Descent below minimum permitted altitude involving A319, VH-VCJ, near Melbourne Airport, Victoria, on 15 May 2015

Introduction

On the evening of 14 May 2015 an Airbus A319, call-sign Snowbird Two (SND2) departed Perth, Western Australia for Melbourne, Victoria. The aircraft was registered as VH-VCJ and operated by Skytraders Pty Ltd as a passenger charter service with 5 crew and 18 passengers. The aircraft’s flight crew consisted of two captains. The pilot-in-command occupied the left seat and was the pilot flying (PF).^[1] The other captain occupied the right seat and was performing the pilot monitoring (PM) duties.

As the aircraft was positioning to commence the approach into Melbourne, the PF made a number of inadvertent autoflight mode selections, which led to the autothrust system disengaging and the engines entering the thrust lock condition. The PF’s actions to correct the thrust lock resulted in an unexpected increase in thrust. In response to the thrust increase, the PF made a number of pitch-down inputs and retarded the thrust levers. The pitch-down inputs, when combined with the increased thrust, resulted in the aircraft developing a high rate of descent with an accelerating airspeed. This led to the aircraft descending below the cleared altitude, as well as the triggering of a number of Terrain Avoidance and Warning System (TAWS) alerts. During the subsequent response to these alerts, the aircraft did not commence climbing for about another 10 seconds, and after two further TAWS alerts had activated.

Events leading up to the inadvertent autoflight mode selections

Approaching Melbourne and before commencing descent, the flight crew set up the aircraft’s flight management guidance system and then briefed for an expected WENDY 1A standard arrival route (STAR) procedure, with an instrument landing system (ILS)^[2] approach to runway 16^[3] for landing (Figure 1). Shortly after, air traffic control (ATC) cleared the aircraft for the WENDY 1A STAR. In the early morning of 15 May 2015, at about 0120 Eastern Standard Time,^[4] the aircraft commenced the descent into Melbourne.

The PF commenced the descent with the following autoflight systems and modes selected:

• Autopilot 1 (AP1) was controlling the aircraft.
• Lateral navigation was in the ‘navigation’ (NAV) mode, while vertical navigation was in the ‘descent’ mode, both of which were managed modes^[5] where the aircraft follows a pre-planned horizontal and vertical flight path loaded in the flight management guidance computer.
• Autothrust system was on, with the thrust levers at the managed thrust position—the climb thrust detent that equated to a thrust lever angle of 22.5 degrees.

Figure 1: The Wendy 1A standard arrival procedure to Melbourne runway 16 ILS approach

Source: Airservices Australia

At 0128, SND2 called ATC and advised that the aircraft was on descent to a cleared altitude of 9,000 ft, and that they had received ATIS^[6] information Romeo.

As SND2 approached waypoint KIKEX (Figure 1) at 0134:25, ATC cleared the aircraft to descend to 3,000 ft and for the ILS approach to runway 16. The PF set 3,000 ft into the altitude function of the aircraft’s flight control unit (FCU). At that time, the aircraft was passing 5,900 ft at an indicated airspeed of 253 kt.

Approaching waypoint NEFER, at 0135:30 and passing about 4,700 ft, SND2 commenced a left turn towards BOL (Figure 1). At 0136:38 the PF requested, and the PM selected, flap 1. The flaps reached this setting two seconds later. At 0136:39, the aircraft had completed the turn and rolled level on the NEFER to BOL track.

The inadvertent autoflight mode selections and following events

The following sequence of events, covering the next 39 seconds of flight, was drawn from the aircraft’s digital flight data recorder (DFDR), cockpit voice recorder (CVR) and crew interviews. This period can be divided into three distinct phases:

• inadvertent FCU selections
• thrust increases and the PF’s responses
• recovery.

The sequence of events from 0136:35 is graphically presented in a data plot at Figure 2. Specific points on that data plot^[7] are identified to enable a clearer understanding of the rapidly changing events.

Figure 2: Data plots based on DFDR and CVR Data

The arrowed numbers identify specific events referred to in the sequence of events. The vertical grid lines each represent 1 second. Source: ATSB

Inadvertent FCU selections

As the aircraft descended through 3,600 ft at 0136:39, the PF announced an intent to ‘arm the approach’. This required the PF to press the APPR (approach) pushbutton on the FCU. Instead, the PF pressed the EXPED (expedite) pushbutton (see Figure 3), resulting in the autoflight vertical mode changing from the open descent mode^[8] to the expedite descent mode^[9] (point 1). Over the next 5 seconds the vertical descent rate increased from around 800 ft/min to around 1600 ft/min, while the airspeed remained stable at around 220 kt.

Figure 3: Autoflight controls

The flight control unit is expanded and, from left to right, the A/THR, EXPED and APPR buttons highlighted. The PF’s instinctive disconnect buttons on the side stick and thrust levers are also identified. Source: Airbus and ATSB

After a few seconds the PM identified that the vertical mode had changed to expedite descent and announced this change to the PF. At 0136:44, upon recognising the incorrect mode selection the PF, in an apparent attempted to correct the error, pressed the A/THR^[10] (autothrust) pushbutton (to off) (point 2). Pressing the A/THR pushbutton had a number of effects:

• The autothrust system disengaged and the engines’ thrust was locked at the thrust level prior to disconnection—idle thrust, which was the commanded thrust at that time (the thrust lock condition).
• The master caution light and aural alert (a single chime) triggered.
• The electronic centralised aircraft monitoring system^[11] THR LK message (thrust lock) was displayed, with an associated procedure.
• A yellow flashing THR LK message was displayed in the flight mode annunciator on both pilots’ primary flight displays.^[12]

Almost immediately, at 0136:47, the PM recognised and announced the thrust lock condition. At about the same time, the autoflight system’s vertical mode transitioned to altitude acquire (ALT* on the vertical mode section of Figure 4), identifying that the autoflight system had captured the 3,000 ft target altitude.

At 0136:51, the PM announced that the aircraft had captured the target altitude. At about the same time the PF recognised the thrust lock condition and pressed the ‘instinctive disconnect’ buttons on both the side stick and thrust levers (see Figure 3). The PF later recalled that the intent behind that action was to reduce the aircraft’s airspeed and to retard the thrust levers. The use of the instinctive disconnect pushbuttons had the following effects:

• The action of pressing the instinctive disconnect pushbutton on the sidestick disconnected the autopilot (point 3), which in turn triggered the autopilot disconnect aural alert (‘CAVALRY CHARGE’). The CAVALRY CHARGE sounded for 1 second.
• The pressing of the thrust lever instinctive disconnect pushbutton caused the thrust lock condition to disengage. It also removed the THR LK message from the electronic centralised aircraft monitoring system and the pilots’ flight mode annunciators. As the thrust levers remained set to the climb detent, the commanded thrust changed from idle to climb.

Thrust increases and the PF’s responses

At 0136:53 the engines began to respond to the commanded thrust change by rapidly increasing thrust (point 4). At about the same time, the PF reconnected the autopilot (point 5) but left the autothrust system disconnected. The PF responded to the rapidly increasing thrust by applying pitch-down inputs on the sidestick (point 6). The PF did not recall applying pitch-down input during post occurrence interviews, but did recall thinking that the aircraft was pitching up.

As a result of the PF’s pitch-down inputs on the side stick, at 0136:58 the autopilot disengaged (point 7). This disconnection again triggered the autopilot disconnect aural (CAVALRY CHARGE) alert, which sounded for 1 second. At the same time, the PF rapidly moved the thrust levers to idle (point 8). At this point, the aircraft’s airspeed was 240 kt and increasing, and the PM asked if the flaps should be retracted. The PF responded in the affirmative.

The PF’s pitch-down inputs, coupled with the aircraft’s high thrust level and the now downward flight vector, resulted in the aircraft’s airspeed and vertical rate of descent rapidly increasing (point 9). At 0137:00 the altitude warning (C CHORD aural alert) commenced. It continued to sound for 15 seconds. As the engine thrust reduced (from the thrust levers being moved back to idle) the PF transitioned from pitch-down to pitch-up inputs on the side stick (point 10). As a result, the rate of descent stabilised and then decreased.

At 0137:02, the first of the terrain avoidance and warning system (TAWS) alerts triggered. This alert, a ground proximity warning system Mode 1 SINK RATE caution, repeated twice. The PF responded by rapidly placing the thrust levers fully forward (point 11) and instructed the PM to advise ATC that they were ‘going around’. At 0137:05 the engines began to respond to the commanded thrust change and rapidly increased thrust (point 12). At the same time the second TAWS alert, an enhanced ground proximity warning system TERRAIN AHEAD, PULL UP, TERRAIN AHEAD warning activated, which ended after 3 seconds. The PF again responded to the rapidly increasing thrust by reducing the pitch-up inputs and then commencing pitch-down inputs (point 13). This reduced the rate at which the aircraft’s rate of descent was decreasing, which had the effect of prolonging the period that the aircraft was descending.

Recovery

At 0137:08 the PF began to introduce pitch-up commands, which further reduced but did not arrest the aircraft’s rate of descent (point 14). At 0137:13 the third TAWS alert, a ground proximity warning system Mode 2 TERRAIN TERRAIN PULL UP warning activated, ending after 2 seconds. The PF responded with increasing pitch-up commands (point 15), which began to arrest the rate of descent. At 0137:15, the PM advised ATC that the aircraft was ‘going around’.

The lowest altitude attained by the aircraft during the occurrence, as recorded by the digital flight data recorder (DFDR), was 2,280 ft at 0137:17. At the same time, the flaps were recorded as being fully retracted. The lowest recorded height above ground level recorded by the radio altimeter was 1,100 ft. The aircraft’s maximum speed while the flaps were in the process of retracting was 314 kt.

At 0137:17, the ATC minimum safe altitude warning^[13] alert activated for SND2 at the ATC workstation. ATC data identified that the aircraft was descending through 2,300 ft at that time. The lowest recorded altitude by ATC was 2,200 ft. As the aircraft began to climb, ATC cleared the aircraft to climb to 4,000 ft and notified SND2 that a low altitude safety warning had triggered. The aircraft was cleared to and continued to climb to 5,000 ft. The flight crew requested vectors to intercept the ILS approach for runway 16. The aircraft landed on runway 16 at 0150 without further incident.

Pilot recollection of the occurrence

The PM later recalled an impression that there was a lot of button pressing, as well as disconnecting and reconnecting of the autopilot during the event. The PM did not recall any TAWS alerts and neither pilot recalled hearing the altitude alert.

Cockpit voice recorder data identified that the PF did not verbalise any intention to change flight mode selections or other actions during the occurrence, other than the initial call identifying an intention to arm the approach.

The PM commented on the low lighting levels set for the flight instruments, which he considered may have resulted in a difficulty in identifying what selections the PF was making on the FCU.

__________

1. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. A standard ground aid to landing, comprising two directional radio transmitters: the localiser, which provides direction in the horizontal plane; and the glideslope, for vertical plane direction, usually at an inclination of 3°. Distance measuring equipment or marker beacons along the approach provide distance information.
3. Runway number: the number represents the magnetic heading of the runway.
4. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
5. For a more detailed discussion on managed vs selected modes, see ‘Autoflight system’ in the Context section.
6. Automatic terminal information service. An automated pre-recorded transmission indicating the prevailing weather conditions at the aerodrome and other relevant operational information for arriving and departing aircraft. The designator identifies the current version of that information.
7. These points are Identified by numbered arrows, and then referred to as ‘point x’ in the discussion.
8. The open descent mode is a selected mode where the aircraft uses target values set by the flight crew using the flight control unit (FCU) selections, while disregarding any constraints contained within the prepared vertical flight path loaded in the flight management guidance computer.
9. The expedite mode is designed to maximise the aircraft’s vertical speed to a target altitude. See Expedite descent in the Context section.
10. The A/THR pushbutton arms, activates, or disconnects the autothrust system. When autothrust is active, the flight management guidance computers determine the required thrust. That thrust is limited to the value that corresponds with the thrust lever position.
11. See The electronic centralised aircraft monitor in the Context section.
12. See The primary flight display and flight mode annunciator in the Context section.
13. See Minimum Safe Altitude Warning in the Context section.

Introduction

The Airbus A320 aircraft is a twin engine, narrow body, short to medium range commercial passenger aircraft. The Airbus A320 family of aircraft comprises the A318, A319, A320 and A321 variants. Based on the original A320, the A319 is a shorter variant.

The air operator’s certificate authorised passenger charter operations using the Airbus A319. The operator used an A320 based simulator for training and proficiency checks.

Personnel information

The pilot flying

The pilot flying (PF) held an Air Transport Pilot (Aeroplane) Licence (ATP(A)L) and had accumulated about 17,250 hours of aeronautical experience. Of these, approximately 2,835 hours were on Airbus A320 type aircraft. In the 90 days preceding the occurrence, the PF had logged 69.5 hours, of which 57.1 were on A319.

The PF held a current Class 1 medical certificate, and as a condition of that certificate was required to wear distance vision correction and have available reading correction. These vision requirements were determined to have not influenced the occurrence.

About three months prior to the occurrence, the PF had completed a recurrent training session to a satisfactory standard in an A320 simulator, and in April 2015 a line check in an A319. The PF was current with all training requirements. The PF’s training reports identified that he had satisfactorily completed the required competency checks and was properly trained and proficient on the A320; however, of the 10 training records available that preceded the occurrence, there were two that contained reports of an occasional tendency to rush actions, and that this led to procedural lapses.

The PF was one of three flight crew employed by the operator who were authorised to conduct instrument training and checking on the A320 aircraft family. The PF was cross-trained on the operator’s other aircraft type, the CASA 212, and was also authorised to conduct training and checking on that type. Additionally, the PF held a management role, although the time required to conduct this role was reducing.

A significant proportion of the PF’s recent flight hours leading up to the occurrence were assigned to conducting check flights on the A319, rather than as the primary operating crewmember. The PF’s training and checking reports did not identify any recency or skill detriment resultant from the PF’s management and/or training roles. However, as the records were limited to approximately five years there was insufficient evidence to assess this further.

The pilot monitoring

The pilot monitoring (PM) held an ATP(A)L with a current Class 1 medical certificate, and had accumulated about 12,290 hours of aeronautical experience, of which about 2,200 hours were on an Airbus A320 type aircraft. The PM was also a check and training captain. Prior to the occurrence, the PM had completed a recurrent training session in an Airbus A320 simulator in February 2015 and a line check in July 2014.

Operations manuals

The operator’s Operations Manual suite was subdivided into five parts. The relevant parts to the investigation included:

• Part A – Operations Manual (OPSA). OPSA contained company policy, requirements and standard operating procedures (SOP)
• Part B – Aeroplane type operating procedures (OPSB). A suite of manuals that contained specific aeroplane type operating procedures and requirements.

The Operations Manual suite was supplemented by Notices to Aircrew. These notices were temporary information that required urgent distribution and notification to the company’s aircrew. There were no notices relevant to the occurrence.

OPSB covered company specific matters that related to a particular aircraft type. The OPSB-A319 stated that flight crew were to use Airbus A319 procedures and limitations, unless modified by information contained within that manual. OPSB-A319 did not include any company specific A319 procedures that were relevant to the investigation.

Airbus procedures were published in company tailored Airbus A319 manuals as part of the OPSB suite. These manuals included the Flight Crew Operating Manual (FCOM), Flight Crew Training Manual (FCTM) and Quick Reference Handbook (QRH).

Aircraft information

The operator’s Airbus documentation was A320 family based. The source of the information presented in this section is the operator’s A320 family FCOM, FCTM and QRH, which Airbus had tailored to meet specifications of the operator’s aircraft, including VH-VCJ.

The primary flight display and flight mode annunciator

The pilot’s primary flight display (PFD) is the outboard of the pilot’s two display screens (Figure 4). The PFD incorporated the primary flight instruments, as well as the flight mode annunciator (FMA). The FMA, which is located just above the primary flight instruments in the top section of the PFD, showed the status of the:

• autothrust in column 1
• autopilots and flight directors vertical and lateral modes in columns 2 and 3 respectively
• approach capabilities and set decision height or minimum descent altitude in column 4
• engagement status of the autopilots, flight directors and autothrust in column 5.

The FCOM section on normal procedures stated that:

The PF should call out any FMA change, unless specified differently (e.g. CAT II & III task sharing). Therefore, the PF should announce:

‐ All armed modes with the associated color (e.g. blue, magenta): "G/S blue", "LOC blue".

‐ All active modes without the associated color (e.g. green, white): "NAV", "ALT".

The PM should check and respond, "CHECKED" to all FMA changes called out by the PF.

Figure 4: The PFD and E/WS displays expanded, with FMA highlighted

Source: Airbus, modified by ATSB

The electronic centralised aircraft monitor

The electronic centralised aircraft monitor (ECAM) monitors aircraft systems, displays aircraft system information, and specifies flight crew actions to be taken in the event of abnormal or emergency situations. The ECAM components relevant to this investigation included the engine/warning display (E/WD) (see Figure 4) and the flight warning computer’s aural and visual alerting systems.

The E/WD display provides the flight crew with the following types of information. On the:

• upper part of the display, primary engine parameters, fuel, and slats/flaps position
• lower part of the display, warning and caution messages and ECAM procedures.

When the ECAM detects a failure, and there is no flight phase inhibition active,^[14] the flight warning computer generates alert messages, aural alerts, and synthetic voice messages. The flight warning computer also drives the master warning light and master caution light. The E/WD displays the alert message as well as the procedures to be followed by the flight crew.

Individual aircraft system failures are graded according to their safety effect on the aircraft, which in turn prioritises how multiple failures are presented to the flight crew. The ECAM has three failure mode levels:

• Level 3: Red warning, denoting a dangerous aircraft configuration, limiting flight condition or system failure that alters flight safety that requires immediate action. They are accompanied by:
  - a continuous repetitive chime or a specific synthetic voice aural alert
  - illumination of the master warning light
  - a warning message on the E/WD.
• Level 2: Amber caution, denoting a system failure that does not have a direct consequence on flight safety. The flight crew should be aware of the condition and, time and situation permitting, these cautions should be considered without delay. They are accompanied by:
  - a single chime aural alert
  - illumination of the master caution light
  - a caution message on the E/WD.
• Level 1: Amber caution, requiring crew monitoring. These failures are accompanied by:
  - a caution message on the E/WD, generally without an accompanying procedure.

In the event of simultaneous failures, a level 3 warning has priority over a level 2 caution, which has priority over a level 1 caution.

ECAM procedures

The FCOM included some basic crew co-ordination procedures associated with the conduct of abnormal and emergency actions. For response to an ECAM, the crewmember that first recognises the ECAM was required to reset the master warning/caution and announce the title failure as indicated on the E/WD. The PF should then order ECAM actions. This cues the PM to manage the failure by first confirming the failure and then conducting the procedure as displayed on the lower section of the E/WD.

OPSA included the following with respect to emergency and abnormal checklists:

• Emergency drills and procedures were to be carried out as per the relevant aircraft emergency checklists and/or in accordance with ECAM procedures.
• If a drill required the movement of a thrust lever, this was to be called for by the PM and conducted by the PF.

Autoflight system

The autoflight system (AFS) comprised four broad functional subsystems:

• Input: through the multifunctional control and display units (which were not relevant for this investigation) and the flight control unit (FCU).
• Data: from the aircraft’s navigation systems, as well as performance and navigational data.
• Computing: through the two flight management guidance systems (FMGS).
• Output: to the flight directors, autopilots, autothrust, and the electronic flight information system that included the PFD and navigation displays.

The FMGS had two distinct functions:

• Flight management, which enabled the aircraft to follow a pre-planned route with vertical, horizontal and speed profiles, through computing the aircraft’s position in conjunction with stored performance and navigational data.
• Flight guidance, which controlled the flight directors, autopilots and autothrust.

The autopilots, flight directors, and autothrust used two types of guidance modes to direct the aircraft:

• Managed guidance, where the FMGS guided the aircraft along a pre-planned route with vertical and speed profiles computed by the FMGS’s flight management function.
• Selected guidance, where the FMGS’s flight guidance function guided the aircraft using targets for lateral, vertical and speed profiles set by the flight crew through the FCU.

The flight control unit

The horizontal and vertical controls for the aircraft’s AFS were located on the glare-shield FCU (Figure 3) equidistant to both pilots. There were a number of switches that selected various modes and functions of the AFS, including anticlockwise, from left to right (Figure 5), the:

• AP1 pushbutton, which engaged or disengaged autopilot number 1
• A/THR pushbutton, which armed, activated or disconnected the autothrust
• EXPED pushbutton, which engaged the expedite mode
• APPR pushbutton, which armed, disarmed, engaged or disengaged the approach modes
• altitude window, which displayed the altitude target as selected by the flight crew.

Expedite descent

The expedite mode is used in climb or descent to reach the target altitude that is set on the FCU altitude window (Figure 5) using a maximum vertical gradient. The expedite mode will ignore any altitude and/or speed constraint set in the flight management part of the FMGS. When the aircraft is in the descent phase, and the EXPED pushbutton on the FCU is pressed (Figure 5), the AFS will enter the expedite descent mode (EXP DES). In this mode:

• the autopilot or flight director will command the aircraft to increase the vertical speed by pitching the aircraft down
• the autothrust will command idle thrust
• with flap selected, the target speed is the limit speed for the flap setting selected
• the first column of the FMA will display THR IDLE, while the second column will display EXP DES (see Figure 4).

The selection of another managed or selected vertical guidance mode, or the selection of a higher altitude on the FCU, will disengage the expedite mode. The expedite mode will automatically disengage when the FMGS captures the target altitude set in the FCU altitude window. When this occurs, column 2 of the FMA (Figure 4) will display ALT*.

Figure 5: Part of the FCU with AP1, A/THR, EXPED and APP pushbuttons as well as the altitude window highlighted in red

Source: flightdecksolutions.com modified by the ATSB

Autothrust system

The autothrust computer is part of the flight guidance system. It interfaces with each engine’s electronic control unit. With autothrust active, the autothrust computer does not move the thrust levers to match the commanded thrust, but instead uses the thrust lever angle (TLA) to determine the maximum thrust that autothrust can command. The E/WD display shows the TLA (that is, the position of the thrust levers) as a small blue circle on the top engine instrument indicator (left side of Figure 6). With autothrust active, the normal position for the thrust levers is the climb detent on the thrust lever range.

Figure 6: The thrust lever angle

Engine instruments showing the relationship between the thrust lever angle and the TLA, (left hand diagram) and the autothrust disengagement procedure (right hand diagram). Source: Airbus, modified by ATSB

The normal method for disconnecting autothrust is by pressing the instinctive disconnect pushbutton on the thrust levers (right side of Figure 6). Pressing the instinctive disconnect pushbutton transfers the commanded thrust from the autothrust computer to the position of the thrust levers. When disconnecting autothrust, the PF should first ensure that the thrust levers are matched to approximately the current thrust setting, as indicated by the TLA on the E/WD, before pressing the instinctive disconnect pushbutton. If the pilot does not match the TLA to the actual thrust when the instinctive disconnect pushbutton is pressed, engine thrust will change to that commanded by the thrust lever position.

In the event of a failure of the instinctive disconnect pushbuttons, an alternative method of disconnecting autothrust is to press the A/THR pushbutton on the FCU (Figure 5). This is not a recommended method of disconnection as it will result in the engines entering the thrust lock mode. In the thrust lock mode:

• thrust is frozen and remains locked at the thrust value when the A/THR pushbutton was pressed
• column 1 of the FMA (Figure 4) will display THR LK, flashing, in amber
• the master caution light will flash and the single chime audio alert will sound
• the ECAM caution messages AUTOFLT: A/THR OFF and ENG: THRUST LOCKED will be displayed on the E/WD
• the E/WD will display the procedure THR LEVERS … MOVE.

As indicated by the ECAM procedure displayed on the E/WD, the required method for disengaging thrust lock is to move the thrust levers. Pressing the instinctive disconnect pushbutton will also disengage thrust lock, however, if the TLA is not matched to the frozen thrust, the thrust will change to that commanded by the thrust lever position. Both methods of disengaging thrust lock will clear the THR LK message from the FMA and the ECAM caution from the E/WD.

Altitude alert system

The flight warning computer will generate an altitude warning when the aircraft approaches or deviates from a preselected altitude or flight level (Figure 5). The warning comprises an aural ‘C chord’ alert, and the PFD altitude window pulsing yellow or flashing amber. The warning may be cancelled by either selecting a new altitude, pressing one of the cancellation pushbuttons, or returning the aircraft to the altitude selected on the FCU.

Instrument lighting

The A320 instrument panels have both integral instrument lighting and flood lighting. The brightness of all panel lighting is adjustable. Each pilot has individual instrument and flood lighting controls for that station’s lighting, while the centre instrument panels also have individual flood lighting and integral lighting controls.

Aircraft flaps

The aircraft had five selectable stages of flap: UP, 1, 2, 3, and FULL. The flap 1 setting, in the approach configuration, is extension of the leading edge slats only. The limit speed for this flap setting is 230 kt.

Terrain avoidance and warning system

VH-VCJ was fitted with a terrain avoidance and warning system (TAWS). The TAWS comprised two primary systems. The first, a ground proximity warning system, used the aircraft’s radio altimeter to produce aural and visual alerts when the aircraft’s radio height was between 30 ft and 2,450 ft, and certain flight conditions were met. These flight conditions were separated into five modes. The relevant modes to this investigation were:

• Mode 1: Excessive rate of descent. This mode produced the SINK RATE caution and PULL UP warning aural alerts
• Mode 2: Excessive terrain closure rate. This mode produced the TERRAIN TERRAIN caution and the PULL UP warning aural alerts.

The second was a terrain hazard warning system, commonly called an enhanced ground proximity warning system. The terrain hazard warning system used a worldwide terrain database, as well as aircraft navigation system input to produce a:

• terrain awareness display that provided predicted terrain conflict and terrain representation on the pilot’s navigation display
• calculated terrain clearance floor, which improved terrain warning during final approach and landing.

The terrain awareness system also produced aural alerts associated with terrain conflicts. These alerts were the TERRAIN AHEAD, PULL UP warning and the TERRAIN AHEAD caution.

The abnormal procedures section of the FCOM contained the following procedures for TAWS alerts:

• “PULL UP” - “TERRAIN AHEAD PULL UP”
  Simultaneously:
  AP................................................................................OFF
  PITCH..........................................................................PULL UP
  Pull to full backstick and maintain in that position.
  THRUST LEVERS.......................................................TOGA
  SPEED BRAKES lever................................................CHECK RETRACTED
  BANK...........................................................................WINGS LEVEL or ADJUST
  Best climb performance is obtained when close to wings level. Then, for “TERRAIN AHEAD PULL UP” only, and if the crew concludes that turning is the safest way of action, a turning maneuver can be initiated.
  - When flight path is safe and the warning stops:
     Decrease pitch attitude and accelerate.
  - When speed is above VLS, and vertical speed is positive:
     Clean up aircraft, as required.
• “TERRAIN TERRAIN” – “TOO LOW TERRAIN”:
  Adjust the flight path, or initiate a go-around.
• “TERRAIN AHEAD":
  Adjust the flight path. Stop descent. Climb and/or turn, as necessary, based on analysis of all available instruments and information.
• “SINK RATE” – “DON’T SINK”:
  Adjust pitch attitude and thrust to silence the alert.

The standard operating procedures section in OPSA included specific requirements with respect to TAWS alerts and warnings. This section stated, that, while these systems were not infallible, all TAWS alerts and warnings require an immediate and positive response. With respect to any TAWS warning, the required response was to level the wings and initiate a maximum gradient climb to the minimum sector altitude for the sector being flown. The response to an alert varied according to the stage of flight, but in essence involved correcting the condition that gave rise to the alert.

Operational philosophy

Communication

In a Flight Operations Briefing Notes (FOBN), Airbus^[15] identified the critical role of effective communications between flight crew. The FOBN stated that the communication between the flight crew ‘allows sharing of goals and intentions and enhancing crew’s situational awareness’. With respect to the topic of communication between the flight crew, the FCTM contained the following:

The term "cross-cockpit communication" refers to communication between the PF and the PM. This communication is vital for any flight crew. Each time one flight crewmember adjusts or changes information and/or equipment on the flight deck, the other flight crewmember must be notified, and an acknowledgement must be obtained.

Such adjustments and changes include:

- Flight management guidance systems (FMGS) alterations

- Changes in speed or Mach …

- Flight path modifications

- System selections...

When using cross-cockpit communication, standard phraseology is essential to ensure effective flight crew communication. This phraseology should be concise and exact, and is defined…

Take action when things do not go as expected

The FCTM included guidance for flight crew on what to do when the aircraft is not performing as expected.

If the aircraft does not follow the desired vertical or lateral flight path, or the selected targets, and if the flight crew does not have sufficient time to analyze and solve the situation, the flight crew must immediately take appropriate or required actions, as follows:

The PF should change the level of automation:

‐ From managed guidance to selected guidance, or
‐ From selected guidance to manual flying.

Optimal use of automation

When interfacing with automation, such as when arming or selecting various autoflight modes or selecting guidance targets, Airbus^[16] recommended adherence to the following:

• before performing any action on the flight control unit (FCU), check that the knob or pushbutton is the correct one for the desired function
• after each action on the FCU, verify the result of this action on the FMA and by reference to the aircraft flight path and airspeed response
• announce all changes in accordance with standard calls as defined in SOPs.

Meteorological information

The pilots reported that during the relevant period of the occurrence, the aircraft was in cloud with showers, and the visibility was zero.

ATIS

Prior to descent, the flight crew transcribed the latest ATIS for Melbourne. That ATIS was designated as information Romeo and stated that:

• runway 16 was the arrivals runway, and the runway condition was wet
• low visibility procedures were in force
• the wind was 230° at 10 kt
• cloud was scattered^[17] at 200 ft and broken at 500 ft^[18]
• visibility was 10 km reducing to 6 km in rain
• the temperature was 11 °C
• the barometric pressure was 1034 hPa
• low visibility procedures were in force.

Bureau of Meteorology

The Bureau of Meteorology provided a number of weather observations for Melbourne Airport that covered the period from when the aircraft commenced descent, at about 0120, until it landed at 0150. The observations recorded the:

• wind as being from the south west at about 10 kt
• visibility as 5 km in drizzle
• cloud as few at 300 ft, broken at 1,400 ft and broken at 2,400 ft
• temperature as 11 °C, while the dew point was fluctuating between 10 °C and 11 °C.

The observations also included a forecast, indicating that over the following three hours, for periods of between 30 and 60 minutes, visibility would decrease to 3 km in showers, rain and drizzle, with the cloud becoming broken at 300 ft.

Air traffic services

Minimum Safe Altitude Warning

The Australian Advanced Air Traffic System (commonly known as TAAATS) is fitted with a Minimum Safe Altitude Warning (MSAW) system to assist in the prevention of controlled flight into terrain.

TAAATS used a general terrain monitoring type of MSAW system that monitors the aircraft’s reported altitude (Mode C)^[19] against a terrain map. The terrain map is based on a mosaic grid comprising areas of about 0.5 km square with each square set to an altitude represented by the highest terrain within that square, with obstacle data (such as towers or buildings) overlaid on that map. A predictive function calculates an aircraft’s rate of descent from a number of Mode C returns and projects this rate of descent and the aircraft’s track forward 60 seconds. If the projection predicts that the aircraft would impact the terrain map, a warning is provided to the controller.

Human performance related information

As part of this investigation, several human factors-related aspects were considered in the context of the flight crew’s actions during the descent. These included the:

• PF experiencing pitch-up illusions with thrust changes
• PF inadvertently pressing the EXPED pushbutton and what could be considered other inadvertent actions by the PF
• effect of fatigue
• role of workload on both crew.

The pitch-up illusion

Pitch-up illusions are a vestibular misperception of acceleration, confused with a climb, and is amplified when visual cues are absent. Given that it was night-time, there would have been very limited visual cues outside the aircraft available to the pilots. The pitch-up illusion is also referred to as a somatogravic effect when referring to what a pilot experiences and is explained by Stott (2011) as follows:

…forward acceleration of the aircraft produces an equal inertial acceleration acting backwards on the pilot and increasing the sense of pressure from the back of the seat….The sensory information provided by the otolithic system^[20] is exactly similar to the…sensation of backward tilt…Thus from non-visual sensations a pilot is unable to distinguish between an actual backward tilt associated with the climb and an illusory sense of tilt associated with forward acceleration.

The pilot’s pitch-down inputs during the descent are consistent with this type of pitch-up illusion event.

Airbus perspective on pitch-up illusions

Airbus has identified the all-engine go-around as a specific manoeuvre where the pitch-up illusion can adversely affect the outcome of a normal procedure. In July 2011, Airbus published a procedural review of the all-engine go-around manoeuvre in their Safety First magazine.

The review was initiated as a result of a number of poorly handled all-engine go-arounds. Most real world go-arounds were conducted at light weights and with high thrust. It was found that the likely consequence of not maintaining the correct pitch attitude during the go-around is acceleration towards the flap limit speed—when autothrust is not active, there is no speed protection to prevent a flap limit speed exceedance. A representation of the pitch-up, or what Airbus termed the false climb illusion, is shown in Figure 7.

Figure 7: Pitch-up illusion

Pitch-up (somatogravic) illusion, experienced as a result of acceleration during the go-around manoeuvre, showing the illusion as experienced by the pilot and the possible response to pitch-down. Source: Airbus

The review included the following points pertinent to the second event, where the PF introduced pitch-down inputs while conducting the go-around manoeuvre:

All pilots must know the required initial pitch target for their aircraft BEFORE commencing a missed approach. They must maintain that pitch target by following the [speed reference system] commands in manual flight. With the autopilot engaged, they should use this knowledge to confirm the autopilot behaviour.

The go-around pitch target for the A320 was quoted as 15 degrees nose up, the importance of which was highlighted as follows:

During a manual Go Around, if the required pitch is not reached or maintained, linear acceleration will result. Research has shown that this may cause a “false climb illusion”. The false climb illusion may lead a pilot to believe that the aircraft is already above the required pitch. Consequently, a pilot may respond with an opposite and dangerous pitch-down input.

Inadvertent pilot actions

Regarding the PF’s inadvertent selection of the EXPED pushbutton, Reason (1990) stated that

A slip is a type of error which result from some failure in the execution stage of an action sequence…These slips could arise because, in a highly routinized set of actions, it is unnecessary to invest the same amount of attention in the matching process….with oft-repeated tasks it is likely that [they] become automatized to the extent that they accept rough rather than precise approximations to the expected inputs.

Additionally, consideration was given to the outcome when similar objects (in this case, the pushbuttons A/THR, EXPED and APPR) were confused for each other. Perceptual confusion is a type of attentional slip and on that, Wickens and Hollands (2000) stated the following:

Perceptual confusions occur because a person may recognise a match for the proper object with an object that looks like it, is in the expected location, or does a similar job…

The pushbuttons on the FCU were the same colour and size. Colour coding and placement of objects has an effect on perception, in the sense that if two items are the same colour, then using colour-coding can tie together items that are spatially separated on the display (Wickens and Hollands, 2000). Additionally, two items on a cluttered display will be more easily integrated or compared if they share the same colour (different from the clutter), but the shared colour may disrupt the ability to focus attention on one while ignoring the other.

In addition to considering objects of similar size and shape, the effect of flight deck lighting was also considered. Woodson and Conover (1964) described several important factors that should be considered in the design of any lighting system:

• suitable brightness for the task at hand
• uniform lighting for the task at hand
• suitable brightness contrast between task and background
• lack of glare from either the light source or the work surface
• suitable quality and colour of illumination and surfaces.

With regard to the FCU pushbutton layout, lighting and colour coding (see Figure 5), the physical similarities (shape, size, and colour) and close proximities between the A/THR, EXPED and APPR pushbuttons on the FCU could have contributed to any perceptual confusion.

Decision making and conscious automaticity

Wickens and Hollands (2000) outline that when undertaking a task, we must translate the information that is perceived about the environment into an action, and this action may be either an immediate response, or based on a more thorough, time-consuming evaluation.

In relation to the PF’s reaction to the thrust lock condition, the limitations of decision making were considered, as was the concept of automatic actions. As outlined by Klein and Klinger (1991) cited in Harris (2011), naturalistic decision making is characterised by ‘dynamic and continually changing conditions, real-time reactions to these changes, ill-defined tasks, time pressure, significant consequences for mistakes’.

In instances where actions that have become well-learned, ‘it is as though practice leads to a mental repackaging of our behaviour…that can be set off with only a brief conscious thought…’ (Wheatley and Wegner, 2001). In this case, the PF pressing the instinctive disconnect buttons was achieved without any time-consuming conscious elements.

Fatigue

The International Civil Aviation Organization (ICAO 2016) defined fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety related operational duties.

Fatigue can have a range of adverse influences on human performance. These include:

• slowed reaction time
• decreased work efficiency
• increased variability in work performance
• lapses or errors of omission (Battelle Memorial Institute 1998).

Time of day can be important for determining whether an individual is in a circadian low or high. Human circadian rhythm is partially determined by the environmental light-dark cycle (Duffy, Kronauer, & Czeisler, 1996). The challenge can be for people to maintain alertness during the night-time hours and reduced sleepiness during the daytime rest break.

The Civil Aviation Safety Authority (2012) stated the following:

The circadian cycle has two periods of sleepiness, known as the circadian trough and the circadian dip. The circadian trough occurs typically between 0200 and 0500 hours (or dawn). During the circadian trough the body’s temperature is at its lowest level and mental performance, especially alertness, is at its poorest.

In the context of time on duty, Goode (2003) identified numerous studies that show an empirical relationship between work patterns and deteriorating performance. In accidents where fatigue was attributed, 20 per cent occurred in the tenth (or more) hour of duty.

Caldwell (2003) stated that ‘the primary determinant of the level of fatigue is the time awake since the last sleep period.’ Russo and others (2005) found that ‘significant visual perceptual, complex motor, and simple reaction time impairments began in the 19th hour of continuous wakefulness.’ As part of an NTSB study of short haul domestic air carrier accidents from 1978 to 1990, ‘time since awake’ was a predominant factor, and often related to ‘ineffective decision making’.

The following data was relevant to the PF’s fatigue assessment. The PF:

• usually obtained about 7 hours of sleep a night between 2300 and 0600
• had conducted two flights over the previous 3 days (one of which was a positioning flight)
• duty ended at 2115 the previous day, resulting in a 17 hour break prior to starting duty on the day of the occurrence
• woke at about 0600 and commenced duty in Melbourne at 1415
• reported feeling well rested
• positioned to Perth, before operating the occurrence flight
• recalled feeling ‘okay’ around the time of the occurrence, but had been awake for about 19.5 hours.

The occurrence took place at about 0130, which was 11 hours and 15 minutes after the PF’s duty commenced. However, the descent was taking place close to a known window of circadian low. Along with the night conditions, with a relatively low-level of lighting in the flight deck, this may have contributed to feelings of sleepiness.

The ATSB evaluated the PF’s level of fatigue using two biomathematical models, Fatigue Avoidance Scheduling Tool (FAST) and System for Aircraft Fatigue Evaluation (SAFE). These models are decision aids designed to assess and forecast performance changes induced by sleep restriction and time of day.

Both models indicated a moderate level of fatigue. The FAST results indicated that at the time of the occurrence, there was a moderate likelihood that the PF was experiencing a level of fatigue known to have a demonstrated effect on performance. The SAFE results predicted that the PF would have felt ‘moderately tired, let down’ at the time of the occurrence, and in a moderate to high-risk category for experiencing the effects of fatigue.

The following data was relevant to the PM’s fatigue assessment. The PM:

• usually obtained about 7.5 hours sleep a night between 2300 and 0630
• was on a rostered period of leave in the two weeks prior to the occurrence
• was in Perth on the day of the occurrence and woke at about 0630 Western Standard Time,^[21] and had therefore been awake for about 17 hours at the time of the occurrence
• commenced duty in Perth at 1800
• reported feeling well rested and having adequate sleep the night before the occurrence
• did not report any fatigue-related concerns associated with the occurrence flight.

Operator fatigue management

Organisations holding an Air Operator Certificate are generally required to comply with the Civil Aviation Orders Part 48 Flight Time Limitations (CAO 48). However, the Civil Aviation Safety Authority had granted the operator an exemption from CAO 48, under a specific instrument. This exemption was in force at the time of the occurrence. In place of the CAO 48 limitations, the operator was required to observe specific flight and duty limits contained in schedules to the instrument. With respect to this occurrence, the following flight and duty limits were relevant:

• where the previous duty period did not exceed 12 hours, the time free of duty shall be 10 hours
• the maximum hours per flight duty period for a local start time between 1300 and 1459, with one or two sectors, was 13 hours
• flight deck duty limits for operations involving two crew was 10 hours.

Workload

In the context of aviation, workload has been described as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. It represents the cost incurred by the human operator in achieving a particular level of performance’ (Orlady and Orlady, 1999). A person experiences workload differently, based on their individual capabilities and the local conditions at the time. These conditions can include the following:

• training and experience in the situation at hand
• the operational demands during that phase of flight
• if the person is experiencing the effects of fatigue
• level of automation in use, and the mental requirements in interpreting their actions.

Research on unexpected changes in workload during flight has found that pilots who encounter abnormal or emergency situations experience a higher workload with an increase in the number of errors compared to pilots who do not experience these situations (Johannsen and Rouse, 1983).

Additionally, Holmes and others (2003) outline that high workload and distractions can result in a pilot scanning fewer instruments and checking each instrument less frequently.

Pilot recency and skill decay

The Civil Aviation Safety Regulations CASR 1998 Part 61: Flight Crew Licencing outlines that recent experience, or recency, refers to undertaking particular flight operations in the past 90 days. These flying experiences include take-off and landings, or instrument approaches, for example. Recency will generally be measured by flight hours (Haslbeck and others, 2014) or sectors flown (Ebbatson, and others, 2010).

The concept of maintaining recency is important to reduce flight skill decay. In a commercial aviation context, Childs and Spears (1986) suggest that cognitive and procedural elements of flying skills decay more rapidly than control-oriented skills. Pilots were observed to have difficulty correctly identifying cues and classifying situations, although once a situation was correctly classified, they remembered what to do. Therefore, they propose that flying training should focus on pilot monitoring skills and recognition of different situations.

Despite the PF having management responsibilities, the PF had almost 70 hours in the previous 90 days, albeit with a significant training duty component. As a result, there was insufficient evidence to determine whether recency and/or skill decay had any influence on the flight crew’s actions.

Operator crew resource management training

The operator’s Operations Manual part A included the statement that ‘flight crewmembers should complete the major elements of the full length [crew resource management (CRM)] course over a three-year recurrent training cycle’. The Civil Aviation Advisory Publication (CAAP) SMS-3(1) Non-Technical Skills Training and Assessment for Regular Public Transport Operations provides the Civil Aviation Safety Authority’s preferred method for training in the human performance aspects of flight crew work performance. This CAAP provides the following definition of CRM:

A team training and operational philosophy with the objective of ensuring the effective use of all available resources to achieve safe and efficient flight operations.

CRM is now more commonly referred to as non-technical skills, which are defined as follows:

…the mental, social, and personal-management abilities that complement the technical skills of workers [and] include competencies such as decision-making, workload management, team communication, situation awareness, and stress management.

The operator’s CRM training program required pilots to complete a two-day classroom-based CRM course within one year of starting with the operation, and an annual refresher course. These courses were run by an external training provider, and the subjects included:

• human perception and the learning process
• personality type, delegation
• leadership and effective communication skills
• effective communication and co-ordination within the flight crew and between crewmembers
• implications of automation on CRM.

Pilots also undertook a CRM course during command upgrade training, and each company line check and operational proficiency check also included an assessment of CRM principles as they were applied during normal, non-normal and emergency procedures. The ATSB was not able to determine the methods by which CRM principles were assessed.

A review of the company’s line check reports showed that ‘crew management/co-operation’ was an assessment criteria for the departure, en route, approach and landing phases of flight. Additionally, ‘CRM technique’ was assessed as a general criteria. The ATSB did not identify any specific criteria included in the operator proficiency check records.

Related occurrences

A review of the ATSB’s occurrence database did not identify any recent similar occurrences on scheduled passenger transport flights that were investigated by the ATSB.

__________

14. The ECAM system is able to inhibit certain ECAM failure alerts depending on the flight phase, such as during the take-off or landing phases.
15. Airbus Flight Operations Briefing Notes: Standard Operating Procedures—Operations Golden Rules.
16. Airbus Flight Operations Briefing Notes: Standard Operating Procedures—Optimum Use of Automation.
17. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘few’ indicates that up to a quarter of the sky is covered, ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky, ‘broken’ indicates that more than half to almost all the sky is covered, and ‘overcast’ indicates that all the sky is covered.
18. Cloud heights are reported reference to the ground level.
19. An aircraft transponder signal with barometric information from an encoding altimeter, encrypted so that it enables altitude presentation on air traffic control radar screens.
20. Part of the vestibular system in the inner ear.
21. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.

While conducting an arrival procedure, prior to commencing an approach into Melbourne, Victoria on 15 May 2015, the Skytraders Airbus A319 descended to about 2,200 ft, which was below the ATC-assigned altitude of 3,000 ft. The crew broke off the arrival procedure and climbed to the new ATC cleared altitude of 5,000 ft before returning to land at Melbourne.

During the descent below 3,000 ft, the aircraft’s Terrain Avoidance and Warning System (TAWS) initiated a number of warning alerts, the speed limit for the aircraft flaps was exceeded, and the Minimum Safe Altitude Warning System (MSAW) initiated an alert to the ATC controller. Critically, during the 26 seconds from the time that the PF pressed the instinctive disconnect pushbutton on the thrust levers to when the aircraft reached its minimum altitude, the aircraft descended just over 1,000 ft and increased speed by about 100 kt.

The event was initiated by an inadvertent switch selection by the pilot flying (PF). This was followed by a combination of errors, rapidly changing events, high workload and an apparent response to a pitch-up illusion, resulting in the aircraft quickly developing a very high rate of descent and increasing airspeed.

Inadvertent FCU selections

As the aircraft was approaching the localiser for Melbourne runway 16, the PF recalled intending to arm the aircraft’s autoflight system (AFS) to capture the localiser for the approach. This required the PF to press the APPR pushbutton on the Flight Control Unit (FCU). Instead, the PF mistakenly pressed the EXPED pushbutton and the AFS entered the expedite descent mode. In an apparent attempt to cancel the expedite descent mode, the PF inadvertently pressed the A/THR pushbutton, which was adjacent to the EXPED pushbutton.

The acts of pressing the EXPED and then the A/THR pushbuttons were both predicated by a prior intention to act, but neither action went as planned. In this case, this prior intention was the pressing of the APP push button, which was part of a routine set of actions. Routine actions are generally characterised as requiring less attention.

The pressing of the A/THR was an apparent instinctive reaction to realising that an error had been made. Both selections were consistent with unintentional slips. Furthermore, the similar size, shape and colour of the EXPED and APPR buttons on the FCU, as well as their close proximity, may have contributed to the error. The lighting conditions in the flight deck may have increased the difficulty for the pilot monitoring (PM) to monitor the actions of the PF.

Reaction to ‘thrust lock’ condition

After the PF inadvertently pressed the A/THR pushbutton on the FCU, the Flight Mode Annunciator and Electronic Centralised Aircraft Monitor (ECAM) identified that the autothrust system had disengaged and the thrust locked at the existing setting, which was idle. The ECAM notified the flight crew of this change by displaying the THR LK caution message, as well as an associated procedure. The flight warning computer simultaneously sounded the caution aural alert, while the FMA’s autothrust column displayed the changed mode. The PM immediately identified this changed autothrust condition and verbally notified the PF of the change. It could not be determined whether this call was in response to the ECAM notification with associated master caution aural alert, or the FMA change.

Normal procedure for disconnecting the autothrust system was to press the autothrust instinctive disconnect (I/D) pushbutton, but this procedure first required the pilot to match the position of the thrust lever with the actual thrust setting. The thrust lever angle indicator assisted in this process. The aim of the THR LK ECAM procedure was to remove the engines’ locked thrust condition. That procedure also included matching the thrust lever position to the actual thrust setting.

On becoming aware that the engines’ thrust had been locked, the PF reacted by pressing the autopilot and autothrust instinctive disconnect pushbuttons, thereby removing the thrust lock condition. The likely intent of disconnecting both autopilot and autothrust was to revert to a fully manual flight mode. This is supported by the simultaneous disconnection of the autopilot and autothrust systems through the use of the instinctive disconnect buttons, an automatic action to complete the apparent intent.

However, in disconnecting the autothrust, the PF did not match the thrust levers to the current power, or set a desired power. This was likely to be a lapse, which is ‘simply omitting to perform one of the required steps in a sequence of actions’ (Harris, 2011). As to why this lapse occurred, the PF’s incomplete response to the ‘thrust lock’ condition may have been a result of a response consistent with a perceived urgency to handle an undesirable state, particularly as the instinctive disconnect pushbuttons were designed for a quick response

High thrust with pitch-down attitude

As a result of not matching the thrust lever angle to the locked thrust setting when disengaging the thrust lock condition, the thrust increased to the climb setting at which the thrust levers were positioned. This resulted in a significant, unexpected thrust increase. The PF responded by applying pitch-down inputs on the side stick and a few seconds later retarded the thrust levers to idle. The pitch-down attitude with high thrust—the engines did not respond to the commanded thrust reduction for a further few seconds—resulted in the aircraft adopting a rapidly accelerating downward vector. At about this time the altitude alert began to chime and, shortly thereafter, the aircraft descended through its clearance limit altitude.

As the aircraft passed through the clearance limit altitude, the first of the TAWS alerts triggered. The PF responded with a declared intent to go-around and rapidly positioned the thrust levers to full power. However, the PF did not raise the aircraft’s pitch attitude to the recommended 15 degrees nose up for the conduct of a go-around. While the PF commenced some pitch-up commands, the aircraft’s attitude remained well below the horizon, resulting in a continuation of the accelerating airspeed and high rate of descent.

Just as the engines began to increase thrust, the second TAWS alert triggered. The procedural response to this second alert was to apply full backstick and maintain that position while setting the thrust to maximum power. However, the PF again responded to the increasing engine thrust with pitch-down commands, resulting in a continuation of the aircraft’s downward flight path. The PF arrested the descent after about 10 seconds, during which time a further TAWS alert triggered.

The flap overspeed

During the period of high thrust, the PM selected the flaps from 1 to UP as the aircraft was accelerating through 260 kt. The slats were not fully retracted for a further 12 seconds, by which time the aircraft had accelerated to more than 310 kt. The limit speed for flap 1 was 230 kt.

The effect of pitch-up illusions during rapid thrust increases

The PF did recall applying pitch-down side stick input during the rapid thrust increases and did not identify the increasing rate of descent, resulting from the nose-down attitude. The PF did, however, recall thinking that the aircraft was pitching up. Throughout the occurrence, the night conditions and operations within cloud resulted in the absence of a natural horizon. It was therefore likely that the PF’s pitch-down side stick inputs were in response to pitch-up (somatogravic) illusions caused by the unexpected and rapid increase in thrust. The PF’s susceptibility to the effects of pitch-up illusions was possibly exacerbated by also experiencing a high workload, which would likely reduce monitoring of flight instruments.

The effect of the pitch-up illusion influenced the breach of altitude, the EGPWS alerts, and the exceedance of the flap limit speed.

The PM’s ability to influence the events

The primary role of the PM is to monitor the aircraft’s flight path and performance and immediately bring any concern to the PF’s attention. However, Dismukes and Berman (2010) have shown that, while flight crew monitoring is an important defence that is performed appropriately in the vast majority of cases, it does not always catch flight crew errors and equipment malfunctions. They also noted:

…even though automation has enhanced situation awareness in some ways…it has undercut situation awareness by moving pilots from direct, continuous control of the aircraft to managing and monitoring systems, a role for which humans are poorly suited.

When considering whether the PM was likely to be able to identify and therefore influence the events that led to the flap overspeed and the breaching of the cleared altitude, the following factors were considered. The:

• PM verbally identified the expedite descent mode change and the appearance of the ‘thrust lock’ condition
• PM had difficulty in identifying the PF’s actions, being unable to see the PF selections on the FCU
• lighting levels in the flight deck were low
• reduced communication between the flight crew—specifically, the PF did not communicate an intended response to the expedite descent mode engagement, THR LK ECAM message, or the various autopilot disconnections and reconnections
• PF did not announce mode changes annunciated on the FMA as required by the standard operating procedures, those changes being resultant from FCU and autoflight system inputs made by the PF
• PF’s response to the thrust lock condition was contrary to normal procedure
• PM’s attention was probably focused on the flap speed, when the aircraft started to rapidly accelerate early in the occurrence. By the time that the PM had selected the flap up, the aircraft had developed a very high rate of descent and descended through the clearance limit altitude
• PM recalled that there was ‘a lot of button pressing’ throughout the occurrence, and that the autopilot was disengaged several times.

The period of time from the inadvertent FCU selections through to the aircraft returning to a positive rate of climb was short, but characterised by rapidly changing events with multiple visual and aural alerts. The PM’s ability to identify and influence the rapidly changing situation was likely affected by the non-routine nature of the event, actions of the PF, reduced communication between the flight crew and an apparent focus on the flap speed exceedance as the aircraft started to accelerate.

Crew workload

Pilots who encounter abnormal or emergency situations experience a higher workload with an increase in performance errors compared to pilots who do not experience these situations (Johannsen and Rouse, 1983). During the occurrence, the attention of the flight crew was likely divided between a number of different information cues and task requirements, from the time the PF made the inadvertent selections on the FCU, through to when the aircraft began to climb. These included:

• multiple aural warnings and alerts
• identifying and responding to mode changes, including appropriate actions to address the THR LK ECAM message
• disengagements and re-engagement of the autopilot
• focus on airspeed (mostly by the PM)
• interactions with ATC towards the end of the occurrence sequence.

At the time, the aircraft was in the descent phase, which inherently has a higher workload. The PM recalled that the workload became very high after the inadvertent FCU selections occurred. The high workload experienced by the PM was demonstrated in the use of an incorrect call sign during ATC communications, as the aircraft started to climb out.

The degree of recollection from both crew after the occurrence also indicated that they experienced a high workload over a short period of time, as details including the numerous aural warnings (including the EGPWS), one of the inadvertent FCU selections and autopilot changes were not recalled. Overall, the high workload the flight crew experienced appeared to have limited their capacity to identify mode changes, such as autopilot disconnections, and to respond to the aircraft’s undesired high rate of descent.

Crew fatigue

The PF awoke at a normal time of 0630, signed on at Melbourne and did not report receiving any rest before or during the operation from Perth to Melbourne. It is reasonable to conclude that, due to time awake, time on duty and the time of day, the PF was probably experiencing a level of fatigue known to have at least some effect on performance. This was predicted by biomathematical fatigue models. There was, however, insufficient evidence to indicate that fatigue contributed to the occurrence. The ATSB also did not ascertain any systemic issues associated with the operator's management of fatigue.

From the evidence available, the following findings are made with respect to the descent below minimum permitted altitude involving an A319, VH-VCJ, near Melbourne Airport, Victoria on 15 May 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The pilot flying inadvertently selected the EXPED pushbutton instead of the APPR pushbutton, and, in an attempt to correct the error, pressed the A/THR pushbutton, creating a thrust lock condition.
• In attempting to remove the thrust lock condition, the pilot flying pressed the instinctive disconnect pushbutton but did not move the thrust levers to match the locked thrust setting. As the thrust was locked at idle while the thrust levers were set to climb thrust, this resulted in an unexpected, significant thrust increase.
• The pilot flying likely experienced pitch-up illusions during two rapid thrust increases and responded to these illusions with pitch-down sidestick input.
• Pitch-down inputs by the pilot flying, combined with a very high thrust setting, resulted in a very high rate of descent with rapidly increasing airspeed. This led to the breach of the cleared minimum descent altitude, as well as triggering a number of Enhanced Ground Proximity Warning System alerts.
• The rapidly changing aircraft state led to the crew experiencing a high workload. This was likely to have limited their capacity to identify mode changes and to respond to the aircraft’s undesired high airspeed and rate of descent.
• The pilot monitoring’s ability to identify and influence the rapidly changing situation was likely affected by the non-routine actions of the pilot flying, the reduced communication between flight crew and an apparent focus on the flap speed exceedance as the aircraft started to accelerate.

Other factors that increased risk

• At the time of the occurrence, the pilot flying was likely experiencing a level of fatigue known to have a demonstrated effect on performance, predominantly due to the time of day and time awake.
• The aircraft’s rapidly increasing airspeed resulted in the limit speed for the extension of the aircraft slats being significantly exceeded.

A319	Airbus A319 model aircraft
A320	Airbus A320 family of aircraft
AFS	Autoflight system
ALT*	Altitude acquire is engaged
AP1	Autopilot number 1
APPR	Approach pushbutton
ATC	Air traffic control
ATIS	Automatic terminal information service
ATP(A)L	Air transport pilots (aeroplane) licence
ATS	Autothrust system
A/THR	Autothrust pushbutton
C	Celsius
CVR	Cockpit voice recorder
DFDR	Digital flight data recorder
ECAM	Electronic centralised aircraft monitor
EGPWS	Enhanced ground proximity warning system
EXPED	Expedite pushbutton
EXP DES	Expedite descent vertical mode
E/WD	Engine/warning display
FCOM	Flight crew operating manual
FCTM	Flight crew training manual
FCU	Flight control unit
ft	Feet
FMA	Flight mode annunciator
FMGS	Flight management guidance system
FWC	Flight warning computer
GPWS	Ground proximity warning system
hPa	Hectopascals
ILS	Instrument landing system
I/D	Instinctive disconnect
km	Kilometre
kt	Knots
MSAW	Minimum safe altitude warning system
NAV	Navigation lateral mode
PF	Pilot flying
PFD	Pilot’s flight display
QRH	Quick reference handbook
OP DES	Open descent vertical mode
OPSA	Operations Manual part A
OPSB	Operations Manual part B
PM	Pilot monitoring
SNB2	Snowbird 2
SOP	Standard operating procedures
STAR	Standard arrival
TAAATS	The Australian advanced air traffic system
TAWS THR LK	Terrain avoidance and warning system Thrust lock condition
TLA	Thrust lever angle

Sources of information

The sources of information during the investigation included:

• the aircraft’s cockpit voice recorder and flight data recorder
• the flight crew
• Skytraders Pty Ltd
• the Bureau d’Enquêtes et d’Analyses.
• Airbus SAS
• Airservices Australia
• Bureau of Meteorology.

References

Battelle Memorial Institute 1998, An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, US Federal Aviation Administration.

Caldwell Jr, JA & Caldwell, JL, 2003. Fatigue in aviation: A guide to staying awake at the stick. Ashgate: Burlington, Vermont.

Childs, JM and Spears, WD., 1986. Flight-skill decay and recurrent training. Perceptual Motor Skills, pp.235-242

Dismukes, R. and Berman, B., 2010. Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail, NASA Ames Research Center

Duffy JF, Kronauer RE, & Czeisler CA. 1996, Phase-shifting human circadian rhythms: influence of sleep timing, social contact and light exposure. The Journal of Physiology, 15, 289-297.

Ebbatson, M., Harris, D., Huddlestone, J. and Sears, R., 2010. The relationship between manual handling performance and recent flying experience in air transport pilots, Ergonomics, 53:2, 268-277. 

Haslbeck A, Kirchner P, Schubert E, & Bengler K, 2014, A Flight Simulator Study to Evaluate Manual Flying Skills of Airline Pilots, Proceedings of the Human Factors and Ergonomics Society 58th Annual Meeting. Available on pro.sagepub.com

Goode, JH., 2003. Are pilots at risk of accidents due to fatigue? Journal of safety research, 34(3), pp.309-313.

Harris, D., 2011. Human Performance on the Flight Deck, Ashgate Publishing Ltd., Surrey, England

Holmes, S., Bunting, A., Brown, D., Hiatt, K., Braithwaite, M., & Harrigan, M. (2003). Survey of spatial disorientation in military pilots and navigators. Aviation, Space, and Environmental Medicine, 74, 957-965

International Civil Aviation Organization 2016, Manual for the Oversight of Fatigue Management Approaches, 2nd edition, Montreal, Canada.

Johannsen, G & Rouse, WB, 1983. Studies of planning behavior of aircraft pilots in normal, abnormal, and emergency situations. Systems, Man and Cybernetics, IEEE Transactions on, (3), pp.267-278.

Noyes, J., 2007. Automation and Decision Making, Decision Making in Complex Environments, Ashgate Publishing Limited, Aldershot, England

Orlady, HW, & Orlady, LM, 1999. Human factors in multi-crew flight operations. Ashgate: Aldershot, UK p.203.

Reason, J. 1890. Human Error, Cambridge University Press, United Kingdom

Russo, M., Johnson, D., Escolas, S. and Hall, S., 2005. Visual Perception, Psychomotor Performance, and Complex Motor Performance During an Overnight Air Refueling Simulated Flight, Aviation, Space and Environmental Medicine, Vol. 76, pp. C92-103

Stott, R.J., Spatial Orientation and Disorientation, in Nicholson, A. (ed.), 2011, The Neurosciences and the Practice of Aviation Medicine, Ashgate Publishing Limited, Surrey, England, pp.55-91

Wheatley, T. and Wegner, DM. 2001. The Psychology of Automaticity of Action, International Encyclopaedia of the Social & Behavioural Sciences, In Smelser, NJ and Baltes, PB, Elsevier Science Ltd.

Wickens, CD. And Holland, JG. 2000. Engineering Psychology and Human Performance, Prentice Hall, New Jersey, USA

Woodson, W. and Conover, D., 1964. Human engineering guide for equipment designers, University of California Press, Los Angeles, USA

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to:

• The flight crew
• Skytraders Pty Ltd
• The Bureau d’Enquêtes et d’Analyses.
• Airbus SAS
• Civil Aviation Safety Authority.

Submissions were received from Skytraders Pty Ltd, the flight crew, the Bureau d’Enquêtes et d’Analyses, and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.