Accidents usually occur when a number of factors align – like the holes in the Swiss cheese. Steve Ayres thinks eliminating the holes before getting airborne has to be the best approach…
Steve Ayres
23 November 2021
A number of recent accidents had me reflecting on the ‘Swiss cheese’ model we often quote in aviation. We all recognise that there are lots of things that can challenge us when we go flying, but we strive to make sure they are minimised and don’t all align to culminate in an accident. Breaking the chain is often key.
But in these recent accidents it occurred to me that a major factor was an aircraft fault which was already known about, and that it was while dealing with the consequences of that fault in flight that the incident occurred.
Adopting a Swiss Gruyere rather than an Emmental approach to flying has to be the better way forward!
A Hartwig Air Beechcraft Baron 95-B55 departed Ceduna Airport, South Australia, for a night-time charter flight with the pilot and one passenger onboard. During the flight, the pilot noted that when the autopilot was engaged, the aircraft was ‘snaking left to right’ but felt that, overall, its tracking was not greatly affected (the aircraft’s slight left and right lateral motion during the flight was evident in the aircraft’s tracking data). The pilot had also observed the same behaviour on an earlier flight that day.
“Downloaded data from the autopilot system revealed three in-flight error codes”
The aircraft was cleared for a night visual approach and descended towards Parafield Airport for a downwind join. At the time, the pilot’s focus was on the autopilot, resulting in the pilot losing sight of the runway.
The aircraft passed over the control tower, parallel with the downwind leg of the circuit and descended to about 1,330ft. At the same time, another aircraft was at 700ft and turning onto the final leg of the circuit for Runway 21R, so the tower controller instructed the pilot of the Baron to maintain 1,500ft. At this time, the pilot believed (incorrectly) that the aircraft was positioned on the downwind leg for runway 21R.
Seventeen seconds later, the controller instructed the pilot to make a right turn with the intention of repositioning the aircraft to join final for runway 21R via a teardrop turn. The pilot started a right turn, during which the aircraft proceeded outside both the circling area and Parafield control area close to high ground. During the right turn, the pilot could not see the runway and continued flying south-east at 1,400ft while looking for it.
About 30 seconds later, the tower controller requested confirmation that the pilot was returning to the airport and informed them that the aircraft was no longer in controlled airspace.
The aircraft continued tracking away from the airport and the controller instructed the pilot to track directly to the airport, maintain 1,500ft, and join the downwind leg.
With the aircraft still travelling south away from the airport, the controller requested confirmation that the pilot could see the airport. The pilot acknowledged and turned the aircraft towards Parafield Airport, subsequently landing safely.
The pilot stated that the behaviour of the autopilot led them to lose confidence in its performance and partly focus on the autopilot during the approach, and that when the aircraft flew over the control tower in line with the runway, they believed the aircraft was positioned on the downwind leg.
The instrument-rated private pilot and passenger departed into instrument meteorological conditions in a Piper PA 46 with a 600ft cloud ceiling. Air traffic control data showed the aeroplane in a climbing left turn that continued beyond the assigned heading.
After reaching 1,400ft amsl, the aeroplane continued turning left and its altitude and speed began to vary. The aeroplane continued in a left spiral, completing more than two full circles, then decelerated in a right turn and rapidly descended until impact with terrain.
Examination of the flight control system revealed no evidence of mechanical malfunctions and downloaded engine data indicated normal engine operation. Downloaded data from the autopilot system revealed three in-flight error codes.
The first error code, which likely occurred about one minute after take-off, would have resulted in the autopilot, if it was engaged at the time, disengaging. The subsequent error codes likely occurred during the erratic flight profile, with the autopilot disengaged.
The mechanic who performed the aeroplane’s last annual inspection stated that the pilot told him that he was having intermittent issues with the autopilot system, such as it not following a selected heading or course. The aeroplane was scheduled in November 2018 for work on this issue, but the appointment was not kept.
In January 2019, the pilot told the mechanic that the autopilot issue had not yet been fixed. The pilot’s girlfriend, who flew with the pilot on several flights during the months leading up to the accident, stated the autopilot would frequently not engage after take-off. When this occurred, the pilot would focus on getting the autopilot to operate during the departure. On one of these flights, she became concerned when the aeroplane entered an unusual attitude.
The pilot of the retractable landing gear-equipped Cessna R182, reported that, after take-off, there was an issue with the alternator. He checked the circuit breakers, which were ‘in’ and decided to land at a nearby airport to have the alternator examined.
During the approach, he placed the landing gear handle in the gear extended position. He said it felt ‘normal’ but that he did not remember if he heard the landing gear motor. He did not look outside the high-wing aeroplane to check the landing gear position, and he did not remember seeing the green landing gear position lights illuminate. He added that the landing gear warning horn did not sound.
He reported that, during landing, the nose landing gear was down and locked, but the main landing gear was trailing behind the aeroplane and the aeroplane slid to the left side of the runway. The pilot reported that if he had known the gear was not extended, he would have manually pumped the landing gear down.
The mechanic reported that, when he arrived at the aeroplane post-accident, the landing gear circuit breaker was popped. He jacked up the aeroplane and repositioned the landing gear and then turned on the power, pushed in the landing gear circuit breaker and raised the landing gear.
He did not recall hearing the warning horn but mentioned that the throttle ‘may have been pushed in’. He successfully cycled the landing gear multiple times.
The mechanic added that a previous pilot of the accident aeroplane reported that the landing gear circuit breaker would often pop and that he would lower the landing gear with the manual pump.
The pilot and student pilot-rated passenger were in a Mooney M20K and inbound for landing.
Multiple witnesses saw the aeroplane on the downwind leg of the airport traffic pattern. One witness estimated that the aeroplane was lower and closer to the runway than a typical traffic pattern.
Witnesses then saw the aeroplane begin a left turn, and one reported that the aeroplane then rapidly transitioned to a nose-down descent.
The wreckage location corresponded to an extended downwind-to-base turn. There was ample space available for the pilot to initiate the turn to final without excessive flight control inputs. The aeroplane appeared to be in the landing configuration, and debris distribution and damage indicated a near vertical, nose-down impact, consistent with the aeroplane impacting the ground while in a spin.
Post-accident examination did not reveal any anomalies with the airframe or engine that would have precluded normal operation, and the engine appeared to be operating at the time of impact. However, evidence suggested that the aeroplane’s engine-driven vacuum pump had recently failed.
Such a failure would have resulted in multiple visual alerts, caused the vacuum-operated instruments to become inoperative, and prevented operation of the aeroplane’s speed brakes. The aeroplane was equipped with a back-up vacuum system, however, impact damage prevented an accurate assessment of its operational status at the time of the accident.
The vacuum pump had exceeded its manufacturer’s recommended replacement life and had been subjected to multiple sudden engine stoppage events, each of which required replacement of the pump.
However, there was no indication in the aeroplane’s logbooks that the pump had been replaced following these events.
Although none of the systems that relied on the vacuum pump were critical for visual flight rules operation, such a failure would have presented an operational distraction to the pilot that would have competed for his attention while flying in the pattern.
Based on witness reports and the location of the wreckage, it is possible that he extended the downwind leg to attempt to manage the failure or in an effort to slow the aeroplane further to land without the speed brakes. The presence of a systems failure may have exceeded the pilot’s capability to appropriately divide his attention between aeroplane control and systems management.
Distractions are never far away in our everyday flying and we have learned to manage most of them effectively. They can be responsible for holes in our piece of Swiss cheese but they are usually small. Training and experience being the best way to keep them that way, of course.
However, the case studies discussed involve distractions that are arguably entirely self-induced. They effectively existed in the piece of cheese before the pilot ever got airborne. The particular fault had the potential on every flight to feature highly and as such would almost certainly align with other holes to become a factor in whether an accident would be avoided or not.
How big a threat those known faults become is, of course, in part down to how competent the pilot is in coping with them. Experienced, current aircrew would hopefully do a better job than the occasional, inexperienced flyer. But some days, most of us fall into that latter category so having pre-existing known threats means the odds are stacked against us from the get-go.
Not that I am suggesting a functioning autopilot should be an essential piece of equipment in order to fly safely, but it can release capacity to deal with other issues when your back is against the wall. An undercarriage circuit breaker that pops occasionally is probably manageable most of the time if you know about it and nothing else goes wrong like running short of fuel or, as in this case, an electrical emergency occurs.
Finally, there is the issue of maintenance. Perhaps back-up systems exist but they too have to be functioning and reliable to get you out of a hole safely and there is a suggestion in the final example that it may not have been the case. Even if it was, why hollow out a giant cavity in the middle of your piece of cheese that sits there waiting to line up with other holes every time you get airborne?
Often the consequences of a particular component failure are not well thought through and are rarely tested against every circumstance we are likely to encounter when flying on a particular day.
So perhaps it’s time to get those old or temperamental bits of kit serviced and functioning correctly before next getting airborne?
