Description

On 6 August 2005, an ATR 72-210 being operated by Tunis Air subsidiary Tuninter on a scheduled passenger service from Bari, Italy to Djerba, Tunisia ditched into the sea in day VMC approximately 23nm north east of Palermo Airport after a rundown of both engines in quick succession following fuel exhaustion. The aircraft broke up on impact with the water and sixteen of the occupants were killed and sixteen, including both pilots, were seriously injured. The remaining seven sustained minor injuries.

Investigation

An Investigation was carried out by the Italian Agenzia Nazionale per la Sicurezza del Volo (Agenzia Nazionale per la Sicurezza del Volo (Italy) (ANSV)). The FDR and CVR were recovered and successfully downloaded. The CVR was found to have continued recording until impact and the FDR until about a minute before it, when it recorded the aircraft altitude as 728 feet.

It was established that in the cruise at FL 230 approximately 50 minutes after takeoff with the aircraft commander acting as PF, the No 2 engine had run down. Shortly afterwards, and four minutes after a previous routine communication, ATC received a request to descend to FL 170 made by the PM due to an unspecified technical problem and permission to descend initially to FL 190 was given. From FDR data, it was apparent that just under 2 minutes after the rundown if the No 2 engine, the same occurred to the No 1 engine. ATC were advised that the aircraft wanted to divert to Palermo. A MAYDAY was declared with a request for radar vectoring to Palermo and the information that they had “lost both engines”. As the aircraft position did not allow the ACC frequency being worked to provide the requested vectors, the aircraft was transferred to Palermo APP.

Attempts to restart both engines were unsuccessful and after gliding for approximately 16 minutes, the aircraft ditched approximately 23 nm northeast of Palermo Airport having advised ATC that it would not be possible to reach the Palermo. Two vessels had been observed in the vicinity of the ditching location and the aircraft was turned so as to land parallel to their tracks. The PM did not complete the ditching checklist but the landing gear remained up as required. The Investigation estimated that a rate of descent of 700-800 fpm had been maintained until shortly before impact and that the pitch at water impact had been about 9° - close to the optimum figure. It was also considered that the damage sustained to the aircraft was commensurate with water impact in an approximately wings level attitude.

The water impact occurred in sea state at an airspeed which appeared to have been in the vicinity of the speed which would have triggered the aural stall warning. The aircraft broke into three parts at impact, the fuselage ahead of the wing attachment, the wing attachment section and the fuselage to the rear of the wing attachment. It was considered probable that the rear fuselage contacted the water first, followed by a reactive pitch forward which led to the front of the forward fuselage being submerged.

All three sections remained afloat and partially attached for 20 to 30 minutes after which time the forward and aft fuselage sections sank. Although the rear fuselage section was partially submerged, almost all the passengers seated in it survived. The front of the forward fuselage section including the flight deck was “completely crushed” by the impact.

As the Investigation progressed, it became apparent that the flight crew had been unaware of the risk of fuel exhaustion because the fuel quantity indications were that sufficient fuel was on board.

It was found that at the conclusion of the previous days flying by the accident aircraft, a malfunctioning Fuel Quantity Indicator (FQI) for the right wing fuel tank had been recorded in the Aircraft Technical Log by the same Captain who had then flown the aircraft on the accident flight the next day.

To clear the defect, the FQI was replaced - but inadvertently with one for an ATR 42 which is only compatible with the maximum capacity, shape, number and positioning of the capacitive probes of that aircraft type. The Investigation established that the effect of installing FQIs from ATR 42 in an ATR 72 would lead to the display of more fuel in tanks than the actual quantity present.

It was found that that despite the ATR 42 and ATR 72 FQIs were identical in their dimensions and in respect of the installation procedure and that the procedure applicable at the time “did not require any manual checks, using the so-called dipsticks, of the actual quantity of the fuel present in each tank, or the subsequent comparison with the value shown by the FQI”. 'The only difference between the two FQI types following installation was found to be white lettering on the front of the instrument indicating the maximum fuel quantity for each fuel tank, “2500” for the ATR 72 or “2250” for the ATR 42 – see the illustration below.

The effect of the maintenance error made was that whilst the actual quantity of fuel on board after completion of maintenance input was 790 kg, the indicated quantity was between 3050 to 3100 kg.

In the case of the actual engine rundown the following day, it was found that the FQI was indicating a total of 1800 kg of fuel remaining, 900 kg in each wing tank when the actual useable fuel on board was zero. It was considered that “the simultaneous failure of both engines is in fact an extremely improbable condition” and that the possibility of fuel contamination could reasonably be discounted given that nearly a hour of prior flight had been uneventful. It was also concluded that the FQI indications “did not allow (the crew) clarification of the cause of engine shutdown” and noted that most of their attention had been given requests for the distance to Palermo airport and to attempts to restart the engines.

In respect of whether ditching outcome was inevitable or whether different aircraft management could have prevented it, it was considered as follows:

“From simulations performed using the ATR calculation software regarding aircraft performance check, it has been determined from a theoretical point of view that, applying the required procedures in both engines failure conditions, especially with particular reference to the maximum efficiency speed, the aircraft would have been able to reach Palermo airport. However, on the basis of simulator tests, it has proved quite difficult to maintain a correct speed profile, due to possible piloting distractions while following failure management and maintaining a constant control of the situation. It must also be taken into consideration the difficulty of correctly using the information supplied by the remaining instruments available.”

In respect of guidance on the engines off ditching scenario which prevailed in this case, it was considered that “the structure of “ditching” procedure shown in FCOM does not take into account the causes of ditching. In case of failure of both engines, it is quite difficult for the flight crew to adapt to recommendations shown in the emergency procedure”.

In respect of the context in which the incorrect installation of the FQI had occurred, it was considered that at the time of the event, the maintenance and organisation standards of the operator were not compatible with the maintenance of continuing airworthiness. It was noted that the operator had since undertook “a series of actions in order to eliminate maintenance and organisation(al) deficiencies”.

Whilst it was concluded that “the ditching was primarily due to the both engines flameout because of fuel exhaustion” it was considered that the accident was the result of a series of linked contributing factors of which the following were of “major importance”:

• Errors committed by ground mechanics when searching for and correctly identifying the fuel indicator.
• Errors committed by the flight crew: non-respect of various operational procedures.
• Inadequate checks by the competent office of the operator that flight crew were respecting operational procedures.
• Inaccuracy of the information entered in the aircraft management and spares information system and the absence of an effective control of the system itself.
• Inadequate training for aircraft management and spares information system use and absence of a responsible person appointed for managing the system itself.
• Maintenance and organization standards of the operator unsatisfactory for an adequate aircraft management.
• Lack of an adequate quality assurance system;
• Inadequate surveillance of the operator by the competent Tunisian authority.
• Installation characteristics of fuel quantity indicators (FQI) for ATR 42 and ATR 72 which made it possible to install an ATR 42 type FQI in an ATR 72, and vice versa.

The Investigation was also concerned at the potentially prejudicial effects on flight safety of the conflict which had occurred between the interests of the State Investigation of the accident and the Italian judicial process.

In respect of the systemic shortcomings evident in the Tunis Air maintenance organisation at the time of the accident, it was noted that significant Safety Action had since followed including:

• the commencement of human factors training for maintenance technicians, engineers and administration personnel
• recurrent training programmes have been defined and implemented for the whole

staff of the Technical Department section concerning company procedures and line maintenance procedures, with particular reference to engines.

• a new Aircraft Technical Log format has been introduced supported by relevant filling instructions according to JAR-OPS 1 standards with, in particular, a new section for the recording of refuelling and post-flight residual fuel contents and relevant certification.
• the verification of the correctness of information entered in the proprietary ‘Aircraft Management And Spares Information System’ in respect of component Part Numbers and their interchangeability.

It was decided that “on the basis of the above mentioned considerations concerning technical-operational reorganisation actions already implemented by the operator, and monitoring programs for respect of safety standards by the authorities, it is not considered necessary to make any specific safety recommendations” in those areas.

Other relevant Safety Action noted included the publication on 10 October 2005 of a new General Operations Manual specifically for Tuninter to replace reliance at the time of the accident on the same manual issued for operations by the parent Company Tunisair.

Safety Recommendations

A total of eighteen Safety Recommendations were issued as a result of the Investigation, three whilst it was in progress and the remainder on completion. Two Recommendations were issued on 6 September 2005 as follows:

• that the European Aviation Safety Agency (EASA) should require an ATR 72 and ATR 42 fleet inspection in order to verify the installation of the applicable Fuel Quantity Indicator.

[ANSV-6/443-05/1/A/05]

• that the European Aviation Safety Agency (EASA) should consider the possibility to mandate a modification of the Fuel Quantity Indicator installation in order to prevent any incorrect fitting.

[ANSV-7/443-05/2/A/05]

It was noted that on 25 October 2006, the German BFU had, as a result of their investigation into a similar confusion relating to the applicability of FQIs for the ATR 42 and ATR 72 on 18 March 2006, and having noted the rejection by European Aviation Safety Agency (EASA) of the above ANSV Safety Recommendation, issued a further Safety Recommendation to EASA on that they "should arrange that the construction of one of the Fuel Quantity Indicators (FQI) of the ATR 72 or ATR 42 be changed to such a extent that they cannot be interchanged anymore.[14/2006]"

On 5 December 2005, one further Recommendation was issued:

• that the European Aviation Safety Agency (EASA) should consider the possibility to change the fuel system certification regulation for public transport aircraft, in order to require that the fuel low level warning be independent from the fuel gauging systems.

[ANSV-13/443-05/3/A/05]

The remaining 15 Recommendations were as follows:

• that the European Aviation Safety Agency (EASA), in the expectation of the eventual installation modification of the FQI, consider the possibility of:
  • (a) requiring to operators whose fleet includes ATR 42 and ATR 72 aircraft to implement ad hoc maintenance procedures in order to avoid the installation of ATR 42 type FQIs on ATR 72 aircraft and vice versa;
  • (b) requiring the creation of labels to be applied on the FQIs in order to show which aircraft type they must be installed on, ATR 42 or ATR 72.

[ANSV-16/443-05/4/A/07]

• that the European Aviation Safety Agency (EASA) should consider the possibility of integrating information available in emergency procedures concerning the ditching, in order to consider also the possibility of ditching without both engines operating.

ANSV-17/443-05/5/A/07]

• that the European Aviation Safety Agency (EASA) and the Federal Aviation Administration (FAA) should consider the possibility of carrying out studies aimed to define guidelines and/or issue regulatory requirements, concerning P/N assignment methods for aviation components.

[ANSV-18/443-05/6/A/07]

• that the European Aviation Safety Agency (EASA) and the Federal Aviation Administration (FAA) should consider the possibility of carrying out studies aimed to define guidelines and/or issue regulatory requirements, concerning the possibility of providing suitable installation modifications on the aircraft or on the component itself, in order to avoid that components with same functions and ostensibly similar but with different performance, could be installed in error.

[ANSV-19/443-05/7/A/07]

• that the EASA, the FAA and the Tunisian DGAC should consider the possibility (of) all air transport operators perform(ing) a systematic check of the correspondence between P/Ns shown in the applicable Illustrated Parts Catalogue with information contained/recorded in software/databases generally used for spares management, with particular reference to components which directly influence the aircraft’s operation and safety.

[ANSV-20/443-05/8/A/07]

• that the EASA, the FAA, the ENAC and the Tunisian DGAC should sensitise the airlines to the importance of the safety demonstration (briefing) addressed to the passengers, emphasising the importance of carefully following the cabin crew’s instructions,especially during emergencies.

[ANSV-21/443-05/9/A/07]

• that the Tunisian DGAC should perform an “ad hoc” check at national airlines concerning Operation manuals compliance with applicable legislation.

[ANSV-22/443-05/10/A/07]

• that the Tunisian DGAC should, in cabin crew applicants’ selection procedures, provide selective criteria aimed also to check behaviour during emergency situations and subsequent conditions of potential stress.

[ANSV-23/443-05/11/A/07]

• that the Tunisian DGAC should consider the possibility of having joint Recurrent Training (flight crew and cabin crew) characterised by operational scenarios with characteristics similar to the event under examination (preparation for landing outside an airport/ditching, emergency evacuation of passengers, etc.).

[ANSV-24/443-05/12/A/07]

• that the Tunisian DGAC should integrate operational manuals available to ATR 42/72 aircraft flight crew (FCOM and QRH), including further information concerning the identification of engine flame out conditions (uncontrolled shutdown) and their management.

[ANSV-25/443-05/13/A/07]

• that the Tunisian DGAC should consider the possibility of introducing a flight data monitoring system, such as Flight Data Monitoring (FDM), useful as a preventive tool. It has to be pointed out that ICAO Annex 6 (provision 3.2.6) recommends (that) operators of an aeroplane of a certificated takeoff mass in excess of 20000 kg (should) establish and maintain a flight data analysis programme as part of (their) safety management system.

[ANSV-26/443-05/14/A/07]

• that the Tunisian DGAC should promote establishment of reporting systems which allow learning and reduction of risk conditions in technical-operational operations, both for the flight operation part and for the maintenance part.

[ANSV-27/443-05/15/A/07]

• that the Minister of Justice (Italy) and Minister of Transport (Italy), as applicable, should initiate the legislative initiatives necessary to ensure that the ANSV, even in case of a pending judicial authority inquiry, can have immediate and unconditional access to all elements (in primis, to information contained in aircraft’s flight recorders) necessary for the technical investigation.

[ANSV-28/443-05/16/A/07]

• that the Minister of Justice (Italy) and Minister of Transport (Italy), as applicable, should take necessary legislative initiatives aimed to rapidly ensure, in Italy, the rights of accredited representatives and relevant consultants of foreign accident investigation authorities appointed for technical investigations, according to provisions stated in Annex 13 of International Civil Aviation Convention (Annex 13 ICAO) also in the event of a judicial authority inquiry.

[ANSV-29/443-05/17/A/07]

• that the Minister of Justice (Italy) and Minister of Transport (Italy) should, as applicable, adopt necessary legislative initiatives to modify the Italian code, in order to make it consistent with provisions 5.12 and 5.12.1. of Annex 13 of the International Civil Aviation Convention (Annex 13 ICAO). In particular, such initiatives should aim to establish the principle that recordings contained in the cabin voice recorder (CVR), recordings concerning communications between aircraft and between aircraft and ATC centres, as well as recordings of telephone calls between ATC centres, can be used in judicial proceedings, limited to the parts that assume particular relevance for reconstructing the event, while other parts not relevant for event analysis shall not be made available, remaining permanently confidential.

[ANSV-30/443-05/18/A/07]

Final Report

The Final Report of the Investigation was released on 16 January 2008 and subsequently made available in English translation.

Related Articles

• Ditching: Rotary Wing Aircraft
• Maintenance Error
• Airworthiness