Why the driver of a suburban passenger train did not slow the train before it collided with the buffer stop at Richmond Station in Sydney’s northwest on 22 January 2018, resulting in injuries to 16 people, could not be conclusively determined, an investigation into the event notes.

The eight-car Waratah class passenger train (designated A42) collided with the buffer stop at the end of Richmond Station’s platform 2 at a speed of about 26 km/h.

A number of possibilities for the driver’s inaction were examined during the course of the investigation, which was conducted on behalf of the Australian Transport Safety Bureau (ATSB) by NSW’s Office Transport Safety Investigations (OTSI). These included: the driver blacking out; the driver experiencing a microsleep due to fatigue impairment; or the driver being distracted or inattentive.

The buffer stop withstood the impact of the collision and prevented the train from crossing onto a main road, the investigation found. But the investigation also concluded that the two hydro-pneumatic rams on the front of the buffer stop did not perform as designed, due to their non-alignment with the crash energy management system on the front of the Waratah train.

In addition, the crash energy management system on A42 did reduce the impact force of the collision, but not all components performed as designed.

Rail operators should ensure that multi-layered defences are in place against over-speeding.

“Rail operators should ensure that multi-layered defences are in place against over-speeding,” said Mick Quinn, OTSI CEO and chief investigator.

“This should include infrastructure design, rolling stock design and train crew health management. They need to ensure that identified risk controls are implemented, and that these control measures are effective in their performance.”

Mr Quinn said that if the driver’s cab had been fitted with an inward-facing camera, the footage may have provided investigators with an insight to why the driver was unresponsive leading up to the collision.

“Having audio and video recordings would allow investigators to eliminate, early in the investigation, potential contributory factors,” he said.

Since the accident, Sydney Trains has proactively addressed a number of safety issues, including redesigning the buffer stops for Platforms 1 and 2 at Richmond, while intermediate train stops, previously identified and recommended as a risk control, have been installed at Richmond.

However, the ATSB has issued a formal safety recommendation calling for Sydney Trains to take action to ensure that existing procedures regarding train crew rest breaks between shift cycles are adequate and start time rotations are reinforced to safeguard against fatigue impairment of train crews.

Finally, the report notes that automatic train protection, which if installed on A42 may have prevented the incident, was still being trialled at the time of the incident. Transport for New South Wales has scheduled automatic train protection to be operational on most Sydney Trains electric rolling stock by May 2021.

Read the report: Collision of Waratah passenger train A42 with buffer stop, at Richmond Station, New South Wales, on 22 January 2018

The flight crew of an AirAsia X Airbus A330 did not follow proper procedures when faced with an engine oil pressure warning, attempting to restart the affected engine even after it had failed, as well as electing to divert to Melbourne when the aircraft was considerably closer to two other airports.

The engine oil pressure warning and subsequent engine failure occurred during a 16 August 2016 scheduled flight from Sydney to Kuala Lumpur, with two flight crew, eight cabin crew and 234 passengers on board. While in cruise near Alice Springs the flight crew received an ‘Engine 2 oil low pressure’ failure alert message, which the ATSB’s subsequent investigation of the event established was due to a shaft failure in the engine’s oil pressure pump.

That alert required immediate crew action comprising of reducing thurst on the affected Rolls-Royce Trent 700 engine to idle and then, in accordance with the Airbus procedure, ‘if [the] warning persists’, shutting down the engine.

Procedures need to be designed with clarity

However, the flight crew probably misinterpreted the term ‘persists’ as requiring they wait a certain period of time to determine if the condition was persisting. As a result, they continued to troubleshoot the failure, rather than shut down the engine.

After monitoring the engine the flight crew formed the view that the warning was the result of a gauge failure. With the intent of further trouble shooting, the crew then increased the engine’s thrust. This led to the engine stalling and ultimately failing.

However, despite evidence to the contrary, the flight crew determined that the failed engine was not damaged and could be restarted. Consequently, and contrary to the operator’s procedures, the flight crew made two attempts to restart the failed engine, even though there was no safety risk to the aircraft that demanded a restart attempt. Both attempts failed.

Also contrary to the operator’s procedures, the flight crew elected to divert to Melbourne following the engine failure, rather than to closer suitable airports in Alice Springs and Adelaide. Although twin-engined airliners such as the A330 are designed to fly safely on a single engine, this decision increased the time that the aircraft was operating in an elevated risk environment of single-engine operations.

“There are three key safety messages from this investigation,” noted ATSB Director Transport Safety Dr Stuart Godley.

“Not only does this occurrence demonstrate the importance of flight crews adhering to standard operating procedures when responding to aircraft system alerts, it also highlights that those procedures need to be designed with clarity,” Dr Godley said.

“Further, the investigation report identifies that where there is not a need for an immediate response, that flight crews look at the full contextural and available information before deciding on a plan of action.”

Since the incident, AirAsia X restated the operational requirements for flight crews for engine restarts and diversion decision making. Further, the airline has also used the occurrence as the basis for a training package for responding to engine failures, restarting failed engines, and diversion decision making.

Read the final report: Engine failure involving Airbus A330, 9M-XXD, 445 km south-east of Alice Springs, South Australia, on 16 August 2016

A Fokker F100 airliner inadvertently returned to service with a lock-out bolt installed, rendering one of its two engine thrust reversers inoperative.

An incorrect type of lock-out bolt used during maintenance the previous day meant that when the captain selected reverse thrust on landing at Karratha on a 27 December 2017 flight from Perth, the right engine thrust reverser did not activate. The aircraft was able to decelerate using normal braking and taxied to the gate without further incident.

An ATSB investigation found that during a maintenance task to inspect the aircraft engines’ emergency fuel shut-off cables, to safely isolate the thrust reverser mechanism a maintenance engineer installed the incorrect lock-out bolt, and then did not remove it after the maintenance was completed.

The investigation found that the engineer used the more conveniently located in-service lockout bolt from the aircraft’s flight deck for the task, instead of the appropriate maintenance lockout bolt, which is fitted with a large red warning flag, and had to be checked out of the tool store. As a consequence, the lock-out bolt did not show as missing during a tooling inventory check as the aircraft was released to service.

Further, there were no warning labels in the cockpit to warn the flight crew that the bolt may be installed.

“This investigation highlights the risks of varying from procedures when performing maintenance tasks,” ATSB Director Transport Stuart Macleod said.

“It is important that, in all parts of the maintenance system, there is an awareness of human factors associated with completion of the task. An understanding of the demands associated with a task may help identify informal work practices that can then be aligned with the formal procedures.”

In response to this incident, the maintenance organisation has highlighted to maintenance staff the importance of following the safety instructions and warnings contained in the aircraft maintenance manual. Further, the maintenance organisation has reinforced procedures for maintenance activities – including task assessments, tooling, and task procedures.

Over the past three years, the ATSB has now investigated three separate incidents where maintenance engineers have inadvertently left lockout bolts installed in passenger aircraft engines after maintenance. The other two incidents, investigations AO-2018-064 and AO-2017-117, involved maintenance providers in Brisbane and Adelaide, respectively.

Read the report: Undetected engine thrust reverser deactivation involving Fokker F100, VH-NHA, Karratha Airport, Western Australia, on 27 December 2017

The ATSB is strongly encouraging pilots of experimental powered gliders to install fire protection between the engine compartment and cockpit following its investigation into a fatal accident where a modified jet-powered glider was destroyed by fire.

The call follows the ATSB’s investigation into a 21 January 2018 accident where a Schleicher ASH-25E glider which had been retrofitted with two small gas turbine engines caught fire not long after being launched from the Bathurst Gliding Club’s Piper’s Field airfield in central west NSW.

The experienced pilot had planned to conduct a solo cross-country flight, and eight minutes into the flight, the glider had climbed to about 2,200 feet in a thermal. Shortly after, the glider abruptly started to descend and track back towards the airfield, and witnesses reported seeing smoke or liquid trailing from behind the glider’s cockpit.

At about 1,100 feet, the pilot jettisoned the front-seat canopy but did not exit the glider, possibly due to incapacitation. Fire engulfed more of the rapidly descending glider’s fuselage before it collided with the ground in a nose-down attitude. The pilot was fatally injured, and the aircraft was destroyed.

The ATSB strongly encourages pilots of powered experimental gliders to install fire protection.

Due to the severity of the post-impact fire, the ATSB investigation could not determine the ignition source, but did establish that the glider’s cockpit and engine housing were not separated by a firewall.

“Pilots of powered experimental gliders are strongly encouraged to install fire protection between their aircraft cockpit and the engine housing,” said ATSB Director Transport Safety Stuart Macleod.

“The ability to exit a glider relies on avoiding incapacitation that can happen quickly in the event of in-flight fires.”

The accident glider had originally been fitted with a small Rotax piston engine driving a propeller mounted on a retractable pylon that allowed the glider to undertake self-sustaining flight (that is, maintaining level flight or initiating a climb, but not for launching). In 2010, the pilot had removed the original engine and propeller, replacing them with two small Titan AMT gas turbine engines for self-sustaining flight, with two 25-litre collapsible fuel cells installed into the wing root.

Once fitted with the jet engines, the glider was flown under an experimental type certificate. The Gliding Federation of Australia’s Manual of Standard Procedures states that flying experimental category gliders “is entirely on the basis of voluntary acceptance of risk by the persons who elect to do so".

Following the accident, the Gliding Federation of Australia published an Airworthiness Directive and an Airworthiness Advice Notice, both entitled Engine Compartment Fire Containment and Retardation, which provide guidance regarding fire safety.

The Airworthiness Directive requires all powered glider operators to inspect and repair fire retardant paint, fit ‘in case of engine fire’ cockpit placards and ensure there is no flammable material on the cockpit side of any firewalls.

Read the final report: Collision with terrain involving experimental ASH-25E glider, VH-GOA, 13 km west-north-west of Bathurst, New South Wales, on 21 January 2018

The flight crew of an Airbus A320 received a landing gear not down master warning while on approach to land at Ballina Byron Gateway Airport, New South Wales, due to an incorrect aircraft configuration following a go-around, a new ATSB investigation report details.

During the 18 May 2018 flight from Sydney, the A320 was conducting a visual approach to land on runway 24, with the first officer manually flying the aircraft. Manoeuvring to join the circuit on a left base, the captain recognised that the aircraft’s airspeed and altitude were both higher than a normal approach profile. However, due to circuit traffic, the captain elected to have the aircraft established on final approach before commanding a go-around.

The ATSB established that the flight crew did not follow their operator’s standard procedures during the go-around and subsequent visual circuit at 1,500 ft. In particular, the flaps remained at Flaps 3 rather than Flaps 1 during the circuit. This created a series of distractions leading to a non-standard aircraft configuration for a visual circuit. Limited use of available aircraft automation added to the flight crew’s workload.

Following standard procedures mitigates the risk of the selection of inappropriate auto-flight modes, unexpected developments, or confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.

During the downwind leg following the go-around, the flight crew did not select the landing gear down as they had commenced the configuration sequence for landing at the Flaps 3 setting. Furthermore, the flight crew incorrectly actioned the landing checklist, which prevented the incorrect configuration for landing being identified and corrected, the investigation established.

Consequently, on the second approach, at about 700 ft, a master warning was triggered because the landing gear had not been selected down. The flight crew then conducted a second go-around and landed without further incident on their third approach.

“This occurrence highlights the importance of adherence to standard operating procedures and correctly monitoring the aircraft’s approach and parameters to provide assurance a visual approach can be safely completed,” ATSB Director Transport Safety Director Dr Stuart Godley said.

“Following standard procedures mitigates the risk of the selection of inappropriate auto-flight modes, unexpected developments, or confusion about roles or procedures that can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.

The ATSB report notes that an incorrect aircraft configuration for landing is rarely the result of a single action or identifiable event.

“In this case a number of factors, such as distraction and limited use of aircraft automation, combined to result in the landing gear not being selected to down,” Dr Godley said.

“While highly undesirable, it should be noted that the aircraft’s warning system effectively alerted the flight crew to the problem and the crew responded promptly to the warning and initiated a second go-around.”

Dr Godley said the incident reinforced how unexpected events during approach and landing phases can substantially increase what is already a high flight crew workload.

Read the final report: Incorrect configuration for landing involving Airbus A320, VH-VQK, Ballina/Byron Gateway Airport, New South Wales, on 18 May 2018

A loss of separation between two Boeing 737s on reciprocal tracks demonstrates the importance of communication and coordination between air traffic controllers operating in separate, yet adjacent airspace, as well as the need for a clear understanding of the responsibility for separation assurance when operating without a shared traffic picture.

These are the key safety messages from the ATSB’s final investigation report into the 11 October 2018 incident, where a Qantas 737-800, registration VH-VZD, was on descent to Brisbane Airport through military-controlled airspace near Amberley Air Force Base, while a Virgin Australia 737-800, VH-YFW, which had departed Brisbane Airport, was approaching Amberley airspace on a reciprocal track. (Airservices Australia, which operates Australia’s civil air traffic management system, and the Royal Australian Air Force, which is responsible for controlling military airspace, such as around major air bases, currently operate separate air traffic management systems at Brisbane and Amberley. As a result, in this scenario traffic information had to be shared manually.)  

Due to thunderstorms in the area, the Virgin aircraft was flying air traffic control (ATC)-assigned radar headings, rather than using a procedural standard instrument departure. As the Virgin aircraft approached Amberley airspace, the Brisbane departures controller (operating from Airservices’ Brisbane terminal control unit at Brisbane Airport) provided an identification of the Virgin aircraft to the Amberley approach controller, who advised that there was an aircraft on an inbound air route. Brisbane replied that the Virgin aircraft would soon be turning right, and thus would avoid Amberley airspace; however when advised to turn right, the crew of the Virgin aircraft replied that due to the weather they wished to continue on their current heading for another 70 or 80 nautical miles.

It was around this time that the Virgin aircraft entered Amberley airspace without a hand‑off from Brisbane ATC and without instructions to the crew to change to Amberley frequency. Prior to this, the Brisbane terminal control unit had not advised Amberley ATC of a changed terminal control unit configuration. This delayed Amberley ATC in being able to contact the correct controller position at the Brisbane terminal control unit to inform them of the inbound aircraft, thus reducing the opportunity for Amberley ATC to resolve the impending conflict.

Once appropriate communication between Amberley and Brisbane ATC was established, the Virgin aircraft was transferred to the Amberley frequency, and the two aircraft were diverted away from each other.

The successful recovery of separation illustrates the effectiveness of the conflict resolution training received by air traffic controllers in loss of separation events.

The ATSB's investigation found the aircraft had incurred a vertical and lateral loss of separation with a minimum-recorded distance between the aircraft of 2.1 nautical miles horizontally and 650 feet vertically, respectively, where the required separation was 3 nautical miles horizontally or 1,000 feet vertically. (Both aircraft were fitted with traffic collision avoidance systems which would have assisted in providing separation instructions to their flight crews in the event ATC were unable to resolve the situation.)

“This investigation highlights the importance of clear communication and coordination between air traffic controllers operating in different, yet immediately adjacent airspace, and the need for a clear understanding of the responsibility for separation assurance, especially when operating without a shared traffic picture,” ATSB Director Transport Safety Dr Stuart Godley said.

As a result of the incident, both Brisbane and Amberley ATC have taken a number of steps to improve communication between their two systems.

“The ATSB welcomes the new dedicated communications pathway between the Amberley approach and Brisbane departures south positions, and the implementation of an airspace release that controls the risk that short notice deviations present across the two non-linked systems.”

Dr Godley also said the successful recovery of separation illustrates the effectiveness of the conflict resolution training received by air traffic controllers in loss of separation events.

Read the final report: Loss of separation involving Boeing 737 aircraft, VH-YFW and VH-VZD, near Amberley, Queensland, on 11 October 2018

An ATSB investigation into an accident where a Robinson R44 helicopter struck a powerline before colliding with the ground has highlighted the lack of readily available electricity network maps for pilots in Victoria, as well as the powerlines’ lack of aircraft markers.

The helicopter was conducting a private flight from a property near Mansfield, Victoria with a pilot and one passenger on board on 6 July 2019.

Before the flight, the pilot sought and obtained some information about hazards, including powerlines, from the property owner. However, the owner was not aware of a distribution powerline strung across the nearby valley with a span of 560 metres, and he could not see the wires from his property. The wires did not have aircraft markers and, in accordance with the relevant Australian Standard (AS 3891), did not require marking.

Additionally, and unlike some other states, readily usable Victorian electricity network maps were not available to assist the pilot’s planning.

As a result, the pilot’s pre-flight planning did not identify the powerline, which the helicopter struck 158 feet (48 metres) above the ground, shortly after take-off. The helicopter descended rapidly, travelling about 400 metres after the wirestrike before colliding with the ground in an upright position, and rolling over, resulting in serious injuries to the passenger and minor injuries to the pilot.

“In Victoria, electricity network information is not readily available to aid pilots during the flight-planning process,” ATSB Director Transport Safety Stuart Macleod said.

“Such information provides valuable safety information to aid pilots in planning flights, and assists the visual identification of hazards, such as wires and poles.”

It is good practice to always maintain a height of at least 500 feet above ground level.

The investigation also highlighted that when flying at low level, pilots should always be constantly scanning the terrain on either side of their flight path for poles and towers, and should avoid low flying unless it is necessary, Mr Macleod noted.

“The ability of pilots to detect powerlines depends on physical characteristics such as the spacing of power poles, the orientation of the wire, and the effect of weather conditions. Depending on the environmental conditions, powerlines may not be contrasted against the surrounding environment. In addition, the size of the wire and limitations of the eye can mean that it is actually impossible to see the wire,” Mr Macleod said.

“Therefore, it is good practice to always maintain a height of at least 500 feet above ground level except during take-off and landing.”

After the accident, local landowners advised the ATSB that the powerline was erected in the 1970s, and that an aircraft conducting aerial agriculture had struck it in the 1980s. They reported that following that past incident, orange plastic marker balls had been fitted to the wires, however, they had perished over time and not been replaced.

“Effective wire avoidance can be achieved using a combination of available wire location information; wire marking; and the avoidance of unnecessary low flying, especially flight below the height of surrounding higher terrain where wire spans may be present,” Mr Macleod reiterated.

Read the final report: Wirestrike and collision with terrain involving Robinson R44, VH-KCH, near Mansfield, Victoria, on 6 July 2019

The ATSB has issued a safety recommendation to AirAsia Indonesia calling for the airline to review its passenger safety briefing material to ensure instructions on how to activate passenger oxygen masks are clear and effective.

The formal recommendation follows an ATSB investigation into a pressurisation event on board one of the airline’s Airbus A320 aircraft about 30 minutes after departure from Perth on a scheduled passenger flight to Bali, on 15 October 2017.

During the climb, while passing through flight level* 340, the crew initiated an emergency descent to 10,000 feet in response to a master caution warning of a malfunction of the aircraft’s pressurisation system.

The captain made a passenger announcement for the emergency descent and manually deployed the passenger oxygen masks. During the emergency descent, some oxygen masks did not deploy or passengers felt they were not receiving oxygen. Consequently, some passengers then moved around the cabin to find a functioning oxygen mask unit. Passengers later surveyed by the ATSB recalled that the cabin crew shouted commands such as ‘BRACE’, ‘GET DOWN’ and ‘CRASH POSITION’, increasing their level of confusion and panic.

After reaching 10,000 feet, the flight crew announced the aircraft was at a safe altitude for oxygen masks to be removed. The aircraft landed safety at Perth Airport, with no injuries to passengers and crew, and no damage to the aircraft.

The ATSB’s subsequent investigation into the incident found that AirAsia Indonesia’s pre-flight safety briefing and safety information card did not include a clear instruction on how to activate the flow of oxygen from the passenger oxygen masks, and that the bag may not inflate when oxygen is flowing. This may have resulted in some passengers not understanding whether or not there was oxygen flowing in the mask.

Further, cabin crew provided additional commands to passengers that were inappropriate for a depressurisation, which had the potential to increase confusion in the cabin and likely increased the level of panic experienced by some passengers.

An important aspect of managing abnormal passenger responses is the cabin crew’s ability to recall and use appropriate standard commands.

ATSB Transport Safety Director Dr Stuart Godley said in an emergency, cabin crew are required to perform a safety leadership role for passengers.

“This incident highlights that an important aspect of managing abnormal passenger responses is the cabin crew’s ability to recall and use appropriate standard commands,” Dr Godley said.

“Passengers generally responded well when appropriate commands were used, but incorrect commands resulted in some confusion and panic.”

Dr Godley said that inclusion of information highlighting that oxygen is flowing through the mask even though the bag may not inflate will improve passengers' knowledge and reduce anxiety and their susceptibility to a hypoxia-related event.

“Cabin crew emergency procedures training that includes role-playing of the full range of expected passenger behaviour, including panic and confusion, can better prepare cabin crew when exposed to more complex real-world scenarios,” Dr Godley said.

The ATSB found the intermittent pressurisation system faults that led to the emergency descent were likely due to an intermittent incorrect calculation of cabin pressure by one of the aircraft’s two independent cabin pressure controllers (CPCs). During the incident, the affected CPC provided 12 intermittent fault messages before the crew began the emergency descent.

Read the final report: Pressurisation event involving Airbus A320, PK-AXD, 160 NM (300 km) north of Perth, Western Australia, on 15 October 2017 

_____________
* At altitudes typically above 10,000 feet commercial aircraft operate to and are separated by ‘flight levels’. Flight levels are measured in units of 100 feet with the aircraft’s altimeter set to a standard air pressure of 1013hPa (rather than the local barometric air pressure). This ensures safe vertical separation between aircraft that might otherwise have altimeters set to different barometric air pressures. Aircraft set their altimeters based on local air pressure (known as QNH) below the ‘transitional level’, which in Australia is 10,000 feet.

Effective aircraft certification design requirements and flight crew training meant an Airbus A330 airliner landed without further incident after one of its engines ingested an engine cowling acoustic panel which failed during take-off, the ATSB investigation into the event notes.

During the 11 June 2017 occurrence, one of the three structural intake cowling acoustic panels of a China Eastern Airlines Airbus A330-200’s left engine separated and was ingested into the engine shortly after take-off from Sydney Airport’s runway 34 Left.

The flight crew effectively maintained control of the aircraft, continued the climb while reducing the thrust setting to idle, and declared a PAN PAN. The crew maintained an altitude of about 6,000 ft as they manoeuvred the aircraft to reduce its fuel load and address technical issues from the incident.

After 42 minutes, the aircraft landed safely at Sydney in an overweight configuration, where emergency services were on standby. Debris from the inlet cowling was later found strewn along the runway and the aircraft’s flight path.

Occurrences like this highlight how effective flight crew training ensures crews are able to effectively respond to any situation

“This event demonstrated the effectiveness of the certification design requirements and flight crew training to ensure continued flight despite effectively losing the power of one of two engines during a critical phase of flight,” said ATSB Director Transport Safety Dr Stuart Godley.

On landing, damage was identified to the inboard side outer inlet cowling skin including the number 1 and number 2 acoustic panels as well as the engine’s fan blades and cold stream duct. Minor airframe damage to the left wing trailing edge flaps, landing gear door, and left side of the horizontal stabiliser was also identified.

With the panel and cowling debris ingested into the engine, there was limited physical evidence available to ATSB investigators.

“Despite extensive testing conducted by the engine and cowling manufacturers, the reason for the failure could not be conclusively determined,” Dr Godley said.

“However, it was considered that the most likely reason for the failure was a localised disbond between the acoustic panel facing sheet and the honeycomb core.”

The ATSB found this was the fourth event where an inlet cowling acoustic panel manufactured by Bombardier Aerospace fitted to an Airbus A330 with Rolls-Royce Trent 700 engines had failed and was ingested. The first incident occurred in October 2006.

In 2014, in response to these earlier incidents, Rolls-Royce introduced a modification for the acoustic panels that doubled their density and adhesive contact area with the inlet cowlings. There have been no recorded failures of the redesigned panels. However, a number of pre-modified inlet cowlings are still in operation (including the one involved in this event).

As a result of this incident, Rolls-Royce issued an amended service bulletin which introduced a new inspection regime with 12-month (rather than 24-month) intervals as well as revised damage limits and highlighting how to conduct a ‘tap test’ to identify acoustic panel damage, including delamination.

Amendments to the service bulletin were also incorporated into a European Aviation Safety Agency airworthiness directive.

Read the final report: Engine cowling malfunction involving Airbus A330, B-6099, Sydney Kingsford Smith Airport, New South Wales, on 11 June 2017

The ATSB is calling for the implementation of improved tools and guidance for airshow display approvals and oversight following its investigation into a high profile fatal accident at an Australia Day air display in Perth in 2017.

A pilot and passenger were fatally injured when their Grumman G-73 Mallard amphibious aircraft aerodynamically stalled over the Swan River and collided with the water during the air display, which was part of the City of Perth’s Australia Day Skyworks event.

The ATSB’s investigation into the accident established that the Mallard was to conduct two circuits over Perth Water, ‘in company’ (that is, following behind at a prescribed distance) with a Cessna Caravan aircraft. The pilot of the Caravan had previous experience operating in this location, including participating in this air display. Following the Caravan was intended as a risk mitigator against the Mallard pilot’s unfamiliarity with display flying over the Swan River.

However, after conducting two passes in company, with both aircraft departing the display area, the pilot of the Mallard subsequently requested of, and received approval from, the air display ‘ringmaster’ to conduct a third pass. The aircraft then returned to the display area without the Caravan and in a manner contrary to the standard inbound procedure, requiring turns at higher bank angles and lower altitudes within a confined area to become established on the display path.

The ATSB investigation found that the aircraft stalled at an unrecoverable height. Had the Mallard re-entered the display area using the standard procedure for the air display, the manoeuvres required to position for the third pass would have been relatively benign with a significantly reduced risk of mishandling the aircraft. Further, the pilot’s decision to carry a passenger was also contrary to the requirements of the display approval and increased the severity of the outcome.

Having well-defined, transparent, and consistent processes for planning and approval of air displays assists in identifying risks and implementing effective mitigation strategies.

“Air displays have inherent and unique risks that everyone involved – pilots, organisers, and regulators – have responsibilities in addressing,” ATSB Executive Director Transport Safety Nat Nagy said.

“It is important that holders of these key positions have a thorough understanding of their role and responsibilities, to ensure adequate completion of safety critical tasks. Having well-defined, transparent, and consistent processes for planning and approval of air displays assists in identifying risks and implementing effective mitigation strategies.”

Mr Nagy said the investigation also highlighted that pilots can limit their exposure to risk by only participating in displays that are within their own and their aircraft’s capabilities and limitations.

“Pilots should not undertake any impromptu manoeuvres that have not been planned or practiced,” he noted.

Since the accident, CASA had independently published a revised manual of guidance for air displays in September 2017.

“The ATSB acknowledges the improvements to CASA’s manual of guidance for air displays and the associated forms,” Mr Nagy said. “But while these changes improve existing guidance, we consider that they only partially address the safety issue surrounding air display approval and oversight.”

Consequently, the ATSB has issued a formal safety recommendation to CASA calling for further improved air display approval and oversight tools and guidance, and enhanced procedures to ensure the suitability air display organisers, coordinators and participants.

Read the final report: Collision with water involving Grumman American Aviation Corp G-73, VH-CQA, 10 km west-south-west of Perth Airport, Western Australia, on 26 January 2017