Information was provided to the ATSB indicating that there was a breakdown of separation between two Australian registered Boeing Company 747 aircraft, in international airspace under the control of Honolulu Centre, on 16 January 2005.
The ATSB commenced a category 4 investigation to determine if safety was compromised. The ATSB subsequently received advice from the US National Transportation Safety Board (NTSB) that the US Federal Aviation Administration (FAA) had investigated the circumstances of the report and found that appropriate separation standards, using radar control techniques, were applied at all times. There as no infringement of separation standards – the minimum longitudinal spacing between the aircraft was 47 NM.
Status: Downgraded the occurrence to category 5 and investigation discontinued.
In accordance with its obligations under Annex 13 to the Convention on International Civil Aviation, the Department of Civil Aviation (DCA), Republic of Zambia, investigated the circumstances surrounding the accident involving Cessna 210, registered ZS-KOX, 33 NM north of Livingstone, Zambia, on 9 September 2004.
At about the time that the aircraft reached its cruising level, the pilot reported engine vibration. The vibration became more severe and culminated in separation of the propeller from the engine with the corresponding loss of thrust. Although suitable forced landing sites were available, the pilot was unable to carry out a safe forced landing due to loss of visibility resulting from engine oil on the aircraft windscreen. On landing, the aircraft impacted trees at the end of a clearing and was destroyed. The accident was not survivable; the pilot and five passengers received fatal injuries.
As three of the passengers were Australian citizens, the DCA, on 12 October 2005, offered the Australian Transport Safety Bureau (ATSB) involvement in the production of the final report. On 12 October 2005, the ATSB appointed an Accredited Representative to the DCA in accordance with Section 5.23 of Annex 13. The DCA supplied the ATSB with a copy of the draft of its final report on the accident and invited the ATSB to comment. ATSB provided comments on the draft and supplied additional technical information.
The DCA is yet to publish its final report on the accident.
The operator has implemented the following safety actions in order to enhance the existing organisational and individual risk controls affecting A330 aircraft loading:
planning is underway for a single load control system commencing March 2007 for the company’s domestic and international operations
inter-departmental communication lists have been amended to ensure the timely promulgation and availability of relevant aircraft documentation for use by flight crews
the Route Manual Supplement has been amended to clearly mandate the requirement for flight crews to check an aircraft’s critical load data against other company documentation before accepting a provisional load sheet
the Flight Crew Operating Manual has been amended to place shared responsibility for the final check of an aircraft’s load sheet data with the pilot in command, and copilot
the load control officer training syllabus has been revised to include aspects of this occurrence, and additional load control checklists have been introduced for use by load controllers
the audit process when updating the company’s load control system has been amended to include an independent cross-check of any changes to an aircraft’s basic record, or of any ‘copied’ details
a log has been created to record all out of hours changes to the company’s load control system.
Analysis
ANALYSIS
The risk for the operator of employing two weight and balance profiles was that it increased the possibility of errors during operations.
The lack of an audit requirement affecting the newly created weight and balance profile, and the lack of a capability for an on-ground warning to the crew of an incorrectly loaded aircraft, meant that the operator's load control system relied on the recognition by the crew of any error in the aircraft's load profile. The investigation could not quantify the impact on workload caused by the requirement for the crew to calculate the aircraft's take-off performance7, but it may have precluded their critical analysis of the aircraft's weight and balance profile. In any case, in this instance, the company's reliance on crew intervention to prevent the application of the incorrect load profile proved unreliable.
The omission of an independent check of the aircraft's basic weight and index parameters by the company's Singapore load controllers negated another potential defence in the operator's load control system. In addition, the implied discretionary requirement in the Route Manual Supplement for flight crews to check flight critical data could have contributed to the apparent breakdown in the crew's loading preparations for the flight. Had either of the Singapore load controllers, or the flight crew more comprehensively followed company procedures, the error in the aircraft's weight and balance profile may have been detected prior to commencing the take-off.
7. Using the aircraft's Performance Supplement Manual.
Factual Information
FACTUAL INFORMATION1
History of the flight
At 1503 Coordinated Universal Time (UTC) on 9 December 2004, the pilot in command of an Airbus Industrie A330-301 aircraft (A330), registered VH-QPC, commenced the take-off from Singapore on a scheduled regular public transport service to Darwin, NT. The pilot in command reported that the aircraft felt nose heavy during rotation2, but that after the aircraft was trimmed, a more normal feel was restored. Following the flight it was found that the aircraft's take-off centre of gravity3 (CG) was forward of the manufacturer's forward limit.
The decision by the operator to operate the domestically configured aircraft on an international service was not communicated to the company department that had responsibility for updating the aircraft's flight document library. As a result, the take-off performance charts for the departure from Singapore were unavailable for use by the flight crew. The flight crew reverted to calculating the aircraft's take-off performance using the aircraft's Performance Supplement Manual.
The operator maintained two distinct weight and balance profiles for application in its A330 operations. The profiles were:
an international profile, employing a basic index4 (BI) of about 292, and used in conjunction with an international weight and balance template
a domestic profile, with a BI of about 192, and used in conjunction with a domestic weight and balance template.
The aircraft's international weight and balance profile was created a number of months before the occurrence flight. During that process a corrupted international profile was created. The system and the operator did not recognise that there was an error in the data in the new profile. There was no requirement for the audit of that profile as it was created from existing certified data. Subsequently, the aircraft's corrupted international profile remained undetected during the intervening months of domestic operations leading up to the occurrence flight.
A number of company defences were promulgated to ensure that the operator's aircraft were correctly loaded:
the Flight Administration Manual placed responsibility with all flight crew members to ensure that company aircraft were operated within their CG limits
the Route Manual Supplement required that, before accepting a provisional load sheet, the crew 'should' confirm their aircraft's critical load data against other aircraft documentation
the Flight Crew Operating Manual specified that the pilot in command was responsible for the final check of an aircraft's load sheet data.
The copilot reported extracting the aircraft's basic weight5 (BW) and BI parameters from a fleet weight and balance folder that was located in the operator's Singapore flight dispatch office. The parameters were then provided to the local load control staff in order for them to produce the loadsheet6 for the flight.
The flight crew reported that, in this instance, neither the copilot nor the second officer could recall having checked the aircraft's critical load data, and that the pilot in command did not check the aircraft's load sheet.
There was no evidence that the load control staff completed the required independent check of the BW and BI parameters for the aircraft and, as a result, an international BI was unwittingly applied to what remained, effectively, the aircraft's domestic weight and balance template.
Aircraft information
No evidence was found of a defect in the aircraft or its systems that may have influenced the circumstances of the occurrence.
The load sheet indicated to the flight crew and load control staff that the aircraft had been correctly loaded in order for the aircraft's CG to remain within limits for all phases of the flight. The investigation determined that the aircraft's CG was located forward of the manufacturer's forward limit for the take-off.
The manufacturer stated that the CG for the take-off did not exceed the aircraft's structural and landing gear limitations, and that the aircraft was 'sufficiently manoeuvrable' at all times. However, an out of limits forward CG increases the risk of there being insufficient elevator authority for a pilot to rotate an aircraft during take-off, or to flare an aircraft for landing. The result would be that take-off and landing distances would be greater than planned by the pilot.
There was no capability for the aircraft's systems to warn the flight crew of an out of limits CG while on the ground. Airborne warning of an out of limits aft CG was possible.
Only those investigation areas identified by the headings and subheadings were considered to be relevant to the circumstances of the occurrence.
Positive, nose-up pitch of the aeroplane about the lateral axis immediately prior to becoming airborne.
The point at which an aircraft would balance if suspended. It must be located within specific limits for safe flight.
In simplified terms, the position of the aircraft's centre of gravity before fuel and payload are added.
Mass of the aircraft, including of the aircraft's fixed equipment and residual fluids.
A performance planning document that annotated the aircraft's weight, centre of gravity for take-off and landing, and the loading requirements for the flight.
Summary
At 1503 Coordinated Universal Time (UTC) on 9 December 2004, the pilot in command of an Airbus Industrie A330-301 aircraft, registered VH-QPC, commenced the takeoff from Changi Airport, Singapore on a scheduled regular public transport service to Darwin, NT. The pilot in command reported that the aircraft felt nose heavy during rotation, but that after the aircraft was trimmed, a more normal feel was restored. Following the flight it was found that the aircraft’s take-off centre of gravity (CG) was forward of the manufacturer’s forward limit.
The investigation found that:
there had been a corruption of the aircraft’s weight and balance data within the international load control system
the error did not manifest itself until the aircraft was used on an international service and the aircraft’s weight and balance was calculated using the corrupted data in the international load control system
the Singapore load controllers did not carry out a check of the basic aircraft’s data as they were required to do by the operator
the flight crew did not carry out a check of the basic aircraft data as they were required to do by the operator.
The operator made a number of changes to procedures that will enhance the existing organisational and individual risk controls affecting A330 aircraft loading. The operator will also introduce a single load control system from March 2007, which will minimize the likelihood of a recurrence of the data corruption event leading to this incident.
As a result of this occurrence, Airservices Australia has advised the Australian Transport Safety Bureau that it is reviewing the following issues in order to strengthen the operational risk controls for prevention and recovery from, similar occurrences:
The Australian Advanced Air Traffic System’s (TAAATS) existing human machine interface for effectiveness and efficiency and to ensure standardisation
Airspace, for division both laterally and vertically, to reduce airspace complexity and facilitate an improved ASD
Route structure, to remove unnecessary waypoints to assist controller interaction with data input
Coordination requirements, both domestically and internationally, to reduce complexity and controller workload, through increased automation
Supervision available, by either increasing the hours of operation of operations supervisors to 24 hour coverage, together with additional training, or by the provision of additional training for systems supervisors, for night time operation
The location of workstation positions at night, for improved peer support and situational awareness
Refresher training, to ensure all staff have completed required training in active listening, scanning, separation assurance, and recovery from an unusual situation such as a breakdown of separation. Additionally ensuring that this training adequately covers compromised separation in the non-radar environment.
In addition, The TAAATS Alerts Review and Enhancement Project is currently reviewing the processing and display of CLAM and other alerts for controllers. Software is currently being developed to allow a flight plan conflict function display for procedural tracks, including ADS tracks, for delivery late in 2006.
Analysis
Analysis
While it was not possible to determine the controller’s level of fatigue, it is likely that the significant level of workload and the controller’s acknowledged diminished level of mental alertness and the time of day, together contributed to the incident.
The routine display of CLAM alerts for expected events, such as the issue of discretionary climb, did little to enhance the controller’s situational awareness in regard to QF31s cleared level status.
Summary
On 28 November 2004, a Boeing Company 747-438 aircraft was en route from Sydney to Singapore at flight level (FL) 360. Another Boeing Company 747-400 aircraft was en route from Bangkok to Sydney at FL350. At 1509, the crew of the 747-438 had been issued with a clearance to climb to FL380 with a requirement to reach that level by 1550 and the crew planned to leave FL360 at 1544. At 1521, the crew of the 747-400 requested a clearance to climb to FL370 and were issued a clearance to reach FL370 by 1528. This resulted in an infringement of separation standards.
At 1538, approximately 150 NM north-west of waypoint NIKOM, the crew of the 747-438 observed an aircraft pass overhead. They informed the controller, and confirmed that they had a clearance to climb to F380. The controller acknowledged the crew, but took no further action to resolve the infringement of separation standards.
The controller reported that when he issued the climb instruction to the crew of the 747-400, his mental picture was that the 747-438 was maintaining FL360, and this was reinforced by a simultaneous separation problem with another aircraft. He also reported that it was possible that he may also have mixed up the displayed levels for the 747-438.
The controller indicated that his sleep pattern had been disrupted, and while he had assessed himself as fit for duty, and felt competent to acquit the required task, he felt ‘a bit more fatigued than normal’.
During a climb to a new cruise level with maximum climb thrust set, the flight crew of a scheduled passenger service Boeing 747-338 aircraft noted an increase in vibration from the number 3 engine, accompanied by warning indications from the engine monitoring instrumentation. The engine was shut down and the flight continued to its destination.
Subsequent engineering examination of the RB211-524D2 engine (serial number 12682) revealed the failure of a single blade from the low-pressure turbine second stage (LPT-2, figure 1). Sections of the failed blade, including the root block, and portions of the separated airfoil section were recovered from the engine and forwarded to the Australian Transport Safety Bureau (ATSB) for examination (figure 2).
Figure 2: Blade fragments recovered from the failed engine
1.2. Visual characterisation
The part number LK83851 stage-2 low-pressure turbine blade (serial number TA6939B) had fractured through the base of the airfoil section; the fracture path extending diagonally from just above the dovetail transition at the rear face, to a position approximately 33 mm above the blade base, measured along the forward face (figure 3).
Figure 3: LPT-2 blade root section showing the fracture profile and its point of origin (arrowed)
The entire fracture was confined to the region beneath the blade platform and airfoil section transition. The fracture surface morphology confirmed a progressive fatigue cracking mechanism (figure 4), with optical and electron microscopy identifying a single origin approximately 790 µm from the rear face of the root block (figures 5 - 7).
Figure 4: Plan view of the blade fracture showing the fatigue cracking morphology and point of initiation
Figures 5 - 7: Blade fracture at increasing magnifications with origin identified
Other than mechanical damage attributable to the loss of the outer blade section, the blade root block showed no evidence of external tool marks, handling damage or other physical features that could be held as contributory to fatigue initiation.\
The blade root block carried the embossed and engraved identification:
The engine manufacturer confirmed that the numbers represented as <xx> above indicated the application of various repair schemes during prior blade overhaul/s. On review, none of those schemes contained actions involving activity at or in the vicinity of the fatigue origin. The manufacturer also indicated that the engraved (vibro-etched) markings '< 201>' had been placed closer to the shank edge than allowed by the particular repair scheme, and that markings too close to section corners have the potential to adversely affect the blade integrity. In this instance however, the cracking showed no association with the < 201> marking, or any other similar feature.
1.3. Metallography & micro-analysis
A serial grind-polish-examine process was used to investigate and characterise the features at and surrounding the fatigue origin. The plane of grinding was parallel to the trailing edge root block face and a total of four metallographic planes were examined through the origin area. A fractured and intrusive dark oxide-like material inclusion was observed during the second stage of examination (figure 8).
Figure 8 and 9: Metallographic cross-section through origin and EDS spectra of inclusion present at arrow
Energy dispersive x-ray analysis (EDS, figure 9) of the inclusion identified a range of elements from the typical base metal chemistry (Ni, Nb, Ti), as well as zirconium (Zr) which was foreign to the base metal alloy but later identified as a component of the refractory moulding material used during the investment casting of the turbine blades. Dimensionally, the visible sections of the inclusion measured approximately 40 µm in the major dimension, with the engine manufacturer indicating that the maximum root defect dimension allowable by the relevant quality acceptance standards (QAS) was in the order of 508 µm (0.2").
The general blade microstructure was typical of a cast nickel-based high temperature alloy, with massive semi-script form carbides within a solid-solution (?, gamma) matrix.
1.4. Chemical analysis
Spectrographic analysis techniques identified the base LPT blade alloy as an IN713LC nickel-chromium-aluminium-molybdenum material. The engine manufacturer confirmed this as the intended LPT blade alloy.
1.5. Fatigue loading and operating conditions
The initiation of fatigue cracking within any component is an indication that the magnitude and number of local stress cycles sustained have exceeded the limits of the material at the crack origin. Components such as the LPT-2 blades that do not have a prescribed fatigue life limit are engineered such that the nominal and expected transient design stresses and stress cycles are kept below the threshold for fatigue initiation. Where fatigue cracking does initiate in these items, it is, by implication, an indication that either the component has been subject to general stresses above the design limits, or that some anomaly has acted to locally concentrate the stresses in the affected area. The presence of notches, tool marks, physical defects, inclusions or microstructural abnormalities can all lead to local stress concentration effects, thus providing conditions suitable for fatigue crack initiation. In the analysis of previous LPT-2 blade failures, the engine manufacturer had implicated uneven fuel distribution issues in the excitation of blade vibration sufficient to produce high-cycle fatigue cracking. In this instance however, there was no reported evidence from the engine examination to suggest that fuel distribution or combustion conditions had been problematic, or that those conditions had contributed to the blade failure.
2. ANALYSIS
The LPT-2 blade fracture morphology indicated that failure had resulted from a progressive high-cycle fatigue (HCF) mechanism, initiated from a surface or near-surface inclusion at the rear trailing corner of the blade root section. The inclusion chemistry and morphology suggested its origin from the refractory mould used to cast the blade during initial manufacture. Given that inclusions and other entrained discontinuities are inherently difficult to avoid in components produced by casting processes, limits are conventionally placed on the size and location of such features to maintain the structural integrity of the items under static and dynamical loading conditions. In this instance, although the dimensions of the visible portion of the inclusion were below the manufacturer's allowance for discontinuities of that nature, it was possible that the defect in total may have been considerably larger, being broken up and partly lost during the blade fracture and separation.
3. CONCLUSIONS
The following conclusions were drawn from the examination of the failed LPT-2 blade from RB211-524D2 engine serial number 12682.
1. Blade failure resulted from the initiation and growth of a fatigue crack from the rear trailing corner of the blade root section.
2. Physical evidence suggested the initiation of cracking from a casting inclusion formed during blade manufacture.
Analysis
The number 3 engine failed in flight as a result of a low-pressure turbine (LPT) second stage blade failure. The blade failure was a result of a fatigue crack that propagated from a casting inclusion formed during blade manufacture.
Despite the engine manufacturer's recommendations regarding the maintenance of life records for Group B components, the LPT blades are not subject to any mandatory life recording program, and so the actual time and hours in service cannot be determined for any individual blade. In addition, unless the life of each blade is recorded from new, the introduction of any life recording program to components already in-service would not be of any benefit.
Factual information
On 22 October 2004, at approximately 0510 Australian Eastern Standard Time, an Australian registered (VH-EBU), Boeing Company 747-338 aircraft, was being operated on a scheduled passenger service from Honolulu, in the United States of America, to Sydney, Australia. Near the instrument flight rules reporting point ISTEM, located approximately 700 nautical miles north-east of Sydney, the flight crew had been cleared by air traffic control to climb from flight level (FL) 340 to FL360. When the crew set climb thrust on the engines, they reported that they felt a vibration in the aircraft and the number 3 engine airborne vibration monitor lights illuminated, indicating that the number 3 engine had an abnormal vibration level. The crew shut down the number 3 engine and continued to Sydney.
A subsequent engineering examination of the number 3 engine indicated that a low-pressure turbine (LPT) second stage blade had failed. The engine, a Rolls-Royce RB211-524D4 turbofan, serial number 12682, was removed from the aircraft and the recovered LPT blade fragments were sent to the Australian Transport Safety Bureau (ATSB) for detailed examination. At the time of the failure, the engine had a recorded time in service of 71,200 hours and 11,221 cycles since new and 14,787 hours and 2,513 cycles since repair. The ATSB examination revealed that the LPT blade had failed as a result of high cycle fatigue cracking (HCF), originating at an anomalous inclusion in the blade material. Details of the failed LPT blade examination are contained in the Technical Analysis report (Appendix A).
Previous LPT blade failures
The engine manufacturer reported that there had been three previous LPT blade failures in this engine type. Two of the events were attributed to engine fuel mal-distribution and subsequent blade excitation, leading to HCF and failure. There was no detail provided on the third event. The failure of this blade type was a rare event, given that the engine type has accumulated in excess of 25 million flight hours in service.
LPT blade life monitoring
The LPT blades in the Rolls-Royce RB-211 series engines do not have a defined blade retirement life and are maintained on condition; being monitored throughout their service life by inspection and engine trend analysis. Once the engine LPT performance parameters change to pre-determined levels, the engine is removed for overhaul or repair. During engine overhaul, the LPT blades are subject to inspections to determine if they meet the dimensional requirements for continued service. LPT blades may be exchanged between various engines during this process.
The engine manufacturer's Time Limits Manual for RB211-524 series engines specified that LPT blades are 'Group B' parts and states that it is 'considered necessary to life mark or maintain life records of Group B parts'. While it was evident that engine serial number 12682 had been overhauled in accordance with the manufacturer's requirements, the individual LPT blades' service lives were not recorded and so the age and life history of the failed blade could not be determined.
Summary
On 22 October 2004, at approximately 1910 Universal Co-ordinated Time, a Boeing Company 747-338 aircraft, registered VH-EBU, was being operated on a scheduled passenger service from Honolulu, in the United States of America, to Sydney, Australia. The flight crew had been cleared by air traffic control to climb from flight level (FL) 340 to FL360. When the crew set climb thrust on the engines, they reported that they felt a vibration in the aircraft and the number 3 engine airborne vibration monitor lights illuminated, indicating that the number 3 engine had an abnormal vibration level. The crew shut down the number 3 engine and continued to Sydney.
A subsequent engineering examination of the number 3 engine indicated that a low-pressure turbine (LPT) second stage blade had failed. The ATSB examination revealed that the LPT blade had failed as a result of high cycle fatigue originating at a site of an anomalous inclusion in the blade material.
The operator has implemented the following procedures to be followed when its aircraft are operating in the Ujung Pandang FIR:
Depart with an operative Traffic Alert and Collision Avoidance System (TCAS)
Cruise at standard levels
Logo lights ON at night (excluding A330 aircraft)
TCAS on for en route climb or descent, or for the entire climb and descent into Indonesian airports
If TCAS becomes unserviceable en route, flight crew must not request or accept en route climb or descent.
Summary
Sequence of events
On 19 June 2004, at about 1908 Coordinated Universal Time (UTC), two Australian registered Boeing Company 767-338ER aircraft were involved in a serious incident in the Ujung Pandang Flight Information Region (FIR) on air route B473, approximately 60 NM northwest of waypoint SAMGE (latitude 02o21/10//N, longitude 129 o39/00//E).
Flight number QF 83, registered VH-OGP was northbound and flight number QF 98, registered VH-OGQ was southbound on the same air route. The crew of QF 83 reported at SAMGE at 1901 UTC. The crew stated that Ujung Control cleared the crew to `Descend flight level (FL) 350, cross SADAN at FL350 and report leaving FL360'. At about 1906, while continuing to maintain FL360, the crew observed an aircraft (QF 98) on the reciprocal track. The crew of QF 98 were cruising at their cleared level of FL350. This aircraft passed 1,000 ft below QF 83 at about 1908. The crew of QF 98 asked Ujung Control to confirm their clearance. The controller then replied `Maintain FL360, report at time 1917'. If the crew of QF 83 had descended their aircraft from FL360 to FL350 there would have been an infringement of separation standards and an increased risk of collision, with QF 98.
The Australian Transport Safety Bureau (ATSB) was advised of the incident and commenced an investigation. The crews of both aircraft were interviewed and data from each aircraft's quick access recorder was analysed. A review of that data subsequently revealed that the incident occurred inside Indonesian territory. Accordingly, the Indonesian National Transportation Safety Committee (NTSC) had the responsibility to conduct an investigation in accordance with Annex 13 to the Convention on International Civil Aviation.
On 8 July 2004, the NTSC informed the ATSB that they had commenced an investigation into the incident and the ATSB appointed an accredited representative to that investigation. The NTSC, being the investigation agency of the country in which the incident occurred, will be preparing the report and has control over the public release of any investigation findings.
The ATSB will publish the NTSC report on its website www.atsb.gov.au when released by the NTSC.
The Australian Transport Safety Bureau did not conduct an on scene investigation of this occurrence. The information presented below was obtained from information supplied to the Bureau.
On 16 June 2004 at 0540 Coordinated Universal Time, a Boeing 747-438, registered VH-OJT, was being operated on an international passenger flight from Singapore to Sydney, with four pilots on board. During the cruise, the co-pilot reported back pain and became incapacitated and was unable to return to duty after crew rest. The co-pilot was relieved of duty and the flight continued to the destination with the pilot in command and one of the other pilots at the controls.
Airservices Australia included the following modification to the Brisbane Centre local instructions applicable to international HF radio operators:
Relay of communications between ATC and pilots, or between pilots and ATC must be completed within 5 (five) minutes of the message being passed to the AusFIC for relay. Any communications relayed to and from ATC must be passed verbatim.
In the event that a message cannot be relayed within the 5 minutes advice must be provided to the appropriate ATC sector.
Analysis
Communications
The reason the HF operator was unable to establish two-way communication with the crew of IVC could not be determined. A formal procedure for notifying the controller that the HF radio operator could not pass the instruction to the crew of IVC may not have ensured that a separation standard existed, as an incorrect instruction had been issued. However, it may have prompted a more timely reassessment of the situation by the controller. In other circumstances, a formal procedure may alert the controller in sufficient time for action to be taken before separation standards are infringed.
Air Traffic Controller
A review of the controller's training records indicated that he had an adequate understanding of the concept of lateral separation. However, his misapplication of a lateral separation point may have reflected his lack of proficiency due to inexperience in working the particular sector of airspace.
Summary
On 16 June 2004, a Boeing 747-400, registered GC-IVC (IVC), was en-route from Melbourne to Singapore on airway A576. The aircraft was approaching the boundary between the Brisbane flight information region (FIR) and the Bali FIR at flight level (FL) 340. Concurrently, a second 747, registered 9V-SPE (SPE), was en-route from Sydney to Singapore on airway G326. That aircraft was also approaching the boundary between the Brisbane FIR and the Bali FIR at FL 340.
The controller recognised that he had to resolve a potential confliction between SPE and a third aircraft. In resolving that confliction, the controller created a new confliction between IVC and SPE. In response, the controller instructed the crew of IVC to reach FL320 by waypoint ATMAP (see Annex A). That requirement was intended to achieve vertical separation between the aircraft prior to any loss of lateral separation1. However, the required lateral separation point was 94 NM south-east of waypoint ATMAP on airway A576. The incorrect requirement led to an infringement of separation standards.
Following a scan of the air situation display, the controller realised that he had issued an incorrect requirement. The controller then issued a second requirement, via the high frequency (HF) radio operator, for IVC to descend to reach FL320 by 80 NM to the south-east of waypoint ATMAP. The controller reported that this requirement was based on the application of a required navigation performance (RNP) 10 separation standard2. This standard was not authorised for use within the Bali FIR. Upon issuing the requirement, the controller handed over to another controller and went on a scheduled break.
Over a period of 10 minutes and 37 seconds, the HF radio operator made 12 unsuccessful attempts to contact the crew of IVC. The oncoming controller realised that the HF radio operator had not been able to make contact with the crew of IVC. He also realised that RNP 10 was not an authorised standard. By that time the authorised separation standards had already been infringed. The oncoming controller then successfully instructed the crew of IVC to descend their aircraft immediately to FL320, via a controller pilot data link communication3 (CPDLC) message to the crew of another aircraft.
The controller involved in this occurrence had completed his field training in April 2004. A review of his training records indicated that he had approximately five weeks' experience on that sector of airspace. According to his check and standardisation supervisor, the controller demonstrated a satisfactory level of competency on completion of his sector-specific training.
The controller was rostered to work an afternoon shift, which commenced at approximately 1500 eastern standard time. During the shift the controller had a break of one hour, returning to the console at approximately 1930. The incident occurred at 2038. There was no evidence that fatigue played a part in the incident.
Coordination of high frequency radio communications
The controller issued the requirement to the crew of IVC to reach FL320 by waypoint ATMAP while that aircraft was within reliable very high frequency (VHF) radio range. However, when the controller realised the error in the requirement, that aircraft had passed outside VHF radio range. The controller attempted to issue the amended requirement to the crew of IVC through a HF radio operator, because the crew of IVC had not nominated CPDLC on their flight plan as a means of communication with ATC.
The HF radio operator was unable to establish two-way communication with the crew of IVC, to pass the amended requirement, despite repeated attempts. The controller was not aware that the HF radio operator was unable to issue the instruction to the crew of IVC.
The controller did not confirm with the HF radio operator that the instruction had been passed to the crew of IVC, and there was no published procedure requiring him to do so. Although there was a requirement for the HF radio operator to notify the controller that the instruction was not passed to the crew of IVC, there was no formal procedure to facilitate that notification.
1Lateral separation is considered to exist when there is at least a 1 NM buffer between the possible positions of two aircraft (ICAO PANS-ATM, Chapter 5 in CASA Manual of Standards Part 172 10.8.1.1). 2For RNP10, the approval process must show that the total navigation system error in each dimension must not exceed +/- 10 NM for 95 per cent of the flight time on any portion of any single flight: a) the true position of the aircraft must be within 10 NM of the programmed route centre line; and b) the true distance to way-points must be within 10 NM of the displayed distance to waypoints.' (International Civil Aviation Organization, 1999, Manual on required navigation performance [RNP], second edition, p. 6). 3Controller Pilot Data Link Communications (CPDLC): A means of communications between a controller and pilot using text-based messages via an ATC data link (Manual of Air Traffic Services, part 10, effective 10 June 2004).
The Australian Transport Safety Bureau did not conduct an on scene investigation of this occurrence. The information presented below was obtained from information supplied to the Bureau.
The Boeing 767-338ER aircraft, registered VH-OGN, was conducting an international passenger flight from Jakarta to Sydney, with two pilots on board. During cruise, the first officer became incapacitated, reporting stomach cramps, sweating and nausea. The first officer was relieved of duty and the flight continued to destination with the captain at the controls. After landing, the first officer was diagnosed with a possible gastric virus. He recovered fully within 24 hours and has resumed flying duties.
The Australian Transport Safety Bureau (ATSB) did not conduct an on-scene investigation of this accident. The accident was investigated by the Civil Aviation Division (CAD) of the Ministry of Transport and Communication Timor Leste (East Timor) which also compiled and released the final report.
On 2 June 2004, at 0725 Coordinated Universal Time, a Bell Helicopter Company 212, registered VH-NSA, was being flown from Dili to the Same village helicopter landing site (HLS), East Timor, to conduct a medical evacuation of a patient from Same to the Dili hospital. The helicopter was being flown by two pilots. Also on board were a helicopter crewman, a doctor and a nurse. The helicopter was reported to have suddenly lost height while manoeuvring in heavy rain during the approach to land at Same. Despite efforts by the pilots to regain airspeed and arrest the descent, the helicopter impacted trees located about 0.5 NM from the Same HLS. The helicopter subsequently impacted the ground and came to rest on its left side. The nurse and the helicopter crewman received serious injuries. The pilot in command, copilot and the doctor received minor injuries.
In accordance with its obligations under Annex 13 to the Convention on International Civil Aviation, the CAD initiated an investigation into the circumstances surrounding the accident.
The CAD requested that the ATSB assist their investigation by providing technical advice and investigation management support. In accordance with Annex 13 paragraph 5.18, the ATSB appointed an Accredited Representative to assist the CAD to obtain details of the pilots' qualifications, operational and technical data and records from Australia. The ATSB also assisted by conducting some interviews by telephone.
The final investigation report titled Aircraft Accident Report Bell 212/UN079/VH-NSA is available from:
Civil Aviation Division of Timor Leste Ministry of Transport and Communication Timor Leste Dili East Timor
