Descent below minimum permitted altitude, final report

Pitch-up illusion during a go-around at night. Again! Release date: 24 November 2017.

A number of autoflight mode selection errors, high workload, non-routine actions of the pilot flying, CRM issues and fixation, identified as contributing factors. Fatigue due to the time of day and time awake may have acted as a factor that increased risk.

vh-vcj-skytraders-airbus-a319-132_PlanespottersNet_439635

Photo (C) Lance C Broad – YBBN Spotters Group 

DESCENT BELOW MINIMUM PERMITTED ALTITUDE INVOLVING AIRBUS A319, VH-VCJ

Near Melbourne Airport, Victoria | 15 May 2015

ATSB Transport Safety Report | Aviation Occurrence Investigation AO-2015-048

Final – 24 November 2017

THE OCCURRENCE

Introduction

On the evening of 14 May 2015 an Airbus A319, call-sign Snowbird Two (SND2) departed Perth, Western Australia for Melbourne, Victoria. The aircraft was registered as VH-VCJ and operated by Skytraders Pty Ltd as a passenger charter service with 5 crew and 18 passengers. The aircraft’s flight crew consisted of two captains. The pilot-in-command occupied the left seat and was the pilot flying (PF).1 The other captain occupied the right seat and was performing the pilot monitoring (PM) duties.

As the aircraft was positioning to commence the approach into Melbourne, the PF made a number of inadvertent autoflight mode selections, which led to the autothrust system disengaging and the engines entering the thrust lock condition. The PF’s actions to correct the thrust lock resulted in an unexpected increase in thrust. In response to the thrust increase, the PF made a number of pitchdown inputs and retarded the thrust levers. The pitch-down inputs, when combined with the increased thrust, resulted in the aircraft developing a high rate of descent with an accelerating airspeed. This led to the aircraft descending below the cleared altitude, as well as the triggering of a number of Terrain Avoidance and Warning System (TAWS) alerts. During the subsequent response to these alerts, the aircraft did not commence climbing for about another 10 seconds, and after two further TAWS alerts had activated.

Events leading up to the inadvertent autoflight mode selections Approaching Melbourne and before commencing descent, the flight crew set up the aircraft’s flight management guidance system and then briefed for an expected WENDY 1A standard arrival route (STAR) procedure, with an instrument landing system (ILS) approach to runway 16 for landing (Figure 1). Shortly after, air traffic control (ATC) cleared the aircraft for the WENDY 1A STAR. In the early morning of 15 May 2015, at about 0120 Eastern Standard Time (Coordinated Universal Time (UTC) + 10 hours), the aircraft commenced the descent into Melbourne.

figure 1

The PF commenced the descent with the following autoflight systems and modes selected:

  • Autopilot 1 (AP1) was controlling the aircraft.
  • Lateral navigation was in the ‘navigation’ (NAV) mode, while vertical navigation was in the ‘descent’ mode, both of which were managed modes where the aircraft follows a pre-planned horizontal and vertical flight path loaded in the flight management guidance computer.
  • Autothrust system was on, with the thrust levers at the managed thrust position—the climb thrust detent that equated to a thrust lever angle of 22.5 degrees.

At 0128, SND2 called ATC and advised that the aircraft was on descent to a cleared altitude of 9,000 ft and that they had received ATIS information Romeo.

As SND2 approached waypoint KIKEX (Figure 1) at 0134:25, ATC cleared the aircraft to descend to 3,000 ft and for the ILS approach to runway 16. The PF set 3,000 ft into the altitude function of the aircraft’s flight control unit (FCU). At that time, the aircraft was passing 5,900 ft at an indicated airspeed of 253 kt.

Approaching waypoint NEFER, at 0135:30 and passing about 4,700 ft, SND2 commenced a left turn towards BOL (Figure 1). At 0136:38 the PF requested, and the PM selected, flap 1. The flaps reached this setting two seconds later. At 0136:39, the aircraft had completed the turn and rolled level on the NEFER to BOL track.

The inadvertent autoflight mode selections and following events

The following sequence of events, covering the next 39 seconds of flight, was drawn from the aircraft’s digital flight data recorder (DFDR), cockpit voice recorder (CVR) and crew interviews. This period can be divided into three distinct phases:

  • inadvertent FCU selections
  • thrust increases and the PF’s responses
  • recovery.

The sequence of events from 0136:35 is graphically presented in a data plot at Figure 2. Specific points on that data plot are identified to enable a clearer understanding of the rapidly changing events.

Figure 2

Inadvertent FCU selections

As the aircraft descended through 3,600 ft at 0136:39, the PF announced an intent to ‘arm the approach’. This required the PF to press the APPR (approach) pushbutton on the FCU. Instead, the PF pressed the EXPED (expedite) pushbutton (see Figure 3), resulting in the autoflight vertical mode changing from the open descent mode8 to the expedite descent mode9 (point 1). Over the next 5 seconds, the vertical descent rate increased from around 800 ft/min to around 1600 ft/min, while the airspeed remained stable at around 220 kt.

Figure 3

After a few seconds, the PM identified that the vertical mode had changed to expedite descent and announced this change to the PF. At 0136:44, upon recognising the incorrect mode selection the PF, in an apparent attempted to correct the error, pressed the A/THR (autothrust) pushbutton (to off) (point 2). Pressing the A/THR pushbutton had a number of effects:

  • The autothrust system disengaged and the engines’ thrust was locked at the thrust level prior to disconnection—idle thrust, which was the commanded thrust at that time (the thrust lock condition).
  • The master caution light and aural alert (a single chime) triggered.
  • The electronic centralised aircraft monitoring system THR LK message (thrust lock) was displayed, with an associated procedure.
  • A yellow flashing THR LK message was displayed in the flight mode annunciator on both pilots’ primary flight displays.

Almost immediately, at 0136:47, the PM recognised and announced the thrust lock condition. At about the same time, the autoflight system’s vertical mode transitioned to altitude acquire – ALT* on the vertical mode section (Figure 4), identifying that the autoflight system had captured the 3,000 ft target altitude.

Figure 4

At 0136:51, the PM announced that the aircraft had captured the target altitude. At about the same time the PF recognised the thrust lock condition and pressed the ‘instinctive disconnect’ buttons on both the side stick and thrust levers (see Figure 3). The PF later recalled that the intent behind that action was to reduce the aircraft’s airspeed and to retard the thrust levers. The use of the instinctive disconnect pushbuttons had the following effects:

  • The action of pressing the instinctive disconnect pushbutton on the sidestick disconnected the autopilot (point 3 in Figure 2), which in turn triggered the autopilot disconnect aural alert (‘CAVALRY CHARGE’). The CAVALRY CHARGE sounded for 1 second.
  • The pressing of the thrust lever instinctive disconnect pushbutton caused the thrust lock condition to disengage. It also removed the THR LK message from the electronic centralized aircraft monitoring system and the pilots’ flight mode annunciators. As the thrust levers remained set to the climb detent, the commanded thrust changed from idle to climb.

Thrust increases and the PF’s responses

At 0136:53 the engines began to respond to the commanded thrust change by rapidly increasing thrust (point 4). At about the same time, the PF reconnected the autopilot (point 5) but left the autothrust system disconnected. The PF responded to the rapidly increasing thrust by applying pitch-down inputs on the sidestick (point 6). The PF did not recall applying pitch-down input during post-occurrence interviews but did recall thinking that the aircraft was pitching up.

As a result of the PF’s pitch-down inputs on the side stick, at 0136:58 the autopilot disengaged (point 7). This disconnection again triggered the autopilot disconnect aural (CAVALRY CHARGE) alert, which sounded for 1 second. At the same time, the PF rapidly moved the thrust levers to idle (point 8). At this point, the aircraft’s airspeed was 240 kt and increasing, and the PM asked if the flaps should be retracted. The PF responded in the affirmative.

The PF’s pitch-down inputs, coupled with the aircraft’s high thrust level and the now downward flight vector, resulted in the aircraft’s airspeed and vertical rate of descent rapidly increasing (point 9). At 0137:00 the altitude warning (C CHORD aural alert) commenced. It continued to sound for 15 seconds. As the engine thrust reduced (from the thrust levers being moved back to idle) the PF transitioned from pitch-down to pitch-up inputs on the side stick (point 10). As a result, the rate of descent stabilised and then decreased.

At 0137:02, the first of the terrain avoidance and warning system (TAWS) alerts triggered. This alert, a ground proximity warning system Mode 1 SINK RATE caution, repeated twice. The PF responded by rapidly placing the thrust levers fully forward (point 11) and instructed the PM to advise ATC that they were ‘going around’. At 0137:05 the engines began to respond to the commanded thrust change and rapidly increased thrust (point 12). At the same time the second TAWS alert, an enhanced ground proximity warning system TERRAIN AHEAD, PULL UP, TERRAIN AHEAD warning activated, which ended after 3 seconds. The PF again responded to the rapidly increasing thrust by reducing the pitch-up inputs and then commencing pitch-down inputs (point 13). This reduced the rate at which the aircraft’s rate of descent was decreasing, which had the effect of prolonging the period that the aircraft was descending.

Recovery

At 0137:08 the PF began to introduce pitch-up commands, which further reduced but did not arrest the aircraft’s rate of descent (point 14). At 0137:13 the third TAWS alert, a ground proximity warning system Mode 2 TERRAIN TERRAIN PULL UP warning activated, ending after 2 seconds.

The PF responded with increasing pitch-up commands (point 15), which began to arrest the rate of descent. At 0137:15, the PM advised ATC that the aircraft was ‘going around’.

The lowest altitude attained by the aircraft during the occurrence, as recorded by the digital flight data recorder (DFDR), was 2,280 ft at 0137:17. At the same time, the flaps were recorded as being fully retracted. The lowest recorded height above ground level recorded by the radio altimeter was 1,100 ft. The aircraft’s maximum speed while the flaps were in the process of retracting was 314 kt.

At 0137:17, the ATC minimum safe altitude warning13 alert activated for SND2 at the ATC workstation. ATC data identified that the aircraft was descending through 2,300 ft at that time. The lowest recorded altitude by ATC was 2,200 ft. As the aircraft began to climb, ATC cleared the aircraft to climb to 4,000 ft and notified SND2 that a low altitude safety warning had triggered. The aircraft was cleared to and continued to climb to 5,000 ft. The flight crew requested vectors to intercept the ILS approach for runway 16. The aircraft landed on runway 16 at 0150 without further incident.

CONTEXT

Introduction

The Airbus A320 aircraft is a twin-engine, narrow body, short to medium range commercial passenger aircraft. The Airbus A320 family of aircraft comprises the A318, A319, A320 and A321 variants. Based on the original A320, the A319 is a shorter variant.

The air operator’s certificate authorised passenger charter operations using the Airbus A319. The operator used an A320 based simulator for training and proficiency checks.

Personnel information

Pilot recollection of the occurrence

The PM later recalled an impression that there was a lot of button pressing, as well as disconnecting and reconnecting of the autopilot during the event. The PM did not recall any TAWS alerts and neither pilot recalled hearing the altitude alert.

Cockpit voice recorder data identified that the PF did not verbalise any intention to change flight mode selections or other actions during the occurrence, other than the initial call identifying an intention to arm the approach.

The PM commented on the low lighting levels set for the flight instruments, which he considered may have resulted in a difficulty in identifying what selections the PF was making on the FCU.

The pilot flying

The pilot flying (PF) held an Air Transport Pilot (Aeroplane) Licence (ATP(A)L) and had accumulated about 17,250 hours of aeronautical experience. Of these, approximately 2,835 hours were on Airbus A320 type aircraft. In the 90 days preceding the occurrence, the PF had logged 69.5 hours, of which 57.1 were on A319.

The PF held a current Class 1 medical certificate, and as a condition of that certificate was required to wear distance vision correction and have available reading correction. These vision requirements were determined to have not influenced the occurrence.

About three months prior to the occurrence, the PF had completed a recurrent training session to a satisfactory standard in an A320 simulator, and in April 2015 a line check in an A319. The PF was current with all training requirements. The PF’s training reports identified that he had satisfactorily completed the required competency checks and was properly trained and proficient on the A320; however, of the 10 training records available that preceded the occurrence, there were two that contained reports of an occasional tendency to rush actions, and that this led to procedural lapses.

The PF was one of three flight crew employed by the operator authorised to conduct instrument training and checking on the A320 aircraft family. The PF was cross-trained on the operator’s other aircraft type, the CASA 212, and was also authorised to conduct training and checking on that type. Additionally, the PF held a management role, although the time required to conduct this role was reducing.

A significant proportion of the PF’s recent flight hours leading up to the occurrence were assigned to conducting check flights on the A319, rather than as the primary operating crewmember. The PF’s training and checking reports did not identify any recency or skill detriment resultant from the PF’s management and/or training roles. However, as the records were limited to approximately five years there was insufficient evidence to assess this further.

The pilot monitoring

The pilot monitoring (PM) held an ATP(A)L with a current Class 1 medical certificate and had accumulated about 12,290 hours of aeronautical experience, of which about 2,200 hours were on an Airbus A320 type aircraft. The PM was also a check and training captain. Prior to the occurrence, the PM had completed a recurrent training session in an Airbus A320 simulator in February 2015 and a line check in July 2014.

Human performance related information

As part of this investigation, several human factors-related aspects were considered in the context of the flight crew’s actions during the descent. These included the:

  • PF experiencing pitch-up illusions with thrust changes
  • PF inadvertently pressing the EXPED pushbutton and what could be considered other inadvertent actions by the PF
  • effect of fatigue
  • role of workload on both crew.

The pitch-up illusion

Pitch-up illusions are a vestibular misperception of acceleration, confused with a climb, and is amplified when visual cues are absent. Given that it was night-time, there would have been very limited visual cues outside the aircraft available to the pilots. The pitch-up illusion is also referred to as a somatogravic effect when referring to what the pilot experiences and is explained by Stott (2011) as follows:

…forward acceleration of the aircraft produces an equal inertial acceleration acting backwards on the pilot and increasing the sense of pressure from the back of the seat….The sensory information provided by the otolithic system is exactly similar to the…sensation of backward tilt…Thus from nonvisual sensations, a pilot is unable to distinguish between an actual backward tilt associated with the climb and an illusory sense of tilt associated with forwarding acceleration.

The pilot’s pitch-down inputs during the descent are consistent with this type of pitch-up illusion event.

Airbus perspective on pitch-up illusions

Airbus has identified the all-engine go-around as a specific manoeuvre where the pitch-up illusion can adversely affect the outcome of a normal procedure. In July 2011, Airbus published a procedural review of the all-engine go-around manoeuvre in their Safety First magazine.

The review was initiated as a result of a number of poorly handled all-engine go-arounds. Most real-world go-arounds were conducted at light weights and with high thrust. It was found that the likely consequence of not maintaining the correct pitch attitude during the go-around is acceleration towards the flap limit speed—when autothrust is not active, there is no speed protection to prevent a flap limit speed exceedance. A representation of the pitch-up, or what Airbus termed the false climb illusion, is shown in Figure 7.

Figure 7

The review included the following points pertinent to the second event, where the PF introduced pitch-down inputs while conducting the go-around manoeuvre:

All pilots must know the required initial pitch target for their aircraft BEFORE commencing a missed approach. They must maintain that pitch target by following the [speed reference system] commands in manual flight. With the autopilot engaged, they should use this knowledge to confirm the autopilot behaviour.

The go-around pitch target for the A320 was quoted as 15 degrees nose up, the importance of which was highlighted as follows:

During a manual Go Around, if the required pitch is not reached or maintained, linear acceleration will result. Research has shown that this may cause a “false climb illusion”. The false climb illusion may lead a pilot to believe that the aircraft is already above the required pitch. Consequently, a pilot may respond with an opposite and dangerous pitch-down input.

Inadvertent pilot actions

Regarding the PF’s inadvertent selection of the EXPED pushbutton, Reason (1990) stated that A slip is a type of error which results from some failure in the execution stage of an action sequence…These slips could arise because, in a highly routinized set of actions, it is unnecessary to invest the same amount of attention in the matching process….with oft-repeated tasks it is likely that [they] become automatized to the extent that they accept rough rather than precise approximations to the expected inputs.

Additionally, consideration was given to the outcome when similar objects (in this case, the pushbuttons A/THR, EXPED and APPR) were confused for each other. Perceptual confusion is a type of attentional slip and on that, Wickens and Hollands (2000) stated the following:

Perceptual confusions occur because a person may recognise a match for the proper object with an object that looks like it, is in the expected location or does a similar job…

The pushbuttons on the FCU were the same colour and size. Colour coding and placement of objects has an effect on perception, in the sense that if two items are the same colour, then using colour-coding can tie together items that are spatially separated on the display (Wickens and Hollands, 2000). Additionally, two items on a cluttered display will be more easily integrated or compared if they share the same colour (different from the clutter), but the shared colour may disrupt the ability to focus attention on one while ignoring the other.

In addition to considering objects of similar size and shape, the effect of flight deck lighting was also considered. Woodson and Conover (1964) described several important factors that should be considered in the design of any lighting system:

  • suitable brightness for the task at hand
  • uniform lighting for the task at hand
  • suitable brightness contrast between task and background
  • lack of glare from either the light source or the work surface
  • suitable quality and colour of illumination and surfaces.

With regard to the FCU pushbutton layout, lighting and colour coding (see Figure 5), the physical similarities (shape, size, and colour) and close proximities between the A/THR, EXPED and APPR pushbuttons on the FCU could have contributed to any perceptual confusion.

Decision making and conscious automaticity

Wickens and Hollands (2000) outline that when undertaking a task, we must translate the information that is perceived about the environment into an action and this action may be either an immediate response or based on a more thorough, time-consuming evaluation.

In relation to the PF’s reaction to the thrust lock condition, the limitations of decision making were considered, as was the concept of automatic actions. As outlined by Klein and Klinger (1991) cited in Harris (2011), naturalistic decision making is characterised by ‘dynamic and continually changing conditions, real-time reactions to these changes, ill-defined tasks, time pressure, significant consequences for mistakes’.

In instances where actions that have become well-learned, ‘it is as though practice leads to a mental repackaging of our behaviour…that can be set off with only a brief conscious thought…’ (Wheatley and Wegner, 2001). In this case, the PF pressing the instinctive disconnect buttons was achieved without any time-consuming conscious elements.

Fatigue

The International Civil Aviation Organization (ICAO 2016) defined fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety-related operational duties.

Fatigue can have a range of adverse influences on human performance. These include:

  • slowed reaction time
  • decreased work efficiency
  • increased variability in work performance
  • lapses or errors of omission (Battelle Memorial Institute 1998).

Time of day can be important for determining whether an individual is in a circadian low or high.

Human circadian rhythm is partially determined by the environmental light-dark cycle (Duffy, Kronauer, & Czeisler, 1996). The challenge can be for people to maintain alertness during the night-time hours and reduced sleepiness during the daytime rest break.

The Civil Aviation Safety Authority (2012) stated the following:

The circadian cycle has two periods of sleepiness, known as the circadian trough and the circadian dip. The circadian trough occurs typically between 0200 and 0500 hours (or dawn). During the circadian trough the body’s temperature is at its lowest level and mental performance, especially alertness, is at its poorest.

In the context of time on duty, Goode (2003) identified numerous studies that show an empirical relationship between work patterns and deteriorating performance. In accidents where fatigue was attributed, 20 percent occurred in the tenth (or more) hour of duty.

Caldwell (2003) stated that ‘the primary determinant of the level of fatigue is the time awake since the last sleep period.’ Russo and others (2005) found that ‘significant visual perceptual, complex motor and simple reaction time impairments began in the 19th hour of continuous wakefulness.’ As part of an NTSB study of short-haul domestic air carrier accidents from 1978 to 1990, ‘time since awake’ was a predominant factor, and often related to ‘ineffective decision making’.

The following data was relevant to the PF’s fatigue assessment. The PF:

  • usually obtained about 7 hours of sleep a night between 2300 and 0600
  • had conducted two flights over the previous 3 days (one of which was a positioning flight)
  • duty ended at 2115 the previous day, resulting in a 17-hour break prior to starting duty on the day of the occurrence
  • woke at about 0600 and commenced duty in Melbourne at 1415
  • reported feeling well rested
  • positioned to Perth, before operating the occurrence flight
  • recalled feeling ‘okay’ around the time of the occurrence, but had been awake for about 19.5 hours.

The occurrence took place at about 0130, which was 11 hours and 15 minutes after the PF’s duty commenced. However, the descent was taking place close to a known window of circadian low.

Along with the night conditions, with a relatively low-level of lighting in the flight deck, this may have contributed to feelings of sleepiness.

The ATSB evaluated the PF’s level of fatigue using two biomathematical models, Fatigue Avoidance Scheduling Tool (FAST) and System for Aircraft Fatigue Evaluation (SAFE). These models are decision aids designed to assess and forecast performance changes induced by sleep restriction and time of day.

Both models indicated a moderate level of fatigue. The FAST results indicated that at the time of the occurrence, there was a moderate likelihood that the PF was experiencing a level of fatigue known to have a demonstrated effect on performance. The SAFE results predicted that the PF would have felt ‘moderately tired, let down’ at the time of the occurrence, and in a moderate to high-risk category for experiencing the effects of fatigue.

The following data was relevant to the PM’s fatigue assessment. The PM:

  • usually obtained about 7.5 hours sleep a night between 2300 and 0630
  • was on a rostered period of leave in the two weeks prior to the occurrence
  • was in Perth on the day of the occurrence and woke at about 0630 Western Standard Time and had therefore been awake for about 17 hours at the time of the occurrence
  • commenced duty in Perth at 1800
  • reported feeling well rested and having adequate sleep the night before the occurrence
  • did not report any fatigue-related concerns associated with the occurrence flight.

Operator fatigue management

Organisations holding an Air Operator Certificate are generally required to comply with the Civil Aviation Orders Part 48 Flight Time Limitations (CAO 48). However, the Civil Aviation Safety Authority had granted the operator an exemption from CAO 48, under a specific instrument. This exemption was in force at the time of the occurrence. In place of the CAO 48 limitations, the operator was required to observe specific flight and duty limits contained in schedules to the instrument. With respect to this occurrence, the following flight and duty limits were relevant:

  • where the previous duty period did not exceed 12 hours, the time free of duty shall be 10 hours
  • the maximum hours per flight duty period for a local start time between 1300 and 1459, with one or two sectors, was 13 hours
  • flight deck duty limits for operations involving two crew was 10 hours.

Workload

In the context of aviation, workload has been described as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. It represents the cost incurred by the human operator in achieving a particular level of performance’ (Orlady and Orlady, 1999). A person experiences workload differently, based on their individual capabilities and the local conditions at the time. These conditions can include the following:

  • training and experience in the situation at hand
  • the operational demands during that phase of flight
  • if the person is experiencing the effects of fatigue
  • level of automation in use, and the mental requirements in interpreting their actions.

Research on unexpected changes in workload during flight has found that pilots who encounter abnormal or emergency situations experience a higher workload with an increase in the number of errors compared to pilots who do not experience these situations (Johannsen and Rouse, 1983).

Additionally, Holmes and others (2003) outline that high workload and distractions can result in a pilot scanning fewer instruments and checking each instrument less frequently.

Pilot recency and skill decay

The Civil Aviation Safety Regulations CASR 1998 Part 61: Flight Crew Licencing outlines that recent experience, or recency, refers to undertaking particular flight operations in the past 90 days. These flying experiences include take-off and landings, or instrument approaches, for example. Recency will generally be measured by flight hours (Haslbeck and others, 2014) or sectors flown (Ebattson, and others, 2010).

The concept of maintaining recency is important to reduce flight skill decay. In a commercial aviation context, Childs and Spears (1986) suggest that cognitive and procedural elements of flying skills decay more rapidly than control-oriented skills. Pilots were observed to have difficulty correctly identifying cues and classifying situations, although once a situation was correctly classified, they remembered what to do. Therefore, they propose that flying training should focus on pilot monitoring skills and recognition of different situations.

Despite the PF having management responsibilities, the PF had almost 70 hours in the previous 90 days, albeit with a significant training duty component. As a result, there was insufficient evidence to determine whether recency and/or skill decay had any influence on the flight crew’s actions.

vh-vcj-skytraders-airbus-a319-132_PlanespottersNet_396167

Photo (C) Victor Pody 

SAFETY ANALYSIS

While conducting an arrival procedure, prior to commencing an approach into Melbourne, Victoria on 15 May 2015, the Skytraders Airbus A319 descended to about 2,200 ft, which was below the ATC-assigned altitude of 3,000 ft. The crew broke off the arrival procedure and climbed to the new ATC cleared altitude of 5,000 ft before returning to land at Melbourne.

During the descent below 3,000 ft, the aircraft’s Terrain Avoidance and Warning System (TAWS) initiated a number of warning alerts, the speed limit for the aircraft flaps was exceeded, and the Minimum Safe Altitude Warning System (MSAW) initiated an alert to the ATC controller. Critically, during the 26 seconds from the time that the PF pressed the instinctive disconnect pushbutton on the thrust levers to when the aircraft reached its minimum altitude, the aircraft descended just over 1,000 ft and increased speed by about 100 kt.

The event was initiated by an inadvertent switch selection by the pilot flying (PF). This was followed by a combination of errors, rapidly changing events, high workload and an apparent response to a pitch-up illusion, resulting in the aircraft quickly developing a very high rate of descent and increasing airspeed.

Inadvertent FCU selections

As the aircraft was approaching the localiser for Melbourne runway 16, the PF recalled intending to arm the aircraft’s autoflight system (AFS) to capture the localiser for the approach. This required the PF to press the APPR pushbutton on the Flight Control Unit (FCU). Instead, the PF mistakenly pressed the EXPED pushbutton and the AFS entered the expedite descent mode. In an apparent attempt to cancel the expedite descent mode, the PF inadvertently pressed the A/THR pushbutton, which was adjacent to the EXPED pushbutton.

The acts of pressing the EXPED and then the A/THR pushbuttons were both predicated by a prior intention to act, but neither action went as planned. In this case, this prior intention was the pressing of the APP push button, which was part of a routine set of actions. Routine actions are generally characterised as requiring less attention.

The pressing of the A/THR was an apparent instinctive reaction to realising that an error had been made. Both selections were consistent with unintentional slips. Furthermore, the similar size, shape and colour of the EXPED and APPR buttons on the FCU, as well as their close proximity, may have contributed to the error. The lighting conditions on the flight deck may have increased the difficulty for the pilot monitoring (PM) to monitor the actions of the PF.

Reaction to ‘thrust lock’ condition

After the PF inadvertently pressed the A/THR pushbutton on the FCU, the Flight Mode Annunciator and Electronic Centralised Aircraft Monitor (ECAM) identified that the autothrust system had disengaged and the thrust locked at the existing setting, which was idle. The ECAM notified the flight crew of this change by displaying the THR LK caution message, as well as an associated procedure. The flight warning computer simultaneously sounded the caution aural alert, while the FMA’s autothrust column displayed the changed mode. The PM immediately identified this changed autothrust condition and verbally notified the PF of the change. It could not be determined whether this call was in response to the ECAM notification with associated master caution aural alert or the FMA change.

Normal procedure for disconnecting the autothrust system was to press the autothrust instinctive disconnect (I/D) pushbutton, but this procedure first required the pilot to match the position of the thrust lever with the actual thrust setting. The thrust lever angle indicator assisted in this process.

The aim of the THR LK ECAM procedure was to remove the engines’ locked thrust condition. That procedure also included matching the thrust lever position to the actual thrust setting.

On becoming aware that the engines’ thrust had been locked, the PF reacted by pressing the autopilot and autothrust instinctive disconnect pushbuttons, thereby removing the thrust lock condition. The likely intent of disconnecting both autopilot and autothrust was to revert to a fully manual flight mode. This is supported by the simultaneous disconnection of the autopilot and autothrust systems through the use of the instinctive disconnect buttons, an automatic action to complete the apparent intent.

However, in disconnecting the autothrust, the PF did not match the thrust levers to the current power or set the desired power. This was likely to be a lapse, which is ‘simply omitting to perform one of the required steps in a sequence of actions’ (Harris, 2011). As to why this lapse occurred, the PF’s incomplete response to the ‘thrust lock’ condition may have been a result of a response consistent with a perceived urgency to handle an undesirable state, particularly as the instinctive disconnect pushbuttons were designed for a quick response

High thrust with pitch-down attitude

As a result of not matching the thrust lever angle to the locked thrust setting when disengaging the thrust lock condition, the thrust increased to the climb setting at which the thrust levers were positioned. This resulted in a significant, unexpected thrust increase. The PF responded by applying pitch-down inputs on the side stick and a few seconds later retarded the thrust levers to idle. The pitch-down attitude with high thrust—the engines did not respond to the commanded thrust reduction for a further few seconds—resulted in the aircraft adopting a rapidly accelerating downward vector. At about this time the altitude alert began to chime and, shortly thereafter, the aircraft descended through its clearance limit altitude.

As the aircraft passed through the clearance limit altitude, the first of the TAWS alerts triggered. The PF responded with a declared intent to go-around and rapidly positioned the thrust levers to full power. However, the PF did not raise the aircraft’s pitch attitude to the recommended 15 degrees nose up for the conduct of a go-around. While the PF commenced some pitch-up commands, the aircraft’s attitude remained well below the horizon, resulting in a continuation of the accelerating airspeed and high rate of descent.

Just as the engines began to increase thrust, the second TAWS alert triggered. The procedural response to this second alert was to apply full backstick and maintain that position while setting the thrust to maximum power. However, the PF again responded to the increasing engine thrust with pitch-down commands, resulting in a continuation of the aircraft’s downward flight path. The PF arrested the descent after about 10 seconds, during which time a further TAWS alert triggered.

The flap overspeed

During the period of high thrust, the PM selected the flaps from 1 to UP as the aircraft was accelerating through 260 kt. The slats were not fully retracted for a further 12 seconds, by which time the aircraft had accelerated to more than 310 kt. The limit speed for flap 1 was 230 kt.

The effect of pitch-up illusions during rapid thrust increases

The PF did recall applying pitch-down side stick input during the rapid thrust increases and did not identify the increasing rate of descent, resulting from the nose-down attitude. The PF did, however, recall thinking that the aircraft was pitching up. Throughout the occurrence, the night conditions and operations within cloud resulted in the absence of a natural horizon. It was therefore likely that the PF’s pitch-down side stick inputs were in response to pitch-up (somatogravic) illusions caused by the unexpected and rapid increase in thrust. The PF’s susceptibility to the effects of pitch-up illusions was possibly exacerbated by also experiencing a high workload, which would likely reduce monitoring of flight instruments.

The effect of the pitch-up illusion influenced the breach of altitude, the EGPWS alerts, and the exceedance of the flap limit speed.

The PM’s ability to influence the events

The primary role of the PM is to monitor the aircraft’s flight path and performance and immediately bring any concern to the PF’s attention. However, Dismukes and Berman (2010) have shown that, while flight crew monitoring is an important defence that is performed appropriately in the vast majority of cases, it does not always catch flight crew errors and equipment malfunctions. They also noted:

…even though automation has enhanced situation awareness in some ways…it has undercut situation awareness by moving pilots from direct, continuous control of the aircraft to managing and monitoring systems, a role for which humans are poorly suited.

When considering whether the PM was likely to be able to identify and therefore influence the events that led to the flap overspeed and the breaching of the cleared altitude, the following factors were considered. The:

  • PM verbally identified the expedite descent mode change and the appearance of the ‘thrust lock’ condition
  • PM had difficulty in identifying the PF’s actions, being unable to see the PF selections on the FCU
  • lighting levels in the flight deck were low
  • reduced communication between the flight crew—specifically, the PF did not communicate an intended response to the expedite descent mode engagement, THR LK ECAM message, or the various autopilot disconnections and reconnections
  • PF did not announce mode changes annunciated on the FMA as required by the standard operating procedures, those changes being resultant from FCU and autoflight system inputs made by the PF
  • PF’s response to the thrust lock condition was contrary to normal procedure
  • PM’s attention was probably focused on the flap speed when the aircraft started to rapidly accelerate early in the occurrence. By the time that the PM had selected the flap up, the aircraft had developed a very high rate of descent and descended through the clearance limit altitude
  • PM recalled that there was ‘a lot of button pressing’ throughout the occurrence and that the autopilot was disengaged several times.

The period of time from the inadvertent FCU selections through to the aircraft returning to a positive rate of climb was short but characterised by rapidly changing events with multiple visual and aural alerts. The PM’s ability to identify and influence the rapidly changing situation was likely affected by the non-routine nature of the event, actions of the PF, reduced communication between the flight crew and an apparent focus on the flap speed exceedance as the aircraft started to accelerate.

Crew workload

Pilots who encounter abnormal or emergency situations experience a higher workload with an increase in performance errors compared to pilots who do not experience these situations (Johannsen and Rouse, 1983). During the occurrence, the attention of the flight crew was likely divided between a number of different information cues and task requirements, from the time the PF made the inadvertent selections on the FCU, through to when the aircraft began to climb.

These included:

  • multiple aural warnings and alerts
  • identifying and responding to mode changes, including appropriate actions to address the THR LK ECAM message
  • disengagements and re-engagement of the autopilot
  • focus on airspeed (mostly by the PM)
  • interactions with ATC towards the end of the occurrence sequence.

At the time, the aircraft was in the descent phase, which inherently has a higher workload. The PM recalled that the workload became very high after the inadvertent FCU selections occurred. The high workload experienced by the PM was demonstrated in the use of an incorrect call sign during

ATC communications, as the aircraft started to climb out.

The degree of recollection from both crew after the occurrence also indicated that they experienced a high workload over a short period of time, as details including the numerous aural warnings (including the EGPWS), one of the inadvertent FCU selections and autopilot changes were not recalled. Overall, the high workload the flight crew experienced appeared to have limited their capacity to identify mode changes, such as autopilot disconnections, and to respond to the aircraft’s undesired high rate of descent.

Crew fatigue

The PF awoke at a normal time of 0630, signed on at Melbourne and did not report receiving any rest before or during the operation from Perth to Melbourne. It is reasonable to conclude that, due to time awake, time on duty and the time of day, the PF was probably experiencing a level of fatigue known to have at least some effect on performance. This was predicted by biomathematical fatigue models. There was, however, insufficient evidence to indicate that fatigue contributed to the occurrence. The ATSB also did not ascertain any systemic issues associated with the operator’s management of fatigue.

FINDINGS

From the evidence available, the following findings are made with respect to the descent below minimum permitted altitude involving an A319, VH-VCJ, near Melbourne Airport, Victoria on 15 May 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance.

A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

  • The pilot flying inadvertently selected the EXPED pushbutton instead of the APPR pushbutton, and, in an attempt to correct the error, pressed the A/THR pushbutton, creating a thrust lock condition.
  • In attempting to remove the thrust lock condition, the pilot flying pressed the instinctive disconnect pushbutton but did not move the thrust levers to match the locked thrust setting. As the thrust was locked at idle while the thrust levers were set to climb thrust, this resulted in an unexpected, significant thrust increase.
  • The pilot flying likely experienced pitch-up illusions during two rapid thrust increases and responded to these illusions with pitch-down sidestick input.
  • Pitch-down inputs by the pilot flying, combined with a very high thrust setting, resulted in a very high rate of descent with rapidly increasing airspeed. This led to the breach of the cleared minimum descent altitude, as well as triggering a number of Enhanced Ground Proximity Warning System alerts.
  • The rapidly changing aircraft state led to the crew experiencing a high workload. This was likely to have limited their capacity to identify mode changes and to respond to the aircraft’s undesired high airspeed and rate of descent.
  • The pilot monitoring’s ability to identify and influence the rapidly changing situation was likely affected by the non-routine actions of the pilot flying, the reduced communication between the flight crew and an apparent focus on the flap speed exceedance as the aircraft started to accelerate.

Other factors that increased risk

  • At the time of the occurrence, the pilot flying was likely experiencing a level of fatigue known to have a demonstrated effect on performance, predominantly due to the time of day and time awake.
  • The aircraft’s rapidly increasing airspeed resulted in the limit speed for the extension of the aircraft slats being significantly exceeded.

SOURCE: Australian Transport Safety Bureau. Excerpted from  Descent below minimum permitted altitude involving Airbus A319, VH-VCJ. Aviation Occurrence Investigation AO-2015-048. Final report – 24 November 2017 

FURTHER READING

  1. The Head-Up Illusion: do you remember it?
  2. Armavia A320 crash during go-around at night in poor meteorological conditions
  3. Tatarstan B735 crash during go-around at night. Learning from the recent past
  4. Going around with all engines operating
  5. Speaking of going around
  6. Loss of flight crew airplane state awareness 
  7. Let’s go around
  8. Flydubai accident Interim Report

**********************

minime2By Laura Victoria Duque Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day 

3 thoughts on “Descent below minimum permitted altitude, final report

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s