Airspeed indication failure on take-off involving Airbus A330, 9M-MTK, Brisbane Airport, Queensland, on 18 July 2018

Overview

On the night of 18 July 2018, a Malaysia Airlines Airbus A330-300, registered 9M-MTK, was being prepared for a regular public transport flight from Brisbane Airport, Queensland to Kuala Lumpur, Malaysia with callsign MH134. The preparation for flight, and the flight itself, were conducted at night in clear weather with light winds.

After the aircraft had arrived at the gate following its flight to Brisbane, an engineer placed covers on the aircraft’s three pitot probes^[1] to prevent them from becoming blocked by wasp nests (a particular hazard at Brisbane Airport—information on this topic is provided in Appendix A). The pitot covers were not removed during the subsequent inspections and other activity throughout the turnaround (Figure 1).

Figure 1: Aircraft on bay during turnaround about to be pushed back with pitot probe covers in placeSource: Brisbane Airport Corporation, annotated by the ATSB

During take-off (commencing at 2331 Eastern Standard Time^[2]) and the subsequent flight, the aircraft systems could not calculate and display airspeed correctly due to the pitot probes being covered.

The aircraft systems detected invalid airspeed when the aircraft reached 50 kt, and displayed a speed flag on the two primary flight displays (PFD).^[3] The flight crew did not respond to the speed flags until the aircraft’s speed was too high for a safe rejection of the take-off, and the take‑off was completed at close to the pre-planned speed.

The flight crew made a PAN PAN^[4] call to the tower air traffic controller, who did not hear it and asked the flight crew to change to the departures frequency. The flight crew then did so and made a PAN PAN call to the departures controller, who responded to it.

The flight crew climbed to 11,000 ft and circled while performing several procedures. These procedures resulted in the flight crew shutting down the aircraft’s air data systems, which activated a safety function called the back-up speed scale (BUSS) that displayed safe flight envelope information to the flight crew in lieu of airspeed. Using this system and airspeed management procedures, the flight crew conducted an approach and landing at Brisbane at 0033. There were no injuries reported among the 14 crew and 215 passengers.

The inoperative air data systems meant that normal landing gear extension was not available, so the flight crew had carried out a gravity landing gear extension. Because of this, the main landing gear doors did not retract and were slightly damaged on landing. Also, nose wheel steering was not available and the aircraft remained on the runway for a short period before being towed to the gate.

Personnel and required checks

To manage the turnaround operation at Brisbane between each flight, Malaysia Airlines had arranged for:

• a travelling licensed aircraft engineer (LAE)^[5] from Malaysia Airlines to carry out, manage, and certify technical handling (engineering) tasks including a transit check, maintenance, and refuelling
• a support engineer, who was an aircraft maintenance engineer provided by Aircraft Maintenance Services Australia (AMSA)^[6] to assist the LAE with non-certifying technical tasks as directed as well as act as security escort for the LAE^[7] (another AMSA engineer was present for a brief period, but was minimally involved)
• ground handlers provided by Menzies Aviation Services (Menzies) to carry out ground handling tasks such as dispatch coordination^[8] and pushback^[9] using a tug, as well as baggage and passenger handling services.

Formally, the engineers were operating primarily under Malaysia Airlines procedures and the ground handlers under Menzies procedures. Further information on the operator’s engineering and ground handling arrangements in Brisbane are provided in Activities and duties in preparation for flight.

Personnel information is provided in Appendix C.^[10]

The following checks and inspections were required by applicable procedures, in approximate chronological order:

• arrival walk-around (to be conducted by ground handlers)
• engineering maintenance walk-around inspection (part of the engineering transit check)
• engineering pre-departure walk-around inspection (part of the engineering transit check)
• flight crew walk-around
• dispatch walk-around (to be conducted by the dispatch coordinator).

The purpose of each walk-around and the responsible personnel are described in Activities and duties in preparation for flight.

Aircraft arrival and initial ground activities

Airport closed-circuit television (CCTV) recordings showed that the aircraft arrived at the bay at 2020. It was scheduled to depart (push back) at 2320. Artificial lighting around the bay provided good visual conditions, particularly around the forward part of the aircraft.

At the time of the aircraft arrival, the ground handlers:

• aided with aircraft guidance to the bay
• chocked the nose and main wheels
• communicated with the pilots and ensured the aircraft was safe to work around
• moved the airbridge into position for passenger disembarkation
• began unloading baggage and freight.

The CCTV recording showed that a required arrival walk-around was not conducted by ground handlers.

The operator’s LAE arrived at the airport at about 2000. The LAE was based in Kuala Lumpur, Malaysia, and had been flown to Brisbane 2 days before to carry out maintenance tasks on two consecutive turnarounds. 9M-MTK was the second of these, and the LAE was required to return to Kuala Lumpur on the same flight.

After passing through airport security, the LAE was taken to the aircraft by a Menzies staff member. The LAE entered the flight deck at 2030 to commence the required transit check, which included a review of the aircraft’s technical documentation.

At 2045 the AMSA support engineer arrived at the aircraft carrying a set of pitot probe covers, which are commonly used in Brisbane to prevent mud wasp infestation.^[11]The support engineer moved an access stand (moveable ladder/platform) to the nose of the aircraft and fitted the pitot probe covers. Ribbons attached to each of the pitot probe covers were visible on the CCTV recording. The support engineer then moved the access stand away and proceeded to the flight deck.

At 2047 the support engineer arrived on the flight deck. According to interviews with the LAE and support engineer, their discussion was brief. The support engineer reported telling the LAE (who was checking aircraft records at the time) that pitot probe covers were fitted to the aircraft. According to the support engineer, the LAE did not acknowledge what had been said, or make an entry in the technical log for the fitment of pitot probe covers (which the support engineer normally expected). The support engineer did not question this.

The LAE had not been aware of the common and recommend practice for the use of pitot probe covers at Brisbane Airport. The LAE stated that it was not normal practice to fit them during transits and later did not recall the support engineer advising of their fitment during the turnaround. The LAE also stated that, had they known pitot probe covers were fitted at that point, they would have either made an entry in the aircraft’s technical log that the pitot probe covers were fitted, or told the support engineer to remove them.

Engineering activities

The support engineer facilitated LAE access to the apron. The LAE instructed the support engineer to add oil to the engines and hydraulic system and the support engineer left the area to obtain the necessary supplies.

The LAE then conducted the external inspection component of the walk-around transit check beginning at 2054 (this component will be referred to as the ‘engineering maintenance walk-around inspection’). The CCTV recording showed that the LAE shone a torch on the area of the two left pitot probes for about 4 seconds while walking towards the nose (Figure 2). The LAE then appeared to look at the area of the right pitot probe.

Figure 2: LAE shining torch on left pitot probes with covers fittedPart of this image is overexposed due to the brightness of the torch.

Source: Brisbane Airport Corporation, annotated by the ATSB

The LAE reported noticing the pitot probe covers fitted to the aircraft at the time the nose area was inspected and intended to talk to the support engineer about them. As the support engineer was still absent from the aircraft retrieving supplies, the LAE decided to continue with the engineering maintenance walk-around inspection. The next interaction between the LAE and support engineer was ten minutes later. The LAE, busy with continuing the engineering maintenance walk-around inspection through that period, forgot about the pitot probe covers.

At about 2155, refuelling of the aircraft commenced under the supervision of the LAE, and was completed at about 2234. At 2237 the LAE and support engineer returned to the flight deck, where the LAE delivered the fuel receipt to the flight crew and certified that the transit check was complete.

The support engineer asked the LAE if there were any further tasks required. The LAE stated that the support engineer was no longer required. Both engineers left the flight deck at 2246. The LAE then sat in their assigned cabin seat for the return flight to Kuala Lumpur. The LAE reported being mindful of the need to board at a reasonable time before the international departure.

There was no formal or informal arrangement for the support engineer to remain with the aircraft. After leaving the vicinity of the aircraft at 2248, the support engineer took paperwork to the office, then went to assist other AMSA engineers on another aircraft. The support engineer reported having the intention to return to 9M-MTK but was assigned a rectification task on the other aircraft.

The support engineer was delayed further when leaving that aircraft while boarding was taking place. By the time the support engineer was able to return (about 2320), 9M-MTK had departed.

The Malaysia Airlines transit check requirements included another inspection, an engineering pre‑departure walk-around inspection, to check (among other things) that pitot probe covers were removed, and all doors and hatches were secured just prior to departure.

The support engineer reported that they understood their tasking was as directed by the LAE. The support engineer expected a pre-departure walk-around would be done by the ground handlers as the dispatch was conducted by them.

The LAE assumed the support engineer was responsible for the dispatch coordination and would subsequently conduct a final walk-around. Both engineers reported that the LAE did not instruct the support engineer to perform a final walk-around and did not ask about it.

Flight crew pre-flight activities

The flight crew arrived at the aircraft flight deck at about 2210, shortly before refuelling began, and commenced a series of pre-flight checks. As part of these checks the flight crew were required to review the aircraft’s technical log for outstanding defects. No defects relevant to the occurrence were recorded.

For this flight, the first officer (FO) was assigned the pilot flying (PF) role, and the captain was the pilot monitoring (PM).^[12]The aircraft manuals assigned responsibility for various tasks to each crewmember. The Preliminary cockpit preparation procedure had a requirement for the PM to check that the gear pins and covers (pitot probe covers) were stowed and to conduct an exterior walk-around (termed ‘flight crew walk-around’ in this report). The cockpit voice recorder (CVR) did not record this part of the pre-flight preparation.

The ‘gear pins and covers’ check, assigned to the PM, involved checking a compartment located behind the left pilot seat (Figure 3) for the presence of landing gear pins and pitot probe covers. Pitot probe covers were not routinely carried with the operator’s aircraft and were not carried on this occasion. Both flight crew later reported that they had not seen pitot probe covers in use in normal flight operations, and they were not informed of their use in Brisbane.

As the PM, the captain was responsible for the exterior flight crew walk-around. The captain commenced the walk-around at 2254, during which the captain briefly shone a torch over one of the left side pitot probes (Figure 4); the captain did not inspect the right side of the nose. In interview with the ATSB, the captain did not recall seeing pitot probe covers. Based on the captain’s walk-around path, torch use (particularly dwell time on check items), and total time taken, the ATSB assessed the captain’s walk-around as having omitted many of the required check items and was conducted without due attention (see Flight crew pre-flight walk-around for the occurrence flight).

Figure 3: Stowage compartment for landing gear pins and pitot probe covers (if carried)Source: Airbus, annotated by the ATSB

Figure 4: Captain briefly shining torch on left side pitot probe areaSource: Brisbane Airport Corporation

After the captain returned to the flight deck, the flight crew compared their separate calculations of the aircraft’s V speeds, which denote different phases of the take-off based on airspeed. The flight crew calculated:

• the decision speed V₁ (the maximum airspeed at which a rejected take-off can safely be initiated in the event of an emergency) as 153 kt^[13]
• the rotation speed V_R (the airspeed at which rotation should be initiated) as 160 kt.

At 2312 the FO called for the Before start procedure. The captain (as PM) commenced the check by stating a phrase captured on the cockpit voice recorder (CVR) that sounded like ‘gear pitot covers’ but could also have been ‘gear pins and covers’. The FO immediately responded with ‘removed’.

Dispatch and taxi

At 2311 the towbar was connected to the aircraft, the main passenger entry door was closed and the airbridge retracted.

Menzies had assigned a team of ground handling personnel to the turnaround of 9M-MTK. A leading hand was in charge of all aspects of the non-engineering ground handling duties and held the responsibility for coordinating the dispatch.^[14]

The leading hand had not received operator-specific training and believed that they were not qualified to perform coordination of this dispatch. For that reason, just before the aircraft was to depart, the leading hand arranged for a ground handler from another Menzies team to coordinate the dispatch. According to the recollection of both individuals, the leading hand asked, ‘Are you good to do the headset?’ and the person taking on the role of dispatch coordinator gave a ‘thumbs up’ signal.

A dispatch coordinator was required to conduct a final walk-around before departure. The leading hand stated that they (the individual) would normally do a complete walk-around of the aircraft just after arrival to inspect it for obvious damage. They would also do a dispatch walk-around as part of the dispatch duty, which meant a check around the entire aircraft to ensure that all the baggage doors and hatches were secured and other similar ‘last-minute’ checks.

The leading hand did not advise the dispatch coordinator that a dispatch walk-around of the aircraft had not been conducted. The dispatch coordinator stated that the aircraft appeared to be ‘ready to go’ at the time of this handover: the airbridge was retracted, the tug was connected, and the driver was in position. The dispatch coordinator assumed that the leading hand had already conducted a dispatch walk‑around and did not ask about it.

The CCTV recording showed that neither of the Menzies personnel conducted a dispatch walk‑around. The dispatch coordinator donned the headset to communicate with the cockpit at 2315 and both Menzies personnel waited near the nose gear for pushback.

The CVR recorded the FO stating to the dispatch coordinator ‘confirm ground checks complete’. The dispatch coordinator responded by stating ‘correct, that is affirmative’.

Pushback commenced at 2318, 2 minutes ahead of schedule. The tug driver could not see the pitot probes from within the tug cabin. The leading hand remained near where the nose gear had been and appeared to look in the general direction of the aircraft for about 18 seconds before turning to take equipment away from the bay (Figure 5).

Figure 5: Aircraft about to be pushed back with pitot probe covers in place (two of three visible)Source: Brisbane Airport Corporation, annotated by the ATSB

The dispatch coordinator walked alongside the nose gear until the tug driver stopped pushing the aircraft back. During this period, the dispatch coordinator was likely checking for sufficient obstacle clearance behind and to the sides of the aircraft and would not have had a need to look behind and above towards the area of the pitot probes.

The towbar and dispatch coordinator’s headset were then detached from the aircraft. CCTV footage from an adjacent bay showed the dispatch coordinator standing back from the left side nose of the aircraft showing the aircraft’s nose gear steering pin to the flight crew, in accordance with procedure, as confirmation that it had been removed (Figure 6). The pitot probe cover streamers would have been visible from this position.

After pushback and engine start the flight crew requested clearance to taxi. At 2324, the flight crew commenced taxi for a full-length take-off on runway 01. During the short duration of taxi, they were mostly engaged in conversation that was not pertinent to the flight. This conversation ended about 3 minutes before the take-off commenced.

Figure 6: Dispatch coordinator in position after pushbackSource: Brisbane Airport Corporation, annotated by the ATSB

Take-off

At the time of the take-off, there was no cloud and surface winds were variable at 3 kt. Winds aloft varied up to about 10 kt from the north or north-north-east, providing a slight headwind on take-off and landing. Due to the low winds in the area, groundspeed (which was recorded) was likely to have been very similar to airspeed, particularly up to 1,000 ft, so groundspeed is provided as an approximation to airspeed throughout this report.

Events throughout the take-off, based on recorded information and flight crew interviews, are listed and illustrated in Figure 7. Unclear utterances are marked in parentheses; some of these were recorded on multiple CVR channels and sounded different on each channel. In these cases, alternative interpretations are provided with the ATSB’s assessment of the most likely interpretation provided first.^[15] Further details and analysis of the data recordings and interpretation of the CVR is provided in Appendix C. Further information about the faults, warnings, and displays associated with the erroneous airspeed data is provided in Aircraft information.

Figure 7: Sequence of events on take-offSource: ATSB. Runway image: Google Earth

Audio analysis of the captain’s ‘speed’ statement at 2331:18 found that it was significantly quieter than both crewmembers’ other statements made throughout the take-off (see Appendix C). Later, both flight crew did not recall seeing a speed anomaly until the aircraft reached 100 kt, and the captain did not recall making the 100 kt call.

The captain’s breathing rate and intensity increased as the aircraft passed about 60 kt. The captain later recalled that the take-off seemed to happen ‘in a split second’. The FO’s breathing rate and intensity increased at about the same time as the captain said ‘borders are red’ or ‘both also don’t have’.

The captain later did not recall hearing the FO suggest a rejected take-off and reported seeing the airspeed display ‘flickering’. The FO recalled seeing a red speed flag during the 100 kt speed check.

ATSB observation The captain’s ‘speed’ statement, 2 seconds after the likely point at which the speed flag was first displayed, indicated that the captain identified the presence of an airspeed problem almost immediately. This was about 10 seconds before the point at which the flight crew are advised to be ‘go-minded’ (that is, when they should only reject a take-off for serious problems). Apparently not checking airspeed until the 100 kt call, the FO was likely unaware of the presence of a problem until after that point.

According to analysis of the recorded data, both PFDs showed the red speed flag until about 2331:40, or about when the aircraft’s nose began to lift. At this point one or both PFDs displayed the airspeed tape with an erroneous airspeed close to the minimum displayable speed (30 kt). The displays probably intermittently transitioned between unrealistically low airspeeds and the red speed flag for a period. It is possible that multiple transitions occurred between recorded data points (1 second apart), which may have appeared as ‘flickering’ to the flight crew.

The FO reported that they commenced rotation by judging the aircraft’s position on the runway (and possibly also referencing the groundspeed display). Later analysis indicated that rotation was commenced at almost exactly V_R. The FO rotated to about 13° nose up pitch attitude and maintained FLEX^[19] thrust. Passing about 120 ft, following confirmation of a positive rate of climb, the landing gear selector lever was selected to the UP position.

At rotation, the PF normally increases pitch towards 15° until lift-off. Memory items of the Unreliable speed indication procedure^[20]require the PF to attain 15° nose-up pitch and apply TOGA^[21] thrust. At this time, the flight crew did not call out ‘unreliable speed’ (as required when initiating the procedure), and the FO did not announce an intention to maintain a certain thrust setting or pitch angle. The FO later reported maintaining maximum continuous thrust (the same detent as FLEX and one setting below TOGA) and 12.5° pitch to limit the risk of a tail strike. The captain, acting as PM, did not confirm or announce deviations from the pitch attitude and thrust settings listed in the memory items of the procedure.

Initial climb

After take-off, the PFDs probably both displayed mostly a speed flag and sometimes an erroneously very low airspeed. The integrated standby instrument system (ISIS) displayed speed at or near the bottom of the speed scale (30 kt) throughout the take‑off and less than 60 kt for the remainder of the flight.

At about 300 ft, the FO again asked ‘ADR 3 to put to ADR 3?’, and receiving no immediate response, said ‘you put to ADR 3?’; the captain said something indistinct but similar to ‘autof...’ at the same time as this second question. The air data source was switched to F/O ON 3 at 2332:10, with the aircraft climbing through 600 ft.

At about 700 ft the FO reduced the pitch attitude and maintained about 9° nose up pitch and maximum continuous thrust. Although the aircraft was below the minimum safe altitude at night (2,500 ft), the flight crew did not discuss whether the safe conduct of flight was assured. However, there were no notable ground hazards in the vicinity and no other aircraft that were likely to present a collision threat.

The FO called for the autothrust ECAM^[22]actions in response to an alert advising autothrust disengagement at 2332:22, when passing 1,000 ft. The captain immediately responded and the flight crew commenced the ECAM actions.

At 1,500 ft, a master caution alert occurred, associated with a chime and the message FCTL ALTN LAW (flight control alternate law). Alternate law is a degraded flight control mode that was entered as the result of invalid air data. The aircraft had actually entered alternate law just after lift-off, however, the message is inhibited until the aircraft reaches 1,500 ft. This mode was also displayed as four small amber crosses on each PFD.

The flight crew continued the ECAM actions, which were interrupted at 2332:45 by the tower controller asking them to contact departures. The captain requested the departures frequency, which the controller provided and was read back by the captain. At this time the aircraft was passing 2,500 ft.

Urgency radio call

At 2333:04, immediately after the captain’s read back, the FO suggested they call PAN PAN and the FO then immediately transmitted over the tower frequency ‘PAN PAN, PAN PAN, PAN PAN, Malaysian one thirty four, we have unreliable airspeed and request maintain runway track and request climb to six thousand [ft] initially’.^[23]The tower controller did not later recall hearing this call and did not respond to it.

Recorded air traffic control (ATC) data shows that the call was received by the ATC radio on the tower frequency. Other recorded data showed that there were no other transmissions or calls around this time. The PAN PAN call came about 40 seconds after the end of a coordination telephone call between the tower and departures controllers, in which they also briefly discussed equipment upgrades that were being conducted at the time (the tower controller later reported that the upgrades had no adverse effect on their workload or performance).

About 28 seconds after the end of the PAN PAN call, the flight crew of another aircraft requested take-off clearance from the tower controller. The tower controller responded with the clearance.

Immediately after that clearance was provided, the tower controller received a coordination call from the departures controller, who asked if the Malaysia Airlines aircraft could be transferred to the departures frequency, which is normally done shortly after take-off. The tower controller advised that it had already been done, and that they would ask again.

During that call, as the tower controller was speaking, the flight crew of the aircraft taking off asked over the tower frequency if the controller heard the PAN PAN call. The tower controller thought that this transmission came through the telephone connection from the speakers at the departures controller’s terminal and accordingly did not respond.

The tower controller then asked the flight crew a second time to change frequency, which the FO read back.

Continued climb and stabilisation

Through the above period the aircraft was passing about 3,800 ft. The FO called for the Unreliable speed indication procedure. No memory items were called by either flight crew, and the captain proceeded to locate the procedure in the quick reference handbook (QRH).

After changing to the departures frequency, the FO made a second PAN PAN call at 2334:21 (passing 5,800 ft), asking to climb to 10,000 ft and maintain runway track. The departures controller acknowledged the PAN PAN and provided the requested clearances.

The captain then asked the FO if the autopilot could be selected on, and the FO replied that it could not.

The After take-off/Climb procedure was not actioned.^[24] At about 2335, when the aircraft was climbing through about 7,000 ft, the flight crew commenced the Unreliable speed indication procedure, including pitch and thrust settings, confirming the maximum permitted altitude with the current flap extension. The thrust levers remained in the maximum continuous thrust detent and the FO maintained 9–12° pitch until the aircraft was levelled off.

As the aircraft approached 10,000 ft, the FO requested further climb to flight level (FL) 1502^[25] which was cleared by ATC. The flight crew resumed the procedure discussing the required pitch and thrust settings to level the aircraft. The FO advised the captain to pause the procedure, citing the FO’s need to focus on flying the aircraft.

The FO stabilised the aircraft in level flight at about FL110. A short time later the FO obtained an ATC clearance to remain at this altitude and to manoeuvre the aircraft to the east of Brisbane Airport (Figure 8).

At this time, the FO retained control.^[26] The flight crew resumed the Unreliable speed indication procedure. During the troubleshooting, the air data switch was changed to NORM, and remained at that setting for about 48 s. The flight crew then changed it to CAPT ON 3 for about 4 s, to F/O ON 3 for about 2 s, then to NORM where it remained for the rest of the flight. During the switching the FO cross checked and described to the captain which ADR system was providing data to which PFD and what indications were observed on the PFD.

After the switch was returned to NORM the FO stated that all three ADR systems appeared inoperable. The captain revised the actions for identifying the affected ADR, cross-checked the PFD indications and said that either the affected ADR(s) could not be identified, or all ADRs were affected.

Figure 8: Flight path of 9M-MTK during take-off, turn-back and landingSource: Google Earth, annotated by the ATSB

After further discussion and revision of the required actions the flight crew determined that all ADRs should be selected off, which is a procedurally irreversible action in-flight (that is, there is no procedure to enable the crew to turn them back on until after landing).^[27] As a way of cross-checking the correct action before taking it, they decided to exchange duties so that the captain would fly and the FO would perform the procedural actions. The FO announced the current pitch and thrust settings to maintain level flight, and the assigned heading before handing control of the aircraft to the captain. The FO revised the required actions for the Unreliable speed indication procedure and reconfirmed the required action with the captain before switching all ADRs off. Once completed, the flight crew confirmed the amount of fuel remaining and requested a block level altitude between 10,000 ft and FL 120 which was approved by ATC.

The FO pre-read the All ADR off procedure in preparation for the next step, which was to turn all ADRs off. At 2343, with the aircraft at about 11,000 ft, the flight crew turned all three ADRs off. This activated the back up speed scale (BUSS), an alternate display mode which permits pilots to keep the aircraft in a safe performance envelope when airspeed data is unreliable or unavailable (Figure 9). Further information on the BUSS is provided in Back up speed scale. The airspeed tape on the ISIS is retained, and in this case would have stayed at the bottom of the speed scale (30 kt).

Figure 9: Example of the BUSS, showing the colour-coded scale (left) that indicates derived speed, and a GPS altitude scale (right)

This image does not reproduce the exact PFD display during the occurrence.

Source: Airbus

In addition to activating the BUSS, turning off all ADRs resulted in the following notable effects:

• the ECAM warning message NAV ADR 1 + 2 + 3 FAULT (fault with all 3 ADRs)
• pressure altitude was replaced with GPS altitude
• spoilers and speed brake are not to be used
• normal hydraulic extension of the landing gear was not possible, and the main landing gear doors could not be retracted after a gravity extension
• cabin pressure needed to be manually controlled by the flight crew
• nose wheel steering was not available on

ATSB analysis of flight data indicated that the aircraft did not approach an aerodynamic stall condition at any point during the flight^[28]

ATSB observation Initially, the absence of airspeed indication required increased flight crew vigilance and coordination to maintain a safe flight envelope. After the crew followed the required procedures, the BUSS presented a clear primary indication of the aircraft’s safe flight envelope and probably greatly reduced the likelihood of error.

At 2344 the FO briefed the cabin crew manager of the situation and advised the flight would be returning to Brisbane for a normal landing.

The departures controller asked the flight crew about their intentions and they advised that they had no airspeed information. In response, the controller provided groundspeed information and offered to provide regular groundspeed updates, which the captain accepted. The controller advised the tower controller of the situation, and the tower controller performed many of the required alert phase^[29] actions including preparing for fire services.

At 2353, the flight crew discussed available options for landing. They decided to conduct an overweight landing on runway 01 and began planning their approach and landing accordingly.

Approach and landing

The flight crew requested a descent from ATC, which the captain, as PF, commenced at 2358. The plan was for an instrument landing system approach with a long (20 NM) final approach leg^[30] to runway 01, with ATC providing vectors, groundspeed, wind and distance to run. The BUSS provided the primary speed reference and the FO provided pitch, thrust, and speed reference information from the QRH to the captain.

The flight crew obtained the Brisbane automatic terminal information service, and reviewed the systems affected and the potential effects. They advised ATC that the aircraft would require a tug after landing (due to the loss of nose wheel steering). The flight crew discussed what they would do if a missed approach was required.

The flight crew also discussed who should fly the approach and landing. Operator policy required the captain to do so in abnormal situations, but in this case the captain felt it better to effectively monitor and manage the unfamiliar situation personally while delegating the PF role to the FO who had significant experience on the A330.

ATC transferred the aircraft to the tower at 0031, when the aircraft was at 1,900 ft on approach. The departures controller advised the tower controller, who was the same controller as during the take-off, that the flight crew requested groundspeed information.

At 0033, the flight crew conducted an overweight^[31] landing on runway 01 at 152 kt groundspeed, touching down at about 390 m from the threshold, near the aimpoint. The maximum recorded vertical acceleration on landing was 1.26 g, which the aircraft manufacturer reported was within the design load limits. The FO selected reverse thrust and stopped the aircraft about 1,600 m short of the runway end.

The aircraft could not be moved immediately due to the main landing gear doors, which do not close following a gravity extension, being in contact with the runway. The LAE was called to the flight deck and, after the flight crew explained the instrumentation problem, recalled that pitot probe covers had been fitted and suspected that they may not have been removed. The LAE opened and leaned out of a side window and identified the presence of covers on the pitot probes.

After ground inspections established that the aircraft was safe to tow, it was towed to the terminal where the passengers and crew disembarked. There were no reported injuries.

Aircraft damage

The main landing gear doors had minor abrasion damage where they contacted the runway surface on landing. If the main landing gear doors are opened on the ground, such as for maintenance activity, they typically remain clear of the ground. However, compression of the main landing gear struts during the overweight landing led to contact between the doors and the runway surface (Figure 10).

Figure 10: Right main landing gear door showing runway contact markSource: ATSB

The pitot probe streamers were damaged by airflow and left red marks on the fuselage skin where they rubbed during the flight (Figure 12). The sheaths were partially burned where they folded over the heated pitot probes in the airflow.

Figure 11: Reconstruction of pitot probe covers on 9M-MTK, showing pitot probe cover damage and contact marks on aircraft skin from the streamerSource: ATSB

Figure 12: The right and left sides of the aircraft’s nose shortly after landing, showing pitot probe covers installedSource: Brisbane Airport Corporation, annotated by the ATSB

Due to the absence of airspeed data the flight crew did not have the usual indications for maximum flap and landing gear speeds. Airspeed estimates using groundspeed, wind data, and atmospheric data indicate that the maximum flap extension speed was most likely exceeded by up to 14 kt during the climb through 4,000 ft, and by up to 5 kt on descent through 7,500 ft. The maximum landing gear extension speed was probably not exceeded. Inspections (required after potential speed exceedances) were carried out and did not identify any damage.

__________

1. Pitot probes provide air data computers and flight instruments with airspeed information, and are ineffective if covered or blocked.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. More information about the flight deck displays is provided in Aircraft information.
4. PAN PAN: an internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
5. LAE: equivalent term for LAME (licensed aircraft maintenance engineer).
6. Aircraft Maintenance Services Australia was rebranded as Heston MRO in February 2019.
7. The LAE did not have the relevant Australian security pass to access the ramp area unescorted.
8. Dispatch coordination is the task of controlling and coordinating pushback between the ground handlers and flight crew. It is also known as the headset function because the dispatch coordinator wears a headset to communicate with the flight crew.
9. Pushback: using a tug to push an aircraft backwards from the terminal so that it can then taxi under its own power. .
10. None of the personnel were found to have been likely experiencing a level of fatigue known to have a demonstrated adverse effect on performance at the time of the occurrence
11. The pitot probe covers used were different to the type approved by the aircraft manufacturer. See Pitot probe covers for further information. See Airport information for further information about the mud wasp hazard at Brisbane.
12. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned flight crew roles with specific duties. In normal operations, the PF controls the aircraft and navigates. The PM carries out support duties, monitors the PF’s actions and the aircraft’s flight path, and makes radio communications. Tasks can be reallocated as required. In abnormal operations, the PF makes radio communications while the PM applies required procedures and actions. See Flight crew procedures. 
13. The flight crew performed the calculations manually and separately, and their results for V1 differed by 1 kt. The captain chose the lower of the two results. Take-off speeds were recomputed by Airbus after the occurrence: the recomputed V1 was 150 kt, and the recomputed VR was 159 kt.
14. A dispatch coordinator, or ‘headset’ person, coordinates pushback tasks between the ground crews and the flight deck, communicating with the flight crew via a headset. See Activities and duties in preparation for flight for more information about this role and related training.
15. The FO’s channel was more distorted, so the area channel was the preferred source where a difference existed.
16. The first part of this utterance sounded similar to the second syllable of ‘abort’, but there was no discernible ‘a’ sound.
17. Air data reference (ADR): This is a likely reference to the air data switch. See Air data indicating systems.
18. The angle of attack data from each ADR was flagged invalid due to airspeed being below 60 kt, leading to all three ADRs being rejected by the flight control computers at the time of lift-off and reversion to alternate law.
19. FLEX: a thrust lever setting that provides a de-rated amount of thrust for take-off to reduce engine wear.
20. In this context, ‘speed’ means ‘airspeed’. More information on this procedure and context about memory items is in Aircraft information.
21. TOGA: Take-off / go-around, a thrust lever setting that applies maximum available thrust.
22. The electronic centralised aircraft monitor (ECAM) monitors aircraft systems, displays aircraft system information, and specifies flight crew actions to be taken in the event of abnormal or emergency situations.
23. In abnormal and emergency situations, the PF is required to advise air traffic control
24. Actioning the After take-off/Climb procedure confirms that the landing gear was up, flaps were retracted (not applicable with unreliable speed indication, which did not allow configuration changes), and air conditioning packs were on to pressurise the aircraft.
25. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s altitude at standard air pressure is referred to as a flight level (FL). FL 150 equates to 15,000 ft.
26. The captain and FO later discussed whether to follow the operational policy that the captain should take over flying in abnormal situations, but the captain did not feel it was necessary in this circumstance. The FO had significantly more experience on the A330 than the captain.
27. This action does not actually turn the ADRs off, but prevents the data from being used for display and control purposes.
28. An aerodynamic stall is a very serious loss of control condition in a large passenger aircraft.
29. Alert Phase (ALERFA): an emergency phase declared by the air traffic services when apprehension exists as to the safety of the aircraft and its occupants.
30. The final leg of an approach is the period between the last turn onto the runway direction and touchdown. Extending the final leg gives the flight crew more time to stabilise the approach.
31. An ‘overweight’ landing is conducted at an aircraft weight higher than certified maximum landing weight, and involves greater structural forces and longer landing distances. The aircraft’s weight on landing was about 211,500 kg, and its maximum landing weight was 187,000 kg.

Airport information

General airport information

Brisbane Airport’s main runway was 01/19, which was 45 m wide and 3,560 m long. It was equipped with edge lighting, centreline lighting, and instrument landing system (ILS) in both directions. Runway 01, used for the take-off and landing, was fitted with approach lighting and a precision approach path indicator,^[32] and was approved in the ILS category I. To its north was a secondary runway (14/32), and a parallel main runway (01L/19R) was under construction to the west.

Mud wasp hazard

‘Mud wasp’ is a colloquial term encompassing numerous species of wasp, including those known as mud‑dauber, keyhole, and potter wasps.^[33] They are named for their nests, constructed mostly from mud or sand, which are sometimes built within abandoned nests of other species or small cavities within human-made objects. The wasps then place captured spiders or insects inside as food for their larvae. Other wasp species can take over these nests parasitically. For these reasons, analysis of the nest’s contents may not always reveal the species of wasp responsible for the original construction of the nest.

Mud wasps are found throughout Australia with the majority found along the eastern seaboard, especially in tropical Queensland.^[34] At least 10 distinct mud wasp species have been identified at Brisbane Airport.

Historically, mud wasps have been known to build nests in aircraft pitot probes, entering through the forward-facing opening (Figure 13). Nesting and food material placed in the cavity blocks the probe, to the point where it may no longer provide accurate airspeed information. A partial blockage, such as that caused by the first addition of mud for a nest, may be enough to cause anomalous airspeed readings as air flow is disturbed.

The Civil Aviation Safety Authority (CASA) reported that the potential for pitot probe contamination may arise within 20 minutes of availability (Appendix A). Wasps have been observed inspecting aircraft within a few minutes of arrival at the gate. There may not be external signs of the presence of a nest or partial nest within the probe, and there have been occurrences at Brisbane airport where pitot probes were blocked during a turnaround by a partially completed wasp nest (see Related occurrences).

House and others (2020a) conducted a study at Brisbane airport to determine the species and prevalence of mud wasp nest building using replica pitot probes of various types, finding that only keyhole wasps (Pachodynerus nasidens, originating from the Caribbean-South American region) constructed nests in the replica probes, although other species could not be excluded. Brisbane Airport is the only place in Australia that is known to have a resident population of this species. It is also present in Hawaii and Micronesia.

Figure 13: Female keyhole wasp (Pachodynerus nasidens) on a replica DHC8 pitot probe, Brisbane Airport, May 2016Source: House 2020b

The Brisbane Airport study found that the wasps could nest in replica pitot probes of all types. Replica pitot probes with apertures of 7.2 mm (modelled after those fitted to a typical Boeing 737‑400) were the most affected, followed by 5.5 mm (A330) and 5.0 mm (Boeing 737-800).

The study also found that 96 per cent of keyhole wasp nesting occurred between November and May. Keyhole wasps are generally active only during the day, but strong airport lighting appears to have allowed them to build nests at night on at least one occasion. Ecosure (2017) stated:

At [Brisbane Airport], mud nests have been reported on all types of buildings including hangars, terminals and other structures, but only in pitot probes of aircraft parked near terminal buildings or in hangars. This suggests that aircraft parked in open areas are difficult for wasps to locate and nest on.

Airworthiness bulletin on wasp nest infestation

In May 2015, CASA issued Airworthiness Bulletin (AWB) 02‑052 ‘Wasp Nest Infestation – Alert’ to ‘urgently advise operators, maintainers and pilots of the dangers associated with undetected wasp infestation in aircraft, and the circumstances under which they can occur.’ It was available on the CASA website and emailed to subscribers. Its two pages contained background information regarding Australian mud-dauber wasps and their potential to make nests in aircraft, originally stating that their nests can completely block a pitot tube within 2 hours. Recommendations were given for the parking and storage of aircraft.

The AWB was updated from time to time with amendments summarised as follows:

• From issue 2 (March 2016):
  • included anecdotal evidence that mud dauber wasps ‘can build a significant nest capable of completely blocking a pitot tube, vent, or drain in around 20 minutes’
  • recommended operators ‘be aware that on-ground pre-flight air data module [built-in] tests and/or computer checks will usually not test pitot probes or static vents for blockages.’
• From issue 3 (December 2017):
  • provided information on the criticality of relevant failures in accordance with the United Sates Federal Aviation Administration (FAA) advisory circular (AC) 23.1309-1E as follows:
• Pitot tubes blocked in flight can cause total loss of function of airspeed or altitude indication. This is classified as hazardous.
• Total loss of function of flight controls is catastrophic.
• Misleading and/or malfunction without warning of electrical trim control systems is catastrophic.
  • advice regarding the fitment of pitot probe covers during turnarounds, and that it was important the covers were approved by the manufacturer, as others may not fit correctly.
• From issue 4 (May 2018):
  • a significant expansion of information from 5 to 11 pages including information from a report commissioned by Brisbane Airport Corporation about keyhole wasps, and noted that as their eradication was not possible, notification of their presence was permanently published in the Airservices Australia’s En Route Supplement Australia (ERSA) section on Brisbane Airport (see Aeronautical charts).
  • mentioned newer design pitot probe covers fabricated from materials ‘such as fibreglass or Nomex’ being able to withstand higher temperatures, as would be required during turnarounds prior to heated pitot probes having cooled sufficiently.
• From issue 5 (February 2021), AWB 02-052 stated the criticality of failure differently:

Pitot tubes or static ports blocked (or even partially blocked) in flight can cause total loss of airspeed or altitude indication. This is classified as hazardous. Misleading and/or malfunction without warning can be catastrophic.

Airbus guidance

In July 2016 Airbus published an article on pitot probes blocked by insect activity in its free Safety First magazine, which shares non-mandatory safety information with Airbus operators and flight crews. The article mentioned a 2013 occurrence investigated by the ATSB (see Related occurrences) and presented an excerpt from an Brisbane Airport ERSA entry that warned of the potential for wasps to block pitot probes. It proposed the use of pitot probe covers as a preventative measure, stating (Airbus 2016):

Parking procedures available in the Aircraft Maintenance Manual [AMM] will request that approved protective covers are installed on each of the air data probes or devices, including Pitot probes. But many operators will not apply the AMM parking procedure if the aircraft only has a short turnaround time or remains on the flight line. …

With the recent finding from the example incident where a Pitot probe obstruction occurred in less than two hours, it is important to know if Pitot probe protection is a priority in local airport ground handling or turnaround procedures. The aircraft operator should collaborate with the local airport authorities to assess the risk of Pitot probes being blocked by sand, dust, dirt or insects activity at their operational base or destination airports. For example, check if a wildlife management plan is part of the airport’s hazard management strategy and what mitigations are in place to detect or manage insect activity. Confirm how each airport will alert airlines or operators where there is evidence that local conditions may contribute to an increased risk of Pitot blockage to aircraft on the ground.

Depending on the outcomes of this risk assessment, the operator should consider implementing a specific policy on the use of Pitot covers even for a short turnaround time. Some airlines already have policies in place for certain airports that require Pitot covers to be used for all aircraft on the ground regardless of turnaround times.

Brisbane Airport wasp management activities

Brisbane Airport Corporation manages the risk to aircraft posed by mud wasps as part of a broader wildlife hazard management. The airport conducts bi-monthly internal wildlife management meetings and quarterly external wildlife management meetings and produces education material for airport workers. Other activities for wasp management include the application of direct and indirect control methods such as removal of nests, limiting availability of nesting materials and food sources, and selective eradication. In addition, there are ongoing studies into the activity and biology of mud wasps in the area and the effectiveness of control methods (Ecosure 2017). Some operators and ground service providers also have wasp management programmes in place.

Aircraft information

General information

The aircraft was one of 15 Airbus A330-300 aircraft operated by Malaysia Airlines. The Airbus A330 is a large capacity, wide-body, twin-engine aircraft, which is used for medium-to-long-range air transport operations and was first certified in Europe in 1993.

Inspection of the on-board aircraft documentation showed that the aircraft had one deferred defect which was an unserviceable park brake light indicator, which is located on the nose gear. It illuminates to indicate to ground personnel when the park brake is set. No other maintenance issues were recorded.

Flight control system

The Airbus A330 has fly-by-wire flight controls. The aircraft’s flight control surfaces are electrically controlled and hydraulically actuated, and flight control computers process pilot and autopilot inputs to direct the control surfaces as required. There are three flight control primary computers and two flight control secondary computers.

The flight control computers continuously monitor outputs from the 3 air data inertial reference units (ADIRUs). There are different rules for comparing discrepant values; typically, each individual value is compared with the median value. If the difference is above a predetermined threshold for a predetermined duration, then the associated part of that ADIRU was rejected and the two remaining sources were used for flight control purposes. When two sources are rejected, the system reverts from normal law to alternate law.

In normal law, the computers prevent the exceedance of a predefined safe flight envelope using a range of protections (load factor, pitch attitude, angle of attack, high speed, and bank angle).

Alternate law is used when there is insufficient air data for normal law to operate correctly. Some of the protections are not provided or are provided with alternate logic. There are two levels of alternate law; the loss of reliable airspeed means the aircraft enters the more degraded level where only load factor protection remains, and the high angle of attack protection is replaced by a stall warning.

Flight crew alerting systems

The A330’s electronic centralised aircraft monitoring (ECAM) system presents aircraft system data to the flight crew. The ECAM comprises the engine and warning display (E/WD) and system display in the centre of the instrument panel.

The lower part of the E/WD displays messages and specifies flight crew actions to be taken in the event of abnormal or emergency situations. The left section presents warning messages and the right section lists the affected systems, secondary failures, memos or special notices (such as ’LAND ASAP’).

Individual aircraft system failures are graded according to their safety effect on the aircraft. The ECAM has three failure mode levels (Figure 14). Alerts are prioritised so that higher-level alerts are displayed first, and also prioritised within each level.

Figure 14: Airbus A330 failure mode levels
WARN: warning. CAUT: caution.
Source: Airbus

Master warning (flashing red) and master caution (steady amber) lit buttons are located on the glareshield in front of each pilot to draw their attention to important messages on the ECAM, and can be pushed to suppress the alerts until a new alert occurs. A continuous (repeating) chime plays when a master warning occurs, and a single chime plays when a master caution occurs.

In addition to the ECAM system, Airbus has a series of procedures for abnormal or emergency situations where flight crew may not receive an ECAM alert or warning. These are known as memory items. Memory items are procedures, or critical immediate actions of an ECAM/quick reference handbook (QRH)/operations engineering bulletin (OEB) procedure, that the flight crew must apply by memory to ensure continued safe flight. In some time-critical situations, the flight crew has no time to refer to the ECAM and/or to the QRH.

Air data indicating systems

Measurement

Most modern aircraft measure airspeed by comparing total air pressure at the front of a pitot probe with static (still) air pressure measured elsewhere. The A330 has 3 pitot probes—2 on the left side and 1 on the right side—and 6 static ports (Figure 15 and Figure 16). On the A330 and A340, the pitot probes are about 2 m above typical eye level and cannot be closely inspected without an access stand (moveable platform). Specialised equipment is needed to detect internal contamination or leakages.

Figure 15: Airbus A330 pitot probe and static port positionsSource: Airbus

Figure 16: View of an exemplar A330 from eye level, with similar pitot probe covers to those used on the occurrence aircraft

Source: ATSB

The pitot probes had a tube that projected out from the fuselage, with the opening of the tube pointed forward into the airflow. The tubes had drain holes to remove moisture and were electrically heated to prevent icing during flight. The A330 uses UTC Aerospace Systems 0851HL pitot probes (Figure 17 and Figure 18), also used on Airbus A318, A319, A320, A321 and A340 aircraft.

Each of the A330’s pitot probes and static ports are connected to a separate air data module, which converts air pressure into digital electronic signals that are passed to one of the 3 ADIRUs.

Each ADIRU comprises two parts which are integrated into a single unit: an air data reference (ADR) part and an inertial reference part. One part can be switched off while the other part can still operate. The ADRs use total pressure and static pressure to compute indicated airspeed and Mach number, which are then passed to other systems including the flight deck instruments. The inertial reference part independently calculates parameters such as groundspeed.

Figure 17: Pitot probe external viewSource: ATSB

Figure 18: Pitot probe internal construction

Representative only; the drawing shows a Thales pitot probe and not a UTC Aerospace Systems pitot probe as used on 9M-MTK.

Source: Airbus

The ADRs feed each primary flight display (PFD):

• ADR 1 processes data from the captain’s pitot probe on the mid-lower left side of the airframe, digitised by the associated air data module, and is presented on the captain’s (left side) PFD.
• ADR 2 processes data from the first officer’s pitot probe on the lower right side of the airframe, digitised by the associated air data module, and is presented on the first officer’s (right side) PFD (identical to the captain’s PFD).
• ADR 3, processing data from the standby pitot probe on the lower left side of the airframe, digitised by the associated air data module.

The pitot probe and static ports used by ADR 3 are also used by the integrated standby instrument system (ISIS) for its display of air data.

Displays

The electronic flight instrument system displays comprise two PFDs, one in front of each pilot, showing mostly flight parameters, and two navigation displays (NDs) that show navigation data (Figure 19). The ISIS is to the right of the captain’s displays.

Figure 19: A330 instrument panelSource: Airbus, annotated by the ATSB

Airspeed is normally displayed as a vertical tape on the left side of each PFD (Figure 20) and the ISIS (Figure 21), with altitude on the right of each. A speed trend (acceleration) vector is shown as a vertical yellow arrow when airspeed is above 30 kt, and V₁ is shown with a ‘1’ symbol. Groundspeed is displayed at the top left of the NDs (Figure 22).

Figure 20: PFD on a typical take-off, showing airspeed scale (left) at 120 kt

Source: Airbus

Figure 21: ISIS showing airspeed (left) at the bottom of the scale (30 kt)

Source: ATSB

Figure 22: Groundspeed indication on ND

The ND has a number of selectable display modes, including weather radar as shown.

Source: Airbus

An air data switch on the switching control panel, at the forward end of the centre pedestal, permits the flight crew to change the source of air data for one of the PFDs to ADR 3 (Figure 23 and Figure 24). An overhead panel shows the status of each ADIRU and allows the flight crew to turn the air data or inertial part of each ADIRU off separately.

Figure 23: Air data switch
Source: ATSB

Figure 24: Part of the operator’s safety reporting process, also used for general safety risk management Source: Airbus

Validity monitoring

The air data system has a complex and interrelated set of rules to evaluate the validity of data from the sensors. ADIRUs, flight control computers, and other equipment continuously conducts various validity checks, including the following:

• Airspeed is not recorded or displayed to the flight crew when it has a calculated value below 30 kt.
• When the aircraft is on the ground, airspeed is below 30 kt and groundspeed above 50 kt, the associated PFD displays a red speed flag (similar to Figure 25). The ISIS will show airspeed at the bottom of the scale at 30 kt under these conditions, and a speed flag for some other failures of the third air data system.
• Generally when all airspeeds are above 90 kts on ground, or at all times in flight, the flight control system uses the median value of the 3 sources. If any of the sources deviates from the median by more than 16 kt for at least 10 s:
  • that airspeed source is considered invalid
  • the associated ADR is rejected (no longer used)
  • the NAV IAS DISCREPANCY (navigation indicated airspeed discrepancy) message and master caution are presented if the airspeed source was displayed on a PFD.
• If an ADR is rejected or flags its data as invalid and there are then differences between the two remaining sources of more than 16 kt for at least 1 s, the remaining ADRs are rejected and the NAV ADR DISAGREE (navigation ADR disagreement) message and master caution is presented.
• Angle of attack is flagged invalid when airspeed is invalid or below 60 kt.

A rejected ADR is not used by the electronic flight control system (which manages control surface movement). Autopilot and autothrust require two or three valid ADRs.

Figure 25: Speed flag on left of PFD (indicative)

This is a composite image and does not exactly reproduce the aircraft display.

Source: Airbus, modified by the ATSB

Alerts on take-off

The flight warning computer inhibits some warnings and cautions for each of the 10 predefined flight phases. Most warnings and cautions are inhibited (temporarily disabled) during some phases, including take-off, to prevent flight crew distraction from more important and time-critical tasks. In these phases, failures that require immediate crew action or affect the safety of flight (such as fire detection) remain active.

Warnings and cautions that are not considered by the manufacturer to be essential to safety in certain flight phases are inhibited (prevented from being displayed) if they appear in those phases. This is to avoid unnecessarily alerting the pilots at times of high workload (such as take-off or landing). They are displayed in the next flight phase for which they are not inhibited if the condition still exists. Examples are listed in Table 1.

Table 1: Selected warnings and cautions and applicability during take-off

Annunciation	Description	Availability during take-off	Alert level	Alert type
NAV IAS DISCREPANCY	With 3 valid airspeed sources, one airspeed source deviates from the median by more than 16 kt for at least 10 seconds	Active after the aircraft reaches 80 kt, but may not always trigger as it requires all airspeeds to be above 30 kt, and a 16-kt discrepancy to remain present for at least 10 seconds	Caution	Aural and visual
NAV ADR DISAGREE	After an ADR is rejected or flags its data as invalid, there are then differences between the two remaining sources of more than 16 kt for at least 1 second	Inhibited	Caution	Aural and visual
NAV ADR 1 FAULT	Fault within ADR(s) or absent data from ADR(s)[35]	Inhibited after 80 kt if valid airspeed is available	Caution	Aural and visual
NAV ADR 1+2 FAULT
NAV ADR 1+2+3 FAULT	Warning	Aural and visual
ENG FIRE	Engine fire detected	Active except from V1 to 15 seconds after lift-off	Warning	Aural and visual
APU FIRE	Auxiliary power unit fire detected	Active except from V1 to 15 seconds after lift-off	Warning	Aural and visual
(speed flag on PFD)	Invalid airspeed (below 30 kt)	Active after groundspeed exceeds 50 kt	Warning[36]	Visual

Back up speed scale

The back up speed scale (BUSS), fitted to 9M-MTK, has been available as standard fitment on the Airbus A380, and as an option on the A330/A340 since 2006 and the A320 series since 2007, with a reported cost of about €300,000 per aircraft in 2010.^[37]

The BUSS is activated by turning off all the ADRs. The BUSS then provides flight crews with a visual indication of the safe speed envelope related to angle-of-attack, obtained through the inertial reference part of the ADIRUs (Figure 26). The airspeed tape on the PFDs, or speed flag if present, is replaced with a colour-coded scale. The pilot flying (PF) maintains the indication within the green zone by adjusting pitch and thrust. Since turning the ADRs off makes static pressure unavailable, pressure altitude is replaced with GPS altitude (Figure 27).

Figure 26: Back up speed scale display
Source: Airbus

Figure 27: Back up altitude display with BUSS active

Source: ATSB

With the BUSS active:

• the flight crew adjusts aircraft pitch and thrust to keep the indicator within the green area of the speed scale
• the stall warning remains operational
• cabin pressure must be controlled manually
• the flight crew are not permitted to use speed brakes (because this affects the relationship between angle-of-attack and airspeed and will cause the BUSS to display erroneous data)
• the flight crew should aim to change the aircraft configuration (extending or retracting flaps or landing gear) with wings level and aim to do so when the indicator is within specific regions of the green band.

Flight crew information

The captain had flown for Malaysia Airlines since 1993 on Boeing 747 and 737 variants, transferring to the Airbus A330 in May 2017 and cleared to line operations in the A330 in September 2017. The FO had flown for the operator since 2009 on the Boeing 737, transferring to the Airbus A330 in 2011. Both pilots held the appropriate qualifications to conduct the flight.

The captain had 14,411 total flying hours, including 555 on the A330. The FO had 6,544 flying hours, including 4,583 on the A330.

The flight crew had arrived in Brisbane on 16 July and had 48 hours’ opportunity to rest before the flight. The captain reported feeling adequately rested.

Further flight crew details are in Appendix B.

Flight crew procedures

See Activities and duties in preparation for flight for information about the flight crew walk-around procedure.

General principles

Flight crew procedures and guidance were tailored to the operator from standard Airbus documents, and comprised the:

• flight crew operating manual (FCOM), which included information about the aircraft systems, performance information, loading data, and standard operating procedures
• quick reference handbook (QRH) for in-flight reference of some procedures and performance information
• flight crew techniques manual (FCTM) containing supplemental guidance material.

The operator also had an operations manual for general policies and procedures not specific to aircraft types.

The FCTM stated that the PF is required to ‘monitor and control the pitch attitude, bank angle, airspeed, thrust, sideslip, heading, etc., in order to achieve and maintain the desired targets…’ The PM was required to ‘actively monitor’ flight parameters and call out any excessive deviation. This role was described as ‘very important’.

According to the relevant policies, flight crew were required to announce and confirm the initiation of any procedure, as well as changing aircraft settings other than flight control, thrust manipulation, seat adjustment and the like.

On first recognition of an abnormal situation or emergency that requires a procedure to be completed, the crewmember who first recognised the situation was required reset the master warning/caution if applicable. For each ECAM procedure, the pilot monitoring was required to call out the title of the applicable procedure. This allowed each pilot to be aware of the situation and be prepared to react correctly in regard to standard operating procedures, crew coordination, task sharing and communication.

In some time-critical situations, there may be critical actions of a procedure that the flight crew must apply immediately by memory to ensure a safe flight path rather than refer to the ECAM or QRH. If the procedure has memory items the flight crew must carry them out before any other actions, while calling the relevant procedure using specific terms, such as ‘unreliable speed’.

The FCTM stated:

The flight crew must ensure a safe flight path. If the safe conduct of the flight is affected, the flight crew applies the memory items.

The memory items enable to rapidly establish safe flight conditions for a limited period of time in all phases of flight and in all aircraft configurations (weight and slats/flaps).

The flight crew must apply the memory items, if they have a doubt on their ability to safely fly the aircraft in the short term with the current parameters, i.e.:

-    The flight crew has lost situation awareness, or

-    The current pitch and thrust are not appropriate for the current flight conditions, or

-    The aircraft has an unexpected flight path for the current flight conditions.

There were ten A330 procedures with memory items:

• loss of braking
• emergency descent
• stall recovery
• stall warning at lift off
• unreliable speed indication
• EGPWS cautions
• EGPWS warnings
• TCAS warnings
• windshear
• windshear ahead

After the memory items are complete, the PF should then command applicable ECAM or QRH actions. This prompts the pilot monitoring (PM) to manage the failure by first confirming the failure and then conducting the procedure as displayed electronically or with the QRH carried in the flight deck.

In abnormal operations the following principles applied, as written in the FCTM:

It is the responsibility of the PF to:

-    FLY ^[38]

-    NAVIGATE

-    COMMUNICATE after the initiation of:

-    The ECAM actions, or

-    A QRH procedure.

It is the responsibility of the PM to:

-    MONITOR the flight path and the navigation

-    Perform ECAM actions or apply QRH/OEB^[39]

The FCTM stated that the PF takes over communication duty from the PM in abnormal operations because ‘the cognitive skills of the PM are mostly dedicated to the understanding and the application of the ECAM/QRH/OEB actions. Therefore, their situation awareness of the environment and the navigation is less effective than the PF’s one.’

The FCTM stated that the flight crew must pause any normal or abnormal procedures or ECAM actions currently underway to perform the After Take-off/Climb procedure (or any other normal procedure that is due), stating:

The flight crew must perform the pending normal C/L [checklist (procedure)] at this stage as it is a good compromise between the necessary application of ECAM procedures and system analysis and the delay in the check of systems status (e.g. in the case of failure after takeoff, flaps and landing gear retracted)

Pre-flight procedures

The relevant parts of the Preliminary cockpit preparation procedure and the Before start checklist are shown in Figure 28 and Figure 29 respectively.

The Preliminary cockpit preparation procedure required the pilot monitoring to check that the gear pins and covers (meaning pitot probe covers and the like) were stowed onboard (in the flight deck), followed by the external aircraft walk-around. More information on the walk-around is in Flight crew walk-around procedure.

The first item of the Before start procedure required the crew to both confirm that they had previously completed the Preliminary cockpit preparation procedure.^[40] The second item of the Before start checklist was for the flight crew to cross-check that the ‘gear pins and covers’ had been removed. Since this is after the completion of the flight crew walk‑around and flight deck compartment check (both part of the Preliminary cockpit preparation procedure), this item effectively reconfirms the findings of those checks with regard to the gear pins and covers.

Figure 28: Extract from Preliminary cockpit preparation procedure
Source: Malaysia Airlines

Figure 29: Before start checklist
Source: Malaysia Airlines

Take-off procedure

Tasks and monitoring

During a take-off, the PF is required to set take-off thrust, maintain directional control along the runway centreline and occasionally scan the engine instruments and airspeed. The PM is required to monitor engine instruments and airspeed.

The take-off procedure as written in the QRH is provided in Figure 30, and additional guidance from the FCOM is provided in Figure 31. The 100 kt announcement (by the PM) and cross-check (by the PF) must be referenced using airspeed. The PM is required to monitor for an automatic callout at V₁; if it is not made, the PM must announce it.

Figure 30: Take-off procedure in QRHSource: Malaysia Airlines

Figure 31: Take-off guidance in FCOM

EPR and EGT are engine parameters.

Source: Malaysia Airlines

In addition to the required actions, it is normal for both flight crewmembers to perform some monitoring of things that are not their primary responsibility. For example, the PF may check flight and engine instruments and the PM may look outside the aircraft to check for traffic and monitor the aircraft’s course.

The PF normally rotates to 15° pitch attitude then follows the aircraft’s speed reference system (SRS) guidance, which provides an indication of the required pitch attitude to maintain a predetermined climb speed in the current configuration. The autopilot can be used to follow the SRS. In alternate law, SRS is not available.

Rejected take-off

The Malaysia Airlines operating procedures stated that the captain held sole responsibility for the decision and action to reject the take-off or continue.

The FCTM included guidance to assist captains with their decision-making process, and provided standard terminology for take-off decision callouts:

It is … recommended that the Captain keeps his hand on the thrust levers until the aircraft reaches V1, whether he is Pilot Flying (PF) or Pilot Monitoring (PM).

-    If a malfunction occurs before V1, for which the Captain does not intend to reject the takeoff, he will announce his intention by calling "GO".

-    If a decision is made to reject the takeoff, the Captain calls "STOP". This call both confirms the decision to reject the takeoff and also states that the Captain now has control. It is the only time that hand-over of control is not accompanied by the phrase "I have control".

The take-off is divided into two phases: low speed (below 100 kt) and high speed (above 100 kt). Guidance on the decision-making for a rejected take-off from the FCTM is shown in Figure 32.

Figure 32: Rejected take-off decision guidance in FCTM

ENG: engine. F/CTL: flight control. EGT: exhaust gas temperature.
Source: Malaysia Airlines

Unreliable airspeed procedure

Detection

Erroneous (or unreliable) airspeed can be detected in a number of ways, including:

• the aircraft detects a problem and alerts the flight crew through:
  • a speed flag on the PFD
  • an ECAM alert
• the flight crew detect a problem directly, through:
  • observing abnormal airspeed values or trends
  • comparing any of the three airspeed displays throughout the take-off, all of which can be seen from both flight crew positions
  • performing the 100 kt cross-check.

Airbus analysis of reported unreliable airspeed events at take-off found that all significant airspeed anomalies appeared before the aircraft reached 100 kt.

The FCTM stated:

The ADRs detect most of the failures affecting the airspeed or altitude indications. These failures lead to:

-    Lose the associated speed or altitude indications in the cockpit

-    Trigger the associated ECAM alerts.

However, there may be cases where an airspeed and/or altitude output is erroneous, while the ADRs do not detect it as erroneous. In such a case, no ECAM alert is triggered and the cockpit indications may appear to be normal whereas they are actually false. Flight crews must have in mind the typical symptoms associated with such cases in order to detect this situation early and apply the "UNRELIABLE SPEED INDICATION" QRH procedure.

The FCTM detailed the effects in normal flight, with one erroneous ADR, and with two or three erroneous but different ADR outputs. The FCTM additionally provided the following case (in entirety):

ONE ADR IS CORRECT, BUT THE OTHER TWO ADRS PROVIDE THE SAME ERRONEOUS OUTPUT, OR IF ALL THREE ADRS PROVIDE CONSISTENT AND ERRONEOUS DATA:

The systems reject the correct ADR and continue to operate using the two erroneous but consistent ADRs. The flight crew can encounter such a situation when, for example, two or all three pitot tubes are obstructed at the same time, to the same degree, and in the same way. (Flight through a cloud of volcanic ash, takeoff with two pitots obstructed by foreign matter (mud, insects)).

Regarding differences between airspeed indications the FCTM stated:

The most probable reason for erroneous airspeed and/or altitude information is an obstruction of the pitot and/or static probes. Depending on how the probe(s) is obstructed, the effects on cockpit indications differ.

It is highly unlikely that the aircraft probes will be obstructed at the same time, to the same degree and in the same way. Therefore, the first effect of erroneous airspeed/altitude data in the cockpit will most probably be a discrepancy between the various indications (CAPT PFD, F/O PFD and STBY instruments).

ATSB observation Although the A330 flight crew techniques manual correctly stated that an ADR would be rejected by aircraft systems with two erroneous yet similar air data indications, it incorrectly stated that the same effect would also occur in the case of three erroneous yet similar air data indications. However, the ATSB considered it very unlikely that two flight crew members faced with this scenario would both misunderstand the description to the extent that it would lead to an incorrect diagnosis of the problem or an incorrect response.

The FCTM provided five non-exhaustive examples of airspeed failure cases and their varying consequences, and explained in detail the effects of pitot probe obstruction during flight, where ice blockages are a significant hazard. One example discussed the effects of total pitot obstruction due to foreign objects, one of the effects of which was constant indicated airspeed. There were no examples specific to the take-off phase of flight. The FCTM stated:

It should be noted that the cases described … cover situations where probes (eg pitot) are totally obstructed. There can be multiple intermediate configurations with similar, but not exactly identical consequences. The … table clearly illustrates that no single rule can be given to conclusively identify all possible erroneous airspeed/altitude indications cases.

In correspondence with ATSB in 2021, Airbus emphasised the importance of flight crew monitoring on take-off, stating that the known causes of unreliable airspeed would lead to the condition being detectable by pilots prior to 100 kt.

Management

When detecting erroneous airspeed, the observing pilot is required to immediately call ‘unreliable speed’ and the flight crew then apply the Unreliable speed indication procedure. The procedure is not associated with an ECAM message. This procedure stated that if the ‘safe conduct of the flight is impacted’ the flight crew were required to carry out a set of memory items which included:

• autopilot, autothrust, and flight directors off
• pitch and thrust:
  • 15° pitch and take-off/go-around (TOGA) thrust (when below the thrust reduction altitude^[41]
  • 10° pitch and climb thrust (when between the thrust reduction altitude and 10,000 ft)
  • 5° pitch above 10,000 ft
• maintain flap configuration, or set to configuration 3 if full flaps are set
• retract speedbrake and landing gear
• level off for troubleshooting when at or above the minimum safe altitude or circuit altitude.

The Unreliable speed indication procedure did not give separate instructions for take-off. There was no specific instruction or guidance in the flight manuals on the type or number of unreliable airspeed indications for which a take-off should be rejected. In a March 2021 article of the Airbus Safety First magazine^[42] titled Unreliable airspeed at takeoff, Airbus stated that a ‘flight crew should be prepared to reject the takeoff at the time of the 100 kt crosscheck if an airspeed discrepancy is observed.’

When a safe flight path is assured, the flight crew can level off and maintain a safe speed using tables in the QRH that provide pitch angles and thrust settings (these vary depending on the aircraft’s altitude, weight, and configuration).

When all ADRs are affected or the flight crew cannot identify the faulty ADR(s), and the aircraft is below flight level 250, the flight crew are required to switch OFF all ADRs, activating the BUSS.

Training

Unreliable airspeed indication is a standard training scenario delivered to most pilots, usually simulated during climb, cruise or descent. Anecdotally, specific training for unreliable airspeed on take-off is rarely, if ever, part of an airline’s regime. The operator’s pilots received separate training and guidance on unreliable airspeed and rejected take-off scenarios separately, but there was no specific guidance for unreliable airspeed on take-off in the aircraft flight manuals, and the occurrence pilots did not receive training for this situation

Non-mandatory additional guidance

A number of articles published by Airbus in its Safety First magazine addressed unreliable airspeed in flight and during take-off. A 2007 article stated:

An unreliable speed situation may be difficult to identify, due to the multiple scenarios that can lead to it. Therefore, training is a key element: indeed the flight crew’s ability to rapidly detect the abnormal situation, and to correctly handle it, is crucial. In case of any doubt, the pilot should apply the pitch/thrust memory items, and then refer to the QRH to safely fly the aircraft, and to positively determine the faulty source(s) before eliminating it (them).

With regard to take-off, a later article stated (Airbus 2021):

Early detection of an unreliable airspeed event will enable the flight crew to reject the takeoff at a lower speed. From the start of the takeoff roll, the pilot monitoring must check for inconsistent airspeed indications, abnormal airspeed trends, or the absence of airspeed indications, and alert the pilot flying as early as possible if an issue is detected.

In correspondence with the ATSB, Airbus later confirmed that a flight crew has to consider rejecting the take-off if unreliable airspeed is observed before reaching 100 kt. Articles that addressed unreliable airspeed during take-off advised to reject the take-off if unreliable airspeed is observed before the decision speed. The 2021 article stated:

The 100 kt crosscheck is the last line of defense to prevent taking off with an unreliable airspeed indication. The flight crew should be prepared to reject the takeoff at the time of the 100 kt crosscheck if an airspeed discrepancy is observed.

An earlier Safety First article (Airbus 2006) also advised pilots to ‘abort their take-offs when airspeed indication is detected unreliable’, adding:

…after take-off thrust setting, both crewmembers should scan airspeed indications. In case of detection of an unreliable condition of one of the airspeeds before V₁, take-off should be aborted.

In some articles, Airbus advised flight crews to follow the Unreliable speed indication procedure in all flight phases, including take-off (Airbus 2007):

If the safe conduct of the flight is affected, the flight crew applies the memory items: these allow “safe flight conditions” to be rapidly established in all flight phases (take-off, climb, cruise) and aircraft configurations (weight and slats/flaps). The memory items apply more particularly when a failure appears just after take-off.

A further Safety First article about ice ridges (which can form on the ground in cold conditions and disrupt airspeed measurements during take-off) similarly advised (Airbus 2018):

What to do in the case of an unreliable speed event during takeoff?

…in any event where an airspeed discrepancy is detected by the flight crew, the UNRELIABLE SPEED INDICATION must be applied. Refer to FCOM UNRELIABLE SPEED INDICATION procedure and associated FCTM chapter for more information on the procedure application.

With regard to how unreliable airspeeds will appear to pilots, the 2006 Safety First article gave an example where an aircraft had two simultaneous and near-identical pitot probe blockages on take-off and discussed the potentially very serious effects of this scenario on aircraft controllability, particularly at higher speeds. Conversely, a later article titled The Adverse Effects of Unrealistic Simulator Scenarios stated (Airbus 2019):

Multiple Pitot obstructions can never occur exactly at the same time and can never have permanently the same obstruction characteristics [over] time. This is fundamental because multiple Pitot obstructions will undoubtedly lead to airspeed discrepancy detected by the flight control system which, in this case, will reject the erroneous airspeed information and associated ADR and revert to alternate law.

This 2019 article was about training scenarios that simulate simultaneous blockage of both openings in multiple pitot probes (which has different effects to this occurrence), arguing that it is not a realistic training scenario because such an occurrence had never happened in operation.

In 2021, the ATSB asked Airbus for its recommendation for how flight crews should respond to an airspeed discrepancy that is identified after 100 kt but before V₁. Airbus stated that:

…above 100kts, and approaching V₁, the Captain should be "go-minded" and only reject the takeoff in very few occasions such as sudden loss of thrust, any indication that the aircraft will not fly safely, any triggering of ECAM alert. Thus, UAS [unreliable airspeed] events do not belong to the events that the crew has to consider for discontinuing the take-off above 100 kt.

In further correspondence in 2022, the ATSB asked Airbus to provide further guidance on specific scenarios (such as the single complete loss of airspeed detected before the 100 kt airspeed check, or scenarios where unreliable airspeed was detected at 100 kt). Airbus responded that the decision to continue or reject a take-off lies with the captain and that all significant unreliable airspeed events were present from low speed and were detectable before 100 kt. The French Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) and Airbus advised the ATSB that they ‘do not consider that there is a need to specifically address the case of unreliable airspeed being identified after 100 kt.’

Sterile flight deck procedure

The purpose of a sterile flight deck is to focus the flight crew’s attention on their primary operational duties, usually applied during the departure and approach phases of flight. In these periods, pilots are not permitted to engage in non-essential conversations that are not pertinent to safe aircraft operation or to engage in any activity which could distract any flight crew member from the safe conduct of their duties.

The operator’s sterile flight deck policy was outlined in its operations manual. It stated the requirements for departures which included:

The period shall be in effect during critical phases of flight. Critical phase of flight involves all ground operations from taxi, take-off, landing, and all other flight operations below 10,000 feet above mean sea level, except cruise flight.

Specifically, the departures phase was defined as:

…from pushback (or as determined by the PIC [pilot in command; i.e. captain] due operation reasons) until the Fasten seat belt sign is switched off during climb.

Flight crew training

Flight crew training overview

Malaysia Airlines flight crews were required to complete recurrent training and checks. Normal procedures were assessed during aircraft flights (line checks) and simulator sessions (recurrent training and proficiency checks). Abnormal and emergency procedures such as unreliable airspeed and rejected take-off scenarios were included in simulator training and proficiency checks. Several recurrent elements would be trained or assessed in each session, with full coverage expected over a period of years (3 years in Australia).

In flight operations generally, assessable skills can be divided into two categories:

• technical skills: the manipulative and knowledge skills a pilot employs while operating an aircraft
• non-technical skills (NTS): the cognitive, social, and personal resource skills that complement technical skills and contribute to safe and efficient task performance (Flin and others 2008).

The operator graded performance in technical skills for line and proficiency checks using a 5‑point scale with the option for the trainer to provide additional information about each grading by marking one or more reason codes. The 7 reason codes were split into domains (knowledge, skills, and affective) and global markers (communications and communication environment, leadership, situation awareness, and decision-making).

NTS was evaluated and separately graded at each training session, proficiency check, and line check. The operator defined 10 assessable NTS elements (such as monitor/cross check, workload assignment and management, assertiveness and receptiveness), and 3 phases of flight to which some or all elements applied (before take-off, take-off to cruise, and descent to taxi). This meant the evaluator marked a total of 26 NTS elements during each flight crew assessment. NTS grades used a 3-point scale: satisfactory, satisfactory with briefing, and unsatisfactory. Behavioural markers (observable behaviours) for each skill were defined.

The ATSB compared the Malaysia Airlines approach to NTS evaluation with that of 4 other airlines operating in Australia and New Zealand. These operators all provided 4–5 NTS markers among the reason codes for grading technical skills, and only one graded NTS separately to technical skills (using a 5-point scale).

ATSB observation Unlike most other reviewed operators, Malaysia Airlines assessed NTS separately to technical skills. This probably provided significant advantages over the method of evaluating NTS only as markers for the performance of technical tasks. This was with a 3-point grading scale, whereas the other operator that evaluated NTS separately used a 5-point scale.

The flight crew’s most recent simulator proficiency checks and recurrent training were in January 2018 (captain) and March 2018 (FO). They were assessed as meeting the operator’s standard. The captain was debriefed on standard operating procedures, ECAM management, task management and problem solving. The FO was debriefed on monitoring/cross-checking and assertiveness.

Flight crew walk-around

The captain was last assessed in external visual inspection of the A330 in September 2017, receiving a grading of 3 (‘consistently meets and sometimes exceeds expectations’). The captain’s only other assessments on record for the flight crew walk-around since 2015 were during line checks on the 737, for which the captain received one grading of 4 (‘consistently exceeds expectations and sometimes only meets expectations’) and one grading of 5 (‘consistently exceeds expectations’ and ‘no area for improvement is readily identifiable’).

In interview, the captain said that the walk-around training took about an hour. The captain described the flight crew walk-around as ‘cursory’. The captain reported that they were not shown what a static or pitot probe cover looked like during walk-around and had not seen them before, other than on aircraft in storage from a distance.

Unreliable airspeed indication

Both flight crew demonstrated competency separately in an unreliable airspeed scenario during their last recurrent training in early 2018. Records showed that both received ‘satisfactory with briefing’ gradings on the element relevant to this scenario. The records did not state the phase of flight where this scenario was applied; the FO recalled theirs to be during the cruise phase and stated that they had not received training for unreliable airspeed during take-off, and until this occurrence did not know whether to reject the take-off. Both flight crew had used the BUSS during the scenario.

The captain’s training record had check marks in the ‘knowledge’, ‘affect’, and ‘situational awareness’ reason boxes and remarks indicating that a briefing was conducted on the application of the unreliable airspeed procedure and flight path management.

The FO’s training record had check marks in the ‘knowledge’ reason box and remarks indicating that there was a briefing on assertiveness and knowledge.

Rejected take-off

Pilots were required to complete a proficiency check in a simulator every 6 months, and it was mandatory for pilots to be assessed in rejected take-off procedures during that check. Anecdotally, rejected take-off scenarios are commonly associated with ECAM alerts and engine failures.

Both flight crew had been assessed in the conduct of a scenario described as ‘a rejected take-off at a reasonable speed before reaching V1’ during their last proficiency checks, each receiving a grading of 4.

The captain had been assessed on this element for the A330 on only one other occasion, receiving a grading of 3. The captain previously received gradings of 4 or 5 in proficiency checks for the 737.

The FO had been assessed on this element for the A330 on several occasions in the previous 3 years, receiving a grading of 4 each time.

Non-technical skills

In the 2 years prior to the occurrence, the captain was assessed for NTS 5 times and the FO was assessed 10 times. They each mostly received almost entirely ‘S’ gradings with the following relevant exceptions:

• on the captain’s most recent assessment, they received a ‘satisfactory with briefing’ grading for the ‘monitor/cross check’ element for the flight phase from take-off to cruise, and the phase from descent to taxi.
• the FO received ‘satisfactory with briefing’ gradings for the ‘assertiveness’ and ‘monitor/cross check’ elements in March 2018 and August 2017 respectively.

Study on flight crew take-off monitoring

In 2018/19, a study of flight crew monitoring in an Airbus A380 simulator was conducted using specialised eye-tracking equipment (Knabl and others 2018). It examined aspects of instrument monitoring for several captains and first officers as both PF and PM, including how this affected their decisions to continue or reject a take-off with a simulated engine failure at 10 kt before V₁ (a period of about 3 s) when presented with ‘ambiguous cues in a time-critical situation’. The cues were abnormal engine indications and a slight yaw movement to simulate an engine failure with limited cues:

A non-critical engine failure (ENG [engine] 2 flame-out) occurred at V₁-10kt which was set at 119kt. No ECAM [message] was triggered but the ENG failure could be identified by monitoring the engine display. Moreover, a slight yaw movement of the aircraft would have served as a cue which would have been easier to detect for the PF than the PM.

There were no master warning/caution alerts generated by the simulated engine failure. A total of 13 scenarios were observed, with a captain being assigned as PF on 6 occasions and PM on 7 occasions.

The participants generally reported having a ‘more active monitoring’ behaviour than usual, including more attention on the instruments, due to the nature of the test and their expectation that something would go wrong. It should also be noted that the flight crews were being examined on their ability to detect changes on a different display (the engine/warning display in the centre of the instrument panel) than the PFD.

The study found that:

• visual behaviour (scan patterns) ‘differed greatly’ among the pilots
• 6 crews rejected the take-off and 7 continued
• 6 of the 7 captains in the PM role continued the take-off, while 5 of the 6 captains in the PF role rejected the take-off
• for crew who continued the take-off, the PM spent ‘considerably’ more time looking outside (particularly those qualified as captains), and less time looking at the PFD, to those who rejected the take-off
• the PM of crews who rejected the take-off generally spent more time looking outside than PMs of crews who continued, and less time looking at the PFD
• overall, above 100 kt, the PF primarily looked at out of the windscreen (82% of the time) followed by the PFD (9%)
• above 100 kt, the PM primarily looked at the PFD (40% of the time) and out of the windscreen (35%)
• two PMs (who were also both captains) were looking at the engine instruments at the time of the simulated failure but did not respond (‘looking without seeing’).

Aeronautical charts

En route supplement Australia

General information

Australian regulations required an aerodrome operator to ensure sufficient information about the aerodrome was published in the En Route Supplement Australia (ERSA).^[43] These include runways specifications and local precautions. The ERSA contains information used for planning a flight and for the pilot in flight.

The manual of standards for Civil Aviation Safety Regulation (CASR) Part 139 – Aerodromes provided further details of the information to be included in the ERSA. This included the width and lighting information for each runway and ‘important cautionary or administrative information relating to the use of the aerodrome’. For example, the ‘additional information’ section of the ERSA for the aerodrome was also required to include ‘significant local data’. For many Australian aerodromes, this section contained hazards such as birds or other animals, weather balloon launches, or the likelihood of turbulence on approach to a runway.

Brisbane airport En Route Supplement

From November 2015 onwards, the ERSA information for Brisbane Airport included a note regarding significant mud wasp activity, and the following other safety-relevant information:

2.   Significant bird hazard exists.

a.   Nankeen Kestrel (birds of prey), peak activity on airfield expected March-July.

b.   Australian White Ibis flocking on airfield HJ [sunrise to sunset], increased numbers expected February-June.

c.   Straw Necked Ibis present on airfield HJ, increased numbers expected July-October.

d.   Flying Fox HN [sunset to sunrise] only.

e.   Cattle Egret present on airfield HJ, increased numbers expected NOV-MAR.

f.    Increased pelican and cormorant in VCY of AD [vicinity of aerodrome].

3.   Significant mud wasp ACT WI AD VCY [activity within aerodrome vicinity] affecting pitot tubes. Pitot tube covers recommended.

The ERSA entry for Brisbane Airport also had information about the potential for false course capture from a navigation aid.

Lido route manual

Airport operational information

The Lido route manual, published by Lufthansa Systems, was used by Malaysia Airlines to provide charts and aerodrome information to its flight crew. The suite of documents included the airport operational information (AOI).

The Lido AOIs contain information about a particular airport. The AOIs are arranged into general, arrival, and departure chapters, with a subsection for ‘warnings’ in the general chapter. The Lido AOI warning information for Brisbane Airport included the same information as in the ERSA about the false course capture (but presented differently), and the following:

Birds in vicinity of AD [aerodrome], increased number expected NOV-MAR.

The ATSB compared the warning information in the 2020 Lido AOIs for Melbourne, Darwin, Perth, and Sydney with the relevant ERSA information. Melbourne and Perth closely aligned with the ERSA data. The Darwin AOI did not include information regarding unlit military helicopter operations in the area and the Sydney AOI did not include information about the hazard posed by a searchlight in the area.

Lido chart development process

The ATSB sought information from Lido about the content development, and revision process of its AOI. Lido stated that as the Lido route manual is designed to carry relevant information for pilots only, not all AIP content is transferred to the AOI. Lido’s guidance manual for such decisions stated that charts should include:

Caution notes for dangers such as bird hazards or strolling animals on RWY [runway] shall be published.

With regard to the expertise of the people involved, Lido advised the ATSB:

Generally, if a person applies to work for our Route Manual production, he or she shall have a strong aviation background (pilot, air traffic controller, dispatcher) or have long-term experience in the area of professional aviation. Then, after having applied successfully, the person undergoes training according to a team dedicated training concept. Amongst many other topics, the content of the QuickRef [Lido’s guidance manual] is part of this.

The relevant process flowchart provided showed a quality check at the end of production.

Other sources of aerodrome information

The Australia Airport Directory, a similar publication published by Jeppesen used by some other airlines operating in Australia, had the following in the Brisbane airport information section:

Significant mud wasp activity within apt [airport] vicinity affecting pilot tubes. Pitot tube covers recommended.

Pitot probe covers

Overview

Pitot probes can become blocked by a range of contaminants including dust, sand, water (such as rainwater, ice accumulation, condensation, or water used during washing), by the remains of insects or other animals after in-flight impact, or by the nesting activity of insects such as mud wasps.

Pitot probe covers provide protection from foreign object obstruction when the aircraft is on the ground. The need for pitot probe covers is dependent on a number of factors, such as the duration the aircraft is on the ground, and local factors such as wildlife and weather. There may be a formal requirement by operators to fit pitot probe covers in these circumstances. Because pitot probes are heated in-flight, maintainers need to wait 15-30 minutes for them to cool after landing before fitting covers (Airbus 2016).

Pitot probe covers typically incorporate a ‘remove before flight’ warning streamer (also known as a flag or ribbon) intended to alert relevant personnel of its presence. Streamers come in various lengths^[44] that are determined by a design specification, or locally fabricated as required. Visibility of the streamer may be improved by fitting an extended streamer or incorporating a lanyard between the cover and its streamer.

Pitot probe covers are regarded as ground service equipment (GSE). Other examples of GSE include towbars, landing gear lock pins and aircraft jacks. While there are some exceptions, GSE is not fitted to an aircraft for flight. GSE can be supplied by an aircraft manufacturer, be generic across multiple aircraft types, or be manufactured by a third party to be comparable in function, however sometimes it may be different in design. GSE manufactured by a third party or locally can be approved internally by operators as there are no regulatory requirements for GSE.^[45]

Pitot probe covers are typically supplied by the aircraft manufacturer with a new aircraft. Over time as they become worn, operators may choose to replace them with a cover manufactured by a third party. Airbus advised the ATSB:

Flight kit and its content (including Pitot covers) are referenced in the IPC [illustrated parts catalogue] (IPC 25-73-04-01). As such, it is part of aircraft configuration. Airbus recommends managing the flight kit and its content like any IPC item. If an operator uses alternative covers not included in the IPC, it is under its own responsibility. This is what is reminded in ISI [in-service information] 34.11.00026, section 5.6.4.

Malaysia Airlines pitot probe covers

At some time in 2018 prior to commencing flights to Brisbane, Malaysia Airlines supplied Aircraft Maintenance Services Australia (AMSA) with a set of Airbus-approved pitot probe covers (Figure 33). These were not fitted to the occurrence aircraft.

Figure 33: Airbus-approved pitot probe covers supplied by Malaysia Airlines to AMSASource: AMSA

Aircraft Maintenance Services Australia pitot probe covers

The pitot probe covers fitted to the occurrence aircraft were the property of AMSA, and manufactured by a company specialising in ground support equipment. AMSA fitted these covers to any operators’ A330 aircraft as part of AMSA’s compliment of equipment used during aircraft receipt and dispatch.

The pitot probe covers fitted to 9M-MTK were manufactured by Sesame Technologies with part number KPC4-480-321. They consisted of a triple-layer woven Kevlar sheath about 12 cm long, with a non-reflective 30 cm ‘remove before flight’ warning streamer attached by a short lanyard (Figure 34). They could be installed by hand using an access stand, or alternatively, a pair of loops at the opening of the cover enabled them to be fitted from the ground using a special pole. A single loop on the opposite end enabled them to be removed with the same pole. These poles were not used by AMSA.

Figure 34: Pitot probe covers removed from 9M-MTK after the occurrence flight, and exemplar covers of the same typeSource: ATSB

Airbus pitot probe covers

The pitot probe covers approved for use by Airbus are a synthetic fabric sheath 22 cm long (Figure 35 and Figure 36). The sheath is held in place on the pitot probe by spring clips. A 30 cm ‘remove before flight’ warning streamer is attached to the sheath by a 21 cm lanyard making the overall length of the streamer/lanyard assembly about 51 cm. This pitot probe cover is listed in the A330 illustrated parts catalogue as part number 98A10001005000, with an alternate part number of A1000100500000. There are no other alternatives approved by Airbus, which stated that ‘using the approved pitot probe covers is important as the covers for other manufacturers’ aircraft may not be the correct fit or offer complete protection for the pitot probes of Airbus aircraft’ (Airbus 2016).

Figure 35: Airbus-approved pitot probe cover with lanyard and streamerSource: ATSB

Figure 36: Airbus-approved pitot probe covers fitted to the left side pitot probes of an A330

Source: Malaysia Airlines

Other pitot probe covers and flight deck warning placard

Some operators use extended streamers for improved visibility during turnaround operations in Brisbane (Figure 37) or flight deck placards to alert flight crews of the presence of covers (Figure 38). A manufacturer of pitot probe covers is developing a system to alert flight crews of the presence of covers with a visual indicator that attaches to an aircraft’s window (Figure 39).

Figure 37: Exemplar pitot probe covers with extended streamers for improved visibilitySource: ATSB

Figure 38: Exemplar flight deck warning placard placed on thrust levers
Source: Supplied

Figure 39: Visual indicator of probe cover fitment
Source: Sesame Technologies

Activities and duties in preparation for flight

Use of pitot probe covers

Brisbane Airport is the only port used by Malaysia Airlines with a known mud wasp problem, and one of a very small number worldwide where the use of pitot probe covers during short turnarounds is recommended to prevent insect infestation.

Malaysia Airlines sent one set of pitot probe covers to AMSA but had not formalised their use. The provisional contract with AMSA included a provision for AMSA to provide various covers, including for pitot probes, with no detail on requirements for their fitment.^[46]

AMSA was contractually required to use pitot probe covers for some other airlines in Brisbane. There was no written guidance on this subject issued by AMSA to its employees. AMSA managers and engineers reported that they preferred to use pitot probe covers for airlines that did not specifically request it, including Malaysia Airlines, because of the risk of mud wasp infestation.

The Malaysia Airlines technical handling manual did not require a technical log entry to record the fitment of pitot probe covers, but engineers were able to do so. When interviewed, AMSA managers stated that they expected a maintenance log entry would be made by an appropriately approved person for the fitment of pitot probe covers. The technical log is checked by flight crew prior to departure, and any open entry such as the fitment of pitot probe covers would require rectification before dispatch.

Of the 21 available technical logs of Malaysia Airlines A330 turnarounds in Brisbane between 9 June and 18 July 2018, 4 contained entries for the fitment of pitot probe covers. Covers might have been used on other flights but were not recorded.

Records showed that the AMSA support engineer had handled 4 other Malaysia Airlines aircraft in this period, as well as the occurrence aircraft. One of these was the 12 July turnaround for which a CCTV recording was available, where pitot probe covers were not used. Technical logs for the other 3 flights recorded the use of pitot probe covers once. This was the only turnaround for Malaysia Airlines that the support engineer recalled, reporting that they were instructed to fit (and later remove) the covers by the Malaysia Airlines engineer.

The Malaysia Airlines’ investigation report indicated that engineers had sometimes requested permission from the Malaysia Airlines engineers to fit covers or told the engineers that covers had been fitted. When asked, the Malaysia Airlines engineers typically instructed AMSA engineers not to install pitot probe covers when they were asked, due to the short turnaround time and because it was not a standard procedure for Malaysia Airlines. After the occurrence, the licensed aircraft engineer (LAE) heard from another engineer that, on at least one previous occasion, another of the Malaysia Airlines’ engineers had noticed that pitot probe covers were fitted and asked for them to be removed.

Flight crew

Flight crew walk-around procedure

The Malaysia Airlines operations manual stated:

Prior to each flight, maintenance must verify the airplane condition is acceptable for flight. The flight crew will also conduct a cursory walk around to verify the aircraft exterior is in a satisfactory condition. During the exterior aircraft inspection (walk-around), flight crew shall focus on safety critical areas of the aircraft and ensure that:

i.    The pitot and static ports are not damaged or obstructed

ii.    Flight controls are not locked or disabled (as applicable, depending on aircraft type);

iii.   Frost, snow or ice is not present on critical surfaces; and

iv.    Aircraft structure or structural components are not damaged.

The FCTM stated:

The objectives of the exterior inspection^[47] are:

-    To obtain a global assessment of the aircraft status. […]

-    To ensure that main control surfaces are in adequate position relative to surface control levers.

-    To check that there are no leaks. For example, engine drain mast, hydraulic lines.

-    To check the status of the essential visible sensors, i.e. AOA, pitot and static probes.

-    To observe any possible abnormalities on the landing gear status.

The FCOM stated:

The exterior walkaround ensures that the overall condition of the aircraft and its visible components and equipment are safe for the flight.

Complete inspection is normally performed by maintenance personnel or, in the absence of maintenance personnel, by a flight crewmember before each originating flight.

An accompanying illustration showed a path that the flight crew can take when conducting the walk-around (Figure 40). Numbers represent a pause point to inspect a particular section of the aircraft, each associated with a section of a list of 42 check items. All the pause points except numbers 5, 13 and 16 had check items, including number 2 for a condition check of the pitot probes (Figure 41). The check is done by memory.

The ATSB estimated that to walk directly through all the pause points in the recommended order would require a path of about 250 m, which would take about 3 minutes at average walking speed (1.4 m/s) if done without pausing.

Figure 40: Flight crew operating procedure illustration of the flight crew walk-around
Source: Malaysia Airlines

Figure 41: Extract from the flight crew walk-around procedureSource: Airbus

Airbus provided operators with computer software that showed a narrated animation of a full flight crew walk-around, and enabled users to self-assess their recall of check items (Figure 42).

Figure 42: Airbus Virtual WalkAround software

Source: Airbus

Other guidance

In July 2016, Airbus published an article in its Safety First magazine titled Pitot Probe Performance on the Ground, which provided information about pitot probes and potential blockages, advising:

Always look at the Pitot probes carefully during the pre-flight exterior inspection and check that all of the covers are removed before flight. Ensure there is no damage to the Pitot probe and that the general condition is good. This will give confidence that the correct airspeed readouts will be available on all of the instruments in all flight phases.

Flight crew pre-flight walk-around for the occurrence flight

Figure 43 compares the flight crew walk-around check procedure with the path taken by the captain as recorded on the single-view video. While walking towards the aircraft, the captain shone a torch on the lower left forward fuselage area for a total of about 4 seconds, including towards the left upper pitot probe for about 1 second when about 7 m away. The captain did not shine the torch on the area of the left lower pitot probe, or on the right side of the nose where the third probe was located. After pausing to inspect the nose gear, the captain walked directly from the rear of the nose gear towards the front of the right engine, out of view.

About 30 seconds later, the captain’s torchlight could be seen for a few seconds as the captain moved from right to left under the fuselage near the main landing gear.

The torchlight then reappeared on the ground outboard of the left engine, before apparently being shone on the side of the left engine cowl (out of sight of the camera) for about 2 seconds. The captain then walked directly out of view to the gate entry point. The walk-around took about 1 minute 32 seconds to complete and the captain was not observed looking in detail at any part of the aircraft apart from the nose gear.

Figure 43: CCTV still image of 9M-MTK overlaid with the required flight crew walk-around path and the captain’s visible walk-around path.Source: Brisbane Airport Corporation, modified by the ATSB

Engineering

Aircraft certification

At the time of the occurrence the technical handling (engineering) functions in Brisbane were the responsibility of the Malaysia Airlines licensed aircraft engineer (LAE). Technical handling tasks in Brisbane included:

• engineering inspections (a transit check)
• refuelling
• general maintenance
• rectifying defects
• certification of all engineering work.

The LAE’s assignment was to travel on a flight from Kuala Lumpur to Brisbane and conduct technical handling of that aircraft before it returned. After an overnight rest in Brisbane, the LAE would return to the airport in the evening and conduct technical handling of the next aircraft, and then board it for the return flight. In this way, one LAE would be assigned technical handling of two successive turnarounds in Brisbane across three days (with one rest day between), and then another LAE would be assigned the next two successive aircraft, and so on.

The LAE reported that they were informed by Malaysia Airlines that their task was to conduct transit and rectification duties in Brisbane, and would be receiving engineering support assistance. However, Malaysia Airlines did not provide details about who would be doing dispatch duties, or anything related to the requirements for the fitment of pitot probe covers in Brisbane.

The LAE involved with the occurrence aircraft had arrived on another aircraft on 16 July and performed defect rectification, inspections, and certification of that aircraft, aided by a different AMSA engineer. Neither engineer stayed with that aircraft for dispatch.

Engineering support

Throughout June and July 2018, AMSA provided security escort and technical assistance to Malaysia Airlines travelling engineers and did not provide aircraft certification or dispatch coordination. The organisations worked under written ad-hoc indemnity release agreements, signed on site by line personnel from both organisations at the time of each arriving flight. These agreements did not contain information about services expected or provided.

AMSA managers and engineers advised the ATSB that their understanding of AMSA tasking was to facilitate LAE access to the apron and provide general engineering assistance as instructed by the LAE on the day.

There was no agreement or procedure in place for the fitment of pitot probe covers and no written requirement for the support engineer to be present at the aircraft for arrival or at the time of dispatch.

The support engineer reported assuming that the ground handlers, being responsible for dispatch, would perform a final walk-around to check doors, gear pins, pitot probes, and the like. As a result, the support engineer did not think it was necessary to be present for dispatch.

Tool control

AMSA had documented tool control policies and procedures which required AMEs and licensed aircraft maintenance engineers (LAMEs) to record the removal of company tooling from its storage location. LAMEs were required to account for all tooling prior to certifying an aircraft for release to service. At the end of a shift, AMEs and LAMEs were required to account for personal tooling, and regional managers were required to review the movement of company tooling. Tooling that for operational reasons remained away from its storage location at the end of a shift, was to be recorded in the shift handover diary by the regional manager.

AMSA supplied basic tooling specific to aircraft turnarounds in a transit toolbox. This included a headset to communicate with the flight crew, marshalling wands, and a steering bypass pin^[48] specific to an aircraft type. Additional items such as pitot probe covers could be added to the transit toolbox as required. The relevant procedure required its removal from its storage location be recorded, and for its return to be recorded along with a condition check of the items it contained.

According to interviewed engineers, at the time of the occurrence, transit toolboxes (containing pitot probe covers) were being removed from their storage location without the action being recorded.

Transit check requirements

Malaysia Airlines technical handling manual required that the aircraft undergo a transit check (a type of engineering inspection) while in Brisbane. This required certification in the technical log when completed. The LAE indicated that there were paper copies of the transit check sheets available in all company aircraft as a reference. The LAE stated that they did not use a paper copy as they were very familiar with the check requirements.

The requirement to check various items on the aircraft exterior was not described as a ‘walk‑around’, but it was likely to be done in that way for the sake of convenience (for example, it would make sense to check the nose landing gear while checking other items near it, rather than returning later). For simplicity, this report refers to this element as an ‘engineering maintenance walk-around inspection’.

The transit check procedure began with tasks mainly related to verifying the aircraft’s airworthiness, and later tasks were primarily concerned with verifying the aircraft’s general condition (that no damage had been incurred during the turnaround) and readiness for flight. It had the following general sequential structure:

• initial parking
• check technical log for reported defects
• check engine oil, hydraulic oil, auxiliary power unit oil, and conduct other similar tasks (from cockpit indications)
• check fuselage, empennage, engines, wings, landing gear, and doors for damage, leaks, missing fasteners, and the like
• check pitot probes, angle of attack sensors, static ports and their surrounding areas for ‘obvious damage’
• check interior and conduct interior maintenance tasks
• refuel the aircraft.

After refuelling, the following tasks were required:

• ‘remove all landing gear lockpins, engine blanks, airframe blanks and pitot covers if installed’
• check air intakes for foreign objects or obstruction
• check all doors and panels are closed and secured
• ‘perform a walkaround inspection of the aircraft exterior. Identify and report external damage found’
• ‘verify that no tools are being left in the aircraft and any tools loaned out from the Tool Crib are returned prior to aircraft departure’
• check all required documents are on board
• certify (sign) that a transit check has been performed
• depart the aircraft.

Review of the CCTV footage indicated that the LAE conducted a transit check walk-around which appeared to follow the correct path of the transit check procedure up to the point of refuelling the aircraft. This walk-around of the aircraft took the LAE about 12 minutes.

Following the aircraft refuelling, the transit check takes on a preparation for flight aspect to ensure that the aircraft is correctly configured for flight with panels and doors closed, tools, blanks, and covers removed. The portion of the transit check following the refuelling of the aircraft was not undertaken.

Ground handling

Ground handling functions

Menzies provided Malaysia Airlines with ground services including ramp support, equipment, towing/pushback of aircraft, and dispatch coordination from the commencement of flights on 6 June 2018. Menzies ground handlers in Brisbane routinely performed dispatch coordination for 3 operators, including Malaysia Airlines. Menzies did not have the capability to provide engineering services in Brisbane.

Menzies reported that dispatch coordination was rarely conducted by Menzies employees; the operators usually engaged engineers from other organisations for this function.

Ground handling procedures were provided in the Menzies aviation ground operations manual. The applicable Menzies procedures required ground handling personnel to conduct:

• an arrival walk-around, immediately after arrival
• a dispatch walk-around, immediately prior to dispatch.

Details on these procedures are provided in the following sections.

At the time of the occurrence, a ground handling agreement between Malaysia Airlines and Menzies had not been signed (see Operator planning for resumption of Brisbane operations) and Menzies was working under its own standard procedures. There were no significant differences between the Menzies and Malaysia Airlines procedures. The agreement signed after the occurrence equivalently required a ‘visual external safety/ground damage inspection’ to be performed ‘immediately upon arrival’ and ‘immediately prior departure’.

Ground handling tasks

The ground handling roles included:

• A leading hand (or flight supervisor), who was responsible for the management of the ground handling requirements of the aircraft turn around. In some instances, this responsibility could be split between teams with one responsible for the arrival and one responsible for the dispatch. In the case of the incident aircraft, the same leading hand was responsible for the arrival and the dispatch.
• A dispatch coordinator (or headset operator), who was responsible for aircraft dispatch communications from the ground to the flight deck during pushback. The role also included a requirement to conduct a post-arrival walk-around and dispatch walk-around inspections of the aircraft. This role within Menzies was usually conducted by the leading hand but in this case was performed by another ground crewmember who had finished assigned duties with another aircraft.

The leading hand and dispatch coordinator both reported being aware of the need to conduct a dispatch walk-around.

Prior to aircraft arrival, the leading hand was required to conduct a briefing and assign responsibilities for the turnaround, including ensuring that required staff are present.

ATSB observation The Menzies leading hand was required to ensure that appropriately qualified staff were available for the turnaround. The leading hand later reported that they thought they were not qualified to coordinate dispatch for Malaysia Airlines aircraft, but if so, this means the leading hand did not ensure that a qualified person would be available. This indirectly led to a last-minute handover of dispatch duties, during which a breakdown in communication occurred meaning that the incoming dispatch coordinator remained unaware that a walk-around had not been conducted.

Procedure for arrival walk-around

The manual stated that:

Upon arrival…the responsible person (Team Leader or equivalent) is required to perform an aircraft inspection for any aircraft damage. This shall be conducted prior to any equipment, including all GSE and Passenger Boarding Bridge (Jetty), positioning to the aircraft. Minimal arrival aircraft inspection shall consist of the following:

-    All cargo doors

-    All access panels and servicing access points

-    Aircraft fuselage

-    Aircraft engine cowlings

-    Aircraft passenger doors.

Procedure for dispatch walk-around

The dispatch walk-around was not an engineering inspection; it was intended to verify the aircraft’s general condition and readiness for flight. The manual stated:

Headset operatives [dispatch coordinator] must carry out a pre-flight check that:

-    All doors and hatches are secured and handles are flush with the aircraft fuselage

-    Nosewheel steering by-pass pin inserted if applicable

-    No visible damage of the aircraft caused by equipment during ground operations

-    No loading or other debris is left in the area of engine intakes

-    All ground locks, engine blanks, pitot head and static vent covers removed (if appropriate)

-    Static vents and pitot tubes are clear of debris or de-icing fluid etc. (as appropriate).

The manual further stated:

A pre-departure walk-around MUST be made before the aircraft is allowed to depart.

Staff must be vigilant and check for any damage or loose hatches (even if a hatch has not been opened at your station).

Any hold or passenger door that is opened after the walk-around (or not closed at that time) the closure must be personally supervised by the headset operative.

Note: The walk-round is primarily a visual check, which is performed at normal walking pace. Hold and access doors and hatches are ‘pushed’ to ensure correct closure. Other hatches can be confirmed as secure if all latches are closed and laying flush in recess.

Note: The walk-round should be carried out prior to engine start-up. To facilitate an on-time departure the main check can be carried out prior to completion of loading, or before doors are closed. Any holds or doors open at this time can be rechecked when closure takes place, without the need to re-check other items.

The relevant Menzies training notes listed 12 key check items, including ‘pitot tubes’, and contained the following information about dispatch:

NOTE: although a licenced engineer or member of the flight crew will have carried out and signed for a Pre-Departure inspection (PDI) of the aircraft, it is vital that the headset operator visually completes a thorough PDI check of the aircraft and immediate areas. … Confirm all doors, panels, hatches secure…

After the tow bar is connected to the push back tractor the headset operator should allow plenty of time to perform the walk round inspection of the aircraft. When all loading and service functions have been completed, the headset operator is required to walk-around again and ensure that all hatches and latches are secure.

After the air bridge or steps have been removed the cabin door/s must be checked to ensure they are closed and secured correctly. Particular attention to the likelihood of straps etc. protruding of door handle/s not stowed in the recess correctly.

The trainer’s notes on operating headsets stated:

The headset operator is required to follow the illustrated walk round sequence when inspecting the aircraft prior to departure. The walk round shall start on the left side of the aircraft nose leg and proceed in a clockwise direction.

A diagram was provided to show the conduct of the dispatch walk-around, including symbols drawing attention to the pitot probes (Figure 44).

Figure 44: Menzies diagram of dispatch walk-around sequence for ground handlers

Source: Menzies

Training and qualifications for dispatch coordination

Menzies stated that staff were chosen for training in dispatch duties only after they had at least 2 years’ general ground handling experience. They were required to conduct a classroom theoretical training session, followed by 15 supervised dispatches on various aircraft types. They were then assessed over 2 flights and provided they were found to be competent were considered qualified to conduct dispatches. Staff also undertook recurrency training every 3 years.

The leading hand believed that dispatch coordination required specialist training on each aircraft type. The leading hand stated that they personally had the appropriate qualification to perform dispatch coordination but believed that none of the team assigned to 9M-MTK had the requisite training to do this for a Malaysia A330 specifically.

On whether airline and/or aircraft specific training was required for the headset coordinator role, Menzies stated that:

No specific training was required, as no differences had been identified either by [Malaysia Airlines] or Menzies.

Menzies stated that both the leading hand and ground handler who dispatched the aircraft were qualified to conduct the dispatch.

The leading hand’s training records indicated that they had received training for dispatch duties on 16 August 2017. There was no record of training for specific aircraft types or operators. The training material in place at the time of the occurrence indicated that the training was generic in nature with a reference to numerous aircraft types including the Airbus A330.

Operator training of Menzies ground handling staff

On 28–29 May 2018 Malaysia Airlines provided training to 3 Menzies instructors to enable them to deliver training to other Menzies staff on the operator’s requirements and any differences with Menzies standard operating procedures. Menzies and Malaysia Airlines compared the required processes for receipt and dispatch, and no substantive differences were identified.

The operator provided further training to 3 Menzies instructors on 6 June 2018 (the day that operations commenced in Brisbane). This was to enable them to deliver training on receipt and dispatch, including dispatch coordination, to other Menzies staff.

Menzies reported that operator-specific training was gradually rolled out over the course of 2–3 weeks in June. However, no records of training delivery of this type were available and neither the leading hand nor dispatch coordinator reported having received training specific to Malaysia Airlines.

Dispatch coordinator communications and phraseology

Ground to flight deck communications has common phraseology for each phase of the aircraft turn around, for arrival, push back and tug disconnection.

At the beginning of the push back phase, the flight crew will prompt the dispatch coordinator that they are ready by stating ‘ready for departure checks please’. Provided the ground handlers are ready, the dispatch coordinator will respond by stating ‘departure checks complete, all doors and hatches closed and secure’.

ATSB observation The dispatch coordinator did not use the standard phrase ‘all doors and hatches closed and secure’, which might have provided a stronger prompt for the dispatch coordinator to perform the required walk-around or to check whether the leading hand had done so.

Menzies quality assurance

Menzies had eight external audits by airlines in 2018 with no significant adverse findings. Menzies, as a major international ground handling group, also conducted audits on various sections of its operations from time to time, with the last Brisbane group audit before the occurrence being conducted in 2016 with no significant adverse findings. One such area audited included:

If an airline is providing the same training instead of the Menzies training, a GAP analysis^[49] must be done to identify the difference between the [Menzies] & airline training and [Menzies] staff trained on the differences as appropriate.

Menzies Brisbane also conducted continual internal incremental line audits (observation audits) on various sections of the operation. In the area of ground handling arrivals and dispatch there were specific audit ‘questions’ such as:

-    Does the Headset Operative carry out a pre-departure check (walk around) that ensures there is no visible damage to the aircraft caused by equipment during ground operations and all cargo/access doors are closed and secured?

-    Before the aircraft commences taxiing under its own power, all equipment and personnel must be moved clear of the aircraft. Does the headset operative ensures that no equipment remains within the aircraft footprint?

-    Does the Headset Operative carry out a pre-departure inspection (walk around) to ensure all ground locks, engine blanks, pitot head and static vent covers have been removed and are clear of debris, de-icing fluid or other substances?

-    Does the Headset Operative carry out a pre-departure inspection (walk around) to ensure Power cables and the boarding bridge is fully retracted and not in the path of the aircraft?

Does the Headset Operative carry out a pre-departure inspection (walk around) to ensure there are no visible leaks of lubricants or hydraulics from the undercarriage?

-    Does the pre-departure inspection (walk around) include check that engine cowling latches are engaged?

-    Is aircraft clear of all obstacles along the intended movement path?

-    Is departure damage check performed?

-    Is predeparture walkaround inspection performed, ensuring landing gear pins are removed?

The audit logs for Brisbane operations over two separate 9-month periods in 2018 and 2019 indicated:^[50]

• Overall, there were 3,181 audits (averaging 6 per day), answering 53,357 audit questions. There were 145 recorded non-compliances in total, which is a compliance rate of 99.7%.
• There were 544 turnarounds where the dispatch coordination function was assessed, asking 872 questions with a compliance rate of 100%. Of these, 414 audits asked questions relating to specific elements of the dispatch walk-around^[51] (a total of 595 questions). The question ‘Is a complete walk-around inspection done to check that cargo/access doors are closed and secured, that there is no visible damage to the aircraft and that the gate area is clear of equipment? (incl wing tips)’ was asked 104 times.
• There were 122 turnarounds for which the arrival walk-around was assessed, with one non-compliance, equivalent to a compliance rate of 99.2%. The non-compliance was for a Malaysia Airlines flight in 2019.
• Malaysia Airlines turnarounds were audited for arrival and/or departure walk-arounds 24 times, including 3 times in Jun–July 2018, with records of the latter indicating:
  • 2 arrival walkarounds were assessed and completed
  • 1 departure walkaround was assessed with 5 distinct questions, of which 1 was answered ‘yes’ and the others ‘n/a’
• Menzies staff coordinated dispatch for at least 11 different airlines in June–July 2018.

Review of other turnarounds

Video recordings of Malaysia Airlines turnarounds

CCTV recordings showing four Malaysia Airlines A330 turnarounds in Brisbane in July 2018, including the one on the night of the occurrence, were assessed by the ATSB. A summary of the assessment is provided in Table 2, with a focus on the use of pitot probe covers and the required turnaround checks. Different personnel appeared to be involved in all turnarounds, except that only two LAEs were involved, each handling two successive flights. The walk-arounds were not assessed in detail for completeness; a walk-around was assessed as ‘partial’ if there were areas of the aircraft and/or obvious check items that were missed. The time taken for the inspections was also noted as a general reflection of the quality and detail.

Table 2: Malaysia Airlines turnarounds in Brisbane during July 2018

		Turnaround date (duration)
	12/07/2018 (2:45)	14/07/2018 (2:45)	16/07/2018 (about 6:00[1])	Occurrence flight 18/07/2018 (2:45)
Pitot probe cover use (AMSA)	No	No	No	Yes
Arrival walk-around (Menzies)	Yes, with torch.	Partial, without torch.	Yes, with torch.	No
Engineering inspections (Malaysia Airlines)[2]	Maintenance walk-around inspection (other than pre-departure)	Partial, with torch. (00:02:15)	Partial, without torch. (00:01:47)	Yes, with torch. (00:08:32)	Yes, with torch (00:11:45)
Pre-departure walk-around inspection	No	No	No	No
Flight crew pre-flight walk-around (Malaysia Airlines)	Yes, with torch (00:04:26)	Yes, with torch. (00:04:56)	No	Partial[3] with torch (00:01:32)
Dispatch walk-around (Menzies)	Partial, with torch. (about 00:03:30)	Yes, with torch. (00:02:45)	Yes, (twice) with torch. 00:03:21 the first time, 00:03:55 the second time.	No

[1]  This turnaround was extended due to an aircraft repair being carried out.

[2]  The Malaysia Airlines engineers were responsible for certification for these checks but could delegate parts of the check (other than certification) to an AMSA engineer. One engineer handled the 12 and 14 July turnarounds, and another handled the 16 and 18 July turnarounds.

[3]  See Flight crew pre-flight walk-around for the occurrence flight.

Video recordings of other operator turnarounds

The ATSB reviewed video of 3 other long-haul passenger aircraft turnarounds on 18 July 2018 involving other operators and engineering organisations. All the dispatch walk-arounds appeared to be conducted by engineers.

All the arrival, engineering, flight crew, and dispatch walk-arounds appeared to be completed in full for each turnaround, except for one dispatch walk-around which was done partially. The range of durations of fully completed walkarounds were 7–8 minutes (engineering), 3.5–8 minutes (flight crew), and 3–7 minutes (dispatch).

Pitot probe covers were only used on the longest of these 3 turnarounds, with the covers being fitted for a total of about 9.5 hours of the 12-hour turnaround. The other turnarounds were 69- and 80-minutes’ duration.

ATSB observation Although the number of reviewed Malaysia Airlines turnarounds was limited, video evidence indicated that the required walk-around inspections and checks by ground handlers, engineers and flight crew were not always conducted, and in some cases were not conducted to the required standard. The 3 reviewed turnarounds involving other operators and engineers had more consistent and thorough engineering and flight crew walk-arounds. The absence of any final engineering walk-around inspection over the course of the four reviewed Malaysia Airlines turnarounds, including by the occurrence engineer whose other inspections were satisfactory, is likely to indicate systemic problems with Malaysia Airlines engineers. Further, the extremely high level of recorded compliance during Menzies audits, including the assessed 100% compliance for dispatch walk-arounds, was very unlikely to be an accurate reflection of actual compliance based on video evidence showing that the required arrival and dispatch walk-arounds were only completed in full on 1 out of 4 flights.

Operator planning for resumption of Brisbane operations

General information

Malaysia Airlines operated flights into Brisbane for many years prior to 2015.^[52] During this period, the operator did not routinely use pitot probe covers in Brisbane. Operations to Brisbane were suspended in August 2015 for commercial reasons. This was about 3 months after the first issue of the CASA AWB on wasp nest infestation was first introduced. The operator did not use pitot probe covers in the intervening period.

The operator later prepared to resume Brisbane operations, planning 4 round trips per week between Kuala Lumpur and Brisbane from 6 June 2018. The project for the resumption of services was led by the airport services department (AS) under the regional AS head (one level below the AS department head), with involvement with the engineering and maintenance (E&M) and flight operations departments for matters relevant to them (such as planning for the use of engineers and pilots, respectively).

The ground handling and engineering arrangements in place at the time of the incident (18 July 2018) were an interim measure put in place until approval from the Malaysian Civil Aviation Authority was received for AMSA to certify for Malaysia Airlines aircraft in Brisbane. After that, the operator planned to permanently engage AMSA for all technical handling (engineering) functions plus dispatch coordination; Menzies would then cease dispatch coordination but continue with its other ground handling functions and there would no longer be an operational need for Malaysia Airlines to supply its own engineers for the Brisbane turnarounds.

The agreements were made in the form of a standard ground handling agreement (SGHA) between Malaysia Airlines and each of the two ground services providers, and a service level agreement (SLA) between Malaysia Airlines and Menzies (Table 3). When the operator resumed flights between Kuala Lumpur and Brisbane on 6 June 2018, no formalised service agreements had been finalised with either Menzies or AMSA.

Table 3: Agreements between the operator and service providers

Agreement	Operator signature date	Completed date	Effective at start of operations	Finalised before occurrence
Standard ground handling agreement (SGHA) between Malaysia Airlines and AMSA	10 July 2018	18 July 2018	No	Yes[1]
Service level agreement (SLA) between Malaysia Airlines and Menzies	25 May 2018	10 August 2018	No	No
Standard ground handling agreement (SGHA) between Malaysia Airlines and Menzies	6 June 2018	23 July 2018	No	No

[1]  Both organisations reported that this agreement was signed prior to the occurrence. The original physical copy was sent by Malaysia Airlines after signing, arriving on 16 July 2018. In practice, line personnel were unlikely to be aware of its completion at the time of the occurrence.

An SGHA is an agreement used commonly by aviation organisations worldwide. The International Air Transport Association (IATA) SGHA contains a pro-forma list of potential services for each arriving and departing aircraft, and the two organisations adapt the list to form their agreement by including only those services they agree upon. The SGHAs between Malaysia Airlines and the two service providers had a simple list of services (without detailing how they should be provided) as well as financial and legal obligations. The SGHA is primarily a commercial agreement, and not operational. That is, it typically contains information about the type of services and equipment provided, but details about how they are to be applied would only be in a very general sense (‘as required’) or absent entirely.

An SLA is a commitment between a service provider and client which, among other things, lists and/or details services that are to be provided. In the case of the SLA between Malaysia Airlines and Menzies, it included details about how some of the services were to be provided (for example, punctuality instructions). It also included agreed performance measures between the two parties, applicable charges, penalty clauses and other matters not covered in the SGHA. A timeline illustrating the key events related to the resumption of Brisbane services is provided in Figure 45, with further details provided in the following sections.

Figure 45: Timeline of key events for the Malaysia Airlines resumption of Brisbane servicesSource: ATSB

Engineering support and certification

A number of documents and records of communication from February 2018 onwards show that Malaysia Airlines intended to engage an external provider for engineering services. The operator conducted evaluations of prospective engineering service providers, including AMSA, in February and April.^[53]

A Malaysia Airlines email sent to AMSA on 17 April 2018 listed items to be included in a proposed agreement, which included only the provision of some ground support equipment and did not include any services. A letter of intent sent to AMSA by the operator dated 28 April^[54] stated that there had been a decision to engage AMSA for ‘technical handling with [aircraft] certification’ at that time.

The operator was required to obtain approval from the Malaysian Civil Aviation Authority for any foreign (non-Malaysian) entity to conduct certification of its aircraft. An application for AMSA to conduct certification of Malaysia Airlines aircraft was submitted on 1 June 2018 and approval was granted later that year.^[55] In the interim, AMSA engineers were not permitted to certify for work conducted on the operator’s aircraft.

The SGHA between Malaysia Airlines and AMSA, finalised on the day of the occurrence but not effective in practice, indicated that AMSA was to provide engineering services including, among others:

• provide, position and/or remove pitot probe covers
• perform line inspection in accordance with the operator’s current instructions and certify for its conduct in the aircraft technical log
• provide personnel to assist the flight crew or ground staff in the performance of the inspection
• conduct ramp to flight deck communications during arrival and dispatch (that is, arrival and dispatch coordination)
• carry out a safety/ground damage inspection immediately upon arrival and prior to departure
• check that all doors and access panels are properly closed and locked.

ATSB observation The prospective agreement with AMSA, signed by Malaysia Airlines a few weeks after the resumption of services and by AMSA on the day of the occurrence, included the requirement to provide, position, and/or remove pitot probe covers. As with many other services listed, and in accordance with how the IATA SGHA is typically applied, it did not specify whether this meant that pitot probe covers were to be used for all turnarounds or on an ‘as needed’ or other basis. This information was not recorded elsewhere. An application for regulatory approval for AMSA to provide certification to Malaysia Airlines aircraft was not submitted until a few days before operations were due to recommence. The operator probably did not allow sufficient time for the regulator to evaluate the application.

Over 25–29 June, 2 AMSA engineers were trained in Malaysia Airlines engineering certification procedures, including:

• online access to and general use of publications and forms including check sheets and technical logs
• transit check requirements and access to the check sheets (the training did not cover the content of check sheets)
• ground handling requirements for Malaysia Airlines aircraft, including the A330, and
• general notes about dispatch coordination.

The operator provided AMSA with copies of, and online access to, relevant procedures and other documents.

Ground handling

Malaysia Airlines conducted an evaluation of Menzies across a range of areas in April 2018.^[56] A plan for the engagement of Menzies was drafted on 27 April 2018 and finalised in May 2018. It did not explicitly state whether Menzies would be responsible for dispatch coordination, but had provisions for Menzies to provide numerous ground services including ramp handling.

Both draft agreements between Malaysia Airlines and Menzies listed the following services to be provided, among many others:

• carry out a safety/ground damage inspection immediately upon arrival and prior to departure
• check that all doors and access panels are properly closed and locked.

Dispatch coordination

The April 2018 letter of intent advising of the decision to engage AMSA for technical handling (engineering) did not explicitly specify that AMSA were to conduct dispatch coordination, although that could be interpreted to be included in the term ‘technical handling’. The draft agreements between Malaysia Airlines and Menzies, signed by the operator in the two‑week period leading up to the resumption of operations, both required Menzies to conduct ramp to flight deck communications during arrival and dispatch (that is, arrival and dispatch coordination).

The Malaysia Airlines investigation report stated that on 4 June 2018 AMSA advised Malaysia Airlines that it would withdraw from the proposed agreement to provide services in Brisbane, which included dispatch coordination. The report stated that tasking for dispatch coordination was transferred from AMSA to Menzies from this point The Malaysia Airlines investigation report stated:

After further discussion, AMSA had later agreed to provide technical support to MAB [Malaysia Airlines]. In the meantime, MAB appointed Menzies to perform headset function during aircraft pushback operations, as an interim measure. This arrangement was different from other Australian airports where the headset function is normally assigned to the engineering support (AMSA) personnel, rather than ramp handlers such as Menzies.

AMSA had no records relating to a change of services from the initial arrangement to what was actually provided when operations resumed. As stated above, the SGHA between the operator and AMSA (signed by Malaysia Airlines on 10 July) included a requirement for AMSA to conduct dispatch coordination.

ATSB observation Malaysia Airlines reported that in early June 2018 AMSA withdrew from an agreement to provide ground services, which led to the requirement to engage Menzies for dispatch coordination. However, Malaysia Airlines had signed a draft agreement for Menzies to perform this function two weeks before that, and there was no evidence available to indicate that Malaysia Airlines intended to engage AMSA for dispatch coordination at that time. The first unambiguous record available engaging AMSA for dispatch coordination was the draft agreement signed by Malaysia Airlines on 10 July, after Brisbane flights had resumed. This agreement was most likely the result of an intent to engage AMSA for both engineering certification and dispatch coordination once regulatory approval for certification was gained.

Acquisition of mud wasp information

Malaysia Airlines reported that it did not have a formal process to monitor some types of safety information (including AWBs) from foreign civil aviation authorities. Nevertheless, the operator reported that both the E&M and flight operations departments obtained the March and May 2018 issues of AWB 02‑052 Wasp Nest Infestation – Alert, possibly through subscriptions to CASA’s automated email alert system.

The operator reported that the flight operations department performed a risk assessment in relation to hazards affecting flight operations at Brisbane Airport. The operator reported that the assessor examined the available Lido chart for Brisbane Airport and, based on the observation that the airport characteristics (such as runway length and approach procedures) and published hazards presented a similar risk profile to other major airports, did not document the risk assessment.

Flight operations evaluators did not visit the airport and relied on the information contained in the Lido aeronautical charts for flight risk information, and the individuals involved in the port assessment process were unaware of the mud wasp hazard.

AMSA and Menzies reportedly both advised the operator’s evaluation team about the mud wasp hazard at Brisbane during the operator’s on-site visit.

In the 17 April 2018 email exchange between Malaysia Airlines and AMSA, the operator included pitot probe covers in a list of required equipment. The AMSA representative advised:

…please be aware that all other carriers into BNE install pitot covers because of wasp infestations at this airport, you may also want to position the covers with AMSA and we will fit them as part of the transit, this will not incur an additional charge provided we do not have to provide the covers.

The operator sent a set of pitot probe covers to AMSA, however, no record of the date, the sender, or recipient was available.

An email from the operator’s station manager in Brisbane to a manager in Malaysia, dated 20 June 2018, stated that there was a ‘known issue’ and regulator advice about mud wasps building nests in pitot probes in Brisbane, adding that they can do so ‘very rapidly’. The station manager asked if it were possible to arrange for pitot probe covers to be fitted for every turnaround in Brisbane as a preventative measure, suggesting that AMSA could do so.

A response to this email on the same day stated that one set of pitot probe covers was now in AMSA’s possession, and that the operator would ‘advise our LAE to comply’ with the recommendation for their fitment.

ATSB observation Different departments in Malaysia Airlines became aware of the mud wasp hazard at Brisbane Airport through various means, including through regulator publications and local knowledge of the service providers. Individuals within the operator’s engineering and maintenance department were aware of the hazard several weeks before the commencement of operations, and sent a set of pitot probe covers to AMSA to be used on the operator’s aircraft without providing guidance or instructions on their intended use to the operator’s line engineers. Although some flight operations staff had obtained the relevant CASA airworthiness bulletin about mud wasps at Brisbane, this information did not reach, or was not used by, the individuals responsible for assessing the port safety from a flight operations perspective.

Risk assessment for Brisbane operations

On 25 May 2018, the operator’s AS department completed a risk assessment relating to the resumption of services to Brisbane. The risk assessment covered aviation safety risk as well as other business- and service-related risks. The record indicated that it was conducted and approved by the regional head of AS (one level below the AS department head). There was no record of other individuals or departments being involved, and no recorded risk assessment by any other department in relation to the resumption of Brisbane services.

The assessment used the ‘change management risk register form’ (see Operator change and risk management processes). This form allowed for an evaluation of initial risk, identification of treatments in the form of risk controls, and evaluation of residual risk (the risk that remains after treatment). The form also afforded the user space to name the assessor and set a status for each risk.

The ATSB’s examination of the overall risk assessment found that:

• four risks, including a risk that identified the mud wasp hazard, had a residual risk rating that was incorrectly calculated one level lower than it should have been (‘low’ instead of ‘medium’)^[57] no risk category information was recorded in the individual risk or control descriptions (for example, a fatigue risk due to having an unsupported station head was recorded; it was not stated whether this was an individual health and safety risk, a risk to customer service, or a risk to the safety of flight)
• there was insufficient information recorded about the nature of each risk and the risk controls to justify reductions in likelihood and severity, including:
  • risks were reduced in severity without listing controls that would feasibly have an effect on severity
  • some of the risk controls were vague or would have no effect on the identified risk (for example, ‘[ground handling agent] assured, will ensure smooth MH [Malaysia Airlines] Operations.’)
• two of the initial risk ratings were incorrectly labelled ‘minor’ (a severity rating) instead of ‘medium’
• some risk controls listed as initial (or existing) were prospective (that is, should have been listed as additional risk controls)
• some risk controls were more about planning than directly controlling risk (such as ‘oversight will be done by airport services trainer and station head’)
• some additional controls were rewordings of existing controls or stating how they were to be achieved, rather than separate controls (for example an existing control for one risk was ‘engineering … to provide flying engineer for aircraft certification at station’ and two additional controls associated with the same risk were ‘engineer will be onboard all aircraft and provide certification for all in and outbound flights’ and ‘station head to ensure engineer is available on all flights’)
• there was no identification of new risks introduced by the implementation of controls, including the risk of having mixed engineering responsibilities or the use of pitot probe covers
• there was no action associated with prospective risk controls or a record of responsibility to ensure that action would be taken, and
• all of the ‘risk assessor’ and ‘risk status’ cells, probably intended to track individual responsibility and completion of risk activities, were blank.

In all, there were 7 identified risks, each of which were assessed as having ‘medium’ initial risk and ‘low’ residual risk. Six of the risks related to turn around times, ground services and management of customers, with no immediately obvious relevance to safety. The other risk, the mud wasp hazard, was described as relating to aviation safety and is reproduced verbatim in Table 4.

Table 4: Record of operator’s risk assessment for the mud wasp hazard at Brisbane

Risk	Mud Wasp effecting Safety of aircrafts. Wasp build nest at tiny holes. Mainly at "pitot".
Existing risk controls	a. Engineer and Technical handler briefed to ensure pitot holes are covered during transit. b. GHA [ground handling agent] to remind Engineering and Technical handler comply to work process. c. To prepare checklist ensure compliance.
Initial risk assessment	Likelihood: remote
Severity: moderate
Risk: medium
Additional risk controls	a. Engineer will log in daily service register to ensure pitot holes are covered. b. Hazard reports to be raised and ensure corrective action.
Residual risk assessment	Likelihood: improbable
Severity: moderate
Risk: low

The risk assessment identified the need for the installation of pitot probe covers for aircraft transits at Brisbane Airport as a risk control. According to the operator, the risk assessment was entered into the AS business unit risk register, but not the applicable domain operational risk register. It was reported that the flight operations department personnel responsible for the operational aspects of the change were not appraised of risks relevant to it, including the mud wasp hazard.

The operator reported that the risk controls concerning mud wasps were communicated to the E&M department, outside of the mechanisms intended to support mitigation of risk and implementation of controls. There was no evidence of E&M department involvement in the conduct of the risk assessment or identification of risk controls, and the E&M department did not perform a separate risk assessment. The AS department did not follow up on the required actions and no risk controls were implemented by E&M as a result of this risk assessment.

ATSB observation The operator’s risk assessment for the resumption of Brisbane flights identified the presence of a mud wasp hazard. Issues with the risk assessment meant that its evaluation of the effectiveness of risk controls, and the remaining residual risk, had limited value. In any case, the identified risk controls were ultimately not implemented. Additionally, the unusual ground operations arrangements in Brisbane were not treated as a safety risk, and not effectively managed.

Operator change and risk management processes

Overview

The operator’s corporate safety management manual (CSMM) contained information about its safety management system and broadly aligned with the format and headings of the framework provided in the International Civil Aviation Organization (ICAO) Annex 19, Safety Management. It included policy, procedures, and guidance on change management and risk management.

Safety risk assessment team

The CSMM stated:

Safety Risk Assessment Team (SRAT) is one of a management review venue which will be held on a regular basis. SRAT comprises of departmental managers, subject matter experts (SME) and other related personnel nominated by the BU [business unit] Head.

The SRAT included managers and other personnel from across the organisation, including the AS and E&M departments. Its objectives included hazard/risk identification and assessment, and change management. The operator reported that activities deemed to trigger change management process were to be identified to and deliberated by the SRAT. The CSMM stated:

During the year, SRAT representatives are responsible for ensuring supplemental risk assessment activities are undertaken and risk registers are updated whenever there is a significant change

The CSMM also stated:

SRAT representatives are to ensure that Risk Assessment Records are reviewed a minimum of once each quarter. This review will provide evidence that identified risks are being monitored, and risk ratings and mitigation plans are being updated to reflect the current status and operating environment.

The operator required that (untreated) risks assessed as ‘medium’ or above were to be notified to, and then monitored by, the SRAT. The SRAT was not notified of the risks identified for Brisbane operations.

The ATSB reviewed SRAT meeting minutes for the 5 monthly meetings held over the period that the changes were being planned and implemented for the resumption of Brisbane services (that is, January–July 2018). The minutes recorded 23–34 attendees and 24–33 absences from each meeting, across all departments. There was a nominated ‘accountable person’ for each department including AS, E&M, and flight operations.

Representation from the 3 departments involved in this activity (AS, E&M, and flight operations) is detailed in Table 5. In some cases, an alternate representative from the department presented information in the absence of the accountable person. One of the attendees at the April 2018 SRAT meeting noted that the meeting schedule sometimes clashed with flight operations roster for some attendees.

Table 5: Departmental representation at SRAT meetings in 2018

	SRAT meeting
Department	1 February	9 March	17 April	16 May	28 June
Airport services (AS)	None	None	Alternate	Alternate	Alternate
Engineering and maintenance (E&M)	Alternate	None	Alternate	None	None
Flight operations	None	Accountable person	None	Accountable person	Unknown[1]

[1]  The minutes for June were inconsistent: the attendance list had the flight operations accountable person as absent, while the minutes proper indicated that they were possibly present.

There was no record of discussions relating to the Brisbane operations in the minutes, and the operator’s investigation found that this topic was not discussed. The regional AS manager, who approved the change risk assessment for the resumption of Brisbane operations, was not among the usual required attendees, and did not attend any of the meetings.

ATSB observation There was limited involvement from the relevant departments with the operator’s SRAT meetings in the first 6 months of 2018 when the resumption of Brisbane operations was being planned. Most notably, the ‘accountable person’ for the department responsible for coordinating and planning the resumption of Brisbane services was not present at any of the meetings, and an alternative was only present for some. The risk assessment for the resumption of Brisbane operations was performed between the May SRAT meeting and the 6 June resumption of operations, so there was no opportunity to present the results until after that. Finally, relevant risks were not raised by the alternative representative at the next meeting in late June.

Change management

International Civil Aviation Organization guidance

ICAO Annex 19 describes the responsibility of the operator with respect to the management of change:

The service provider shall develop and maintain a process to identify changes which may affect the level of safety risk associated with its aviation products or services and to identify and manage the safety risks that may arise from those changes.

Annex 19 is supported by ICAO document 9859 (Safety Management Manual), the 4th edition of which was published in January 2018. The 4th edition of the ICAO Safety Management Manual was updated from the 3rd edition (published in 2013) to be less prescriptive and to focus on the intended outcomes of each activity and process.

ICAO Annex 19 and the Safety Management Manual tie the management of change directly to safety risk and integrate it with safety risk management processes. The Safety Management Manual states:

Safety management practices require that hazards resulting from change be systematically identified, and strategies to manage the consequential safety risks be developed, implemented and subsequently evaluated.

The ICAO Safety Management Manual further stated:

The organization’s management of change process should take into account the following considerations:

a)    How critical is the change? The service provider should consider the impact on their organization’s activities, and the impact on other organizations and the aviation system.

b)    Availability of subject matter experts. It is important that key members of the aviation community are involved in the change management activities; this may include individuals from external organizations.

c)    Availability of safety performance data and information. What data and information is available that can be used to give information on the situation and enable analysis of the change?

Malaysia Airlines processes

The operator’s CSMM included policy, procedures, and guidance on change and risk management. It included a 3-page section on change management. About half of this section contained a detailed list of events to trigger change management procedures, which included:

• addition or removal of an airport/station
• new routes
• any other significant change that is deemed to carry operational risk.

Beyond this, there was a change management process, described by a flowchart (Figure 46), and a written description which stated, in entirety:

Relevant Divisional Heads are responsible for initiating change management procedures for activities for which he/she is responsible, and for maintaining a record of each assessment.

Activities deemed to be change management triggers are to be identified at the monthly operational risk meetings (SRAT). A risk assessment must be conducted and identified risks and mitigation plans must be documented in the applicable domain or subsidiary operational risk register.

Refer to Appendix A.12 for the Change Management Risk Register Form.

Figure 46: Malaysia Airlines change management process flowchartSource: Malaysia Airlines

ATSB observation The resumption of Brisbane operations qualified as a change management trigger. However, although there was generally wide representation at the SRAT meetings and individuals aware of the change were probably present, there were no records of its discussion at the SRAT as required by the change management process.

The ‘change management risk register form’ in the manual’s appendix was used for the risk assessment for Brisbane operations, and had the same headings as that assessment. The form was a basic register of risks, and did not support any type of transition planning or management in respect of management of change.

As an example of current aviation industry practices, the 4th edition of the ICAO Safety Management Manual provided enhanced guidance on change management processes over the 3rd edition including greater detail of the steps involved. An ATSB comparison of the operator’s change management process with this guidance is provided in Table 6.

Table 6: Current aviation change management guidance and Malaysia Airlines implementation in 2018

ICAO Safety Management Manual guidance	ATSB observation of Malaysia Airlines implementation
a) understand and define the change; this should include a description of the change and why it is being implemented;	The process did not specifically require, or include guidance or instruction, on how to define the change.
b) understand and define who and what it will affect; this may be individuals within the organization, other departments or external people or organizations. Equipment, systems and processes may also be impacted. A review of the system description and organizations’ interfaces may be needed. This is an opportunity to determine who should be involved in the change. Changes might affect risk controls already in place to mitigate other risks, and therefore change could increase risks in areas that are not immediately obvious;	The process did not include a step to define relevant stakeholders. There was no requirement to involve stakeholders in the management of the change except through the risk management process, if the risk was not ‘acceptable’. The process did not require existing risk controls to be linked to the new hazard in the risk register, increasing the likelihood that the link could be overlooked in future.
c) identify hazards related to the change and carry out a safety risk assessment; this should identify any hazards directly related to the change. The impact on existing hazards and safety risk controls that may be affected by the change should also be reviewed. This step should use the existing organization’s SRM [safety risk management] processes;	The process required a risk assessment mitigation plan to be completed. There was no guidance on the purpose, content, or development or use of a risk assessment mitigation plan. There was no requirement for a change management action plan or the nomination of a responsible person to plan or document the change overall. There was no requirement to produce or track actions.
d) develop an action plan; this should define what is to be done, by whom and by when. There should be a clear plan describing how the change will be implemented and who will be responsible for which actions, and the sequencing and scheduling of each task;
e) sign off on the change; this is to confirm that the change is safe to implement. The individual with overall responsibility and authority for implementing the change should sign the change plan; and…	There was no guidance about what level of authority was required for a change (although the risk management section provided guidance on the levels of authority to accept risk).
f)  assurance plan; this is to determine what follow-up action is needed. Consider how the change will be communicated and whether additional activities (such as audits) are needed during or after the change. Any assumptions made need to be tested.	There was no means of assurance for change management implementation and follow-up to monitor and review changes.

Risk management

General content

The safety risk management section in the CSMM was more substantial than the change management process, with elements such as a reporting policy, flight safety analysis, just culture, investigation, and fatigue risk management.

Information about safety risk assessments was distributed across several subsections, with a flowchart, risk matrix and associated category definitions in a section about safety incident and hazard reports, and a broad text description of the process in a separate section on safety risk assessment.

The section detailing the method of performing a safety risk assessment was about 3 pages long, including 1 page of definitions and several subsections describing how risk assessments fit in with the broader operational environment (such as how risk registers are managed and information about annual reviews). The risk management process was described as follows:

Operational risk assessments will be performed using the same 5 x 5 risk matrix and process as defined for occurrence report risk rating at section 2.2.5 of this manual.

All identified risks will be fully documented on the Risk Assessment Record (Appendix A).

SRAT representatives are to ensure that Risk Assessment Records are reviewed a minimum of once each quarter. This review will provide evidence that identified risks are being monitored, and risk ratings and mitigation plans are being updated to reflect the current status and operating environment.

Risk assessment categories and matrix

The CSMM defined multiple categories of risk (for example, safety of flight, business or environmental). Neither the standard risk assessment form or the change management risk register form required the category of each risk to be defined.

The risk level was determined using a 5x5 risk matrix and a risk tolerability table. The CSMM defined 5 ratings for likelihood (from ‘extremely improbable’ to ‘frequent’) and 5 ratings for severity (from ‘negligible’ to ‘catastrophic’). There were 4 levels of overall risk, from ‘low’ to ‘critical’. The CSMM provided guidance for each of the risk levels, indicating that ‘low’ risks were acceptable (tolerable) and were to be routinely monitored by the head of the relevant department.

Severity could be assessed in terms of 14 categories, including injury/illness, airworthiness, and safety of flight. Within each category, a description of the kinds of impact or severity associated with each severity level was provided, with relevant examples reproduced verbatim in Table 7.

Table 7: Safety of flight severity categories used by the operator

Safety of flight severity category	Description
Minor	·        deviation with some potential to impact safe operation of an aircraft, or ·        managed by air crew using non-normal checklist procedures.
Moderate	·        deviation impacting the continued safe operation of an aircraft ·        managed by air crew using multiple non-normal checklist procedures or additional actions

The risk assessment record template in the manual’s appendix was separate to the change management form template, and required additional information, including:

• impact category
• tracking source
• details about safety actions
• remarks
• review

Unlike the change management form template, the risk assessment record template did not include a space to record the residual likelihood or residual consequence (only the overall residual risk).

Risk management process

The ‘process as defined for occurrence report risk rating’ (referred to by the risk management process for identified operational risks) had a flowchart to illustrate the process (partially reproduced in Figure 47). It indicates the steps involved in processing hazard and occurrence reports. These steps included determining the risk level of each hazard or incident, investigation level, assignment to respective business unit, and closure of investigation.

After initial report collection and risk classification, there was a decision point where incidents and hazards with:

• ‘high’ or ‘medium’ risk were to follow a detailed investigation process with differing priorities, including steps for corrective actions, review, acceptance, implementation, monitoring and closure (via the arrows to the right of Figure 47).
• ‘low’ risks were directed to a decision labelled ‘Investigate?’; following the ‘no’ path ends the process without further steps, and the second unlabelled path passes to the same investigation process as for higher risks but with low priority.

The CSMM did not clarify whether the ‘risk’ decision point was to be based on initial or residual risk.

Figure 47: Part of the operator’s safety reporting process, also used for general safety risk management
Source: Malaysia Airlines

There was no guidance on identifying and involving stakeholders, and although the process listed ‘monitoring’ as a key step, there was no guidance for how this should be accomplished.

The CSMM stated:

Domain and subsidiary Risk Assessment Records are to be consolidated into a business unit [departmental] operational risk register and this is to be [consolidated] into a Master Operational Risk Register.

Related occurrences  

Brisbane Airport

Overview

A review of the ATSB occurrence reporting database^[58] indicated that, from 2008–2018, there were at least 20 other airspeed anomaly occurrences involving high-capacity regular public transport aircraft on take-off from Brisbane.^[59] There were 5 reported airspeed anomalies during take-off due to system failures other than pitot system blockages, and 15 due to pitot system blockages.

In all the occurrences involving pitot system blockages, one pitot probe was blocked. Six of them were associated with insects or insect nests, all between the months of January and April, with the remaining 9 having no recorded cause. There were 5 different aircraft types involved: Airbus A330, Boeing 737, ATR 72, Fokker F28, and Dornier 228. None were operated by Malaysia Airlines.

The ATSB investigated two other A330 aircraft where one of the pitot probes had been blocked with wasp nests: one in 2006 and one in 2013. There have been no reported instances where more than one pitot probe was blocked by wasps.

Overall, the 20 airspeed anomaly occurrences that were examined resulted in 10 rejected take‑offs, 9 flights turning back after take-off, and 1 flight that continued to its destination. The occurrences involving Airbus aircraft (all A330s) resulted in 3 rejected take-offs and 1 air turn-back.

2006 occurrence

In 2006, the flight crew of an Airbus A330 taking off from Brisbane observed a discrepancy between their airspeed indications: at that time, the PF’s airspeed was 110 kt and the PM’s airspeed was 70 kt.^[60]The crew rejected the take-off, and the aircraft reached 122 kt before decelerating. Reverse thrust was not used. Due to excessive heat in the aircraft’s main landing gear brakes, the fusible plugs on six of the eight main landing gear wheels melted and the respective tyres deflated during taxi. There were no injuries.

The operator required the fitment and removal of pitot probe covers ‘as necessary if the ground time exceeds 12 hours, or less at the discretion of the certifying engineer.’ About 2 months before the occurrence, an email instructed maintenance staff to ‘fit pitot probe covers as soon as possible and remove them as close as possible to departure.’ In this case, the relevant engineer did not fit pitot probe covers because the aircraft’s turnaround was expected to be short: about 55 minutes.

There had been 5 incidences of pitot system failure associated with Brisbane operations in January–March 2006, including the investigated occurrence. At the time, they were suspected to be the result of mud wasp infestation but debris was only reported to have been found in the pitot probe of the investigated occurrence aircraft. Of the 5 occurrences, 3 resulted in rejected take-offs in Brisbane, and 1 other aircraft later had 2 rejected take-offs after the problem was not identified during maintenance.

2013 occurrence

In 2013 at Brisbane Airport, an Airbus A330 took off with two airspeed sources inoperative.^[61] The flight crew had rejected an earlier take-off attempt at about 88 kt after observing an airspeed indication problem on the captain’s display. The flight crew taxied back to the terminal where troubleshooting was carried out. During troubleshooting, in accordance with manufacturer instructions, ADIRU 1 was suspected faulty. It was exchanged with ADIRU 2 and disabled, with the FO’s air data source now set to ADIRU 3, which was permissible under the minimum equipment list. During a second take-off with the captain as PF, the aircraft passed the V₁ decision speed (151 kt in this case) before the flight crew detected that the captain’s display remained erroneous. The investigation report stated:

During the second take-off roll, the crew reported that the red airspeed flag was not apparent until after V₁. However, the recorded flight data again indicated that it was likely that a red airspeed flag would have been displayed on the captain’s PFD, after the groundspeed had reached 50 kt.

The take-off was continued. Once airborne, with only one valid source of airspeed data, the crew declared an emergency and returned to Brisbane. There were no injuries. Remnants of an insect nest consistent with that of a mud wasp was found in the captain’s pitot probe, likely formed during the 2-hour turnaround (pitot probe covers were not fitted).

Database searches

Australian aircraft defect reports

An ATSB search of the CASA Defect Report Service database for reports from 2010–2020 involving transport category^[62] aircraft identified:

• 54 reports of wasp or insect infestation of pitot probes:
  • 10 were in Brisbane, 2 elsewhere in Queensland (Coolangatta and Townsville), 4 in Sydney, 3 in Perth, 2 in Fiji, and 1 in a remote town in Western Australia (32 locations were not stated)
  • 21 events involved failures that would probably not be detectable on take-off, and a further 9 events had no flight phase stated
  • of those that might have been detectable on take-off, 11 take-offs were continued and 15 were rejected (including 3 rejected take-offs for the same problem); 6 rejected take-offs were from below or slightly above 100 kt and there was no information available for the others.
  • a variety of aircraft types were affected with no clear correlation with any type or manufacturer
  • on several occasions, pitot/static system tests did not initially reveal obstructions, sometimes leading to further rejected take-offs when the blockages reappeared
  • one report stated that a wasp infestation had occurred in a 20-minute period after pitot probe covers were removed for flight
  • there was at least one reported event in every month, with most (72%) between December and April, and a further 15% in October or November.
• other sensors including static ports, elevator feel pitot probes^[63] and engine sensors were also affected several times
• on 12 occasions, wasp nests were found on external surfaces such as control surfaces, actuators, pressure outlet valves, and doors.

Airbus operator reports

Airbus received reports of 0–4 in-service pitot probe blockage events causing unreliable airspeed on take-off each year from 2010–2019, mostly from insect activity and mostly from different airports. The number increased in 2020, with 55 reports from January 2020 to March 2021. Data on all of these occurrences is limited. Airbus reported that about one-third of occurrences through each period resulted in the take-off being continued.

Of the 55 recent reports of unreliable airspeed on take-off, 44 were due to blocked pitot probes, mostly due to insect activity after extended storage, although there were some involving aircraft that were on the ground for less than 2 hours. Most (36) unreliable airspeed events resulted in rejected take-offs, with the other 19 take-offs being continued.

A post-flight report, containing limited data about the flight, was available for 17 of the 19 continued take-off events. Airbus analysis of these records found that:

• for 2 events the ISIS was the only instrument displaying unreliable airspeed
• for 1 event, a speed flag appeared
• for 1 event, an ECAM message and master caution (single chime) alert were triggered before 80 kt.

Aside from the occurrence event, there were 2 flights with reported blockages of multiple pitot probes from 2010–2019, and 5 from January 2020–April 2021. These led to 3 rejected take-offs (at 125 kt, 100 kt, and an unknown speed) and the other 4 take-offs being continued.

Airbus later reported that, from April to July 2021, a lower proportion (13%) of unreliable airspeed occurrences resulted in a continued take-off.

Airbus published case studies about airspeed anomalies on take-off in an article titled Unreliable Airspeed at Takeoff (Airbus 2021). The occurrence event was one case study. The other two were:

• In an A330, the captain’s airspeed during take-off was low, displaying 55 kt at the time of the 100 kt speed call (when the flight crew detected the discrepancy), and 80 kt at rotation (133 kt). The speed flag was not displayed because the measured airspeed was above 30 kt and the difference to groundspeed was not sufficient to trigger the flag. The take-off was completed and the flight crew decided to return. The article stated:

If the airspeed was monitored even more closely by the flight crew during the takeoff roll, they may have identified the speed discrepancy sooner, allowing them to reject the takeoff and bring the aircraft safely to a stop.

• In an A320, the captain’s airspeed read 45 kt with the aircraft at a standstill on the ground. During the take-off roll, the captain’s indicated airspeed increased slightly but fell below actual airspeed and read 58 kt at the 100 kt speed call, at which point the flight crew detected the problem and rejected the take-off. The article stated:

The Standard Operating Procedure requests monitoring of the PFD speed scale during the entire takeoff roll. Following this recommendation may have made the flight crew aware of the airspeed discrepancy earlier than the 100 kt callout and enabled them to reject the takeoff at lower speed.

Occurrences related to air data sensor malfunction

Air data malfunctions directly related to maintenance activities

• Airbus had records of 3 occasions where aircraft took off with one pitot probe cover installed, involving various Airbus types with broadly similar warning systems and displays to the A330. They resulted in one rejected take-off from 95 kt, one continued take-off after the problem was detected at about 100 kt, and one continued take-off from an unknown speed. There were no previous recorded occurrences with more than one pitot probe cover installed.
• The ATSB recorded 2 previous instances of high-capacity air transport aircraft departing an Australian airport with pitot probe covers left on from 1998–2018. Both were Fokker F28s with one pitot probe left on, resulting in rejected take-offs.
• In 2021, a Boeing 787 that had flown from Melbourne, Victoria to Los Angeles, United States was found to have tape (with ‘remove before flight’ streamers) left over the engine static ports following previous maintenance. This occurrence is under investigation by the ATSB.^[64] In 2012, an A330 turned back due to discrepancies between the airspeed indications that appeared after take-off.^[65] Later analysis found that the PF’s (captain’s) airspeed was reading 20–30 kt too low and the standby airspeed was 30–50 kt too low. The investigation found debris in all three pitot systems that was from pitot probe covers that were damaged when probe heat had been applied with the covers still fitted at some point prior to the flight.
• In 2008, the flight crew of an Airbus A320 lost control during a test flight while carrying out an improvised low-speed test at low altitude over the Mediterranean Sea near the French coast.^[66] The investigation found that water had entered angle-of-attack sensors that had been incorrectly left uncovered during aircraft washing. The water froze, immobilising two of the three sensors and disabling the aircraft’s low speed protections. There were 7 fatalities.
• In 1996, a Boeing 757 impacted water after take-off in darkness from Lima, Peru.^[67] Just after take-off, the flight crew identified multiple problems with the air data system and received multiple contradictory alerts. The flight crew attempted an approach and landing at Lima, experiencing several stalls and altitude loss. The air traffic controller provided altitude information to the flight crew, which was incorrectly assumed to be valid but was actually erroneous as it was provided by the aircraft’s systems. Distracted by the contradictory warnings, the flight crew did not respond to the radar altimeter’s indications (which were not affected by air data) at low altitude and the aircraft impacted water. All 70 occupants were fatally injured. The investigation found that the aircraft’s static ports had been blocked by tape that was installed during a maintenance activity, and not removed afterwards. Relevant recommendations included pilot training for unreliable airspeed and more conspicuous covers for static ports.

Insect ingress

• In June–July 2021, several aircraft had abnormal pitot/static system events in aircraft operating from or stored at London Heathrow Airport, United Kingdom, leading to two rejected takeoffs,^[68] one flight returning after the aircraft displayed multiple fault messages shortly after push-back, and one aircraft that displayed a pitot probe heater fault in-flight without any other abnormal indications. One take-off involving an A320 was rejected at 104 kt after the captain (PF) observed less than 40 kt on the captain’s PFD and 70 kt (the actual airspeed) on the FO’s. Another A320 take-off was rejected at about 60 kt after both flight crew observed low airspeed indications (less than 30 kt) early in the take-off roll. The AAIB investigation identified the cause to be the nesting activity of certain species of wasps and bees within pitot probes. On inspection, three additional aircraft were found to have blocked pitot probes. Some insects and larvae were sampled and identified as Ancistrocerus parietum (a species of mud wasp) and Megachile pilidens (a species of solitary bee). Most of the aircraft had been in storage.
• In 2020, the flight crew of an Airbus A321 taking off from Doncaster, United Kingdom, rejected the take-off at V₁ (120 kt in this case) after no airspeed was seen on the captain’s display.^[69] Insect larvae was found in the corresponding pitot probe. The aircraft had been stored for nearly 12 weeks with pitot probe covers fitted.
• Airbus advised the ATSB that in 2011, an A320 took off with 3 different airspeeds displayed. Although data is limited, Airbus analysis indicated that the captain’s and ISIS airspeeds were both under-reading; the captain’s by about 8 kt initially and the ISIS by about 36 kt shortly after take-off. The FO’s airspeed may have also been erroneous. The NAV IAS DISCREPANCY message and master caution were presented during the take-off roll, indicating that a discrepancy of at least 25 kt was present for at least 10 s, although the time at which this triggered is not known. The flight crew turned back. All 3 pitot probes were found blocked by insects. The flight was the first after maintenance.
• An operator reported several airspeed anomalies in its Airbus A330 fleet between June 2011 and February 2015 in airports in Hawaii and California, United States (Ecosure 2017). Insect debris consistent with wasp activity was detected in eight of the involved aircraft. Non-insect material in two others was initially believed to be associated with human construction activities but it was later suggested that these could be from preliminary nest building activity by wasps.
• In 2009, a Boeing 757 took off from Accra, Ghana, with erroneous airspeed indications on the captain’s side.^[70]The captain, who was pilot flying, detected the problem before the aircraft reached 80 kt (at which point a speed call was required in this aircraft type) and decided to continue the take-off while referencing the standby and first officer’s instruments. The flight crew and an engineer on board correctly diagnosed the failure of the left air data system and selected the captain’s instruments to the alternate system before engaging the first officer’s autopilot, believing that their actions had disconnected the erroneous air data from the flight management computers. In fact, the aircraft’s flight management computers continued using the erroneous data, and falsely sensed an overspeed condition which resulted in an automatic pitch‑up command. The flight crew disconnected the autopilot and returned to Accra. There were no reported injuries. A beetle or similar insect was later found in the left pitot system. The investigation concluded that ‘although the commander [captain] considered that conditions were suitable for resolving the problem when airborne, a low speed rejected take-off would have been more appropriate in these circumstances.’ The operator subsequently advised flight crews to reject a take-off if a similar airspeed problem is recognised below 80 kt.
• In 1996, a Boeing 757 impacted water after take-off in darkness from Puerto Plata, Dominican Republic after a failure of the captain’s airspeed display (the FO’s and standby airspeed displays were correct).^[71] When performing the required airspeed cross-check at 80 kt during the take-off roll the flight crew identified that the captain’s airspeed indicator was erroneous. The flight crew continued the take-off. During the climb, aircraft systems presented multiple warnings associated with excess speed. Although the aircraft was flying slowly, the flight crew thought that it was flying too fast and reduced thrust. The stick-shaker stall alert system, alerting the crew to the aircraft’s slow speed, activated. The captain increased thrust in response to the conflicting alerts. The left engine flamed out due to inadequate airflow to the left engine, while the right engine’s thrust increased, and control was lost. The aircraft impacted water and all 189 occupants were fatally injured. An investigation by the Dominican Junta Investigadora de Accidentes Aéreos (​JIAA) found that the pitot probe feeding the pilot’s airspeed indicator was blocked by an insect nest. It highlighted the importance of recognising a speed indication malfunction during take-off and recommended, among other things:
  • training emphasis ‘on the importance of recognising a malfunctioning airspeed indicator during take-off
  • the use of blocked pitot probe scenarios in flight simulator training, and
  • inclusion of a ‘caution alert’ when erroneous airspeed is detected.

Water or ice ingress

There have been several occurrences, a very small number of which were fatal accidents, where in‑flight pitot probe icing was encountered in recent decades.

In 2009, an Airbus A330 stalled and collided into the sea at night while en route to France from Rio de Janeiro, Brazil.^[72]The investigation found that in-flight pitot probe obstruction due to ice accumulation had led to discrepancies in the airspeed displays and multiple alerts.. The flight crew did not carry out the unreliable airspeed procedure. Following pitch-up control inputs made by the pilot flying, the aircraft entered a stall which the flight crew did not diagnose and control was not regained. There were 228 fatalities. The aircraft was not fitted with the BUSS.

A complete review of other in-flight pitot probe icing events was not undertaken by the ATSB. Other related occurrences (on take-off or associated with pitot probe drain blockages) include:

• In 2018, an Antonov An-148 crashed shortly after take-off in icy instrument meteorological conditions from Moscow, Russia.^[73] With three different airspeed indications, the flight crew lost control. There were 71 fatalities. Pitot probe heating had not been selected on, and the three pitot probes had become blocked with ice.
• In 2015, the crew of an Airbus A320 received multiple alerts arising from erroneous airspeed measurements in all three systems at various times during the take-off and climb from Perth, Australia.^[74] The flight crew incorrectly diagnosed the source of the problem (interpreting an airspeed problem as an angle-of-attack problem) and subsequently thought that a stall warning was spurious when in fact the warning was valid. The flight returned to Perth. The airspeed disagreement was due to the pitot probes being contaminated with foreign material that prevented water from draining..
• In 1999, a McDonnell Douglas MD-11F freighter crashed on landing at Subic Bay, Philippines.^[75] There were no fatalities. The Aircraft Accident Investigation Board (Philippines) found that drain holes in the captain’s pitot tube were likely blocked, leading to erroneous airspeed indications on the captain’s display. The investigation stated that the available flight crew indications (the display of an amber ‘IAS’ on the PFD and three alerts associated with other systems) did not directly lead the flight crew to commence the appropriate ‘Airspeed: Lost, Suspect or Erratic’ checklist. The NTSB also stated that the flight crew did not make use of the standby airspeed indication to determine the reliability of the other indications. The investigation report detailed other air data anomalies in related aircraft types.

Other debris

• On 6 November 1996 a McDonnell Douglas MD-11 overran the runway during landing at Buenos Aires, Argentina.^[76] The aircraft received minor damage and there were no injuries. No investigation report was available; the NTSB stated in the 1999 Subic Bay investigation report that:

…the crew landed long and fast as a result of erroneous airspeed indications. It was determined that these indications were caused by water in the pitot tubes as a result of blocked pitot tube head drain holes. Laboratory analysis of the debris blocking the drain holes revealed fiberglass shards, which may have entered the uncovered pitot tubes as a result of on-airplane radome repairs.

There were 2 identified previous instances of similar alerts and anomalies in the same operator’s other MD-11 aircraft that were also caused by blocked pitot probe drain holes, and 3 other instances likely due to air data computer malfunction or other reasons.

Aircraft returned to service after storage

There have been numerous reports of aircraft having air data problems after being returned to service after periods of storage during the COVID-19 pandemic from early 2020 onwards. For example:

• On 12 June 2020 (revised 7 October 2020), IATA issued Guidance for Managing Aircraft Airworthiness for Operations During and Post Pandemic, with advice on the prevention of problems with air data systems during prolonged storage. IATA drew attention to concerns about contaminated air data systems on aircraft after a period of storage, stating that ‘unreliable airspeed and altitude indications are key contributing factors leading to [loss of control and controlled flight into terrain] accidents in the past’. It urged flight crews to include related elements in pre-flight threat and error management (TEM) briefings, such as cross-checking airspeed, the rejected take-off procedure, and memory items of unreliable airspeed and altitude indication procedures.
• On 20 July 2020, the European Union Aviation Safety Agency (EASA) issued a publication titled Return to service of aircraft after storage: Guidelines in relation to the COVID-19 pandemic, indicating that there had been occurrences of ‘erroneous air data information including contaminated / blocked pitot-static systems’ following aircraft storage. The guidance was later updated with additional examples of hazards, mitigation strategies and other guidance.
• On 5 August 2020, EASA issued safety information bulletin 2020‑14 Pitot‑Static Issues After Storage due to the COVID-19 Pandemic which stated:

EASA has noticed an alarming trend in the number of reports of unreliable speed and altitude indications during the first flight(s) following the aircraft leaving storage, caused by contaminated air data systems. This has led to a number of Rejected Take-Off (RTO) and In-Flight Turn Back (IFTB) events. Most of the reported events concerned the accumulation of foreign objects, such as insect nests, in the pitot static system. This contamination caused obstruction of pitot probe and static port orifices, in some cases on multiple systems, even when the covers were installed. The risk of such contamination was increased, if the aircraft storage/de-storage procedures were not completely or improperly applied at the beginning, during or at the end of the storage period.

A later revision recommended rejecting a take-off if an airspeed anomaly is detected, and stated:

Operators should also consider including the unreliable air data scenario into the operator’s post-Covid re-qualification simulator programme. The Operator’s policy on take-off briefings should be re-assessed to consider the issues highlighted in this SIB [Safety Information Bulletin].

• On 3 June 2021, the Dutch Safety Board issued 21.0004423 Interim warning in response to two serious incidents involving commercial aircraft, related to return to service of aircraft following temporary storage, stating:

The Safety Board is currently investigating two occurrences involving commercial aircraft that encountered problems with their airspeed and altitude indications shortly after takeoff… In one of these occurrences, a cover had not been removed, while in the other a number of pressure lines had not been properly connected. In both cases, the pilots were presented with incorrect altitude and airspeed information as a consequence.

• On 12 June 2021, the United Kingdom Civil Aviation Authority (CAA) issued safety notice SN‑2021/014 Pitot Blockage Events that stated:

The UK CAA and AAIB [Air Accidents Investigation Branch] have been advised of three separate events occurring at London Heathrow Airport between 9 June 2021 – 11 June 2021, whereby aircraft have been subject of pitot blockages that resulted in airspeed discrepancies and associated crew actions. The cause of these events are the subject of ICAO Annex 13 investigation, which the UK AAIB is undertaking, however initial feedback suggests a form of insect infestation may have contributed to these events.

The notice additionally stated:

Crews should be made aware of this potential issue, reminded of the importance of the speed checks during the take-off roll and the actions to be taken in the case of a discrepancy, as well as the appropriate unreliable speed indications for their aircraft type should they discover the issue once airborne.

__________

32. A precision approach path indicator is a set of lights installed near the runway aim point that provides pilots with guidance on acquiring and maintaining the correct vertical approach path to a runway
33. Information in this section is mainly derived from House and others 2020a, House and others 2020b, and Ecosure 2017.
34. Atlas of Living Australia (2015), in Ecosure (2017).
35. The number(s) of each failed ADR is presented. These messages are not caused by sensor issues or disagreements.
36. The colour of the flag is red, which is exclusively used for warnings.
37. BUSS cost reported in ABC News, The Last Four Minutes of Air France Flight 447; https://abcnews.go.com/Travel/minutes-air-france-447/story?id=9951878, accessed 9 July 2021.
38. Maintain aircraft control.
39. OEB: operations engineering bulletin. A temporary procedure published for flight crews when a situation is identified that could pose a potential risk to the safe operations of the aircraft and there is no existing procedure or technical solution to manage this risk.
40. Items marked with ‘BOTH’ are to be confirmed by both flight crew.
41. Thrust reduction altitude: the altitude at which thrust is normally reduced after take-off. In this case it was 1,500 ft.
42. Published by the Airbus product safety department, Safety First shares information and lessons learnt about safety topics related to the design, maintenance, and operation of Airbus aircraft. The content does not constitute or supersede approved guidance – see https://safetyfirst.airbus.com/about/.
43. The ERSA was part of the Aeronautical Information Publication (AIP) published by Airservices Australia.
44. One standard for ‘remove before flight’ steamers is the National Aerospace Standard NAS1756. These streamers are 3 inches wide and can be supplied in various lengths as designated by the part number suffix, that denotes their length in inches.
45. This does not include tooling for aircraft maintenance and equipment used for measurement.
46. This contract was not implemented at the time of the occurrence; see Operator planning for resumption of Brisbane operations.
47. The flight crew manuals termed it an ‘exterior inspection’ or ‘exterior walkaround’; this report refers to it as a ‘flight crew walk-around’ to avoid confusion with other similar activities.
48. A steering bypass pin when fitted to an aircraft allows it to be manoeuvred on the ground. 
49. Gap analysis: an activity that compares actual performance with expected or desired performance
50. All totals and percentages in this section exclude questions that were answered ‘N/A’ or ‘Not observed’.
51. These questions would normally only be answered positively if the dispatch coordinator conducts all or the relevant part of a dispatch walk-around, excluding checking the nose gear steering pin which can be done as part of other functions. 
52. The current operator, Malaysia Airlines Berhad (MAB), was formed from Malaysian Airline System (MAS) in 2015, retaining most of the former operator’s structure, personnel and assets.
53. The evaluation of AMSA found three non compliances with regulatory requirements: wheels in storage were overdue a regular rotation, a tyre pressure gauge calibration certificate was not available, and a handover book was not signed on one day
54. The operator’s investigation stated that this letter was transmitted on 16 May
55. AMSA reported the approval was issued on 19 September 2018; the operator reported the approval was issued on 1 December 2018.
56. Some non-compliances involving ramp handling were identified, although details were not recorded.
57. These risks, which had the combination of ‘improbable’ likelihood and ‘moderate’ severity, should have been rated ‘medium’ according to the operational risk matrix and not ‘low’ as recorded. This was possibly a mistake in using the risk assessment spreadsheet. A formula for looking up the appropriate risk rating based on selected likelihood and severity was used in some cells, while others had the text ‘Low’ copied or typed directly into those cells.
58. The database contains data on transport safety occurrences that are reportable under the Transport Safety Investigation Regulations. Reportable occurrences include ‘malfunction of an aircraft system’ if it ‘compromises or has the potential to compromise the safety of the flight’. However, not all occurrences are notified to the ATSB, and many pitot probe contamination events do not result in a reportable occurrence. As a result, these statistics are representative only.
59. A 2013 occurrence involving one rejected take-off and one returned flight and was counted as one occurrence, and is discussed further below.
60. ATSB investigation report 200601453, Rejected takeoff - Brisbane Airport, Qld - 19 March 2006 - VN-QPB, Airbus A330-303. Available at www.atsb.gov.au.
61. ATSB investigation report AO-2013-212, Air data system failure involving Airbus A330-243, A6-EYJ, near Brisbane Airport, Qld on 21 November 2013. Available at www.atsb.gov.au.
62. Transport category generally applies to multi-engine aircraft primarily intended for the regular public transport of passengers and/or cargo for hire or reward, and with a maximum take-off weight exceeding 5,700 kg.
63. The Boeing 737 has pitot probes mounted on the vertical stabiliser to provide airspeed data to an elevator feel computer.
64. ATSB investigation AO-2021-040, Aircraft preparation involving a Boeing 787-9, registration VH-ZNJ, discovered at Los Angeles International Airport, USA on 22 September 2021
65. Aviation Investigation Bureau (Kingdom of Saudi Arabia), Unreliable Airspeed Indication System/Component Failure or Malfunction (Non-Powerplant) (Scf-Np), Airbus A330-343E, Registration HZ-AQA, Jeddah, Saudi Arabia, 9 May 2012.
66. Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile report d-la081127, Accident to an Airbus A320 232 registered D-AXLA operated by XL Airways Germany on November 27, 2008 near Canet-Plage.
67. Accident Investigation Board (Peru), Accident of the Aeroperú Boeing 757 Aircraft with Registration N52AW.
68. Air Incidents Investigation Branch (AAIB) investigation AAIB-2736, AAIB investigation to various Airbus and Boeing aircraft between 9 June and 19 July 2021, United Kingdom.
69. Air Accidents Investigation Branch (AAIB, United Kingdom) report AAIB-26741, AAIB Bulletin 11/2020.
70. AAIB (United Kingdom) report EW/A2009/01/03, AAIB Bulletin 12/2009
71. Junta lnvestigadora de Accidentes Aéreos (Dominican Republic), Final Aviation Accident Report, Birgenair Flight ALW 301, February 6, 1996. 
72. Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (France), Final Report on accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF447 Rio de Janeiro – Paris.
73. Aviation Accident Investigation Commission (Commonwealth of Independent States), Final Report on the Results of the Investigation of the Aircraft Accident An-148-100V RA-61704, Stepanovskoye, Moscow region, 11 February 2018. 
74. ATSB investigation report AO-2015-107, Unreliable airspeed indication and stall warning involving an Airbus A320, VH‑FNP, near Perth, Western Australia, on 12 September 2015. Available at www.atsb.gov.au
75. Aircraft Accident Investigation Board (Philippines), Aircraft Accident Investigation Report, Federal Express N581FE MD 11 Aircraft, October 7 1999, Subic Bay International Airport
76. In Aircraft Accident Investigation Board (Philippines), Aircraft Accident Investigation Report, Federal Express N581FE MD 11 Aircraft, October 7 1999, Subic Bay International Airport, p.20

Introduction

Pitot probe covers were fitted to the aircraft during the three-hour turnaround, which is a strategy used by many airlines to prevent wasp infestation at Brisbane Airport, Queensland. There were numerous opportunities for their presence to be communicated to or identified by other people, but a range of individual errors and organisational problems interfered, and ultimately, the covers were not removed.

With covers fitted to all three pitot probes, the aircraft’s three air data systems were prevented from measuring airspeed. Airspeed is a critical flight parameter. It is particularly important to flight crew during take-off and initial climb, as it is the basis for their awareness of flight conditions such as the approach of aerodynamic stall and determination of critical decision points.

Wasp ingress almost always affects just one system, and larger aircraft typically have multiple airspeed data sources. Conversely, the non-removal of pitot probe covers potentially results in the loss of all airspeed data, which increases the potential for adverse consequences.

Aircraft of various types have commenced take-off with erroneous or absent airspeed on numerous occasions. Sometimes multiple indication systems were affected for a variety of reasons. Nearly all occurrences result in a successful rejected take-off or turn-back. A small number of flight crews had significant trouble correctly ascertaining the nature of the problem and determining the aircraft’s actual airspeed, or had such a high workload that other problems (such as low altitude) were overlooked, occasionally resulting in fatal accidents.

In this occurrence, both flight crew became aware of the problem at different points in the take-off, but did not communicate or coordinate well and make a clear decision to reject or continue while it was still safe to reject. As the aircraft continued to accelerate, the flight crew were left with no safe option other than to continue the take-off. After take-off, the flight crew regained effective coordination through the application of published procedures and, crucially, did not allow the problem-solving process to distract from keeping the aircraft within a safe flight envelope.

Having reached a safe altitude the flight crew completed the required troubleshooting actions, which activated an optional-fitment indication system called the back-up speed scale (BUSS). Coupled with information from air traffic control, this provided enough information for the pilots to maintain control of the aircraft and land safely.

In the following sections, this analysis discusses a wide range of factors associated with the occurrence, broadly divided into factors associated with:

• management of the take-off and flight without airspeed information
• the mud wasp hazard, use of pitot probe covers, and the aircraft being dispatched with pitot probe covers fitted
• Malaysia Airlines’ management processes.

Take-off without airspeed information

Relevant concepts

A common and significant challenge for the human factors discipline is to explain why a person does not detect or correct a problem when it appears, particularly when the indications of a problem and the right course of action appear obvious in hindsight.

Figure 48 provides a simplified representation of the activities involved in recognising and recovering from a problem. Take-off is one of the highest workload phases of flight (Lee and Liu 2003), and abnormal events occurring at this time further increase workload (Orasanu 1994). In such situations, an individual’s cognitive capacity can be reduced by stress, slowing or even halting the processes involved in recovering from a problem.

Figure 48: Activities involved in recovering from a problemSource: ATSB

Although each stage adds to the total recovery time, the more significant delays are usually the perception and assessment stages, and these delays are generally more to do with the focus of attention rather than the perception process.

During the take-off, red speed flags on both primary flight displays from 50 kt onwards unambiguously indicated that airspeed data was erroneous. This gave the flight crew about 12 seconds to detect the problem and respond before reaching the speed at which they should be ‘go-minded’ (100 kt), and a further 15 seconds before the aircraft passed the decision speed where they could no longer reject the take-off without significant risk of an accident.

In this context, the crew first had to identify the problem, either through detecting the absence of movement (or slow movement) on an airspeed tape, a discrepancy between the airspeed indications, observing the presence of a speed flag on a PFD (after 50 kt), or through one flight crewmember observing a cue and alerting the other. The nature of unreliable airspeed indications and flight crew guidance will be discussed in the following section.

Surprise occurs where there is a mismatch between new information and a person’s expectations (Landman and others 2017). It has been found that during an unexpected event, there is a delay in pilots’ response to the situation and there is also more variation in response times (Casner and others 2013). For example, when faced with an unexpected aerodynamic stall, pilots took almost 9 times longer on average to respond than when the situation was expected—as long as almost 20 seconds. It has been found participants reacted more slowly to reject a take-off when they were not expecting a significant failure (Stevens and others 2007).

Flight crew actions prior to reaching 100 kt

Flin and others (2008) state that decision errors can occur ‘when conditions change so insidiously that the operators do not update their situation assessments often enough.’ A crew would not immediately notice erroneous airspeed prior to 30 kt in the take-off, because the speed tape is not expected to move until this speed. The cue itself is very subtle: it is difficult to notice the absence of movement as well as judge the point at which the tape should move. Individuals are less likely to respond quickly to a gradually emerging situation (Landman and others 2017, Underwood and others 2013).

After 30 kt, the airspeed tape would normally begin to move and a yellow airspeed trend arrow would appear. Their absence in the period between 30 kt and 50 kt was not noticed by either flight crew member.

At 50 kt, a red speed flag would have appeared on both PFDs. The captain identified the presence of a speed problem as soon as it was clearly displayed, as indicated by the ‘speed’ statement 2 seconds after the speed flags appeared. The captain did not act on the information, and probably remained in the assessment stage, unsure of the right decision. Possible explanations for this might include:

• surprise and/or stress due to the unexpected and extremely rare nature of the problem, which had not been encountered before (stress could be indicated by the captain’s increased breathing rate and reported time compression)
• time taken to understand the full nature of the problem, possibly related to the captain’s relatively low experience on Airbus aircraft or the nature of the problem’s presentation (discussed in a later section)
• miscalculation of the severity of the problem and not projecting it forward as a future threat, therefore not justifying a rejected take-off (what might be phrased as ‘not wanting to turn a small problem into a big problem’)
• distraction from hearing an unrelated radio call very soon after noticing the problem (the flight crew need to pay attention to radio calls to identify potential conflicts).

In a 2022 article titled Training Pilots for Resilience, Airbus stated (2022):

When a flight crew is exposed to unexpected disruptions, they may experience a physiological reaction, known as the startle effect. This involuntary and uncontrollable reaction may be accompanied by a momentary loss of situational awareness resulting in a temporary deterioration in performance.

The captain’s ‘speed’ statement was relatively quiet and apparently did not gain the FO’s attention. Effective crews build shared situation models when threats arise. They assess and communicate the nature of the threat, the degree of risk, and time available (Orasanu 2010). Put simply, for a crew to be effective, both crewmembers need to have awareness of a situation, not just individually. Research has found that higher-performing crews talked more about cues that signalled the possibility of future problems, which set them up to monitor the situation closely and to establish contingency plans in case conditions deteriorated (Orasanu 1994).

Airbus have repeatedly emphasised the importance of flight crew monitoring of airspeed on take-off (Airbus 2007, Airbus 2021). The flight crew procedures require the pilot monitoring (PM) to monitor airspeed, and although there is no strict requirement for the pilot flying (PF) to do so, it is normal for them to check airspeed from time to time. The FO, who was PF, almost certainly did not perceive a problem (either by seeing a speed flag or hearing the captain’s ‘speed’ statement) until the 100 kt speed call when the crew are required to cross-check their airspeed indications.

Research has found variation in flight crew scan patterns during take-off (Harris and others 1986). Studies have also shown that there is significant variability in flight crew monitoring during take-off and that the PF spends most of the time looking out of the windscreen (Knabl and others 2018, Mumaw and others 2001). This was likely the case in the occurrence event, especially in the dark lighting conditions that prevailed.

The PF needs to focus outside the aircraft most of the time, and can only glance at the instruments, with a significant amount of potential information needing to be assimilated in that glance. There is also a task switching cost in terms of a slower response time and increased errors when changing focus and assimilating information, such as changing from ‘eyes outside’ to ‘eyes inside’ (Monsell 2003). Further, people are inherently poor at monitoring for infrequent events (CAA 2013).

Flight crew actions from 100 kt onwards

The 100 kt speed call was likely made on the basis of groundspeed, which is not a valid reference for that call and the captain did not advise the FO that groundspeed was used as the captain’s reference. The captain later did not recall making the call. Research has found that it can be difficult for people to recall events that occurred during a stressful period (Wolf 2014). The captain’s (and, later, FO’s) breathing rate was elevated, which can be another indication of stress (Veltman and Gaillard 1996).

Research by Orasanu and others (1998) of tactical decision errors made by pilots (as identified in accident investigation reports) found that about three-quarters of the errors were of the type that involved a continuation with the original plan despite cues that suggested changing the course of action. Common contributions to these errors were ambiguous dynamic conditions and goal conflicts. Orasanu and others (1998) stated:

Ambiguity and goal conflicts both imply that multiple courses of action should be entertained, first, because different readings of ambiguous cues might lead to different actions, and second, because different actions might be needed to satisfy competing goals.

In this case, the flight crew had to choose between two competing and risky options: continuing a take-off without any valid airspeed or rejecting a take-off when there was a realistic possibility that the aircraft could not be stopped before it reached the end of the runway. To add to the problem, the second option was becoming riskier with time.

Stress is one factor that effects situation assessment because reaching decisions requires projection and evaluation of the consequences of the various options (Orasanu and others 1998). Stress limits the decision maker’s ability to project the situation into the future and mentally simulate the consequences of a course of action. Orasanu and others (1998) continue by stating:

Reaching decisions [with multiple options] requires projection and evaluation of the consequences of the various options. If pilots are under stress, they may not do the required evaluations. Stress limits the decision maker's ability to project the situation into the future and mentally simulate the consequences of a course of action. …

…. Certain phases of flight induce higher levels of stress. namely those in which time is limited, workload is heavy, and there is little room for recovering from an error. These tend to be take-off and landing situations. Mistakes during these periods may have serious consequences.

Dealing with a serious and unfamiliar problem adds to this stress and interferes with the flight crew’s ability to understand, decide, and act. The flight crew’s stress and workload was indicated by their somewhat limited recall of events, the captain’s reported time compression, and later, possibly task-shedding (such as not changing frequency after take-off after being prompted).

Once aware of the problem, the FO likely went to the next step of the mental process, which was to assess the information. The captain’s 100 kt call gave the FO no indication of the existence of a problem. Until the FO performed the cross-check, the situation was normal in their mind and the FO would have been surprised to see a speed flag with no previous indication of a problem. Therefore, the FO had to assimilate the available information and (possibly) resolve the apparent contradiction between the 100 kt call and the presence of the speed flag on both displays.

The FO’s first response showed confusion (‘eh?’). The next statement might have been a suggestion to reject the take-off (as ‘[a]bort, uh?’), but the captain then said either ‘borders are red’ (possibly referring to the speed flag, which has red borders) or ‘both also don’t have’ (possibly referring to the absence of both pilots’ airspeed indications). The FO responded ‘ah’ and ‘oh no’ or ‘both no’. This exchange indicates that until about this point, the FO had not yet fully understood the problem and had not reached a decision. The FO’s increased breathing rate indicates their level of stress increased during this period.

The FO then prompted the captain for assessment or action (‘captain?’). The captain, likely still assessing the situation, did not immediately respond but then said ‘okay, check’ which did not make sense in that context, indicating continuing confusion.

Had the captain come to a decision to continue the take-off at any point, this should have been clearly commanded by calling ‘GO’ in accordance with the aircraft flight manuals. Only the captain had the authority to make such a decision; without this command, and with too little time to evaluate the captain’s responsiveness, the FO could only continue the take-off or suggest appropriate actions.

With more experience on the aircraft type, the FO had apparently arrived at a decision by this point, and said ‘go to ADR three’ (meaning to switch indicated air data to a third source). This is a step from the Unreliable speed indication procedure, which neither crewmember called for as required by the flight manual.

The FO, as PF, also did not first perform the required memory items of this procedure: pitch and thrust. The procedure required these actions to be taken if the ‘safe conduct of the flight is impacted’, and while the flight crew may have individually considered this not to be the case, they did not verbally confirm it with each other or challenge that assumption. There was no way for the flight crew to verify that the aircraft’s acceleration performance was adequate, which meant their situational awareness was not assured.

Pitching up on take-off too early slows the aircraft’s acceleration, so it is understandable why this step was not immediately accomplished. However, once it was clear the take-off would continue, the use of maximum available thrust would have enabled the aircraft to gain a safe speed and then climb to a safe altitude as quickly as possible. The FO may have also thought that a rejected take-off was still a viable option, and using maximum thrust or rotating would have effectively removed that option. In addition, the FO does not have control of the thrust levers after initially setting take-off thrust.

The FO’s next statement was indistinct on the recording. The operator interpreted it as ‘abort, abort’, which would be consistent with the FO’s recollection. If so, in the absence of specific terminology for the FO’s use in this circumstance, ‘abort, abort’ was an appropriate phrase to convey this intention. However, the indistinctness of the statement on the recording may also mean that it was not spoken clearly enough for the captain to understand. Also, it was spoken immediately after the suggestion to ‘go to ADR three’ so a suggestion to reject the take-off at this point would be unexpected. In any case, the captain did not respond.

Throughout this period, with no airspeed data available and only groundspeed and outside visual cues available, one or both of the flight crew were likely to be considering how close the aircraft was to the decision speed. As the aircraft accelerated, the flight crew had limited information to determine whether they had already passed, or were about to pass, this point. Harris and Khan (2003) found that once an aircraft approaches the decision speed, there is an increase in flight crew response time due to the increased difficulties of making a decision under time pressure. This may also be associated with a narrowing of perceptual scan, fixation on inappropriate solutions, and reduction of working memory capacity (Stokes, Kemper, and Kite 1997, referenced in Orasanu and Fischer 1997).

The flight crew’s process of perception, assessment, and decision-making was delayed, which took the crew past the period when the take-off could have been rejected with virtually no risk and resulting in a situation where the comparative risks of continuing or rejecting were uncertain.

Just 15 seconds after the 100 kt speed call, the aircraft passed the decision speed, and the flight crew could no longer reject the take-off without likely overrunning the end of the runway. Likely uncertain of the aircraft’s speed, the captain did not make the required V₁ call even though groundspeed was available as an approximation. This may be due to ongoing confusion, and is also consistent with research that shows that people are likely to shed tasks when under a high workload (Wickens and others, 2013).

It is very likely that the FO decided that it was safer to rotate than to reject at about this time, and was able to commence the rotation at the correct time through judgement and experience (and possibly assisted by reference to groundspeed).

In summary, the flight crew’s inaction when faced with an unreliable airspeed indication on take-off can be explained by a range of factors. Surprise, uncertainty, time pressure, and ineffective communication probably led to stress and high cognitive workload, particularly after 100 kt. In turn, this led to a delayed, and ultimately absent, decision.

Most critically, the captain was aware of a problem but likely unsure how to manage the situation; the FO was not aware of a problem until the appropriate decision was much less clear. Furthering these issues, the two crewmembers made multiple remarks without clearly and assertively identifying the problem, proposing a solution, or responding to each other. This limited communication was coupled with and contributing to a limited capacity for each pilot to individually understand the problem, which delayed their response until the choice to reject the take-off was no longer available.

Management of the flight after take-off

Although by the time of lift-off both flight crew members recognised the existence of an airspeed indication problem, neither made the required ‘unreliable speed’ call and there was no coordinated action to apply the Unreliable speed indication procedure until about 3 minutes after take-off.

During the intervening period, the FO maintained normal pitch and thrust settings, instead of applying the 15° nose-up pitch attitude and take-off/go-around (TOGA) thrust memory items of the Unreliable speed indication procedure. In the absence of any airspeed indication and in alternate law with reduced flight envelope protection, it would have been prudent to apply these memory items to establish a safe speed and climb gradient as soon as possible. Maintaining a pitch attitude that was potentially lower than normal in the absence of airspeed indication also risked accelerating past the maximum flap and landing gear extension speeds.

Without either crew calling for the Unreliable speed indication procedure (which had troubleshooting steps including switching air data), the FO twice more asked for the air data to be switched to a third source, and one of the flight crew did so with the FO’s air data source at about the same time. It is not clear whether the other crewmember was aware of this action through non-verbal communication. While the action did not pose an immediate threat to safety, troubleshooting outside of established procedure can be hazardous, and doing so without the confirmation of both crew risks a crewmember losing awareness of the aircraft’s ongoing status and flight path.

Perhaps distracted by the erroneous airspeed problem, the flight crew did not carry out the After take-off/Climb procedure which is still required to be conducted in abnormal conditions to ensure a safe aircraft configuration. Although not having an effect in this case, this bypassed some important checks of aircraft configuration that could have led to other problems later in the flight.

The flight crew advised ATC of the problem and established a safe altitude before carrying out troubleshooting and applicable procedures. The flight crew’s workload was reduced by:

• their request for a block level, granted by air traffic control, rather than a specific level
• provision of groundspeed information and vectoring from air traffic control
• following standard procedure and effective crew resource management principles.

Once activated, the Airbus back up speed scale (BUSS) gave the flight crew immediate indication of the aircraft’s safe speed limits. This almost certainly resulted in a significantly lower workload than they had during the climb and working from pitch-and-thrust tables. This and other occurrences, such as the 2009 A330 accident over the southern Atlantic Ocean, illustrate the safety value of the BUSS.

The reduction of workload greatly helped the flight crew in the ongoing management of the remainder of the flight. Apart from not establishing the correct pitch and thrust settings immediately after take-off, the flight crew managed airspeed and altitude within safe limits to a reasonable extent based on the limited data they had available. The aircraft did not approach a stall or descend too close to water or terrain at any point. Although the aircraft probably exceeded the maximum configuration speed on about two occasions, it was by a small amount for brief periods.

Air traffic controller response to urgency call

No reason could be established for the tower controller not hearing the PAN-PAN call. There had been enough time since the preceding telephone call for it to no longer be a significant distraction, particularly for an air traffic controller well-used to multitasking. There were no other known distractions or issues that could have interfered with the controller’s perception of the urgency call.

It is possible that, having just asked the aircraft to transfer to the departures frequency and received acknowledgement, the tower controller may have unintentionally disregarded the next transmission from that aircraft as being on another frequency or otherwise being unrelated to the tower controller’s duties, and later forgotten about it.

Take-off airspeed monitoring and decision-making

Introduction

Flight crew monitoring and rapid decision-making during take-off are critical. Flight crews need to detect a problem and arrive at the safest decision based on the information presented to them and their previous training. Unfortunately, there are sometimes situations when the correct course of action is not immediately obvious, and flight crews need to consider the risks of each option and choose between them. This is a significant challenge in unfamiliar, time-critical situations such as the loss of airspeed indications on take-off.

Air data problems can manifest in many different ways that can be hard to differentiate and diagnose quickly. The instrument indications may be obviously false or may appear to be normal but are actually false. Airspeed displays may differ but remain somewhat close in value, which can be particularly difficult to detect when they are rapidly changing. In these situations, crews can be unsure about the very existence of a problem. The process becomes even more difficult when considering the potential for multiple failures, such as when two sources agree: the third might be correct but could be untrusted. Airbus stated (2007):

…it should be emphasized that identifying an unreliable speed indication is not always obvious: no single rule can be given to conclusively identify all possible erroneous indications and the display of contradictory information may confuse the flight crew.

When presented with a clear indication that airspeed was unavailable, the occurrence flight crew still experienced uncertainty and did not actively decide on a response until the alternative (rejecting the take-off) was no longer available. The occurrence shows that, even when flight crews are faced with unambiguous displays, a range of human factors can interfere with expected behaviour and result in suboptimal actions. A greater proportion of crews will make errors when presented with information that needs to be evaluated.

This occurrence involved the concurrent failure of three air data probes due to a common cause. While this particular failure mode (multiple covered pitot probes) is extremely rare, failure of one or more airspeed systems on take-off occurs from time to time and is likely to be more difficult to identify quickly. Experience has shown that these failures occur in a variety of ways—with airspeed that reads too high or too low, and sometimes with multiple systems. Diagnosing an airspeed problem quickly enough to reject a take-off at low speed has proven challenging for many crews. The occurrence flight crew had not received training that involved unreliable airspeed on take-off.

Flight crews need to become aware of an airspeed issue as early as possible in the take-off. They then need to make the appropriate decision quickly depending on the aircraft’s proximity to the ‘decision speed’ (V₁): the last point at which the crew can reject the take-off and still come to a stop before the end of the runway. Even before V₁, however, the hazards of a rejected take-off are still present: ineffective or overheated brakes, burst tyres, and occasionally runway veer-offs have been encountered.

Rejecting a take-off becomes much more hazardous as the aircraft’s speed increases. The United States Federal Aviation Administration (1993) found that most accidents that occurred during a rejected take-off were from the very small proportion (2%) that were rejected above 120 kt. An earlier rejection is safer for two primary reasons: at the initial application of brakes the aircraft’s speed is lower, limiting most of the adverse effects, and it has travelled less distance along the runway. This is the basis of Airbus’ philosophy for flight crews to be ‘go-minded’ past 100 kt—a crucial point during the take-off.

The safest response to unreliable airspeed on take-off mainly depends on the aircraft’s speed at which the problem is detected. Airbus analysis of past occurrences suggests that unreliable airspeed indications should almost always be detectable before the aircraft has reached 100 kt. At these low speeds, immediate action is needed if the take-off is to be rejected. However, statistics indicate that some flight crews either undergo similar decision-making delays as the occurrence flight crew, or do not become aware of the problem until late in the take-off, when they are supposed to be ‘go-minded’. This places them in a difficult position where they have to make a quick decision while facing a potentially serious and unfamiliar problem.

Normally, both flight crew check their respective airspeed displays and verify that they are close to 100 kt, or by the time the PF checks, just past it. Although the captain had detected an airspeed issue earlier, this is when the flight crew truly began to assess the situation but they were then faced with a very limited amount of time in which to decide what to do. It is likely that this time pressure applied in other occurrences where flight crews continued the take-off, as well as other factors such as uncertainty over whether an airspeed problem actually exists.

In fact, with the 100 kt airspeed cross-check necessarily occurring in the high-speed regime, pilots need to make the decision more quickly and may be more inclined to continue if they do not detect unreliable airspeed until then. In an Airbus A330, the decision speed can be as low as about 120 kt, potentially requiring the flight crew to call, check, respond, decide and act in just a few seconds. Some other aircraft types have an airspeed cross-check at 80 kt.

Following an investigation involving a Boeing 737-800 with a faulty angle-of-attack sensor, where two take-offs were continued after the flight crew saw an airspeed discrepancy at the 80 kt speed check, the French Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile reported (BEA2018-0071.en):

The take-off is a dynamic phase during which the crew may not have the resources to identify all the possible consequences of a failure of the speed indicator. Given the importance of the speed indications to continue the flight, a doubt as to this parameter should incite the crew to envisage rejecting the take-off when this is still possible.

Following two low-speed rejected take-offs due to unreliable airspeed in 2021, the United Kingdom Air Accidents Investigation Branch (AAIB) noted (AAIB-2736):

The pilots of G-EUUO observed that, at the unusually low operating weights associated with low passenger numbers, the Airbus A320 SOP [standard operating procedures] 100 kt check can be very close to V₁, leaving little time for a rejected takeoff decision if the speed anomaly is only detected at that point. The equivalent speed check on the Boeing 777 is made at 80 kt. The recorded data traces for the rejected takeoffs showed that both aircraft briefly continued to accelerate after their thrust levers were retarded. The investigation was made aware of a similar incident at Luton Airport where a lightweight Airbus A319’s takeoff was rejected at V₁ (109 kt), but before the retardation devices overcame the aircraft’s residual acceleration, its airspeed peaked at 120 kt. While its speed exceeded V₁ during the rejected takeoff, the aircraft’s relatively light weight meant that there was more than sufficient runway stop margin available.

This emphasises the importance of flight crews being able to detect the condition early in the take‑off and then quickly make an appropriate decision. Pilot awareness and decision-making are two of the key factors that control whether a flight crew continue or reject a take-off when faced with unreliable airspeed, and both were involved in the occurrence event. These factors will be discussed in the following sections, as well as analysis of the flight crew’s non-technical skills (NTS) training to evaluate whether this might have affected their performance.

Occurrence data

Before 2020, when unreliable airspeed occurrences apparently increased more than tenfold over the previous average (largely due to aircraft having been in storage), Airbus flight crews encountered unreliable airspeed on take-off at least about once a year. It appears that in most cases of serious unreliable airspeed occurrences (that is, other than slight discrepancies) where the take-off is continued, flight crews turn back, indicating that if they become aware of unreliable airspeed while still able to reject the take-off safely, most flight crews would do so in the absence of confounding factors. This suggests that a deliberate decision to continue would not be common, and probably mostly associated with relatively minor airspeed failures (such as slight discrepancies).

Overall, although unreliable airspeed is a potentially hazardous condition, historic occurrences suggest that pilots have a varying response to airspeed anomalies on take-off. In at least one case, an Airbus flight crew rejected a take-off at the decision speed when one display was incorrect. There were several occasions where flight crews in various aircraft types continued a take-off with one or more erroneous airspeed displays, either because the issue was not detected while it was still safe to reject the take-off, delayed flight crew response to an observed problem, or because the flight crew decided to continue.

A combination of these factors was involved in the occurrence event: the captain was aware of a problem initially, while the FO was not aware of a problem until the aircraft’s speed was past 100 kt. The fact that a decision to continue or reject was not made indicates the presence of factors that affected or delayed decision-making throughout the take-off, as well as with factors that affected the FO’s initial awareness.

The failure of a single airspeed source is significant enough for Airbus to recommend rejecting the take-off if identified at the time of the 100 kt cross-check (Airbus 2021) or before the decision speed (Airbus 2006). Occurrences involving multiple unreliable airspeed indications should generally be more readily detectable than single erroneous indications. Once the situation is detected, flight crews would be more likely to reject a take‑off because of the increased risk of flight with multiple failures. Therefore, it would be expected that these situations would most often result in a low-speed rejected take-off.

However, only 1 of 8 occurrences of multiple erroneous airspeeds on take-off has resulted in this outcome.^[77] Five of these occurrences involving multiple unreliable airspeed indications were continued, including the occurrence flight, and a further two were rejected past 100 kt.

More broadly, Airbus records show that, of 55 occurrences involving single or multiple unreliable airspeed indications on take-off, 19 (35%) were continued. While there was no data available for 2 (4%) of these, the remainder comprised:

• 2 (4%) with erroneous airspeed on the integrated standby instrument system (ISIS)
• 8 (15%) with erroneous airspeed on one of the PFDs
• 7 (13%) with an audible alert and ECAM message that appeared at 80 kt.

The proportion of take-offs rejected in the high-speed regime (above 100 kt) is not known but these have occurred and add to the proportion of occurrences with undesirable outcomes. Separate data indicates that in the last decade, at least 6 unreliable airspeed indications were not detected until after 100 kt, and 2 of these were not detected until V₁.^[78] Flight crew responses were mixed, with half of each group rejecting the take-off and the others continuing.

This strongly indicates that in many cases either the erroneous indications were not clear enough to the flight crew or because their decision-making was not optimal. It further suggests an inconsistency in flight crew responses.

Following the two low-speed rejected take-offs due to unreliable airspeed, the AAIB reported (AAIB-2736):

As a precaution, the crews proactively took things a little slower, extended their briefings and placed extra focus on aircraft external checks and cockpit switch selections. They reported that this approach was in line with their company’s “defensive operations” policy which had been implemented as mitigation for reduced pilot recency.

On the other hand, the AAIB also stated:

…one pilot considered that reduced recency had caused them to initially question their fault diagnosis, prompting them to seek additional information before confirming the failure.

Unfortunately, the available occurrence records are not detailed enough to permit a review of the speeds at which flight crews become aware of a problem and evaluate the reasons for their actions. Further study may be beneficial.

Nevertheless, this limited occurrence data indicates that at least a third of erroneous airspeed occurrences result in an undesirable outcome (continued take-off with erroneous ­­airspeed, or rejected take-off at high speed), and that the proportion worsens with the number of erroneous indications. The reasons are currently unclear, as airspeed monitoring—particularly on take-off—is a fundamental and extremely important pilot skill, but likely to involve delayed detection and/or decision-making.

Flight deck indications and flight crew guidance for unreliable airspeed on take-off

The current European Certification Specifications (CS) 25.1322 for transport category aircraft require a warning indication if ‘immediate corrective action is required’, and ‘timely attention-getting cues through at least two different senses by a combination of aural, visual, or tactile indications’ for all warning-level alerts.

This requirement does not apply retroactively and certification of the A330 preceded it. In many situations on take-off, indications of an airspeed problem are only presented visually. Although the condition is likely to require immediate corrective action (on take-off), and the speed flag is red (the colour associated with warning indications), there are no associated audible alerts and the display itself is static, limiting its capability to draw attention (the speed flag also only appears once groundspeed is above 50 kt and does not appear on the ISIS). Similar limitations exist for inconsistent airspeed alert messages, due to the relevant alerts being inhibited during take-off or requiring differences to exist for relatively long periods. It is important to get the crew’s attention when, and only when, an action is necessary to cope with a failure or to cope with a possible future failure (Brière and others 2001).

Recognition of auditory warnings is improved in comparison to visual warnings in situations where the pilot is required to visually attend to more than one thing a time, because the pilot may not be looking in the direction of a visual display (Stevens and others 2006). For this reason, auditory rather than visual warnings are often used to convey information in emergency situations (Doll and Folds, 1986). An auditory warning would have likely gained the PF’s attention in this occurrence, and probably also in other occurrences.

In addition to gaining a flight crew’s attention, alerts can help inform the flight crew of the severity of the situation. Flight crews ‘must be able to differentiate between situations that are detrimental to operational safety, and those that are not’ (Airbus 2014). Orasanu and others (1998) suggest that flight crews might ‘press on’ with an original plan in the face of cues that suggest a change would be warranted, mediated by an underestimation of the risk associated with the problem and a failure to evaluate the possible consequences of continuing or adopting a different course of action. They add that ‘the evidence must be unambiguous and of sufficient weight to prompt a change of plan.’

Decision types fall into two subgroups depending on whether a prescriptive rule exists that defines a situationally appropriate response; if not, the decision primarily relies on the pilot’s knowledge and experience (Orasanu and Fischer 1997). With regard to deciding whether to continue or reject a take-off based on predefined rules, Orasanu and Fischer state:

The crucial aspect of the decision process for rule-based decisions is accurate situation assessment. The major impediment is ambiguity. Such decisions are often made under high time pressure and risk; thus, the [aviation] industry has prescribed appropriate responses to match predictable high-risk conditions. Once the situation is recognized, a fast response may be required for safety.

In other words, there needs to be enough unambiguous information for the flight crew to identify the problem and apply the appropriate rule. Initially, the captain saw indications that might have been unambiguous in the sense that the nature of the problem (absent airspeed indications) was apparent, but the problem itself—not the indication—was ambiguous because there was no prescriptive rule for responding to it. At the time, the optimal response was not clear to the captain. While the captain probably had some appreciation of the importance of the situation when it arose, as indicated by an increased breathing rate, an auditory or otherwise more prominent warning may prompt a more automatic response to reject the take-off immediately.

The flight crew’s situation assessment difficulties continued once the FO became aware of the problem: by this time, the flight crew needed to jointly assess and decide on a problem with outcomes that were both potentially serious now that the aircraft was approaching V₁. Any other flight crew who do not observe unreliable airspeed until the 100 kt cross-check would also be in this situation.

Orasanu and Fischer (1997) add:

‘Ill-structured’ problems entail ambiguity, either in the cues that signal the problem or in the available response options. Cues may be sufficiently vague or confusing that the crew cannot identify the problem (‘situational management’ decisions), or crews do not know what to do even if the problem is understood (‘creative problem solving’ required).

In its Safety First magazine, Airbus justifiably suggest rejecting a take-off even when there is a single airspeed indication failure, as long as the aircraft is below the decision speed. In 2021 correspondence with ATSB, Airbus advised that unreliable airspeed should not be a reason for rejecting a take-off above 100 kt. As guidance for responding to unreliable airspeed on take-off is not part of the formal documentation provided to operators, these views may not be universal.

According to the Airbus flight crew techniques manual, a rejected take-off should be seriously considered if any electronic centralised aircraft monitor (ECAM) warning or caution is activated in the low-speed regime (below 100 kt). This emphasis on ECAM warnings and cautions is reinforced by the unreliable airspeed guidance, which states that the air data systems ‘detect most of the failures’ affecting the airspeed indications and that these failures ‘trigger the associated ECAM alerts.’ Thus, a flight crew is, by design, less likely to seriously consider rejecting a take‑off unless presented with an ECAM alert, fire, loss of thrust, or other obvious danger signals.

In the absence of alerts that convey the urgency of a situation as well as its nature, it can take a flight crew several seconds to understand and react—possibly more time than they have, especially if a failure occurs close to or after the decision speed.

A330 flight crews are provided a list of conditions for which they would be expected to reject a take-off after reaching 100 kt:

At these speeds [above 100 kt], the Captain should be “go-minded” and very few situations should lead to the decision to reject the takeoff:

1.    Fire warning, or severe damage

2.    Sudden loss of engine thrust

3.    Malfunctions or conditions that give unambiguous indications that the aircraft will not fly safely

4.    Any red ECAM warning

5.    Any amber ECAM caution of the ENG [engine] system or the F/CTL [flight control] system.

Although a pilot may not have these specific situations in mind during the take-off, they would likely have a reasonable understanding of the types of failure that should result in a rejected take-off. In addition, any warning received during the period of take-off from 80 kt indicated airspeed ‘must be considered as significant’. Training in rejected take-offs is likely to be predominantly associated with ECAM alerts and engine failures, which provide clear indications and prompts.

While the loss of airspeed indication is hazardous, the manner of its presentation is usually less prominent than other dangers like a fire warning or loss of engine thrust. There is often no ECAM alert or master warning/caution. There may be a discrepancy between multiple indications—an indication that may not be detected by flight crews until the speed check at 100 kt— or sometimes the appearance of a speed flag on the affected display. To a pilot, these may not be ‘unambiguous indications that the aircraft will not fly safely’, especially to those unaware of the manufacturer’s advice to reject the take-off if the crew are confident that the aircraft is below the decision speed.

The list of situations that should result in a rejected take-off did not address airspeed indication failures. There was also no instruction or guidance in the flight manuals on the type or number of unreliable airspeed indications for which a take-off should be rejected, or whether this decision should change if the crew is in doubt over the aircraft’s proximity to the decision speed.

Furthermore, the Unreliable speed indication memory items are not always applicable during take-off: if the airspeed is low enough to safely reject, crews should do so, and if in doubt, application of TOGA thrust is appropriate, but the application of 15° pitch-up too soon would only slow the aircraft’s acceleration.

If a flight crew is uncertain of the aircraft’s airspeed, it would probably be safer to assume the decision speed has been exceeded than to reject a take-off past that speed, but this is not a desirable situation.

In summary, the objective should be for flight crews to detect unreliable airspeed as early as possible in a take-off and to provide them with enough information (at the time and through training) to make an immediate decision in most circumstances. Relying on the 100 kt cross-check may not be sufficient, as it takes the aircraft into the high-speed regime where a rejected take-off is a more significant, and potentially risky, event. The current A330 flight deck indications of unreliable airspeed are not prominent enough to reliably gain a pilot’s immediate attention as well as adequately convey sufficient unambiguous information to allow for quick comprehension of the severity of the problem.

Further, flight crew training and guidance for unreliable airspeed on take-off may not equip them with sufficient knowledge to make a decision in the limited time they have available.

These concerns are not unique to the A330 or Airbus aircraft, and the lessons about flight crew guidance and unreliable airspeed indications are almost certainly relevant to a range of aircraft types. Accordingly, the ATSB encourages all manufacturers of larger air transport aeroplanes to consider what types of unreliable airspeed events can occur, how the information is presented to flight crews, and what responses are the safest in different phases of the take-off and in a range of potential situations. Ultimately there needs to be sufficient assurance that flight crews become aware of and understand how to appropriately respond to unreliable airspeed on take-off in a timely manner.

Flight crew non-technical skills training

The ATSB reviewed past assessments the flight crew had received in non‑technical skills (NTS), such as communication, leadership, assertiveness and receptiveness. Although both pilots required occasional briefings, this did not indicate a history of substandard NTS performance in either pilot.

The NTS grading methodology was also considered. Unlike some other operators, Malaysia Airlines graded flight crew proficiency in NTS separately to technical skills. This approach provides significant advantages over evaluating NTS only as markers for the performance of technical tasks. For example, it provides opportunities for more in‑depth evaluation and feedback of NTS.

However, the use of a 3-point scale for these NTS somewhat limited the operator’s capability to capture slight but important differences in NTS performance between sessions and between pilots. With limited granularity in grading scales, it can be difficult to detect whether an individual’s performance had improved or degraded over time. There is also no visible scope for improvement once a ‘satisfactory’ level is reached: pilots who receive limited feedback about their individual NTS strengths and weaknesses might be less likely to recognise and work on the areas of underperformance and may have less motivation to improve beyond a base level of competency. Furthermore, evaluators may not identify consistently marginal performance.

To address this, Holt and others (2001) suggest using a 4- or 5-point scale for NTS. Similarly, two of the most well-known marker systems are the University of Texas system developed by Robert Helmreich and colleagues (Flin and O’Connor 2001), which uses a 4-point scale, and the NOTECHS (non-technical skills) scheme (Joint Aviation Authorities 1997) using a 5-point scale. Baker and Dismukes (2002) propose enhancing rating accuracy by providing evaluators with NTS performance examples using a 4‑point scale (excellent, standard, debriefed, and repeat).

In flight training, it can be difficult to detect a change in performance or identify when performance is consistently acceptable but not to a high level of proficiency, especially when multiple trainers are involved. Organisations can use standardised NTS assessment guidelines to reduce subjectivity, helping trainers recognise behavioural markers consistently so that they can then address the problem. Doing so successfully requires a mature understanding of the standards by the trainers/assessors and crew, so this level of standardisation needs to be developed over time. If done too early, there can be too much inconsistency in the application of finely-graded standards, making comparison and tracking even less reliable.

Notwithstanding this minor limitation, the Malaysia Airlines method of grading NTS was probably as or more effective than the method used by the majority of other reviewed operators.

Airport operational information

The operator’s flight operations department used the airport operational information (AOI) published by Lido for an assessment of the hazards that existed at Brisbane Airport before services recommenced. The AOI was also used by pilots on an individual basis as airport reference guidance. However, there was no information about the mud wasp activity affecting pitot probes and the recommendation to use pitot probe covers in the AOI when referencing Brisbane Airport.

The absence of relevant hazard information could mean that operators generally might not know about and address important hazards at an organisational level. Additionally, as the use of pitot probe covers in airline operations is primarily a maintenance activity, pilots who are aware of this hazard are more likely to note the presence (or absence) of pitot probe covers, may request them to be fitted, and could be more prepared for the potential for airspeed problems on take-off.

Lido drew on information from the Aeronautical Information Publication (AIP) for inclusion in the AOI. Along with the wasp hazard, other safety-related information in the AIP was absent from the AOI. For example, the AIP stated that various kinds of large bird were active at Brisbane throughout the year but the AOI stated that bird activity was only during part of the year.^[79] The Lido AOIs for other selected Australian airports had not reproduced a small number of minor safety-related items, including one military traffic hazard.

Internal Lido guidance for the development of AOI content unambiguously required caution notes for bird and military traffic hazards, and for ‘any kind of dangers officially referenced in source documents’ such as the mud wasp hazard.

The absences led the ATSB to review the Lido process for choosing what types of safety-related information was promulgated in AOI, and how that information was reviewed before publication. No obvious problems were identified with that process or the required expertise of the people involved, and no other reason for the identified absences was established.

However, the ATSB notes that the information contained in the AIP presents safety information that local subject matter experts consider to be important; any process with the potential to alter or omit such information before it is presented to pilots could increase risk.

Risk controls associated with the use of pitot probe covers

Introduction

Pitot probe covers are normally fitted to aircraft when parked overnight or for extended periods. Fitting covers during turnarounds is not common and requires the use of controls to ensure they are removed prior to departure.

During the planning for resumption of flights to Brisbane after a cessation of over 2 years, the operator planned to use pitot probe covers as a risk mitigation strategy for the mud wasp risk at Brisbane Airport. However, a complete strategy for their fitment and removal was not implemented. As a result:

• there was no procedure or guidance for front-line personnel (the operator’s engineers and the support engineers) to use pitot probe covers at Brisbane Airport during turnarounds
• flight crew and the operator’s engineers were not informed about the mud wasp hazard or the recommended use of pitot probe covers specific to Brisbane Airport
• use of pitot probe covers at Brisbane was intermittent, so the operator’s aircraft were often exposed to the potential for pitot probe contamination from mud wasps during turnarounds.

Furthering these problems, engineering arrangements in Brisbane were somewhat unusual: the routine use of a travelling engineer for aircraft certification, who were required to board the same aircraft they were working on before departure. This working environment gave rise to the risk of miscommunication and miscoordination among ground crews, leading to some important tasks being overlooked or incomplete.

A 2009 ATSB report, Ground operations occurrences at Australian airports 1998 to 2008, stated that the relatively low ‘industry-wide attention on risk controls to improve safety in ground operations’ had led to little change in the frequency of adverse ground operations events in Australia over the previous few decades. The report stated:

The most common contributing factor to ground operations occurrences were individual actions. For occurrences between 1998 and 2008, these most frequently involved action errors, where a person deviated either from plans or standard operating procedures. Common examples were towbar connection procedures and pushback errors, like turning back too sharply with the tug and damaging the nose or landing gear of the aircraft. Less frequently, individual action errors were associated with a violation, information, or decision error.

A number of ground crew errors were involved in this occurrence, across a variety of categories. Certain themes underlie some of these errors—at times, some personnel exhibited a lack of diligence, attentiveness, communication, and ownership of important tasks.

However, personal factors were not sufficient to explain why the aircraft was allowed to depart with pitot probe covers fitted. Individual errors and undesirable personal factors are suppressed in a well-defined work environment where individual responsibilities are clear, when tasks do not change hands, and when the practical implications of front-line work have been thoroughly considered. The following sections explore how these errors were allowed to contribute to the occurrence by the environment in which they were made.

Use of pitot probe covers

Fitment of pitot probe covers prior to the flight

Engineering support staff at Brisbane Airport had become accustomed to fitting pitot probe covers to various airlines aircraft, following individual airline requirements, CASA advice, and probably airport advice to a point that it became normalised practice. In the absence of any information to the contrary, the support engineer believed that pitot probe covers were to be fitted to all aircraft during turn arounds in Brisbane, including Malaysia Airlines aircraft.

On the other hand, the Malaysia Airlines LAE knew none of this. Following the fitment of the pitot probe covers, the support engineer reportedly told the LAE that pitot probe covers had been fitted. At that time the LAE did not acknowledge what had been said or make an entry in the technical log as a risk control to ensure the pitot probe covers were removed before flight. The LAE did not later recall being informed of the pitot probe covers by the support engineer and likely did not hear or assimilate the information.

The use of closed-loop communication—seeking, receiving, and understanding an acknowledgement—is a way to ensure effective communication and has been found to reduce error (Foushee and Manos 1981). In this case, the support engineer did not receive or seek confirmation that the message about pitot probe covers was understood.

Furthermore, the support engineer was not permitted to enter the details of the fitment of pitot probe covers into the aircraft’s technical log and did not press the issue after seeing that the LAE did not do so. The support engineer may not have seen it as a sign that the LAE did not hear the support engineer’s statement.

As there was no technical log entry, there was no prompt for the LAE or flight crew to recall the presence or confirm the absence of pitot probe covers when the log was later checked.

The support engineer was needed for the removal of the pitot probe covers before dispatch, either to do so personally or escort the LAE for security purposes. However, it is unlikely that the support engineer thought about the practicalities of removal at the time the covers were fitted, or when deciding to work with another aircraft for a while. The support engineer likely forgot about the need to remove the covers.

The support engineer then left the aircraft to work on another aircraft. This made it less likely that the support engineer would recall the presence of pitot probe covers later (having moved onto other tasks) and removed any opportunity of seeing them during incidental activities around the aircraft. In effect, the support engineer tacitly passed responsibility for the covers onto the LAE, who had not accepted that responsibility.

Fitment of pitot probe covers on other occasions

In the absence of guidance from Malaysia Airlines or written procedures from AMSA, the use of pitot probe covers for the operator’s aircraft was inconsistent. Pitot probe covers were used for 3 out of 19 turnarounds prior to the occurrence for which technical logs were available (it is possible, though not highly likely, that pitot probe covers had been used on other occasions without a technical log entry being made).

Since AMSA engineers were not controlling or conducting all of the engineering activities, the use of pitot probe covers increased the likelihood of miscommunication or error because it split responsibility for the task between the AMSA engineers (who supplied and fitted pitot probe covers but could not make technical log entries) and the Malaysia Airlines engineers (who had limited awareness of the need for pitot probe covers at Brisbane).

Pre-flight walk-arounds

Introduction

There were effectively five walk-around checks required between the aircraft’s arrival and its dispatch, four of which did or should have taken place during the period in which the pitot probe covers were fitted. These were the:

• engineering maintenance walk-around inspection
• flight crew walk-around
• engineering pre-departure walk-around inspection
• dispatch walk-around.

The procedures specifically included checks of the pitot probes and should have presented multiple opportunities for the covers to be detected and removed, in addition to incidental opportunities during general ground activities. In each case, individual errors and violations prevented the detection and removal of the pitot probe covers.

Engineering maintenance walk-around inspection

While conducting the first part of the transit check the LAE saw that the pitot probe covers were fitted to the aircraft. According to the LAE, this was unexpected as they were not aware of any instances where pitot probe covers were required to be fitted during turn arounds and they had not been informed of any requirement to fit pitot probe covers in Brisbane. The LAE intended to ask the support engineer to remove them. However, the support engineer was not nearby at that time so the LAE decided to continue with the transit check tasks. Subsequently the LAE did not remember to request the removal of the pitot probe covers when the support engineer returned to the aircraft a few minutes later. Any reasons why the LAE did not remove them personally were not explored.

Prospective memory is the suspending or deferring of a task with the intention to return to it later or forming an intention to add a new task at a later time. A failure of prospective memory has occurred when a person does not return to complete the task as intended. Prospective memory failures often occur with tasks that are not habitually performed (Dismukes 2008). In this case, the LAE did not routinely use or need to remove pitot probe covers, and never used them during turnarounds.

Another reason why people forget to complete tasks as intended is the absence of reminder cues (Dismukes 2012, Reason 2016). There were no cues that may have prompted the LAE’s memory. The continuing presence of the pitot probe covers went unnoticed, likely because the LAE was working elsewhere or because the streamers were outside of the LAE’s immediate vision, the matter was not brought up in later discussions with the support engineer and flight crew, and there was no entry in the aircraft’s technical log that was required to be cleared when the LAE certified for the transit check.

Engineering pre-departure walk-around inspection

The pre-departure walk-around inspection (required as part of an engineer’s transit check) and dispatch walk-around (required to be conducted by the person conducting dispatch duties) have a similar purpose: to check the aircraft for any damage that may have occurred while on the ground, and to ensure that the aircraft is correctly configured for flight – for example, that doors and panels have been secured, any pins, blanks and covers have been removed, and that the aircraft is clear of equipment.

Although the engineers and ground handlers were both required to perform separate final walk-arounds, only one walk-around is required in cases when engineering and dispatch duties are conducted by the same engineer. That is, the general airworthiness functions of the check can be combined with the check of the aircraft’s readiness for flight. Accordingly, there is often only one ‘last’ opportunity to identify any problems with the aircraft before it departs, such as unlatched doors or the presence of pitot probe covers. In this case, the operator’s arrangements meant that both checks were required.

The LAE did not conduct a pre-departure walk-around inspection, which might have prompted a recall of the presence of pitot probe covers. The LAE had not conducted the required pre-departure walk-around inspection for the previous turnaround either, even though they were not travelling on that flight.

The LAE, not having been informed of how responsibilities were to be shared, assumed that the support engineer would conduct the pre-departure walk-around, without confirming that was the case. The LAE was not aware that the ground handling organisation was conducting dispatch coordination duties, so was not aware that the support engineer was not responsible for a pre-departure walk-around inspection and was not required to stay with the aircraft until dispatched. Without this knowledge it is likely that the LAE did not see a need to tell the support engineer to perform a pre-departure walk-around, reportedly assuming that it was part of the support engineer’s responsibilities. It is unclear whether the LAE was aware that the other AMSA engineer on the previous turnaround also did not perform a pre-departure walk-around.

Meanwhile, the support engineer’s understood function was only to assist the LAE as instructed, and to provide access to, and escort the LAE around the tarmac. The support engineer was free to leave once the LAE advised that there were no further tasks.

Therefore, both engineers had different understandings of their respective roles with regard to this check. They did not confirm their responsibilities or intentions with each other or challenge their individual assumptions.

They were placed in this position by engineering arrangements that were unusual by most standards but had become routine in Brisbane. On every second turnaround, the operator required an LAE to conduct a transit check and board the same aircraft for the return flight. Thus, the LAE was required to board the aircraft before the final check of the aircraft’s readiness for flight and could not check for security of the cargo and passenger doors. This meant that the transit check could only be completed in its entirety with the support engineer performing the last few steps, which probably contributed to the LAE’s assumption that the support engineer would conduct a final walk-around.

The LAE boarded the aircraft about 36 minutes before the aircraft was dispatched following the completion of aircraft refuelling, citing the need to board the aircraft before its international flight. While this reasoning is understandable, there was no compelling reason for the LAE not to perform a partial check of the aircraft’s readiness for flight during this period, omitting a small number of items like the cargo and passenger doors. This could also have been done alongside the captain during the flight crew walk-around.

Had the LAE conducted a final walk-around, they most likely would have seen the pitot probe covers again and removed them or had them removed, as the aircraft was close to being dispatched.

More generally, in the absence of any other agreements or guidance, AMSA engineers would no longer be directly responsible for the dispatch walk-around, and there was no explicit requirement for them remain with the aircraft until pushback. This indirectly led to the omission of the engineering pre-departure walk-around inspection, which engineers would normally combine with the dispatch walk-around, but now there was a situation where both engineers might not (and did not) realise that the engineering inspection was not done.

Flight crew pre-flight walk-around check

The brief amount of time the captain’s torch dwelled over the pitot probe, and the omission of other check items of the walk-around, are strongly indicative of reduced attention in general. During the walk-around, the captain briefly shone the torch on one of the aircraft’s left pitot probes, which had covers fitted at the time. The captain did not recall the presence of the pitot probe covers when interviewed after the occurrence, and likely overlooked them partly as a result of this reduced attention.

Research in visual attention found that people rarely cognitively perceive what they are looking at unless their attention is directed to it in a phenomenon sometimes known as ‘inattentional blindness’ (Mack 2003). The conduct of the captain’s walk-around reduced the likelihood that abnormalities would be noticed.

Another factor that is likely to be involved is expectation. Expectation has an influence on perception: people see what they expect to see (Hawkins 1987). The operator had not advised flight crews of the mud wasp risk or the use of pitot probe covers and, in part due to the absence of a warning in the Lido airport information, the captain was not aware of the mud wasp activity and requirements to fit pitot probe covers at Brisbane.

Expectation is influenced by how frequently a person had previously encountered an item (Wolfe and others 2013). The captain reported never seeing pitot probe covers during previous walk‑arounds and likely did not expect to see them on the aircraft in Brisbane.

Flight crew and engineer walk-arounds for other flights

While the need to board the aircraft may have distracted the LAE to some extent, the same LAE did not need to board the flight on the previous evening, yet had not conducted a final walk-around on that occasion either. The same is true of the previous LAE, who had worked the preceding two turnarounds. From the video evidence available, in total, both LAEs omitted the required engineering pre-departure walk-around inspection on all of the 4 turnarounds, including both occasions when they were not required to board the aircraft. Further, two of the transit checks overall were of a very short duration and did not inspect all key areas required.

Similarly, the captain’s walk-around was only partially completed, while one other pilot omitted the flight crew walk-around completely. Of the four flight crew walk-arounds that were required, only two were likely to have been completed in full to the standard required by procedure.

The operator’s use of the term ‘cursory’ to describe the required flight crew walk-around is not appropriate for a task of this level of importance. The Macquarie Dictionary defines ‘cursory’ as ‘going rapidly over something, without noticing details; hasty; superficial’. Although performing the task rapidly is not inherently problematic, it is very important for a flight crew to notice details and avoid being hasty or superficial. However, while the captain chose the same word in interview to describe the required walk-around, it is uncertain whether this choice of term affected the captain’s attitude towards this task.

While individual factors were likely involved, the high incidence of incomplete or absent walk-arounds from the operator’s engineer and flight crews may be indicative of a systemic, cultural issue, possibly that of a casual approach to these important tasks.

Walk-arounds need to be completed in full and with careful diligence. Each one needs to be conducted with the mindset that it may be the sole opportunity to detect damage or other irregularities and confirm the aircraft’s readiness for flight. The ATSB has investigated recent occurrences where serious damage was not detected despite multiple routine walk-around visual inspections by flight crew and engineers. These include tail damage to an ATR-72,^[80] and engine nacelle damage to a Boeing 737.^[81]

Dispatch coordinator walk-around

In Brisbane, Menzies did not typically perform dispatch duties or the associated dispatch walk-arounds, but ground handling staff received training and guidance appropriate to the duty. There were procedures that required the dispatch walk-around to be undertaken, specifically identifying pitot probes as an item to check. Accordingly, had a walk-around been done, the presence of the pitot probe covers was likely to have been identified.

The leading hand stated that they did not do a dispatch walk-around because they did not have headset duties for that aircraft, as that responsibility had been handed over to another ground handler who was called to assist in the final minutes before departure. The other ground handler who was called to assist with the dispatch stated that they believed the leading hand had already done a walk-around as the aircraft appeared to be ready for dispatch.

Regardless of whether the leading hand was qualified to perform the dispatch, the leading hand and dispatch coordinator were both aware of the need to conduct a dispatch walk-around. The leading hand, who would have known that it had not been done, did not do it personally or tell the dispatch coordinator that one was needed. Having remained in the area after handing over dispatch duties, it would have been readily apparent to the leading hand that the dispatch coordinator did not perform a walk-around. The dispatch coordinator, who held primary responsibility for the task, may have assumed that it had been done but did not check, and could have done it if there was any doubt. The omission of this walk-around was therefore probably the result of a combination of individual violations and poor communication.

Menzies stated that operator-specific training was delivered to line personnel in June 2018, and the occurrence leading hand thought that it was required to be able to conduct dispatch coordination of Malaysia Airlines aircraft. However, Menzies did not have records of this training being required or delivered, and neither of the occurrence Menzies staff recalled having received it.

The level of non-compliance for walk-arounds of Malaysia Airlines aircraft in July 2018 (2 absent and 2 partial walk-arounds out of 8) is indicative of a non-compliance rate that should be detectable through observation audits, particularly those that assess multiple elements of the activity as Menzies did. However, Menzies audits over two separate 9-month periods in 2018 and 2019 showed 100% compliance with assessed elements of the 544 required dispatch walk‑arounds, and a 99.2% compliance rate for the less safety-critical arrival walk-arounds (one non‑compliance out of 122).

It is unlikely that there were confounding factors related to the arrangements with Malaysia Airlines, as both relevant personnel were aware of the need to conduct walk-arounds when coordinating dispatch. Further, the requirement for arrival walk-arounds was not dependent on the operator but the conduct of arrival walk-arounds was similarly inconsistent.

While a high compliance rate is desirable, the assessed 100% compliance does not reflect actual compliance from the small sample assessed by the ATSB using video recordings. Such a mismatch between audited and actual compliance may indicate problems related to the manner in which the audits were conducted (for example, the auditing process being visible and inadvertently encouraging adherence) or non-compliance with the audit process itself (such as elements being marked as correctly completed when they were not observed).

Tool control

The undetected presence of a foreign object on an aircraft could potentially compromise flight safety or cause damage. For this reason, tools used for maintenance and ground handling of aircraft requires formal and informal controls to ensure they have been accounted for prior to flight. ATSB (2009) found that about 19% of foreign object damage (FOD) occurrences were from tools and equipment and:

The most common factor that contributed to FOD occurrences was individual actions relating to aircraft maintenance. These included replacing, repairing, and installing aircraft components, and the use and removal of tools and personal items from aircraft prior to the issue of a maintenance release or aircraft dispatch.

The primary function of tool control is to prevent tooling remaining on board (or fitted to) an aircraft prior to its departure. Its secondary function is to account for tooling as an asset. With the provision of a non-certifying engineer (AME) to assist Malaysia Airlines turnarounds, the relevant AMSA tool control requirements were not a reliable means to account for tooling (such as pitot probe covers) prior to aircraft dispatch. This was because the procedural checks were to be carried out when returning the tooling after the aircraft had departed and at the end of a shift, rather than prior to aircraft dispatch as licensed aircraft maintenance engineers (LAMEs) were required to do. This requirement was not relevant in this case, as the AME was in a non-certifying role. In addition, the existing controls were further degraded by the local practice whereby pitot probe covers, and other equipment were drawn from their storage location without being recorded.

Reliance on the technical log alone introduces practical considerations: either the LAME removes pitot probe covers sooner than strictly necessary, which would leave the probes vulnerable to insect contamination, or certifies for an aircraft with the covers still fitted with the intention to remove them later, which introduces the potential for error.

Gear pins and covers check

The Preliminary cockpit preparation procedure required flight crews to conduct a ‘pins and covers check’—that is, landing gear pins and pitot probe covers. When only this equipment is used for the aircraft, this check helps flight crews to ensure that the pins and covers would not be fitted at the time of departure.

However, Malaysia Airlines did not routinely carry pitot probe covers as part of the aircraft’s standard equipment, but retained the check for pitot probe covers. Because of this, flight crews would become accustomed to pitot probe covers being absent from the check, making the check ineffective for these items because others would have to be used. This was likely the case in this occurrence.

It was not possible to determine whether the captain physically checked for the presence of pitot probe covers in the flight deck compartment as required. Nevertheless, had they done so, they would have expected to find only landing gear pins because pitot probe covers were not routinely carried on the operator’s aircraft.

Procedural problems such as this can arise from conducting operations in a different way than originally intended, if there is insufficient consideration of how the change can affect the way procedures are carried out. The resulting inconsistencies can lead to an automatic prompt-and-response rather than actual verification that the check had occurred and affect flight crew perceptions of procedures in general.

Pitot probe cover characteristics

The pitot probe covers were fitted to the aircraft for most of the time that it was on the ground. Over much of this period, their presence would not necessarily be notable to people working in the area because they are not important at that time. However, in the short period leading up to pushback and taxi, ground crews begin to think in terms of the aircraft’s immediate readiness for flight, including whether the doors and panels are closed, whether ground equipment is still attached, and so on. If there is something preventing the aircraft’s readiness for flight, it needs to be resolved.

The main purpose of ‘remove before flight’ streamers is to create this awareness: if a person were to check for the presence of pitot probe covers or a landing gear pin, their attention is drawn to the required item by the checklist they are following, and a streamer simply helps them to find it. On the other hand, the streamers are used to draw attention at times when a person is not specifically looking for that item. In other words, the streamers exist to improve the likelihood of incidental—not purposeful—detection.

Therefore, while it is not surprising that the ground crews did not notice or act on the presence of the pitot probe covers during the majority of the turnaround, it is notable that several of them (all of whom would almost certainly be aware of the importance of a streamer marked ‘remove before flight’) apparently overlooked their presence in the immediate period before, during, and after pushback. For example, the leading hand was looking in that direction just before pushback, and the dispatch coordinator was looking in that direction when showing the flight crew the nose gear steering pin after the tug was disconnected.

While it is not clear whether the ground crews were paying much attention to the aircraft itself through this period, it is apparent that the pitot probe covers and streamers did not gain their attention, either from nearby (being well above normal eye height) or from a short distance (when they fill much less of an observer’s field of view).

The purpose of a ‘remove before flight’ streamer, attached to an item of ground support equipment such as a pitot probe cover, is to gain the attention of someone who is not primarily looking for the equipment.

A number of characteristics contribute to the conspicuity of streamers. Red streamers can provide effective contrast against a white fuselage in good light but may not be as attention-attracting in poor lighting such as night, especially when they are dirty. Reflective materials may be helpful at night.

Another factor is length. The streamers attached to the pitot probe covers provided by AMSA were about 60% the total length of lanyards and streamers attached to other covers approved by the aircraft manufacturer and used by Malaysia Airlines. Shorter streamers are less likely to draw a person’s attention when in their visual field even if they are not paying particular attention to that area.

A longer streamer, or one with a lanyard, is more likely to move if wind is present. In general, a human’s perceptual system is sensitive to motion, particularly in their peripheral vision (McKee and Nakayama 1984; Wickens and others 2013). However, it has been reported that the greater force on longer streamers in strong winds can occasionally drag the covers off. Operators need to balance the likelihood of this occurring against the need to ensure their removal before flight through the use of longer streamers.

Larger aircraft such as the A330 have pitot probes that are well above eye height and therefore often out of sight or in the peripheral vision of people working nearby. People are not effective at perceiving details in the peripheral vision (Proctor and Proctor 2012). With such aircraft, a longer streamer and/or lanyard would enter their field of vision more often, increasing the likelihood of being noticed during normal activities.

The limited conspicuity of the pitot probe covers used on the occurrence aircraft reduced the likelihood of incidental detection of the covers, which is important during turnarounds. Pitot probe covers are frequently used when aircraft undergo deeper maintenance or are parked or stored for an extended period, where their use is routine and there is ample opportunity to detect them once an aircraft is to be released to service. On the other hand, there are increased time pressures and fewer opportunities for their removal during turnarounds. However, there are incidental opportunities that arise for ground crews to notice pitot probe covers while doing unrelated tasks such as attaching a tug and pushing the aircraft back, and the likelihood of this incidental detection is increased with the use of larger or brighter streamers.

Operator port induction for Brisbane

Application of engineering functions in practice

A standard ground handling agreement for AMSA to perform all technical handling functions was completed on the day of the occurrence. However, the arrangements for Malaysia Airlines to perform and control the technical handling functions with assistance from AMSA continued in practice, so the terms of the agreement probably did not have any substantial effect on the night of the occurrence. The operator’s interim arrangement of having a travelling LAE assisted by a local engineer was probably associated with being unable to obtain the required approvals in a short period of time.

Although there were no settled agreements between the organisations, line personnel and their immediate managers did appear to have a clear understanding of their broad roles, including which people were responsible for engineering certification (the LAE) and dispatch coordination (Menzies staff).

However, the interim arrangement changed the way engineering functions were carried out compared with normal operations. In particular, the operator did not appear to recognise that the LAEs would be likely to feel higher time pressures than usual, due to the need to board the aircraft for flight, and could not in practice perform the engineering pre-departure walk-around inspection because the aircraft doors had to be closed and then checked from outside.

This demanded a higher level of improvisation, communication, and coordination than usual, during every turnaround, and contributed to a working environment in which errors were less likely to be caught.

Dispatch coordination

Although an agreement for Menzies to provide dispatch coordination had been drafted about 2 weeks before the resumption of flights, the operator only delivered a course to Menzies instructors for dispatch coordination a few hours before operations were to resume. This increased the risk of underqualified staff being rostered had there been important safety elements to convey.

Separately, although using ground handlers and not engineers to perform dispatch coordination should not inherently carry any additional risk, an engineer is more likely to identify things that could affect the safety of flight (such as the presence of pitot probe covers during pushback) and is more likely to remember any incomplete tasks when staying involved in the turnaround operation until the end. An engineer also has a deeper level of understanding about the requirements for safety of flight (including the importance of pitot probes) and is therefore more likely to identify less-obvious problems.

Finally, in this case, using an engineer for dispatch coordination would have been one way to overcome the problem of how the engineering pre-departure walk-around inspection could be done in practice. Task analysis activities can also help identify these types of problems. This involves breaking a task (such as managing a turnaround) into progressively smaller tasks and considering variables that may impact the completion of certain steps. For example, by considering each step that each person must complete during a turnaround with the arrangements in place at Brisbane, it may become clear that the LAE would not be able to finalise the transit check from on board the aircraft. The process can then be changed to prevent this situation from arising.

Continuation of operations without firm arrangements

The Malaysia Airlines investigation report stated that the ground service arrangements had substantially changed in the days before the resumption of Brisbane flights, but in terms of dispatch coordination this was not corroborated by other evidence such as the draft agreement for Menzies to perform dispatch coordination signed by the operator 2 weeks beforehand. Furthermore, had AMSA withdrawn from an agreement to conduct engineering certification, the short-term situation remained the same because regulatory approval was still pending.

Regardless of whether a late change actually did occur, other records indicate that some of the key activities required for the recommencement of Brisbane operations were conducted shortly before, and sometimes after, flights had resumed. Specifically:

• a risk assessment had been performed less than 2 weeks previously, leaving little time to approve and implement mitigation strategies
• long-term engineering arrangements had not been finalised, with an agreement with AMSA not yet being signed by either party (and possibly not yet drafted)
• there was no regulatory approval for AMSA to perform aircraft certification (likely requiring Malaysia Airlines to make interim arrangements with a travelling engineer and local support engineer)
• long-term ground handling arrangements had not been finalised, with two agreements being Menzies were drafted and signed by the operator (one on the same day as the first flight) but not finalised by Menzies
• training had only been provided to Menzies trainers on the day that flights resumed, and there was uncertainty around whether that training was required to be—or actually—provided to Menzies front-line personnel.

In total, while line personnel might not generally be aware of the broader organisational picture, details about operational implementation of contractual agreements do filter through, and there was an unusually high level of vagueness how all turnaround tasks would be performed in practice.

When working in an established role in a consistent way, people develop personal practices and habits that generally reduce the incidence of error. When an unusual situation arises, as is common in the ramp environment, it is necessary to rely on the initiative, knowledge and skills of individuals. No process can address every potential situation. However, relying on individuals increases the risk of individual error, so relying heavily on individuals who are largely working outside defined procedure should not become the norm.

In this case the engineers and dispatch coordinators were required to perform their roles in a different way to how they were accustomed. For example, there was also overlap in specific services that were agreed with both providers; for example, the agreements with both providers included dispatch coordination. Although in practice there was no apparent uncertainty about this particular function, this type of inconsistency can sometimes translate to misunderstandings about roles and responsibilities among line personnel, particularly when arrangements change or the individuals are performing tasks to which they are not accustomed.

Although this problem is foreseeable, it can be easily overlooked. A broadly similar problem with communication and coordination resulted in an uncommanded aircraft movement during pushback in 2016, resulting in aircraft damage.^[82]The use of specialised methods (such as task analysis) can help identify this kind of risk. Also, the ICAO Safety Management Manual suggested joint hazard-identification activities guidance on hazard identification when working with other organisations:

Organizations should also identify hazards related to their safety management interfaces. This should, where possible, be carried out as a joint exercise with the interfacing organizations. The hazard identification should consider the operational environment and the various organizational capabilities (people, processes, technologies) which could contribute to the safe delivery of the service or product’s availability, functionality or performance.

As an example, an aircraft turnaround involves many organizations and operational personnel all working in and around the aircraft. There are likely to be hazards related to the interfaces between operational personnel, their equipment and the coordination of the turnaround activity.

Airlines world-wide have an increasing reliance on external engineering and ground handling support services. Therefore, it is of vital importance that there are clear lines of communication, procedures, and standards in place between all parties involved to ensure that tasks are implemented and undertaken correctly. This necessitates thorough planning, initiated early, with check points along the way to ensure that the implementation is on track.

Limitations of the risk assessment

The risk assessment for the resumption of Brisbane operations had numerous problems that reduced its effectiveness. For example, where controls changed a risk category or posed other risks (for example, using pitot probe covers), these effects were not fully recorded or explored. The ICAO Safety Management Manual stated:

A determination of any unintended consequences, particularly the introduction of new hazards, should be made prior to the implementation of any safety risk controls.

The risk assessment had limited or absent categorisation of risk, which meant that compound risks—those where the hazard can have multiple effects—were not fully explored. This can result in misconception of the risk. For example, the use of pitot probe covers may present a risk to safety of flight (through being left on) and customer service (through delays) if their use is not well-managed. Treating one risk may result in the other being overlooked, depending on the chosen risk controls. By specifying each category of risk and treating them separately, the identified risk controls can then have adequate coverage of the potential undesired outcomes and aid the prioritisation and allocation of resources.

The assessment also obscured the distinction between existing and additional risk controls. That is, future activities were listed as existing controls, and prospective assurances from third parties, which do not necessarily translate to actual activities, were listed as though they had a direct effect on risk. Also, additional controls were sometimes rewordings of existing controls or stating how they were to be achieved, which does not have any additional effect on risk. Therefore, risk could not be reduced by the stated controls.

Furthermore, the risk assessment contained a number of errors, most notably that four of the residual risk entries were erroneously recorded as ‘low’ instead of ‘medium’ (possibly as the result of a data entry error). This, in part, allowed the operator’s review and assurance processes to be bypassed, as will be explained in Limitations of operator change and risk management processes, below. In essence, a mistake allowed it to bypass a means for detecting mistakes.

Overall, these problems with the risk assessment approach—the lack of outside involvement, absence of consideration of introduced risk, limited categorisation, incorrect use of controls, and errors—negated its value. The E&M and flight operations departments were probably not involved in the risk assessment, and did not perform or record a separate risk assessment. The absence of this specialist input increased the likelihood of certain risks being overlooked or underestimated.

Non-implementation of risk controls

Although the risk assessment for the recommencement of services into Brisbane was conducted less than two weeks before operations resumed, the risk assessment identified generally appropriate safety risks, including the mud wasp hazard, and the need for appropriate risk controls. Although this was late in the planning process, there was no evidence whether the limited time prevented implementation of the identified risk controls (as the operator had not previously used pitot probe covers at Brisbane, this was not just a matter of reactivating existing controls).

The Malaysia Airlines airport services (AS) department, which held overall responsibility for the planning and implementation of the resumed service to Brisbane, conducted the risk assessment without apparent involvement from other relevant departments. This probably limited the quality of the risk assessment, particularly regarding the identification of hazards and the evaluation of risk control practicality and effectiveness.

In particular, within the scope of the change management process, the flight operations department was not appraised of the assessment of the mud wasp risk or the proposed use of pitot probe covers. Therefore, subject matter experts therein had no prompt to manage the potential effects of the hazard or control on the safety of flight from a flight operations perspective.

The engineering and maintenance (E&M) department was reportedly informed of the need to implement certain risk controls, including a checklist for the installation and removal of the pitot probe covers during transit at Brisbane Airport. No such checklist or similar process was developed for reasons that could not be fully established.

Although the operator had high-level processes for tracking implementation of risk controls and other actions, the processes permitted some risks to be managed at a departmental level, which occurred in this case. The AS and E&M departments probably had informal risk management processes, and ultimately, it appears that individuals within those departments did not follow up on the identified actions. It is likely that, in the absence of formal action tracking, a combination of individual errors led to the required control not being implemented and the issue not being finalised.

In addition, the risk assessment was approved by the regional AS department head, which was one level below the required approval level required by the corporate safety management manual (CSMM). There was no evidence to evaluate whether this had an impact on the quality of the assessment.

Promulgation of safety information regarding the wasp hazard at Brisbane

It was reported that the Malaysia Airlines flight operations assessors planning for the resumption of Brisbane operations were not aware of the mud wasp hazard at Brisbane. This was due to the relevant information not being included in the airport operational information used by Malaysia Airlines. Additionally, there was no formal process to monitor relevant safety information from foreign regulators to ensure that it reached the appropriate people. Some flight operations staff had obtained the airworthiness bulletin about mud wasps at Brisbane, but this information did not reach the individuals responsible for assessing the port safety from a flight operations perspective.

As a result, the flight operations department did not perform a risk assessment for the hazard, so there were no Brisbane-specific flight operations risk controls in place such as measures to advise flight crews of the increased risk of erroneous airspeed (either due to mud wasp nesting or pitot probe covers remaining fitted) or of the use of pitot probe covers to provide an expectation for them during walk-arounds.

Separately, the operator’s airport services (AS) and engineering and maintenance (E&M) departments became aware of the mud wasp hazard at Brisbane through advice from the local service providers as part of a broader port assessment process. However, there was no strategy to control the fitment and removal of pitot probe covers, which increased both the risk of mud wasp infestation (since they were only sometimes fitted) and the risk of non-removal of pitot probe covers when they were used.

Had a strategy been in place, it is likely that the flight crews and engineers would have been informed about the use of pitot probe covers at Brisbane and been more likely to notice or remember their presence. It would have also been more likely to result in improved coordination about their use between Malaysia Airlines and AMSA engineers.

On a separate but related note, the agreements (once settled) between Malaysia Airlines and the two ground services providers did not explicitly state whether the available services would always, or only sometimes, be applied. Most relevantly, the agreements requiring the provision of pitot probe covers did not include information about when their fitment was expected: on every turnaround, if an aircraft is to be parked for a period of days, or some other condition. It is feasible that two organisations could pass different interpretations of the requirement onto line personnel, increasing the likelihood of miscoordination or miscommunication on the ground.

Limitations of operator change and risk management processes

Introduction

The operator had multiple pathways, including risk management processes and change management processes, for significant operational risks to be (a) brought to the attention of relevant departments and (b) to be managed and tracked at a higher level. According to these processes, risks that could not or should not be managed within one department were meant to be brought to the attention of senior managers at safety risk assessment team (SRAT) meetings. In principle these processes should be sufficient to manage risk.

However, the SRAT was not notified of the resumption of Brisbane operations. This was due, in part, to a combination of problems in the relevant processes, allowing the circumvention of broader risk and change management pathways that would normally involve the SRAT in the management of significant changes and risks. This meant the opportunity to strengthen the risk assessment through peer review and oversight was lost. There was no opportunity for stakeholders to learn of the risk and help manage it effectively, including the use of the SRAT’s formal risk management records.

Stakeholder involvement in change and risk management processes

First, the corporate safety management manual (CSMM) required significant changes to be notified to the SRAT, and the resumption of Brisbane operations after a 3-year cessation clearly fell under several of the applicable criteria. The reasons for the change not being tabled (even though preparations were underway) are unclear, although re‑establishing a route to an established international airport may not have been seen as a high-risk enterprise.

There was representation of various departments at the SRAT, as well as nominated accountable persons, increasing the likelihood that important changes and risks would be raised at that forum if the other processes had not done so. However, accountable representatives of the various departments were only intermittently present at the SRAT meetings held during the relevant period. In particular, the accountable person for the AS department (the department responsible for managing the change) was absent from all those meetings, which placed higher dependence on the alternate representatives. These representatives attended only 3 meetings and did not table the change at these meetings, or table the risks associated with the change at the next meeting after the risk assessment was done.

Given the involvement of other departments in the actual activity of planning the resumption of services to Brisbane, it is highly likely that there was wider awareness of the change across the SRAT, and yet the SRAT as a group did not proactively identify it as a change that needed its attention.

In addition, according to the operator’s processes, the SRAT would only become involved in the risk management process for higher-level risks. While this is a reasonable (and common) provision to limit the number of less-important risks that the SRAT had to manage, the risk management process did not require any level of review or stakeholder involvement to identify problems with a risk assessment, such as if the assessor does not identify all relevant risks, underestimates risks, overestimates the effectiveness of controls, or makes other errors in the assessment.

The ICAO Safety Management Manual states:

It is important to involve the “end users” and subject matter experts in determining appropriate safety risk controls. Ensuring the right people are involved will maximize the practicality of safety risk chosen mitigations.

In this case, subject matter experts and key stakeholders in associated disciplines (especially flight operations and engineering) were not involved in the process of assessing the safety risk and the identification of effective controls, and the wider group (with established processes) was not used for assurance and oversight of the implementation of risk controls. Management of safety risk could therefore, in some circumstances, be left to one person.

This meant that there was a likelihood of the change initiator having an incomplete picture of risk, and that identified controls could not be checked for validity and effectiveness by the people responsible for implementing them.

Potential for process misinterpretation and non-registration of risk controls

The second problem was related to the change and risk management processes both allowing an interpretation that permitted risks to be managed by the responsible department alone if the risks could be reduced to ‘low’ after applying risk controls. In this case, through the change management process, Malaysia Airlines identified seven risks that were rated as ‘medium’ initially, and then reduced to a ‘low’ residual risk through proposed risk controls. That assessment was flawed, as discussed previously, but this may also explain why the risks were not raised at the next SRAT after the risk assessment: the assessor may have thought it meant ‘low’ residual risks did not need further attention.

This may have been partly because the risk management process used a flowchart for the safety investigation process (Figure 49). This was specific to the safety reporting process, but it was used as the generic process for all other risk assessments. This required a substantial amount of interpretation by the user because several of its elements were only applicable to the safety reporting process and subsequent investigation.

Figure 49: Part of the operator’s safety risk management process, annotatedSource: Malaysia Airlines, annotated by the ATSB

From a safety investigation perspective, the ‘risk?’ decision point clearly referred to initial risk, because this part of the process would come before the investigation and identification of additional risk controls. However, from the perspective of a person applying the flowchart to risks identified by a change management process, the distinction between initial and residual risk is less clear. That is, the process did not clearly state whether the ‘risk?’ decision point should be based on initial or residual risk.

The flowchart had a decision point marked ‘Investigate?’ for risks assessed as ‘low’, which led to no further action if the assessor answered ‘no.’ This decision point was appropriate for the safety report investigation process but was not fully applicable to change-oriented risks. There was no guidance about how to make this decision, and a person could reasonably think that there was no need to ‘investigate’ if they felt they had the required knowledge at hand and was unaware of any errors in the assessment.

Separately, the change management process had a similar potential for misinterpretation (Figure 50). The intention of the flowchart appears to have been to:

• prompt a risk assessment
• prompt a mitigation plan and registration of controls if the initial risk was not acceptable
• enable the implementation of a change if the initial (untreated) or residual (treated) risk was acceptable (the pathways leading to ‘Implement Change’).

Figure 50: Operator’s change management process flowchart, annotated
Source: Malaysia Airlines, annotated by the ATSB

However, the flowchart may have unintentionally allowed the implementation of change based only on the residual (treated) risk in the following manner. A person conducting the assessment was prompted to propose risk controls when using either of the available risk assessment forms (the change management form or the risk assessment record form) as part of the ‘Risk Assessment’ step. This assessment would produce both an initial risk and a residual risk. There was no guidance on which of these should be used for the ‘Risk Acceptable?’ decision, allowing ‘low’ residual risks to be accepted without review even if the initial risk was moderate or above as the process probably intended. In fact, the pathway shown in Figure 50 was applied during the assessment for the resumption of Brisbane flights, although it is unclear whether the above reasoning was used in this instance.

The risk controls identified during this process reduced the risk from a level requiring mitigation and ongoing monitoring to a level that did not, but did so only nominally. If following the illustrated pathways, the risk and change management flowcharts only required existing risk controls to be registered, not new controls. As a result, there was limited assurance that the assessed reduction in risk actually took place. If the risk controls were ineffective, not implemented, or introduced other risks—all of which occurred in this instance—then the actual risk could be higher than estimated.

Other limitations of the change management process

The resumption of Brisbane services was correctly treated as a change in accordance with the CSMM (with the exception that it was not notified to the SRAT). However, there were limited records of the planning and conduct of the change, indicating that a complete change management process may not have been followed.

Change management is an important element of a safety management system. The operator’s change management process and guidance overall was very limited and omitted many key elements of an effective process, including requirements to:

• plan the change
• identify stakeholders and assign responsibilities
• document the change (such as through a change control register)
• categorise the change (enabling tailoring of the process across minor and significant changes),
• identify regulatory compliance requirements
• produce and track actions, and
• monitor and review the change after implementation.

The ICAO Safety Management Manual (primarily directed towards states rather than operators) first detailed such change management steps in the 4th edition, published in January 2018. Nevertheless, these principles had been well-established before then; for example, Hayes (2002) expanded on a wide range of change management topics, drawing on models and methods developed over the preceding decades. This more-detailed level of organisational change management has also been applied to aviation (Flouris and Yilmaz 2011).

Many key elements of established change management practices were omitted from the Malaysia Airlines planning and implementation of a major change (the reintroduction of Brisbane services). This may be due to the absence of details about change management in the CSMM, which hindered the operator’s ability to systematically validate the tolerability of risk, meet the strategic objective (namely, the successful implementation of change) and potentially affecting the safety objectives as well.

There were also problems with the defined process. The written description of the change process did not clarify how change management triggers were to be identified to the SRAT meetings, or who held the responsibility to do so.

Also, the provided change management form was essentially an alternative risk assessment form despite being used for a different purpose, and this may have led the assessor to conflate the two purposes to some degree. Furthering this problem, the labelling of the form as a change management form may lead to the risks not being entered into the appropriate risk registers as would be expected if the risk assessment form is referenced instead. These issues ultimately meant that the assessment had reduced value both as a change management exercise and as a risk management exercise.

__________

77. These 8 occurrences are: the occurrence flight, 2 other flights from 2010–-2019, and 5 flights from January 2020–April 2021. See Airbus operator reports
78. The latter two occurrences are the A330 in Brisbane in 2013, and the A321 in Doncaster in 2020.
79. Although there is little benefit in naming all relevant species (pilots may not be familiar with relevant bird and bat types), operational information should include details such as the size of the animals as well as relevant information about their flocking and movement habits so that pilots can plan and prepare appropriately.
80. In-flight upset, inadvertent pitch disconnect, and continued operation with serious damage involving ATR 72 aircraft, VH-FVR, 47 km WSW of Sydney Airport, NSW on 20 February 2014. Available at www.atsb.gov.au.
81. Engine nacelle strike and continued operation involving Boeing 737-8FE, VH-YIW, Faleolo Airport, Apia, Samoa on 23 April 2016. Available at www.atsb.gov.au.
82. ATSB investigation AO-2016-028, Ground handling occurrence involving Airbus A330, 9M-MTB, Melbourne Airport, Vic, on 31 March 2016, available at www.atsb.gov.au.

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors. Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the airspeed indication failure on take-off involving Airbus A330, 9M MTK, at Brisbane Airport on 18 July 2018.

Contributing factors

• In the absence of clear instruction or guidance, the Aircraft Maintenance Services Australia support engineer fitted pitot probe covers to the aircraft shortly after its arrival, as was done for some other airlines to mitigate the threat of wasp infestation. Later, the engineer left to perform tasks on another aircraft and did not return to the aircraft prior to its departure as intended.
• Due to miscommunication or error, a technical log entry was not made following the fitment of pitot probe covers. As a result, when the technical log was reviewed prior to flight, the presence of pitot probe covers was not detected.
• The Malaysia Airlines engineer saw the pitot probe covers fitted to the probes during the transit check, about 2 hours before departure, and intended to ask the support engineer to remove them. However, associated with the limitations of prospective memory, the operator’s engineer subsequently did not remember to do so.
• The captain did not expect, or detect, the presence of the pitot probe covers during their pre-flight exterior inspection (walk-around). The captain did not include a number of the required check items, including the right side pitot probe, and looked at the left side pitot probe area briefly.
• The Malaysia Airlines engineer did not perform a final walk-around inspection of the aircraft, including a check for pitot probe covers, as required by the transit check that the engineer had certified as complete. The engineer assumed that the walk-around would be completed by the support engineer and/or ground handlers.
• The Menzies Aviation person assigned as dispatch coordinator for the aircraft handed over that duty to another person immediately before pushback, and neither person conducted the required dispatch walk-around. This was the last procedural opportunity to identify the presence of pitot probe covers before the flight.
• The aircraft was released for flight with covers fitted to all three pitot probes, preventing the air data systems from measuring airspeed.
• There was limited and ineffective communication between the captain and first officer in response to the speed flag on each of the primary flight displays (which appeared at about 50 kt groundspeed during the take-off). This significantly reduced their coordination and capacity to interpret the situation with the limited time available.
• While independently trying to diagnose a rare and unfamiliar problem during take-off, the flight crew experienced high cognitive workload, time pressure, and stress. This reduced their capacity to effectively interpret the situation and make a decision early enough to safely reject the take-off.
• The Airbus guidance provided in the flight crew techniques manual and other manuals for assisting A330 flight crews to decide whether to continue or reject a take-off did not discuss unreliable airspeed indication scenarios. (Safety issue)
• In the Airbus A330, there was no auditory alert associated with nil or unreliable airspeed from two or more sources during take-off (a high workload, critical phase of flight). Comparatively, other critical failures provide both visual and auditory indications. (Safety issue)
• Although suitable for use in most situations, the streamers attached to the pitot probe covers supplied and used for A330 operations by Aircraft Maintenance Services Australia provided limited conspicuity due to their overall length, position above eye height, and limited movement in wind. This reduced the likelihood of incidental detection of the covers, which is important during turnarounds. (Safety issue)
• Some Aircraft Maintenance Services Australia (AMSA) engineers extended the use of pitot probe covers (to mitigate the threat of wasp infestation) to operators that did not explicitly require it, including Malaysia Airlines. This increased the likelihood of error associated with the use of pitot probe covers because AMSA engineers were not controlling the engineering activities and were not permitted to make technical log entries. (Safety issue)
• Aircraft Maintenance Services Australia did not have a reliable method to account for tooling and equipment (such as pitot probe covers) prior to aircraft dispatch when providing non-certifying engineering support. (Safety issue)
• Menzies Aviation staff did not consistently carry out the required arrival and pre-departure aircraft checks of Malaysia Airlines aircraft, and Menzies Aviation audit processes were not effective at evaluating compliance with these requirements. (Safety issue)
• Malaysia Airlines flight crew and engineers did not fully complete the required aircraft inspections. (Safety issue)
• Malaysia Airlines did not clearly specify the division of engineering responsibilities between Malaysia Airlines and Aircraft Maintenance Services Australia engineers at Brisbane, leading to ambiguity with regard to who should conduct the final walk-around portion of the transit check. This risk was increased by the operator commencing and continuing flights to Brisbane with interim ground handling and engineering arrangements that varied from usual industry practice. (Safety issue)
• Malaysia Airlines did not develop and disseminate guidance and procedures about the use of pitot probe covers to flight crews and engineers, and there was limited awareness among those groups of the need for pitot probe covers at Brisbane Airport. (Safety issue)
• The Malaysia Airlines risk assessment for the recommencement of operations into Brisbane had numerous errors and omissions that potentially reduced its effectiveness.
• Although Malaysia Airlines identified the potential risk of pitot probe obstruction by wasps at Brisbane, and decided to address the risk with the use of pitot probe covers, it did not effectively communicate risks and required actions between departments and follow them through to completion.
• Malaysia Airlines’ processes for the management of change did not follow recommended industry practices, and its risk and change management processes were not detailed and clear enough to assure:
  • the appropriate level of involvement of subject matter expertise and safety groups
  • that risk controls were implemented and monitored. (Safety issue)

Other factors that increased risk

• The flight crew briefly attempted to conduct troubleshooting during a critical stage of flight without calling for and adhering to the pitch attitude and thrust setting memory items of the Unreliable speed indication procedure, and also omitted the After Take-off/Climb
• For reasons that could not be determined, the tower controller did not respond to the initial PAN PAN call made by the flight crew after take-off.
• The Lido airport operational information did not include the Australian Aeronautical Information Publication (AIP) advice to fit pitot probe covers at Brisbane Airport (related to significant mud wasp activity), as well as other safety related AIP information. (Safety issue)

Other findings

• Once activated, the aircraft's back up speed scale (BUSS) was highly effective in reducing the flight crew's workload during approach and landing and provided critical flight information that would have otherwise been unavailable. The BUSS is available as an option on the Airbus A330 and other Airbus types.
• After the initial climb, the flight crew managed the unreliable airspeed issue with effective communication and coordination.
• The departures controller provided effective support to the flight crew from soon after take-off, including taking the initiative to provide groundspeed information.

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.  All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Instruction and guidance for unreliable airspeed on take-off

Safety issue number: AO-2018-053-SI-16

Safety issue description: The Airbus guidance provided in the flight crew techniques manual and other manuals for helping A330 flight crews decide whether to continue or reject a take-off did not refer to unreliable airspeed indications.

Alerts associated with nil or unreliable airspeed during take-off

Safety issue number: AO-2018-053-SI-10

Safety issue description: In the Airbus A330, there was no auditory alert associated with nil or unreliable airspeed from two or more sources during take-off (a high workload, critical phase of flight). Comparatively, other critical failures provide both visual and auditory indications.

Pitot probe cover characteristics

Safety issue number: AO-2018-053-SI-09

Safety issue description: Although suitable for use in most situations, the streamers attached to the pitot probe covers supplied and used for A330 operations by Aircraft Maintenance Services Australia provided limited conspicuity due to their overall length, position above eye height, and limited movement in wind. This reduced the likelihood of incidental detection of the covers, which is important during turnarounds.

Aircraft Maintenance Services Australia use of pitot covers

Safety issue number: AO-2018-053-SI-01

Safety issue description: Some Aircraft Maintenance Services Australia (AMSA) engineers extended the use of pitot probe covers (to mitigate the threat of wasp infestation) to operators that did not explicitly require it, including Malaysia Airlines. This increased the likelihood of error associated with the use of pitot probe covers was because AMSA engineers were not controlling or conducting all of the engineering activities and were not permitted to make technical log entries.

Aircraft Maintenance Services Australia tool control

Safety issue description: AO-2018-053-SI-07

Safety issue number: Aircraft Maintenance Services Australia did not have a reliable method to account for tooling and equipment (such as pitot probe covers) prior to aircraft dispatch when providing non-certifying engineering support.

Menzies audits of dispatch coordination tasks

Safety issue number: AO-2018-053-SI-18

Safety issue description: Menzies Aviation staff did not consistently carry out the required arrival and pre-departure aircraft checks of Malaysia Airlines aircraft, and Menzies Aviation audit processes were not effective at evaluating compliance with these requirements.

Malaysia Airlines inconsistent walk-arounds

Safety issue number: AO-2018-053-SI-12

Safety issue description: Malaysia Airlines flight crew and engineers did not fully complete the required aircraft inspections.

Interim engineering arrangements

Safety issue number: AO-2018-053-SI-02

Safety issue description: Malaysia Airlines did not clearly specify the division of engineering responsibilities between Malaysia Airlines and AMSA engineers at Brisbane, leading to ambiguity with regard to who should conduct the final walk-around portion of the transit check.

Guidance about the use of pitot covers

Safety issue description: AO-2018-053-SI-14

Safety issue description: Malaysia Airlines did not develop and disseminate guidance and procedures about the use of pitot probe covers to flight crews and engineers, and there was limited awareness among those groups of the need for pitot probe covers at Brisbane Airport.

Change and risk management processes

Safety issue number: AO-2018-053-SI-05

Safety issue description: Malaysia Airlines’ processes for the management of change did not follow recommended industry practices, and its risk and change management processes were not detailed and clear enough to assure:

• the appropriate level of involvement of subject matter expertise and safety groups
• that risk controls were implemented and monitored.

Lido airport operational information

Safety issue number: AO-2018-053-SI-03

Safety issue description: The Lido airport operational information did not include the Australian Aeronautical Information Publication (AIP) advice to fit pitot probe covers at Brisbane Airport (related to significant mud wasp activity), as well as other safety AIP information.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety advisory notice to operators conducting flights to Brisbane Airport

SAN number:

AO-2018-053-SAN-003

On 30 August 2018, ATSB issued a safety advisory notice advising all operators that conduct flights to Brisbane Airport to consider the use of pitot probe covers and, if covers are used, ensure there are rigorous processes for confirming that covers are removed before flight.

The safety advisory notice is available at https://www.atsb.gov.au/publications/safety-advisory-notice/ao-2018-053-san-003/.

Amended airworthiness bulletin

On 6 July 2021, the Civil Aviation Safety Authority amended airworthiness bulletin AWB 02-052 Wasp Nest Infestation – Alert encouraging operators to ‘ensure all pitot / static and vent covers are removed prior to flight.’

ADIRU	Air data inertial reference unit
ADR	Air data reference
AIP	Aeronautical Information Publication: a package of documents which provides all of the operational information necessary for the safe and efficient conduct of national (civil) and international air navigation throughout Australia and its States and Territories
ALERFA	Alert phase
ALT	Altitude
AME	Aircraft maintenance engineer (non-certifying)
AMSA	Aircraft Maintenance Services Australia
AOA	Angle of attack
AOI	Airport operational information
AS	Airport services
ATC	Air traffic control
AWB	Airworthiness bulletin
BEA	Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile
BUSS	Back up speed scale
CASA	Civil Aviation Safety Authority
CASR	Civil Aviation Safety Regulations
CCTV	Closed-circuit television
CSMM	Corporate safety management manual
CVR	Cockpit voice recorder
DAR	Digital aircraft recorder
E&M	Engineering and maintenance
E/WD	Engine and warning display
ECAM	Electronic centralised aircraft monitor: aircraft systems, displays aircraft system information, and specifies flight crew actions to be taken in the event of abnormal or emergency situations
EGT	Exhaust gas temperature: an engine status parameter
EPR	Engine pressure ratio: an engine status parameter
ERSA	En route supplement Australia: part of the Aeronautical Information Publication published by Airservices Australia, containing pictorial presentations of all licenced aerodromes and other information specific to aerodromes for planning a flight and for a pilot in flight.
FLEX	Flexible temperature: a thrust lever setting that provides a de-rated amount of thrust for take-off to reduce engine wear
FCOM	Flight crew operations manual
FCTL ALTN LAW	Flight control alternate law (ECAM message)
FCTM	Flight crew techniques manual
FDR	Flight data recorder
FL	Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s altitude at standard air pressure is referred to as a flight level. FL 150 equates to 15,000 ft.
FO	First officer
FOD	Foreign object damage
GHA	Ground handling agreement
GSE	Ground support equipment
IAS	Indicated airspeed
IATA	International Air Transport Association
ICAO	International Civil Aviation Organization
ISIS	Integrated standby instrument system
LAE	Licensed aircraft engineer (equivalent term to licensed aircraft maintenance engineer or LAME)
LAME	Licensed aircraft maintenance engineer: a ground engineer approved to certify for maintenance within the scope of their licence
NAV ADR 1 + 2 + 3 FAULT	Fault with all 3 ADRs (ECAM message)
NAV ADR DISAGREE	ADR disagreement (ECAM message)
NAV IAS DISCREPANCY	Navigation indicated airspeed discrepancy (ECAM message)
ND	Navigation display
OEB	Operations engineering bulletin
PAN PAN	An internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance
PF	Pilot flying: the pilot who controls the aircraft and, in normal operations, navigates
PFD	Primary flight display
PFR	Post-flight report
PM	Pilot monitoring: the pilot who, in normal operations, carries out support duties, monitors the pilot flying’s actions and the aircraft’s flight path, and makes radio communications
QRH	Quick reference handbook
RTO	Rejected take-off
SAN	Safety advisory notice
SGHA	Standard ground handling agreement
SLA	Service level agreement
SPD	Speed
SRAT	Safety risk assessment team
SRS	Speed reference system
TOGA	Take-off / go-around: a thrust lever setting that applies maximum available thrust
V1	Decision speed: the maximum speed at which a rejected take-off can safely be initiated in the event of an emergency
VR	Rotation speed: the speed at which rotation should be initiated

Sources of information

The sources of information during the investigation included:

• the flight crew, engineers, and ground handlers
• Malaysia Airlines
• Aircraft Maintenance Services Australia and Heston MRO
• Menzies
• Civil Aviation Safety Authority
• Airservices Australia
• Lido
• Airbus
• Brisbane Airport
• aircraft recorded data.

References

Airbus (2006) ‘Pitot probes obstruction on ground’, Safety First, December, 11: 10–13.

Airbus (2007) ‘Unreliable speed’, Safety First, December, 5: 14–19.

Airbus (2014) ‘Control your speed… at take-off’, Safety First, July, 18: 6–17.

Airbus (2016) ‘Pitot probe performance covered on the ground’, Safety First, July, 22: 6–13.

Airbus (2019) ‘The adverse effects of unrealistic simulator scenarios’, Safety First, July, 28: 20–27.

Airbus (2020a) ‘Aircraft parking and storage’, Safety First, July, pp.1–8.

Airbus (2020b) ‘Preparing for a safe return to the skies’, Safety First, July, pp.1–9.

Airbus (2021) ‘Unreliable airspeed at takeoff’, Safety First, July, pp.1–10.

Airbus (2022) ‘Training pilots for resilience’, Safety First, January, pp.18–27.

Air Incidents Investigation Branch (AAIB) investigation report AAIB-2736, AAIB investigation to various Airbus and Boeing aircraft between 9 June and 19 July 2021, United Kingdom.

ATSB aviation research investigation AR-2009-042, Ground operations occurrences at Australian airports 1998 to 2008, Australia.

ATSB occurrence investigation AO-2011-102, VFR flight into dark night involving Aérospatiale, AS355F2 (Twin Squirrel) helicopter, VH-NTV, 145 km north of Marree, SA on 18 August 2011, Australia.

Baker DP and Dismukes RK (2002) ‘A framework for understanding crew performance assessment issues’, The International Journal of Aviation Psychology, 12(3), pp.205–222.

Boeing (2003) ‘Erroneous Flight Instrument Information’, Aero, July, pp.11–21.

Brière, D, Favre C and Traverse P (2001) ‘Electrical flight controls, from Airbus A320/330/340 to future military transport aircraft: a family of fault-tolerant systems’, in Spitzer, CR (ed) The Avionics Handbook, CRC Press, United States.

Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) investigation report BEA2018-0071.en, Incidents to the Boeing 737-800 registered F-GZHO operated by Transavia France on 7 February 2018 at Norwich (United Kingdom) and 8 February 2018 at Paris-Orly, France.

CASA (Civil Aviation Safety Authority) (2017) Advisory Circular, Teaching and assessing non-technical skills for single-pilot operations, AC 61-08, January 2017, Australia.

Casner SM, Geven RW & Williams RT (2013) ‘The effectiveness of airline pilot training for abnormal events’, Human Factors: The Journal of the Human Factors and Ergonomics Society, 55(3): 477–485.

Civil Aviation Authority (CAA) (United Kingdom) (2013) Monitoring matters: guidance on the development of pilot monitoring skills, 2013/02, April 2013, United Kingdom.

Civil Aviation Authority (CAA) (United Kingdom) (2021) Safety Notice, Pitot Blockage Events, SN‑2021/014, June 2021, United Kingdom.

Dismukes RK (2012) ‘Prospective memory in workplace and everyday situations’, Current Directions in Psychological Science, 21(4): 215–220.

Doll TJ and Folds DJ (1986) ‘Auditory signals in military aircraft: ergonomic principles vs. practice’, Applied Ergonomics, 17(4): 257–264.

Dutch Safety Board (2021) Interim warning in response to two serious incidents involving commercial aircraft [online document], accessed 9 June 2021.

Ecosure 2017. Mud-Nesting Wasps and Aircraft Safety at Brisbane Airport – progress report. Presented to Brisbane Airport Corporation, 2017.

European Union Aviation Safety Agency (EASA) 2020. Guidelines, Return to service of aircraft after storage: Guidelines in relation to the COVID-19 pandemic, TE.GEN.00107-003, November 2020, Germany.

FAA (Federal Aviation Administration) (1993) Takeoff Safety Training Aid, PB93-780013, August 1993, United States.

Flight Safety Foundation (1999) ‘Erroneous Airspeed Indications Cited in Boeing 757 Control Loss’, Accident Prevention, October, pp. 1–8.

Flin R and Martin L (2001) ‘Behavioral markers for crew resource management: a review of current practice’ The International Journal of Aviation Psychology, 11(1): 95–118.

Flin R, O’Connor P and Crichton M (2008) Safety at the sharp end: a guide to non-technical skills, CRC Press, Florida US.

Flouris TG and Yilmaz AK (2011) Risk management and corporate sustainability in aviation, Ashgate, Aldershot UK.

Foushee HC and Manos KL (1981) ‘Information transfer within the cockpit: problems in intracockpit communications’, in Billings CE and Cheaney ES (eds) Information transfer problems in the aviation system, NASA Technical Paper 1875.

Harris RL, Glover BJ and Spady AA (1986) Pilot workload and eye tracking, NASA Technical Paper 2525.

Harris D and Khan H (2003) ‘Response time to reject a takeoff’, Human Factors and Aerospace Safety, 3(2): 165–175.

Hawkins FH (1987) Human factors in flight, Ashgate, Aldershot UK.

Hayes J (2014). The theory and practice of change management, 4^th edition. Palgrave, United States.

Holt RW, Boehm-Davis DA and Beaubien JM (2001) ‘Evaluating resource management training’, Improving teamwork in organizations: Applications of resource management training, pp.165–188. CRC Press.

House AP, Ring JG and Shaw PP (2020a) ‘Inventive nesting behaviour in the keyhole wasp Pachodynerus nasidens Latreille (Hymenoptera: Vespidae) in Australia, and the risk to aviation safety’ PloS one, 15(11): 1–14.

House AP, Ring JG, Hill MJ and Shaw, PP (2020b) ‘Insects and aviation safety: the case of the keyhole wasp Pachodynerus nasidens (Hymenoptera: Vespidae) in Australia’, Transportation research interdisciplinary perspectives, 4: 1–14.

International Air Transport Association (IATA) (2020) Guidance for Managing Aircraft Airworthiness for Operations During and Post Pandemic. 2^nd edition, IATA, Canada.

Joint Aviation Authorities (1997) JAR–FCL: Part 1. (Aeroplane) flight crew licensing requirements. Hoofddorp, Netherlands: Author.

Knabl P, Cameron M, Dahlstrom N, Nolan P, Myers R and Da Cruz J (2018) Emirates/Seeing Machines A380 Eye tracking study 2018/2019 Internal report. Unpublished.

Landman, A, Groen, EL, van Paassen, MM, Bronkhorst, AW and Mulder M (2017) ‘The influence of surprise on upset recovery performance in airline pilots’, The International Journal of Aerospace Psychology, 27(1-2): 2–14.

Lee, YH & Liu, BS 2003, ‘Inflight workload assessment: Comparison of subjective and physiological measurements’, Aviation, Space, and Environmental Medicine, 74(10): 1078–1084.

Mack, A (2003) ‘Inattentional blindness: Looking without seeing’, Current Directions in Psychological Science, 12(5): 180–184.

McKee, SP and Nakayama, K (1984) ‘The detection of motion in the peripheral visual field’, Vision Research, 24(1): 25–32.

Mumaw, RJ, Sarter, NB and Wickens, CD (5-8 March 2001) ‘Analysis of pilots’ monitoring and performance on an automated flight deck’ [conference paper], 11th International Symposium on Aviation Psychology, Ohio, accessed 15 August 2019.

Orasanu, JM (1994) ‘Shared problem models and flight crew performance’ in Johnston, N, McDonald and Fuller, R (eds) Aviation Psychology in Practice, Ashgate, Aldershot.

Orasanu, J, Martin, L and Davison, J (29-31 May 1998) ‘Errors in aviation decision making: bad decisions or bad luck?’ [conference paper], Fourth Conference on Naturalistic Decision Making, Virginia, accessed 20 January 2021.

Orasanu JM (2010) ‘Flight crew decision-making’, in Kanki BG, Helmreich RL and Anca J (eds) Crew resource management, Elsevier, Amsterdam.

Proctor RW and Proctor JD (2012) ‘Sensation and perception’, in Salvendy G (eds) Handbook of human factors and ergonomics, John-Wiley and Sons, New Jersey.

Reason, J (2016) Managing the risks of organizational accidents, Routledge, United Kingdom.

Samn SW and Perelli LP (1982) ‘Estimating aircrew fatigue: a technique with application to airlift operations’ United States Air Force (USAF) School of Aerospace Medicine SAM-TR-82-21, United States.

Stevens, C, Perry, N, Wiggins, M and Howell, C (2006) Design and evaluation of auditory icons as informative warning signals, ATSB Transport Safety Report B2005/0120.

Stevens, SM, Goldsmith, TE, Johnson PJ and Moulton JB (2007) ‘Performance Differences on Rejected Takeoffs as a Function of Expectancy’, Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 51(2): 80–84.

Underwood, G, Ngai, A and Underwood, J (2013) ‘Driving experience and situation awareness in hazard detection’, Safety Science, 56: 29–35.

Veltman, JA and Gaillard, AWK (1998) ‘Physiological workload reactions to increasing levels of task difficulty’, Ergonomics, 41(5): 656–669.

Wickens, CD, Hollands, JG, Banbury, S and Parasuraman, R (2013) Engineering psychology and human performance, 4th edn. Pearson, United States.

Wolf, OT (2014) ‘Stress and memory retrieval: mechanisms and consequences’, Current Opinion in Behavioral Sciences, 14: 40–46.

Wolfe, JM, Brunelli, DN, Rubinstein, J and Horowitz, TS (2013) ‘Prevalence effects in newly trained airport checkpoint screeners: trained observers miss rare targets, too’, Journal of vision, 13(3): 1–9.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Airbus
• Airservices Australia
• Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA)
• Brisbane Airport Corporation
• Civil Aviation Safety Authority
• Heston MRO (previously Aircraft Maintenance Services Australia)
• Lufthansa Systems
• Malaysia Airlines
• Menzies Aviation
• captain and first officer
• leading hand and dispatch coordinator
• licensed aircraft engineer
• support engineer
• Swiss Transportation Safety Board
• tower and departure controllers.

Submissions were received from the following parties:

• Airbus and BEA
• Civil Aviation Safety Authority
• Malaysia Airlines

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A – Airworthiness bulletin AWB 02-052: Mud Wasp Infestation – Alert (Issue 6)

Appendix B - Personnel information

Captain

The captain held a Malaysian Air Transport Pilot (Aeroplane) Licence (ATPL), was certified in English proficiency at level 6 and held a valid Class 1 medical which contained limitations of ‘valid only as or with a co-pilot and shall wear corrective lenses. The captain held the appropriate qualifications to command the flight. Table C1 summarises the captain’s aeronautical experience.

Table C1: Summary of captain’s aeronautical experience

Total flying hours	14,411 hours
Total hours on the A330	555 hours
Total flying last 28 days	72.07 hours
Last proficiency check (simulator)	27 January 2018
Last line check (aircraft)	14 September 2017

The captain had worked for Malaysia Airlines since 1993 on Boeing 747 and 737 variants. In May 2017 the captain transferred from the 737-800 fleet to the Airbus A330 fleet. The operator’s A330 conversion course consisted of computer-based training, simulator training and line training in the aircraft.

A review of training records noted that training and check pilots commented that the captain’s abilities and performance during training were about average. A range of comments were noted on the captain’s command line training forms, generally not associated with any particular theme except that they showed that the captain may have had some difficulty with hand-flying using instrument raw data on the A330 only (likely to be associated with relative inexperience on this type). During the conversion training conducted in the simulator the A330 unreliable airspeed indication procedure was demonstrated to the captain.

The captain also completed the operator’s training programs in the following areas:

• crew resource management training in March 2017
• emergency procedures A330 conversion training in May 2017.

On 15 September 2017, the captain was cleared to line flying on the A330.

The occurrence flight was the first time the captain had operated to Brisbane Airport on an A330.

First officer

The first officer (FO) held a Malaysian ATPL, a current Class 1 medical certificate and held the appropriate qualifications to conduct the flight. Table C2 summarises the FO’s aeronautical experience.

Table C2: Summary of FO’s aeronautical experience

Total flying hours	6,544 hours
Total hours on the A330	4,582 hours
Total flying last 28 days	95.53 hours
Last proficiency check (simulator)	7 March 2018
Last line check (aircraft)	21 March 2018

A review of training records since 2016 indicated that the FO’s abilities and performance were consistently assessed to an above average standard.

Licensed aircraft engineer

The Malaysia Airlines licensed aircraft engineer (LAE) who certified for the aircraft on the night of the incident conducted an apprenticeship with the operator and attained an engineer licence in 2000, further attaining a type rating for the Airbus A330 in 2008. The LAE’s normal role was leading hand on a line maintenance shift at the operator’s main base in Kuala Lumpur, Malaysia.

When asked to self-rate fatigue using the Samn-Perreli scale (Samn and Perelli 1982), the LAE reported a rating of 4-5, indicating a level between ‘a little tired, less than fresh’ and ‘moderately tired, let down’. Accordingly, further information was obtained about the LAE’s 72-hour history.

The LAE took an 8-hour flight from Kuala Lumpur to Brisbane at 2030 on 16 July, having obtained ‘a few hours’ of sleep on the flight. Upon arriving in Brisbane, the LAE conducted a transit check on the aircraft. This aircraft had a hydraulic leak, which delayed its departure until about 0330. The LAE got to sleep about 0600, sleeping until about 1400 and having the rest of that day (17 July) off.

The LAE obtained about 10 hours of sleep the night before the occurrence, waking at 0600 on 18 July and spending the day at leisure before commencing travel to the airport at about 1700.

Based on this information, ATSB analysis, including the use of fatigue modelling software indicated that the LAE was not likely to have been experiencing a level of fatigue known to have a demonstrated effect on performance at the time of the occurrence.

Support engineer

The support engineer had about 18 years of experience in aircraft maintenance and joined AMSA in 2015. At AMSA the support engineer carried out line maintenance on customer aircraft as directed by AMSA licensed aircraft maintenance engineers.

There were no indications that the support engineer was experiencing fatigue at the time of the occurrence.

Leading hand

The leading hand had worked as a ground handler for about 6 years and was qualified to manage a team of ground handlers and certify for aircraft loading. The leading hand was also trained in receipt and dispatch in August 2017 through theoretical and practical training and assessment. That training covered several different aircraft types including the Airbus A330.

The leading hand started a ten-hour shift at 1500. They reported having a ‘pretty good’ level of alertness during the shift.

Dispatch coordinator

The dispatch coordinator had about 8 years of ground handling experience and was qualified to conduct leading hand duties, certify for loading aircraft and conduct dispatches. Training records showed the completion of dispatch coordination training, including both theoretical and practical training, in November 2016. That training appeared similar to that of the leading hand and covered several different aircraft types including the Airbus A330.

The dispatch coordinator started a ten-hour shift at 1500.They indicated that they ‘did not feel tired’ at the time of the occurrence, having just had 2 days off.

Appendix C - Recorded data

Overview

The ATSB recovered and downloaded data from the aircraft’s cockpit voice recorder (CVR) and flight data recorder (FDR) and obtained data from the aircraft’s digital aircraft recorder (DAR), used for routine monitoring by the operator. The post-flight report (PFR) was viewed and printed on the aircraft.

The data from the CVR and FDR contained all of the occurrence flight, while the DAR included all data up to 2348 and intermittent data after that time.^[83]

Flight data recorder and digital aircraft recorder

Airspeed measurement

The FDR recorded computed airspeed (CAS) from air data inertial reference unit (ADIRU) 3 once per second, and additionally from any one of the three ADRs twice per second depending on flight crew selection and data validity:

• if the air data switch is in NORM^[84] or F/O ON 3,^[85] and the data from ADIRU 1 is valid, the data from ADIRU 1 is recorded
• if the air data switch is in NORM or F/O ON 3, and the data from ADIRU 1 is invalid, the data from ADIRU 2 is recorded
• if the air data switch is in CAPT ON 3,^[86] and the data from ADIRU 3 is valid, the data from ADIRU 3 is recorded
• if the air data switch is in CAPT ON 3, and the data from ADIRU 3 is invalid, the data from ADIRU 2 is recorded

For each ADIRU, the airspeed data is considered valid when it is above 30 kts and there are no related fault conditions. Invalid data is indicated in the recording.

Throughout most of the flight, the recorded airspeed was invalid. There were some periods where airspeed data was valid (but incorrect), notably:

• For a period starting at 2331:39, after the aircraft passed 140 kt groundspeed on take-off, the CAS was recorded increasing through 32 knots, indicating that ADIRU 1 or ADIRU 2 first sensed airspeed above 30 kt at this time.
• At rotation, the FDR recorded 38 kt airspeed from ADIRU 1 or ADIRU 2 and the airspeed from ADIRU 3 had not yet reached 30 kt.
• ADIRU 3 first sensed airspeed above 30 kt at 2331:54 (the ISIS would have stayed at or near the bottom of the speed scale throughout take-off). The maximum airspeed sensed by ADIRU 3 was 57 kt.
• At 2338:29 the airspeed again reduced below 30 knots and was marked invalid. Over the following 10 minutes there were short intervals where the airspeed was recorded above the 30‑kt threshold.
• The maximum airspeed recorded was 66 kt at 2337:13 when the aircraft was at about 11,000 ft with a groundspeed of 226 kt.

Overall, these recorded airspeeds were consistent with the pitot probes being covered and having partial airflow passing through the covers at times, resulting in erroneous low airspeeds being measured.

The DAR sampled CAS once per second and preliminary analysis shows broadly similar values as the FDR.

Airspeed displays

It is generally not possible to conclusively determine which of the primary flight displays (PFD) (captain, first officer (FO), or both) showed valid airspeed when the recorded data became valid (above 30 kt) on take-off from 2331:39. After the air data switch was selected to F/O ON 3 at 2332:11, the FDR would have recorded the data from ADIRU 1 if valid, or ADIRU 3 if ADIRU 1 was invalid. Since it recorded valid data but the FDR‑recorded data from ADIRU 3 remained invalid, this means that the data recorded reflected a valid airspeed shown on the captain’s PFD at this time and also reflected the captain’s PFD (that is, from ADIRU 1) until the switch position changed later in the flight. Further, there was no sudden change in this parameter when the switching was made, suggesting that it is more likely than not that it was also recording from ADIRU 1 just before the switch to F/O ON 3 at 2332:11.

After the switch to F/O ON 3, as the ISIS CAS was still invalid, the FO’s PFD would have displayed the red speed flag from that point even if the data from ADIRU 2 was valid. From this point until the switch was returned to NORM, the recorded PFD CAS would have therefore been the same as shown on the captain’s PFD (through ADIRU 1).

When airspeed is invalid or below 60 kt, the associated angle of attack (AOA) data is flagged invalid. All three ADIRUs flagged AOA as invalid throughout the take-off. Since AOA 2 was invalid, if ADIRU 1 and ADIRU 2 airspeeds had both been displayed at any point during the take-off, the airspeed on the FO’s PFD remained below 60 kt.

The first time AOA 2 became valid was at 2332:24, at which time the air data switch was in the F/O ON 3 position and the FDR recorded 38 kt airspeed. This means that, at this time, the recorded airspeed data would have been from ADIRU 1; the captain’s PFD was indicating about 38 kt and the FO’s PFD was indicating at least 60 kt.

AOA 1 first became valid at 2333:40. The recorded CAS parameter smoothly reached 60 kt at this time, indicating that the recording was from ADIRU 1 at this point. AOA 3 was invalid for the entire flight.

The aircraft’s flight control computers entered normal law from 2333:42 to 2333:45. At the time, recorded CAS was 62 kt, the integrated standby instrument system (ISIS) CAS was 37 kt, and both AOA 1 and AOA 2 were valid. This means that the airspeed data, though invalid, met the conditions for the aircraft’s flight control computers to reconfigure to normal law for this brief period, .

Potential for stall

An aircraft may stall if AOA, which is the vertical angle of the airstream relative to the aircraft, is too high. This can occur when a pilot attempts to maintain height or climb when airspeed is too low. Although the AOA sensor data was treated as invalid for most of the flight because each associated airspeed was mostly below 60 kt, the AOA sensors were functioning correctly, and the FDR recorded their measurements. The ATSB estimated the aircraft’s proximity to the stall warning angle throughout the flight based on available recorded data. The AOA measured throughout the flight was below the estimated stall warning angle and well below the actual stall angle, meaning that the aircraft did not approach a stall condition at any point throughout the flight.

Potential speed exceedances

The ATSB estimated airspeed throughout the flight using the groundspeed, heading, and the recorded winds aloft at around the time of the flight. The resulting speeds are indicative of potential exceedances of the aircraft’s maximum permissible speed with the current configuration (flaps and landing gear) throughout the flight.

The maximum flap extended speed may have been slightly exceeded twice:

• for a period of about 2 minutes on climb (750–6,000 ft), by an average of about 8 kt up to a maximum 14 kt
• for a period of about 80 seconds after levelling off, by an average of about 3 kt up to a maximum of 5 kt

Cockpit voice recorder

Overview

The CVR recorded three channels: the captain’s and FO’s microphones and an area microphone. The CVR recording was from about 1303:22 onwards.

Interpretation of flight crew utterances

The audio quality of the captain’s and area channels were generally satisfactory. The FO’s channel was somewhat distorted.

Three ATSB investigators separately evaluated the flight crew speech and then compared interpretations. In addition, the operator’s interpretation of the area microphone channel (with the assistance of the flight crew) was also considered. The operator allowed the flight crew to review the recording.

Where there was any significant doubt about an interpretation, the more likely interpretation was given preference while allowing for the possibility of other interpretations. The least distinct statements are listed in Table C8.

Table C8: Least distinct flight crew statements

Time	Speaker	ATSB interpretation	Operator interpretation	ATSB comments
2331:18	Captain	‘ah, speed, speed’.	‘speed’	Very faint on the area channel.
2331:31	FO	‘bort uh’, ‘both yes’ or ‘what uh’	‘abort?’ (sounded like ‘bort?’)	Sounded most like ‘bort.’
2331:32	Captain	‘borders are red’	‘both also don’t have’	Syllable count is most consistent with ‘borders are red.’ The operator’s interpretation was that the captain was responding to the FO’s question, thinking that the FO had said ‘both?’, as in ‘are both airspeed indications inoperative?’
2331:33	FO	‘oh no’ or ‘both no’	‘both no’	-
2331:37	FO	‘captain?’	‘capt..?’	-
2331:40	FO	‘go to ADR three’ then indistinct	‘put to ADR three… abort, abort’	FO’s channel and area channel sounded completely different on the indistinct part.
2331:40	Captain	‘okay, check’	‘ah check’	Difficult to hear on the area channel as it was at the same time as the FO’s statement.

Loudness of speech during take-off

The loudness of the flight crew utterances during the take-off from commencement of take-off roll to rotation were measured using Audacity software (version 3.0.2, build ff5003a) with the ‘contrast analysis’ tool.^[87] This tool measures the difference between foreground (target) audio and background audio according to the WCAG 2 standard,^[88] which is an accessibility standard for web content. Under this standard, a minimum 20 dB^[89] loudness above background noise is required for the content to be considered acceptable.

The average loudness of the captain’s speech during this period was measured to be 25.8 dB above the background noise, and the FO’s was 27.8 dB. All statements by both pilots exceeded the 20 dB WCAG 2 standard except for the captain’s ‘speed’ utterance, which was 17.8 dB above the background noise.

Flight crew breathing rate during take-off

Respiratory (breathing) rate and intensity can be indicative of a level of individual stress. Typical respiratory rate for a healthy adult at rest is 15–18 breaths per minute.

The captain’s breathing was indistinct (indicating low intensity) until 2331:19, just after the ‘speed’ statement. Between that point and aircraft rotation, the captain’s breathing rate was at least 33 breaths per minute.

The FO’s breathing was indistinct until 2331:27, just before the 100 kt call, when a very faint breath was heard. The FO’s breathing increased in intensity from 2331:32 onwards, and until rotation the FO’s breathing rate was at least 26 breaths per minute.

Post-flight report

The PFR is a record of faults and messages detected by aircraft systems. Electronic centralised aircraft monitor (ECAM) messages, along with faults that are not presented to the flight crew are recorded in the PFR with the time that each fault or message first arose being recorded with 1‑minute precision. The order of messages and faults is not preserved when they fall within the same 1‑minute period.

The PFR was closed (that is, it ceased recording faults and messages) at 2336 due to logic intended to mark the end of a flight: when one of the ADIRUs provides a valid airspeed value above 80 kt for more than 1 s, and then none of the ADRs provided any valid airspeed above 80 kt for the next 150 s. These conditions were probably initially met at 2333, consistent with the brief presence of valid AOA data from ADIRU 2 at 2333 that indicated the associated pitot probe measuring airspeed above 60 kt at that time (that data was not directly recorded).

The PFR faults and messages, along with other effects, are listed in Table C9 with explanations based on ATSB and Airbus analysis.

Table C9: Effect of air data absence on aircraft systems

Time	Effects	Explanation
ECAM messages to the flight crew
2331	FLAG ON CAPT PFD: FD FLAG ON CAPT PFD : SPD LIMIT FLAG ON FO PFD: FD FLAG ON FO PFD : SPD LIMIT	The flight director and speed limit indications on both PFDs became unavailable as a result of the absence of valid air data.
AUTO FLT A/THR OFF	Autothrust disconnected due to the absence of two valid air data systems. This resulted in a master caution and associated chime after take-off.
F/CTL ALTN LAW	The loss of valid air data led to the flight control system entering alternate law at 1500 ft radar altitude (the alert is inhibited before then). Full stall prevention was not available, replaced by a stall warning that used AOA data[90] routed through the inertial reference part of the ADIRUs.
2332	ENG 1 EPR MODE FAULT ENG 2 EPR MODE FAULT	Engine pressure ratios were invalidated due to the absence of valid air data. As a result, the engines reverted to a degraded mode, where the thrust levers command N1 (compressor/turbine speed) rather than the engine pressure ratio.
Recorded fault messages (not displayed to the flight crew)
2331	ADIRU1+2+3 (1FP1+2+3) ADR	Each ADIRU flagged its associated AOA data invalid because the associated airspeed did not reach the minimum of 60 kts for AOA validity. The electronic flight control system rejects an ADIRU when it has invalid AOA data and the aircraft is airborne; this occurred for all 3 ADIRUs at lift-off, resulting in this fault.
2332	SENSE LINE: P2 TO EEC/EEC(E1-4000KS)	Engine pressure sensors, which were probably sensing valid data, were invalidated because they disagreed with the incorrect but matching pitot pressures provided by 2 of the ADIRUs.
2333	AUTO FLT REAC W/S DET FAULT	Reactive windshear detection fault was generated due to absence of valid angle of attack data.
2334	Intermittent EFCS	Maintenance messages associated with the receipt of invalid air data.
Hard ADIRU2(1FP2)/ FMGEC2(1CA2)

__________

83. The DAR was set to only record information that met the operator’s flight data analysis capture criteria.
84. NORM: normal.
85. F/O: first officer.
86. CAPT: captain.
87. See https://manual.audacityteam.org/man/contrast.html
88. WCAG: web content accessibility guidelines. See https://www.w3.org/TR/WCAG20/. Although this standard is not intended for analysis of CVR audio and does not necessarily mean that the speech cannot be (or is unlikely to be) heard and understood, it was considered a reasonable indication of the relative loudness of each utterance. Criterion 1.4.7 was used.
89. Ratios between two values are often expressed in decibels (dB). Speech that meets the 20 dB requirement will seem approximately 4 times louder than background noise.
90. Although AOA data was treated as invalid by the air data systems because the measured airspeed was too low, the data was treated as valid by the stall warning system.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.