Engine malfunction and runway overrun involving Cessna 208B, VH-NWJ, Lizard Island Airport, Queensland, on 8 January 2024

Investigation summary

What happened

On 8 January 2024, a Cessna 208B Grand Caravan, registered VH‑NWJ and operated by East Air, departed Lizard Island Airport, Queensland on a non‑scheduled passenger service to Cairns Airport, with the pilot and 9 passengers on board. During the climb, at approximately 3,400 ft, the pilot observed the engine speed and thrust increase uncommanded, and the engine instrumentation indicated numerous parameters were exceeded or were not indicating at all. The pilot returned to land but due to the uncontrollable excessive power being generated by the engine, they conducted a high‑speed approach, touched down long on a short runway, overran the end, and the aircraft flipped over. All occupants received minor injuries, and the aircraft was substantially damaged. 

What the ATSB found

The ATSB determined that the fuel control unit of the Pratt & Whitney Canada PT6A‑114A engine very likely malfunctioned due to internal or external influences. This resulted in the engine speed accelerating uncommanded and exceeding numerous engine limitations, including the gas generator speed and interstage turbine temperature. The ATSB was not able to determine the exact nature of the fault. 

In accordance with the aircraft flight manual procedure, pilots of PT6A turbine engine aircraft are trained for ‘roll back to idle’ malfunctions, including the use of the manual override or emergency power lever where fitted. However, there was no such procedure for an uncommanded engine acceleration malfunction or inability to reduce power, although this type of event occurred at a rate higher than any other fuel control unit related malfunction or failure mode. As such, ATSB’s consultation with training organisations for the Cessna Caravan aircraft identified that the nature of the fuel control unit malfunction was not widely understood by pilots, operators or the pilot training industry.

What has been done as a result

As a result of this accident, East Air has published a temporary revision to its Quick Reference Handbook for the Cessna 208B aircraft to include an emergency item for 'Unscheduled power increase during flight (High Torque, Ng, ITT and/or Fuel Flow)'. 

The ATSB has issued safety advisory notice AO‑2024‑001‑SAN‑001 in conjunction with this investigation report. The SAN raises awareness of engine acceleration events on PT6A powered aircraft and encourages operators to consider the potential responses to this type of failure for different phases of flight, to document appropriate actions, and to train pilots to ensure that operations are performed correctly and consistently.

Safety message

Procedures are widely recognised as being basic to safe aircraft operations. They are designed to assist with reducing variation within a given process and ensure operations are performed correctly. Without procedures, pilots are required to exercise judgement based on their experience, skills and knowledge. When details regarding certain non‑normal or emergency scenarios are not contained in an aircraft flight manual, air transport operators should consider customising their exposition and providing appropriate training to ensure that their pilots are adequately prepared for such an event. 

Summary video

The occurrence

On 8 January 2024, at about 0646 local time, a Cessna 208B Grand Caravan, registered VH‑NWJ and operated by East Air, departed Lizard Island Airport, Queensland on a non‑scheduled passenger service to Cairns. On board the aircraft were the pilot and 9 passengers.   

After take-off from runway 12, the pilot turned right, tracked south‑south‑west and made a departure call to Brisbane Centre air traffic control (ATC).[1] At 1,750 ft above mean sea level, the pilot turned left onto the departure track in a cruise climb and engaged the autopilot. 

At 0652, passing 3,400 ft at an indicated airspeed of 102 kt, the pilot noted a change to the engine sound and that the aircraft was accelerating (Figure 1, ‘Exceedance event’). The pilot checked the engine gauges on the Garmin G1000 multifunction flight display. They noted the values indicated on both the engine torque and interstage turbine temperature gauges were above the redline and the gas generator speed and fuel flow were not indicating, being marked with a diagonal red cross through the gauge locations. The propeller revolutions per minute was high but within the green operating range.

Within 10 seconds, the pilot initiated a left turn with the purpose of returning to Lizard Island and broadcast a PAN PAN call[2] on the area frequency advising their intentions. Despite trying to arrest it, the aircraft continued to climb and accelerate over the next 2 minutes reaching 4,000 ft and 166 kt.

The pilot started troubleshooting the issue by moving the power, propeller control and emergency power levers with the only response coming from the propeller control lever. The pilot also partially moved the fuel condition lever through the gate[3] from low idle to cut‑off and noted the engine power cutting in and out and returned the condition lever to low idle. At the same time, the pilot conducted a large orbit around the island attempting a shallow descent while the engine continued to produce excessive power. Further manipulation of the propeller control lever somewhat reduced the engine thrust. The pilot updated ATC on their situation and progressively deployed the flaps to create drag in an attempt to slow the aircraft.

After one orbit of the island, the pilot felt they were low enough to attempt a landing with a 2 NM (4 km) final approach to runway 12 and notified ATC of their intentions. The pilot reported they were concerned with the populated resort accommodation and maintenance buildings on the approach end of the runway and the possibility of injury to those on board and on the ground if the aircraft did not have the energy to make the runway. To ensure they cleared potential obstacles, the pilot elected to perform a powered‑on approach. 

The pilot continued to adjust the propeller lever in an attempt to reduce the engine thrust. The final approach was started at 147 kt (the pilot operating handbook stated the normal approach speed with full flaps was 75‍–‍85 kt). The pilot was able to reduce the airspeed to 123 kt by the runway threshold and reported attempting to shut down the engine. The aircraft floated along the down‑sloping runway, bouncing and touching down at around 100 kt, an estimated two‑thirds of the way along the runway. 

The pilot applied maximum braking, but the aircraft exited the end of the runway at 92 kt. The aircraft continued across undulating sandy soil and low vegetation before the left wingtip struck the ground, which spun and flipped the aircraft, coming to rest inverted, 127 m from the end of the runway. 

Figure 1: Flightpath of VH-NWJ

Source: Google Earth, annotated by the ATSB

After the aircraft had stopped, most passengers started evacuating the aircraft through the cargo (rear left) door. The pilot, after completing shutdown actions, exited through the front left door, followed by other passengers. Upon exiting, the pilot noticed a small fire had started at the front of the engine. After ensuring the passengers were still evacuating successfully, the pilot returned to the cockpit to retrieve a fire extinguisher, then discharged it into the engine cowling. The fire was extinguished but continued to smoulder.

Once all passengers had evacuated, the pilot moved them to the end of the runway where they were met by Lizard Island resort staff who raised the alarm with emergency services. Concurrently, ATC tried to contact the pilot but received no response. They engaged another pilot flying in the area to make contact, but that pilot was also unsuccessful in receiving a response. ATC then called the island resort and were advised the aircraft had overturned off the end of the runway. ATC then advised the Australian Maritime Safety Authority Joint Rescue Coordination Centre which coordinated the emergency response.

All aircraft occupants were flown to Cairns Hospital with the pilot and 9 passengers receiving minor injuries. The aircraft was substantially damaged.

Context

Pilot information

The pilot held a commercial pilot licence (aeroplane) with a single-engine class rating and tailwheel, retractable undercarriage, gas turbine engine and manual propeller pitch control design feature endorsements. The pilot had 3,706 hours total aeronautical experience, of which 2,431 hours were on the C208 type. All the pilot’s recent flying had been on the C208B. The pilot held instrument and flight instructor operational ratings.

The pilot held a valid class 1 aviation medical certificate and reported being well rested and fully alert for the flight. The pilot was required to wear distance vision correction.

Airport information

Lizard Island Airport was a restricted access airfield servicing a resort and marine research centre. It had one sealed asphalt 15 m wide runway aligned to 120/300° of 980 m length. The runway rises and falls through approximately 5 m over its length. 

Aircraft information

General

The Cessna 208B Grand Caravan was a high‑wing aircraft powered by a single Pratt & Whitney Canada (P&WC) PT6A‑114A turboprop engine and McCauley Propeller Systems feathering 3‑bladed metal propeller. VH‑NWJ was first registered in Australia in April 2023 and had accumulated about 8,765 hours total time in service at the time of the accident. It was configured with a cargo pod and a 14‑seat interior layout. 

Engine limitations

The P&WC PT6A-114A turboprop engine is managed by a Honeywell DP‑F2 fuel control unit (FCU) controlling and limiting the gas generator speed (Ng), interstage turbine temperature (ITT) and engine torque. Ng and ITT are controlled by the rate of fuel consumption, while engine torque is controlled by a combination of fuel consumption and propeller pitch. The associated limits for the engine and propeller are listed in Table 1.

Table 1: Powerplant limitations for PT6A-114A as installed in the Cessna 208B

[1] Engine torque has a moving limit. If maximum torque is used, propeller rpm must be set so as not to exceed power limitations.

[2] 5-minute limitation.

Source: Pilot’s operating handbook for Cessna Model 208B G1000 aircraft 

Engine controls

In the C208 aircraft, the engine and propeller are controlled principally by 3 levers, the power lever, propeller lever, and fuel condition lever. The power lever primarily controls the amount of power the engine generates. The propeller lever controls the propeller speed (Np) by biasing a constant speed governor. However, in beta mode,[4] the power lever also directly controls the propeller blade angle. The condition lever provides 2 idle speeds for the engine but is there principally as a fuel control to permit starting or stopping the engine. 

Engine power is controlled by the power lever that, through FCU fuel scheduling, controls the gas generator speed. Excess energy generated by the engine core is used to turn the power turbine which, via a gearbox, turns the propeller. The propeller thrust generated is controlled by the propeller rotational speed in combination with the propeller blade angle. The propeller blade angle is adjusted by the propeller speed governor to maintain a constant propeller speed that can be biased by the propeller lever. 

A fourth control is provided on the C208 for emergency purposes. The emergency power lever (EPL) can be used to manually override control of the FCU, which can be effective during certain fuel control malfunctions[5] (refer to section titled Malfunction conditions).

Fuel control unit basic operation

The FCU receives 2 inputs directly from the engine, Ng and compressor discharge air pressure (P3). P3 air passes through 2 metering orifices to the pneumatic section of the FCU. Air from both the first and second pneumatic meterings are used as part of the fuel control and are labelled Px and Py respectively (Figure 2). A flyweight governor driven by the compressor turbine pushes against spring‑loaded levers, which open a bleed valve to Py (governor valve). 

The Py and Px air lines connect to the governor bellows, which controls a liquid metering valve in the fuel side of the FCU. Px and an ambient pressure line are connected to a second bellows (acceleration bellows), which also connects to the governor bellows shaft and is used to provide smooth changes to the fuel scheduling. 

The fuel side of the FCU is supplied with unmetered fuel from the fuel pump. The metering valve, controlled by the governor and acceleration bellows, meters fuel to the flow divider and fuel nozzles.

Figure 2: Fuel control unit schematic 

Source: Pratt & Whitney Canada, annotated by the ATSB

In normal operation when a power increase is requested, the power lever moves the speed set lever in the FCU, which biases the spring pressure to close the governor valve, increasing Py causing the governor bellows to compress, opening the metering valve and increasing fuel flow. As Ng accelerates, P3 increases (and in turn Px and Py) allowing the acceleration bellows to compress, further opening the metering valve. However, the engine does not continue to accelerate as the increase in Ng also increases the flyweight governor force on the governor valve, thereby opening it and reducing Py. This slight reduction finds a new equilibrium in the governor bellows and maintains the metering valve position until another input changes. 

In summary, the power lever indirectly controls the fuel flow to the engine. The governor bellows initiates acceleration, deceleration, and controls the Ng steady state. Increasing Py pressure causes Ng to increase, and vice versa, a decrease in Py reduces Ng. The power lever only biases the governor spring and lever to alter the rate of Py bleed. 

In the case of an FCU malfunction, an EPL is provided to the pilot to manually override the automated fuel scheduling. In practice, moving the EPL drives a shaft in the FCU, which presses on the end of the governor bellows, compressing it and the acceleration bellows mechanism, which in turn opens the fuel metering valve. As such, the feature is used to maintain engine functionality when the engine experiences a power rollback (usually to idle). As the EPL linkage is not directly attached to the governor bellows and can only push on it, the EPL can only be used to increase fuel flow to the engine above what the FCU is scheduling (either in normal use or during a malfunction). The EPL cannot be used to reduce fuel flow and thus cannot control an engine experiencing an uncommanded engine acceleration event.

Meteorological information

There was no Bureau of Meteorology weather station at Lizard Island. The nearest station was at Cape Flattery, 20 NM (37 km) south‑south‑west, which reported winds of 7 kt at 120° and a temperature of 30°C. The pilot reported there was little cloud and light winds of about 5 to 6 kt from the south‑east. Video taken by a witness of the final approach showed greater than 10 km visibility, few cumulus clouds^[6] at lower levels and scattered cirrus cloud at high levels suitable for a visual approach.

Wreckage and impact information

Site information

While there was no evidence of the touchdown point on the runway, a skid mark, identified to be from the right main tyre, started about 110 m before the end of the runway asphalt. The skid mark disappeared and reappeared multiple times towards the end of the runway and was determined to be evidence of wheel brake modulation by the pilot.

Low foliage disruption showed the aircraft track through about 100 m of scrub after it had exited the end of the runway. The aircraft came to rest inverted with the aircraft nose pointing to the west (Figure 3). There was evidence of a small fire on the underside of the engine cowl in the vicinity of the exhaust duct and areas of the engine were found to have a coating of dry powder extinguishant. 

Figure 3: Wreckage position in relation to the runway

Source: East Air, annotated by the ATSB

Wreckage examination

The outboard 1.5 m of the left-wing leading edge was crushed down and back (Figure 4). The left‑wing front spar fuselage attachment had failed in tension and the rear spar fuselage attachment had pushed into the adjacent fuselage wall. In addition, the wing strut had failed at the fuselage end fitting. The vertical stabiliser and rudder were bent to the left with downward bending damage to the tailcone.

The nose wheel strut had collapsed rearward. The propeller blades were bent in a manner that indicated they were in the feathered[7] position at the time of impact with the ground.

The engine cowl side doors had been removed. The engine mount was distorted downwards and to the right, and there was minor creasing of the firewall. All engine controls and rigging, sense lines, piping and hoses were checked and found to be secure and intact. All secured connections were found to be lock wired or pinned. The oil tank lid was latched and secure.

Figure 4: Aircraft wreckage

Source: Queensland Police Service, annotated by the ATSB

The wing fuel tank selectors were both off. Battery and avionics switches were off, and no circuit breakers were identified as tripped. The following centre console control positions (Figure 5) were found:

• fuel shutoff: in (on)
• wing flaps selector and indicator: FULL
• fuel condition lever: just above LOW IDLE
• prop RPM lever: FEATHER
• power lever: IDLE
• emergency power lever: one third of the way between IDLE and MAX
• elevator trim: a quarter from NOSE DOWN.

Cockpit engine controls were exercised and, despite some distortion and damage in the engine bay, moved as expected through their ranges of motion.

Figure 5: Centre console as found after the accident

Source: ATSB

The cabin was intact except for the left wall adjacent to the wing where the incursion of the wing had created slightly reduced space for one passenger in the fourth row. All seats were attached to the floor and not deformed.

Fuel control unit examination

No pre-existing damage or faults were found with the aircraft during the wreckage examination, and so the other plausible explanation for the engine acceleration was an internal issue with the FCU. During ATSB attendance at the accident site, the FCU was retrieved from the engine. The FCU mates with the fuel pump and shares a common driveshaft from the compressor turbine via a gearbox. The FCU and fuel pump were separated to determine the condition of the drive coupling, a possible failure location associated with uncommanded engine acceleration. The input drive shaft to the FCU and the drive coupling were both found serviceable and in good condition (Figure 6).

The P3 compressor discharge air hose and P3 inline filter were checked and found to be clean and clear of debris. 

Arrangements were then made for the FCU to undergo a specialised inspection by Pratt & Whitney Canada on behalf of the ATSB. The FCU was dispatched from the ATSB Brisbane office as an international air freight consignment but it was lost in transit. Extensive checking and investigation by the freight provider to locate the tracked consignment was unsuccessful. Consequently, any internal mechanical faults, such as component failures, material degradation, or contamination of pneumatic passageways in the FCU could not be determined. Should the FCU ever be recovered, this report will be amended to reflect any findings of the subsequent analysis.

The FCU had been removed from the aircraft and sent to TAE Aerospace 3 weeks before the accident. Work packs showed the unit was bench flow tested to confirm the operator‑reported high cut‑off angle and was adjusted. The FCU was not disassembled during the procedure. 

Figure 6: Fuel control unit and fuel pump

Source: ATSB

Recorded data

Garmin G1000

The aircraft was fitted with a Garmin G1000 electronic flight instrument system consisting of 2 primary flight displays and one multi-function display. The G1000 had a 58 channel, 1 Hz, flight and engine parameter, flight data logging capability. Crew alerting system messages were not recorded in the flight data log. An SD memory card was retrieved from the device, which contained recorded data from multiple flights, including the accident flight. 

The data indicated at 0652:00 there was a sudden change in fuel flow and consequential increase in Ng, ITT and engine torque (the exceedance event). There was an associated momentary 25 rpm increase in Np but it returned to its prior setting of ~1,868 rpm immediately (Figure 7). After the exceedance event, fuel flow and Ng both appeared to increase to such an extent that the values went outside the range of sensor capabilities. This aligned with the pilot’s recollection that these parameter indications blanked on the G1000 display and were replaced by a red cross indication.

While flight and engine control positions were not recorded, engine parameter changes could be associated with certain inputs of the propeller and condition levers. Particularly, on short finals when the aircraft was approaching the runway threshold, a marked reduction in fuel flow, Ng, ITT, propeller speed and engine torque over 6 seconds was identified, indicative of an attempted engine shutdown. However, all these parameters then slowly increased over the next 18 seconds until about the time the aircraft overturned. The engine manufacturer could not understand the slow response without inspecting the FCU and advised that in throttle slam testing, the PT6A takes approximately 3‍–‍4 seconds to reach maximum power.[8]

Figure 7: Garmin G1000 recorded data for accident flight

Source: ATSB

Powerplant parameters

A review of the data showed that for the exceedance event, engine torque, ITT, and Ng all exceeded the upper limits including permitted transient periods and values. The variation in all 3 parameters were characterised by a step change in value over a 3 second period.

The Ng parameter recorded periods of valid and invalid data. Analysis of the data appeared to indicate periods where sensor values surpassed the limits of the recordable range. This interpretation would indicate Ng exceeded 105.16% for 2 minutes initially, with additional shorter exceedance periods also noted. Hence, the maximum Ng during the flight could not be determined. Regardless, assuming the invalid data were out‑of‑range values, the Ng exceeded the normal operating limit for a total period of more than 8 minutes.

ITT exceeded the normal operating limit from the exceedance event until approximately the time of the flare for landing (almost 10 minutes). The maximum recorded temperature was 885°C.

At the time of the exceedance event, engine torque increased from 1,700 ft-lb to ~2,080 ft-lb. In an attempt to control the engine and reduce propeller thrust, the pilot progressively coarsened the propeller pitch. This had the effect of increasing engine torque. The maximum engine torque recorded was 2,483 ft-lb.

Propeller speed was within limits for the entire flight except for a small, permitted transient event that occurred during initial power application at the start of the take‑off. Other engine parameters such as oil pressure and temperature remained within limits for the entire flight. 

Fuel control unit 

Malfunction conditions 

There are at least 3 ways in which an FCU malfunction is known to affect engine performance: 

• engine power rolls back to idle
• an inability to change the power setting, or
• induce uncommanded engine acceleration.

A roll back to idle can result from Py leaks or governor spring failures. The EPL is provided for this situation and if used, can command more fuel as described above.

An inability to change power usually results from a control (power lever) disconnect. If more power was required than what was set at the time of the disconnect, the EPL could be used to achieve that. However, there is no way to reduce power other than to shut down the engine, that is, zero power.

An uncommanded acceleration can result from multiple sources in either the pneumatic or fuel side of the FCU. In the pneumatic side of the FCU, cap bearing distress, a sheared drive coupling, Py bleed blockage (multiple causes), drive body contamination, or split governor bellows can result in engine acceleration. The fuel side of the FCU includes possible failures such as splitting of the metering valve seat or bypass valve seal failure. Such failures will command the equivalent of pushing the power lever fully forward, or for some failure modes, possibly higher power levels. 

Malfunction rates

FCU failure and malfunction rate information of PT6A engines was sought from the engine manufacturer. P&WC reported 13 uncommanded acceleration or the inability to reduce power events over a 10‑year period (2014‍‍–2024) for the C208/C208B Caravan and 19 similar events for other single‑engine aircraft types using a similar FCU configuration. The manufacturer also supplied 5‑year (2019‍–‍2024) malfunction rate data shown in Table 2. The data provided events in different classifications as well as malfunction rates over an equivalent period for power rollback events.

It was shown that half of all reported Honeywell FCU malfunctions on single‑engine aircraft, including the Cessna Caravan, were uncommanded engine acceleration or inability to reduce power situations. While this malfunction rate met acceptable levels of reliability for component part certification, the rate for uncommanded engine acceleration or inability to reduce power situations was higher than any other type of event and equated to 0.9 events per million flight hours as shown in Table 2 for PT6A‑114/114A engines fitted to the Cessna Caravan. 

Table 2: 5-year malfunction rate (events per million flight hours)

Source: Pratt & Whitney Canada

Operational information

Operator information

The aircraft operator, East Air, was conducting a non‑scheduled passenger service under Part 135 of the Civil Aviation Safety Regulations (1998) ‘Australian air transport operations – smaller aeroplanes’. The operator conducted multiple flights most days between Cairns and Lizard Island carrying passengers as required to and from the resort island. 

Engine emergency scenarios

All Cessna 208/208B pilot’s operating handbooks and flight manuals incorporate emergency checklists and expanded procedures that include engine scenarios such as engine fire or engine failure. Specifically, the flight manual for the accident aircraft included engine failure emergency checklist procedures for 4 different phases of flight.

The manual also included 3 engine malfunction procedures including ‘Loss of Oil Pressure’, ‘Fuel Control Unit Malfunction in the Pneumatic or Governor Sections (Engine Power Rolls Back To Idle)’, and ‘Emergency Power Lever not Stowed’ at engine start, along with some related fuel system procedures. The FCU malfunction in the pneumatic or governor sections provided instruction, among other things, on the use of the EPL.

There was no procedure for an uncommanded engine acceleration or inability to reduce power. The ATSB sought the aircraft manufacturer’s (Textron Aviation) advice as to why there was no procedure for this type of malfunction. Textron Aviation advised that at the time of the aircraft’s certification, the flight manual was reviewed and approved by the United States Federal Aviation Administration and subsequently accepted by the Civil Aviation Safety Authority. It also advised that it was not aware of any single‑engine aircraft with a procedure for what to do if a pilot finds that they do not have control over an engine.

The ATSB sought the engine manufacturer’s (Pratt & Whitney Canada) advice as to why there was no procedure for an uncommanded engine acceleration or inability to reduce power malfunction. P&WC advised that, while it is the engine manufacturer, the aircraft manufacturer is responsible for developing the aircraft handling procedures, which are documented and approved through the aircraft flight manual. P&WC advised it would support any manufacturer in the development of suitable procedures. 

The ATSB reviewed pilot operating handbooks and aircraft flight manuals for many PT6A powered single‑engine aircraft as well as those powered by other makes of turbine engines. While some aircraft types had propeller overspeed procedures, the only PT6A powered single‑engine aircraft identified that had a procedure that mentioned excessive power was the PA46‑600TP. This procedure stated that, for excess power when performing a manual [fuel] override operation, pitch up and deploy the landing gear and flaps. This was followed by an instruction to land as soon as possible and when landing was assured, to bring the condition lever to cut‑off/feather.

The C208B flight manual emergency procedures for engine failure and engine fire, as well as the normal procedure for engine shutdown, all called for the propeller to be feathered before the fuel condition lever was moved to the cut‑off position. In the event of an uncommanded engine acceleration, feathering a propeller prior to moving the fuel condition lever to cut‑off would increase the risk of overstressing the engine or airframe structures.  

Training requirements

Parts 119 and 135 of the Civil Aviation Safety Regulations (1998) and the Part 135 Manual of Standards contained requirements for operator training of flight crew including proficiency checks in non‑normal and emergency procedures. As a Part 135 operator using a prescribed single‑engine aeroplane[9] they were required to have procedures in their exposition for engine malfunction or failure for certain phases of flight, for example, during the take‑off roll, take‑off below turnback height, and take‑off above turnback height. The standards also required procedures for other phases of flight in visual[10] and instrument meteorological conditions,[11] and further delineated between phases of flight above and below 1,000 ft above ground level.

Most relevant, the operator had to establish procedures to address certain defined engine failure and malfunction scenarios including ‘the exceeding of an engine performance parameter’. Advisory circular 135‑13 v1.0 Prescribed single‑engine aeroplanes, further explained this requirement and advised that these items would normally be addressed in the aircraft’s flight manual. However, if the detail in the flight manual was insufficient, operator customisation of their exposition was encouraged, provided that the mandatory matters of the flight manual were still included in the correct order.

The operator reported that it was previously unaware that the PT6A engine could malfunction in such a way as to produce an uncommanded acceleration. Hence, no training was conducted within the organisation for that type of failure, nor was there a procedure in the company’s exposition for the C208 aircraft.

Industry knowledge of uncommanded acceleration events

An ATSB review of selected training organisations in Australia conducting initial and conversion training for the Cessna Caravan, and similar types, identified limited industry knowledge of this type of engine malfunction. Those organisations had a range of knowledge on uncommanded engine acceleration malfunctions varying from:

• no knowledge of the malfunction and thus no inclusion in their training syllabus
• some knowledge of certain events and included a ‘discussion’ during class‑based training
• knowledge of multiple events and inclusion of a procedure to follow in such situations.

Only one training organisation covered an uncommanded acceleration malfunction as part of its training syllabus. Its inclusion was based on the organisation having experienced such an event with one of its own aircraft. The emergency procedure was developed by the organisation and was based on its incident experience.

The pilot of this accident reported they had no knowledge that an uncommanded engine acceleration was a possible malfunction of the FCU, and they had subsequently talked to other pilots who also had not heard of such malfunctions.

Passenger safety

A passenger survey was conducted post‑accident with a 66% response rate. All respondents reported they received a safety briefing from the pilot before the flight, which included information about lifejackets, seatbelts, exits and fire extinguishers. Most respondents reported that they were aware of exit locations because of the briefing. Passengers were also asked about seatbelt fitment, with all of those that responded advising that they wore both the lap belt and shoulder harness. Two passengers reported the belts were ‘snug’. One passenger reported the shoulder harness was difficult to fit initially but was resolved and fitted correctly prior to take‑off. 

The pilot recalled that, when the engine malfunction occurred, they turned to the passenger behind them and said, ‘we've got an engine issue, we've got to go back to Lizard [Island]’. While a passenger at the front of the aircraft reported they were alerted to an issue by the pilot, and they passed that information to some passengers behind, other passengers did not realise there was a problem until the aircraft was coming into land.

Three passengers reported that the pilot told them to brace for impact. After stopping, one passenger reported difficulty releasing their seatbelt due to them being upside down. Four respondents reported they were instructed to leave the aircraft, and 2 passengers reported the pilot gave instructions to move away from the wreckage once they had evacuated. Three passengers reported they left the aircraft by the rear left exit, which was opened by one of those passengers, and it was identified that 3 other passengers left by following the pilot out the front left door. One passenger got stuck exiting via the pilot’s door and required assistance from other passengers. Estimations by the passengers on time to evacuate ranged from ‘approximately 30 seconds’ to ‘less than a couple of minutes’.

Injuries reported by the passengers included bruising, cuts and abrasions, stiffness and soreness to joints and muscles. One reported receiving a seatbelt burn to their left shoulder. The most severe passenger injury was a laceration to the side of the head.

Related occurrences

A review of the ATSB’s aviation occurrence database between 2010 and 2024 involving aircraft with P&WC PT6A engines showed that there was one related occurrence during that period. Additionally, the Transport Canada Web Service Difficulty Reporting System[12] was also searched for power runaway events between 2014 and 2024. One defect in this system was also identified on the Transportation Safety Board of Canada investigation website. The following occurrences are a selection of those found as part of this search.

ATSB occurrence (OA2011-08920)

On 23 December 2011, while in cruise flight, the engine of a Cessna Caravan went uncommanded to full power and was unresponsive to power lever inputs. The aircraft was climbed to a safe height and the crew shut down the engine and glided to the destination airport. Recorded data indicated at times the ITT exceeded 920°C, Ng exceeded 112% and engine torque exceeded 2,300 ft‑lb. While the fault could not be replicated in bench tests of the FCU, an inspection revealed non‑required grease on the P3 air adapter mating face could have made its way to, and temporary blocked, the Py air bleed orifice, leading to the metering valve moving towards the maximum fuel stop. 

Transport Canada defect report (20140908003)

The pilot of a Cessna 208 reported that, while flying, the power lever was moved to the idle position but there was no change in engine power. Engine torque stayed between 1,250 and 1,400 lbs. The FCU manufacturer found a cracked governing bellows. 

Transport Canada defect report (20141218004)

On 4 December 2014, a Cessna C208B, experienced a runway overrun upon landing and came to rest in water. The aircraft sustained substantial damage, and the 6 occupants on board were not injured. The engine was reported to have had an uncommanded and uncontrollable acceleration.

Transport Canada defect report (20141218009)

After landing, during the engine shutdown procedure, the pilot of a Cessna 208B reported that the engine remained at flight [sic] idle even when the fuel condition lever was placed at ground idle [sic]. When they slightly moved the power lever, the engine experienced an uncommanded acceleration. After some manipulation of the condition and power levers, the pilot successfully shut down the engine. 

Transport Canada defect report (20171103016)

During taxi, the pilot moved the fuel condition lever from low to high and noticed engine torque and Ng reached the upper limit, with the ITT crossing the red line. The pilot returned the condition lever back to the initial position, but the engine did not respond, with no changes to the indicated parameters. The crew attempted to maintain control but due to the aircraft’s speed, the aircraft flew to 100 ft off the ground. The crew elected to shut down the engine and landed uneventfully.

Transport Canada defect report (20190906001)

On 25 August 2019, while the aircraft was on approach for landing, the pilot reduced the power lever and reported that the torque did not reduce. The pilot elected to perform an in‑flight shutdown and landed uneventfully. The maintenance repair overhaul service provider performed an engine ground run, which was found satisfactory and elected to perform a flight test. During the flight test, the engine behaved as previously, and the pilot elected to perform a second in‑flight shutdown and landed again uneventfully. The failed part was reported as a cracked bellows in the FCU.

Transport Canada defect report (20210721007) 

On 15 June 2021, when climbing through 2,500 ft above ground level, the engine tone on a Cessna 208 aircraft changed, and all engine parameters started increasing. The power lever was retarded, but the engine parameters such as propeller speed, engine torque, and ITT all increased continuously. All indications on the primary flight display for the engine turned red. The pilot declared an emergency and made a 180° turn back to the runway. To prevent damage to the engine, or possible catastrophic failure, the engine was shut down and a safe landing was made down wind.

Transportation Safety Board of Canada (A24C0004)

On 10 January 2024, the pilot of a De Havilland DHC‑3T Turbo Otter was unable to reduce engine power shortly after take‑off. The pilot activated the emergency power lever, but it had no effect. The pilot initiated a climb in an attempt to manage the airspeed. The flight proceeded to its destination, however, the airspeed increased to over 140 miles per hour, and the pilot’s side window shattered. When within range of the airport at approximately 4,000 ft, the pilot shut down the engine with the condition lever. The aircraft decelerated more quickly than anticipated and struck trees on final approach. The aircraft came to a stop beside the runway, sustained substantial damage but there were no injuries.

Safety analysis

Introduction

On 8 January 2024, a Cessna 208B Grand Caravan with a pilot and 9 passengers on board departed Lizard Island Airport to Cairns, Queensland. Shortly after take‑off, the aircraft experienced an uncommanded and uncontrolled engine acceleration. The pilot elected to return to Lizard Island where a high‑power, high‑speed landing was conducted that resulted in a runway overrun and the aircraft flipping over.

This analysis reviews the reason for the engine acceleration and the resulting effect on the flight. It also examines the aircraft procedures for Pratt & Whitney Canada PT6A engines, and industry awareness and training on experiencing an uncommanded engine acceleration event.

Uncommanded engine acceleration

Shortly after take-off, the engine experienced an uncommanded acceleration, which was detected by the pilot as a change to the engine sound and that the aircraft was accelerating. The pilot confirmed a malfunction by the available engine parameter displays, which were either beyond limits or not indicating. The pilot attempted to diagnose the malfunction but had no ability to correct the situation and thus elected to return to the departure airport. Recorded data reviewed by the ATSB confirmed the engine malfunction and engine parameter exceedances.  

With no other pre-existing damage or faults found with the aircraft, the fuel control unit (FCU) was the only component that could produce such a malfunction. It was removed from the aircraft wreckage for further examination. The ATSB determined that the input drive shaft and drive coupling was serviceable. Unfortunately, further analysis by the manufacturer was unable to be conducted. Irrespective, and consistent with other related occurrences, an internal failure or foreign object contamination of the FCU was the only plausible explanation for the uncommanded engine acceleration, although the definitive reason for the malfunction could not be determined.

Runway overrun

The pilot, faced with an aircraft producing excessive power and thrust, inhospitable terrain, populated areas under the approach path, and a short runway, elected to perform a power on approach to land to enable them to control their final flightpath.

The pilot reported moving the fuel condition lever to cut‑off when the aircraft was on short finals and making the runway was assured. While the recorded data showed the engine parameters dropped significantly, the engine then accelerated slowly over the next 18 seconds to again exceed limits. The pilot recalled attempting to shut the engine down, however, the emergency power and condition levers were not found in their expected positions post‑accident. This, in addition to the flight data, showed that the engine had not been successfully shut down as intended. The slow response of the engine returning to excessive power could not be explained and was possibly associated with an FCU malfunction.  

Due to the excessive speed and the downslope of the runway, the aircraft touched down about two‑thirds along the runway. Despite brake application, the aircraft left the end of the runway crossing uneven terrain with low foliage before a wingtip caught the ground and the aircraft flipped upside down. 

Limited pilot and operator awareness

While the aircraft flight manual provided a procedure for scenarios such as an engine failure and FCU malfunction resulting in a roll back to idle power, there was no equivalent procedure for an uncommanded engine acceleration. Therefore, there was no documented procedure or troubleshooting information available to the pilot for this type of malfunction. Instead, the procedural options available were for an engine failure or fire, or the normal procedure for engine shutdown. However, for an uncommanded engine acceleration event, the steps in an engine shutdown procedure would have to occur in a different order so as not to overstress the engine or airframe structures.

Both the pilot and operator indicated that, prior to the event, they were not aware the FCU could malfunction in such a manner. There was also a mixed understanding from the flight training organisations consulted. While one organisation specifically trained for uncommanded engine acceleration malfunctions (based on directly having experienced the problem), the majority did not, though some did informally discuss the issue with trainees while not providing a procedure for handling the situation. 

For Pratt & Whitney Canada PT6A engines, data provided by the manufacturer showed an uncommanded engine acceleration or inability to reduce power event occurred at a rate of 0.9 events per million flight hours. While this malfunction rate met acceptable levels of reliability for component part certification, the rate for uncommanded engine acceleration or inability to reduce power situations was higher than any other type of event, including roll back to idle events, for which a specific procedure existed. It is acknowledged that every type of event cannot be accounted for in an aircraft flight manual or the pilot’s operating handbook. However, given the likelihood of this type of event, it is important that pilots are aware that the event can occur and how best to manage such a situation.  

As the pilot had intended to shut down the engine, it could not be determined if a lack of procedure and training influenced the accident. However, awareness and training for an uncommanded engine acceleration event will prepare pilots, ensure operations are performed correctly and consistently, and should result in a better outcome. As noted in the Civil Aviation Safety Authority advisory circular for prescribed single‑engine aeroplanes, it would also be beneficial for operators to develop strategies to manage this type of malfunction in the absence of a flight manual procedure. Otherwise, without formal procedures, pilots are required to exercise judgement and innovate in a highly stressful situation, based on their experience, skills and knowledge.

Findings

From the evidence available, the following findings are made with respect to the engine malfunction and runway overrun involving Cessna 208, VH-NWJ, at Lizard Island, Queensland on 8 January 2024. 

Contributing factors

• Shortly after departure, the fuel control unit very likely malfunctioned resulting in an uncommanded engine acceleration event beyond limits, necessitating a return to the airport.
• The engine power was unable to be reduced and the engine was not successfully shut down on final approach. As a result, the aircraft could not be slowed sufficiently to prevent a runway overrun.  

Other factors that increased risk

• While uncommanded engine acceleration or inability to reduce power events occur at a higher rate than any other type of fuel control unit malfunction in Pratt & Whitney Canada PT6A single‑engine aircraft, there were no flight manual procedures addressing this type of occurrence. Consequently, there was limited awareness by pilots and operators on how to identify and safely respond to an uncommanded engine acceleration event.

Safety issues and actions

Safety action not associated with an identified safety issue

Additional safety action taken by East Air

As a result of this accident, East Air published a temporary revision to its Quick Reference Handbook for the Cessna 208B to include an emergency item for 'Unscheduled power increase during flight (High Torque, Ng, ITT and/or Fuel Flow)'.

Safety advisory notice to operators of PT6A engine aircraft

In the absence of a flight manual procedure and with limited industry awareness, the ATSB encourages operators of single‑engine PT6A powered aircraft to consider potential responses to an uncommanded engine acceleration event for different phases of flight, and to document and train pilots on appropriate actions to ensure operations are performed correctly and consistently.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot and passengers
• East Air
• Textron Aviation
• Pratt & Whitney Canada
• Civil Aviation Safety Authority
• Transport Canada
• Transportation Safety Board of Canada
• Queensland Police Service
• recorded data from the primary flight display unit on the aircraft. 

References

Civil Aviation Safety Authority. (2021). Prescribed single-engine aeroplanes (advisory circular AC135-13 v1.0). Retrieved from https://www.casa.gov.au/node/81695

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the pilot
• East Air
• Textron Aviation
• Pratt & Whitney Canada
• Civil Aviation Safety Authority
• United States National Transportation Safety Board
• Transportation Safety Board of Canada.

Submissions were received from:

• the pilot
• East Air
• Textron Aviation
• Pratt & Whitney Canada
• Civil Aviation Safety Authority
• Transport Canada Civil Aviation.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.