew conducted an approach briefing for Launceston. That briefing included discussions covering the expected instrument landing system[3] (ILS) approach for runway 32L (Figure 1), and the missed approach should it be required. The operator’s low visibility procedures were also covered. Those procedures required that, approaching the minima, the CA was to scan both the aircraft instruments and outside for the runway. The FO’s primary task was to monitor instruments and the aircraft’s flight path.
Descent was commenced at about 0125. Automated weather observations for Launceston at 0113, recorded visibility of 9,000 m in rain showers and overcast cloud at 200 ft. At about 0131, air traffic control (ATC) advised the crew that, based on the latest automated weather observations, conditions on the ground were, 300 m visibility and overcast cloud at 200 ft. The crew were subsequently cleared to leave controlled airspace on descent and to conduct an instrument approach to runway 32L.
Launceston tower control services were generally available between the hours of 0600 and 2200. As the tower was closed, the controlled Class D airspace below 1,500 ft above mean sea level (AMSL) had reverted to non‑controlled Class G airspace. In the event of a missed approach, the aircraft would re-enter Launceston Class C and D controlled airspace above 1,500 ft AMSL and a clearance would be required prior to any subsequent manoeuvring on completion of the published missed approach.
The aircraft passed overhead Launceston at about 0136. The flight crew then proceeded to descend the aircraft in accordance with the prescribed ILS approach procedure. The minimum altitude for landing of 750 ft (202 ft above the runway threshold) was reached at about 0145. As the crew could not see the runway, a missed approach was conducted.
At about 0147, the aircraft levelled off at the missed approach altitude of 3,200 ft. About 20 seconds later, the CA initiated a left turn by selecting the autopilot heading bug to a south‑westerly heading. The CA’s intention was to continue the left turn and position the aircraft overhead the airport for a second instrument approach. The FO reported being surprised by the turn and immediately thought that they should climb the aircraft.
Figure 1: Launceston instrument landing system approach chart for runway 32L with relevant minimum safe altitudes required for manoeuvring, in instrument meteorological conditions or at night, circled in red.
Source: Airservices Australia modified by the ATSB
After advising ATC that they had conducted a missed approach, ATC asked the crew to confirm that they were on the published missed approach. The flight crew confirmed this and advised ATC that they were turning back towards Launceston. At about the same time, the CA responded to a radio call from the Launceston Airport groundsman and handed control of the aircraft to the FO. While the CA did instruct the FO to keep the turn going, to where, or onto what heading was not discussed.
While the CA was talking to the groundsman about the weather, the FO observed the radio altimeter become active. The radio altimeter provides an indication of aircraft height above the ground up to 2,500 ft. In response to the radio altimeter activation, the FO advised the CA that they should climb the aircraft.
By about 0148, the aircraft was turning left through a heading of 140 degrees and climbing through 3,900 ft. The aircraft was also approaching the boundary of the 3,200 ft minimum sector altitude[4] (MSA). At about the same time, ATC asked the crew to confirm that they would be remaining within the 3,200 ft sector and advised that otherwise they needed to be at 5,800 ft. The crew responded by advising they were climbing to 5,800 ft.
The aircraft subsequently entered the 5,800 ft MSA sector at about 4,400 ft, on a steady heading of about 110 degrees, and about 3.5 NM (6.5 km) southwest of the airport. As the aircraft was below the required MSA, ATC issued a safety alert for terrain and instructed the crew to climb immediately to 5,800 ft.
In response, at about 0149, the crew advised ATC that they were climbing to 6,000 ft. ATC acknowledged the call and asked the crew if they would be entering the holding pattern overhead Launceston. The crew reported that they were maintaining 6,000 ft and asked ATC to standby.
At about 0150, the aircraft was in a left turn, maintaining 6,000 ft and about 5 NM (9 km) to the southeast of the airport. ATC advised the crew that they were about to enter an area with a higher MSA and to climb immediately to 6,300 ft or higher. The crew acknowledge the altitude requirement and advised ATC that they would be returning to Melbourne. A short time later, as the aircraft had not yet reached 6,300 ft, ATC reissued the instruction to climb immediately to 6,300 ft.
The aircraft was subsequently cleared to climb to its cruise altitude and returned to Melbourne.
Flight below the minimum sector altitude (MSA) occurred following a missed approach that was conducted due to poor weather conditions. While the flight crew assessed that the safety of the aircraft was never in doubt, there was confusion as to how the aircraft was to be manoeuvred on completion of the missed approach.
This analysis will examine the aircraft’s flight path following the missed approach, and factors that contributed to the flight below MSA.
Prior to commencing descent, the crew conducted a normal approach briefing. The prevailing weather conditions at Launceston airport were such that the flight crew were required to conduct an instrument landing system (ILS) approach. The weather conditions also meant that it was reasonably foreseeable that they would need to conduct a missed approach. While an instrument approach briefing was conducted prior to descent, and covered the standard components including the missed approach segment, there was no discussion of how the aircraft would be subsequently manoeuvred.
A missed approach following an ILS approach is not common as the associated low weather minima usually permits the landing to be completed. As such, planning how the aircraft is to be manoeuvred in the event of a missed approach may not always be considered in detail. Additionally, tracking and altitude requirements following a missed approach are often provided by air traffic control (ATC), particularly in the case of larger commercial aircraft such as VH‑XMO.
Additionally, with the exception of situations such as simulator training, missed approaches are often unexpected. Consequently, the safe conduct of a go‑around and subsequent manoeuvring relies on a shared appreciation to avoid the need to clarify intentions during an already busy period. Irrespective of the weather conditions, a thorough go‑around briefing, that gives consideration to factors such as initial and subsequent flight paths, crew actions and co‑ordination, terrain clearance and ATC requirements, offers an effective means of ensuring that a common appreciation exists.
Although air traffic control (ATC) services were available en route and during descent, Launceston Tower was closed when the aircraft arrived. Consequently, the normally tower‑controlled Class D airspace below 1,500 ft became non-controlled Class G airspace. This meant that, in the event of a missed approach, the aircraft would re-enter Launceston Class C and D controlled airspace at 1,500 ft and an ATC clearance would be required prior to manoeuvring beyond the published missed approach.
The approach and missed approach flight paths were aligned to enable the aircraft to descend and climb clear of terrain. The missed approach path positioned the aircraft within a sector that had an MSA of 3,200 ft. Any manoeuvring outside of that sector required the crew to climb the aircraft to the relevant sector MSA prior to entry. In this case, the left turn was towards a sector that had an MSA of 5,800 ft. Alternatively, climbing straight ahead on the missed approach track to 5,800 ft would have enabled the crew to manoeuvre the aircraft as required within 10 NM (19 km) of the airport.
On completion of the missed approach, the captain commenced a left turn with the intention of positioning the aircraft for a second approach. While a continuous left turn may have maintained the aircraft within the 3,200 ft sector, this manoeuvre had not been discussed during the approach briefing. As a result, when the CA handed control of the aircraft to the FO, the left turn was stopped on a south-easterly heading.
The south-easterly flight path resulted in the aircraft tracking towards a sector with a MSA of 5,800 ft while at an altitude of 3,200 ft. Although the crew had commenced a climb, the aircraft had only achieved an altitude of 4,400 ft when it entered the 5,800 ft sector. As a result, ATC issued a safety alert for terrain proximity. ATC also issued instructions for an immediate climb to 5,800 ft and later, to 6,300 ft.
Although the aircraft was never in immediate danger of colliding with terrain, it was operated over an area and at an altitude less than that prescribed for safe flight. Had the required clearance been obtained prior to manoeuvring, ATC would have provided the crew with appropriate tracking and altitude requirements. Additionally, without the flight path monitoring and timely altitude alerts provided by ATC, the risk of collision with terrain may have increased.
Had the approach briefing included a discussion about subsequent manoeuvring, both crew members would have had a shared understanding of the expected flight path. Such a discussion would have provided the crew with an opportunity to discuss alternative tracking, minimum safe altitude requirements, and the need to obtain a clearance.
Findings
From the evidence available, the following findings are made with respect to the flight below lowest safe altitude involving Boeing 737, registered VH-XMO at Launceston Airport, Tasmania on 17 June 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The instrument approach briefing conducted by the flight crew did not ensure there was a shared understanding of how the aircraft would be manoeuvred following completion of the published missed approach.
The absence of an established, and shared, manoeuvring plan, resulted in the aircraft being operated in an area below the prescribed minimum safe altitude.
On completion of the missed approach, the flight crew did not obtain an onwards airways clearance prior to further manoeuvring. That negated the terrain clearance assurance that would otherwise have been provided and increased the risk of conflict with other aircraft.
Other findings
The flight path monitoring and safety alerts issued by air traffic control, provided the flight crew with clear and timely minimum altitude requirements and ensured the aircraft was operated well clear of terrain.
Safety issues and actions
Proactive safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
The aircraft operator, Express Freighter Australia, has made the following amendments to their training and procedures:
A flight standing order was issued that drew flight crew’s attention to the runway 32L instrument approach procedure’s missed approach and the requirements for subsequent manoeuvring.
The approach briefing requirements were amended to include intentions for manoeuvring following the completion of a published missed approach.
A ‘Hot Topic’ discussion item – post missed approach manoeuvring and management, was added to the recurrent simulator training program.
The recurrent simulator training program, released in December 2016, included exercises that reinforce the enhanced arrival and approach briefing requirements. Crews were required to demonstrate appropriate inflight management and manipulation subsequent to completion of a published missed approach.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
flight crew
aircraft operator
Airservices Australia.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew and operator of VH-XMO, Airservices Australia and the Civil Aviation Safety Authority (CASA).
Submissions were received from CASA and the aircraft operator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the evening of 19 February 2016, an Airbus A320 aircraft, registered PK-AXY and operated by PT Indonesia AirAsia was on a scheduled passenger service from Denpasar, Indonesia to Perth, Australia. During cruise, the captain’s flight management and guidance computer (FMGC1) failed. Due to the failure, the flight crew elected to use the first officer’s duplicate systems. For the aircraft’s arrival in Perth there was moderate to severe turbulence forecast below 3,000 ft with reports of windshear. The crew commenced an instrument landing system (ILS) approach to runway 21.
During the approach, the flight crew made a number of flight mode changes and autopilot selections, normal for an ILS approach with all aircraft operating systems available. However, some of those flight modes and autopilot selections relied on data from the failed FMGC1 and the autothrust system commanded increased engine thrust. The crew did not expect this engine response and elected to conduct a go-around. With an increasing crosswind on runway 21, the crew accepted a change of runway, to conduct a non-precision instrument approach to runway 06.
With the time available, the first officer programmed the new approach into his FMGC and conducted the approach briefing. During this period, the captain hand flew the aircraft and manually controlled the thrust. During the approach to runway 06, the crew descended the aircraft earlier than normal, but believed that they were on the correct flight path profile.
While descending, both flight crew became concerned that they could not visually identify the runway, and focused their attention outside the aircraft. At about that time, the approach controller received a “below minimum safe altitude” warning for the aircraft. The controller alerted the crew of their low altitude and instructed them to conduct a go-around. The crew then conducted another approach to runway 06 and landed.
What the ATSB found
The ATSB identified that the flight crew were unsuccessful in resolving the failure of the FMGC and had a limited understanding of how the failure affected the aircraft’s automation during the ILS approach. This resulted in the unexpected increase in engine thrust, which prompted a go-around.
The flight crew had a significant increase in workload due to the unresolved system failures, the conduct of a go-around and subsequent runway change. This, combined with the crew’s unfamiliarity and preparation for the runway 06 instrument approach, meant they did not effectively manage the descent during that approach.
The flight crew’s focus of attention outside the aircraft distracted them during a critical stage of flight. The crew did not detect that they had descended the aircraft below the specified segment minimum safe altitude.
The flight crew commenced their descent for the second runway 06 instrument approach later than normal, initially necessitating an increased rate of descent and at 300 ft the engine thrust reduced briefly to idle.
Safety message
Handling of approach to land is one of the ATSB’s SafetyWatch priorities. Unexpected events during the approach and landing can substantially increase what is often a high workload period. Adherence to standard operating procedures and correctly monitoring the aircraft and approach parameters provides assurance that the instrument approach can be safely completed. A go-around should be immediately carried out if the approach becomes unstable or the landing runway cannot be identified from the minimum descent altitude or missed approach point.
The occurrence
On the evening of 19 February 2016, an Airbus A320 aircraft, registered PK-AXY and operated by PT Indonesia AirAsia was on a scheduled passenger service from Denpasar, Indonesia to Perth, Australia. The aircraft was operated by two flight crew, four cabin crew and carried 96 passengers.
For the flight to Perth, the captain was the pilot flying (PF), with the first officer the pilot monitoring (PM).[1] A late requirement to change aircraft delayed the departure of the flight by 2 hours and the updated arrival time into Perth was estimated to be about 2130 Australian Western Standard Time.[2]
Departure and cruise
On departure from Denpasar Airport, the aircraft climbed to the cruise altitude of FL 370.[3] The flight proceeded normally until the aircraft was just over an hour from Perth when, at approximately 2024, the crew noticed that the captain’s multipurpose control and display unit (MCDU1)[4] had frozen and the captain’s navigation display (ND)[5] had the advisory message MAP NOT AVAIL. In addition, the first officer’s MCDU (MCDU2) displayed the message INDEPENDENT OPERATION, which indicated to the crew that the captain’s flight management and guidance computer (FMGC1)[6] had failed. Figure 1 depicts the location and interaction between the various equipment.
Figure 1: Schematic of A320 cockpit, depicting the location and interaction between various equipment
Source: Airbus Flight Crew Operating Manual
At the time of the FMGC1 failure, flight data indicated the aircraft was flying at a calibrated airspeed of 253 kt. A short time later, the captain recalled disengaging autopilot 1 (AP1)[7] and engaging autopilot 2 (AP2).
The flight crew reported that in an attempt to resolve the issues associated with the frozen MCDU1 screen and apparent FMGC1 failure, they referred to the Quick Reference Handbook (QRH) and the Flight Crew Operating Manual (FCOM) but they determined that there was no specific action for the failures. Instead, as the first officer’s FMGC (FMGC2) appeared to be operating normally, they decided to continue to Perth using his ND and MCDU, because these utilised the functioning FMGC. At 2040, about 15 minutes after the failure occurred, the crew climbed the aircraft to FL 380. The remaining 30 minutes of the cruise was uneventful.
Pre-descent planning and approach
Prior to the descent, the flight crew reviewed and briefed the approach altitude minima, planned arrival route, weather, go-around procedures, as well as conducting other normal pre-descent activities. For the aircraft’s arrival in Perth, moderate to severe turbulence was forecast below 3,000 ft, with visibility greater than 10 km and no significant cloud below 5,000 ft. As the crew had not identified any specific procedure for managing the FMGC failure, and the first officer’s duplicate systems appeared to be operating normally, his MCDU was used to program the arrival procedure and instrument landing system (ILS)[8] approach. The crew briefed that the first officer would take over as PF during the approach, as they believed it was better for the PF to have the functioning ND and MCDU.[9] The crew later reported that they did not identify or conduct further investigation to determine how the FMGC failure may affect continued flight operation or the conduct of the approach.
At about 2115, the flight crew commenced descent into Perth to conduct the JULIM 2A standard instrument arrival[10] and ILS approach to runway 21.[11] As the aircraft descended through 9,000 ft, the captain took over the role of PM while the first officer became PF.
The flight crew selected managed lateral and vertical descent modes[12] with AP2 selected. At about 2140 while descending through 5,000 ft, the crew received the first of three speed restrictions from air traffic control (ATC), which required a change from a managed speed mode to a selected speed mode,[13] to control the aircraft’s speed.
At about 2143, with the approach mode armed, the flight crew engaged AP1 and received a CAB PR LDG ELEV warning.[14] The warning was a result of engaging AP1 with an inoperative FMGC1.[15] This was because with both autopilots engaged, FMGC1 took precedence over FMGC2. The data programmed into FMGC1 at that time did not include the landing and approach data required for the aircraft’s flight management system to determine the cabin’s pressurisation schedule for the descent and landing. To resolve the cabin pressure warning, the crew set the cabin pressure to manual and continued the approach.
ILS approach to runway 21 and go-around
See Figure 2 for a profile view of the runway 21 ILS approach. At about 2144, the aircraft intercepted the localiser and the glideslope for the runway 21 ILS (Appendix A contains the aircraft track overlaid on the approach chart along with the flight data for the approach). At 2144:38, after reducing the aircraft’s selected speed to 160 kt and establishing the aircraft on the ILS, the selected altitude on the flight control unit (FCU)[16] was set to the go-around altitude, consistent with the operator’s standard operating procedure. A short time later, the flight crew elected to select a managed speed mode. This change resulted in the auto flight system attempting to capture the speed target contained in FMGC1 when it failed (which was 253 kt) and the autothrust system commanded an increase in engine thrust.
The flight crew recognised the increasing engine thrust and airspeed but they did not understand why it occurred. The captain told the first officer, ‘make a go-around’[17] and then advised ATC that they were conducting a go-around. From 2144:57, there was a period of 25 seconds where dual sidestick control inputs occurred. During this time, the autopilot automatically disengaged and the captain disconnected the autothrust system.[18] The recorded data indicated that neither the captain nor first officer pressed the priority takeover button[19] during this period. The captain recalled that at about 2,500 ft, at the flap 0 speed, he stated ‘okay, my control’ and took over as PF with the first officer taking the PM responsibilities. Recorded data indicates the captain had sole control of the aircraft at 2145:24, at an altitude of about 2,500 ft.
Figure 2: Profile view of the runway 21 ILS approach with aircraft flight profile (blue). The aircraft was on the ILS profile until the increase in engine thrust and go-around
Source: Naviga (modified by the ATSB)
After the go-around and vectoring for the runway 06 VOR approach
After taking control of the aircraft, the captain reconnected the autopilot and autothrust. The recorded flight data indicates that the AP1 was engaged for 12 seconds, with the autothrust engaged and active for 10 seconds. The captain then decided to disconnect the autothrust to manually fly the aircraft, due to his uncertainty over the thrust increase during the previous approach and failure of FMGC1. The recorded data indicates that when the autothrust was disconnected the thrust lever was below the climb detent. This positioning of the thrust lever meant that it was unlikely the flight crew received a thrust lock (further information is provided in the Autothrust system sub-section in the Context).
At 2146, the first officer requested ATC provide radar vectors for another ILS approach to runway 21. ATC provided radar vectoring and issued clearance for the approach. However, about 4 minutes later, ATC advised the flight crew that the crosswind for runway 21 had increased to 22 kt, with gusts to 25 kt. Due to the increased crosswind, ATC offered the crew the option of conducting a VHF Omni Directional Radio Range (VOR)[20] approach and landing on runway 06.[21] At 2152, after confirming the crew’s preference to land on runway 06, ATC vectored them to the final approach track to conduct the VOR approach.[22] The captain considered there was sufficient time to prepare for the approach, so did not perceive a need to enter a holding pattern to complete the briefing. At 2156, ATC informed the crew that a new ATIS was current and that there was moderate to severe turbulence below 3,000 ft.
The first officer later recalled programming FMGC2 for the VOR approach, and briefing the captain for the approach. The first officer also cross-referenced the information in the FMGC with his paper copy of the instrument approach chart. The captain stated that they conducted a short briefing instead of a full briefing because the situation was moving so quickly.
VOR approach to runway 06 and subsequent go-around
At 2200, ATC asked the flight crew twice if they were established on the 248 radial (which was the inbound track for the VOR procedure) and the first officer responded that they were 10 NM from the runway. ATC again asked the crew to confirm they were established, and the first officer replied stating, that they were ‘established on the inbound radial 068’.[23] In response, ATC cleared the crew to conduct a VOR runway 06 approach, with 10 NM to touchdown. Shortly after, the captain recalled the first officer asking, ‘do we descend now captain?’ In response, captain initiated a descent from 2,500 ft when the aircraft was at 9 DME[24] (Figure 3). Soon after, the landing gear was extended and the first officer selected 1,600 ft on the FCU for the next descent altitude limit. However, the operator’s Flight Crew Training Manual (FCTM) required that the go-around altitude be set on the FCU when established on final approach.[25] Coincidentally, 1,600 ft was the corresponding segment minimum safe altitude for the runway 03 VOR approach, whereas the published altitude for that stage of the runway 06 approach was 1,900 ft.
The captain elected to continue manually flying the aircraft using his primary flight display (PFD) and the first officer’s ND, and manually controlling the engine thrust due to the apparent automation failures. The first officer continued to monitor the descent gradient and vertical speed, and later recalled believing that they were on the correct descent profile. However, for most of the descent, the aircraft’s rate of descent exceeded the recommended rate (700 ft/min) that was published on the approach chart for the aircraft’s groundspeed. The maximum recorded rate of descent briefly reached 1,550 ft/min.
As the approach continued, the flight crew became concerned that they could not see the runway, and both crew became focused on locating the runway. The first officer later reported that because of this, he was no longer monitoring the approach segment minimum safe altitude constraint or was aware of the aircraft’s below flight path deviation during the descent. Although the FCU altitude was set to 1,600 ft, the autopilots were not engaged and the aircraft descended through the selected altitude without capturing the target altitude.
To assist in locating the runway, the first officer asked ATC if they were on the ‘left side of the runway or right side of the runway’. At about the same time, the ATC radar displayed a minimum safe altitude warning (MSAW). In response, the approach controller instructed the flight crew to ‘go round, you are low, low altitude alert, go round’. The flight crew acknowledged the alert and immediately conducted a missed approach. The aircraft had descended to an altitude of 1,473 ft, before the climb was initiated, which was about 400 ft below the segment minimum safe altitude (Figure 3). Aircraft track and flight data for the approach is available in Appendix B.
Figure 3: Profile view of first runway 06 VOR approach with aircraft flight profile (blue). The flight profile shows the crew descending the aircraft below the 2,500 ft segment minimum safe altitude and continuing below the 1,900 ft segment minimum safe altitude before conducting a go-around.
Source: Naviga (modified by the ATSB)
Preparation and conduct of the second runway 06 VOR approach
After completing the go around, ATC radar vectored the flight crew for another VOR approach for runway 06. At around 2204, while the aircraft was being radar vectored, the captain requested that the first officer take over as PF so he could review the approach chart.
At about 2208, the flight crew engaged the autothrust. It remained engaged and active for about 4 minutes, before the FCU autothrust pushbutton was pressed at 2212 and the thrust lock became active until the thrust levers were moved from the climb detent.[26] The crew re-engaged the autothrust about a minute later, and it remained active for 25 seconds before being disengaged, again via the FCU autothrust push button and resulting in a second thrust lock. The crew again moved the thrust levers clearing the thrust lock warning. The crew did not re-engage the autothrust for the remainder of the flight.
During the second VOR approach while the first officer was the PF, there were four occasions where the captain made sidestick control inputs. These inputs were between 2 and 3 seconds in duration and the recorded data indicates that they were not sufficiently large to activate the dual input alert. Neither of the flight crew could recall why the dual inputs occurred.
At about 2212, the captain requested ATC turn on the high intensity lighting on runway 06 as they were still having difficulty seeing the runway. ATC responded that there were no high intensity runway lights for that runway. At 2214, when the aircraft was at an altitude of 2,500 ft, inbound on the final approach track of the VOR and at about 8 DME, the captain took over as PF and the first officer resumed the PM role. At about the same time, ATC asked the crew if they had the runway in sight and informed them that the tower had increased the runway lighting intensity. Approaching 6 DME, the flight crew selected the FCU altitude to the minimum descent altitude for the VOR approach, again contrary to the operator’s procedure for conducting a non-precision instrument approach. The captain confirmed to ATC that the runway was in sight, and at about 5 DME, initiated descent from 2,500 ft to land on runway 06 (see Figure 4 for the profile view of their second approach to runway 06).
Due to the late commencement of the descent from 2,500 ft, the aircraft exceeded the recommended rate of descent (700 ft/min) for the aircraft’s groundspeed until 1,100 ft above the height of the runway threshold. In addition, the aircraft’s rate of descent was greater than 1,200 ft/min[27] for a period of 40 seconds, from an altitude of about 2,100 ft to 1,200 ft. In this period, the rate of descent averaged 1,380 ft/min. When the aircraft was 1,000 ft above the height of the runway threshold, the rate of descent was below 700 ft/min. For a period of 22 seconds, from 430 ft to 120 ft above ground level (AGL), the aircraft’s vertical speed exceeded 700 ft/min and increased to a maximum of 1,100 ft/min. As this decent rate was below 1,200 ft/min, it did not require a callout by the first officer. At 300 ft AGL, the engine thrust reduced briefly to idle and at this point, the aircraft did not meet the stabilised approach criteria. Aircraft track and flight data for the approach is available in Appendix C.
Recorded flight data indicated dual sidestick control inputs occurred, one at 300 ft AGL for one second, then three times from 120 ft AGL until landing with durations of 3 to 5 seconds, these inputs would have resulted in a dual control input alert. However, the aircraft landed without further incident.
Figure 4: Profile view of second runway 06 VOR approach with aircraft flight profile (blue)
The captain was an Indonesian national and held an Indonesian Airline Transport Pilot Licence (ATPL) and had accumulated about 13,500 hours of aeronautical experience. Of these, about 9,250 hours were in command and about 5,200 hours were on the A320. The captain reported flying into Perth 3 to 4 times a month (including a night approach on 13 February 2016), and conducting a VHF Omni Directional Radio Range (VOR) approach on runway 06 previously, although not often. The captain had conducted a VOR approach on 18 February, the day prior to the occurrence and reported that he regularly conducted non-precision VOR approaches into his home port of Denpasar.
The captain’s proficiency check records indicated that during the 6-month period prior to the occurrence he had successfully completed a non‑precision approach during his cyclic simulator training. His training record for September 2015 recorded competency with managing a flight management and guidance computer (FMGC) or instrument failure. The captain had been assessed as meeting the requirements of the International Civil Aviation Organization (ICAO) English language proficiency[28] at a level 4 standard.
The captain held the relevant Indonesian Certificate of Medical, First Class. That certificate required the pilot to wear corrective lenses for vision.
The first officer
The first officer, a Japanese national, held an Indonesian Commercial Pilot (Aeroplane) Licence (CPL) and had accumulated about 4,200 hours of aeronautical experience, with approximately 3,100 hours on the A320. The first officer had flown into Perth previously, but the occurrence flight was the first time he had conducted an approach into Perth at night, and it was his first runway 06 VOR approach. The first officer had conducted a VOR approach on the day prior to the incident and reported that he regularly conducted VOR approaches into Denpasar.
The first officer’s proficiency check records indicated that during the 6-month period prior to the occurrence he had successfully completed a non‑precision approach during his cyclic simulator training, including a non-precision approach and landing. The first officer had been assessed as meeting the requirements of the ICAO English language proficiency at a level 5 standard.
The first officer held the relevant Indonesian Certificate of Medical, First Class. That certificate required the pilot to wear lenses that correct for distance vision and possess glasses that correct for near vision.
Fatigue considerations
The flight crew reported feeling alert during the approaches. The ATSB reviewed their flight and duty times and 72-hour history prior to the occurrence, and found no evidence that they were likely to be affected by fatigue at the time of the incident.
Approach speed
The approach speed (VAPP) was computed for the crew by the flight management guidance computer (FMGC) and was based on the aircraft’s stall speed in the selected landing configuration, plus one third of the headwind component calculated from the airport wind entered by the flight crew into the FMGC.[29]
When operating in managed speed mode and to assist with maintaining the energy state of the aircraft in changing wind conditions, the FMGC also continuously calculated a target speed that took into account the instantaneous wind being experienced by the aircraft. That resulted in the target airspeed displayed to the crew on their primary flight displays increasing with strengthening headwind gusts and decreasing with weakening headwind or tailwind gusts (but not below VAPP). If the wind entered by the crew into the FMGC was the same as the instantaneous wind, then the target speed would be VAPP.
For the non-precision approaches to runway 06, the crew were operating the aircraft without the autopilot, autothrust engaged and consequently, were in selected speed mode, and the target speed displayed to the flight crew was VAPP.
Weather
At the time of the approaches, moderate to severe turbulence was forecast below 3,000 ft and ATC had received reports of windshear below 1,600 ft (see Table 1).
Table 1: Actual weather conditions as reported by successive ATIS reports at around the time of the flight by PK-AXY
Moderate to severe turbulence reported below 3,000 ft
B737 reported moderate undershoot and overshoot windshear below 1,600 ft on final approach, runway 21 at 1330
Moderate to severe turbulence reported below 3,000 ft
Windshear warning
Moderate to severe turbulence reported below 3,000 ft
Analysis of the recorded information confirmed that turbulent conditions existed in the vicinity of Perth Airport at the time of the aircraft’s arrival. However, there were no activations of the aircraft’s windshear warning system[31] nor activation of the aircraft’s low-speed flight envelope protection systems.
Airport beacon and runway 06 lighting
The control tower at Perth Airport was equipped with a rotating aerodrome beacon, used to indicate the location of the airport from the air. The beacon alternated between a white and green flashing light, once every 6 seconds.
Runway 06/24 was equipped with high intensity runway lighting, selectable by the tower controller to six stages of intensity. It was also equipped with medium intensity runway lighting, selectable to three stages of intensity. There was no high intensity approach lighting for runway 06 or other lighting[32] to assist pilots identify the runway threshold, and nor was such lighting required. The high intensity runway lighting was selected to stage six (maximum intensity) for the crew’s second approach to runway 06.
Flight management guidance system failure
During the cruise, the flight crew received a red text message on the captain’s blank navigation display (ND) stating MAP NOT AVAIL and the first officer’s multipurpose control and display unit (MCDU2) displayed INDEPENDENT OPERATION. The captain’s ND remained inoperative, with the MAP NOT AVAIL message for the remainder of the flight.
The operator’s Flight Crew Operating Manual (FCOM) indicated that a ND may display a MAP NOT AVAIL message for several reasons:
The MODE CHANGE or RANGE CHANGE message has been displayed more than 6 seconds, or
The FMGC has failed, or
The FMGC has delivered an invalid aircraft position.
The MCDU may display an INDEPENDENT OPERATION message when the FMGCs operate independently of each other. In this case, the flight directors (FD) will also operate independently from one another, with the captain’s FD receiving data from FMGC1. The flight crew had access to the aircraft’s Quick Reference Handbook (QRH) and FCOM during flight. These documents were available for the crew to reference in the event of an aircraft system issue, such as a flight management guidance system (FMGS) failure.
Quick reference handbook
Within the ‘Abnormal and emergency procedures’ section of the QRH, under auto flight there is only one listed procedure, ‘Loss of FMS Data in Descent / Approach (Severe Reset)’. This procedure would not have been relevant at the time of the failure, as it occurred during cruise. However, the computer reset table located in the ‘Miscellaneous procedures’ section was relevant. The crew could not explain why they were unable to locate the relevant information.
The Airbus A320 QRH included a procedure to address one locked or blank MCDU, and another for both MCDUs locked (or blank) or FMGC malfunction. The inflight procedure for one locked/blank MCDU was to ‘Pull the CB [circuit breaker] for the locked or blank MCDU and push it back after 10 s[econds]’. The QRH procedure for both MCDU’s locked / FMGC malfunction was:
Short FMGC Reset: …
In flight:
‐ FD 1(or 2) (OFF)
‐ Pull the CB [circuit breaker] of the affected FMGC
‐ Reset it after 10 s[econds].
Long FMGC Reset: …
In flight:
‐ FD 1(or 2) (OFF)
‐ Pull the CB of the affected FMGC
‐ Reset it after 15 min[utes].
Note: Consider a long FMGC reset only if a short FMGC reset has no effect.
In this instance, the crew recognised that the frozen MCDU1 screen and other system indications suggested a FMGC failure, but conducted neither procedure.
Flight crew operating manual
The FCOM contained a number of different types of FMGS failures and related procedures. These were located in the Procedures section, under ‘Supplementary Procedures’. The table of contents for the supplementary procedures contained a section on auto flight with a subsection related to ‘FMGS Reset and Other Abnormal procedures’. The crew could not explain why they were unable to locate the relevant information.
The failure mode that most closely represented the messages the crew received, related to one flight management system (FMS) failing and latching, but with the FMS continuing to send valid but frozen guidance targets, corresponding to the last valid targets sent before the FMS failed. With this type of failure, the autopilot and FD on the affected side may remain available, and the failed FMGC continues to guide the aircraft using the frozen targets. The FCOM stated that the procedure for this failure is to:
DISREGARD the information coming from the failed side
DO NOT USE the AP [autopilot] on the affected side
- If the AP is engaged on the affected side:
FLY the aircraft back on the intended path
ENGAGE the AP on the operative side, according to the Recommended Practice for
Autopilot Engagement (Refer to FCTM/OP-030 Autopilot/Flight Director)
- If time permits:
PERFORM a long reset of the failed FMGC
Refer to PRO-SUP-22-10 Manual FMGS Reset - Manual Reset of One FMGC
- If the failure affects FMGC1, and if the FMGC1 is still failed and latched before the approach:
DO NOT USE AP1 for the approach
- Before disconnecting AP2:
REVERT to selected speed
DISCONNECT A/THR [autothrust]
Note: It prevents the A/THR from switching to the frozen speed target of the failed FMGC1 when the flight crew disconnects the AP2 for landing.
Dual control inputs on the sidestick
On the A320, each pilot has a sidestick that they can use to manually control the pitch and roll attitude of the aircraft. When the autopilot is engaged, the sidesticks are locked in the neutral position. If a pilot applies a force above a specific threshold, the sidestick becomes free and the autopilot disengages.
The handgrip on the sidestick contains a takeover push button. This button can be used to disconnect the autopilot or takeover from the opposite sidestick.
When the pilots move both sidesticks simultaneously, neither takes priority, and instead the system adds the signals of both sidesticks, with the total limited to the maximum deflection of a single sidestick. If there is a simultaneous deflection of both sidesticks, with a 2º off-neutral deflection, the two green ‘sidestick priority’ lights in the instrument panel’s glareshield illuminate and there will be a ‘dual input’ voice message.
Either pilot can deactivate the other sidestick and take full control by pressing and holding down the priority takeover pushbutton. If the takeover pushbutton is depressed for 40 seconds, the other sidestick is deactivated. It can be reactivated by momentarily pressing the pushbutton of either sidestick.
There was no record of either the captain or the first officer pushing the priority takeover pushbutton during the ILS approach, go-arounds, or during the remainder of the flight.
Handover/takeover procedures
To transfer controls the FCOM stated that the crewmembers must use the following callouts:
‐ To give control: The pilot calls out “YOU HAVE CONTROL”. The other pilot accepts this transfer by calling out “I HAVE CONTROL”, before assuming PF duties.
‐ To take control: The pilot calls out “I HAVE CONTROL”. The other pilot accepts this transfer by calling out “YOU HAVE CONTROL”, before assuming PM duties.
In addition, the Flight Crew Training Manual (FCTM) stated that ‘If the PM (or Instructor) needs to take over, the PM must press the sidestick takeover pushbutton, and announce: “I have control”.’
Types of dual control inputs
Airbus has analysed dual sidestick input events that have been reported to them. In Safety First, The Airbus Safety Magazine (December 2006), Airbus reports that they have found that there are three types of occurrences:
The “Spurious” Dual Stick inputs
Typically due to an inadvertent movement of the stick by the PNF [PM].
For example when grabbing the FCOM or when pressing the R/T [radio].
A spurious dual stick input only marginally affects the aircraft behavior due to only time limited & small inputs.
The “Comfort” Dual Stick inputs
Typically due to short interventions from the PNF [PM] who wants to improve the aircraft’s attitude or trajectory:
These are generally experienced in approach, during a capture (altitude localizer), or in flare, and have minor effects on the aircraft’s altitude/trajectory.
However, as the PF is not aware of the PNF’s [PM] interventions, he may be disturbed and may counteract the PNF’s [PM] inputs.
The “Instinctive” Dual Stick Inputs
Typically due to a “reflex” action on the part of the PNF [PM] on the stick. This instinctive reaction may come about when an unexpected event occurs, like for example an AP disengagement, an overspeed situation or a dangerous maneuver.
Such interventions are more significant in terms of stick deflection and duration. Usually in such situations, both pilots push the stick in the same direction, which may lead to over control, a situation illustrated by the above occurrence.
Autothrust system
Autothrust can be activated when the thrust levers are in the climb detent and the flight crew press the autothrust pushbutton on the flight control unit (FCU). When active the autothrust controls either airspeed or engine thrust as appropriate.
instinctive disconnect button on the thrust lever is pressed
both thrust levers are set to idle.
The thrust lock function is activated when the thrust levers are in the climb detent and either of the flight crew pushes the autothrust pushbutton on the FCU, or the autothrust disconnects due to a failure. When this occurs, the thrust is locked at its level prior to disconnection. Moving the thrust levers out of the climb detent suppresses the thrust lock and associated warnings and gives the crew manual control with the thrust levers.
When the thrust lock function is active:
THR LK flashes amber on the flight mode annunciator (FMA)
electronic centralised aircraft monitor (ECAM) displays ENG THRUST LOCKED and this message flashes every 5 seconds
ECAM displays THR LEVERS …... MOVE
A single chime sounds and the master caution light flashes every 5 seconds.
Stabilised approach criteria
The FCOM specified that in visual conditions the approach should be stabilised at 500 ft above ground level (AGL). In order to be stabilised all of the following conditions had to be verified and meet at the stabilisation height:
the aircraft is on the correct lateral and vertical flight path
the aircraft is in the desired landing configuration
the thrust is stabilised, usually above idle, in order to maintain the target approach speed along the desired final approach path
there is no excessive flight parameter deviation.
If the aircraft was not stabilised by 500 ft AGL in visual conditions the crew were required to conduct a go-around, unless the flight crew estimated that only small corrections were necessary to rectify minor deviations from stabilised conditions due, amongst others, to external perturbations.
Non-precision instrument approach
The Flight Crew Training Manual (FCTM) indicated that the overall strategy for conducting a non-precision instrument approach was to fly it ‘ILS alike’ with the same mental image or representation and similar procedure. The use of autopilot was recommended for all non-precision approaches as it reduced flight crew workload and facilitated monitoring of the procedure and the aircraft’s flight path. If the flight crew correctly programmed the FMGC, the autopilot and FD would ensure lateral and vertical managed guidance was available to conduct the approach.
Depending on whether the autopilot was being used, the PF either monitored the progress of the approach or provided the manual inputs to manage the aircraft’s lateral and vertical navigation, normally using the guidance targets displayed on the FD. In addition, the FCTM indicated that when conducting a non-precision instrument approach, the PF ‘should expand the instrument scan to include outside visual cues’ as the aircraft approached the minimum descent altitude.
The operator’s FCTM stipulated setting the go-around altitude on the FCU when the aircraft was established on final approach and if in a selected mode, the current aircraft altitude was below the missed approach altitude. The FCTM also prohibited setting the minimum descent altitude as the target altitude on the FCU, which could cause a spurious altitude capture and destabilisation of the approach at a critical stage.
Communication and standard callouts
The FCTM stated that if, for any reason, one parameter deviates from stabilised approach conditions, the PM will make the appropriate callout as follows:
Parameter
Exceedance
Callout
Indicated airspeed
Speed target +10 kt / -5 kt
“SPEED”
Vertical speed
Descent rate exceeds 1,200 ft/min
“SINK RATE”
Pitch altitude
+10º / -2.5º
“PITCH”
Bank angle
7º
“BANK”
ILS Only
Localiser
Excess deviation
½ dot PFD
“LOC”
Glideslope
½ dot PFD
“GLIDE”
Non precision approach
Cross track error greater than 0.1 NM
“CROSS TRACK”
Vertical deviation greater than ½ dot
“V/DEV”
Course greater than 2.5º (VOR)
“COURSE”
Course greater than 5º (Automatic direction finder)
“COURSE”
Altitude distance check
“___FT HIGH (LOW)”
Altitude callouts were also to be made by the PM through to landing. Neither the captain nor first officer recollected any callouts being made.
Related occurrences
A search of the ATSB database for similar occurrences in the last 5 years was conducted. The search did not identify any occurrences where a flight crew had difficulty locating Perth Airport or the runways in CAVOK conditions.
The database contained six occurrences where an enhanced ground proximity warning system (EGPWS) glideslope warning had occurred during the runway 06 VOR approach. Of these, four related to the inadvertent selection of the ILS for another runway. There were a further 25 cases of glideslope warnings where the runway was not identified in the occurrence details. There was one record of an EGPWS terrain warning occurring at Perth although the approach involved was not identified. The occurrence details in that case suggested the terrain warning was spurious. There were no occurrences recorded in the ATSB occurrence database where an minimum safe altitude warning was issued by ATC during a runway 06 approach.
On 4 and 29 May 2010, an Airbus A330 aircraft, operated by AirAsia X was involved in two separate occurrences on approach to the Gold Coast, Queensland, where the aircraft were descended below the segment minimum safe altitudes.[34] On both occasions, there was low cloud and reduced visibility on arrival at the Gold Coast. The ATSB found that these events were indicators of a minor safety issue regarding the operator's training of its flight crews, in relation to non-precision approaches.
On 24 July 2011, a Boeing Company 777-3D7 aircraft, operated by Thai Airways, was conducting a runway 34 VOR approach to Melbourne Airport, Victoria.[35] During the approach, the tower controller observed that the aircraft was lower than required and asked the flight crew to check its altitude. The tower controller subsequently instructed the crew to conduct a go-around. However, while the crew did arrest the aircraft’s descent, there was a delay of about 50 seconds before they initiated the go-around and commenced a climb to the required altitude.
The ATSB established that the pilot in command may not have fully understood some aspects of the aircraft’s automated flight control systems and probably experienced ‘automation surprise’ when the aircraft pitched up to capture the VOR approach path. As a result, the remainder of the approach was conducted using the autopilot’s flight level change mode, where the aircraft’s rate of descent may be significantly higher than required. In addition, the flight crew inadvertently selected a lower than stipulated descent altitude, resulting in descent below the specified segment minimum safe altitude for that stage of the approach.
On 30 June 2011, an Airbus A320 aircraft, operated by Tiger Airways Australia conducted a go-around procedure at Avalon Airport, Victoria, after an unsuccessful approach to runway 18.[36] While re-positioning the aircraft for another approach, this time on the reciprocal runway 36, the aircraft descended without further ATC clearance to below the assigned altitude. The flight crew was subsequently cleared for a visual approach; however, the aircraft descended to below the minimum permitted altitude of 2,000 ft, to 1,600 ft. The ATSB investigation found that the flight crew’s understanding of the aircraft’s position during the second approach was probably influenced by the workload associated with the runway change.
On 11 September 2016 an Airbus A330 aircraft, operated by AirAsia X descended below the segment minimum safe altitude, near the Gold Coast Airport, Queensland.[37] The flight crew were cleared to conduct a RNAV-Z (GNSS) instrument approach to runway 14 at Gold Coast Airport in visual meteorological conditions. During the approach, the aircraft was observed to descend below a segment minimum safe altitude. At the time of publication, the ATSB investigation was ongoing.
During the flight, the captain’s flight management guidance computer (FMGC1) failed. The flight crew’s response to this and their utilisation of FMGC1 during the runway 21 instrument landing system (ILS) approach, resulted in an unexpected increase in engine thrust and subsequent go-around. After conducting the go-around, they were required to change runways due to increased crosswind and conduct a VHF Omni Directional Radio Range (VOR) approach onto runway 06. During this VOR approach, air traffic control (ATC) received a minimum safe altitude warning, prompting the controller to alert the crew of their low altitude and instructed them to conduct a go-around. Subsequently, the flight crew made another approach for runway 06 and the aircraft landed safely.
The following analysis discusses the crew’s understanding and management of the FMGC failure, their systems knowledge, and the human performance factors that affected the management of the approaches, which resulted in two go-arounds.
Crew response to the flight management guidance system failure
During the cruise, when the captain identified that his multipurpose control and display unit (MCDU1) had frozen and the navigation display (ND) map became unavailable, the flight crew correctly identified an FMGC1 failure. However, they could not locate any information about how to resolve it in the aircraft’s manuals. Had they found the MCDU and FMGC reset procedures in the Quick Reference Handbook (QRH), the crew may have been able to rectify the failure. This would have provided normal operation of the captain’s navigation display ND and MCDU. With an operational MCDU, the captain would have been able to input the approach and aerodrome data into the FMGC1 and the unexpected increase in engine thrust would not have occurred.
Additional information on the failure mode was available in the Flight Crew Operating Manual (FCOM), but the flight crew did not find this information in that manual. The investigation was unable to determine why the crew did not locate the relevant information. This failure to find and action the QRH and FCOM, meant the aircraft systems remained degraded for the rest of the flight.
Understanding of system interactions and subsequent crew decision making during the runway 21 ILS approach
The flight crew discussed the FMGC1 failure during their first approach briefing and decided to use the first officer’s functioning MCDU (MCDU2) and ND on the descent. Because the crew had not previously found the information in the FCOM relating to the failure, they did not understand how it could affect the interactions between the aircraft systems and hence the conduct of the descent. They were therefore unaware that both autopilots, and in particular autopilot 1 (AP1), should not have been engaged during the instrument approach. The reason for not engaging AP1 was that FMGC1 took primacy over the first officer’s FMGC (FMGC2) when both autopilots were used and the data in FMGC1 had frozen at the time of failure.
When the flight crew engaged AP1 during the first approach, they did not recognise that the subsequent cabin pressure fault was related to the engagement of AP1 and its utilisation of FMGC1 data. Additionally, the crew did not realise that the FMGC1 target speed at the time of failure (253 kt) would be utilised when the speed mode was changed from a selected mode (which had a target speed of 160 kt at the time), to a managed mode after AP1 was engaged.
The issue of flight crew understanding systems interactions is not limited to this occurrence. In response to the increase in incident and accident reports of flight crew experiencing difficulties using flight path management systems, a United States Federal Aviation Administration-led Flight Deck Automation Working Group analysed several data sources to produce findings and recommendations for the use of automation on modern flight decks. The working group found that operators had concerns with the level of flight crew skills required for managing automated system malfunctions and/or failures. The working group was cognisant that it was impossible to train pilots in all possible malfunction situations or failure scenarios. They stated that pilots needed to be prepared to recognise the results of partial and complete system failures and intervene appropriately (PARC/CAST Flight Deck Automation Working Group, 2013).
Crew’s understanding of systems interactions and dual control inputs
In this case, the flight crew’s lack of understanding of how the systems interacted led to inappropriate system selections and resulted in the increase in engine thrust. Although the failure of FMGC1 had not been resolved by the flight crew prior to the aircraft commencing descent, FMGC2, MCDU2, autopilot 2 (AP2) and engine autothrust were all capable of normal operation and could have been used to complete the approach normally.
Although the flight crew elected to conduct a go-around when the engine thrust unexpectedly increased, there was a period of 25 seconds where dual sidestick control inputs occurred, prior to the captain taking over control of the aircraft. These dual control inputs indicate a level of confusion and lack of communication regarding conduct of the go-around and about which pilot was in control of the aircraft. There were other instances of dual control inputs of short duration (less than 5 seconds). While these inputs did not affect the flight, there have been other instances where sustained dual control inputs have had a detrimental effect on the control of the aircraft.
Reaction to automation functionality and decision making
Following the go-around and without understanding the reason for the increase in engine thrust or the effect the FMGC1 failure had on the system, the flight crew briefly re-engaged AP1. Due to doubts about the functionality of the automation, the captain then elected to reduce the level of automation, and manually fly the aircraft. This decision presented as being intuitively derived from patterns of behaviour the captain had used successfully in the past. The decision had the effect of removing the potentially problematic automation, but it also increased the crew’s workload.
Researchers (Klein 2008, Kahneman, 2011) have stated that, in time-constrained environments, individuals can make decisions using intuitive reasoning where the steps are often unconscious and based on pattern recognition. For intuitive or naturalistic decision-making, an experienced individual will identify a problem situation as similar or familiar to a situation they have dealt with before and will extract a plan of action from memory. If time permits, they will confirm their expectations prior to initiating action. If time does not permit, actions will need to be initiated with uncertainty that may result in a poor decision.
Crew workload after the initial go-around
Workload has been defined by Orlady and Orlady (1999) as:
…reflecting the interaction between a specific individual and the demands imposed by a particular task. Workload represents the cost incurred by the human operator in achieving a particular level of performance (p.203).
The available cognitive resources are finite and will vary depending on the experience and training of the individual as well as the level of stress and fatigue experienced. Workload is managed by balancing task demands such that, when workload is low, tasks are added and when workload becomes excessive, tasks are shed (Orlady and Orlady, 1999). Tasks, such as internal and external communication, can be shed in an efficient manner by eliminating low priority tasks or they can be shed inefficiently by abandoning important tasks. The task demands can be influenced by the mental and physical requirements of the task, as well as the time available (Wickens and Hollands, 2000).
Factors increasing crew workload
After the first approach, the flight crew’s workload increased substantially with the following conditions:
although the engine autothrust, AP2 and FMGC2 were still operating normally, the crew became uncertain about the automation’s functionality and elected to manually control the engine thrust and fly the aircraft using raw data.
the crew had limited experience, outside of simulator sessions, flying approaches manually.
the turbulent conditions increased the attention required by the captain to maintain desired heading, pitch attitude and airspeed.
the unexpected runway change meant the crew needed to program the approach into the first officer’s MCDU, review the approach and conduct a briefing prior to the approach.
the unexpected runway change and reduced timeframes limited the time available for the crew to review the approach charts.
the captain’s ND was still in operating in a degraded mode and was not displaying lateral tracking guidance for the VOR approach nor the information from the distance measuring equipment (DME). For that information, the captain needed to refer to the first officer’s ND on the other side of the cockpit instrument panel.
the captain’s flight director (FD) was still referencing the frozen FMGC1 and was not providing valid FD attitude guidance targets.
while the crew were experienced in flying non-precision VOR approaches, they had limited experience flying the Perth runway 06 VOR approach at night. The first officer reported never having flown the approach before.
Recorded data indicates that there was 8 minutes from making the decision to conduct the VOR approach to when the flight crew confirmed they were established on the approach, at 10 NM. The limited time available to prepare for the approach, combined with the degraded systems, would have further increased their workload.
Effect of increased workload
Workload and time pressure can lead to a reduction in the number of information sources an individual may access, and the frequency or duration of time these sources are checked (Staal, 2004). Amongst other effects, a high workload can result in individuals not understanding the implications of the information they are presented with.
In this occurrence, the captain’s workload was increased due to the decision to hand-fly the aircraft using the first officer’s ND for lateral tracking guidance and distance information during the VOR approaches. This increased workload made it more likely that, in the visual conditions, he would try and continue the approach using external visual reference.
The flight crew’s workload impacted their ability to manage the approaches and was evidenced by the shedding of tasks, such as:
reviewing the approach charts,
monitoring of the flight profile,
descending the aircraft without confirming the aircraft position,
neither crew member observing the DME distance,
breakdown in the crews’ use of standard operating procedures, such as selecting altitudes other than the missed approach altitude on the flight control unit, while conducting the non-precision instrument final approach.
Had the flight crew elected to hold and prepare prior to conducting the approach, they may have reduced their workload, improved their preparations and conducted a thorough briefing prior to conducting the unfamiliar approach.
Preparation and conduct of the first runway 06 VOR approach
During the first runway 06 VOR approach, the flight crew’s focus of attention was outside the aircraft, attempting to locate the runway. Although the crew were conducting the instrument approach in visual conditions, more attention should have been given to maintaining the aircraft on the prescribed instrument approach flight path profile, until reference was made to the runway landing environment and/or the instrument approach was discontinued. The following content explains how the crew's ability to monitor and maintain the correct flight profile and altitude during the approach was likely hindered. This resulted in the aircraft descending below the specified minimum safe altitude without being detected by the crew.
Crew focus of attention
The captain could not identify the runway and requested assistance from the first officer. Both flight crew then focused on locating the runway, with neither appearing to monitor the aircraft’s flight profile. The crew first became aware of the altitude constraint and that the aircraft had descended below it when advised by ATC. This indicates that both crew were distracted and neither was monitoring the approach at this time. Further indications that the crew was distracted from monitoring the approach included:
the captain took the first officer’s question about when to initiate descent as a prompt to descend without confirming the aircraft’s position.
the lack of detection that the aircraft was descended early.
the first officer thought aircraft was on correct profile because he observed an appropriate initial descent rate.
the descent rate increased substantially above that necessary for a 3-degree approach.
neither crew member observed the DME distance, after initiation of descent.
the first officer could not recall communicating altitude or distance information during the approach.
Crew ability to monitor the approach
Monitoring is an extensive set of behavioural skills that all flight crew are expected to have. This skill set is specified in the aircraft operator’s standard operating procedures and involves the primary roles of monitoring the aircraft’s flight path, communications and the activities of the pilot flying. The UK Civil Aviation Authority (UK CAA) (2013) has defined monitoring as:
The observation and interpretation of the flight path data, configuration status, automation modes, and on-board systems appropriate to the phase of flight. It involves a cognitive comparison against the expected values, modes, and procedures. It also includes observation of the other crew member and timely intervention in the event of deviation. (p.9)
The difficulties that flight crew have with maintaining effective monitoring are thought to be due to not directly controlling the system being monitored. Humans are inherently poor at maintaining vigilance for infrequent events and equipment failures in modern airline operations are rare. Flight crew rarely receive direct feedback on the effectiveness or consistency of their monitoring unlike the feedback they would receive when they may fly an aircraft manually (UK CAA, 2013).
Researchers (Dismukes & Berman, 2010) found that in most instances where flight crew were failing to monitor the aircraft state or position, there were competing concurrent task demands on the crew’s attention. Humans have a limited ability to divide attention amongst tasks and generally, have to switch attention back and forth between tasks. This leaves an individual vulnerable to losing track of the status of one task while being engaged in another.
Other factors affecting awareness of the flight profile
Believing they were on the correct profile, based on the vertical speed the first officer observed early in the descent, combined with the night conditions, and unfamiliarity with the approach reduced the visual cues outside of the cockpit available to the crew regarding the aircraft’s position. The reduced external visual cues along with the crew not utilising the available internal visual cues, such as the course deviation indicator, distance information and multifunction display, led to the crew not understanding where they were on the flight profile or where they were with respect to the runway.
Communication during the approach
The flight crew missed opportunities to identify the early descent, higher than normal rate of descent and descent below the segment minimum safe altitude because they were focused outside the cockpit rather than monitoring their primary flight instruments. The first officer did not provide the captain with the standard altitude and distance callouts, nor with an alert about the rate of descent, which resulted in the aircraft flying below the flight profile. This potentially reduced the captain’s awareness of the deviations from the standard approach and limited his ability to correct it. That communication was particularly important given that the crew had not optimised the aircraft’s remaining systems, with the captain attempting the approach without his ND and FD attitude guidance targets on his primary flight display.
Preparation and conduct of the second runway 06 VOR approach
During the vectoring for the second runway 06 VOR approach, the captain took on the pilot monitoring role. This gave the captain the opportunity to review the approach data and familiarise himself with the required flight profile. The captain returned to the role of pilot flying soon after the initial approach fix and elected to obtain visual contact with the runway prior to initiating the descent. Due to the late descent, the aircraft’s rate of descent was greater than 1,200 ft/min for a period of the approach (although it was stabilised by 1,000 ft).
Due to the captain manually controlling the engine thrust and the turbulence, the engine thrust was briefly at idle at about 300 ft above ground level, which did not meet the stabilised approach criteria and was coincident with an increasing rate of descent. Unstable approaches are known to increase risks in landing, although in this instance the landing was completed without further incident.
Findings
From the evidence available, the following findings are made with respect to the operational event involving an Airbus A320, registered PK-AXY and operated by PT Indonesia AirAsia that occurred 17 km west-south-west of Perth Airport, Western Australia on 19 February 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The flight crew’s diagnosis of the captain’s failed flight management guidance computer was accurate, but after they did not find the procedure to follow, the failure was not appropriately managed. This resulted in degraded systems capability for the approach.
The flight crew had a limited understanding of how the captain’s failed flight management guidance computer would affect the use of the aircraft’s automated systems during the instrument landing system approach. This meant that their decision to engage autopilot 1 resulted in the frozen data stored in the failed guidance computer being utilised by the auto flight system, leading to an unexpected increase in engine thrust and prompted the crew to conduct a missed approach.
The unresolved system failures, combined with the conduct of a missed approach procedure and the subsequent runway change increased the flight crew's workload. This likely reduced their ability to analyse the actual extent to which their automation was degraded, and effectively manage the subsequent approaches.
During the first runway 06 non-precision approach, the flight crew’s focus of attention was outside the aircraft, attempting to locate the runway. This distraction, along with their unfamiliarity with the approach procedure, inhibited their ability to monitor and maintain the correct flight profile and altitude during the approach. The flight crew did not detect that the aircraft had descended below the segment minimum safe altitude for that stage of the approach.
Other safety factors
During the flight, multiple dual control inputs occurred, which in other circumstances have resulted in aircraft responding in an unexpected manner.
The aircraft's flight path profile was not adequately monitored or communicated between the flight crew during the non-precision instrument approaches to runway 06. This reduced the captain’s awareness of any deviation from the prescribed approach and limited his ability to correct it.
The second runway 06 non-precision instrument approach did not meet the stabilised approach criteria for a short period during the final approach, increasing the safety risk of the landing.
Safety issues and actions
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out.
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence
As a result of this occurrence, PT Indonesia AirAsia have taken the following proactive safety action:
Implemented additional classroom sessions on aircraft line-check into the re-training program.
Incorporated the incident as a subject of the SPOT (Special Orientation Training) in the simulator syllabus.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
aircraft operator, PT Indonesia AirAsia
aircraft flight crew
provider of air traffic services, Airservices Australia
manufacturer of the aircraft, Airbus.
References
Dismukes, R.K., and Berman, B. (2010). Checklists and monitoring in the cockpit: Why crucial defences sometimes fail. NASA/TM-2010-216396, NASA Ames Research Centre, Moffett Field, CA.
Kahneman, D. (2011). Thinking, fast and slow. Allen Lane: London, UK.
Klein, G. (2008). Naturalistic decision making. Human Factors, Vol 50, No.3, pp.456-460.
Orlady, H.W., and Orlady, L.M. (1999). Human factors in multi-crew flight operations. Ashgate: Aldershot, UK.
PARC/CAST Flight Deck Automation Working Group. (2013). Operational use of flight path management systems. US Federal Aviation Administration.
Staal, M.A. (2004). Stress, cognition, and human performance: A literature review and conceptual framework. NASA/TM-2004-212824, NASA Ames Research Centre, Moffett Field, CA.
UK Civil Aviation Authority. (2013). Monitoring matters: Guidance on the development of pilot monitoring skills. Loss of Control Action Group, CAA Paper 2013/02, West Sussex, UK.
Wickens, C.D., and Hollands, J.G. (2000). Engineering psychology and human performance (Third edition). Prentice Hall: New Jersey, US.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to PT Indonesia AirAsia, the aircraft flight crew, Airservices Australia, the Civil Aviation Safety Authority, Airbus and the French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile.
Submissions were received from PT Indonesia AirAsia, Airservices Australia, the Civil Aviation Safety Authority, Airbus and the French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Runway 21 ILS approach, aircraft track and flight data
Figure A1: Runway 21 ILS approach with aircraft track (blue)
Source: Naviga (modified by the ATSB)
Figure A2: Flight data showing autopilot and mode selections with a resulting thrust and speed increase during the runway 21 ILS approach. The descent depicted is from 3,000 ft to 2,000 ft.
Note:
1. At 2143:04 AP1 was engaged
2. At 2144:37 the auto speed was changed to a managed mode resulting in an increase in the target airspeed (to 253 kt)
3. At 2144:51 the go-around was initiated
Source: ATSB
Appendix B – First runway 06 VOR approach, aircraft track and flight data
Figure B1: First runway 06 VOR approach with aircraft track (blue) and approximate location of go-around (red cross)
Source: Naviga (modified by the ATSB)
Figure B2: Flight data from first runway 06 VOR approach from 2,500 ft to 1,473 ft
Note:
1. At 2200:45 descent initiated
2. At 2201:57 the go-around was initiated, at an altitude of 1,473 ft
The target CAS is the speed target that would appear on the speed tape of the primary flight display.
Source: ATSB
Appendix C – Second runway 06 VOR approach, aircraft track and flight data
Figure C1: Second runway 06 VOR approach with aircraft track (blue)
Source: Naviga (modified by the ATSB)
Figure C2: Flight data from second runway 06 VOR approach from 2,500 ft to landing
Note:
1. At 2215:20 descent was initiated, at about 5 DME
Source: ATSB
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the evening of 5 July 2015, land and hold short operations (LAHSO) were in effect at Melbourne Airport, Victoria. This allowed for simultaneous landings on crossing runways, with the requirement that one aircraft stops well before the intersection of the runways. On this evening, an Emirates Boeing 777 was cleared for an immediate take-off from runway 34 while two Qantas Boeing 737s were on approach to runways 34 and 27. This resulted in the crew of the Boeing 737 on approach to runway 27 initiating a missed approach, followed by the crew of the Boeing 737 on approach to runway 34 being instructed by air traffic control (ATC) to go-around. The Boeing 737 on approach to runway 34 was then radar vectored by ATC below the minimum vector altitude.
What the ATSB found
The ATSB found that, since 2011, Airservices Australia had been aware of the hazard associated with the inability to separate aircraft that were below the appropriate lowest safe altitude at night but had not adequately mitigated it. This resulted in a situation where, in the event of a simultaneous go-around at night during LAHSO at Melbourne Airport, there was no safe option available for air traffic controllers to establish a separation standard and to ensure a mid-air collision did not occur when aircraft were below minimum vector altitude. Though Airservices Australia had implemented a number of preventative controls prior to this occurrence in response to concerns expressed by the Civil Aviation Safety Authority (CASA), a recovery control was not implemented until 2016.
Additionally, the compromised separation recovery training provided to the air traffic controllers employed in the Melbourne ATC Tower did not include a night scenario for missed approaches during LAHSO.
What's been done as a result
Airservices Australia has received an exemption from CASA to radar vector aircraft below the minimum vector altitude at night at Melbourne Airport under certain conditions. Airservices Australia has also instigated a stagger procedure for land and hold short arrival pairs such that aircraft will not come into unsafe proximity in the event of a missed approach. Training in compromised separation recovery at night during LAHSO has also been introduced for Melbourne ATC Tower controllers.
Safety message
Though air traffic controllers have a duty of care to intervene in a situation where they believe that the safety of an aircraft may be in doubt, such interventions can have unintended consequences. When assessing possible actions to address a hazard, the air traffic service provider should consider both preventative and recovery controls. Additionally, simulator training is useful for developing emergency response skills and, as such, should address all credible compromised separation recovery scenarios.
Safety issue and actions
The safety issue identified during this investigation is listed in the Findings and Safety issue and actions sections of this report. The ATSB expects that the safety issue identified by the investigation should be addressed by the relevant organisation. In addressing this issue, the ATSB prefers to encourage the relevant organisation to initiate safety action proactively, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Hazard associated with the inability to separate aircraft below the appropriate lowest safe altitude at night
The hazard associated with the inability to separate aircraft that are below the appropriate lowest safe altitude at night was identified but not adequately mitigated. This resulted in a situation where, in the event of a simultaneous go-around at night during land and hold short operations at Melbourne Airport, there was no safe option available to air traffic controllers to establish a separation standard when aircraft were below minimum vector altitude.
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions by Airservices Australia in response to this occurrence:
Training in night-time compromised separation recovery during LAHSO was completed by all Melbourne Tower controllers in March 2016.
On 10 March 2016, an arrival stagger was introduced for LAHSO arrival pairs to ensure that, in the event of a missed approach, the aircraft would not be in unsafe proximity at the runway intersection.
Additional details
Melbourne Aerodrome Control On-the-job Training Instructor details
The sources of information during the investigation included:
Airservices Australia
the Civil Aviation Safety Authority
the airlines involved
flight crew from VH‑VXS, VH‑VYE and A6‑EBU
the air traffic controllers involved.
References
Arthur, W., Bennett, W., Stanush, P.L. & McNelly, T.L., 1998, ‘Factors that influence skill decay and retention: A quantitative review and analysis,’ Human Performance, vol. 11, pp. 57-101.
Gibb, R., Gray, R. & Scharff, L., 2010, Aviation visual perception, Ashgate, Surrey, England.
Isaac, A. R. with Ruitenberg, B., 1999, Air traffic control: human performance factors, Ashgate, Aldershot, England.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
Submissions were received from Airservices Australia, the Civil Aviation Safety Authority, the airlines involved, the flight crew from VH‑VXS and VH‑VYE, the Dubai Civil Aviation Authority and the involved air traffic controllers. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
The occurrence
At 1808 Eastern Standard Time[1] on 5 July 2015, an Emirates Boeing 777‑31HER (B777), registered A6‑EBU and flight number 405, conducting a scheduled passenger flight to Changi Airport, Singapore was issued instructions to line up on runway 34[2] (Figure 1) at Melbourne Airport. The instruction was issued by a trainee Melbourne Aerodrome Controller (trainee tower controller)[3] following discussion with her on‑the‑job training instructor (tower OJTI). Also in the Tower were the Melbourne Tower Coordinator (coordinator) and a controller providing both Melbourne Surface Movement Control and Airways Clearance Delivery. At the same time, two Qantas Boeing 737‑838s (B737s) were about 5 NM (9 km) from the threshold of their respective runways under land and hold short operations (LAHSO):[4]
the B737 on final for runway 27, registered VH‑VXS (VXS) and flight number 449, was conducting a scheduled passenger flight from Sydney, New South Wales
the B737 on final for runway 34, VH‑VYE (VYE) and flight number 819, was conducting a scheduled passenger flight from Canberra, Australian Capital Territory.
Under LAHSO, the B737 tracking to land on runway 34 was required to land and stop before the intersection with runway 27, allowing the other B737 to land on the full length of runway 27.
About 30 seconds later, as the B777 continued to taxi towards the runway, the aircraft was cleared for an immediate take-off.[5] In one continuous movement, the B777 flight crew followed the taxiway lights onto the runway and executed a 90˚ turn to line up on the runway centre line prior to commencing the take-off roll.[6] This manoeuvre took longer than the trainee tower controller and the tower OJTI had anticipated and, by the time the B777 had commenced the take-off roll at 1810, VXS was at about 2.5 NM (5 km) from the runway 27 threshold passing 1,300 ft above mean sea level (AMSL)[7] on descent and VYE was less than 2 NM (4 km) from the runway 34 threshold passing 1,100 ft on descent.
Due to the slower than anticipated speed by the B777 commencing its take-off roll, the trainee tower controller requested the flight crew of VXS to reduce to minimum speed. The flight crew responded that they were at minimum speed. The tower OJTI then asked the trainee tower controller to inform the flight crew of VXS that, in the event of a missed approach, the flight crew were to expedite climb to 4,000 ft as there was ‘traffic departing the crossing runway.’ In response to this transmission, at 1810, the flight crew of VXS advised that they were going around.[8] At that time, VXS was about 1.2 NM (2.2 km) from the runway 27 threshold passing 900 ft on descent and VYE was about 1 NM (2 km) from the runway 34 threshold passing 800 ft on descent.
Figure 1: Melbourne Airport diagram with runways 27 and 34 indicated (green and blue respectively) and the location where the B777 entered runway 34 indicated by a purple arrow
Source: Airservices Australia, modified by the ATSB
The coordinator expressed concern that the departing B777 was still occupying runway 34 and that a runway separation standard would not be maintained with the arriving VYE.[9] Receiving what he deemed an unsatisfactory response from the tower OJTI, the coordinator then instructed the trainee tower controller to send VYE around.[10] At the same time as the trainee tower controller instructed the flight crew of VYE to go around, at 1811, a runway 34 occupancy caution activated in the Tower because the B777 was still on runway 34 and VYE was less than 15 seconds flight time from the threshold.[11] Two seconds later, the caution upgraded to a warning as VYE was now less than 10 seconds flight time from the threshold descending through 500 ft and the B777 was still on the runway, passing taxiway FOXTROT (Figure 2). At that time, VXS was less than 1 NM (2 km) from the runway 27 threshold climbing through 1,100 ft.
Figure 2: Melbourne Airport diagram with runways 27 and 34 indicated (green and blue respectively), and the location of the B777 (purple arrow) passing taxiway FOXTROT (yellow) at 1810:34
Source: Airservices Australia, modified by the ATSB
Seconds later the flight crew of VYE reported that they had commenced the go-around. Surveillance data showed that the B777 was still on runway 34, south of the intersection with runway 27. The trainee tower controller then advised the flight crew of VYE that a B737 (i.e. VXS) was going around on runway 27 but used the incorrect runway identification – runway 34 instead of runway 27.
At 1810:43, as VYE flew over the threshold of runway 34, surveillance data showed the aircraft climbing through 600 ft with the B777 still on the runway, still south of the intersection with runway 27, with VXS less than 0.3 NM (0.6 km) from the threshold of runway 27 climbing through 1,200 ft.
Nine seconds later at 1810:52, as VYE left 1,000 ft on climb overhead runway 34 (Figure 3), the trainee tower controller was instructed to tell the flight crew to turn right onto a heading of 360˚ while the aircraft was below the minimum vector altitude (MVA) of 2,000 ft.[12] At that time, surveillance data showed the B777 north of the runway 27 intersection climbing through 800 ft and VXS overhead runway 27 climbing straight ahead through 1,700 ft. Shortly afterwards, the trainee tower controller issued a wake turbulence caution to the flight crew of VYE[13] in relation to the B777 departing runway 34.
Figure 3: Melbourne Airport diagram showing the location and height of the B777 (purple), VH‑VXS (green) and VH‑VYE (blue) at 1810:52
Source: Airservices Australia, modified by the ATSB
Fourteen seconds later at 1811:18, VYE was just south of runway 27 and climbing through 2,100 ft – now above the MVA of 2,000 ft. All aircraft were now tracking well clear of each other and their flight paths were diverging, with the B777 continuing to Changi and the two 737s being re-sequenced to land at Melbourne Airport without further incident.
At no time was traffic information[14] provided to the flight crew of the B777 regarding either B737.
Airservices Australia (Airservices) surveillance data showed that separation between the two B737s reduced to about 0.9 NM (2 km) and 900 ft as VXS crossed runway 34 in front of VYE, climbing in the missed approach on runway 27. At that time, VYE was also climbing, conducting a go-around from runway 34. The tower controller was responsible for maintaining a separation standard and the only available standard was visual.[15] However, due to the limitations of human vision at night[16] and the disposition and trajectory of traffic at the time, visual separation could not be assured.
Melbourne Aerodrome Control on-the-job training instructor (tower OJTI)
Melbourne Coordinator (coordinator)
a controller performing the combined duties of the Melbourne Surface Movement Controller and the Melbourne Airways Clearance Delivery Controller.
With the exception of the trainee tower controller, each controller was correctly endorsed and no fatigue‑related issues were identified. The tower OJTI and the coordinator were also endorsed in all Tower control positions.
The trainee tower controller was on her fourth under-training shift and had not used or observed land and hold short operations (LAHSO) before. Though she had 11 years’ experience working in busy control towers overseas, the trainee tower controller held no endorsements at Melbourne Airport.
All controllers had completed the Tower-specific compromised separation recovery training.[17]
The flight crew from the three involved aircraft were correctly licenced and fit for duty.
Entering runway 34
A senior Tower controller reported that, during the day, most aircraft line up on runway 34 by following the runway 16 taxi-off markings (in yellow on Figure 4), entering the runway via a curve. Some aircraft also follow this path at night, but some follow the taxiway lighting onto runway 34, resulting in a 90˚ turn to line up in the departure direction (in orange on Figure 4).
Figure 4: Threshold of runway 34 at Melbourne Airport, showing the curved line-up track in yellow, and the track in orange that follows the taxiway lighting
Source: Google Maps, modified by the ATSB
The trainee tower controller and the tower OJTI both reported that, when issued with a clearance for an immediate take-off, they had expected the Boeing 777‑31HER (B777) to line up via the curved entry to runway 34. The controllers believed that by entering runway 34 via a 90˚ turn, the B777’s take-off was delayed.
‘Cleared for an immediate take-off’, is an internationally used phrase that requires the flight crew to taxi onto the runway and take off in one continuous movement. It does not specify the runway entry technique.
The B777 flight crew later reported that they did taxi out and take off in one continuous movement and recorded data supports this. Further, the operator advised that, as performance calculations required the full length of the runway, the 90-degree line up manoeuvre was required.
Missed approach and go-around
When, for any reason, flight crew judge that an approach cannot be continued to a successful landing, a missed approach or go-around is flown. For this reason, a clearance to land authorises the flight crew to go-around or carry out a missed approach. An approach may be discontinued for a number of reasons including:
The required visual references have not been established by the decision altitude/height or minimum descent altitude/height or is acquired but is subsequently lost.
The approach is, or has become, unstable.
The aircraft is not positioned so as to allow a controlled touchdown within the designated runway touchdown zone with a consequent risk of aircraft damage with or without a runway excursion if the attempt is continued.
The runway is obstructed.
Landing clearance has not been received or is issued and later cancelled.
A go-around is being flown for training purposes.
A missed approach procedure is designed for each instrument approach to provide terrain and obstacle protection. When flight crew conduct a missed approach from a visual approach, they must initially remain on runway track and remain visual until re-cleared by the controller. As the flight crew must reconfigure the aircraft during the missed approach, workload can be high.
Land and hold short operations
To improve airport capacity and air traffic system efficiency, LAHSO involves aircraft landing and holding short of an intersecting runway (see Figure 1 for the runway configuration at Melbourne Airport) while another aircraft takes off or lands on an intersecting runway. At Melbourne Airport, the landing rate during LAHSO is about 44 aircraft per hour, and about 24 when LAHSO is not in use. Also used in Canada and the US, in Australia LAHSO is only available to operators who have received authorisation from the Civil Aviation Safety Authority to participate in the procedure. During LAHSO, the aircraft issued a hold short requirement is classified as the ‘active participant’, and the aircraft which has unrestricted use of the full length of the crossing runway is classified as the ‘passive participant’. Under LAHSO, simultaneous take-off and landing is permitted only during the day, but simultaneous landings are permitted day and night. In Australia, with the exception of one operator, foreign-operated aircraft are not permitted to participate in LAHSO.
LAHSO has been used in Australia for over 20 years and, at the time of the occurrence, was used at Adelaide, Darwin and Melbourne airports. The procedure is used by day only at Darwin Airport[18] as the crossing runway, runway 18/36, is not lit at night. Following an Airservices review of this occurrence, LAHSO is no longer used at night at Adelaide Airport. At Melbourne Airport, on the day of the occurrence, end of civil twilight was 1743, about half an hour prior to the occurrence.
LAHSO was only conducted when certain cloud base and visibility conditions existed – the cloud base, or ceiling, must not be less than the minimum vector altitude (MVA) within 8 NM (15 km) of the Airport and the visibility not less than 8 km. With an elevation of 434 ft and the highest MVA within 8 NM (15 km) being 2,400 ft, the minimum cloud base for LAHSO at Melbourne Airport was 2,000 ft above ground level. Documentation also required that the Automatic Terminal Information Service broadcast include advice that LAHSO was in progress and stipulate which runway was in use for both arriving and departing aircraft, and which was for arriving aircraft only. All of these requirements were met on the night of this occurrence.
On occasions, an aircraft may require the ‘landing only’ runway for departure, referred to as an off‑mode departure. Managing arriving and departing aircraft operating under LAHSO is made more complex when an off-mode departure is required.
To ensure LAHSO participants are aware of the other aircraft, specific phraseology is stipulated. When landing is approved for an active participant during LAHSO, the following phraseology is used:
Controller: ‘(callsign) (other aircraft type) departing (or landing) on crossing runway, hold short runway (number) cleared to land runway (number)’
Flight crew: ‘hold short runway (number) cleared to land runway (number) (callsign)’
The phraseology used for the passive participant is:
Controller: ‘(callsign) (other aircraft type) landing on crossing runway will hold short cleared to land (or to take-off) runway (number)’
Flight crew: ‘cleared to land (or take-off) runway (number) (callsign)’
Additionally, during LAHSO, the tower controller is responsible for maintaining visual separation in the event of a missed approach or a dual missed approach. This is until such time as another separation standard can be applied, either 3 NM (6 km) or 1,000 ft.
Runway separation standard
For the aircraft involved in this occurrence, separation standards require that the aircraft landing behind a departing aircraft cannot cross the runway threshold until the preceding aircraft is airborne and:
has either commenced a turn, or
is beyond the point on the runway at which a landing aircraft could be expected to complete its landing roll and there is sufficient distance to enable the landing aircraft to manoeuvre safely in the event of a missed approach.
Wake turbulence separation standard
In addition to providing runway separation, wake turbulence[19] standards must also be applied for aircraft departing or going around behind another aircraft. Separation is either time- or distance-based, and is determined by the wake turbulence categories of the aircraft involved. The maximum take-off weight of the B777 place the aircraft in the heavy aircraft category, and the B737‑838 in the medium category. The time-based standard between the aircraft was 2 minutes, and the applicable distance standard is 5 NM (9 km). As Melbourne is a radar tower environment, only the distance standard was applicable.
A wake turbulence standard is not required between an aircraft landing behind an aircraft taking off on the same runway. If the landing aircraft, however, conducts a missed approach behind one departing, the aircraft in the missed approach is considered a departing aircraft. As the trainee tower controller did on this occasion, the controller should issue a wake turbulence caution to the flight crew of a following aircraft when less than the applicable wake turbulence standard exists.
Traffic information
Traffic information is issued by an air traffic controller to alert flight crew to other known or observed traffic. This traffic may be in proximity to the position or intended route of the aircraft, and the issued traffic information helps the flight crew avoid a collision. Traffic information should be provided when, in the controller’s judgement, one aircraft may observe another aircraft and could be uncertain of their intention.
Traffic information should be concise and, to assist flight crew in identifying other aircraft, may include the following information if deemed relevant by the controller:
aircraft identification
type and description, if unusual
position information
direction of flight or route of the aircraft
level
intentions of the pilot.
The provision of traffic information, and the content of that information, is reliant on the controller’s assessment of the underlying need.
Compromised separation recovery training
Compromised separation recovery actions are important emergency response actions. They need to be implemented by controllers promptly and accurately when determined that separation standards have been, or will shortly be, compromised. To ensure emergency response actions are conducted effectively, they need to be regularly practiced. Skill decay is more likely to occur when tasks are rarely performed (Arthur et al., 1998), as is the case for compromised separation recovery actions during actual controlling.
Controllers are required to issue safety alerts to pilots of aircraft as a priority when the controller becomes aware that aircraft are considered to be in unsafe proximity. This is the case unless a pilot advises that action is being taken to resolve the situation, or that the other aircraft is in sight. No safety alerts were issued by the trainee tower controller during this occurrence.
An ATSB investigation into a loss of separation assurance near Tindal, Northern Territory in 2014 found that Airservices had not provided controllers with effective simulator-based compromised separation recovery training. This report, ATSB investigation AO-2014-074 – Loss of separation assurance involving A 330 9V‑STQ and A320 VH‑VFH near Tindal, Northern Territory on 24 April 2014, available on the ATSB website, was not released until May 2016, after the occurrence under investigation here.
Vision at night
The tower controller can provide heading information to flight crew to establish and/or ensure separation in the event of a missed approach and, if the aircraft is below the MVA, by day the controller can transfer the responsibility for terrain clearance to the flight crew. As the human visual perceptual system, however, is physiologically limited in perceiving within a night-time environment (Gibb et al., 2010), the responsibility for terrain clearance when an aircraft is being radar vectored at night must remain with the controller.
Another issue discussed by Gibb et al. relates to flight crew susceptibility to glare from bright city lights during approach and landing at night. A review of US investigation reports into accidents and incidents from 1978 to 2005 found 58 documented vision-related accidents and incidents, with 93 per cent occurring during the approach and landing phase.
Additionally, because of the absence of any size cues at night (i.e. at night the apparent size of an object is related to its brightness rather than its image size) the judgement of distance is extremely difficult (Isaac and Ruitenberg, 1999). In providing visual separation, controllers should rely primarily on azimuth; for example, one aircraft to the northwest and another to the northeast. To ensure that aircraft are not in close proximity, caution should be exercised when using a judgement of relative distance or height for visual separation.
Though flight crew can sight and monitor another aircraft at night, the physiological limitations limit their ability to visually separate. These same physiological limitations hinder a controller’s ability to monitor aircraft at night visually, both when attempting to separate visually and in determining if an aircraft is on the runway or airborne.
Controller best judgement and duty of care
The Civil Aviation Safety Regulations Part 172 contains the standards for the provision of air traffic services. The regulations include advice that:
…the provider may deviate from the standards if an emergency, or other circumstance, arises that makes the deviation necessary in the interests of aviation safety.
Best Judgement. Do not allow anything in these instructions to preclude you from exercising your best judgement and initiative when:
a. The safety of an aircraft may be considered to be in doubt: or
b. A situation is not covered specifically by these instructions.
The Airservices National Air Traffic Service Procedure Manual[21] includes:
Duty of care. Upon becoming aware of information such that it would be reasonable to conclude that an unsafe situation has, or may occur, it would be expected that all necessary action is taken to remove that risk.
Note: The extent of the action required will be driven by professional judgement given the particular circumstances and would include an assessment of the likelihood of the event occurring and the potential severity of the outcome.
Further, the National Air Traffic Service Procedure Manual includes:
Reasonable assurance. A controller’s professional judgement that they have ‘reasonable assurance’ of achieving a particular separation standard requires them to be certain that:
a. The disposition and relative performance of all aircraft, vehicle or persons concerned are such that at all times and under normal operation the separation between them will not be less than that mandated;
b. If the anticipation of an aircraft, vehicle or person operating in the expected way is essential to achieving separation then that aircraft, vehicle or person is provided with sufficient information to make them aware of the dependency; and
Any equipment, the continued operation of which is necessary to assure separation, is operating within normal parameters and there is no reason to expect that the serviceability or performance will change.
On-the-job instruction
Air traffic control training comprises theoretical, simulator and on-the-job components. On-the-job instruction is conducted in the workplace by specially trained instructors. The trainee may move through control positions in a hierarchical manner – for example Surface Movement Control then Aerodrome Control (tower), although the trainee involved in this occurrence had started as a tower trainee.
Airservices stated that the overriding principle for an OJTI is that safety must never be compromised. The training for OJTI also included information about the types of errors to be expected:
Those that must be prevented as they would compromise safety
Those that must be corrected immediately
Those where correction can be delayed as the trainee could learn from the outcome
Those that result from a lack of experience where correction is not necessary.
Intervention strategies for an OJTI range from questioning the trainee, to suggesting an alternate course of action, to directing the trainee, and finally to intervening by taking over or overriding the trainee. Intervention is the last resort and only used to ensure safety.
While conducting training, overall responsibility for the provision of a safe and efficient air traffic service resides with the OJTI, as the trainee is either not licenced or not endorsed. During the training period, the trainee will be given more and more responsibility for the control and separation of aircraft, but the OJTI must monitor the trainee’s performance and ensure that any errors or omissions that may impact safety can be corrected in a timely manner. To facilitate this, the communication system provides a facility to enable the OJTI to override the trainee’s transmissions.
Advanced Surface Movement Guidance Control System
The Melbourne Tower is fitted with an integrated tower automation suite that presents information to controllers by way of a number of computer screens. Different integrated tower automation suite installations exist to incorporate the differing automation available in control towers across Australia. The Melbourne Airport integrated tower automation suite incorporates an Advanced Surface Movement Guidance Control System – a system that provides the controller with surveillance data for vehicles and aircraft on the ground, and airborne aircraft in the immediate vicinity of the Airport. The Advanced Surface Movement Guidance Control System generates aural alerts based on two logics:
Time to threshold for an arrival on a single runway if the Advanced Surface Movement Guidance Control System detects a vehicle or aircraft (targets) on that runway:
Caution: 15 seconds from that runway’s threshold
Warning: 10 seconds from that runway’s threshold.
Target to target where a collision risk exists between two targets.
In addition to the aural caution and warning, the controller also received a visual representation of the caution and warning alerts.
On receipt of an Advanced Surface Movement Guidance Control System caution or warning, the controller is required to scan the aerodrome traffic immediately to assess the integrity of the alert. If required, the controller should then issue traffic advice, control instructions and/or a safety alert. Though the controller did not issue any traffic or safety alerts, she had already instructed the B737 on final for runway 34 to go around prior to the activation of the caution and the warning.
Airborne collision avoidance system limitations
Regular public transport aircraft are fitted with airborne collision avoidance systems (ACAS) that, independently of any ground-based air traffic control system, provide collision avoidance protection by advising flight crew of traffic in their immediate area. Traffic advisories (TAs) provide a visual representation of the proximate traffic to assist flight crew to sight that aircraft. Resolution advisories (RAs) provide recommended vertical escape manoeuvres (either climb or descend) to either increase or maintain existing vertical separation between aircraft. When the two aircraft involved are capable of RAs, ACAS uses data from both aircraft to determine the best solution and issues coordinated and complimentary RAs to the flight crew – one to climb and the other to descend. Consequently, flight crew are taught to respond to an RA regardless of any instruction from a controller.
The collision system logic is complex and is based on sensitivity levels, time intervals to the closest point of approach and the size of the protected volume around the aircraft. Critically, the sensitivity level is based on the altitude of the aircraft and, below 1,000 ft above ground level, RAs are inhibited and TAs are only issued when the proximate aircraft is within 20 seconds to the closest point of approach. In this occurrence, with Melbourne Airport at 434 ft, RAs would not have been issued when the aircraft were below 1,434 ft, i.e. during the time of their closest proximity.
ACAS is considered the last line of defence against a mid-air collision and should not be relied on as a separation method.
Terrain awareness and warning systems
Regular public transport aircraft are also fitted with terrain awareness and warning systems (TAWS). This system relates aircraft position, which should be from a GPS source which can be internal to the equipment or fed from the aircraft flight management system, to an almost worldwide terrain/obstacle/airport database which the equipment manufacturer regularly updates. A comprehensive set of reliable cautions and warnings can be generated which use both the radio altimeter and relative position. TAWS provides a forward looking terrain avoidance function that looks ahead of the aircraft along and below its lateral and vertical flight path and provides suitable alerts if a potential controlled flight into terrain threat exists.
Like the ACAS, a TAWS is considered the last line of defence against controlled flight into terrain and should not be relied on as a separation method.
Previous occurrences
In October 2011, at Melbourne Airport, at night and during LAHSO, an aircraft on final to land on runway 34 conducted a missed approach while another aircraft was landing on runway 27. As the aircraft in the missed approach was below the MVA, the controller was unable to issue a radar vector to ensure separation. The occurrence was reported but ATSB did not investigate.
At night on 5 July 2015, three aircraft came into unsafe proximity during take-off and landing at Melbourne Airport, Victoria. Shortly afterwards, one aircraft was radar vectored in a missed approach while below the minimum vector altitude (MVA). This analysis discusses the relevant controller actions and the organisational issues identified during the investigation.
Use of runway 34 for off-mode departures
Sequencing for arriving aircraft at Melbourne Airport has been computerised to ensure consistency and efficiency. The sequencing tool, MAESTRO, is used by Airservices at a number of airports and uses the actual position and speed information from their surveillance system to determine each aircraft’s landing runway and position in the sequence. This information is displayed to the controllers to enable them to use speed control, vectoring or holding to achieve an orderly traffic flow.
When land and hold short operations (LAHSO) are in place for runways 27 and 34, both runways are available for arriving aircraft, but only runway 27 is available for departing aircraft. Some larger aircraft, however, require runway 34 for departure due to its greater length. Additionally, runway 34 can be more attractive to departing aircraft due to a shorter taxi distance, or the runway being better aligned to their departure direction.
MAESTRO builds a gap into the runway 27 arrival sequence to allow for departing aircraft. Aircraft departing from runway 34 are considered off-mode during LAHSO, and a controller must fit departures into the arrival sequence based on their best judgement. For the aircraft involved in this occurrence, runway separation requires that a landing aircraft cannot touch down until the preceding departing aircraft, using the same runway, is airborne.
On the night of this occurrence, in the gap between arrivals sequenced to runway 34, one off‑mode departure had already used runway 34 prior to the B777 being lined up. Though the flight crew of the B777 had received the current Automatic Terminal Information Service[22] stating that LAHSO were in use, being an international operator, the flight crew may not have been aware that both runways at Melbourne Airport were being used for simultaneous arrivals and they were not told about the B737s on final for both runways.
In a statement, the captain of the aircraft on final for runway 27, VH‑VXS (VXS), reported he had heard the instruction to the B777 for an immediate departure. After observing the preceding aircraft depart from runway 34, he believed that his aircraft would be in close proximity to the B777 when they landed, so he had asked the first officer to prepare for a missed approach. Shortly after, and having determined that there was insufficient spacing with the B777, the captain instructed the first officer to initiate a missed approach as the B737 was approaching 500 ft above ground level.
The coordinator became concerned about the sequence when he realised that the flight crew of the B777 had not been advised of the B737 (VXS) going around from final runway 27. Due to the limitations of human vision at night, judgement of distance is extremely difficult, and the coordinator was concerned that the B777 flight crew may have elected to initiate a rejected take-off if they perceived the B737 as a possible threat. If the B777 had rejected the take-off and remained on the runway, there may have been insufficient runway behind that aircraft for the landing roll of the B737 on final for runway 34, VH‑VYE (VYE). Additionally, the coordinator was concerned that there was a high probability that the runway separation standard would not be achieved between the B777 and VYE.
The coordinator communicated his concerns to the trainee tower controller and the tower OJTI. On receiving what he deemed an unsatisfactory response, and believing the situation to be safety‑ and time‑critical, the coordinator instructed the trainee tower controller to send VYE around. The trainee tower controller and the tower OJTI later reported that, as the B777 commenced the take-off roll, they also had concerns about the sequence and the potential for a loss of separation between the two aircraft using runway 34. However, immediately prior to that they both thought that the sequence, while ‘tight’, would work. In that context, if separation relies on an expected rate of aircraft ground movement that may not occur, it is prudent to have an alternative plan. This is more important if the involved aircraft is large and/or operated by international flight crew who may be less familiar with the airport. However, on this occasion the actions of the B777 flight crew were appropriate.
Given the specific LAHSO phraseology required to be used by the Tower controller, and the necessity for a read back by the flight crew of VYE of the restriction to hold short, there may have been insufficient time available for the trainee tower controller to clear both arriving aircraft to land. The trainee tower controller, on her first exposure to LAHSO, had about 29 seconds to:
issue a landing clearance to the flight crew of VYE, including the restriction to hold short of runway 27
receive a correct read back of the restriction from the flight crew
issue a landing clearance to the flight crew of VXS, including advice that VYE was landing on runway 34 but would hold short of runway 27.
Had the line-up and take-off clearance for the B777 been delayed, the two B737s would have landed under LAHSO and the B777 could have then departed without any time pressure. Alternatively, the provision of traffic information on the two B737s to the flight crew of the B777 would have made them aware of the traffic situation and provided the option of expediting their departure or remaining clear of the runway.
Unsafe proximity
Two aircraft arriving simultaneously for different runways during LAHSO are separated by the requirement that one aircraft lands and stops prior to the intersection of the runways. When one or both aircraft however, conduct a missed approach, another separation standard is required. The only available standard was visual. As both aircraft were tracking towards the runway intersection, the controller could not be assured that visual separation would be maintained as the judgement of distance at night is limited by the physiology of the human eye.
Airservices surveillance data showed that separation between the two B737s reduced to about 0.9 NM (2 km) and 900 ft as VXS crossed runway 34 in front of VYE, as VXS climbed in the missed approach on runway 27. At that time, VYE was also climbing, conducting a go-around from runway 34. The tower controller was responsible for maintaining visual separation; however, due to the limitations of its application at night, a surveillance (radar) separation standard of 3 NM (6 km) or 1,000 ft was arguably more appropriate.
As a clearance to land is also a clearance to conduct a missed approach, controllers should have a plan for such an eventuality and act on that plan in a timely manner.
The action of the coordinator in instructing the trainer tower controller to send VYE around changed what was a potential loss of runway separation into a loss of separation between airborne aircraft.
Radar vectors
Though VYE, while going around on runway 34, did not fly through the flight path of the B777 as it executed the go-around, it was 1.5 NM (3 km) behind the B777 instead of the required wake turbulence standard of 5 NM (9 km). The radar vector and caution were issued by the trainee tower controller to expedite the re-establishment of a standard. Additionally, the radar vector increased the divergence between the flight paths of the two B737s when VXS was 0.9 NM (2 km) ahead of VYE and 900 ft above, passing from the right to left.
When an aircraft is vectored by a controller, the responsibility for navigation and terrain clearance is transferred from the flight crew to the controller. A MVA is calculated to ensure terrain clearance at the stated minimum levels and vectoring below the MVA would only be conducted in an emergency situation. At the time of the occurrence, the coordinator believed that the situation was both time- and safety-critical, and he deemed that issuing a radar vector below MVA was the only course of action available, and that action had earlier been sanctioned by his manager.[23] As such, he told the trainee controller to issue the radar vector to the flight crew of VYE.
Hazard assessment and mitigation strategies
Following correspondence from the Civil Aviation Safety Authority (CASA) prior to October 2011 about concerns in relation to separating aircraft below the appropriate lowest safe altitude at night during two-runway operations at Brisbane Airport, Airservices had suspended that type of operation at Brisbane. As stated earlier,[24] in 2011 one of a LAHSO arrival pair at Melbourne Airport conducted a go-around at night and the controller was unable to radar vector to ensure separation. The day after the 2011 occurrence at Melbourne Airport, CASA again wrote to Airservices requesting an explanation as to:
… what safety precautions are in place to ensure the safety of aircraft participating in LAHSO at night and why this procedure should not be suspended at night until the safety study … is completed.
In a letter to Airservices a week later, CASA stated:
… the (air traffic management) system should not rely, as a primary means of defence, on vectoring or heading changes for (instrument flight rules) category aircraft at night that are below the appropriate minimum altitude.
The safety study referenced in CASA’s initial letter was published by Airservices in October 2012 and included two relevant hazards:
Hazard 901/1 – a go-around at night causing a loss of the ability of controllers to provide separation.
Hazard 901/10 – two aircraft perform a go-around.
At the time of the safety study’s publication, two controls had been put in place to address Hazard 901/1:
cloud ceiling increased to the MVA
the visibility standard increased to 8 km (4 NM).
Only the first of the following controls identified for Hazard 901/10, however, had been met:
Only conduct LAHSO at aerodromes and at times when a reasonable benefit is being realised and these times or conditions to be identified in (local instructions).
Formalise sequencing intervals or cut off distances to reduce likelihood of go-arounds during LAHSO caused by an occupied runway.
Implement procedures to reduce pilot initiated go-arounds due to unstable approach for which there is (a controller) attribution.
CASA continued to express concern in relation to aircraft separation following a go-around at night, early in 2013 providing a discussion paper again articulating concerns about the safety of aircraft below MVA and providing options, including the instigation of a stagger between LAHSO arrival pairs. In April 2013, Melbourne Tower controllers also expressed concerns and were advised by management that radar vectoring below MVA at night was acceptable as a last resort.
In January 2015, following a CASA audit of LAHSO at Melbourne Airport, they made the following observation:
To reduce the risk of aircraft in close proximity, CASA requests that Airservices review the procedures to achieve separation assurance following a double go-around, especially the ability of the tower controller to provide visual separation in certain meteorological conditions.
Airservices ‘noted’ the finding and determined that the issue was being considered in an extant review of LAHSO at Melbourne Airport.
Airservices suspended night LAHSO at Melbourne Airport in November 2015, 4 months after this occurrence. An Airservices survey of obstacles later confirmed that limited radar vectors below MVA did not pose a hazard to aircraft at night, and, in April 2016, CASA issued an exemption to Airservices to radar vector below MVA at night at Melbourne Airport as long as a number of conditions were met. The CASA exemption is limited to aircraft involved in LAHSO. That day, night LAHSO was reintroduced at Melbourne Airport. Another control instigated by Airservices in early 2016, though recommended by CASA in early 2013, was a stagger for arriving LAHSO pairs:
to reduce the risk of two aircraft being in ‘unsafe proximity’ (i.e. passing the runway intersection within 20 seconds of each other) in the case of a double go-around.
Though Airservices was aware of the hazard from at least October 2011, as noted by CASA, in early 2013 the only controls put in place or proposed were preventative in nature i.e. designed to reduce the risk of an aircraft conducting a missed approach at night during LAHSO at Melbourne Airport. Not until 2016 did Airservices put in place a recovery control[25] – a surveyed area where aircraft could be radar vectored when below MVA at night. Had Airservices pursued a recovery control after the 2011 occurrence, the radar vector issued by the trainee tower controller would have been in accordance with documented procedure and training, and would not have resulted in a breakdown of separation with terrain.
Compromised separation recovery training
At the time of this occurrence, the compromised separation recovery training for Melbourne Tower controllers was conducted in a simulator, using various scenarios relevant to Melbourne Airport.
Though one training scenario involved aircraft conducting missed approaches from both runways under LAHSO, the scenario was during daylight hours. As LAHSO is only conducted in visual meteorological conditions, during the day the controller can assign the responsibility for terrain clearance to the flight crew when radar vectors were issued below the MVA.
At night when radar vectoring, the controller must retain the responsibility for terrain clearance. No LAHSO-related simulator training scenarios were at night, though night-time scenarios have now been added.
From the evidence available, the following findings are made with respect to the unsafe proximity and radar vector while below the minimum vector altitude involving a Boeing 777‑31HER, registered A6-EBU, and two Boeing 737‑838s, registered VH‑VXS and VH‑VYE, at Melbourne Airport on 5 July 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The decision to clear the flight crew of A6‑EBU for an immediate take-off, combined with the aircraft’s slower than anticipated rate of movement, resulted in it coming into proximity with VH‑VXS and VH‑VYE.
The proximity between A6‑EBU, VH‑VXS and VH‑VYE resulted in the flight crew of VH-VXS on final for runway 27 electing to go around and the flight crew of VH-VYE on final for runway 34 being instructed to go around on the direction of the Melbourne Coordinator.
Although initiated due to a safety concern, the decision by the Melbourne Coordinator to instruct the crew of VH‑VYE to go around resulted in an airborne loss of separation compared to a potential loss of separation on the ground.
The simultaneous go-arounds conducted by VH-VYE and VH-VXS, sequenced to land on intersecting runways under land and hold short operations at Melbourne Airport, resulted in the controller issuing a radar vector to the flight crew of VH-VYE while the aircraft was below minimum vector altitude to assure surveillance and wake turbulence separation.
The radar vector issued at night to the flight crew of VH-VYE when no other options were available, though intended to ensure wake turbulence and surveillance separation behind A6‑EBU and separation assurance with VH-VXS, did not assure terrain and obstacle clearance.
The hazard associated with the inability to separate aircraft that are below the appropriate lowest safe altitude at night was identified but not adequately mitigated. This resulted in a situation where, in the event of a simultaneous go-around at night during land and hold short operations at Melbourne Airport, there was no safe option available forair traffic controllers to establish a separation standard when aircraft were below minimum vector altitude. [Safety issue]
Other factors that increased risk
The lack of night-time compromised separation training scenarios for the Melbourne Air Traffic Control Tower controllers increased the risk of the controllers responding inappropriately when aircraft were in proximity at night.
The automated sequencing system used by Airservices Australia at Melbourne Airport (MAESTRO) did not ensure that two aircraft would not arrive at the intersection of the runways at the same time during land and hold short operations, increasing the risk of unsafe proximity at the intersection.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 3 August 2015 at about 0410 Eastern Standard Time (EST), a Cessna 441 aircraft, registered VH-EQU, departed Scone Airport for a positioning flight to Illawarra Regional Airport (Wollongong Airport), New South Wales. The flight was to be conducted as a multi-crew operation with the pilot flying (PF) occupying the left seat, and the pilot monitoring (PM) occupying the right seat.
Prior to departure, the pilots conducted a pre-flight briefing noting that the weather forecast for the Wollongong area included a warning for severe turbulence below 8,000 ft. The departure and cruise were uneventful. After commencing descent into Wollongong, the PF briefed the PM for an area navigation (RNAV) instrument approach and landing to runway 16 (Figure 1). The approach was planned to be hand flown in darkness under clear skies with a westerly wind of 25–30 kt, reducing to a light breeze on the ground.
The aircraft arrived overhead position WOLND (Figure 1) at about 5,000 ft on descent to 3,700 ft. Due to the strong westerly wind, flying conditions were turbulent and the PF reported that it was quite difficult keeping the aircraft’s wings level. Approaching WOLNI, the PF levelled the aircraft and maintained 3,700 ft as planned. The aircraft was then slowed down to permit the extension of flap and landing gear.
Figure 1: Cessna 441, VH-EQU
Source: Aircraft owner, modified by the ATSB
In accordance with the approach, the PF recommenced descent at 2.2 NM prior to position WOLNF. Due to the steeper than normal approach path angle (3.7 degrees as opposed to the usual 3.0 degrees), the PF reported establishing a descent rate of about 1,000 feet per minute (fpm). The PM reported that they were expecting a descent rate of about 900 fpm. Air traffic control surveillance data showed the descent rate established was somewhere between 1,000 and 1,500 fpm.
Shortly before WOLNF and as the aircraft approached 2,700 ft, the PM called ‘two thousand seven hundred’ with the expectation that the PF would maintain that altitude until passing WOLNF. However, the descent continued and a few seconds later, the terrain alerting and warning system (TAWS)[1] generated visual and aural ‘CAUTION-TERRAIN’ alerts. These alerts were generated as the system detected that the flight path was projected to come within 300 ft of an obstacle or terrain.
Figure 2: Wollongong RNAV(GNSS) approach to RWY 16 showing approximate flight path profile (green/red dotted line) based on air traffic control surveillance data
Source: Airservices Australia, modified by the ATSB
Pilot flying comment
The PF’s company duties included aircraft charter pilot and flight instructor. The PF’s flying experience included 230 hours operating Cessna 441 aircraft (16 hours in the last 90 days) and 6,930 total flying hours.
The PF recalled working hard trying to keep the aircraft’s wings level, which may have distracted them from monitoring the descent profile adequately. The PF recalled thinking that they may have been slightly low on profile approaching WOLNF, but was startled when the terrain warning sounded. The PF had not participated in any TAWS training, even though they had flown the aircraft (fitted with TAWS equipment) for the previous 12 months.
Pilot monitoring comment
The PM company duties included aircraft charter pilot and flight instructor. The PM’s flying experience included 350 hours operating Cessna 441 aircraft and 3,400 total flying hours.
The PM believed that the when the TAWS alert activated, the aircraft was at an altitude somewhere between 2,600 ft and 2,500 ft and about 0.5 NM before WOLNF. The time between being below 2,700 ft, having the TWAS alert and an appropriate response was less than 10 seconds.
The PM reported having completed TAWS training with a previous employer. The PM believed that following the TAWS warning, they should have applied full power, climbed at maximum rate and conduct a missed approach in accordance with the operator’s procedures.
Fatigue management
Prior to the flight, both pilots had completed 2 days free of duty. They reported being well rested and obtaining about 8 hours sleep each night.
On the morning of the flight, the pilots reported waking up around 0300. They advised that they generally found it counterproductive to try and get to sleep early and therefore only received about 5 hours of sleep.
Despite the limited amount of sleep, both pilots reported being alert during all stages of the flight.
ATSB comment
The aircraft was fitted with a terrain awareness and warning system (TAWS) designed to reduce the risk of flight into terrain. While a TAWS was not required for the particular type of operation, the lack of TAWS training probably explains the nature of the PFs response to the terrain alert.
Pilots and operators of aircraft are encouraged to be appropriately trained in the use of all equipment fitted to their aircraft.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that all pilots now receive TAWS training.
Safety message
Due to the early start combined with inadequate sleep the night before, despite reporting otherwise, the pilots were likely fatigued. Pilots need to be aware that obtaining less than 7-8 hours sleep a night increases the risk of operating with a level of fatigue known to have a demonstrated effect on performance.
Pilots also need to consider the effect flying in the early hours of the morning has on their performance. Their body is in a circadian low period which could lead to periods of impaired alertness and delayed reaction times.
The ATSB continues to be concerned about flight below minimum descent altitudes. When conducting an approach in instrument meteorological conditions, which includes darkness, pilots must ensure the approach is conducted in accordance with the prescribed procedure. In this case, the pilots were required to manage the vertical profile to ensure the aircraft remained at or above the minimum descent altitude, thereby ensuring clearance from terrain and obstacles.
Descent below the minimum descent altitude compromises the minimum terrain clearance requirements and increases the risk of controlled flight into terrain (CFIT).
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 12 June 2015, the crew of a Boeing B737-300, registered VH-NLK, were conducting a non-directional beacon/distance measuring equipment (NDB/DME) approach into Kosrae Airport in the Federated States of Micronesia. The flight was the inaugural regular public transport (RPT) flight for Nauru Airlines into Kosrae. During the approach, at night and in instrument meteorological conditions, the aircraft descended below the minimum descent altitude and three enhanced ground proximity warning system (EGPWS) ‘too low terrain’ alerts were triggered. A go-around was performed prior to the aircraft reaching the missed approach point. During the go-around, the airspeed decayed and required the pilot to use full thrust. The flight crew identified and corrected the barometric pressure setting and the subsequent approach and landing into Kosrae were uneventful.
What the ATSB found
The flight crew did not complete the approach checklist before commencing the non-precision NDB approach into Kosrae, resulting in the barometric pressure setting on the altimeters not being set to the local barometric pressure. This resulted in the aircraft’s altitude being lower than what the pressure altimeter was indicating to the pilots. The aircraft descended below the EGPWS terrain clearance floor profile for the Kosrae runway, resulting in three separate EGPWS alerts.
Terrain clearance assurance was eroded further after receiving the first two EGPWS alerts by the flight crew not correcting the flight profile. The crew's belief that the EGPWS alerts were due to a decreased navigational performance and not terrain proximity led to the crew’s decision to inhibit the first EGPWS alert and not correct the flight path.
The flight crew initiated a missed approach when they lost visual contact with the runway. The captain was experiencing fatigue and the flight crew had an increased workload and stress due to the inaugural RPT flight into Kosrae at night in rapidly deteriorating weather. As a result, the crew’s decision making and task execution on the missed approach were affected, and the aircraft state, airspeed and attitude were not effectively monitored by either crew member.
The ATSB also found that there were established risk factors associated with Kosrae at the time the operator commenced regular public transport operations into Kosrae. The only instrument approach available for use was an offset procedure based on a non-precision navigation aid. The risk associated with this type of approach was amplified due to the need to use a 'dive and drive' style technique instead of a stable approach path, and that it required low level circling manoeuvring from the instrument approach to align the aircraft with the runway. Furthermore, there was very high terrain in close proximity to the runway and the airport did not have a manned air traffic control tower.
What's been done as a result
Following this occurrence, the operator has reviewed and changed procedures relating to:
increased time for flight crew on non-standard/non-routine activities during their cyclic training program
reviewed and included control column checklists, which includes the descent and approach checklist, with tactile indicators
included two-engine go-arounds in simulator sessions
reviewed and improved awareness of QNH setting procedures and human factors aspects of briefings and line checks.
Safety message
This occurrence highlights the importance of flight crews declaring any instances of acute fatigue and stress-inducing circumstances that may have an impact on their flying performance. Operators also need to remind flight crew of the importance of their decisions with regards to their fitness to fly. For flight crews, the importance of completing approach checklists and monitoring the approach at safety critical times is emphasised. For operators, the occurrence highlights the importance of incorporating dual-engine go-arounds into simulator training sessions.
The occurrence
On 12 June 2015, a Nauru Airlines[1] Boeing 737-300 aircraft, registered VH-NLK, operated a scheduled passenger flight originating in the Republic of Nauru and transiting Tarawa, Republic of Kiribati, and Marshall Islands Airport, Majuro atoll, Republic of the Marshall Islands, to Kosrae Airport and finally Pohnpei Airport, both in the Federated States of Micronesia (FSM). This was the operator’s inaugural scheduled regular public transport service to Kosrae and Pohnpei. Travelling on-board were the Nauruan President, the Nauruan Minister of Aviation, and the Chairman of the Board of Directors of Nauru Air Corporation. In the six weeks preceding this flight, the operator had flown three charter flights to the FSM airports. The captain also stated that he had flown a couple of charter flights (during the day) into Kosrae before this inaugural scheduled service.
The flight was originally scheduled to leave Nauru at 0230 Coordinated Universal Time (UTC) (1430 Nauru Time).[2] However, a technical issue with the original aircraft led to a change to VH‑NLK. This resulted in the aircraft departing 60 minutes late. The flight crew, comprising of a captain and first officer, originated in Nauru having been positioned there from their base in Brisbane, Queensland, the day before.
The sector from the Marshall Islands to Kosrae was delayed a further 17 minutes due to ground handling issues. The flight departed after last light at 0740 and the planned flight time was 1 hour 19 minutes. The approach and landing at Kosrae was at night.
For this sector, the captain was the pilot flying, and the first officer was the pilot monitoring.[3] During the climb to the planned cruising altitude of flight level (FL)[4] 360, in accordance with standard procedures, the flight crew selected the standard atmospheric pressure of 1013 hPa on the altimeters.
The flight crew stated that, prior to commencing the descent for Kosrae, they obtained the weather and the local QNH.[5] The weather had deteriorated from that forecast (see section titled Meteorological information). The flight crew also stated that, during the descent and approach, the local flight information service radio operator[6] provided a considerable number of weather updates on the local airport conditions at Kosrae. Visibility was around 3 NM, rain showers were in the area with low cloud and wind ‘pretty much straight down the strip for (runway) 05’. The captain, as pilot flying, conducted the briefing for the non-directional beacon (NDB)[7]/distance measuring equipment (DME)[8] approach to runway 05 (Figure 1). The captain stated that, at this time, they had made special mention of the unusually low transition level[9] of FL 55. The captain stated that at most airports they operated into, the transition level was between FL 110 and FL 130.
The crew then completed the descent checklist. They had decided that, based on the expected weather conditions, they would make two approach attempts, and if they could not land, would divert to Nauru Airport, the nominated alternate airport. Prior to descending below the transition level, the crew did not complete the approach checklist, which consisted of one item: set the altimeters to the local QNH and crosscheck them. Leaving the altimeters’ subscale set to the standard atmospheric pressure setting of 1013 hPa, and not setting the subscale to the local barometric pressure of 1007 hPa, resulted in the indicated altitude over-reading, such that when the altimeter indicated 500 ft, the aircraft’s actual altitude was about 320 ft above the mean sea level.
Figure 1: Kosrae NDB/DME-A approach chart with the transition altitude and level, and missed approach point highlighted
Source: Jeppesen – annotated by ATSB
At about 0856, the aircraft passed overhead the NDB at 5,000 ft, and continued the descent, tracking outbound on a heading of 300°, to about 10 NM from the NDB (10 DME). The flight crew were controlling the aircraft through the auto-flight systems, with an autopilot and the autothrottle engaged. At this point, the crew turned the aircraft left, and at 0901, the aircraft intercepted the inbound track to the NDB at about 1,800 ft. The crew selected the landing gear down at 1,500 ft, and flap 15 at 1,250 ft.
The crew stated that they established visual contact with the runway as the aircraft passed through 900 ft indicated altitude, about 5 NM from the DME. At about 740 ft indicated altitude, the crew selected flap 25. The crew elected to delay selection of the nominated landing flap of 40 degrees until they made positive visual contact with the runway. They did not subsequently select flap 40 on that approach.
As the aircraft descended to the minimum descent altitude for the approach of 500 ft, the captain selected the altitude hold (ALT HOLD) mode to level the aircraft at 500 ft indicated altitude. At 0903:13, an Enhanced Ground Proximity Warning System (EGPWS) Terrain Clearance Floor (TCF) alert (see section titled EGPWS alerts) sounded, and lasted for 5 seconds (Figure 2). The aircraft was over water, at 368 ft radio altitude.[10] The crew reported that they were in visual meteorological conditions (VMC) at night, with the runway lights in sight. The crew stated that, at the time, they believed the EGPWS alert was due to a ‘map shift’ in the aircraft’s navigation position (see section titled The navigation function of the flight management system). The flight crew selected ‘terrain inhibit’, which cancelled the current EGPWS TCF alert. The crew were not aware that the EGPWS had its own internal GPS.
At 0903:19, the aircraft was at 4.31 DME, 480 ft indicated altitude and 340 ft radio altitude, and descending at about 313 fpm, when the EGPWS TCF alert again sounded, and lasted for 12 seconds. The aircraft maintained 480 ft indicated altitude for about 12 seconds, before descending again.
Figure 2: Approach profile annotated with indicated and radio altimeter readings highlighting the difference between the displayed and actual altitudes plus the three EGPWS Terrain Clearance Floor alerts and the Terrain Inhibit alert cancellation activation
Source: FAA and ATSB
The crew reported losing visual reference with the runway when the aircraft was about 3 NM from the DME. In response to losing visual reference, the captain disconnected the autopilot and autothrottle and pressed the take-off/go-around (TOGA) switches on the thrust levers. At this time the recorded aircraft pitch angle was 9.5°. The flight data recorder data showed that TOGA was selected at 0903:47, at 448 ft indicated altitude, or 304 ft radio altitude (see Figure 3), and the aircraft was about 3.5 NM from the DME. At this time, the aircraft’s computed airspeed reduced to 129 kt.
The captain stated that he pressed the TOGA switches on the thrust levers once. In the Flight Director engaged go-around mode, one TOGA switch press results in a reduced thrust autothrottle setting, and two presses of the TOGA switch advances the autothrottle to full go-around thrust (see section titled Autothrottle go-around modes). The crew stated that the aircraft pitch angle was initially raised to 15°, however, the captain observed the airspeed decay and pitched the aircraft down to increase the airspeed. The first officer stated he called ‘sink rate’ twice. The captain then realised and rectified the situation, depressing the TOGA switch a second time commanding full go-around thrust.
At 0903:53, the aircraft was at 3.3 DME, and the third EGPWS TCF alert sounded, which lasted for 10 seconds. The aircraft was then at 384 ft indicated altitude, or 244 ft radio altitude, and descended 5 seconds later to its lowest radio altitude of 200 ft before climbing.
At 0904:04, the flaps were retracted to 15° and the aircraft reached its maximum pitch up angle of 16°. Two seconds later, the flaps were retracted to 10°. From the time the captain set the thrust to TOGA until the aircraft was stabilised on the missed approach path (at about 0905), the recorded aircraft pitch angle varied from -0.35° to +16°.
Figure 3: Selected flight data recorder data plot
Source: ATSB
When the aircraft was established on the missed approach heading, the captain continued a climb to 4,000 ft. After stabilising the aircraft in the missed approach, the crew identified that the altimeters were still set to 1013 hPa and corrected them to the local area QNH. After repositioning overhead, the NDB at 4,000 ft, the crew then conducted a second approach and the aircraft landed at Kosrae without further incident.
The captain held an Air Transport Pilot (Aeroplane) Licence, a multi-engine command instrument rating and a Class 1 Aviation Medical Certificate. The captain had a total of 16,600 hours of aeronautical experience, of which 16,100 hours were on the Boeing 737.
The captain’s last instrument rating had been completed on 14 January 2015 and the last flight review line check completed on 14 February 2015.
The captain reported sleeping well on the nights of 9 and 10 June 2015, obtaining 9.5 and 7 hours on the respective nights. On arriving at Nauru (11 June), he discovered that his mother was very ill. The night prior to the Kosrae duty, he had spent a significant amount of time at the hospital with his mother. The captain stated that he tried to get a few hours decent sleep prior to going to work, achieving five to six hours sleep between 0100 and 0700 local.
In interview, the captain stated that he had not informed the company of the situation with his mother. Some of his colleagues knew that his mother was sick, but not the extent of her illness. The captain stated that he believed it might have led to fatigue because he did not have a good sleep the night prior.
The captain stated that, in hindsight, it would have been better to remove himself from duty, but stated that it was his turn (to be the Nauruan captain flying for Nauruan dignitaries). He saw his mother every time he flew to Nauru and took the opportunity to go see her when he was requested to captain the inaugural Nauru Airlines scheduled service into the Federated States of Micronesia.
The first officer
The first officer held an Air Transport Pilot (Aeroplane) Licence, a multi-engine command instrument rating and a Class 1 Aviation Medical Certificate. The first officer had a total of 3,300 hours of aeronautical experience, of which 1,600 hours were on the Boeing 737.
The first officer’s last instrument rating had been completed on 8 October 2014 and the last line check completed on 3 March 2015.
The first officer reported obtaining 8 hours sleep on the night of 9 June 2015 and 5 hours on the night of 10 June. He reported getting a 2-hour nap as a passenger during the positioning flight from Brisbane to Nauru on 11 June and then obtained 12 hours sleep the night prior to the occurrence flight. The first officer reported feeling well rested.
Recent duty
The captain and first officer were based in Brisbane. The captain had not had a duty period since 5 June and had time off for the days prior to the positioning flight to Nauru on 11 June. The first officer had not had a duty period since 8 June and flew a positioning flight as a passenger from Nauru to Brisbane on 9 June, had 10 June off, and flew on the positioning flight to Nauru on 11 June.
Relevant aircraft systems
The navigation function of the flight management system
The aircraft was equipped with a flight management system (FMS) to assist the flight crew in managing the aircraft’s automatic navigation systems, and associated flight management functions. Inputs from two inertial reference systems (IRS) and specific ground-based radio navigation aids, through a number of FMS controlled radio navigation receivers,[11] enabled the FMS to determine the aircraft’s position. The aircraft was not fitted with a global positioning system (GPS) navigation unit. The accuracy of the FMS navigation data was dependent on the types of navigation aids used to generate navigation fixes, with specific combinations of radio navigation aids providing the most accurate data. However, when these were not available the FMS used IRS position information only. Due to the nature of the IRS, the accuracy of this source of position information decreased with elapsed time.
As FMS navigation accuracy decreased, an effect known as ‘map shift’ became prevalent. Map shift is where the navigation data presented to the pilot on the navigation display shifts from their actual positions as a result the inaccuracy of the FMS derived navigation position. Map shift is a common symptom of the FMS having an extended period of being reliant on IRS for navigation data. With respect to the occurrence, the positional data from the FMS was probably IRS based for the entire flight, due to the absence of the required navigation aids for that sector.
The flight data recorder’s recorded position information was sourced from the FMS derived aircraft position. There were inaccuracies identified in the FMS position from the commencement of the flight, with the runway position at take-off being about 810 m to the south-west of the actual runway threshold.
Enhanced ground proximity warning system (EGPWS)
VH-NLK was fitted with a ‘Class A’ terrain awareness and warning system that provided a terrain awareness display as well as the functions and features of a ground proximity warning system (GPWS). The unit, designated as being an enhanced ground proximity warning system (EGPWS), provided two types of alerts:
Look-ahead terrain alerts: the EGPWS function monitored the aircraft’s position, acquired through a self-contained global positioning system (GPS) receiver, against terrain proximity using an internal worldwide terrain database. If there was a potential terrain conflict, alerts were provided based on estimated time to impact.
GPWS type alerts: based on radio altimeter height and combinations of barometric altitude, airspeed, glide slope deviation, and aircraft configuration.
The look-ahead terrain alerts and radio altimeter height-based alerts were prioritised based on the level of hazard and the required crew reaction time.
The EGPWS recorded a significant selection of aircraft data associated with an alert, including GPS position and radio altimeter height, as well as the type of alert triggered. The EGPWS unit triggered three ‘TOO LOW TERRAIN’ alerts during the approach into Kosrae, at 0903:13-17, 0903:19-29 and 0903:54 to 0904:02. These alerts were terrain clearance floor (TCF) alerts. The data also identified a ‘terrain inhibit’ parameter following the first alert.
The EGPWS based TCF function used a terrain clearance envelope around the airport runway to provide protection against controlled flight into terrain situations where the existing GPWS unsafe terrain clearance protections provide limited or no protection. TCF alerts are based on current aircraft location, destination runway centre point position, and radio altimeter height. TCF is active during take-off, cruise, and final approach.
When an aircraft penetrates the TCF alert envelope, the aural message ‘TOO LOW TERRAIN’ will occur. The initial penetration of the TCF alert envelope was the trigger for the first EGPWS alert. This aural message will also occur post the initial envelope penetration for each 20 per cent degradation in height. This was the trigger for the second EGPWS alert. EGPWS cockpit alert annunciations remain illuminated until the alert envelope is exited. The EGPWS data indicates that the aircraft exited the TCF envelop after the second alert, but then re-entered the envelope after the flight crew had commenced the missed approach manoeuvre. This was the trigger for the third EGPWS alert. At the time of the three alerts, the aircraft configuration was gear down with flap 25. This was considered to be a landing configuration.
There were two EGPWS indicators and controls relevant to the unit’s operation. The instrument panel (Figure 4) includes the PULL UP warning light in the field of vision of both pilots.
The lower right section of the instrument panel included the GPWS controls. The terrain inhibit switch (7) in the NORM (guarded position) enabled EGPWS features. When selected to TERR INHIBIT, terrain/obstacle alerting was inhibited. Aircraft flight data identified that the first EGPWS alert had an associated inhibit signal. This inhibit signal was due to the flight crew selecting the terrain inhibit switch to ON following the first warning alert.
The Boeing 737 flight crew operations manual, which was the company’s approved reference, stated that the response for the TCF alerts was to correct the flight path, aircraft configuration, or airspeed. The manual also stated:
If a terrain caution occurs when flying under daylight VMC, and positive visual verification is made that no obstacle or terrain hazard exists, the alert may be regarded as cautionary and the approach may be continued.
The flight crew’s response to the first two EGPWS alerts did not appear to comply with the procedural requirements. The alerts did not occur in daylight VMC conditions and the crew’s visual reference with the runway or terrain was reported as intermittent. The crew’s response was stated to be due to the belief that the alert was the result of map shift issues and not because of ground proximity.
Comparison of FMS vs EGPWS position
The FMS did not have access to the EGPWS GPS information. The FMS recorded position of the aircraft at the time of the EGPWS alerts was compared against the position data recorded by the EGPWS. From the image below (Figure 5), it is evident that there was an FMS position error (approximately 1,065 m NW of the GPS position) at the time of EGPWS alerts. After the go-around, the FMS data appears to drift significantly (2,090 m north-north-west at landing), providing less reliable position information. It is important to note that the FMS derived position data was not required for the approach that was undertaken.
Figure 5: The flight data recorder data is shown below in blue and the EGPWS data is in red showing that, prior to the go-around, there was a 1.0 NM positional error to the flight management computer determined position
Source: Jeppesen, modified by the ATSB
Autothrottle go-around modes
There were two autothrottle go-around modes, the autopilot (AP) go-around (which required dual AP operation) and Flight Director (FD) go-around (which is the reversion mode when both APs were not engaged). The FD go-around required the aircraft to be in flight and below 2,000 feet radio altitude, and not in the take-off mode. The flight crew operations manual included the following discussion concerning the FD go-around mode:
With the first push of either take-off/go-around (TOGA) switch, the:
autothrottle (if armed) engages in go-around and advances thrust toward the reduced go-around N1[12] to produce 1,000 to 2,000 fpm rate of climb
autothrottle engaged mode annunciation on the flight mode annunciator (FMA) indicates go-around
AP (if engaged) disengages
pitch mode engages in TOGA and the pitch engaged mode annunciation on the FMA indicates TOGA
FD pitch commands 15 degrees nose up until reaching programmed rate of climb, and thereafter commands manoeuvring speed for each flap setting based on maximum weight calculations.
With the second push of either TOGA switch (if autothrottle engaged and after autothrottle reaches reduced go-around thrust), the autothrottle advances to the full go-around N1 limit.
The captain stated that he was not used to conducting a reduced thrust two engine go-around because he had always practiced a one-engine go-around in the simulator, which automatically provided full engine thrust from a single TOGA switch push. The captain stated that he had conducted a few full thrust go-arounds previously but in VMC conditions.
The Kosrae NDB/DME approach
The instrument approaches available for Kosrae were RNAV (GPS) approaches to runways 23 and 05, and the non-directional beacon (NDB) /distance measuring equipment (DME) approach. As VH-NLK was not fitted with GPS navigational equipment, the only instrument approach available to the flight was the NDB/DME approach.
The NDB/DME approach was classified as a circling approach only, due to the final approach course being offset from runway 05 heading by more than 30°. The missed approach point for this approach was at 2.9 DME with a minimum descent altitude of 500 ft.
According to the recorded data, prior to becoming established on the instrument approach, the aircraft overflew the NDB, turned onto the missed approach heading of about 300°, and then tracked outbound to the 10 DME arc before turning inbound on the 264° radial (see Figure 5). The recorded flight data identified that the aircraft descended below the published profile of 900 ft at 6.7 DME rather than 5 DME. The aircraft was required to remain at 500 ft until established on the final approach path for landing. However, the altimeter recorded 432 ft (radio altitude height of 306 ft) when the captain commenced the go-around.
Nauru Airlines procedures
Transition level
The flight crew reported that the transition level of FL 55 at Kosrae was lower than other ports in their network, which were typically FL 110 to FL 130. The crew stated that they had briefed the lower transition level prior to top of descent and had reminded themselves of the lower level while passing through FL 130. They also stated that the lower transition level, combined with increased crew workload on the approach due to deteriorating weather, led to the crew forgetting the approach checklist, therefore not setting the correct QNH.
The operator’s flight crew operating manual stated that setting the QNH during the descent required the local QNH to be set as the aircraft approached the transition level. Each pilot was required to call the exact altimeter indications and compare the indications to detect any discrepancy between instruments. Positive altimeter calls were also required to be carried out during the descent at FL 150, the transition level, and at 5,000 ft above aerodrome elevation.
As the local QNH was reported to be 1007 hPa and the crew left the QNH set at the standard pressure of 1013 hPa, the pilots’ altimeters were over-reading by 180 ft during the approach.
Instrument approach criteria
The company’s operations manual stated that ‘all approaches are to be flown in a stabilised manner with the aircraft established in the correct configuration no later than 1,000 ft above ground level for instrument approaches and 500 feet above ground level for visual approaches’.
The operations manual also required an NDB/DME approach to be flown using raw data.[13] A runway aligned GPS-based approach was available at Kosrae. At the time of the occurrence, the operator had established operational procedures for the use of GPS as the primary navigational aid for GPS-based approaches,[14] but the Civil Aviation Safety Authority had not authorised the operator to conduct RNAV (GPS) approaches.
The flight crew training manual (FCTM) specified that an approach was considered stabilised only when a number of criteria were met. Notably, these included:
the aircraft requiring only small changes in heading and pitch to maintain the correct flight path
the aircraft being in the correct landing configuration
all briefings and checklists having been conducted.
It also stated that unique approach procedures or abnormal conditions resulting in a deviation from the above elements required a special briefing. This was the case with the Kosrae approach, which required the flight crew to use a ‘dive and drive’[15] technique due to the unique structure of the approach, and then circling to align the aircraft to the landing runway.
The FCTM also contained recommended procedures for the conduct of circling approaches. The FCTM procedures included that the circling approach be conducted with the aircraft configured with landing gear down and flap 15 selected. The aircraft was required to be in the final landing configuration before the aircraft was established on final approach.
The captain assessed that, due to the need to conduct circling manoeuvring following the approach, there was a need for a special briefing. The approach required pitch and power changes due to the need to manoeuvre the aircraft from the missed approach point of the instrument approach to a point where the aircraft would be aligned with the runway for the final approach to landing. The manoeuvring was the result of the offset between the instrument approach course and the runway. There was also the requirement that this manoeuvring be conducted as a visual segment, and the consideration that the visual slope guidance would only provide useable information once the aircraft was aligned with the runway.
The circling approach procedure resulted in the delayed selection of flap 25 until the aircraft was at 740 ft (altimeter) and landing flap not being selected during the approach. The crew reported initially gaining visual reference with the runway environment at 900 ft. While the aircraft did not meet the operator’s stabilised approach criteria, the unique nature of the circling approach and the captain’s special briefing removed the need for strict compliance with these requirements.
Meteorological information
Sunset at the Marshall Islands Airport (departure aerodrome) was 0652 with the end of civil twilight at 0715. Sunset at Kosrae Airport was 0723 with the end of civil twilight 0745.
The terminal forecast for Kosrae held by the flight crew was issued on 11 June at 2339 UTC. It covered the period of 12 June from 0000 to 2400 UTC and stated the wind direction as 80° at 7 kt, visibility greater than 6 statute miles and showers in the vicinity of the aerodrome (not at the aerodrome, but between 5 to 10 statute miles from the aerodrome). The weather forecast provided to the flight crew did not require an alternate to be planned; however, the flight crew reported carrying sufficient fuel for a diversion to Nauru.
An aerodrome weather report (METAR) for Kosrae was issued on 12 June at 0750 UTC, approximately 70 minutes prior to the aircraft arriving overhead Kosrae. It stated the wind direction as 80° at 10 kt, visibility greater than 10 statute miles. It also stated that cloud was scattered at 1,500 ft and broken at 13,000 ft. The METAR did not include a trend forecast and there was no other indication that the local weather conditions would deteriorate.
The flight crew stated that, as they approached Kosrae, the weather deteriorated rapidly. They received regular updates on the changes from the Kosrae flight information services (FIS). During the approach, visibility began to fluctuate at or below 3 to 3.5 NM, the crew lost visual reference with the runway necessitating a missed approach. The flight crew reported that the FIS advised that the local barometric pressure was 29.74 in Hg (1007 hPa).
Flight data recorder information
The aircraft’s quick access recorder provided data regarding the aircraft’s pressure altimeter and the radio altimeter readings. Pressure altimeter information was sourced from the aircraft’s air data computer and was based on the standard pressure altimeter setting of 1013 hPa. A comparison of this pressure altitude information with the recorded radio altimeter information indicated that, on average during the approach, the aircraft’s height was about 120 ft lower than the pressure altimeter’s altitude reading.
Fatigue, workload and stress
Fatigue
Fatigue can have a range of adverse influences on human performance, such as slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and more lapses or errors of omission (Battelle Memorial Institute 1998). Gawron, French, and Funke (2001) contend mental, or cognitive, fatigue is more central to performance degradation than physical fatigue. They state that cognitive fatigue can be ‘inferred from decrements in performance on tasks requiring alertness and the manipulation and retrieval of information stored in memory.’ (p. 581).
Researchers (see Staal, 2004, for a review) have identified that visual scanning and attentional processes have been shown to be particularly sensitive to disruption from performance degradation due fatigue. In addition, most people generally underestimate their level of fatigue.
Sleep is vital for recovery from fatigue, with both the quantity and quality of sleep being important. It is generally agreed that most people need at least 7 to 8 hours of sleep each day to achieve maximum levels of alertness and performance. Some research has concluded that less than 5 hours sleep in the previous 24 hours is inconsistent with a safe system of work (Dawson and McCullough 2005) whereas other research has shown that having less than 6 hours sleep affects performance (Thomas and Ferguson 2010, Williamson and others 2011).
At the time of the occurrence, the operator managed fatigue through the processes of flight hour and duty time limitations as required under Civil Aviation Orders 48.0 and 48.1. The operator had developed a fatigue risk management system, however, it was in a draft stage and not approved for use by the Civil Aviation Safety Authority.
Workload and stress
Dismukes and Berman (2010) conducted research on flight crew checklist use and monitoring behaviour. These researchers found that most instances of failure to monitor the aircraft state or position resulted from competing concurrent task demands on the crew’s attention. Humans have a limited ability to divide attention among tasks and generally have to switch attention back and forth between tasks. This leaves an individual vulnerable to losing track of the status of one task while being engaged in another.
Workload has been defined as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. Workload represents the cost incurred by the human operator in achieving a particular level of performance’ (Orlady and Orlady, 1999, p.203). An individual has a finite set of mental resources they can assign to a set of tasks. These resources can change given the individual’s experience and training and the level of stress being experienced at the time. An individual will seek to perform at an optimum level of workload by balancing the demands of their tasks. When workload becomes excessive the individual must, as a result of their finite mental resources, shed tasks.
Under conditions of stress, an individual’s attention will channel or tunnel. Focus on peripheral tasks will be reduced and centralised on to main tasks. What differentiates a main task from a peripheral task depends on what the individual perceives to be of greatest importance or greatest salience. Tunnelling of attention can result in either enhanced performance or reduced performance, depending on the nature of the task and the situation. ‘When peripheral cues are irrelevant to task completion the ability to tune them out is likely to improve performance. On the other hand, when these peripheral cues are related to the task and their incorporation would otherwise facilitate success on the task, performance suffers when they are unattended’ (Staal, 2004, p.31).
Emotional states have been described as providing a third processing layer on top of cognitive and physiological levels. ‘Emotions play an important role in motivating people to initiate and maintain a task in the first place, but they may also interfere with cognitive processing. In particular, under time pressure or threatening conditions, the regulation of our emotions is critical for efficient task performance’ (Gaillard, 2001, p.626).
Research on risk associated with approach and landing
In the late 1990s, the Flight Safety Foundation established the Approach and Landing Accident Reduction (ALAR) task force. The task force was commissioned to, among other things, identify common factors in approach and landing accidents and serious incidents involving turbine powered aircraft of a weight greater than 5,700 kg, and develop processes and guidance to aid operators in the reduction of these types of occurrences.
The ALAR task force identified a number of factors that were significant and common to approach and landing accidents and serious incidents. Some of these factors were also present in this occurrence, including an approach in instrument meteorological conditions (IMC), at night, in an environment where radar was not available, and where the flight crew use a non-precision instrument approach procedure.
The guidance material produced by the task force included the ALAR Risk Awareness Tool (RAT). Designed to increase flight crew’s awareness of factors that can increase the risk of an accident during approach and landing, the RAT is designed to be integrated into the approach briefing normally conducted before commencement of the descent. There were a number of factors from the RAT that identified an elevated level of risk associated with the occurrence approach. These included:
no ATC approach service or airport tower service
non-precision approach, especially with a step down procedure or circling procedure
visual approach in darkness
hilly or mountainous terrain
visibility restrictions, such as darkness or instrument meteorological conditions.
The RAT also makes the following point:
Greater risk is associated with conducting a nonprecision approach rather than a precision approach, and with conducting an approach in darkness and in IMC rather than in daylight and in VMC. The combined effects of two or more of these risk factors must be considered carefully.
The RAT also promotes the use of the missed approach or go-around manoeuvre when the safety of the approach or landing has become marginal, stating that ‘[f]ailure to recognize the need for a missed approach and to execute a missed approach is a major cause of approach-and-landing accidents’.
On 31 March 2014, an Airbus A320 departed Auckland, New Zealand for a scheduled passenger flight to Gold Coast, Queensland. On departure from Auckland, where the local QNH was 1025 hPa, the crew selected the standard atmospheric pressure of 1013 hPa on the altimeters during climb to flight levels.
During the cruise, about 15 minutes prior to commencing the descent for the Gold Coast, the crew obtained the automatic terminal information service (ATIS) for Gold Coast and the captain wrote the details onto the take-off and landing data (TOLD) card, including the local barometric pressure of 1018 hPa. The crew then conducted the approach briefing, including a review of this information, which was entered into the flight management guidance computer (FMGC) for the approach.
Approaching transition altitude, the ‘BARO REF’ warning flashed, however, the captain was communicating with ATC, hence the page in the FMGC with the QNH displayed was not selected.
The captain then completed the communication with ATC and commenced the transition check by stating ‘transition’. At this time, the captain omitted to select the FMGC onto the flight plan page to display the QNH that had been entered. The first officer stated ‘set QNH 1025’ and the captain entered that into the second altimeter and the first officer entered the same value into the standby altimeter and a cross check confirmed that all three altimeters matched.
Passing about 1,000 ft AMSL, as the first officer completed the turn onto final approach, he observed the T-VASIS indicating a ‘fly-up’ profile. The radio altitude callout of 500 ft sounded and the first officer realised that the approach path was incorrect. When at about 159 ft above ground level, the EGPWS ‘TERRAIN’ warning sounded, and the first officer commenced the missed approach. The crew checked the QNH on the TOLD card and realised an incorrect QNH had been set.
International overview of go-around events
Although most go-arounds are conducted without significant problems, difficulties are experienced. As part of its detailed review of go-around issues, the French Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA) (2013) conducted a survey of flight crews from several French and British airlines. Key results included:
About 60 per cent of pilots indicated that they had encountered difficulties during the conduct of a go-around manoeuvre. The most common difficulties were capturing the go-around altitude, auto-flight system management, aircraft configuration management, coping with modifications to the flight path on ATC request and visual scan management.
About 85 per cent of pilots reported that they were adequately trained in go-arounds with one engine inoperative but almost half the pilots indicated that they were not sufficiently trained for go-arounds with all engines operating.
The BEA’s analysis of the survey results stated that a key problem was:
The sudden onset of new tasks, the need to perform vital, rapid and varied manoeuvres, and the rapid changes in the numerous parameters to be managed (controlled) in a limited period of time combine to make it difficult for a crew to perform a go-around that is not controlled right from the start.
In its conclusions, the BEA stated that ‘aeroplane state awareness during go-around’ type events involved a combination of factors, including time pressure and a high workload; and the low number of go-arounds with all engines operating performed by crews, both in-flight and in the simulator. The BEA issued a significant number of recommendations to the European Aviation Safety Agency relating to go-around issues.
While positioning the aircraft to commence the non-directional beacon/distance measuring equipment (NDB/DME) approach into Kosrae airport, Federated States of Micronesia, the approach checklist was not completed and so the altimeters were not set to the local barometric pressure. This resulted in the aircraft’s actual altitude being180 ft lower than the pressure altimeter’s reading. Three enhanced global positioning warning system (EGPWS) ‘Too Low Terrain’ alerts were triggered due to the aircraft's altitude being below the minimum terrain clearance.
The flight crew believed that the EGPWS alerts were due to decreased navigational performance and not terrain proximity. This led to the flight crew’s decision to inhibit the first EGPWS alert and not correct the flight path prior to their deciding to perform a go-around manoeuvre.
The captain stated that he was fatigued and the crew stated that they were experiencing increased workload. This appears to be due to the flight being the inaugural regular public transport flight into Kosrae, conducted at night in rapidly deteriorating weather. Fatigue, workload and stress appear to have affected the crew’s decision making and task execution on the missed approach.
This analysis will examine the type of approach procedure available to the flight crew for Kosrae, the operator’s operational procedures, the conduct of the go-around manoeuvre and the effects of fatigue, workload and stress on the occurrence.
Level of risk associated with the approach
The Flight Safety Foundation’s Approach and Landing Accident Reduction task force provided a number of focal points that were present in the occurrence approach into Kosrae, which in turn indicated an elevated level of risk associated with that approach.
Risk associated with the localised high terrain was mitigated by the aircraft having EGPWS based warning systems fitted. Risk factors of a night-time approach into an airport without a manned tower were the result of delays encountered over the previous sectors, issues that should be considered by the operator in a risk analysis for operations into Kosrae before commencing these operations. A further risk factor necessary for consideration prior to commencing operations into Kosrae was that there were only two types of instrument approaches: runway aligned GPS-based approaches, and the offset non-precision approach. As the occurrence aircraft was not fitted with equipment required for GPS based approaches, and the operator not approved to conduct them, the only option for operations into Kosrae was to conduct a non-precision approach. This elevated the risk associated with the approach, and that risk was further amplified by:
the approach necessitating a ‘dive and drive’ profile due to:
the offset of the final approach course from the runway heading
the location and height of the missed approach point, which was well below a normal 3 approach profile.
the need to conduct low level manoeuvring from the missed approach point to enable the aircraft to align with the runway.
The aircraft’s navigation system also represented a significant risk factor in the conduct of this approach. While the operator’s procedure required the use of raw navigational data for the approach, the use of an NDB as a primary approach aid is subject to several effects that can result in error, including the night effect, thunderstorm activity and localised high terrain, which were all potential sources of navigation error in this occurrence.
Further, due to the limited number of navigation aids available on the occurrence sector, the navigation system was dependent on inertial reference for position data. This will often result in the ‘map shift’ error being presented to the pilots, where the pilot’s navigation displays are significantly ‘shifted’ from the actual real-world position of the displayed data, and can contribute flight crew error. With respect to the occurrence flight, the flight crew incorrectly believed that the initial EGPWS alerts were the result of a ‘map shift’ error; however, a comparison between the aircraft’s quick access recorder data and the EGPWS GPS data identified a map shift error of about 1 NM seawards of where the aircraft’s actual position was.
The flight crew’s conduct of a briefing for the approach, and decision to perform a go-around when visual contact with the runway was lost, mitigated the risks to some extent.
Approach checklist
Prospective memory can be defined as the intention to perform an action in the future, coupled with a delay between recognising the need for action and the opportunity to perform it. A distinguishing feature of prospective memory is the need for an individual to remember that they need to remember something. Researchers (Dismukes, 2006) have identified that prospective memory issues may result in a failure to return to a task or procedure that has been interrupted, even when the task or procedure is habitual.
The crew had briefed the new transition level at top of descent and had briefly discussed the need to conduct the approach checklist on passing through the transition level when they were descending through FL 130 (the usual transition level). The crew had put a plan in place to complete the checklist. However, as they were flying over the non-directional beacon at FL 050 and were looking at the runway in preparation for the commencement of the approach, workload began to rise and they forgot to return to the approach checklist and complete it, as per a prospective memory error. Thus, as the aircraft descended through the transition level, the altimeters were not set to the local barometric pressure from the standard pressure setting of 1013 hPa and, as a result were over-reading the aircraft’s altitude by 180 ft. The aircraft’s actual height was, on average, 120 ft lower than the aircraft’s indicated altitude.
EGPWS warnings and crew response
The EGPWS issued a series of Terrain Clearance Floor (TCF) alerts during the NDB/DME approach into Kosrae. The EGPWS recorded data for a period around the EGPWS events. At the beginning of recording, the aircraft was 5.1 NM from the runway, with landing gear down, at a radio altimeter height of 663 feet and a vertical speed of -1,011 fpm. At approximately 19, 25 and 61 seconds after the commencement of the EGPWS recording, the EGPWS issued a ‘TOO LOW TERRAIN’ alert due to the aircraft’s penetration of the TCF envelope.
The EGPWS also recorded a ‘terrain inhibit’ parameter which corresponded to the pilot selection of the terrain inhibit feature. In the recorded data, the terrain inhibit was activated for two seconds, occurring four seconds after the beginning of the first TCF alert.
The flight crew stated that they heard the EGPWS warning prior to their reaching the missed approach point (MAP) and that they had the runway lights in sight although the visibility was fluctuating, and decided to keep going because they had a visual reference for the runway. Furthermore, the flight crew thought the warnings were due to map shift. Therefore, the flight crew believed the warnings were false and inhibited the first warning due to this belief.
The operator’s operations manual stated that, in instrument meteorological conditions (IMC), all EGPWS alerts were to be treated as genuine and flight crew must take rectification or avoidance action immediately. The operator’s flight crew operations manual stated that if positive visual verification was made that no obstacle or terrain hazard existed when flying under daylight VMC conditions prior to a terrain or obstacle warning, the alert could be regarded as cautionary and the approach continued.
The investigation found that the approach was being conducted at night in intermittent visual conditions prior to the aircraft going into IMC conditions just prior to the MAP. In these conditions, the EGPWS warnings should have been treated as genuine and action taken immediately rather than the crew inhibiting the alert.
Fatigue, workload and stress
The captain’s mother had become ill and her health had severely degraded by the time the captain arrived in Nauru from Brisbane. The captain stayed with her at the hospital for as long as possible before returning to his hotel where he had a disrupted night’s sleep of less than 6 hours. At the time of the EGPWS warnings, the captain had been awake for about thirteen hours and reported feeling fatigued.
The crew reported that their workload increased following the EGPWS alerts due to the deteriorating weather and distraction of the Kosrae flight information service (FIS) providing wind velocity change and visibility updates. The first officer stated that the FIS updates interrupted the crew’s working through checklists, as they needed to listen and respond. The effect of the increased workload would have been exacerbated by the stress of flying the operator’s inaugural RPT flight into Kosrae with Nauruan dignitaries on board.
For the captain, the workload would have been further exacerbated by the stress of his mother’s illness and the fatigue of a disrupted night’s sleep. The captain stated that in hindsight, he should have removed himself from the flight but didn’t want to as he was only one of two Nauruan captains employed by the operator and it was his turn to fly an important flight. He did not inform the operator of his mother’s illness.
On the decision to go-around, the captain pressed the takeoff/go-around button only once instead of twice, which resulted in a reduced thrust rather than a full power go-around. The aircraft was pitched up initially to 15° but was then pitched back down to increase the decaying airspeed. Soon after, the aircraft was at its lowest height of 200 ft by the radio altimeter. Given the increased workload of the crew, and the effects of stress and fatigue on the captain, the aircraft state, airspeed and attitude was not effectively monitored by either crew member following the go-around decision. Therefore, the execution of the go-around task and its attendant decision making was not performed effectively.
The go-around manoeuvre and recurrent training
The survey on the conduct of the go-around manoeuvre by the Bureau d’Enquêtes et d’Analyses (BEA, 2013) identified that it was common for the pilot flying to experience aircraft handling difficulties during the initial phase of the all-engine go-around manoeuvre, and that there was a general lack of training for the all-engine go-around manoeuvre.
With respect to the incident pilot’s handling issues during the go-around, these may have been affected by fatigue, workload and stress. However, it is also likely that these handling issues were contributed to by the limited training for the all-engine full-thrust go-around. The development of a recurrent training syllabus is a complex process and, as well as meeting specific regulatory requirements, involves operators making decisions about which of many important tasks and situations need to be included in each session. Go-arounds with one engine inoperative are typically conducted in every recurrent training session, and there has been increasing recognition that regularly practicing all-engine go-arounds is also important (BEA, 2013). Although the procedural steps are fundamentally the same, the increase in energy and time pressure associated with an all-engine go-around provides different challenges.
There are many permutations of the go-around task that need to be covered in recurrent training. A lesson from this occurrence and many similar occurrences is that flight crews should be regularly exposed to the time pressure and challenge of conducting full thrust go-arounds.
At the time of the occurrence, the operator did not include full-thrust go-arounds as part of their simulator-based recurrent training for their pilots. Although the inclusion of more go-around training including these aspects will reduce the overall risk associated with go-arounds, it is difficult to conclude that they would necessarily have reduced the likelihood of this occurrence.
Findings
From the evidence available, the following findings are made with respect to the Enhanced Ground Proximity Warning System (EGPWS) alerts involving a Boeing 737-300, VH-NLK, at Kosrae International Airport, Federated States of Micronesia, on 12 June 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The flight crew did not complete the approach checklist before commencing the non-precision NDB approach into Kosrae. As a result, the altimeters' barometric pressure settings remained at the standard setting of 1013 hPa instead of being set to the reported local barometric pressure of 1007 hPa. The flight crew descended the aircraft to the minimum descent altitude of 500 ft as indicated by the altimeters, however, due to the barometric pressure setting not being reset, the aircraft descended to a height significantly below 500 ft.
The crew descended the aircraft in IMC and at night below the approach profile for the Kosrae runway, resulting in EGPWS alerts. Terrain clearance assurance was eroded further by the flight crew not correcting the flight profile until the flight crew lost visual contact with the runway.
The flight crew's belief that the EGPWS warnings were due to a decreased navigational performance and not terrain proximity led to their decision to inhibit the first EGPWS warning and not correct the flight path.
Due to the captain’s fatigue and the increased workload and stress associated with the inaugural regular public transport flight into Kosrae at night in rapidly deteriorating weather, the crew’s decision making and task execution on the missed approach were affected.
Other factors that increased risk
The crew’s recurrent training had not included B737-300 full thrust go-around simulations.
The operator commenced regular public transport operations into Kosrae with the only instrument approachavailable for use beingan offsetprocedure based on a non-precision navigation aid. The risk associated with this type of approach was amplified due to the need to use a 'dive and drive' style technique instead of a stable approach path, and that it required low level circling manoeuvring from the instrument approach to align the aircraft with the runway. Furthermore, there was very high terrain in close proximity to the runway and the airport did not have a manned air traffic control tower. For this occurrence, the risk was further elevated as a result ofthe approach being conducted at night-time in poor weather conditions. [Safety issue]
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Elevated risk from non-precision approach with low-level circling and non-stabilised approach procedure
The operator commenced regular public transport operations into Kosrae with the only instrument approach available for use being an offset procedure based on a non-precision navigation aid. The risk associated with this type of approach was amplified due to the need to use a 'dive and drive' style technique instead of a stable approach path, and that it required low level circling manoeuvring from the instrument approach to align the aircraft with the runway. Furthermore, there was very high terrain in close proximity to the runway and the airport did not have a manned air traffic control tower. For this occurrence, the risk was further elevated as a result of the approach being conducted at night-time in poor weather conditions.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Proactive safety action taken by: Nauru Airlines
On 18 September 2017, Nauru Airlines stated that they had addressed the recommendations they had made as part of their internal investigation report into the occurrence. The actions taken appear below:
A review of the cyclic training program was undertaken by the Flight Standards Manager (FSM) with a focus on providing more flight crew training time to enable skill levels associated with non-standard/non-routine activities to be enhanced. The FSM has re-written the simulator program, changing it to two days twice a year in lieu of one day four times a year. This will provide flight crew with at least two full days of training instead of trying to fit training and checking in during a four-hour session. The training program has been drafted, but not yet implemented.
A review of the descent and approach checklist card type, content and location was completed. A control column checklist incorporating tactile indicators was put into operation within weeks of the event.
Two engine go-around training was included in the first simulator session following the event. This continues to be covered regularly.
Performance based navigation (PBN) ground schools have reminded crew of QNH setting requirements. In addition, a pilot notice was issued to remind crew of the QNH validity period (15 minutes).
A review of the options available for the most appropriate time to set the transition altitude QNH setting was undertaken soon after the event. The review identified that there is no foolproof method, and that this was a problem with most airlines. It was decided to stay with the current policy but increase training and checking of this procedure.
For all flight standards meetings conducted after the event, discussions on events that could arise from not setting QNH at the transition altitude have been included. Also included are, discussions of different transition altitudes on the company network and the different types of terrain that could be encountered in the airline’s current and future network of operations. Terrain considerations are now mentioned in the operations manuals and will be incorporated in the new route manual.
A review of the human factors and non-technical skills (HF-NTS) course content to include relevant points from this event into the applicable modules has been assigned.
Soon after the event, additional emphasis was placed on the importance of correct briefing and NTS in line checks. This is now being carried out during line and simulator checks.
General details
Captain details
Licence details:
Air Transport Pilot (Aeroplane) Licence Issued 22 Sep 1998
Endorsements:
Included relevant endorsements for the relevant B737 types.
Ratings:
Command (M/E Aeroplane) issued 22 Sep 1998. Instrument Rating Command (M/E Aeroplane) renewal dated 17 Jun 2014, with an expiry date of 30 Jun 2015.
Medical certificate:
Valid and current – completed 16 Feb 2015
Aeronautical experience:
16,600 hours flying experience
Last flight review:
14 Feb 2015
First Officer details
Licence details:
Air Transport Pilot (Aeroplane) Licence Issued 17 Sep 2013
Endorsements:
Included relevant endorsements for the relevant B737 types
Ratings:
Command (M/E Aeroplane) issued 09 Jan 2009.
Medical certificate:
Valid and current – completed 1 Oct 2014
Aeronautical experience:
3,300 hours flying experience
Last flight review:
3 Mar 2015
Sources and submissions
Sources of information
The sources of information during the investigation included the:
flight crew and operator of VH-NLK
aircraft enhanced ground positioning warning system (EGPWS)
EGPWS manufacturer
The US Federal Aviation Administration
Airservices Australia
Civil Aviation Safety Authority.
References
Battelle Memorial Institute. (1998). An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, US Federal Aviation Administration.
Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA). (2013). Study on aeroplane state awareness during go-around. Available from www.bea.aero/etudes/asaga/asaga.php
Dawson, D., & McCulloch, K., (2005). ‘Managing fatigue: It’s about sleep’, Sleep Medicine Reviews, vol. 9, pp. 365-380.
Dismukes, K. (2006). Concurrent task management and prospective memory: pilot error as a model for vulnerability of experts. In Proceedings of the Human Factors and Ergonomics Society 50th Annual Meeting – 2006, pp. 909-913.
Dismukes, R.K. and Berman, B. (2010). Checklists and monitoring in the cockpit: Why crucial defences sometime fail. National Aeronautics and Space Administration Technical Memorandum NASA/TM-2010-216396. Ames Research Centre: Moffett Field, US.
Flight Safety Foundation (FSF) (1998). Flight Safety Digest, November 1998—February 1999: “Killers in Aviation”. Available from flightsafety.org
Gaillard, A.W.K. (2001). Stress, workload and fatigue as three biobehavioural states: A general overview. In P.A. Hancock, & P.A. Desmond (Eds.), Stress, workload, and fatigue. Mahwah, NJ: L. Erlbaum.
Gawron, V.J., French, J., & Funke, D. (2001). An overview of fatigue. In P.A. Hancock, & P.A. Desmond (Eds.), Stress, workload, and fatigue. Mahwah, NJ: L. Erlbaum.
Orlady, H.W., & Orlady, L.M. (1999). Human factors in multi-crew flight operations. Ashgate: Aldershot, UK p.203.
Thomas, M.J.W., & Ferguson, S.A., (2010). Prior sleep, prior wake, and crew performance during normal flight operations, Aviation, Space, and Environmental Medicine, vol. 81, pp. 665-670.
Staal, M.A. (2004). Stress, cognition and human performance: A literature review and conceptual framework. National Aeronautics and Space Administration Technical Memorandum NASA/TM–2004–212824. Ames Research Centre: Moffett Field, US.
Williamson, A., Lombardi, D.A., Folkard, S., Stutts, J., Courtney, T.K., & Connor, J.L., (2011). The link between fatigue and safety, Accident Analysis and Prevention, vol. 43, pp. 498-515.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew, Nauru Airlines, the Federated States of Micronesia, and the Civil Aviation Safety Authority.
Submissions were received from the Civil Aviation Safety Authority and Nauru Airlines. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Occurrence summary
Investigation number
AO-2015-066
Occurrence date
12/06/2015
Location
Kosrae International Airport, Federated States of Micronesia
On 23 June 2015, at about 0420 Western Standard Time (WST), the captain and first officer of an Avro 146 aircraft, registered VH-NJW, and operated by National Jet Express, signed on to conduct a scheduled return flight from Perth to Granny Smith Airport, Western Australia (Figure1). The flight crew reviewed the weather forecast, including the aerodrome forecast (TAF)[1] for Leonora, which was the closest available TAF to Granny Smith. The TAF indicated broken[2] cloud 1,000 ft above ground level (AGL). The weather report (METAR) current at Leonora at that time indicated nil cloud detected (NCD). The forecast also included cloud at 1,500 ft AGL clearing at 0900 WST. Based on the weather forecast, the crew were required to plan for an alternate aerodrome,[3] and the captain planned sufficient fuel to return to Perth if they were unable to land at Granny Smith.
Figure 1: Selected aerodromes in Western Australia
Source: Google earth annotated by the ATSB
The first officer conducted the take-off and climb from Perth, and handed control of the aircraft to the captain after reaching the top of climb. In accordance with company procedures, the captain was required to conduct the landing at Granny Smith airport, due to the unsealed runway surface.
When established in the cruise, the flight crew received a weather report for Laverton indicating cloud at 800 ft AGL. The first officer spoke to the aerodrome reporting officer (ARO) at Granny Smith Airport, who reported that there were patches of blue sky above the aerodrome. The flight crew elected to continue to Granny Smith. They planned to overfly the aerodrome at the lowest safe altitude of 3,300 ft above mean sea level (AMSL), and if the weather was suitable, descend and join the circuit on downwind for runway 16. If they were unable to obtain the required visual reference for the aerodrome, the crew planned to divert to Laverton Airport, and conduct an area navigation (RNAV) approach and land there. The flight crew also discussed the option of conducting an RNAV approach at Laverton and, if suitable conditions for visual flight existed, they could then transit across to Granny Smith Airport, about 9 NM south of Laverton.
When the aircraft arrived overhead Granny Smith, the conditions were overcast. The flight crew elected to divert to Laverton, and advised the ARO that if they were able to establish visual reference at Laverton they would track from there to Granny Smith. The aircraft descended to the minimum sector altitude of 3,100 ft AMSL and the flight crew conducted the RNAV approach to runway 25. The crew configured the aircraft for the approach into Laverton, selecting gear down and flap 24, prior to arrival at the initial approach fix. When about 2.5 NM from the runway threshold and at about 2,150 ft AMSL, the aircraft became clear of cloud but the captain could not see the runway ahead at Laverton. The captain then disconnected the autopilot and turned the flight director off, in accordance with the standard company procedure for conducting a visual approach.
The weather to the south towards Granny Smith was clear, so the captain elected to divert to Granny Smith and turned the aircraft towards it, with the aircraft still configured for the approach with gear down and flap 24. The flight crew were able to maintain visual contact with the ground and reported about 8 km of visibility. The first officer had set the altimeter bug to 2,130 ft prior to commencing the descent, which was the minimum descent altitude (MDA) of 2,080 ft plus 50 ft as required by the company procedures. The wind was from 160° at 12 kt, and the captain planned to establish the aircraft on a straight in approach for runway 16.
The captain observed the radio altimeter (RADALT) indicating 500 ft and the electronic ground proximity warning system (EGPWS)[4] called ‘500’, both indicating the aircraft was 500 ft AGL. Shortly afterwards, the crew received an EGPWS ‘DON’T SINK’ warning. The first officer observed the RADALT indicating 380 ft and the vertical speed indicator showing about 100 ft per minute descent. The captain immediately applied nose-up pitch and increased the thrust, in accordance with the standard response. The aircraft climbed towards cloud and the captain levelled the aircraft off to remain clear of cloud. The crew then received a second ‘DON’T SINK’ warning (see ‘Don’t Sink’ section below). The first officer noted the RADALT indicating 410 ft and the captain immediately initiated a go-around, climbing to 4,000 ft AMSL.
Due to the time spent operating with the aircraft in the approach configuration, and the possibility of holding required in Perth, the captain then elected to divert to Kalgoorlie and refuel. After arrival in Kalgoorlie, the captain contacted the company flight operations manager. The manager queried whether the captain was fit to continue to operate the aircraft, to which the captain replied in the affirmative. After communicating with the company, at about 0900, the aircraft departed and tracked to Granny Smith. The conditions were still overcast at Granny Smith Airport, and the flight crew elected to track to Laverton, and conduct the RNAV approach. When at about 2,500 ft AMSL the aircraft encountered visual meteorological conditions.[5] The flight crew then elected to track to Granny Smith Airport, where the aircraft landed. The crew subsequently conducted the return flight to Perth.
Don’t Sink
According to the flight crew operating manual (FCOM), the EGPWS Mode 3 provides protection against loss of altitude after take-off or during a go-around. The amount of altitude loss is assessed against the height of the aircraft above the terrain. If the loss of altitude becomes significant for the height, a ‘Don’t Sink, Don’t Sink’ aural alert is given and the amber (terrain) ‘TERR’ caution lights illuminate. In response to a ‘Don’t Sink’ caution, the FCOM specified one memory action: adjust the pitch attitude and thrust to restore a positive rate of climb.
Pilot comments
The captain had limited sleep in the preceding three weeks. In the 24 hours prior to signing on for duty, the captain had about three hours’ sleep. The captain reported feeling irritable, with poor concentration, heavy eyes, and slow thinking processes. The captain believed that the captain’s decision-making had been affected by lack of sleep. The captain advised the first officer prior to the flight of having had little sleep.
Both the captain and the first officer had been on leave for three weeks prior to the incident flight.
The first officer reported that they had made the decision to transit to Granny Smith, based on the understanding that a visual segment could be flown as the aircraft was within 30 NM of the aerodrome, clear of cloud and in sight of the ground with visibility greater than 5 km. However, that applied, according to Aeronautical Information Publication Australia (AIP) ENR 1.5-12 section 1.15 Visual Approaches, when the aircraft was ‘at an altitude not below the lowest safe altitude [LSALT] /minimum sector altitude [MSA] for the route segment’. The minimum sector altitude was 3,300 ft.
Flight data
The aircraft operator analysed the flight data (Figure 2). The data showed that during the transit from Laverton to Granny Smith, EGPWS ‘DON’T SINK’ alerts were triggered when the aircraft’s altitude reduced to 346 ft AGL, and again 1 minute later at 529 ft and then 520 ft AGL.
Figure 2: Plan view of the incident flight from the recorded flight data
Source: Aircraft Operator
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:
Fitness to fly
The head of flying operations (HOFO) for the aircraft operator sent a notice to all company flight crew. The notice stated that fitness to fly was critical for their daily functions. The HOFO reminded flight crew that their personal health and safe operations of company aircraft were of the highest priority. Company pilots were advised not to work if they did not feel ‘up to the task’. The notice also provided contact information for the company’s recommended employee assistance program.
Safety notice
The company immediately issued an operational notice to all flight crew, titled Operations to airfields without instrument approach procedures. The notice stated the following:
On arrival at the destination, descent below the LSALT is only permitted if, within 5 NM of the airfield, conditions exist to permit a visual approach as per the runway approach profiles specified in the applicable Operations Notice or the OM-C1.
For reference, OM-A2 1.5.3 Lowest Safe Altitude
An aircraft may only be operated below the LSALT when:
Departing the prescribed circling area and operation above the MSA
Carrying out a published instrument approach
Carrying out a minimum weather circuit within the circling area and not below the circling altitude
In the process of taking off or landing in accordance with approved departure or arrival procedures
Visual conditions exist, utilising criteria laid down in the Jeppesen Airway Manual – Air Traffic Control – General Flight Procedures
Being radar vectored.
It is not permitted to conduct an instrument approach at a nearby airfield to gain visual reference, and then transit to the destination airfield below LSALT.
Safety message
The captain noted that in hindsight their decision-making was impaired by lack of sleep. Research (Thomas and Ferguson, 2010) has shown that prior sleep is a critical fatigue-related variable. Less than 6 hours’ sleep in the previous 24 hours was found to be associated with degraded operational performance and increased error rates.[6]
Civil Aviation Advisory Publication (CAAP) 48-1(1), states that ‘determining fitness for duty has always been a complex and challenging task…and substantial fatigue research has demonstrated that humans are quite poor at determining how fatigued they actually are.’ In addition, flight crewmembers ‘who are fatigued will have impaired decision-making and they will have poorer judgment in terms of how fatigued they are and whether they are actually fit for duty’.
Prior to flight, it is important for pilots to assess their fitness to fly. The following checklist provides a quick reference. A description of aeromedical factors is available in the US Federal Aviation Authority Pilot’s Handbook of Aeronautical Knowledge.
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
