Safety summary

What happened

At about midday, on 19 December 2019, a turbine‑powered Cessna P210N ‘Silver Eagle’ with United States registration N210BA, departed Bankstown Airport, New South Wales, for a private flight under instrument flight rules to Cambridge Airport, Tasmania. The aircraft was occupied by a pilot and one passenger.

Shortly after reaching the cruise altitude of about 18,000 ft, the aircraft encountered icing conditions. After descending to 16,000 ft, approximately 22 km south‑south‑east of Moruya Airport, the engine experienced a total power loss and could not be restarted. The aircraft subsequently arrived in the vicinity of Moruya Airport at about 8,000 ft above ground level. A glide approach to runway 18 was unsuccessful, and the aircraft impacted terrain about 560 m north of the runway threshold. The aircraft was destroyed, with the pilot seriously injured and the passenger receiving minor injuries.

What the ATSB found

The ATSB found that the accident flight was planned and conducted through forecast icing conditions, for which the aircraft was not certified or equipped.

Continued flight in icing conditions for an extended period resulted in significant accumulation of ice on the airframe. The subsequent descent to avoid further ice build‑up coincided with the pilot deactivating available engine ice-protection systems, which in turn led to an engine flameout from ice ingestion.

Due to the environmental conditions, the engine was unable to be restarted because of a phenomenon known as ‘rotor lock’ however, sufficient height was available to conduct a forced landing at Moruya Airport.

The investigation found that the pilot’s initial manoeuvring during the glide approach resulted in the aircraft being too low to reach the most appropriate runway and subsequent distraction led to a misjudged approach to the remaining runway options.

A number of other factors associated with pre‑flight preparation and the operation of the aircraft and its systems were also identified. The ATSB also found that the seatbelts and shoulder harnesses worn by the pilot and passenger probably reduced the extent of their injuries, and the prompt attendance of nearby paramedics further reduced their risk.

Safety message

Thorough knowledge of an aircraft’s limitations and systems, in combination with an understanding of hazardous weather and aviation meteorological products, is critical to safe and effective flight operations.

Icing conditions can be extremely hazardous to light aircraft and every icing encounter, to some extent, is unique and unpredictable. While inadvertent icing encounters can occur, a cautious approach during planning can reduce the likelihood of encountering these conditions. Pilots should carefully evaluate all available relevant meteorological information when determining whether icing conditions are likely along the planned flight path. Where the aircraft is not certified or equipped to operate in icing conditions, any ice-protection systems on the airframe, propeller, or engine should be regarded as a means to provide time to exit unexpected icing conditions, not to continue to operate in those conditions.

Although forced landings can occur in a variety of circumstances, in general, pilots should focus on remaining visual with the intended landing area in order to accurately assess the aircraft’s performance in glide, and reach key decision points to refine the course of action. Practice and proficiency in simulated forced landings and power-off approaches improves the likelihood of successfully managing these emergencies.

The occurrence

Precursor events

On the afternoon of 17 December 2019, a Cessna P210N Silver Eagle (P210N) with United States registration N210BA, landed at Bankstown, New South Wales following a flight from Griffith, New South Wales. The aircraft was fully refuelled, without anti-icing additive,^[1] before being stored in a hangar (see the section titled Fuel and anti-icing).

On the morning of 19 December, the pilot prepared the aircraft for flight and checked the fuel quantity and quality (water check). At about 1147 Eastern Daylight‑saving Time,^[2] the aircraft departed Bankstown under the instrument flight rules (IFR)^[3] for a private flight to Cambridge, Tasmania, with the pilot and one passenger on board.

By about 1218, the aircraft was at the planned cruising altitude of flight level (FL) 180.^[4] Shortly after, the pilot noted that rime ice^[5] was accumulating on the leading edge of both wings and the front windscreen. The pilot recalled that the propeller de-ice and all engine (turboprop) ice‑protection systems were activated at the time.

At about 1225, the pilot requested, and received, a clearance from air traffic control (ATC)^[6] to descend to FL 160 due to the ice accumulation. During that descent, the pilot deactivated the propeller de-ice and engine ice-protection systems. Another engine ice-protection system, which functioned automatically when the aircraft was pressurised, continued operating (see the section titled Ice protection). Some 5 minutes later, after reaching FL 160, the pilot recalled that the aircraft was positioned between cloud layers.

Between 1233 and 1238, the pilot made a number of track deviations up to 1.0 NM left and 2.7 NM right of track to avoid entering cloud. At about 1245, the pilot took several photographs, including one which showed ice on the leading edge of the left wing and pitot probe (Figure 1). At that time the aircraft was operating between two cloud layers, relatively close to the upper layer.

Figure 1: Ice accumulation on the left wing and pitot probe

Source: Pilot, annotated by ATSB

Engine failure

At about 1246, approximately 22 km south-south‑east of Moruya Airport, the aircraft’s engine lost all power (Figure 2). The pilot recalled not hearing any grinding, popping, or banging noises from the engine at the time, and that it sounded similar to the engine being shut down normally. About 5 seconds later, the pilot made a right turn towards the coastline and unsuccessfully attempted to restart the engine (see the section titled Unsuccessful engine restarts). Thirty seconds after the engine failure, the pilot called ATC, declared MAYDAY,^[7] and was provided a heading to Moruya Airport. The pilot then tried restarting the engine again, without success.

Figure 2: N210BA flight track

Source: Google Earth, annotated by ATSB

Shortly after, the pilot requested ATC provide the local weather and airport‑related information. The pilot was given the meteorological aerodrome report (METAR),^[8] which indicated an 8 kt south-easterly wind, visibility up to 8,000 m, and scattered^[9] cloud at 2,800 ft above mean sea level (AMSL).^[10] The pilot assessed runway 18^[11] (length 1,523 m) as the most suitable and programmed a radial bearing for the runway into the aircraft’s Garmin GNS 530 GPS ​navigation system. The pilot was also using the synthetic vision feature in the Garmin Pilot application on an iPad to provide a three-dimensional representation of the surrounding terrain and location of the airport runways.

At about 1251, the aircraft arrived south of the airport at 8,000 ft, where the pilot began a clockwise orbit. Shortly after, the pilot broadcast details of the emergency situation and intention to land on runway 18 over the Moruya common traffic advisory frequency (CTAF).^[12] The crew (pilot and observer) of a nearby Robinson R44 helicopter (R44), heard that transmission while conducting aerial shark patrol activities. In response, the R44 pilot advised the P210N pilot that they would notify people on the ground (at the airport) of the emergency (Figure 3 and Table 1), and soon after, notified the chief instructor of a skydiving company at Moruya Airport to organise emergency services. The R44 pilot recalled then flying directly to the airport, intending to be on the ground early to avoid distracting the P210N pilot.

At about 1255, the P210N pilot broadcast being on a ‘…no engine, right base approach to runway one eight’ (Figure 3 and Table 1). Shortly after, the aircraft briefly climbed from 1,400 ft to 1,500 ft while approaching the Moruya River, before turning east and descending to about 1,000 ft (Figure 3). The pilot recalled experiencing windshear and an increased rate of descent at this point, resulting in an assessment that there was insufficient remaining height to conduct a glide approach to runway 18. Consequently, the pilot decided to land on either runway 36 or runway 22.

Figure 3: N210BA flight track in the vicinity of Moruya Airport (see Note)

Note: Labels ‘A’ to ‘F’ are the approximate locations of CTAF radio calls between the pilots of N210BA and the R44. A transcript of these radio calls is included in Table 1. All altitudes are in AMSL.

Source: Google Earth, annotated by ATSB

Table 1: Extracts from relevant radio communications

The R44 pilot reported that, at about 1256, they were 1‑2 NM north-east of the airport and saw N210BA heading east over the river. At about the same time, skydive instructors recalled seeing the aircraft with the propeller in feather, the landing gear down, and flap partially extended. The R44 pilot thought landing at the airport would be a distraction to N210BA, so they positioned their aircraft just off the coast, at about 200 ft above the water, abeam the mid-point of runway 18. The skydiving company was holding an event that included two Australian Defence Force (ADF) paramedics. Following notification of the developing emergency, the instructors and ADF paramedics followed the aircraft in vehicles as it descended.

The P210N pilot recalled rejecting both the runway 36 and runway 22 approach options as they wanted to stabilise the aircraft and they could not sight the R44. The pilot reported that at that stage of the approach, they were pre-occupied with sighting the R44 helicopter to avoid a collision.

The aircraft entered the downwind leg for a left circuit to runway 18 at approximately 600 ft and, at about 300 ft, abeam the runway 18 threshold, the aircraft was turned onto a left base. The pilot assessed that the aircraft would not make the runway, or its undershoot, and instructed the passenger to secure their seatbelts. The pilot then tried to reduce the aircraft speed to just above the stall speed to reduce the impact severity, which activated the stall warning system. The pilot reported targeting an airspeed of 44 kt^[13] during the latter stage of the forced landing. At about 1258, the aircraft’s left and right wing clipped a pair of trees, followed by a ground impact about 560 m north of the runway 18 threshold.

Post-accident emergency response

After witnessing the accident, the R44 pilot repositioned the helicopter near the crash site, terminating in a low hover. The observer exited the helicopter and assisted the occupants. The R44 pilot then guided the skydive instructors and ADF paramedics to the accident site from the air before landing nearby.

The skydive instructors and R44 observer attempted to remove the unconscious pilot from the aircraft but they were unable to open the main entry door. One of the ADF paramedics assisted the injured passenger who had exited through the broken front windscreen. As fuel was leaking from the aircraft, the chief skydive instructor reached through the windscreen and switched off some of the electrical systems.

The R44 pilot and two additional paramedics from the Westpac Lifesaver Rescue Helicopter Service (based at Moruya Airport) travelled by car to the accident site. After finding a tyre lever, the aircraft’s emergency exit door was pried open, and the pilot was removed onto a stretcher. Following additional treatment, the pilot and passenger were airlifted to Canberra Hospital. The pilot suffered serious injuries while the passenger received minor injuries.

__________

1. A fuel system anti-icing additive prevents the formation of ice in fuel lines which can block the flow of fuel to the engine.
2. Eastern Daylight saving Time (EDT): Coordinated Universal Time (UTC) +11 hours.
3. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
4. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 180 equates to 18,000 ft.
5. Rime ice is rough, milky, and opaque. It is formed by the instantaneous or very rapid freezing of supercooled water droplets as they strike the aircraft. The rapid freezing results in the formation of air pockets in the ice, giving it an opaque appearance, and making it porous and brittle.
6. Melbourne Centre frequency.
7. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
8. Meteorological aerodrome report (METAR): a routine aerodrome weather report issued at routine times, hourly or half-hourly.
9. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘few’ indicates that up to a quarter of the sky is covered, ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky, ‘broken’ indicates that more than half to almost all the sky is covered, and ‘overcast’ indicates that all the sky is covered.
10. Above mean sea level (AMSL): all altitudes refer to AMSL unless otherwise stated. Moruya Airport has an elevation of 17 ft AMSL.
11. The number represents the magnetic heading of the runway.
12. Common Traffic Advisory Frequency (CTAF): A designated frequency on which pilots make positional broadcasts when operating in the vicinity of a non-controlled aerodrome or within a Broadcast Area.
13. All speeds are in knots indicated airspeed (KIAS) unless otherwise stated.

Context

Pilot information

The pilot held a Private Pilot Licence (Aeroplane) issued by the Civil Aviation Safety Authority (CASA) in 1997. The pilot also held a single-engine aeroplane class rating and a manual propeller pitch control design feature endorsement. The pilot’s last flight review, conducted in May 2019, was valid at the time of the accident.

In October 2019, the pilot obtained a United States (US) Federal Aviation Administration (FAA) Private Pilot Licence for a single-engine airplane in recognition of the pilot’s previously issued CASA licence. The FAA licence included an instrument rating achieved in the US. At that time, the pilot also completed a flight review in the US, and received endorsements to operate a ‘complex’, and ‘high-performance’^[14] aircraft, such as the P210N.

Type-specific experience and training

The pilot had a total of 430 flight hours, of which 162 were in a P210N. In the 90 days before the accident, the pilot had flown about 74 hours, of which 45 were in a P210N.

In 2019, the pilot completed a non-mandatory training course for the P210N at Propjet 210 Aviation^[15] (PropJet) in the US. The course was intended to help pilots transitioning from piston to gas turbine powered P210N aircraft. The training syllabus covered many topics, including:

• slow flight
• stalls
• ice protection and inadvertent icing encounters
• use of fuel system icing inhibitor
• managing engine failures, including restart procedures
• simulated forced landing techniques
• owner responsibility for required maintenance.

The pilot completed engine-out training in a P210N (non-turbine) in May 2019 and, later that year, additional engine-out training for an instrument rating.

Medical information and fatigue

The pilot held a Class 2 aviation medical certificate issued by CASA with no restrictions, which was valid until February 2021.

The pilot was unconscious immediately following the collision but, after neurological examinations, cleared of any impairments two weeks post-accident. The ATSB collected information about the pilot’s 72 hours of activity prior to the accident. A review of that evidence identified that it was unlikely that the pilot was experiencing a level of fatigue known to affect performance.

Aircraft information

The Cessna P210N is a six seat, pressurised aircraft with retractable tricycle landing gear. The aircraft (N210BA) was manufactured in 1979 and was originally fitted with a piston engine. In 1997, the aircraft underwent supplemental type certificate (STC) modifications^[16] that included the fitment of a Rolls-Royce Model 250-B17F/2 turboprop engine^[17] and Hartzell propeller. Cessna 210 aircraft modified in this manner were branded ‘Silver Eagle’.

Fuel system

General description

The fuel system consists of:

• two inner wing tanks
• two wing tip tanks
• an auxiliary transfer tank in the baggage compartment
• two fuel reservoir (header) tanks.

The inner wing tanks gravity feed the header tanks, where the fuel then passes through a fuel selector valve, two electric boost pumps (one a backup), a fuel filter with bypass valve, an engine driven pump, and then into the engine fuel nozzle. The fuel selector valve allows fuel to be delivered to the engine from either the left or right header tank, or from both header tanks simultaneously. The auxiliary and wing tip tanks only resupply the wing tanks. The aircraft Pilot’s Operating Handbook and FAA‑Approved Airplane Flight Manual Supplement (flight manual) identified Jet A1 as the primary fuel.

The engine cockpit instrumentation included a fuel pressure gauge and a fuel flow indicator. The cockpit annunciator panel provided visual indications for the fuel related systems. There were red warning lights for:

• fuel bypass warning (fuel filter blocked to the point where it was being bypassed)
• fuel pressure warning (fuel pressure reduced to below 5 pound per square inch (psi))
• low fuel quantity (either main wing tank was 7 US gallons or less).

The pilot reported that before, and at the time of the engine power loss, there were no annunciator panel warnings illuminated, and there were indications of adequate fuel pressure.

Fuel and anti-icing

Water can exist within aviation turbine fuel in three different forms: dissolved, entrained, or free water. Due to the affinity of turbine fuel to water, some dissolved water will always exist within the fuel but is not considered a contaminant if it remains dissolved. Entrained water can be caused by agitation of the fuel as it passes through system components during refuelling or flight, and from the separation of dissolved water if the fuel temperature cools sufficiently. Free water can be introduced during refuelling, condensation from moist air entering the tanks through the vent system (either on the ground or during flight), or the settling of entrained water. Entrained and free water cooled below the freezing point of water can form ice within the fuel system.

Anti‑icing additive, when used in the correct concentration, can prevent formation of fuel system ice from any entrained or free water at fuel temperatures as low as about ‑40 °C. The additive works by lowering the freezing point of water. The aircraft’s flight manual limitations section contained the following instruction about fuel additive use:

For flight at ambient temperatures of 40° [F] (4° C) and below, the fuel used in this aircraft MUST have an anti-icing additive in compliance with MIL-I-27686D or E or Phillips PF A55MB, incorporated or added into the fuel during refuelling in accordance with the additive manufacturer’s instructions.

The pilot reported that they interpreted the temperature stated in this instruction as being the ambient temperature at the refuelling point (that is, on the ground). Otherwise, the pilot pointed out, additive would be used all the time as ambient temperatures at the usual high operating altitudes were normally below 4 °C. The pilot also stated never having used additive or encountering any issues when operating at low temperatures, and believed fuel system icing was an issue only in temperatures below ‑35 °C.

The forecast ambient temperature at the pilot’s planned cruise altitude was between -9 and -11 °C (see the section titled Area forecasts). The pilot did not request anti-icing additive, which was available at Bankstown Airport when the aircraft was refuelled, and the fuel already in the aircraft also did not contain anti-icing additive.

Fuel documentation showed that the aircraft was refuelled with about 88 gallons of Jet A1 on 17 December 2019. The pilot stated that before departure on 19 December, the auxiliary tank, wing tanks, and tip tanks were dipped and found to be essentially full, with no water present.^[18] The pilot estimated that the aircraft had used approximately 30 gallons of fuel before the engine power loss.

A strong smell of aviation turbine fuel was present at the accident site. Additionally, the fuel filter in the engine bay was full of fuel (about 1 litre) with no water detected in a sample tested using a fuel water detector syringe. The pilot also advised that PropJet’s examination of the fuel filter found no signs of discolouration, which PropJet stated was usually associated with water contamination.

Training

The pilot attributed their understanding of anti-icing additive usage to information they received during the 2019 PropJet training course, adding that other P210N pilots had the same interpretation. The pilot stated that PropJet training flights were conducted between FL 150 to FL 200 without anti-icing additive and recalled an ambient air temperature below -4 °C on one occasion. The pilot also noted that additive was available at the refuellers where those flights were undertaken.

The ATSB requested the PropJet training course material to review its content, but was advised by PropJet that, as the course was delivered face-to-face and verbally one-on-one, there was no documented training material. However, the topics covered were available, and included the use of anti-icing additive. PropJet also advised that the course was delivered using information in the aircraft’s flight manual and was consistent with the engine manufacturer’s (Rolls-Royce) recommendations. Due to the verbal training delivery, it was not possible to review the specific content relating to the usage of anti‑icing additive. More importantly, the information provided to pilots undertaking that training was not available for their later reference.

Recorded data

The aircraft was fitted with a transponder that broadcast ADS-B^[19] data every 5–10 seconds. This data was available up until about 9 seconds before the collision with terrain. During the flight, the pilot used the US-based software program ForeFlight,^[20] which provided GPS position and altitude up to about 5 seconds before the impact. The GPS ground speed was generally consistent with the ADS-B ground speed. The last reliable ground speed was recorded about 14 seconds before the impact, which indicated an approximate ground speed of 78 kt on a 290° track.

In the 5 minutes leading up to the engine power loss, the following ADS-B parameters and range of values were recorded:

• altitude – 16,001‑16,100 ft
• ground speed – 164‑170 kt
• track – 187‑198°.

Engine information

The Rolls-Royce Model 250-B17F/2 (M250-B17F/2) engine is a M250 series turboprop variant with a four-stage axial compressor and centrifugal impeller, driven by a two-stage gas producer turbine. The engine has a reverse flow annular combustor and two-stage power turbine that provides the drive for the reduction gearbox and propeller shaft. The propeller gearbox and power turbine are not mechanically coupled to the gas producer turbine and compressor.

Ice protection

The aircraft’s flight manual prohibited flight into known icing conditions (see the section titled Icing conditions). The aircraft was not fitted with any airframe anti-ice or de-ice protection systems. However, the aircraft was fitted with ice-protection systems in case of an unexpected icing encounter. These consisted of heating for the pitot probe and the windshield, while the propeller blades had electrically heated elements that provided de-ice protection by cycling every 20 seconds. In addition, the engine had the following ice-protection systems (Figure 4 and Figure 5):

• Engine inlet^[21] – mounted to the compressor front support (compressor inlet) with compressor bleed air providing anti-ice protection. A cockpit gauge provided the heated air temperature.
• Compressor inlet – the compressor inlet consists of an outer skin, hollow radial struts, and a hub (bullet nose). Compressor bleed air provides anti-ice protection.
• Continuous engine ignition – the igniter sparks continuously to relight the fuel-air mixture in the event combustion is extinguished due to a momentary change in the fuel-air ratio.

Figure 4: Side view of an exemplar P210N propeller and engine inlet

Aircraft engine, propeller, and engine inlet shown are similar to N210BA.

Source: Mattia De Bon, annotated by ATSB

Figure 5: Front view of N210BA engine inlet and compressor inlet (post-accident)

Source: Rolls-Royce

The STC holder advised that the cockpit switch labelled ‘inlet heat’ activated all three ice protection systems. Although, when the aircraft cabin was pressurised, the engine inlet ice‑protection automatically operated irrespective of the switch position. However, the compressor inlet ice‑protection and continuous ignition required manual activation by using the inlet heat switch. Continuous engine ignition could also be manually activated using another, separate cockpit switch.

When interviewed after the accident, the pilot’s description of the ice-protection systems did not include the compressor inlet ice-protection system. While this indicated a gap in knowledge, the pilot noted that, although the engine inlet fitted operated automatically when the aircraft was pressurised, out of habit they turned the inlet heat switch on in icing conditions (which in turn activated the compressor inlet ice-protection system).

Inadvertent icing encounter checklist

If icing conditions were encountered, the Inadvertent icing encounter emergency checklist in the aircraft’s flight manual instructed the pilot to ensure all the ice-protection equipment was activated and to exit the icing conditions as soon as possible. The introductory note in the checklist stated:

The engine inlet anti-ice lip [engine inlet] and engine anti-ice [compressor inlet], propeller de-ice, and continuous ignition must be activated for flight or ground operation in visible moisture at an OAT [outside air temperature] of 41° F (5° C) and below or while operating in falling or blowing snow regardless of ambient temperature. These systems must be operated in the above-mentioned conditions even if there is no visible sign or airframe ice and/or snow accumulation.

Deactivation of the system shall not be made until the above-mentioned conditions have been left and all accumulated airframe ice and/or snow has dissipated.

The pilot advised that they were not aware of this checklist but stated that ‘…if you get into inadvertent icing, get out of it’, indicating an awareness of the associated risk. The pilot recalled that the engine ice-protection systems were on during the icing encounter at FL 180 but turned them off during the descent to FL 160 since the aircraft was no longer in visible moisture and not accruing any more ice.

The pilot reported that the decision to descend was mainly based on the passenger’s concern about the observed ice build-up. They further advised being familiar with the performance of the P210N airframe with ice accumulation from previous icing encounters that had not caused any operational problems. The pilot also stated that some of those encounters involved more severe icing than this occurrence, and that other P210N owners/pilots had reported that the aircraft could carry a substantial amount of ice without any problem.

Recorded data

The pilot reported that, since acquiring the aircraft in 2019, the engine had not presented any abnormal indications. Photos captured by the pilot^[22] about 30 seconds before the engine power loss showed some of the engine instrumentation in the cockpit. The position of cockpit controls and instrument readings were obtained from those photographs (Table 2 and Table 3). Where relevant, engine operating limitations for maximum continuous operation have been included.

Table 2: Engine instruments 

Table 3: Cockpit control and instrument information

Post‑accident engine examination

Following an initial assessment at the accident site, the engine was relocated to the ATSB’s technical analysis facilities in Canberra for further inspection, which identified the following:

• A small amount of residual fuel in the fuel nozzle with no blockages.
• The igniter condition appeared normal.
• All three magnetic chip detectors and oil filter had no visible chips, shards, or specks of metal, and both the filter and oil were clean.

The engine was subsequently transported to Asia Pacific Aerospace, a Rolls‑Royce authorised maintenance repair and overhaul centre, where the Rolls-Royce supervised examination found:

• continuity and functionality of control linkages
• fuel system and engine anti-ice components were serviceable
• continuity of gas producer rotor and power turbine rotor
• light rub contact on one third of the compressor shroud face
• soft body impact damage on some of the stage two, three and four compressor blades, but primarily on the fourth stage (Figure 6)^[23]
• significant cracking on the first stage gas producer turbine nozzle shield (P/N 23062750), but no indications that pieces of the shield had liberated (Figure 7)
• a crack on the trailing edge of the inner band face of the first stage turbine nozzle
• light rub contact over a short section of the first stage gas producer turbine blade track located within the second stage turbine nozzle (Figure 8).

Figure 6: Fourth stage compressor blade damage

Source: ATSB

Figure 7: First stage gas producer turbine nozzle shield cracking

Source: ATSB

Figure 8: Rub contact on first stage gas producer turbine blade track

Additional blade rub on the turbine blade track was evident but not shown in this photo.

Source: ATSB

Rolls-Royce stated that there was insufficient evidence to determine the source of the observed compressor blade damage. With respect to the first stage nozzle crack, Rolls-Royce noted that cracks in this area were typical of in-service experience and were unlikely to grow to critical length between maintenance inspections. Rolls-Royce concluded that there were no pre-existing conditions that should have prevented normal engine operation.

First stage turbine nozzle shield inspections

Due to in‑service cracking of first stage turbine nozzle shields in M250 series engines, Rolls-Royce had issued commercial engine bulletins (CEB) in March 2000 recommending initial and recurring inspections of affected turbine nozzle shields for cracking. Recurring inspections were not needed if the nozzle shields were replaced with unaffected shields. For M250-B17F series engines, CEB A‑72-2069 was applicable and outlined that partial, or complete separation of the nozzle shield due to cracking, could result in heat distress and coking of the gas producer turbine bearing, and an oil fire.

The bulletin recommended the following inspections of the nozzle shield P/N 23062750:

• initial inspection – inspect at 1,000 cycles. If the cycles are unknown, or the nozzle has more than 1,000 cycles, inspect within 100 cycles
• recurring inspection – inspect every 1,000 cycles of operation.

A 2015 engine test report indicated that the aircraft’s M250-B17F/2 engine had accumulated 1,386 cycles (since new). Review of the engine maintenance history did not identify any entries relating to completion of CEB A-72-2069 or maintenance on the nozzle shield.

Engine power loss

A review of the captured engine parameters (Table 2) by the ATSB and Rolls-Royce did not identify any operational abnormalities, while the engine examination found no mechanical issues. Further, the pilot described the engine power loss as similar to the engine being shut down normally. On that basis, the ATSB concluded that the engine probably experienced a flameout. The aircraft’s flight manual defined a flameout as an ‘unintentional loss of combustion chamber flame during operation’. As a flameout can occur for various reasons, several potential causes were investigated.

Fuel exhaustion or starvation

Evidence at the accident site indicated there was sufficient fuel on-board the aircraft with fuel continuity evident up to the engine fuel nozzle, and no blockages due to fuel contamination. There was no water detected in fuel from the fuel filter, which indicated there was no potential for hazardous ice formation in the fuel system. Additionally, the pilot reported that there were indications of adequate fuel pressure prior to, and just after the flameout. Further, during the engine examination, the relevant fuel system components were tested and shown to be functioning. All of this evidence supported a conclusion that fuel exhaustion or fuel starvation was not a likely cause.

Compressor stall

A compressor stall occurs when there is a breakdown in airflow through the compressor. This can lead to flow reversal, banging sounds, and flame expulsion. The pilot reported not hearing any popping or banging sounds from the engine at the time of the flameout. Additionally, the recorded engine parameters and manufacturer’s post‑accident examination of the engine did not identify anything that would support a compressor stall event.

Incorrect fuel‑air mixture

If the rich or lean limit of the fuel-air ratio is exceeded in a gas turbine engine’s combustion chamber, the flame will extinguish.^[24] At the time of the flameout, there were no significant changes in the aircraft’s course, speed, or altitude based on flight track data that would have required a change in the engine speed or power level. While there was bushfire activity in the general area along the aircraft’s flight path, photographs taken by the pilot about 30 seconds before the flameout did not indicate that the aircraft was flying in bushfire smoke‑contaminated or polluted air, while the fuel flow and fuel pressure indications appeared normal. Therefore, the evidence did not support a flameout resulting from a rich or lean fuel mixture. Additionally, there was no evidence of any engine fuel‑metering component defects.

Significant weather

At the time of the flameout, the aircraft was not operating in rain or reported turbulence. As such, engine water ingestion or turbulence disrupting airflow into the engine were both ruled out. However, as previously detailed, there was a significant build-up of airframe ice preceding the engine power loss. Consequently, the ATSB considered the likelihood that icing may have affected the operation of the engine.

Intake icing

The M250-B17F/2 engine is certified to operate in icing conditions prescribed by the Federal Aviation Regulations^[25] when all the engine ice-protection systems are activated.^[26] Rolls-Royce stated that if the compressor inlet ice-protection system was deactivated during an icing encounter, ice would begin to accumulate. Depending on the amount of ice build-up, the airflow would be reduced to the engine, degrading performance, and causing a rise in the gas producer turbine temperature – measured as turbine outlet temperature (TOT). Significant ice build‑up at the compressor inlet could affect the airflow sufficiently to cause a flameout.

The pilot reported deactivating the compressor inlet ice-protection system during the descent to FL 160 (supported by the photographs). Therefore, it is possible that sufficient ice accumulated on the compressor inlet to flameout the engine during the descent and subsequent level flight at FL 160. However, the pilot also advised that there were no changes in TOT from the cruise phase at FL 180 until the flameout. Based on that account, and the advice provided by Rolls‑Royce, any ice present on the inlet was of insufficient quantity to produce a noticeable rise in TOT. Additionally, the adjacent engine inlet ice-protection system was operating up to the point of the engine power loss, possibly reducing the potential for ice accumulation in the vicinity of the compressor inlet.

Certification of the M250-B17F/2 engine utilised some of the ice certification test results of another M250 series engine variant with the same compressor design. These tests did not assess the effectiveness of the engine inlet anti‑ice system as that was an airframe‑specific component. One of the certification tests was conducted in icing conditions using a 60‑second delay before turning the electrically heated compressor inlet ice-protection system on. The test was undertaken in a ‑20 °C icing environment, reduced power setting, and with the continuous ignition off. That test found that there was a large build-up of ice on the compressor inlet that subsequently detached and was ingested when the compressor inlet ice-protection was turned on. The ingestion caused a flameout and bending of a first stage compressor blade.

Based on the results of the test, it was considered unlikely that any ice build‑up on the compressor inlet following deselection of the ‘inlet heat’ switch would have been sufficient to cause a flameout unless it detached and entered the engine.

Ice ingestion

The engine’s certification did not include specific requirements for tolerance to foreign object ingestion, such as ice and water. However, tests conducted by Rolls-Royce identified that a minimum of 30 mL of water, ingested within 0.25 seconds, was sufficient to cause a flameout. Based on that result, Rolls-Royce estimated that at least 30 mL of ice could similarly cause a flameout. A related Rolls-Royce study in 1968 confirmed that 30 grams of snow or slush ingested into M250 series engines could result in a flameout.

Roll-Royce records indicated 10 flameout events due to ice or snow ingestion in M250 series engines since 1996 (helicopter applications). Engine damage caused by ice ingestion was usually in the form of soft body damage (for example, aerofoil bending) on the first stage compressor blades, but if the ingestion was not hard (for example, snow) there may not be visible damage.

Rolls-Royce issued Revision 3 of a commercial service letter in October 2005 that warned owners, operators, and pilots of aircraft with M250 series engines that snow or ice ingestion can cause an engine flameout. The letter reminded customers that the aircraft’s flight manual should be referred to for the operation of ice protection systems.

Unsuccessful engine restarts

Rotor lock

The engine restart emergency procedure in the aircraft’s flight manual contained the following warning:

Due to thermal changes within the turbine, the gas producer section of the engine may lock up after an inflight shutdown. This is a temporary condition which may exist after the engine has been shutdown for approximately one minute and which may continue for up to ten minutes following shutdown. Therefore, if at all possible, air starts should not be attempted during the time period between one minute after shutdown and ten minutes after shutdown.

Rolls-Royce stated that M250 series engines have tight clearances between the first and second stage gas producer turbine wheel blades and their respective blade tracks on the second stage nozzle. These components expand and contract at different rates due to thermal changes during engine operation. After a flameout, the outer rim of the second stage nozzle, which contains the blade tracks, can cool more quickly than the turbine blades. This differential cooling can result in contact between the blades and blade track, temporarily preventing gas producer rotation (compressor and turbine). Once the turbine blades cool sufficiently, and the clearances return, gas producer rotation is restored. This thermally‑induced condition is commonly referred to as ‘rotor lock’ or ‘core lock’.

An engine’s susceptibility to rotor lock, including the amount of time taken before the gas producer section locks, and the duration of its locked state, is dependent on many variables. These variables include outside air temperature, altitude, blade tip clearances, second stage nozzle roundness, and engine health. Rolls-Royce indicated that M250 turboprop engines (used in aeroplanes) are more susceptible to rotor lock than M250 turboshaft engine variants (used in helicopters). This is because turboprop aircraft typically operate at a higher altitude with lower ambient air temperature, and higher speeds, for longer periods of time. These operational conditions produce a rapid cooling effect of the turbine case structure in the event of a flameout, increasing the chance of rotor lock compared to the turboshaft variants.

Rolls-Royce stated that a substantial amount of turbine blade rub along the first or second stage gas producer turbine blade track was usually indicative of rotor lock. Rolls-Royce could not confirm whether or not the blade rub found during the engine examination (Figure 8) was due to rotor lock, but advised expecting to have found more turbine blades rub on the blade track if rotor lock had occurred. Rolls-Royce also pointed out that the starter/generator circuit breaker should activate if a restart was attempted while the engine was in the rotor lock condition.

Restart attempts

The starter/generator is used for engine starting and to provide power to the aircraft’s electrical systems while the engine is operating. The starter/generator is linked by gearing to the shaft that couples the compressor and gas producer turbine. Visual examination of the starter/generator showed no signs of overheating or arcing, and all the terminals were correctly installed. The starter’s drive shaft was intact and rotated freely by hand.

The pilot reported being familiar with the rotor lock warning in the flight manual, specifically the need to perform a quick restart, and had practiced the restart procedure before the accident flight to commit it to memory. The pilot stated that the first restart attempt was within 20 seconds of the flameout and followed the memorised procedure but was not seeing any indication of the expected gas generator rotation. The pilot then reviewed the ForeFlight engine restart checklist and confirmed that the correct procedure was completed.

The pilot stated that the ForeFlight restart checklist was used for the second unsuccessful restart attempt. There had been no problems with the starter/generator or electrical systems during the flight and the starter/generator circuit breaker did not activate during the restart attempts. The pilot recalled an increase in amperes on the aircraft’s cockpit ammeter while the starter button was being pressed but did not hear the engine’s turbine spinning up or see any percentage increase on the gas generator rpm gauge.

Meteorological information

Area forecasts

Bureau of Meteorology

A significant weather (SIGWX) chart is a routine forecast, covering FL 100–250 and FL 250­–630, that provides information on certain weather phenomena, including moderate (see the section below titled Icing conditions) and severe icing.^[27] A SIGMET^[28] is a non-routine weather advisory covering all altitudes that, in relation to icing conditions, only covers advisories on severe icing. An AIRMET^[29] is also a weather advisory on conditions not already included in the Graphical Area Forecast, and includes forecasts for moderate icing up to 10,000 ft.

There was no AIRMET or relevant SIGMET applicable to the planned flight but a SIGWX chart covering FL 100–FL 250 was available (Figure 9). This chart included weather associated with a transiting cold front moving east to north-east at about 45 kt that included broken altostratus and altocumulus clouds with moderate icing from below 10,000 ft to FL 190, and isolated embedded cumulonimbus from below 10,000 ft to above FL 250.

Figure 9: BoM forecast significant weather chart applicable to the planned flight

The orange highlighted area shows the transiting cold front that was not included on the ForeFlight FL 250–FL 630 SIGWX chart. The top half of original chart is not shown.

Source: Bureau of Meteorology, annotated by ATSB

ForeFlight

At 0914 on 19 December, the pilot used ForeFlight to file the flight plan. ForeFlight generated a graphical weather report for the route, including a vertical cross section chart and SIGWX chart. A section titled ‘SIGMETs/AIRMETs’ was also presented and included a single SIGMET for severe turbulence from FL 210–FL 400. The vertical cross section chart showed the planned flight path, which indicated that during cruise the aircraft would pass through forecast areas of light and moderate icing, with ambient air temperatures between -9 °C and -11 °C (Figure 10).

Figure 10: ForeFlight vertical cross section chart for planned flight

Source: Pilot

The SIGWX chart covered FL 250 to 630 (Figure 11). The pilot incorrectly interpreted the chart as showing no significant weather at the planned flight level (FL 180), and expressed an understanding that the chart was a graphical representation of SIGMETs.

Figure 11: ForeFlight significant weather chart for planned flight

Source: Pilot

At the time of the accident, ForeFlight software capabilities were mainly dependent on the user’s geographical region. In the region covering Australia, AIRMETs, and SIGWX charts covering FL 100–FL 250 were not supported. The geographical weather limitations were detailed in an article on the ForeFlight website but there was no indication of those limitations within the software’s graphical weather report.

The pilot assumed all relevant weather information was being provided in the same way as it had been when using the software in the United States and Europe.

In Australia, CASA approves organisations as data service providers (for example, those that offer electronic flight bag software). Approved data service providers are authorised to publish aeronautical data such as weather and charts, which pilots can use as an alternative to data published by Airservices Australia. At the time of the accident, the four approved data service providers for Australian airspace were Jeppesen, Avsoft Australia, OzRunways, and Garmin International. The use of unapproved electronic flight bag software in Australia, such as ForeFlight, increases the risk of missing important weather information.

Icing conditions

Icing severity is generally classified as trace, light, moderate, or severe. The Bureau of Meteorology (BoM) provided the following general advice on moderate icing severity:

…the rate of accumulation is such that even short encounters become potentially hazardous and use of de-icing/anti-icing equipment or diversion is necessary.

The FAA provided the following interpretation of ‘known’ icing conditions.^[30]

…“Known icing conditions” involve…circumstances where a reasonable pilot would expect a substantial likelihood of ice formation on the aircraft based upon all information available to that pilot.

Pilots should also carefully evaluate all of the available meteorological information relevant to a proposed flight including applicable surface observations, temperatures aloft, terminal and area forecasts, AIRMETs, SIGMETs, and pilot reports (PIREPs). As new technology becomes available, pilots should incorporate the use of that technology into their decision-making process. If the composite information indicates to a reasonable and prudent pilot that he or she will be operating the aircraft under conditions that will cause ice to adhere to the aircraft along the proposed route and altitude of flight, then known icing conditions likely exist.

The United States National Transportation Safety Board (NTSB) position on the subject was similar, stating that ‘…known icing conditions exist when a pilot knows or reasonably should know about weather reports in which icing conditions are reported or forecast.’

While the aircraft’s flight manual stated that flight into known icing conditions was prohibited, the pilot interpreted this as applying only when an AIRMET or SIGMET for icing was issued.

Additionally, the pilot stated that the forecast icing was ‘…more of a heads up than anything else’ and that ‘…you adjust accordingly as per the conditions when you’re there’, indicating an interpretation of just needing to be aware of potential icing when in cloud at a particular flight level. The pilot also interpreted the likelihood of encountering the forecast icing conditions as more probable than not but expected that an AIRMET or SIGMET for icing would be issued if those conditions were highly probable. The pilot reported having used the Windy^[31] program to view cloud top information before the flight, recalling that the cloud tops were at FL 140, and hence expected to be above clouds at the planned cruise altitude of FL 180.

Moruya Airport weather

The forecast winds at various altitudes in the Moruya Airport area at the time of the accident were:

• 35 kt from 260° at 7,000 ft
• 24 kt from 270° at 5,000 ft
• 12 kt from 150° at 2,000 ft
• 7 kt from 150° at 1,000 ft.

Additionally, the following automated surface observation for Moruya Airport was available from the routine aerodrome weather report issued shortly after the accident:

• 1300 – winds 140° at 7 kt with greater than 10 km visibility and nil cloud detected.

The pilot of the R44 helicopter stated that there was a ‘…light southerly [wind] blowing but nothing really’ with a considerable amount of haze in the area (based on the helicopter’s flight to Moruya at about 500 ft).

The P210N pilot stated that the wind between 3,000–9,000 ft was more benign than that below 3,000 ft. The pilot also reported experiencing a significant increase in tailwind as well as ‘…getting a lot of sink’ approaching Moruya River between 2,000 ft and 1,500 ft, and strong gusts at lower levels.

Due to the presence of bushfire smoke haze, the pilot recalled not being able to see the airport clearly at 9,000 ft, even when only about 2 NM away. They also reported difficulty seeing the end of runway 18 on the downwind leg late in the glide approach.

Accident site and wreckage information

The pilot reported that there were no control issues with the aircraft during the flight and that it was controllable until ground impact. No pre-existing faults with the aircraft were identified during the wreckage examination.

Impact sequence

Examination of the accident site indicated that the left and right wing each clipped a tree immediately before the aircraft impacted the ground in a left-wing low attitude about 560 m north of the runway 18 threshold (Figure 12). The wreckage trail was about 30 m long and orientated 212°. Based on the tree and ground impact marks, the aircraft struck the trees at a left bank angle of about 16° with a subsequent descent angle of approximately 14°.

The left wing struck the ground first followed by a single, feathered propeller blade, and subsequent heavy impact on the left engine exhaust and lower engine cowling. The aircraft then yawed left through 180° before impacting several trees, causing the tail assembly to separate. The aircraft came to rest facing the opposite direction to its flight path.

Examination of the wreckage indicated that the aircraft entered the vegetation with approximately 10° of flaps and the landing gear extended.

Figure 12: N210BA main ground impact mark and wreckage

Source: ATSB

Occupant restraints

Both front seats were fitted with a lap belt and single shoulder harness that provided a three-point restraint system. The pilot briefed the passenger on emergency procedures before impact, including fastening the seatbelt. Accounts from the passenger and a first responder confirmed that both occupants had fastened their seat belts and shoulder harnesses before impact.

Emergency egress

The aircraft’s main entry door was at the front on the pilot’s side (left side of aircraft) and included several pin-type lock devices spaced around the edges. An emergency exit door was located on the front passenger’s side (right side of aircraft) and could only be opened and closed from inside the aircraft. The aircraft’s emergency landing without power checklist included the check: ‘Door ‑ UNLATCH PRIOR TO TOUCHDOWN’.

First responders found the main entry door in the latched and locked position after the accident with all pressurisation lock pins still engaged in the airframe and no evidence of failure of the door latching and locking mechanism. The pilot stated that they intentionally did not open the main entry door before impact in order to ‘retain cabin strength’ during the ground contact. However, they advised asking the passenger to open the emergency exit door before impact, but there was no time to do so.

The pilot also advised that they did not complete the emergency landing without power checklist before the impact, but indicated following the ‘C-GUMPS’ checklist^[32] while on the downwind leg for runway 18.

Operational information

Checklists

While the aircraft’s flight manual was stored in the aircraft, the pilot used a set of electronic checklists within the ForeFlight program on the accident flight, which were read out electronically through the headset using a feature called ‘Checklist Speak’. The ForeFlight program contained pre-built checklist templates for various aircraft based on their flight manuals. However, it also allowed users to edit these templates or create their own checklists. At the time of the accident, ForeFlight did not include a pre-built template for a P210N aircraft. The pilot used checklists that were obtained from another P210N owner, and had not made any changes to the emergency procedures within those checklists.

As part of the investigation, the ATSB compared three emergency procedures from the ForeFlight electronic checklists with their equivalent in the aircraft’s flight manual. Of these, the engine restart checklist was the only emergency checklist used by the pilot during the accident flight. Some of the inconsistencies found in the electronic checklists are listed below.

• Engine failure during flight
  • items from the Engine failure during flight and Engine restart procedures checklists in the flight manual were combined into a single checklist
  • the rotor lock warning in the flight manual was omitted (see the section titled Rotor lock)
  • checklist item ‘Fuel Pumps ‑ OFF’ in the flight manual was omitted
  • order of items in the flight manual were different
  • additional items absent from the flight manual were included
• Emergency landing without engine power
  • checklist item ‘Seats, Seat Belts, Shoulder Harnesses ‑ SECURE’ in the flight manual was omitted
  • checklist item ‘Fuel Pumps ‑ OFF’ in the flight manual was omitted
  • checklist item ‘Mixture ‑ IDLE CUT-OFF’ not applicable to the engine type was included.
• Inadvertent icing encounter
  • introductory note regarding activation and deactivation of engine ice-protection systems in the flight manual was omitted (see the section titled Inadvertent icing encounter)
  • Two other notes in the flight manual were omitted.

A review of the Engine failure during flight electronic checklist by Rolls-Royce concluded that following the checklist would not prevent a successful restart. A review of the ‘Checklist Speak’ feature by the ATSB found that only the checklist item was read out to the user. Any additional text attached to the item including notes, warnings, and cautions, were not read out. As such, there was the potential to miss important checklist information (although it was not contributory to this accident).

The FAA issued a safety alert for operators (SAFO) in 2017 to warn pilot’s and operators about the risks of using commercial off-the-shelf (COTS) checklists, or developing their own checklists, instead of using those in the aircraft’s flight manual. The SAFO was released after an investigation into an accident where a pilot landed with partially extended landing gear. The pilot used a COTS checklist that did not match the aircraft’s flight manual with respect to landing gear failure and manual gear extension, which significantly contributed to the pilot’s inability to fully extend the landing gear.

The SAFO recommended that pilot’s and operators that choose to use COTS checklists, or develop their own, should thoroughly compare these to the aircraft’s flight manual to ensure all the manufacturer’s pertinent information is available during flight.

Aircraft weight and balance

The aircraft’s maximum take-off weight and landing weight was 4,000 lbs (1,814 kg) and 3,800 lbs (1,724 kg) respectively, and the take-off and landing centre of gravity envelopes were different shapes (Figure 13). The pilot used a ForeFlight program feature to conduct the pre-flight weight and balance assessment. Program documentation outlined that the feature, which required user information input, could only be used if the aircraft met certain requirements. One requirement was identical take-off and landing centre of gravity limit envelopes. The software provided a warning to the user if the aircraft’s weight or balance exceeded any user-input limitations.

The pilot provided the ATSB with a ForeFlight document, created about 25 minutes before take-off on 19 December that showed the aircraft’s planned take-off weight was 4,111 lbs (1,864 kg). The pilot advised that there were no related software warnings before the accident flight.

The pilot also provided the ATSB with another ForeFlight document (created after the accident flight) that contained the centre of gravity envelope from the pilot’s N210BA weight and balance profile. The maximum take-off and landing weight values mirrored the aircraft’s flight manual, but the shape of the envelope was different, and included an offset area with boundaries beyond the maximum take-off weight (Figure 13). Program documentation indicated that the offset area was probably due to data entry errors.

Figure 13: Centre of gravity envelope comparison

Take-off and landing limits have been highlighted.

Source: Pilot, modified by ATSB

The ATSB assessed that, based on cargo weights, estimated fuel, and occupant weights, the aircraft’s take-off weight was similar to the value on the ForeFlight document prepared by the pilot before the accident flight. Considering the likely fuel burn rate, the aircraft’s weight at impact was estimated to be about 3,910 lbs (1,774 kg). The aircraft’s centre of gravity was within the take-off and landing limits.

Glide performance

Information detailed in the flight manual supplement associated with the installed turbine engine indicated a glide ratio of approximately 19:1 with the propeller feathered,^[33] no wind, flaps and landing gear up, and the best glide speed flown (93 kt at 4,000 lb). Extending the landing gear and flaps both significantly reduced the glide ratio.

The aircraft’s average glide ratio from about 6,000 ft until impact was approximately 11.2:1 (based on the distance travelled from the GPS data). The pilot reported extending the landing gear, and at least 10° of flap, at about 6,000 ft, to lose altitude and while sufficient battery power was available. This was due to concern that there would not be enough electrical power to operate those systems at a later point during the glide approach. The landing gear could be manually extended without electrical power, although this process was much slower than normal gear extension. The aircraft could also be safely landed without the flaps extended.

The pilot also reported that, before extending the landing gear and flaps, the aircraft had much better glide performance than experienced during the PropJet training. That training was undertaken with low engine power intended to simulate a feathered propeller. After being notified by the pilot that the simulated drag was higher than experienced during the accident flight, PropJet adjusted the engine power used during training to be more representative of the aircraft’s actual glide performance.

Stall speeds and warning

The published stall speed at the maximum take-off weight varied depending on the flap setting, angle of bank, and centre of gravity (with bank angle and flap deflection having the greatest effect). The lowest stall speed was 59 kt (0° bank, 30° flap), and for a 16° degree bank angle and 10° of flap, the stall speed was about 72 kt.

The aircraft had a vane-type stall warning system in the leading edge of the left wing. The vane sensed changes in airflow over the wing and produced a continuous tone and aural message through the cockpit speaker between 5 –10 kt above the stall in all configurations.

The pilot reported that the aural stall warning sounded through the headset and recalled that it activated after the aircraft turned onto the base leg for runway 18. The pilot further advised that the activation was expected since they were deliberately trying to slow the aircraft down to just above a stall. The pilot stated that the aircraft had a ‘…very distinctive stall buffet’ and a ‘…very docile stall’.

The pilot initially advised targeting an indicated airspeed of 44 kt during the forced landing after realising the aircraft would not make the runway, as they recalled the aircraft stalled at this speed with full flaps during slow speed training in the P210N. As detailed in the aircraft’s flight manual, it was not possible to attain an airspeed of 44 kt during the glide approach without stalling the aircraft.

The pilot subsequently advised that they were targeting 44 kt ground speed in the latter stages of the approach to reduce the collision energy. As aircraft control is dependent on airspeed, targeting a groundspeed increases the risk of losing control. Additionally, given the wind conditions on the day, it was not possible to attain a groundspeed of 44 kt without stalling the aircraft.

Forced landing

The CASA Flight Instructor Manual (Aeroplane) provided guidance on the initial stages of managing a forced landing following an engine failure:

Having selected the field and landing direction a plan must be formulated. This depends principally on the height available and distance to the field. If the aeroplane is say, 5,000FT above the field it will probably be advantageous to fly around the field.

Remaining above the landing area improves a pilot’s ability to continually assess their altitude, positioning, wind, and manage any misjudgements or changes in these factors. Once the aircraft arrived above the landing area, the CASA manual further stated:

…the aeroplane must be flown to a position some 1,000FT above ground level which is, in effect, on the base leg relative to the chosen field and from which a comfortable glide into the field can be made.

The CASA Visual Flight Rules Guide also provided a visual representation of the forced landing procedure (Figure 14). This procedure recommended a flight path including key positions (high key / low key) to assist pilots in judging the glide approach and evaluating the situation. Pilots should use any combination of gliding manoeuvres to arrive at the key positions, at which point a power-off approach^[34] can be conducted by following the regular landing circuit.

Figure 14: Forced landing procedure

Source: Civil Aviation Safety Authority

Pilots should glide to the downwind (low) key position, located abeam the intended landing spot, before making any configuration changes. The United States’ FAA Airplane Flying Handbook, Chapter 8 – Approaches and Landings provided the following specific guidance.

At or just beyond the [low] key position, the landing gear is extended if the airplane is equipped with retractable gear... After reaching that point, the turn is continued to arrive at a base-leg key position… Flaps may be used at this position, as necessary, but full flaps are not used until established on the final approach. The angle of bank is varied as needed throughout the pattern to correct for wind conditions and to align the airplane with the final approach. The turn-to-final should be completed at a minimum altitude of 300 feet above the terrain [AGL].

Pilots should maintain the aircraft in the optimal glide configuration until arriving at a position within the landing circuit where there is more assurance of a successful landing (for example, the low key position). If pilots want to alter the glide approach before this point, adjustments can be made via manoeuvring (for example, slips or altering turn radius).

Although not explicitly stated, the CASA and FAA guidance implied a left circuit approach as fixed‑wing aircraft are usually piloted from the left seat. Hence, a left circuit approach improves the pilot’s visibility of the intended runway or landing area and enables a constant assessment of the aircraft’s position and glide performance.

The FAA handbook further included the following guidance with regard to aircraft speed when an off‑airport landing on terrain becomes necessary.

The overall severity of a deceleration process is governed by speed (groundspeed) and stopping distance. The most critical of these is speed; doubling the groundspeed means quadrupling the total destructive energy and vice versa. Even a small change in groundspeed at touchdown—be it as a result of wind or pilot technique—affects the outcome of a controlled crash. It is important that the actual touchdown during an emergency landing be made at the lowest possible controllable airspeed, using all available aerodynamic devices.

Similar occurrences

In-flight engine and airframe icing have been factors in many aviation incidents and accidents, especially in general aviation. Significant guidance material has been published on the hazardous effects of ice on aircraft (see the references list within the section titled Sources and submissions). An FAA SAFO was issued in November 2006 to increase pilot awareness of the dangers of flight in icing conditions and advised the following:

Pilots should use all available meteorological information where forecasts indicate that structural icing may occur and should plan flight to avoid these areas if possible. If flight weather conditions are such that icing may occur, pilots should know how to recognize the early signs of ice accumulation on their airplane, e.g., ice on the windshield wipers, propeller spinners, and ice behind the boots. Other cues such as airspeed degradation, higher power settings, and unanticipated trim changes may also indicate icing accumulation. Finally, if icing conditions are encountered, pilots should follow the guidance in their flight and operating manuals for operating in icing conditions and exit the icing conditions as soon as practicable.

The ATSB identified the following two previous occurrences involving P210N aircraft that experienced engine flameouts due to operation in icing conditions.

NTSB investigation 1996 (N450T)

On 6 May 1996, the pilot of a P210N aircraft, registered N450T, was conducting a private flight at 7,000 ft in the United States. About 30 minutes after take-off, the aircraft’s M250-B17F/2 engine experienced a total loss of power. The aircraft descended for a forced landing and collided with trees resulting in fatal injuries to the pilot and passenger.

Examination of the wreckage identified no pre-impact failure of the engine, airframe, fuel system, or propeller. The NTSB investigation found that N450T was not certified for flight into known icing conditions, and that some of the anti-ice and de-icing equipment specified in the aircraft’s flight manual was not used. The pilot had received weather information before the flight indicating forecast icing conditions above 5,000 ft in the destination area.

The investigation determined the probable causes of the accident to be:

…improper planning/decision by the pilot, which led to flight into icing conditions; and his failure to use all anti-ice and de-icing equipment, as specified by the airplane operator's manual for inadvertent flight into icing conditions. This resulted in loss of engine power due to ice, a forced landing, and subsequent collision with trees during the forced landing.

ATSB investigation 1999 (N62J)

On 27 October 1999, the pilot of a P210N aircraft, registered N62J, was conducting a private flight in Australia, cruising at FL 160. While en route, the pilot reported an engine failure to air traffic control before colliding with steep mountainous terrain resulting in fatal injuries to the pilot.

Examination of the wreckage identified that there was an in-flight breakup before impact from the airframe being stressed beyond its design limits. An inspection determined that the M250-B17F/2 engine was producing significant power at impact. No evidence was found to suggest that anti‑icing additive had been added to the fuel. Conditions in the area at the time of the reported engine failure were conducive to engine intake icing.

The ATSB investigation concluded that the engine power likely reduced significantly because the aircraft was operating in conditions for which it was not designed or certified. As the aircraft descended into warmer air below the freezing level, the engine probably regained normal operation.

__________

14. A complex aircraft is an aircraft that has a retractable landing gear, flaps, and a controllable pitch propeller, including those equipped with an engine control system consisting of a digital computer and associated accessories for controlling the engine and propeller. A high-performance aircraft is an aircraft fitted with an engine capable of producing more than 200 horsepower.
15. A maintenance and training organisation based in the US.
16. STC SA1003NE currently held by Griggs Aircraft Refinishing. Previously held by O&N Aircraft Modifications until 2016.
17. The Rolls-Royce Model 250 (M250) series of engines were originally developed by the Allison Engine Company in the 1960s and known as the ‘250 series’. The Allison Engine Company became a subsidiary of Rolls Royce North America in 1995.
18. Seven other aircraft utilised the same batch of fuel on the same day, with no difficulties reported to the ATSB.
19. ADS-B: Automatic Dependent Surveillance–Broadcast is a means by which aircraft, aerodrome vehicles and other objects can automatically transmit or receive data such as identification, position and additional data, as appropriate, in a broadcast mode via a data link.
20. ForeFlight is an electronic flight bag. An electronic flight bag is a portable information system for pilot’s which allows storing, updating, delivering, displaying and/or computing digital data to support flight operations or duties.
21. In March 2018, the aircraft’s electrically heated engine inlet was replaced with an engine inlet heated using compressor bleed air.
22. The pilot advised that they usually took photographs during the cruise phase of flights to capture engine instrument readings as a method of engine trend monitoring.
23. For unknown reasons, the compressor blade deformation was not identified during the engine examination at Asia Pacific Aerospace. A post-examination review by Rolls-Royce of examination photographs identified the damage.
24. A rich flameout generally results from very fast engine acceleration, where an overly rich mixture causes the fuel temperature to drop below the combustion temperature. It also may be caused by insufficient airflow to support combustion, which may occur because of a blocked engine inlet, inlet filter or changes to the air composition entering the engine (for example, intense ground fires, power station exhausts, gas flares on oil rigs, or industrial chimneys). A lean flameout occurs if the fuel quantity is reduced proportionally below the air quantity.
25. The certification conditions are based on atmospheric icing data and intended to address 99 per cent of supercooled droplet icing conditions. The term ‘icing conditions’ typically refers to weather conditions where supercooled liquid droplets form ice on cold surfaces. However, the icing environment can present icing environments outside those certification conditions such as supercooled large droplets (SLD), and ice crystals. SLD can have drop diameters up to 100 times larger than regular supercooled droplets and strike behind protected regions. Ice crystal clouds occur near deep convective thunderstorms where liquid water particles freeze and flow out of the cloud top. Ice crystals can accumulate on hot engine components (for example, within a compressor) as ice/water on the surfaces are able to cool down the surface down to the point where ice can accrete.
26. Compliance with engine certification requirements are at the engine level, and do not account for the integration of that engine with an aircraft and propeller combination. Such integration is usually a consideration as part of aircraft level certification. It is likely that N210BA was prohibited from flight into icing conditions as the aircraft was not equipped with any certified airframe ice-protection equipment.
27. Significant weather is depicted by symbols on the chart and includes the prognosis for moderate or severe turbulence (including clear air turbulence), moderate or severe icing, surface fronts, cumulonimbus cloud associated with thunderstorms, and other weather phenomena.
28. A significant meteorological information (SIGMET) is a weather advisory that provides the location, extent, expected movement and change in intensity of potentially hazardous (significant) or extreme meteorological conditions that are dangerous to most aircraft, such as severe icing, thunderstorms or severe turbulence. SIGMETs cover all altitudes.
29. An AIRMET provides advice on deteriorating conditions, such as moderate icing, between the surface and 10,000 ft above mean sea level, not already included in the relevant Graphical Area Forecast. AIRMETs are complimentary to the routine issue and correction of Graphical Area Forecasts. Compared to SIGMETs, AIRMETs cover less severe weather phenomena.
30. FAA (Federal Aviation Administration) (2009) Legal Interpretation, Bell, January 2009, United States. Available from the FAA Regulations Division.
31. The Windy software program provides forecast and observed weather information such as rain, wind, temperature, and clouds.
32. C-GUMPS is an acronym used mostly by pilots of retractable gear aircraft with piston engines as a mental checklist to ensure nothing critical has been forgotten before landing. C – carburettor heat, G – gas (fuel), U – undercarriage, M – mixture, P – propeller(s), S – switches and seatbelts.
33. Feathering: the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in flight engine failure or shutdown.
34. Power-off approaches are made by gliding an airplane with the engine(s) idling to a selected point on the runway. The objective is to develop the skills required to execute a gliding approach from traffic pattern altitude and land safely on a specified touchdown point. Although a power-off approach is not an emergency procedure, the glide pattern and key point concepts can be used during an emergency landing without power.

Safety analysis

Just after midday on 19 December 2019, while en route from Bankstown, New South Wales, to Cambridge, Tasmania, a Cessna P210N Silver Eagle (P210N), registered N210BA, experienced a total power loss at Flight Level (FL) 160, about 22 km south‑south‑east of Moruya Airport, New South Wales. Following a glide approach to the airport, the aircraft impacted terrain 560 m north of the runway 18 threshold, injuring the two occupants.

In the context that there were no aircraft defects or anomalies that contributed to the accident, the following analysis will discuss the reason for the power loss and other significant operational factors.

Pre-flight planning

An effective pre-flight risk assessment requires, among other things, an adequate knowledge of:

• weather reports and forecasts
• the capabilities and limitations of the aircraft and its systems.

The aircraft’s flight manual prohibited flight into ‘known’ icing conditions as the aircraft was not appropriately equipped to operate safely in such conditions. Specifically, while the engine had systems to counter ice-formation and its effects, the airframe did not.

The Bureau of Meteorology (BoM) forecast valid for the proposed flight predicted moderate icing at the intended flight altitude. In practice, that meant ‘…the rate of accumulation is such that even short encounters become potentially hazardous and use of de-icing/anti-icing equipment or diversion is necessary.’ Additionally, such a forecast met the definition of ‘known’ icing conditions used by both the United States Federal Aviation Authority (FAA) and the National Transportation Safety Board.

While the pilot did not use the BoM forecast during their pre‑flight preparation, the electronic flight bag software (ForeFlight) used by the pilot generated a pre-flight weather report that also forecast light to moderate icing conditions along the planned flight path. As such, information was available to identify that known icing conditions would probably be encountered.

However, the pilot believed the ForeFlight icing forecast, while providing an indication of possible icing, did not prevent the planned flight from proceeding. Additionally, the pilot incorrectly believed that icing forecasts were relevant only when an associated AIRMET or SIGMET had been issued. While the BoM‑produced SIGWX chart (a routine forecast) indicated moderate icing above 10,000 ft, the pilot did not view the chart, nor was it displayed in the ForeFlight report (see the section titled Electronic flight bag).

The aircraft’s flight manual required use of fuel system anti-icing additive for flight in ambient air temperatures less than 40 °F (4 °C). The pilot incorrectly believed this limit applied to the ambient air temperature on the ground. This interpretation was the result of the pilot’s assessment that, as flights were usually conducted at high altitude, and therefore below 4 °C, the reference in the manual was to temperature on the ground because, otherwise, additive would be routinely required. This belief was probably reinforced by the experience of not encountering any problems during flights at low temperatures without additive use, and the similar experiences of other pilots. The pilot also stated that fuel system icing was only a problem if air temperatures below -35 °C were expected, indicating a limited understanding of icing in aviation turbine fuels.

Consequently, although air temperatures in flight were forecast to be significantly below 4 °C (-9 to -11 °C), the pilot never considered the use of anti-icing additive. While the evidence, including the examination of the fuel system, indicated that it was unlikely the absence of additive contributed to the engine power loss, its omission increased the risk of ice formation in the fuel system and potential engine fuel starvation.

In summary, the pilot did not have adequate knowledge of the aircraft’s systems limitations or weather reports and forecasts with respect to icing. Consequently, the flight was planned and conducted through forecast icing conditions for which the aircraft was not certified or equipped.

Operation in icing conditions

The aircraft’s flight manual emergency checklist for an inadvertent icing encounter stated that icing conditions must be exited as soon as possible, and engine ice protection systems left operating while ice was visible on the airframe. Therefore, when the forecast icing conditions were encountered at FL 180, an immediate descent was the safest option.

The pilot’s in‑flight photographs showed substantial airframe ice build‑up. However, the pilot was not aware of the checklist requirement and reported that they were not concerned about operating in icing conditions for an extended period. That perspective was due to an inadequate understanding of the risks involved, reinforced by the pilot’s own experience and that of others. The pilot’s decision to descend was made after the passenger expressed concern about visible ice accumulation on the aircraft.

In addition to the photographed airframe ice, continued flight in icing conditions probably resulted in ice accumulation on other unprotected areas on the airframe, propeller, and engine. The descent to avoid further ice build-up coincided with the pilot deactivating available ice-protection systems, contrary to the flight manual. That action increased the risk of further ice formation, any accumulated ice remaining, and the risk of an icing‑related engine flameout.

Engine flameout

Based on the pilot’s description of the engine power loss being similar to a normal engine shut down, and the absence of any identified mechanical issue with the engine or its systems, the ATSB concluded that the engine probably experienced a flameout. Several potential causes of engine flameout were considered. The evidence indicated that:

• fuel exhaustion/starvation
• compressor stall
• a rich or lean fuel mixture
• turbulence
• water ingestion

were all unlikely to have occurred. However, given the presence of airframe ice at the time of the power loss, an icing‑related flameout was considered further.

The Rolls-Royce M250 series engines are certified to operate in icing conditions when all the associated protection systems are functioning. Based on the pilot’s account that the engine anti‑ice systems were operating up until the commencement of the descent from FL 180, it was therefore considered unlikely that any significant engine ice accumulated prior to that descent. Once the protections of continuous ignition and compressor inlet heat were removed, ice could form at the compressor inlet.

Based on the described constant turbine outlet temperature leading up to the engine failure, it was probable that if any such ice build‑up occurred, it would have been insufficient to have produced a flameout from blocking the flow of air into the compressor. Additionally, the pilot reported that the compressor inlet heat was only switched off as it was assessed that the aircraft had exited icing conditions.

Despite the pilot’s assessment, given the extent of the forecast icing and recorded aircraft manoeuvring on reaching FL 160, icing conditions may have persisted after the commencement of the descent. In that case, and as indicated in Rolls‑Royce certification testing, that would have permitted ice accumulation at the compressor inlet during at least part of the aircraft’s descent to  FL 160, and subsequent level flight up until the engine power loss.

Testing conducted by Rolls‑Royce also identified that only a relatively small quantity of ingested ice is required to produce an engine flameout. In addition, deactivation of continuous ignition increased the engine’s susceptibility to such a flameout.

During certification testing, compressor inlet heat was required to dislodge the built‑up ice. Noting the compressor inlet heat was not reinstated on this occasion, the engine inlet heat was on continuously before the engine failure. Given the vicinity of that heat source to the compressor inlet, a potential mechanism existed to dislodge ice capable of entering the engine. Additionally, aerodynamic effects and/or vibration were equally feasible mechanisms to dislodge accumulated ice.

In summary, given the:

• known icing conditions, operation of the engine without full anti‑ice protection at the time of the power loss, and susceptibility of the engine to flameout from small amounts of ingested ice
• described nature of the engine power loss
• absence of other likely causes

the ATSB concluded that the engine flameout was probably due to ice ingestion.

Rotor lock

Rotor lock is a temporary condition where differential changes in thermal contraction of gas producer turbine components after an engine flameout results in contact between rotating and fixed components sufficient to prevent engine rotation. Due to relatively small internal clearances between components, the M250 series engines are known to experience rotor lock.

Given the:

• prior functionality of the engine starter
• examined condition of the starter components after the accident
• absence of any other reported electrical issues/related warnings during the flight
• reported amperage increase when the starter was being engaged

the starter and related circuit was most probably serviceable at the time of the engine failure.

Based on the pilot’s account, it’s likely that the engine restart procedure was performed correctly with the first attempt completed before the 60 seconds indicated in the flight manual for rotor lock. However, due to its variable nature, rotor lock can occur in less than 1 minute. At the time of the power loss, the engine had probably been operating close to the maximum continuous temperature limit of the gas producer turbine for approximately 1 hour. At the same time, the aircraft was operating at relatively low ambient air temperature and high speed. In combination, that produced a significant thermal gradient and high potential for differential component cooling. Consequently, though the engine examination was not conclusive about rotor lock and the starter circuit breaker did not reportedly activate, the ATSB concluded that it probably occurred and prevented the engine restarts.

While the variable nature of rotor lock provides no certainty of a successful restart, the gas producer turbine may have been free to rotate when the aircraft reached Moruya River at 1,500 ft, about 10 minutes after the engine flameout. However, it is not reasonable to expect that the pilot would have attempted another engine restart so late in the approach as their focus was on conducting the forced landing.

Forced landing

Initial glide approach

Due to concern that electrical power would not be available late in the glide approach, the pilot elected to extend the landing gear, and at least 10° of flap, at an altitude of about 6,000 ft. In the event of electrical power loss, it was still possible to manually lower the landing gear. However, that method was significantly slower than normal extension and would have added to the pilot’s workload during the glide approach. While the early reconfiguration for landing significantly reduced the available glide performance and was contrary to advice provided in the FAA’s Airplane Flying Handbook, the aircraft arrived above the intended runway threshold at an altitude of 4,500 ft – sufficient height for a successful landing.

From that position, the pilot elected to fly south-east, away from the airport, which at the furthest point was about 3 NM from the runway threshold (at an altitude of 2,800 ft). Although the pilot was using navigation equipment to assist orientating the aircraft for the glide approach, tracking away from the airport in that manner reduced visibility of the intended runway, and the ability to continually assess the situation. By contrast, had the pilot elected to lose the required height in the vicinity of the runway threshold by remaining over the runway, visual assessment of the glide profile in the hazy conditions would have been significantly easier.

Following the manoeuvring to the south‑east, the aircraft was then tracked back towards the airport, arriving south of the Moruya River at 1,400 ft about 1.8 NM from the intended downwind (low key) position. At that point the aircraft was now too low to conduct a glide approach to runway 18. That was recognised by the pilot and the decision made to approach an alternative runway.

Manoeuvring in the vicinity of the airport

The pilot’s account of the accident strongly supports that, after deciding to abandon the approach to runway 18 and track east along Moruya River for an alternative runway, the pilot’s attention became primarily focused on visually sighting the R44 helicopter. This preoccupation distracted the pilot from managing the remaining approach and forced landing.

Attention is a focusing response to a stimulus or task that reflects a state of arousal or concentration.^[35] Studies indicate that attention paid to a particular stimulus or task generally occurs in the context of competition among multiple stimuli or tasks for limited processing capacity.^[36] Multiple stimuli or tasks that make simultaneous demands on an individual’s central processing mechanism will tend to interfere with each other. Should one or more of these competing stimuli or tasks be sufficient to interfere with, or divert attention, from the original focus of attention, then the individual becomes distracted.^[37] It is within the context of attention that the process of distraction occurs.

Distractions ultimately influence and change our decisions. Decision making is regarded as the cognitive process resulting in the selection of a belief or a course of action among several possible alternative options. It is a reasoning process based on assumptions of values, preferences, and beliefs of the decision-maker.^[38]

The focus on the helicopter’s position probably occurred because of the pilot’s prioritisation of risks. The pilot appeared more concerned about the risk of colliding with the helicopter than the risk of missing the runway and colliding with terrain.

By focussing on the helicopter, the pilot became distracted from managing the aircraft’s speed, position, and altitude, causing them to misjudge an approach to the remaining viable runways (runway 36 and 22). This misjudgement resulted in the aircraft arriving at a position where an off‑airport landing was the only option, leading to the collision with terrain. While the prioritisation of ‘aviate, navigate, communicate’ is well known to pilots, on this occasion additional radio communication during the glide approach to ascertain the position of the R44 may have reduced distraction for the accident pilot during a period of high workload.

Distraction has contributed to many aviation safety accidents and incidents. Data from the ATSB showed that between 1997 and 2004 there were over 500 occurrences attributed to distraction, with the majority involving pilot distraction.

After realising an off-airport landing was imminent, the pilot reported targeting a speed of 44 kt based on a belief that it was the aircraft’s stall speed. However, the aircraft’s lowest published stall speed was 59 kt. Therefore, the pilot was probably targeting an airspeed well below the stall speed for the aircraft’s configuration at the time, increasing the risk of loss of control close to the ground. From the available evidence (recorded data, tree and ground impact marks, and the pilot’s recall) it was not possible to determine if the aircraft was in a stalled condition before impact. More generally however, maintaining control of the aircraft all the way to ground contact increases the likelihood of survival during a forced landing.

Survivability

A substantial amount of research has shown that seat belts in small aircraft that include an upper torso restraint (UTR), such as a shoulder harness, significantly reduce the risk of injury compared to lap belts only. A UTR can minimise the flailing of the upper body and reduce the risk of impacts involving the head and upper body.

The pilot’s and the passenger’s seatbelt and shoulder harness were secured upon impact and probably reduced the extent of their injuries. In addition, the close proximity of first responder paramedics resulted in the rapid provision of first aid, which further reduced risk to them.

The aircraft’s emergency checklist for forced landings included unlatching the main door to avoid its opening mechanism jamming during impact, preventing egress or access. However, the pilot kept the door locked to retain cabin strength. While it was not possible to determine if this objective was achieved (due to the variables involved), the locked door delayed the first responders accessing the cockpit. While this did not affect the outcome severity on this occasion, under different circumstances such as a post‑impact fire or ditching, it could have proved fatal.

Electronic flight bag

The pilot used the ForeFlight electronic flight bag (EFB) software, which was not a Civil Aviation Safety Authority‑approved operational data source. As detailed earlier, the use of this EFB software resulted in the pilot missing important weather products as they were regionally unsupported.

The ATSB determined that the aircraft’s maximum take-off weight was exceeded by about 50 kg. Based on the estimated fuel burn, the aircraft was above the maximum landing weight by a similar amount when it impacted terrain. Although not a contributing factor to this accident, operating above the specified weight limits can significantly affect aircraft performance and structural integrity.

The ForeFlight software reflected the flight manual weight limitations, however, the pilot reported that it did not generate any weight‑related warnings during pre‑flight preparation. It was also identified that the ForeFlight weight and balance function was not compatible with the P210N, and the centre of gravity envelope used by the pilot was different to that in the aircraft’s flight manual. These differences can result in the aircraft being beyond the allowable weight and centre of gravity limits, but not generate an alert. Therefore, if relying on an EFB, it must be compatible with the aircraft manufacturer’s source data.

Finally, a review of the electronic emergency checklists on the pilot’s ForeFlight EFB identified several important differences to the aircraft’s flight manual checklists. For example, a key omission from the Engine failure during flight electronic checklist was the requirement to isolate the engine from the fuel, an important step in the event of a catastrophic engine failure or fire. In addition, the checklist omitted a warning about rotor lock, which specified the importance of time in engine restart success. Additionally, the Emergency landing with no engine power electronic checklist was missing the requirement to secure the seat belts and shoulder harnesses and another item intended to prevent a potential source of fire, both important checks for a forced landing.

Nozzle shield cracking

The aircraft’s M250-B17F/2 engine was the subject of a Rolls-Royce engine service bulletin for crack inspections of the first stage nozzle shield. The engine's total cycles at the time of the accident indicated that if the bulletin had been complied with, the engine should already have been inspected. However, as significant cracking of the nozzle shield was identified during the ATSB engine examination, it was likely that the engine had not been inspected as required by the bulletin. Further, a review of the engine maintenance history did not show any record of compliance with the bulletin.

While there was no associated Airworthiness Directive mandating compliance, cracking of the nozzle shield increased the risk of coking of the gas producer turbine bearing and the potential for an oil fire.

__________

35. Berlyne, 1993
36. Broadbent, 1953; Kahneman, 1973
37. Nelson, Duncan, & Kiecker, 1993.
38. Herbert, 1977.

Findings

From the evidence available, the following findings are made with respect to the engine failure and collision with terrain involving a Cessna P210N, registered N210BA, which occurred near Moruya Airport, New South Wales, on 19 December 2019.

Contributing factors

• The accident flight was planned and conducted through forecast icing conditions for which the aircraft was not certified or equipped.
• Flight in icing conditions for an extended period resulted in significant accumulation of ice on the airframe. The subsequent descent to avoid further icing coincided with the pilot deactivating available engine ice-protection systems, which in turn led to a flameout from ice ingestion.
• The engine restarts were unsuccessful, most probably because of a temporary thermal rotor lock condition where rapid and differential cooling of the engine’s gas producer turbine prevented it from rotating.
• Although sufficient height was available to conduct a forced landing at Moruya Airport, the pilot’s initial manoeuvring resulted in the aircraft being too low to conduct a glide approach to the most appropriate runway.
• Due to distraction in the latter stage of the approach, the pilot misjudged the approach to the remaining runway options that preceded the subsequent collision with terrain.

Other factors that increased risk

• The electronic emergency checklists used by the pilot were contrary to the aircraft’s flight manual, omitting safety critical checks.
• The aircraft was about 50 kg above the maximum take-off weight on departure from Bankstown Airport and about the same amount above the maximum landing weight at the time of the collision.
• The aircraft was operated in temperatures conducive to fuel system icing without the protection of fuel anti-icing additive.
• The premature configuration of the aircraft, due to concern over electrical power depletion, significantly decreased the aircraft’s glide performance before the landing was assured.
• The pilot targeted an airspeed below the manufacturer-specified stall speed during the forced landing, increasing the risk of control loss.
• The engine’s first stage gas producer turbine nozzle shield showed significant cracking, which increased the risk of an oil fire. There was no evidence that the manufacturer’s service bulletin for initial and ongoing inspections for cracking had been completed.

Other findings

• The seatbelts and shoulder harnesses worn by the pilot and passenger probably reduced the extent of their injuries, and the prompt attendance of paramedics further reduced their risk.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Bureau of Meteorology
• Civil Aviation Safety Authority
• United States National Transportation Safety Board
• pilot and passenger of accident flight
• PropJet 210 Aviation
• R44 helicopter pilot
• recorded data (GPS, ADS-B, photographs)
• Rolls-Royce
• P210N STC holder (Griggs Aircraft Refinishing)
• skydive instructor

References

AOPA (Aircraft Owners and Pilots Association) (2008), Safety Advisor: Aircraft Icing, United States

AOPA (Aircraft Owners and Pilots Association) (2021) Icing and Cold Weather Ops [online document], accessed 10 May 2021.

ATSB aviation research investigation report AR-2008-044(1), A pilot’s guide to staying safe in the vicinity of non-towered aerodromes, Australia.

ATSB aviation occurrence investigation 199905037, Cessna Aircraft Company P210N, N62J, 14 km W Hernani, NSW, 27 October 1999, Australia.

ATSB aviation research investigation report B2004/0324, Dangerous Distraction: An examination of accidents and incidents involving pilot distraction in Australia between 1997 and 2004, Australia.

Berlyne, D. E. (1993). Conflict, arousal and curiosity. New York: McGraw-Hill.

BoM (Bureau of Meteorology) (2021) Knowledge Centre [online document], accessed 10 May 2021.

Broadbent, D. E. (1953). Perception and communication. New York: Pergamon Press.

CASA (Civil Aviation Safety Authority) (2006), Flight Instructor Manual (Aeroplane), Issue 2, Australia

CASA (Civil Aviation Safety Authority) (2021) Icing [online document], accessed 10 May 2021.

CASA (Civil Aviation Safety Authority) (2021), Visual Flight Rules Guide, version 6.3, Australia

EGAST (European General Aviation Safety Team) (2015), In Flight Icing, GA 10, Germany

FAA (Federal Aviation Administration) (2015), Pilot Guide: Flight in Icing Conditions, AC 91-74B, United States.

FAA (Federal Aviation Administration) (2016), Airplane Flying Handbook, FAA-H-8083-3B, United States.

Herbert Alexander Simon (1977). The New Science of Management Decision. Prentice-Hall.

Kahneman, D. (1973). Attention and Effort. New Jersey: Prentice-Hall.

NASA (National Aeronautics and Space Administration) (2019) Aircraft Icing Training [online document], accessed 10 May 2021.

Nelson, J. E., Duncan, C. P., & Kiecker, P. L. (1993). ‘Toward an understanding of the distraction construct in marketing’. Journal of business research, 26, 201-221.

NTSB (National Transportation Safety Board) 1997, aviation accident final report NYC96FA101

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilot
• Civil Aviation Safety Authority
• PropJet 210 Aviation
• Griggs Aircraft Refinishing
• ForeFlight
• Rolls-Royce
• National Transportation Safety Board.

Submissions were received from:

• the pilot
• Civil Aviation Safety Authority
• Griggs Aircraft Refinishing
• National Transportation Safety Board.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 15 December 2019, an Airbus A330-202 aircraft, registered VH-EBC and operated by Qantas Airways, departed Sydney, New South Wales on a scheduled passenger service. About 7 minutes after departure, the flight crew were alerted to a problem with one of the aircraft’s 3 hydraulic systems. The flight crew followed the required checklists and decided to return to Sydney. Following an uneventful landing, the flight crew stopped the aircraft on a taxiway. Shortly after, the auxiliary power unit (APU) was started and the bleed air selected on to maintain air conditioning in the aircraft cabin, and the aircraft was towed to the terminal.

After the aircraft arrived at the terminal, a haze/smoke began to form in the cabin and flight deck, followed by passengers and crew experiencing physical symptoms. After consultation with the customer service manager and the first officer, the captain commanded an evacuation.

The first of 2 aerobridges had already been connected to the aircraft when the evacuation command was given. At this time, some passengers were already standing and had retrieved their cabin baggage. Slides were successfully deployed on 3 exits, and the second aerobridge was then connected to another exit. Two of the other 3 exits were not used and the slide was not successfully deployed at the other exit. Of the passengers who used the escape slides, one received serious injuries and 5 received minor injuries.

What the ATSB found

The rudder servo flexible pressure hose from the aircraft’s green hydraulic system ruptured during the flight, which resulted in a hydraulic fluid leak towards the rear of the aircraft. The rupture was due to a combination of corrosion and fatigue cracking of the stainless streel braid in the hose.

Following a significant period of time after landing, the hydraulic fluid was ingested into the APU air intake, which led to atomised hydraulic fluid contaminating the aircraft cabin and flight deck through the air conditioning system. Although cabin crew members had smelt an odour, they thought was related to the hydraulic system failure or similar fumes prior to arriving at the terminal, they did not convey this information to the flight crew.

The evacuation occurred at a unique time when cabin crew members had completed their shut-down duties, and the aircraft was at the terminal with all the doors disarmed. Although cabin crew had covered a similar scenario during their initial training, in subsequent evacuation training the doors would always be armed. This may have been contributory to 2 of the cabin crew not rearming their door prior to opening it during the evacuation. In contrast, 2 of the other cabin crew members had verbalised what they would do if they were required to evacuate and were successful in executing their procedures without hesitation.

Some passengers (who used the aerobridges or the slides) retrieved their cabin baggage after the evacuation command was given. In addition, some passengers who evacuated using the slides carried their cabin baggage down the slides. As a result, the evacuation was delayed and the risk of injury to themselves and others was increased. The ATSB also found that information provided to passengers via the safety briefing and during the evacuation about what to do with cabin baggage in an evacuation and the use of escape slides was limited and inconsistent.

In addition, the primary evacuation commands practiced by cabin crew to instruct passengers in an evacuation did not include phrases such as 'leave everything behind' and 'jump and slide'. Consequently, passengers would generally not receive specific guidance until they reached an exit, which could potentially slow an evacuation. The operator also did not have a procedure for a rapid disembarkation, which would allow for rapid deplaning at a slower and more controlled pace than an emergency evacuation.

What has been done as a result

Qantas introduced a procedure for A330 flight crew to refrain from turning the APU bleed on until an engineering inspection had occurred following a hydraulic system leak. The operator also introduced a periodic replacement program for the pressure supply line to the hydraulic servo for all 3 hydraulic systems.

In addition, Qantas introduced periodic training that required cabin crew members to physically demonstrate the procedures for an evacuation at the terminal. It also amended its passenger safety briefing video showing passengers how to descend the escape slide. The operator advised it was also looking to incorporate ‘leave everything behind’ into its primary evacuation commands, and developing a procedural framework for the rapid disembarkation of passengers in circumstances where an evacuation and the use of escape slides may not be necessary.

Safety message

The management of passengers in an emergency situation is the last line of defence in avoiding injury and fatalities, therefore it is important that passengers are well informed through the provision of sufficient and accurate communication about what they may be required to do.

The timing of this occurrence highlights the necessity for crew members to remain prepared to react to an emergency at any time, until everyone has disembarked the aircraft. Using a method such as the silent review prompts cabin crew members to mentally rehearse emergency procedures, which ensures they are ready to act in case of an emergency.    

Communication between the cabin crew and flight crew is essential in abnormal situations, and it is important for information to be relayed as soon as it becomes available. Cabin crew should be trained to recognise and report to the flight crew any unusual smells, sounds and sights, including the use of common terminology to describe odours. 

The occurrence

Hydraulic system failure and return to Sydney

On the morning of 15 December 2019, an Airbus A330-202 aircraft, registered VH-EBC and operated by Qantas Airways, departed Sydney, New South Wales, on a scheduled passenger service to Perth, Western Australia. On board were 2 flight crew, 8 cabin crew and 222 passengers. The first officer (FO) was the pilot flying (PF) and the captain was the pilot monitoring (PM).^[1]

The pre-flight preparations, boarding taxi and take-off were uneventful and the aircraft departed Sydney at 0844 Eastern Daylight-saving Time.^[2]

At about 0851, a ‘green’ hydraulic system leak (HYD G SYS LEAK) message was displayed on the aircraft’s electronic centralised aircraft monitor (ECAM). The flight crew monitored the leak and noted that the hydraulic fluid level for the green system was fluctuating and decreasing. As per the required ECAM actions, they turned off the engine-driven pumps for the green hydraulic system. At 0854, the flight crew advised air traffic control (ATC) of a hydraulic problem and requested to level off at flight level (FL) 230.^[3]

At 0855, the pressure in the green hydraulic system started dropping and soon after the ECAM displayed a green hydraulic system^[4] low pressure warning (HYD G SYS LO PR). The flight crew completed the required actions and decided to return to Sydney.

The captain took the role of PF and the FO the role of PM. The FO advised ATC and the operator about the return to Sydney and a requirement for a tow after landing. The captain informed the customer service manager (CSM)^[5] and made a public announcement (PA) to the passengers, advising of the decision to return to Sydney.

The flight crew reviewed the ECAM status page and the inoperative systems. They also completed all checklist items, carried out an arrival briefing, and commenced descent. The weather for their arrival was reported to be clear visibility, with some scattered low cloud, wind from the north-west at about 8 kt, and a temperature of 24° C.

The flight crew later stated they had considered whether to issue a PAN^[6] call, but decided they were not experiencing a situation that required urgency. Although the aircraft had lost one hydraulic system, there were still 2 other hydraulic systems available and they were not expecting any problems with landing the aircraft or exiting the runway after landing.

During the approach, the flight crew conducted the landing gear gravity extension procedure that was required due to loss of hydraulic control of the aircraft landing gear, which resulted in the landing gear doors remaining open for landing.

In response to the flight crew’s advice about the hydraulic failure, ATC activated an alert phase^[7] and 2 aviation rescue fire fighting service (ARFFS) vehicles (known as a tenders) were dispatched to attend the aircraft.

At 0927 the aircraft landed on runway 34 left and the captain taxied the aircraft off the runway onto the high-speed taxiway exit B9, using differential braking to steer the aircraft as the nose-wheel steering was unavailable.^[8]

Events on the ground prior to the evacuation

The aircraft remained parked on a taxiway due to the nose-wheel steering being unavailable, and the flight crew confirmed to ATC that a tow to the terminal was required. While waiting for the tug to arrive to tow the aircraft, the flight crew started the auxiliary power unit (APU).

When the engineers and tug arrived at the aircraft, the flight crew shut down both engines (at 0936) and selected APU bleed air^[9]on to enable air conditioning and electrical power to be maintained in the cabin. Engineers completed an inspection of the exterior of the aircraft and, aside from the landing gear doors remaining open, observed nothing of note. At 0947, a tug started towing the aircraft back to the terminal.

The ARFFS requested that the captain contact the fire commander, who was now in attendance and following the aircraft back to the terminal. After speaking to the captain, the ARFFS fire commander stood down the other tender in attendance and accompanied the aircraft back to the terminal.

After the aircraft had stopped on the taxiway, the CSM recalled smelling a very strong mechanical oil smell that they thought, based on previous experience, was attributable to the hydraulic and nose-wheel steering problem. At that time, the CSM discussed the smell with the R1^[10] cabin crew member, who also recalled smelling something they described as being like ‘cooking oil’. Both cabin crew recalled thinking the smell was nothing of concern and did not contact the flight crew or other cabin crew at that time.

The FO reported that they told the captain that they could smell something strange during the tow to the terminal but had thought that the smell was smoke or diesel fumes from the tug. The FO again discussed the smell when the aircraft arrived at the terminal.

Just prior to the aircraft reaching the terminal, the cabin crew received the standard instruction from the flight crew to ‘disarm doors and crosscheck’. In response, the cabin crew disarmed all doors and completed a call back to the CSM. The L3 cabin crew member recalled that, just before the call back, when they were crossing over to complete their crosscheck procedure, they said to the R3 cabin crew member that they could smell something similar to ‘dirty socks’. During the call back, the L3 cabin crew also advised the CSM that they could now see a ‘haze’ forming in the cabin. Other cabin crew also recalled they could see a haze, mist or smoke in the cabin at about this time.

The aircraft arrived at the terminal at 0957:53 and was parked at gate 10, facing towards the south. At this time the wind direction was from the north at a speed of about 7 kt, which resulted in the wind blowing from the aft to the front of the aircraft.

The flight crew reported that, soon after stopping at the terminal, they noticed an acrid smell in the flight deck and they started to experience irritation to the eyes and throat, prompting them to open the flight deck windows. The captain recalled seeing a haze in the flight deck and the FO recalled seeing mist or smoke in the flight deck.

Soon after the call back in the cabin, the captain and the CSM had a conversation over the interphone about the haze and smell in the aircraft.^[11] During the call, the CSM asked other cabin crew nearby at the L2 and R2 doors about the severity of the haze, and then advised the captain that the conditions were getting worse and that they needed to ‘get out’. The captain recalled that the CSM had confirmed the need to evacuate, however the CSM did not recall specifically speaking about an evacuation. Following the discussion with the CSM, the captain confirmed the need to evacuate with the FO, to which the FO agreed.

Emergency evacuation at the terminal

Emergency evacuation command

The captain ordered an evacuation over the PA system and the FO declared a MAYDAY^[12] to ATC, stating they had ‘smoke in the cabin’. The MAYDAY broadcast started at 1000:08 but the exact time of the evacuation command could not be determined.

Prior to the emergency evacuation command, both aerobridges ^[13] for the L1 door and the L2 door were in the process of being connected to the aircraft. The aerobridge at L1 was connected and the door started to be opened at 1000:18 and was fully open at 1000:22. Closed-circuit television (CCTV) showed the CSM ending the call to the captain at this time. Passengers were reportedly already standing, and some had retrieved their cabin baggage.

Exit availability and use

Figure 1 shows the 8 exits on the A330 aircraft. Five exits were used during the evacuation; 2 exits connected to the aerobridges (L1 and L2), and 3 other exits which had escape slides deployed (R3, L4 and R4).

Figure 1: Cabin layout showing doors used during the evacuation

Source: Qantas, annotated by the ATSB

More specifically, the following occurred at each exit:

• The L1 door was open at 1000:22, with passengers beginning to evacuate about 5 seconds later through this exit and via the aerobridge.
• The doors at L4 and R4 were opened at 1000:38, with the slides deployed and ready for use soon after. Both L4 and R4 doors were armed by the cabin crew members before opening and the slides deployed successfully. The cabin crew at these exits recalled checking outside the aircraft both prior to and then following the evacuation command. They also verbalised to each other the need to rearm their doors prior to opening them.
• The door at R3 was initially opened at 1000:29. However, the door was opened in the disarmed mode and the cabin crew member then closed, rearmed, and reopened the door and the slide deployed successfully at 1000:54.
• The door at L3 was opened at 1000:35 but the slide was not deployed. The cabin crew member at L3 recalled that they checked outside conditions before opening the door. However, because the door was still disarmed, the slide was not deployed. They then declared their exit blocked and directed passengers to available exits.
• The second aerobridge was connected to the L2 door and was open at 1001:18. The cabin crew member at the L2 door reported that they did not check outside conditions as per their procedure; they assumed that an aerobridge would be available and waited for this to be connected. Until that occurred, they directed passengers to the L1 door. The aerobridge operator knocked at the door for about 10 seconds before the L2 turned around to acknowledge the operator and open the door.
• The cabin crew member at R2 reported that the haze/smoke they could see inside the cabin may have indicated that there was a fire outside. They recalled that, although they checked outside conditions, which were clear, they decided to block their exit and they directed passengers to the exits attached to the aerobridge at L1 and, when it opened, the aerobridge at L2.
• The cabin crew member at R1 recalled seeing vehicles outside when they checked outside conditions and declared their exit blocked. They recalled that they did not continue to check outside conditions but instead directed passengers to the aerobridge at L1.

Of the 222 passengers, 129 utilised the 2 aerobridges to exit and the other 93 left via the 3 available escape slides. The last passenger using the aerobridge at L1 exited at 1001:30 and the last passenger using the aerobridge at L2 exited at 1002:04. The last passenger using the slides exited R3 at 1002:39.

During the evacuation, the FO exited the flight deck with their torch and entered the cabin. At this stage, the CSM had briefly left the L1 door area. When the FO came into the cabin, a passenger was attempting to re-enter the aircraft to retrieve a bag and the FO directed them to leave the aircraft. The FO exited the aircraft via the nearest available exit (the aerobridge at L1) at 1001:43 and proceeded to the tarmac via a ladder attached to the aerobridge. Once on the tarmac, they provided ARFF personnel with information about passenger numbers and advised that there were no dangerous goods onboard.

Handling of cabin baggage

As the evacuation occurred at the terminal, some passengers had already retrieved, or started to retrieve, bags prior to the evacuation command. Video footage captured by passengers after the evacuation command showed passengers retrieving cabin baggage from overhead baggage compartments (Figure 2).

Figure 2: Still image of passenger video taken during the evacuation 

Passengers collecting cabin baggage from overhead lockers during the evacuation.

Source: Channel 7  

Cabin crew at doors with escape slides deployed reported that some passengers arrived at the doors carrying bags. The cabin crew stated that they advised those passengers to leave their bags and, when they did, the passengers were generally compliant, with a number of passengers leaving their bags in the galley area on the way to their exit. However, video footage showed several passengers taking bags down the escape slides (Figure 3). CCTV and video footage taken by passengers also showed that at least 40 of the 129 passengers who exited via the 2 aerobridges were carrying cabin baggage (such as a small suitcase or backpack).

Figure 3: Still image showing passengers evacuating with cabin baggage

Source: Sydney Airport Corporation Limited, annotated by the ATSB

Use of escape slides

Cabin crew reported that many passengers did not know how to use the escape slides when they reached the exits, with some passengers pausing to ask what to do and others descending the escape slides by kneeling or lying down.

Of the passengers who used the escape slides, one passenger was seriously injured, and 5 others received minor injuries. The serious injury involved tendon ruptures in both knees. The other passenger injuries ranged in type and severity, and included but were not limited to knee sprain/strains, friction burns to the hands, and cuts/abrasions to the elbow. All of the injuries occurred during the use of the slides. Other passengers reported anxiety and chest pain.

Of the 222 passengers, there were 12 passengers who were listed on the flight manifest as requiring special assistance, including infants, children and others. As far as could be determined, most of these passengers evacuated using an aerobridge, although one of the 4 infants was carried down a slide.

Emergency service response

The ARFFS fire commander reported that, when the aircraft stopped at the terminal, all ARFFS crew members left their vehicle. The commander could smell and taste oil (which they thought was a hydraulic fluid) in the air and noticed a golden coloured fluid on the aircraft ‘tail pipe’ (that is, near the APU). In response, the fire commander set up an exclusion zone around the rear of the aircraft.

The fire commander proceeded to the nose wheel of the aircraft and was speaking with an engineer when the airport’s crash alarm activated in response to the MAYDAY call. The fire commander reported that they initially thought that the crash alarm was a test, as it was usual for a test of the alarm to occur around the same time each Sunday. About 3–5 seconds after the alarm, the fire commander recalled hearing a loud bang and seeing the aircraft escape slides deploy.

At this time both ARFFS crew members and the 2 engineers that had approached the aircraft were at the nose wheel. Due to the activation of the crash alarm, all the other ARFFS tenders responded from their stations.

The ARFFS reported assisting passengers at the bottom of the escape slides, directing passengers 15–20 m away from the aircraft on both sides, and organising a triage area.

Post evacuation actions

After all passengers had evacuated the aircraft, the cabin crew and captain checked the cabin of the aircraft. During this period, a paramedic tending to the seriously injured passenger at the bottom of the R3 slide asked one of the cabin crew for an emergency first aid kit. The cabin crew member called for the R3 cabin crew member to obtain the kit and the R3 cabin crew member slid the kit down the slide.

Cabin crew members reported that, after checking the cabin, they considered using the escape slides to evacuate the aircraft. However, when they consulted the captain, the captain advised that they could exit via the aerobridge if they preferred. Therefore, the captain and all cabin crew evacuated the aircraft through the aerobridges. The captain proceeded to the tarmac to assist passengers before returning to the aircraft cabin.

CCTV footage showed that, following the full evacuation of passengers from the aircraft, multiple cabin crew members re-entered the aircraft via the L1 aerobridge to retrieve cabin baggage and other items. Other staff members, including engineering staff, also entered the aircraft cabin before it had been deemed safe by the ARFFS. The last cabin crew member (who had re-entered the cabin) left the aircraft at 1007:53.

Two ARFFS personnel entered the aircraft wearing breathing apparatus to assess the cabin air with the purpose of deeming the aircraft safe at 1012:13.

__________

1. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
3. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 230 equates to 23,000 ft.
4. The Airbus A330 has 3 independent hydraulic systems, each identified by a different colour (green, blue, yellow).
5. The customer service manager (CSM) is the most senior cabin crew member on board the aircraft and manages the aircraft cabin on behalf of the captain.
6. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
7. Alert phase (ALERFA): an emergency phase declared by the air traffic services when apprehension exists as to the safety of the aircraft and its occupants.
8. A330 nose-wheel steering is lost with a green hydraulic system leak. VH-EBC was not equipped with the alternate nose-wheel steering system that is supplied by the yellow hydraulic system. This was an optional system available from Airbus and not required to be fitted.
9. Bleed air: compressed air taken from the compressor section of the APU, which is utilised for the aircraft’s air conditioning system.
10. Cabin crew members are referred to as per their position on the aircraft, as described in Figure 1.
11. Due to conflicting accounts, it could not be confirmed who initiated this communication. The call was between the flight deck and CSM only.
12. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
13. An aerobridge is a covered portable walkway for the transfer of passengers between an airport terminal and an aeroplane.

Context

Personnel information

Flight crew

The captain and first officer (FO) both held an Air Transport Pilot (Aeroplane) Licence (ATPL) and were appropriately qualified for the flight.

The captain had been flying with the operator for about 30 years, initially on the Boeing 737 type aircraft, and undertaking a number of senior roles within the organisation, before moving onto the Airbus A330 type aircraft about 3.5 years prior to the occurrence. They had accumulated about 20,100 flight hours, of which 8,238 hours were on the A330. The captain last completed a cyclic simulator training session (which included a hydraulic system failure) in July 2019, and emergency procedures training (which covered land evacuations) in August 2019.

The FO had been flying with the operator for 15 years and had recently transitioned from the Boeing 747 type aircraft to the A330 in October 2018. They had a total of about 12,200 flight hours, of which 900 hours were on the A330. The FO completed emergency procedures training in February 2019 and last completed a cyclic simulator training session (which included a hydraulic system failure) in September 2019.  

Cabin crew

There were 8 cabin crew on board, with one cabin crew member stationed at each of the 8 aircraft doors. All cabin crew were qualified to operate on the A330. The cabin crew had a varied level of flying experience, ranging from 11 months to 30 years flying with the operator (Table 1).

Table 1: Cabin crew experience and date of last emergency procedures (EP) training

The cabin crew member stationed at L1 was the customer service manager (CSM).

Aircraft information

General information

The Airbus A330-202 (A330) is a twin engine, wide-body (dual aisle) medium-to-long-range air transport operation aircraft.

VH-EBC, serial number 0506, was manufactured in 2003 by Airbus, with a total time in service of 67,833 flight hours. VH-EBC was brought onto the Australian aircraft register in 2003 by Qantas Airways and was one of 28 A330 type aircraft utilised by the operator.  

The passenger seating capacity on VH-EBC was 271, including 28 business class seats and 243 economy seats.

Hydraulic system description

The Airbus A330 has 3 independent hydraulic systems designated as green, blue and yellow (see also Appendix A). The operational pressure is 3,000 psi. The 3 hydraulic systems are powered by 4 engine-driven pumps and there are 3 electrical pumps that can automatically act as backup for each hydraulic system.

If green hydraulic system pressure is lost, the only functions that are not performed by the other systems are emergency power generation, nose-wheel steering and landing gear extension. With nose-wheel steering lost for taxiing, it was possible to steer the aircraft using a differential braking technique. However, if the flight crew did not have experience with this technique, the A330 Flight Crew Techniques Manual (FCTM) stated it was preferable to request a tow to return to the terminal. The loss of the green hydraulic system prevented the landing gear from being extended by normal means, necessitating a gravity free-fall extension to the down position.

Hydraulic system monitoring

The hydraulic system monitoring unit (HSMU) and the electronic centralised aircraft monitor (ECAM) monitored the condition of the hydraulic system continuously. If a fault occurred, an ECAM message and associated aural alert informed the flight crew.

When the green system hydraulic fluid reservoir quantity falls below 17 L, the indication of the fluid level on the ECAM hydraulic system page will change from a green line to 2 amber lines. It also triggers a hydraulic system leak message.

For the occurrence involving VH-EBC, the messages displayed on the ECAM related to the hydraulic system leak and their timings included:

• HYD G SYS LEAK (0851)
• HYD G ENG 1+2 PUMPS LO PR (0854)
• HYD G SYS LO PR (0854) (recorded flight data indicated that this occurred at 0854:57)
• HYD G RSVR LO LVL (0919).

When these messages displayed, they were accompanied by a checklist of actions and considerations for the flight crew.

The flight crew took the necessary actions indicated by each of the checklists, including a landing gear gravity extension. The crew were also aware that there may not be nose-wheel steering available, as this was communicated via the ECAM.

Engineering inspection

The aircraft was inspected by the operator’s engineers after the evacuation to identify the source of the hydraulic leak. There was evidence of residual hydraulic fluid on the tail flowing down towards the auxiliary power unit (APU) air intake (Figure 4).

Figure 4: Tail of VH-EBC showing hydraulic fluid leak towards APU air intake

Source: Qantas, annotated by the ATSB

The operator’s engineers examined the internal sections of the vertical stabiliser and identified the hydraulic leak emanating from a flexible hose connected to the centre rudder hydraulic servo, which was powered by the green hydraulic system rudder servo pressure hose. The leak occurred near where the hose joined a 45° end fitting (Figure 5). Apart from this leak, there was no discernible visual defects.

Figure 5: Location and position of green system rudder servo hoses and position of leak

Source: Qantas, annotated by the ATSB

The green hydraulic system rudder servo high pressure hose (part number AE2464379H0316) is a flexible hose constructed of 3 layers:

• a seamless extruded Teflon resin inner tube
• an outer braid consisting of densely packed small diameter stainless steel wires
• a blue Teflon abrasion sleave.

The purpose of the stainless steel braid is to reinforce, and prevent rupture of, the inner tube, which is exposed to high pressure fluid in normal operation.

The failed hydraulic hose was removed from the aircraft and sent to the aircraft manufacturer for a detailed examination. That examination identified:

The leakage was confirmed between 45° fitting and metallic label. The outer steel braid of the hose was found damaged. The fractured wires of the steel braid exhibit corrosion attack and corrosion products. Fatigue striations were detected indicating a fatigue fracture. The fractures of the wire originated from corrosion attack and fails due to fatigue load and corrosion. No other mechanical damage could be identified which could act as crack starting points.

Figure 6 shows the hydraulic hose stainless steel braid fractures, with evidence of corrosion and fatigue cracking at varying degrees of magnification.

Figure 6: Hydraulic hose steel braid fracture surface showing corrosion and fatigue cracks

Source: Airbus, annotated by the ATSB

Hydraulic hose failure history

Each of the 3 independent hydraulic systems had 2 rudder servo flexible hoses (one pressure and one return). The hoses were considered to be an on-condition part with no life limit. The Airbus A330 recommended maintenance program stipulated a visual inspection of the rudder servo flexible hoses every 24 months. The last inspection conducted by the operator on VH-EBC was completed in June 2019.

At the time of the occurrence, this was the operator’s second A330 hydraulic loss occurrence involving a hydraulic system rudder servo pressure hose in the previous 4 years. The first occurrence was on 6 May 2019 and involved the green system; on that occasion no fluid was ingested into the APU air intake. That occurrence involved an aircraft that was a similar age, flight hours and flight cycles as VH-EBC. Both of the failed hoses were original fitment during manufacture in 2003.

The ATSB is aware of another rudder servo pressure hose failure on another operator’s A330 that resulted in hydraulic fluid entering the APU air intake and then the aircraft cabin and flight deck via the air conditioning system. That serious incident occurred in 2014 and involved an A330 with a similar serial number and manufacture date to VH-EBC (see Related occurrence) and a hose with the part number AE2464373H0316. The failure occurred at a similar point on the hose as the VH-EBC occurrence, near the 45° end fitting. Examination of the hose identified that the rupture was due to fatigue failure of the metal braid. There was no indication of corrosion. The hose was original fitment during manufacture in 2003.

The ATSB requested hydraulic hose failure history information from Airbus. The manufacturer stated:

It is difficult to have a comprehensive view of all cases, as not all are reported to Airbus as per Occurrence reporting rules, only those cases which had an impact on a system would be reported.

Airbus has regularly to demonstrate to the EASA that the safety objectives are still met, and that the situation is not degrading...

The hose PN AE2464379H0316 that failed on MSN 506 [VH-EBC] was fitted on A330-200 aircraft (ST7 variant) from MSN 181 to MSN 555 only but only about 220 of those are still operated worldwide. From A330 MSN 555 onwards…, the hydraulic system has been modified and those involved hoses are not installed anymore.

Airbus do not have information about exact failure rates, what they have recovered is the number of parts that have been ordered during a 3 years period, those orders cannot be linked directly with a failure, but it gives an idea. Moreover, please note that there are 3 hoses per aircraft (for blue, green, yellow hydraulic lines) and that it is common practice to order some spares in addition to the parts needed.

Here are the figures Airbus could retrieve:

68 parts PN AE2464379H0316 [green rudder servo hydraulic pressure hose]

The A330 has mandatory flexible hose replacements for areas identified as having a high in-service failure rate. However, according to Airbus, the rudder servo flexible hoses did not require mandatory replacement based on the in-service failure rate. Other than the 2014 serious incident, the manufacturer advised that it had not investigated any other occurrences involving failures of this type of rudder servo flexible hose.

Skydrol hydraulic fluid

The hydraulic fluid utilised in the Airbus A330 is a fire-resistant phosphate ester-based fluid known as Skydrol.  

According to the material safety data sheet, Skydrol is toxic to humans and animals. If it is heated to decomposition, it emits acrid smoke and fumes. If smoke and fumes are carried via the air conditioning system into the aircraft cabin and flight deck, occupants have been known to experience irritant effects to the eyes and respiratory system. There have also been other reported symptoms affecting the central nervous system, which can include dizziness, lack of concentration and coordination.

The first aid treatment suggested for inhalation of Skydrol is to have the person breath fresh air, and if breathing difficulty is experienced to provide oxygen; and in both cases seek medical assistance if necessary.   

Auxiliary power unit (APU) and bleed air intake

Figure 7 is a schematic of the APU showing the air intake that was the entry point for the hydraulic fluid ingress. The air intake provides inlet air to the APU gas generator and also the load compressor. The load compressor provides pressurised air to the cabin air conditioning system when the aircraft is on the ground and the APU bleed air valve is open.

There is an air intake diverter and fluid gutters installed in and around the APU air intake. Together with the diverter, the fluid gutters form a frame that protrudes from the fuselage skin around the air intake opening. The frame is designed to minimise fluid ingress into the APU air intake. However, when the aircraft is on the ground some fluid may bypass the frame due to the lack of airflow.

Figure 7: A330 APU schematic showing air intake and path of the atomised hydraulic fluid contamination into the cabin

Source: Airbus, annotated by the ATSB

The operator’s Flight Administration Manual (FAM) contained guidance to flight crew on APU management after arrival at an airport. Although it did not specifically address the situation faced by the flight crew on this occasion, it did include information about the use of the APU to supply air conditioning when the outside air temperature exceeded 21 °C or there was inadequate ventilation inside the aircraft.

The flight crew of VH-EBC used their discretion and decided that, given the time that it might take to tow the aircraft to the terminal, the APU bleed was selected on to maintain passenger and crew comfort.

Emergency exits and escape slides

Types of doors

The A330-202 type aircraft has 6 type A doors (3 on each side), and 2 type 1 doors (one on each side) (Figure 8). All 8 doors are equipped with emergency escape slides and are designed for use in an emergency evacuation.

The differences between a type A door and a type 1 door are that the type 1 door is smaller, equipped with a single lane slide (as opposed to dual lane), is a slide only exit, and the slide cannot be used as a raft.

Figure 8: Location of A330-200 type A and type 1 doors

The left and right sides of the aircraft have identical slide configuration.

Source: Airbus, annotated by the ATSB

Door arming and disarming

For all 8 doors, the door had to be armed to enable the escape slides to automatically deploy. To arm a door, the slide arming lever (Figure 9) is placed into the armed position. When the lever is put into this position, the girt bar (a horizontal metal rod attached to the escape slide) is connected to the floor brackets on both sides of the door. When the door is opened, the slide pack will then be pulled out from the door container and fall under gravity, triggering the automatic escape slide inflation mechanism. If the automatic inflation fails, the escape slide can be manually inflated. Opening the door from the outside disarms the door and the escape slide will not deploy. 

Figure 9: Type A door arming lever location and related features

Source: Qantas and Airbus, annotated by the ATSB

To ensure that the aircraft doors were prepared for an emergency, the operator’s procedures required the cabin crew to arm the doors just after the aircraft started to move from its parking position (just after pushback). The procedure required the CSM to make an announcement to the cabin crew instructing them to ‘arm doors and crosscheck’.

After the door was armed, the cabin crew member removed the safety pin (shown with the red tag in Figure 9), moved the arming lever into the armed position and placed the safety pin in a pouch located at the door. Therefore, when the door was armed there was no red tag visible to the cabin crew.

The doors remained armed until the aircraft had landed, and the cabin crew were instructed by the flight crew to disarm the doors. The public announcement (PA) from the flight crew typically occurred when the aircraft was in close vicinity of the terminal. After receiving the instruction, the cabin crew disarmed their doors and completed a crosscheck, ensuring that the doors were in the disarmed position. When the doors were disarmed, the reverse procedure was undertaken, and the safety pin was re-inserted following the movement of the arming lever into the disarmed position.

The exits are disarmed to allow the aircraft doors to be opened and connected to aerobridges or stairs for passenger disembarkation, and to avoid any injuries to personnel outside the aircraft if there was an inadvertent slide deployment.

At the time of the captain’s evacuation command on VH-EBC, all doors had already been disarmed.   

Operation of aircraft doors in an emergency

The operator’s Aircrew Emergency Procedures Manual (AEPM) stated that, for the operation of the A330 type A doors in an evacuation, cabin crew were required to:

1. Check outside to ensure the door is safe to open.

2. Open door in ARMED Mode.

3. Lift Door Handle rapidly fully up and release it.

4. The door power assist will open the door.

5. The slide will automatically deploy and inflate.

The operation of the type 1 door was almost identical in a land evacuation, aside from a cover that had to be lifted from the handle to open the door.

The aircraft manufacturer’s recommended procedure^[14] for cabin crew to use when operating the exits in an emergency evacuation was similar. However, the recommended procedure required that the cabin crew check that the door was armed prior to checking outside conditions and operating the door.

Use of the escape slides in an emergency

In a section titled ‘Safe Slide Use’, the AEPM stated:

In an evacuation using an escape slide, to reduce the chance of injury, a Crew member should:

- Jump well clear of the girt bar area, (this is to avoid contact with the area where the slide is attached to the aircraft resulting in possible injuries).

- Drop into seated position with legs straight, feet shoulder width apart and toes pointed back.

- Lean well forward by placing their hands on their knees to slow the descent. Using this technique also ensures hands are to be kept clear of the slide fabric avoiding possible friction burns.

- Be aware that deceleration pads at the bottom of the slide will assist them returning to a standing position.

- Keep moving to let their momentum carry them away from the bottom of the slide.

The operator’s procedures also included instruction on how to assist passengers with special needs when evacuating via the slides; however, there was no guidance provided in relation to evacuation with infants.

Research conducted by the United States Federal Aviation Administration (FAA) in 2001^[15] indicated that, for passengers carrying infants, faster egress could be achieved by jumping onto the evacuation slide. There was no definitive guidance provided about appropriate boarding and carrying positions, although it was suggested that the best position would be that which was most comfortable for the person carrying the child, as long as support was provided to the child’s head and neck.

The operator’s cabin crew and flight crew practiced an escape slide descent during their initial training, and they watched a video explaining safe slide descents to maintain currency each year.

Emergency procedures

Smoke / mist in cabin procedure

The Quick Reference Handbook (QRH), located on the flight deck, contained checklists for various emergencies and abnormal events, including a checklist for smoke / fumes / avionics smoke. The procedure applied to events in flight and on the ground, and the initial actions on the first page focussed on smoke / fumes events while in flight.

The second page of the procedure started with:

- If AIR COND smoke suspected:

APU BLEED…………………….OFF

The procedure then provided additional actions for that scenario and other scenarios.

Fumes event procedures

In 2015, the International Civil Aviation Organization (ICAO) provided detailed guidance about training and reporting of fumes events.^[16] It stated:

Various types of fumes, smoke, haze and mist may contaminate the cabin and flight deck air supply system. Outside air may be contaminated with engine oil, hydraulic fluid, engine exhaust, ground service vehicle exhaust, fuel, de-icing fluid or ozone. Recirculation fans are another potential source of contaminated air.

Of all of these potential contaminants in the cabin and flight deck, particular concerns have been raised regarding the negative impact on flight safety when crew members are exposed to oil or hydraulic fluid fumes or smoke, and experience acute symptoms in flight. Due to the potential flight safety implications, it is beneficial to provide guidance and instructional material to enable crew members to promptly recognize and respond to suspected air supply system-sourced fumes…

Crew members use a wide variety of terms to describe oil and hydraulic fluid fumes. Often, oil fumes do not smell like oil. Instead, they are typically described as smelling like dirty socks/smelly feet, foul, or musty. Hydraulic fluid often has a distinctive and recognizable odour that is often described as acrid.

It recommended that training be provided to cabin crew in ‘odour descriptors’. It stated:

Cabin crew members should attempt to identify and locate the source of the fumes (i.e. air supply system or cabin equipment/item) and attempt to identify the type (e.g. dirty socks, musty/mouldy, acrid) and intensity (e.g. mild, moderate or strong) of the fumes.

This same information was replicated in guidance issued by the Civil Aviation Safety Authority (CASA) in 2018.^[17]

The operator’s AEPM stated:

If fumes are suspected in the cabin, initial actions include:

Protect yourself – limit personal exposure to fumes. Consider removing yourself from the area.

Communicate – via Emergency All Stations Call. It is vital that information is relayed to the Flight Crew as a priority. This assists in providing the information required to adequately assess and deal with the event.

Limited access to the area and exposure to crew/passengers.

Investigate and monitor as directed by Flight Crew – should a return to area be necessary, consider using a PBE [portable breathing equipment]. Note that PBE use may compromise communications efforts.

The operator’s Cabin Crew Operating Manual (CCOM) detailed the following guidance in relation to fumes in the cabin:

9.9.2 Cabin Fumes Considerations

Fumes caused by oil contaminated bleed air have been described as having a strong odour similar to ‘dirty socks’, and possibly a blue smoke haze or mist. However, a fumes event may not necessarily be characterised by visible smoke. A fumes event may be characterised experiencing any of the following symptoms:

- Cough, wheeze, shortness of breath, chest tightness, difficulty with speech;

- Sore throat, burning throat, difficulty swallowing, nasal irritation, runny nose, eye irritation, chest pain, palpitations;

- Dizziness, headache, sensation changes or weakness anywhere in the body, difficulty balancing, loss of hearing, difficulty concentrating; and/or

- Nausea and/or vomiting.

Crew are advised that they should seek a medical consultation if any of the above symptoms occur following a fumes event. Fume odour can appear strong initially and mistakenly appear to subside with further exposure. A conservative approach should be adopted during all events. Refer to … the AEPM for the initial actions in a fumes event.

The same guidance was detailed in the flight administration manual (FAM) applicable to the flight crew, with the only difference being that there was no instruction to refer to the procedure detailed in the AEPM.

Communication in an emergency

The operator’s AEPM stated that, if there was a situation that required ‘URGENT’ simultaneous contact with all stations, including the flight deck, this was to be achieved by pressing the PRIO ALL call button on any of the interphone handsets in the cabin. The flight crew could either use the overhead guarded emergency call button or press the EMER CALL on the flight deck interphone handset. 

If an emergency occurred that only required the flight deck to be informed, the CSM or other cabin crew members could make a call to the flight deck using the PRIO CAPT on the interphone handset. This call will be between the cabin crew member and the flight crew only and will not include the other stations in the cabin.

When contact was made about the haze/smoke in the cabin and flight deck on VH-EBC, the call was reported to be an emergency call between the captain and CSM. An ‘emergency all stations call’ that would include all cabin crew was not utilised. 

Evacuation signal

According to the AEPM, the captain was responsible for initiating an evacuation. The AEPM stated that the captain should do so by as many means as possible. The 3 possible methods listed were:

- PA “Evacuate, Evacuate, Evacuate”.

- Verbal evacuation order by Flight Crew Member entering cabin.

- Emergency Evacuation Signal System (as installed).

The emergency evacuation signal system was an option on the A330 and was installed on VH‑EBC. The system itself could be used as a means of initiating an evacuation and alerting passengers to an emergency. To operate the system, there was a guarded command switch located in the flight deck and on the forward attendant panel at L1 in the cabin (Figure 10).

Figure 10: Evacuation signal controls

_{Source: Qantas, annotated by the ATSB}

Figure 10 shows a switch in the flight deck that could be set to either CAPT, or CAPT & PURS. This selection would determine whether or not the aural alert for the cabin could be activated in the flight deck only (set to CAPT) or also by the button at the forward attendant panel (CAPT & PURS). It was the operator’s normal practice to have the switch set to CAPT & PURS.

In either setting, when the command switch was pressed by the captain, an aural alert (like an alarm with repeated high pitch tones) would sound in the cabin and visual indications would appear on the flight deck overhead panel (red flashing light) and on all cabin attendant indication panels located in the cabin (red flashing light and the word EVACUATION).

Although the AEPM provided information to cabin crew about how the evacuation signal functioned, there was no procedure documented in Qantas’s manuals that detailed when the cabin crew were required to (or advised to) activate the evacuation signal.

When the evacuation occurred on VH-EBC, the captain issued the command via the PA. Neither the cabin crew nor the captain operated the evacuation signal.

Flight crew evacuation checklist

The QRH included a checklist for an evacuation (on the back page). The checklist detailed the sequence of actions to be taken by the flight crew in an emergency evacuation.

The evacuation checklist was also documented in other flight crew manuals within the operator’s suite. Following this evacuation, the operator found that the QRH checklist in the Flight Crew Operating Manual (FCOM) had been expanded to include ‘Press the EVAC COMMAND’ for the initiation of the evacuation (Figure 11). This additional action was not included in the actual QRH on the aircraft.

Figure 11: Flight crew evacuation checklists

Source: Qantas, annotated by the ATSB

On this occasion, the captain initiated the evacuation before referring to the emergency evacuation checklist in the QRH.

Flight crew land evacuation procedures

The operator’s AEPM contained a land impact drill that detailed actions to be taken by the flight crew if an evacuation was required. As well as completing the evacuation checklist, both the captain and FO had additional actions they had to undertake. The captain was required to monitor and oversee the evacuation, and when all assistance had been rendered, evacuate the aircraft. The FO was required to enter the cabin and repeat the evacuation command, exit the aircraft through the first available exit, and report to emergency services. Both the captain and FO were also required to supervise the welfare of passengers until relieved by rescue personnel.

For the evacuation involving VH-EBC, the flight crew reported that, and were observed to, complete the land impact drill as per the documented procedure.

Cabin crew land evacuation procedures

The operator’s AEPM also detailed actions that the cabin crew were required to undertake in the event of an emergency evacuation (see Appendix B). Key actions to evacuate passengers included:

• commence evacuation commands (after the evacuation order is given)
• check door/exit is safe to open and open the exit (including checking for fire/obstructions)
• guard exit until the escape slide is correctly inflated
• direct passengers using appropriate commands and try to ensure that passengers do not take cabin baggage when evacuating
• if a door/exit is unusable, redirect passengers; and continually reassess the door/exit for suitability.

Key actions after passengers had evacuated included:

• take a torch and check the cabin for remaining passengers, communicating with crew so as not to duplicate areas that have been checked
• evacuate through the closest available exit and take a megaphone if located at their station
• assist passengers on the ground (including administering first aid and directing passengers to safe areas).

Procedures for an evacuation at a terminal

The operator’s AEPM procedure for an evacuation at a terminal highlighted additional considerations for cabin crew. These included the use of stairs and aerobridges if available, checking outside for vehicles and obstructions, and a reminder to rearm doors prior to opening, if the area outside the aircraft was clear.

Post evacuation procedures 

The AEPM contained additional procedures for after an evacuation. These procedures required both the flight crew and cabin crew to assist on the ground until relieved by emergency services personnel. For the cabin crew, the procedures required them to:

- Assist passengers away from slides.

- Direct passengers toward the blue flashing light. If a blue flashing light is not visible direct passengers upwind. Note: Blue flashing light used in Australia only.

- Marshall passengers away from the aircraft and treat injured – begin First Aid.

- Strictly enforce NO SMOKING.

- Protect passengers from fire, fuel and vehicles.

In addition, the operator’s procedures advised of other considerations following an evacuation on land. These included:

- Remain clear of the aircraft, upwind and marshall passengers together.

- Do not re-enter the aircraft under any circumstances, unless in liaison with the Fire Commander/Police Officer…

Flight and cabin crew emergency procedures training

There was a regulatory requirement for annual proficiency testing of crew in the execution of emergency procedures. Appendix IV of Civil Aviation Order (CAO) 20.11 detailed what should be covered in the proficiency test, which included evacuation procedures and exit operation in normal and emergency mode. Civil Aviation Regulation (CAR) 217 required that each crew member undergo 2 checks of their competency each year.

Prior to July 2014, the operator’s cabin crew undertook 2 days of assessment and training each year. After July 2014, this was changed to 1 day of training and assessment, with a second check of competency undertaken via computer-based training and assessment.

The operator had covered all the documented evacuation procedures in initial training, which included an evacuation at the terminal. However, there was no explicit regulatory requirement for operators to conduct the evacuation at the terminal procedure on a regular basis during annual recurrent training and assessment, and it was not included the operator’s 3-year recurrent training matrix approved by CASA. The operator advised that the procedure had not been covered outside of initial training for a number of years.

Additionally, cabin crew reported that, during their annual training and assessment, the door would always be in the armed mode during an evacuation scenario, and therefore they did not need to rearm the door before opening it during the exercise.

In July 2003, there was an evacuation of one of the operator’s Boeing 747 aircraft (VH-OJU) at Sydney Airport following a fire in the landing gear after the aircraft had arrived at the gate.^[18] At the time of that evacuation, the 12 aircraft doors had been disarmed and one of the doors was connected to an aerobridge. During the evacuation, 8 of the 11 doors were opened by the cabin crew by rearming the door prior to opening. The other 3 exits were not armed first and were declared blocked by the cabin crew members at those doors.

The ATSB investigation report into the July 2003 occurrence stated:

The operator indicated that during the 2002 – 2003 bi-annual EP training, a land evacuation at the terminal was practiced. The scenario for the exercise was a wheel well fire warning after engine shut down procedures had been completed. During the exercise the doors were disarmed, so door rearming by cabin crew was required.  

Silent review

The use of a silent review is a well-known tool utilised by cabin crew to assist them to mentally prepare for an emergency situation.

The operator’s CCOM documented the requirement for cabin crew to undertake a silent review of emergency procedures and equipment during take-off and landing, during the no-contact phase^[19] of flight. A mnemonic ‘OLDABC’ was used as a prompt for cabin crew to remember emergency procedures:

- Operation of exits

- Location of emergency equipment

- Drill (impact)

- Able-bodied and disabled passengers

- Brace position and signal

- Commands

The cabin crew stationed at the rear exits (R4 and L4) on VH-EBC reported conducting a similar review with each other after the aircraft had arrived at the terminal. Within the context of an abnormal event, they recalled discussing that the doors were disarmed, where the assist handles were for each door (as they were different on each side of the aircraft), and their evacuation commands. In addition, prior to the call to evacuate, both cabin crew members checked outside conditions and reported to each other what they could see, which at the time included a fire tender in the vicinity of the L4 door. Once the evacuation command was made, the crew member at R4 reportedly yelled to the L4 crew member to arm their door before opening it.  

Evacuation commands to passengers

Operator commands at the time of the occurrence

The operator’s AEPM provided commands for use by crew members in a land evacuation (Figure 12). It included core commands and other recommended commands.

Figure 12: Operator’s documented evacuation commands

Source: Qantas

Although none of the core commands specifically referred to cabin baggage, the cabin crew had the option of using the command ‘leave everything behind’ as required. The operator also provided recommended actions for cabin crew to take if passengers attempted to take cabin baggage during an evacuation. The AEPM stated:

Where possible during an evacuation, passenger baggage must remain onboard the aircraft as it has potential to slow the evacuation, damage the escape slide and injure other passengers at the bottom of the slide. However, considerations should be given to avoiding:

- Piling up of baggage in exits, aisles and crossovers and in front of the flight deck door.

- Confrontation with passengers over baggage (the result which may impede the evacuation).

Possible strategies for dealing with baggage if it is surrendered at the door include:

- Throwing it on to seats (if configuration permits).

- Throwing it out of the aircraft forward or aft of the slide (away from the base of the slide) in an evacuation only.

CAUTION: Be alert for people moving around the base of the slides or under the aircraft.

Note: The crew member should not compromise their position in the doorway to retrieve a bag.

The cabin crew on VH-EBC reported that the core commands were practiced and rehearsed during training and the other recommended commands (in Figure 12) were those that could be used by cabin crew depending on the situation.  

All the cabin crew on VH-EBC reported that, during the evacuation, they used the core commands for a land evacuation. The cabin crew at the doors where escape slides had been deployed (R3, L4 and R4) reported that passengers arrived at their exits with cabin baggage, and/or were unsure of how to use the slides. Consequently, they started to use instructions like those in the recommended commands, such as ‘leave your bags’ or ‘jump and slide’, but only when the passengers had reached their door. The cabin crew member at R3 recalled changing their commands to ‘sit and slide’ when they assessed that there was less urgency to evacuate.

The cabin crew members at blocked exits (R1, R2 and L3 and for a period L2) reported using the re-direction commands such as ‘go across’ in addition to other core commands, but reported they did not use the command ‘leave everything behind’ prior to passengers reaching the other doors with their cabin baggage.

The passenger who was seriously injured with injured knees when using the slide at R3 recalled hearing the commands ‘get out, come on go’. They advised that they heard no other instruction on how to use the escape slide during or prior to the evacuation. They stated that they stood at the slide, sat down and then someone tugged them and they ended up going fast and chaotically down the slide, and ended up landing on the tarmac on their knees when they arrived at the bottom.

One cabin crew member also advised that the AEPM commands had changed since they started with the operator. They thought the ‘old commands’, which included instructions about slide use, may have been useful to passengers prior to reaching the exit.

Operator’s previous commands and change process

The operator completed a review of its evacuation commands in June 2004 following the occurrence that resulted in the evacuation of the Boeing 747 VH-OJH at a terminal in July 2003. The ATSB report stated:

The cabin crew reported a number of difficulties in applying the evacuation procedures, particularly those regarding cabin luggage. Some were unsure as to whether the priority should be to get the passengers off the aircraft as quickly as possible and ignore cabin baggage, or to insist that all cabin baggage be left on the aircraft. Other cabin crew, who followed operator procedures and insisted that cabin baggage be left behind, reported a build-up of baggage in the aisles and around doorways, potentially slowing passenger movement from the aircraft…

The [AEPM] procedure did not specify commands to leave cabin baggage behind. The on-board safety cards located in each seat depicted a bag with a circled cross through it next to a passenger evacuating, symbolising that bags were not to be taken during evacuations.

Following the occurrence, the operator conducted a review of its cabin crew commands. Figure 13 shows the operator’s commands at the time of the review (and the time of the July 2003 occurrence).

Figure 13: Operator’s previous land and ditch commands

Source: Qantas

The review included:

• an examination of 16 other airlines’ commands for land and water evacuations
• a survey of 50 random passengers at the Sydney domestic airport to determine what commands those passengers would expect to hear
• extensive internal review and a change management process, which included obtaining and reviewing feedback from CASA.

As a result, the review team recommended that a change be made to the commands to split them into ‘core commands’ and ‘other recommended commands’, as well as adding the command ‘leave everything behind and get out’ to the other recommended commands. There were also commands that were recommended for use in a precautionary disembarkation (see Procedure for precautionary disembarkation).

The changes made to the commands as per the recommendations are reflected in Figure 12, excluding commands for a precautionary disembarkation.

Research and guidance about evacuation commands

Commands instructing passengers to leave cabin baggage behind

Guidance produced by a number of sources including CASA, the aircraft manufacturer, ICAO, and the International Air Transport Association (IATA) recommended that cabin crew use commands during an evacuation that instruct passengers to leave their cabin baggage behind. This is to reduce delays and reduce the potential for passengers blocking aisles and exits and/or damaging escape slides.

All guidance, except that from CASA, also specifically advised that the commands should occur at the beginning of the evacuation. One reason for this was that it was too late to provide this instruction when the passenger had reached the exit with their cabin baggage. All sources also suggested that passengers be advised in the pre-flight safety briefing about leaving cabin baggage behind during an evacuation. 

An ATSB research report Evacuation Commands for Optimal Passenger Management (2006) detailed the results of a survey of Asia Pacific and Australian airline operators. In response to a question about what instructions were given to passengers in relation to cabin baggage, all but one of the operators surveyed stated they employed a command to direct passengers to leave their cabin baggage behind during an evacuation. It was also noted that in previous research conducted by the NTSB,^[20] there had been instances where passengers and cabin crew had argued during an evacuation about taking cabin baggage and this had caused disruption to the evacuation flow.

The research report also noted the ATSB report into the July 2003 evacuation involving VH-OJH indicated similar problems with cabin baggage and passenger flow. In addition, the research report highlighted that there may be a need to remind passengers, in an operator’s pre-landing announcement, about leaving cabin baggage behind if required to evacuate. However, at the time of the 2006 survey, most operators (including the operator of VH-OJH) did not provide such information in the pre-landing announcement.

Commands for escape slide use

Escape slides are designed to enable a quick and safe egress for passengers and crew in an emergency. To help facilitate an expeditious exit, cabin crew are trained to be assertive and use short, concise commands to get passengers out of the aircraft as quickly and safely as possible. 

When transport aircraft are certified, testing is conducted to ensure that an evacuation can be undertaken within 90 seconds using half of the exits. A successful evacuation is not only affected by the configuration or design of the aircraft itself, but also procedural aspects. This includes the actions taken by cabin crew to influence the speed of the evacuation, including the use of commands.

In the NTSB’s Safety study: Emergency Evacuation of Commercial Airplanes (2000), speed was identified as the primary reason airlines utilised the command ‘jump and slide’ at exits. The NTSB noted that it was not aware of any aircraft being certified with a ‘sit and slide’ procedure, and it concluded that evacuations involving slide use could be delayed if passengers sat at exits before boarding a slide or if crew commands did not direct passengers how to get onto a slide. The report recommended that the FAA review airline procedures and training programs to ensure that the commands used for slide evacuations were consistent with the commands used for slide evacuations during certification.

The ATSB research report Evacuation Commands for Optimal Passenger Management (2006) also discussed commands for slide use. It stated:

The reason for commands that encourage passengers to ‘Jump’ or ‘Jump and slide’ when evacuating is to achieve the required flow rate of 70 people per lane per minute down the slide (FAA, 1990). This rate could not be achieved if a procedure of ‘Sit and slide’ was used, as the act of sitting takes valuable time. One study found that if 100 passengers were to sit on the slide, they would take 33 seconds longer to evacuate than 100 passengers who jumped (see Johnson, 1984)…

‘Jump and sit’ may cause confusion, as it is possible that some passengers might interpret this to mean that either jumping or sitting is acceptable… The command ‘Jump and slide’ may increase the speed of the evacuation and could therefore have an impact on the injuries sustained by passengers. This is not likely to be a key issue in a genuine emergency situation, such as where a post-crash fire is present. However, in precautionary emergency evacuations, where the airframe is evacuated ‘just in case’, it is possible that passengers will not tolerate a higher injury rate…

In addition to conducting a survey, the ATSB 2006 research report also involved conducting trials of different types of evacuation commands in a simulator. In aircraft with dual lane slides, such as the A330, the report also noted:

The results showed that evacuations without dual-lane flow commands were faster, but more disorganised. With a larger passenger load, dual-lane flow commands could be useful for managing the evacuation in a more orderly and less congested fashion. 

The improvisation of commands was also discussed in the ATSB research report in the context of an operator permitting cabin crew to use commands they thought were appropriate when instructing passengers to fit life jackets, rather than having trained them to say scripted commands. The report noted ‘the danger of this approach was that it is widely recognised in the literature on learning and skill acquisition that over-training can often be required to ensure competence in infrequent events.’

Other guidance in ICAO’s Manual on Information and Instructions for Passenger Safety (2018) advised:

Once cabin crew members open the exits and verify that assisting evacuation means (e.g., slide, slide-raft) are ready for use; they should instruct passengers to move towards the usable exits. At exits equipped with dual-lane slides, cabin crew members should instruct passengers to divide into two lines at the doorway to evacuate as many passengers as possible simultaneously in pairs.

Procedure for a rapid disembarkation

A rapid disembarkation (sometimes known as a rapid deplaning or precautionary disembarkation) is a procedure used in an abnormal situation that has the potential to escalate into an emergency, and where passengers and crew need to deplane   quickly as a precautionary measure.

A rapid disembarkation usually happens at the airport and the emergency exits and slides are not used unless it is decided that this is necessary, in which case this will be done in a controlled manner with commands such as ‘sit and slide’ used to instruct passengers about slide use. As it is a rapid egress from the aircraft, passengers will be instructed to leave their belongings behind.^[21]

Rapid disembarkation procedures are commonly used among Australian and other overseas operators, and assessed by CASA when an operator is applying for an Air Operator’s Certificate (AOC). Both ICAO in its manual Cabin crew safety training manual and Manual on Information and Instructions for Passenger Safety, and IATA in its Cabin operations best practices guide reference a rapid disembarkation as an alternative procedure to an evacuation.

Qantas previously had a rapid disembarkation procedure (which they termed a precautionary disembarkation), which was in both the AEPM and the QRH and was included in crew emergency procedures training and assessment. The operator advised the ATSB that the process to remove the precautionary disembarkation procedure began in 2012 with a risk assessment, and the process was finalised in 2017. In 2020, the operator provided the following summary to the ATSB regarding the reason for removal of the procedure:

A number of previous safety investigations between 2005 and 2013 had identified that the precautionary disembarkation procedure was not effective in managing the actual disembarkations as designed and expected.

The organisation recognised that our events had become less routine and more unique. We therefore needed to provide crew with a formal framework that provided the flexibility to manage these events safely and effectively, in a wide range of circumstances.

The operator also provided a flight operations memo dated June 2017, which was distributed to flight crew, that explained some limitations and additional reasoning for the removal of the procedure:

It is acknowledged that there may be some highly unusual instances where options are limited and outside the scope of company policy where the Capt determines that neither an evacuation or a non-routine disembarkation is appropriate. In such cases the captain retains the authority under CAR 145^[22] and 224 to deplane passengers using escape slides or any other means.

Additionally, a number of abnormal events (eg smoke in the cabin) have occurred at the terminal while attached to an aerobridge. In these situations, it was identified that the 'Precautionary Disembarkation' lacked the necessary flexibility to effectively manage the deplaning of passengers.

Accidents around the world continue to demonstrate that the use of escape slides pose a significant risk to injury to passengers. While this is justified in emergency scenarios (when grave or imminent danger to occupants) the injury risk is no longer considered acceptable during non-emergency events.'

The precautionary disembarkation procedure was replaced by a ‘non-routine disembarkation’ in 2017, which was classified as a normal procedure and therefore not referred to in the AEPM or the QRH. A non-routine disembarkation was documented in both the CCOM and the FCOM. Text in the CCOM stated:

A Non-Routine Disembarkation is a process to be used when it is not possible for passengers to disembark the aircraft in a routine or normal manner but where there is insufficient risk to passenger or aircraft to justify continuation of alert phase and/or evacuation. The pace of a Non-Routine Disembarkation is slower than that of a routine disembarkation, to ensure passenger safety. A Non-Routine Disembarkation may be upgraded to an evacuation if the situation requires and in this instance, all primary escape routes, providing they are safe, must be opened.

With the removal of the precautionary disembarkation procedure, the only procedural option available to flight crew to rapidly disembark or to get passengers out of an aircraft quickly was to use the evacuation procedure, which involved using escape slides.

Following the occurrence involving VH-EBC, and as part of its safety action, the operator provided details of non-technical skills training that demonstrated how the evacuation procedure could be adjusted by a captain in different scenarios. The event used as an example occurred during engine start in Cairns in February 2019. After the passengers had been loaded onto a Boeing 737 aircraft, there was an engine overheat indication and subsequent fire warning. In response, the captain decided that an evacuation was required. This was due in part to the unavailability of stairs after the aircraft had returned to the bay, and partly because there was no other procedural option whereby the slides were permitted to be used for disembarkation. It was reported that in this instance the captain adjusted the evacuation procedure by nominating exits for use on the right side of the aircraft only, and advised the cabin crew that the over-wing exits were not required. This event was utilised as an example of where the captain used their authority under CAR 145, which permitted the captain of an aircraft to adjust the emergency procedure to avoid immediate danger.

Airbus also previously had a rapid disembarkation procedure documented in its version of the CCOM, however this procedure was removed in 2008. When asked about the reason for the removal of the procedure, the manufacturer advised:

The precautionary evacuation procedure was deleted for the following reasons: In the case of obvious rapid disembarkation on the stand initiated by the flight crew, specific airline procedure for both aircraft and on ground activities should apply.

Research and previous safety investigation reports advocating the use of a rapid disembarkation procedure is provided in Appendix C.

Passenger safety briefing

Regulatory requirements for passenger safety briefings

CAO 20.11 (Emergency & lifesaving equipment & passenger control in emergencies) stated an operator shall ensure all passengers are provided with an oral safety briefing before each take-off. The order detailed a list of items that passengers must be briefed on, including the location of emergency exits. There was no specific requirement to provide passengers with information about what to do with cabin baggage in an emergency, or the use of the escape slides.

CAO 20.11 also required that a safety briefing card was available for passengers on regular public transport (RPT) aircraft with a seating capacity of more than 6 (including crew). The card was required to contain additional information on several matters, including diagrams of emergency exits and the methods of operating the exits. 

Guidance on passenger safety briefings

ICAO in its manual on Information and Instructions for Passenger Safety provided guidance on how and what safety related information should be provided to passengers prior to and during flight. In respect to information about passenger cabin baggage and slide use, it was suggested that the pre-flight safety demonstration contain information about what to do with cabin baggage and belongings in case of an evacuation, and provide information on the location of emergency exits. It also suggested other information that could be included such as how to evacuate with infants and children.

CASA had produced similar guidance, including the following guidance on the content of the passenger briefing card in CAAP (Civil Aviation Advisory Publication) 253-2 V2.0 Passenger safety information: Guidelines on content and standard of safety information to be provided to passengers by aircraft operators (initially released in 2004, with the same text repeated in the revised version in 2018):

Evacuation slide use. The card should contain instructions consistent with the manufacturer’s recommended procedures (e.g. for passengers to jump outward in the seated position with legs extended, and not to stop and sit at the door sill). Use of the slide or other assist means should be consistent with the exits on that aircraft. Removal of high heels prior to using an escape slide is recommended.

Operator’s safety briefing

The operator used an audio-visual presentation to relay safety information to passengers. At the time of the occurrence, the video showed people travelling to different locations around the world and provided the required instructions to passengers in the different contexts, none of which were in an aircraft.

Figure 14 shows still images from the video where information was provided about cabin baggage in an emergency, and the use of emergency escape slides. There was no information provided to passengers about the use of the escape slide with infants.  

Figure 14: Still images from the operator’s passenger safety video

Source: Qantas

The audio provided the following information, which matched the subtitles in the video:

It also has escape slides and life rafts which the crew will operate in an emergency. If you have to evacuate leave all items behind. Slide leaning forward with your hands on your knees.

As evident in the figure, the images in the video were not consistent with the subtitles or the audio.

Operator’s safety briefing card

The operator provided a copy of its A330 safety briefing card utilised at the time of the occurrence. Figure 15 shows the pictorials on the card that provided information about cabin baggage and the use of escape slides in a land evacuation.

Figure 15: Excerpt of operator’s A330 safety briefing card

Source: Qantas, annotated by the ATSB

Related occurrence

There was one previous serious incident involving an A330 where, following the failure of a rudder servo pressure hose, hydraulic fluid entered the APU air intake and then the aircraft cabin. It occurred at Karachi International Airport on 4 October 2014 and involved an A330-243 with serial number 0518. The serious incident was investigated by the United Arab Emirates Air Accident Investigation Sector, General Civil Aviation Authority.^[23]The report’s synopsis stated:

On 4 October 2014, Emirates Airline flight EK609, from Jinnah International Airport (JIAP), Karachi, Pakistan, to Dubai International Airport (OMDB), the United Arab Emirates, with 14 crewmembers and 68 passengers onboard was operated by an Airbus A330 Aircraft, registration A6-EAQ. As preparations for departure were completed the flight crew sensed an odor accompanied by a yellow hydraulic system low pressure indication on the electronic centralized aircraft monitoring (ECAM) system.

The odor was due to hydraulic fluid mist that entered the cabin and cockpit through the airconditioning system. The source of the hydraulic fluid mist was leakage from a fractured hose that provides hydraulic pressure to the rudder yellow system actuator. The leaking hydraulic fluid entered the auxiliary power unit (APU) from where it entered the airconditioning system. Examination of the hose concluded that the cause of the fracture was, most probably, fatigue failure of the metal braiding, followed by fracture of the hose PTFE core pipe.

The mist filled the cockpit and cabin and caused difficulty in breathing, throat discomfort, and eye irritation for some occupants…

Based on initial information, the Commander [captain] decided to return the Aircraft to the stand and disembark the passengers and crew using steps. The Commander requested information about the situation in the cabin from the L4 cabin crewmember, who stated that visibility in the cabin was now limited to four rows. On receiving this information, the Commander decided to order an evacuation while the Aircraft was at its final pushback position.

The Air Accident Investigation Sector (AAIS) determined that the cause of the dense mist was the failure of a yellow hydraulic system rudder servo hose that allowed leaking hydraulic fluid to enter the APU, become heated and atomized, and then to be fed into the Aircraft airconditioning system. The cause of the hydraulic hose failure was not determined by the Investigation…

A contributing factor to the Incident was that the flight crew were unable to identify the source of the mist/smoke and decided to leave the APU running in case it became necessary to shutdown both engines.

During the 2014 occurrence, the aircraft had not yet commenced taxiing for departure. The atomised hydraulic fluid appeared to enter the cabin and flight deck via the APU about 1 minute after the yellow hydraulic system low pressure warning. In the case of VH-EBC, the atomised hydraulic fluid appeared to enter the cabin and flight deck via the APU about 2 minutes after the aircraft stopped at the terminal.

The investigation report included the following recommendation which was issued to  Airbus:

SR49/2016

Assess the risk of amending the existing SMOKE/FUMES/AVNCS SMOKE and SMOKE/FUMES REMOVAL checklists to distinguish between inflight and on-ground smoke scenarios, and insert text in the checklists to differentiate between the aircraft be on the ground or inflight.

Airbus responded to the recommendation (Appendix D), and reiterated that the procedure for smoke/fumes inflight was suitable for use on the ground. 

__________

14. Airbus A330/A340 Cabin Crew Operating Manual (2018)
15. Corbett, C.L. (2001). Caring for Precious Cargo, Part I: Emergency aircraft evacuations with infants onto inflatable escape slides (DOT/FAA/AM-01/18). Washington, DC: Office of Aerospace Medicine.
16. ICAO Circular 344-AN/202 Guidelines on Education, Training and Reporting Practices related to Fume Events
17. Cabin safety bulletin 13 - Management of odours, smoke and fumes during flight released November 2018
18. ATSB investigation 200302980, Boeing 747-438, VH-OJU Sydney Aerodrome, NSW 2 July 2003
19. The no-contact phase occurs within the sterile flight deck period during take-off and landing. No communication between the cabin and the flight deck is permitted during this time.
20. National Transportation Safety Board 2000, ‘Safety Study: Emergency Evacuation of Commercial Airplanes’, NTSB/SS-00/01 PB2000-917002, Washington DC, USA.
21. European Aviation Safety Agency (EASA), (2019) Frequently Asked Question (FAQ) n.99876. What is the difference between ‘rapid disembarkation’ and ‘evacuation’? What is the difference between ‘rapid disembarkation’ and ‘evacuation’? | EASA (europa.eu)
22. CAR 145 stated that ‘…the pilot in command of an aircraft shall pay due regard to all dangers of navigation and collision and to any special circumstances which may render a departure from those rules necessary in order to avoid immediate danger.’
23. AAIS Case No: AIFN/0016/2014, Airbus A330-243, A6-EAQ, Hydraulic Fluid Mist and Protective Breathing Equipment Fire in the Passenger Cabin, Karachi International Airport, 4 October 2014.

Safety analysis

Introduction

About 7 minutes after departure from Sydney, the flight crew became aware that there was a problem with the A330 aircraft’s green hydraulic system. The flight crew followed the required checklists and decided to return to Sydney rather than continue to Perth. After landing, the crew shut down the aircraft’s engines and started the auxiliary power unit (APU) in preparation for being towed to the terminal. The APU bleed was selected on to enable air conditioning in the cabin.

Approaching the terminal, the aircraft doors were disarmed by the cabin crew as per the normal procedure. Soon after the aircraft stopped at the terminal, a haze/smoke was evident and worsening in the cabin and flight deck, with some crew and passengers experiencing physical symptoms. After consultation with the customer service manager (CSM) and the first officer (FO), the captain commanded an evacuation. The evacuation was called at about the time one aerobridge was being connected and a second was in the process of being positioned at the aircraft, therefore the passengers evacuated via both aerobridges and escape slides.  

This analysis first considers the hydraulic hose failure. It then discusses the communication between the cabin crew and flight crew, and the overall management of the evacuation of the passengers, including the use of escape slides at the terminal, and aspects of passenger behaviour.

In addition, the analysis discusses a number of additional safety factors identified during the investigation, which relate to the operator’s passenger safety briefings, commands used in an evacuation, and other procedural aspects such as the unavailability of a rapid disembarkation procedure.  

Hydraulic hose failure

The source of the hydraulic issue related to the loss of hydraulic fluid from a ruptured green system rudder servo hydraulic hose. Materials analysis conducted by the manufacturer indicated that the hose failure was due to a combination of corrosion and fatigue cracking of the stainless streel braid. Once the stainless steel braid failed, this left the inner Teflon hose structurally unsupported, resulting in high pressure hydraulic fluid rupturing the inner Teflon hose.

This occurrence was the operator’s second occurrence involving a failure of the same hose type, fitted to the same position on 2 different aircraft with a similar age, flight hours, and cycles. Those occurrences were 6 months apart on 2 of the oldest A330s in the operator’s fleet. A similar failure had occurred on a yellow system hose on an aircraft of the same age involving another operator.

The aircraft manufacturer did mandate a calendar time replacement of some other hydraulic hoses (located in the wheel wells of the aircraft) that had a higher failure rate. However, the green system rudder servo hydraulic hose was not a mandatory replacement. Rather, it was an on-condition part that either had to have an identified visual defect or fail before it was required to be replaced. The hose had been visually inspected about 5 months prior to failure. However, the identification of any defect other than a hydraulic leak was not likely as the failed hose did not have any visual defects externally, even after it had failed.

Although the failure of the same hose on 2 different aircraft in the same fleet may indicate an underlying issue, there was not enough worldwide data to indicate an emerging trend to warrant a mandatory calendar replacement of the part. That said, there is nothing preventing individual operators from introducing a replacement program based on their own historic in-service fleet-wide analysis.

Hydraulic fluid ingestion into the APU

The flight crew were unaware that there was hydraulic fluid leaking into the tail cone area of the aircraft and out onto the lower surface of the empennage. Engineers who inspected the aircraft after landing, and prior to it being towed to the terminal, did not notice any leaking hydraulic fluid on or around the aircraft. It is possible there was limited hydraulic fluid present during these inspections, and more fluid was later forced from the failed hydraulic hose as the aircraft was turned to park at its allocated gate, with the nose-wheel hydraulic actuator movement pushing residual fluid out.

The hydraulic fluid from the hose leak at the rudder servo ran down the tail and was ingested into the open APU air intake. The APU was started, and the bleed air selected on while the aircraft was on the taxiway, 22 minutes prior to the aircraft arriving at the terminal. About 2 minutes after the aircraft stopped at the terminal, the low-pressure suction at the APU air intake drew hydraulic fluid into the APU load compressor, enabling the air conditioning system to deliver atomised hydraulic fluid to the aircraft flight deck and cabin.

The aircraft was fitted with an air intake diverter and fluid gutters to minimise the likelihood of fluid entering the APU air intake. These features would prevent fluid intake in most cases when the aircraft was on the ground. No significant fluid appeared to enter the air intake while the aircraft was stationary on the taxiway (for 11 minutes after the APU was started) and while it was being towed (about 11 minutes). However, as evidenced in this case and the other similar serious incident involving an A330 in 2014, the diverter and gutters can be bypassed by leaking hydraulic fluid in some situations when the aircraft is stationary on the ground. In the case of VH-EBC, the wind direction when the aircraft was parked at the terminal may have assisted the hydraulic fluid ingestion (the wind was blowing from the aft to the front of the aircraft when parked).

Communication between the cabin and flight crew

The cabin crew members at the L1 and L2 doors reported smelling something unusual when the aircraft had stopped on the taxiway, and during the tow to the terminal. When the aircraft arrived at the terminal and the cabin crew commenced the procedure to disarm the doors, the cabin crew member at L3 reported that they could smell ‘dirty socks’; however, they did not communicate this to the CSM, instead reporting only about the haze that could be seen in the cabin. The FO had also smelt something unusual and reported this to the captain, however they had not provided the same descriptions as the cabin crew.

It is vitally important that cabin crew provide the flight crew information about unusual smells in the cabin with as much detail and common terminology as possible (such as using an odour descriptor). If the flight crew on this occasion had been provided with information that there was an unusual smell (particularly one that the CSM had associated with a hydraulic system problem or one which may have indicated a fumes event), this may have raised the threshold for considering the relevance of the smell in relation to the hydraulic event.

Regardless of the source of the unusual odour (it may not have been related to the hydraulic leak), this information may have prompted the flight crew to turn the APU bleed air off, as this action forms part of the smoke/fumes procedure. If the APU bleed had been turned off this would have resulted in very limited hydraulic fluid mist contamination of the aircraft cabin.

Aircraft evacuation

Use of evacuation signal

The captain issued the evacuation command via the public announcement (PA) system, stating the required words (‘evacuate, evacuate, evacuate’). The announcement was effective in alerting the cabin crew and passengers of the need to evacuate the aircraft.

The operator’s procedure required a captain to initiate an evacuation using all available means, which in this case included the use of the emergency evacuation signal (alarm) that was fitted to VH-EBC as well as making the PA. The use of the evacuation signal is a secondary method to alert crew and passengers that there is a need to evacuate the aircraft, which provides additional assurance that passengers and crew are made aware of a need to evacuate in case the PA command is not fully effective.

In this case, the captain did not activate the emergency evacuation signal. Not all of the other A330 aircraft in the operator’s fleet had the evacuation signal fitted. In addition, the Quick Reference Handbook (QRH) located in the flight deck of VH-EBC did not include the use of the evacuation signal in the evacuation checklist, even though this was in the operator’s other operational documents for flight crew. Therefore, even if the captain referred to the checklist, they would have had to recall that they were on an A330 that had this function fitted.

The emergency evacuation signal could also be activated on the flight attendant panel in the cabin on VH-EBC. However, there was no procedure detailing when the cabin crew should ensure the signal was activated. This removed an additional redundancy. In situations where a flight crew did not or could not activate the signal, the cabin crew will be unlikely to activate it without a procedure that details when they should do so.

Decision to use exits

When the captain ordered the evacuation, they did not provide any additional information to the cabin crew about the exits to be used during the evacuation. That is, the captain had not used their powers under Civil Aviation Regulation 145 to adjust the procedure for the specific situation (as detailed in some of the operator’s training as a suitable alternative in some cases), nor were they required to or needed to. Accordingly, it would be expected that all available exits would be utilised, and passengers would be evacuated as quickly as possible as per the documented emergency procedure. The operator’s evacuation at the terminal procedure identified additional considerations when an evacuation occurred at a terminal, which included the use of stairs and aerobridges; however, this did not indicate that these options should be used instead of other available exits.

When the captain issued the evacuation command, the aerobridge was being connected to door L1, which provided an easy means of escape for passengers near that door. Of the other exits, 2 doors with slides were opened promptly at the rear of the aircraft (L4 and R4), with R3 also being available soon after (see below). L2 was connected to an aerobridge about 1 minute after the evacuation command, and R1 and R2 were not opened.

Although L2 eventually had an aerobridge connected, there was no reason that the R2 exit could not have been opened as the cabin crew member had assessed that the exit was clear on 2 occasions. They based the decision not to open the exit on an assumption but no visual evidence of an external fire, and possibly the fact that there was an aerobridge already connected at L1 and there was a flow of passengers towards that exit.

The R1 exit remained closed due to a vehicle being seen outside initially; however, this exit was not reassessed for availability. The L2 exit was also not checked for availability to ensure that an aerobridge was being connected and to facilitate it being available as soon as possible.

Ultimately, most of the passengers in the front of the aircraft were directed to the L1 exit to evacuate for the first 50 seconds of the evacuation. Although using the aerobridge reduced the risk of physical injuries on this occasion, not opening available exits in an evacuation as soon as practicable can have catastrophic consequences depending on the situation.

Operation of the doors during the evacuation

Two of the 4 cabin crew who opened a door with the intention to activate an escape slide did not rearm the door before opening it (L3 and R3). One of the cabin crew members then promptly closed the door, rearmed the door and opened it again to activate the slide (R3).

The cabin crew members were all trained and assessed against the operator’s published and approved procedures, and they were all qualified to operate the flight. However, the training for an evacuation at the terminal was limited. Cabin crew had practiced the procedure for an evacuation at a terminal during initial training, which identifies additional considerations such as ensuring that the doors are rearmed. Nevertheless, the cabin crew had not practiced the procedure in recurrent training for a number of years, and most of the cabin crew had not practiced the procedure since their initial training.

The operator’s procedure to open the doors in an emergency stated that they should open the door ‘ARMED’, and this implied that the cabin crew should first check the door was armed. Reports from cabin crew advised that in their annual training and assessment, the door was always in the armed position in an evacuation scenario, and therefore it was not habitual for them to check that the door was armed prior to opening.

In comparison, the manufacturer’s procedure explicitly stated that the person should check that the door was armed before opening. It would therefore be beneficial to ensure that the procedure for opening the door in an emergency includes a step that ensures that the cabin crew check the status of the door prior to opening, and that cabin crew are trained to check that the door is armed, regardless of where an evacuation occurs.

Review of procedures after landing  

Just after the cabin crew at the rear of the aircraft (L4 and R4) were alerted to the haze/smoke in the cabin, they completed a verbal review of evacuation procedures together, which included discussion about the need to rearm their doors if an evacuation was required. As a result, they were prepared for the evacuation, rearmed their doors when the evacuation command was given, and successfully deployed both escape slides.

Both the rear cabin crew members recalled utilising the silent review concept with each other just prior to the evacuation being called. The silent review is a well-known tool utilised by cabin crew during the take-off and landing stages of flight and will usually be undertaken when the no-contact phase is in place. The use of this same premise, coupled with communicating what actions were required, is a great example of the use of non-technical skills by these cabin crew members. Cabin crew should be encouraged to mentally rehearse their procedures anytime they have been alerted to an abnormal situation, as well as during take-off and landing, and it would be advisable that crew members are reminded to remain alert to any abnormalities until everyone has safely disembarked the aircraft.   

Cabin baggage and use of escape slides  

Passenger safety briefing

Information about what to do with cabin baggage in an emergency and the use of escape slides was provided to passengers in a safety video (with audio and subtitles) and was supplemented by the information in the safety briefing card. However, the content provided to passengers was both limited and inconsistent in the following ways:

• The procedure to descend the escape slide safely included instructions about jumping past the girt bar, keeping legs straight with toes pointed upwards; this information was not included in the safety video. Although the briefing card had a pictorial that could be interpreted as having a requirement to jump and slide with toes pointed upwards, it could not be determined to what extent passengers had this interpretation.
• The safety video showed a passenger sitting and then sliding, which is not the recommended means of using an escape slide. As research has shown, this method (rather than jumping first) can cause delays in an evacuation.
• The safety video showed a passenger leaning back with their hands on their knees, rather than leaning forward, which is the safest means of use.
• The briefing card showed a person jumping and crossing their arms to descend the slide. Although this would be an acceptable position when sliding, it was not consistent with the operator’s procedure or the safety video.
• The safety video depicted a passenger putting their cabin baggage next to the slide as they sat down to descend the slide. However, it is obviously preferable that passengers do not bring cabin baggage to the exits at all.
• The briefing card showed a small pictorial of a bag with a circle and a line through it to indicate to passengers that cabin baggage should not be taken when exiting; this was the only reference to the requirement to leave bags behind on the briefing card.
• The in-flight announcements (just prior to landing) did not include a reminder to leave cabin baggage behind in an emergency.
• There was no information provided about how to descend the escape slide safely with infants and children, either in the information provided to passengers or in the operator’s procedures for cabin crew.

Although there is no guarantee that passengers will attend to safety information provided to them in pre-flight safety briefings, there have been a number of developments in the utilisation of audio/visual presentations (video) by operators, using entertainment in an attempt to gain passenger attention. However, there has been no research that has proven that this approach leads to safer outcomes in emergencies.

Regulatory requirements dictate what information must be provided to passengers orally and in a written format, and in this case those minimum requirements were met. However, the operator’s safety video provided the information in differing contexts outside of the aircraft environment. For example, it utilised a slide at an amusement park rather than an actual aircraft emergency evacuation slide. In this part of the safety video, the audio and subtitles provided information about the use of the escape slides and the requirement to leave cabin baggage behind, but the visual content did not match the audio information.

The majority of airlines who fly domestically in Australia do not use a safety video and are not required to do so; rather, information about cabin baggage and slide use is provided orally (using a pre-recorded announcement or a public announcement by the cabin crew) and via the safety briefing card. Utilising a video can certainly be useful in providing passengers a visual representation of actions they may be required to take. However, to be most effective, the information in the video about cabin baggage and the use of the slides should be consistent with the information given in both the safety card and the audio, and clearly outline the required actions.

Research conducted by the NTSB (2000) and the ATSB (2004) found that passengers tend not to look at the safety briefing card, and even if passengers do look at the card not all of them will understand the instructions provided. The NTSB also found that passengers believed that the safety briefing should include information on how to operate the exits and escape slides. As it cannot be guaranteed that a passenger will attend to and understand the information provided on a safety briefing card, it should only be used as a supplement to the oral briefing and not the primary source of safety information provided.

The management of passengers in an emergency situation is the last line of defence in avoiding injury and fatalities. Therefore it is important that passengers are well informed through the provision of sufficient and accurate communication about what they may be required to do. It is widely known that more knowledgeable passengers will be better equipped to react appropriately in an emergency, and that briefing passengers does in fact increase passenger survivability (Meng-Yuan, 2014). In this occurrence, the passengers were provided with information that was limited and inconsistent, and this meant that there was more reliance on cabin crew providing instructions to passengers on what to do during the evacuation.

Commands used during the evacuation

Qantas’s cabin crew primary evacuation commands to passengers did not include phrases such as 'leave everything behind' and 'jump and slide'; instead, these phrases were optional. Consequently, passengers would generally not receive specific guidance about required actions until they reached an exit, which would likely slow down an evacuation.

Interviews with all 8 cabin crew indicated that the commands they used to instruct passengers were consistent with the core commands documented in the operator’s Aircrew Emergency Procedures Manual (AEPM), which were those they had practiced in training. However, some of the cabin crew reported that they had not utilised the ‘other recommended commands’.

It is very likely that passengers may attempt to evacuate with cabin baggage in an emergency, particularly when disembarking at a terminal, and there have been examples where confrontation with cabin crew at the exits has caused an interruption to the evacuation flow. Accordingly, it is important that cabin crew advise passengers at the beginning of the evacuation to leave everything behind. This may not stop all passengers bringing cabin baggage to the exit but may prevent some passengers from attempting retrieval, and can limit the potential number of bags brought to the exits.

In terms of escape slide use, almost all passengers will have never had the opportunity to utilise an aircraft escape slide and therefore will rely on the cabin crew to provide instruction on its use. The passenger safety briefing and briefing card in this occurrence provided conflicting and limited information, and this made the reliance on cabin crew instructions even greater. The cabin crew reported only providing additional instruction to passengers when they reached the slide, some of which were not consistent with guidance provided by the manufacturer and others for safe and efficient slide use in an emergency, for example ‘sit and slide’, ‘get out’.

Research has shown that the trained evacuation commands used in an evacuation should be aligned with those used during certification. This is because when the aircraft is certified, the testing that is undertaken provides assurance that not only the aircraft design is effective, but also the procedural aspects such as cabin crew commands are too. Without additional testing or research, a significant change to those commands becomes an unknown in terms of their effectiveness. For example, the operator no longer requires the passengers to form 2 lines for dual lane slides and does not always use the command to jump (onto the slide).

Passenger behaviour during the evacuation

Passenger behaviour in emergencies will always be unpredictable, particularly given that many emergencies will have unique aspects. However, in several previous evacuations passengers have taken cabin baggage, even when instructed explicitly not to.

In this case it was reported that passengers were reasonably compliant when given instruction directly. Given the timing of the evacuation, where some passengers were already standing getting ready to disembark, it is also understandable that they would have already retrieved some cabin baggage. However, it was still very evident that a significant number of passengers retrieved baggage after the evacuation command, and some evacuated with cabin baggage using the escape slides. This resulted in a slower evacuation pace. In this case, the risk of harm from the fumes was less once the doors were opened and the cabin was ventilated. Therefore, there was a lower risk of incapacitation or significant effects from exposure to the atomised hydraulic fluid.

Video footage and reports from the cabin crew showed that many passengers were unaware of what to do when they used the evacuation slides. Some passengers reportedly sat and slid, and others went down the slide on their knees or were lying down. Six passengers were injured as a result of using the escape slides, with a variety of injuries reported, including friction burns to the hands. Friction burns to the hands are a result of placing hands on the slide when sliding down. This is partly why the recommended safe slide position includes placing the arms across the chest or on the knees, the other reason is to provide stability and maintain a slower speed.

The passenger who was seriously injured could not recall any instructions prior to or during the evacuation about how to descend the escape slide. It could not be determined whether other passengers who received injuries paid attention to the information provided in the safety video, or whether they could recall the information.

Post evacuation

The operator’s procedures required that both the flight and cabin crew assist passengers on the tarmac after they have evacuated, until relieved by emergency services. On this occasion, emergency services were present when the evacuation occurred. Nevertheless, none of the cabin crew provided assistance to the passengers who had evacuated using the slides. The cabin crew, who have first aid training, may have been able to assist in attending to passengers on the tarmac, particularly those with injuries.

Cabin crew did ask the captain if they should exit via the slides, however the captain gave the cabin crew the choice of evacuating via the aerobridges. Both the cabin crew and the flight crew exited via the aerobridges, with the flight crew proceeding to the tarmac to report to the fire commander and provide assistance, before returning to the terminal.

The operator’s procedures, and the procedures of the aviation rescue fire fighting service (ARFFS), stipulated that the fire commander was required to conduct a risk assessment of the aircraft before flight crew, cabin crew and ground personnel, were cleared to re-enter. However, following the evacuation, cabin crew continued to re-enter the aircraft cabin to collect cabin baggage and other items for both passengers and other crew members. Other personnel also entered the aircraft cabin. They did so without being given a clearance that it was safe to do so. These personnel were not equipped to re-enter the cabin, nor were they in a position to conduct an informed assessment of the risk.

Rapid disembarkation

The objective of an evacuation is to optimise the use of all available exits. The captain on this occasion commanded an evacuation believing that it was necessary to get out of the aircraft as quickly as possible. The captain was aware of haze, mist or smoke in the flight deck and cabin, was not sure of the source of the problem, and was aware that the problem was getting worse.  Given this context, the captain’s decision to evacuation was appropriate.

However, to reduce the number of potential injuries related to escape slide use, a rapid disembarkation (if available) may be a suitable alternative in other situations where there may be a need to get out of the aircraft quickly, but not with the same level of urgency. This includes situations such as a fuel spill, fumes event or bomb threat where the rapid disembarkation can be upgraded to an evacuation if required.

In this case, at least some of the cabin crew were inadvertently actioning a form of rapid disembarkation/rapid deplaning procedure, as opposed to an evacuation that required all available exits to be used and the aircraft to be ‘evacuated’ as quickly as possible. Although the captain had commanded an evacuation, some of the cabin crew had assessed that there was no immediate danger in the cabin, and had decided that it was in the best interests of passengers to only use certain exits and at a slower pace.

For example, the cabin crew in the forward section of the aircraft who did not have an aerobridge connected, upon establishing a flow of passengers, did not continue to check outside their exits to determine if they were usable and instead decided to redirect passengers to the exits connected to the aerobridges. In addition, the cabin crew member at R3 changed their commands for passengers reaching the exit to sit down and slide.

This assessment by the cabin crew of less urgency did not result in any adverse outcomes on this occasion. However, without any further consultation with the flight crew, the cabin crew may not have had all the information to effectively downgrade the emergency response.

As evidenced in the operator’s training material, a captain could initiate an evacuation and nominate the use of some exits only. However, adding specific instructions to an evacuation procedure can add complexity to the situation, and the use of selected exits would be more compatible with a rapid disembarkation procedure, if available. A rapid disembarkation procedure can be upgraded to an evacuation at any time. However, it is more difficult to go the opposite way and downgrade an evacuation after it has been initiated, which also has the potential to lead to an increased number of injuries to passengers.

Having a rapid disembarkation procedure ensures that there is a broader framework for crews to use to respond to abnormal or emergency events. It also ensures that flight crew and cabin crew will be routinely trained and assessed in the use of the procedure for responding to particular types of events.

As highlighted by a number of investigation reports, accidents around the world continue to show that there is a significant risk of injury to passengers when escape slides are used. This risk is acceptable in a life-threatening situation where the alternative may be catastrophic; however in cases such as a fumes event, fuel spill or other similar situation where passengers can be disembarked in a quick but controlled manner, particularly if an aerobridge is already attached, a procedure that allows passengers to disembark quickly in a controlled manner may be preferable to prevent unnecessary injury.

Findings

From the evidence available, the following findings are made with respect to the hydraulic system malfunction, return and evacuation, involving Airbus A330, VH-EBC on 15 December 2019.

Contributing factors

• The rudder servo hydraulic system pressure hose ruptured in flight, depleting the green hydraulic system of fluid, which necessitated a return to Sydney.
• After the auxiliary power unit (APU) was started and bleed selected on, and the aircraft was towed back to the terminal, the leaking hydraulic fluid was ingested into the APU air intake. The atomised hydraulic fluid, which appeared as haze, mist or smoke, was then distributed into the cabin and flight deck through the air conditioning system, resulting in the captain deciding to evacuate the aircraft.
• A number of passengers evacuated using the escape slides in a manner that increased the risk of injury (for example, on their knees, lying down or sitting before sliding, or with hands on the slides). Of the 93 passengers that used the escape slides to exit the aircraft, one was seriously injured and 5 received minor injuries.

Other factors that increased risk

• Although some cabin crew members had detected unusual smells both before and after the aircraft had been towed back to the terminal, they did not pass this information on to the flight crew prior to the captain’s decision to initiate an evacuation.
• Although some of Qantas’s A330 aircraft were fitted with an emergency evacuation signal, the emergency evacuation checklist located in the flight deck for these aircraft did not include the use of the evacuation signal. In addition, there was no documented procedure that detailed when the evacuation signal should be used by cabin crew.
• A cabin crew member did not open an available exit even though they had observed that there were no signs of smoke, fire or obstruction outside the aircraft. Rather, they assumed that there was fire outside due to haze/smoke being visible inside the cabin.
• During the evacuation, one cabin crew member did not assess outside conditions properly and 2 cabin crew members did not continue to check exit availability, instead directing passengers to the available aerobridge(s).
• The aircraft evacuation occurred at a time when cabin crew members had completed their shut-down duties and the doors had all been disarmed, with an aerobridge already connected to the aircraft. As a result, 2 exit doors were opened in the disarmed mode. Although one of these exits was then armed and reopened and the slide deployed, the other exit remained open without the slide deployed and was declared blocked.
• Qantas’s cabin crew recurrent training did not include any situation whereby a disarmed door would have to be rearmed in an emergency. This increased the likelihood that a door would be opened without the escape slide deployed, reducing the number of available exits. (Safety issue)
• Qantas’s method of briefing passengers provided limited and inconsistent information about how to use the escape slides safely and what to do with cabin baggage in an emergency. (Safety issue)
• Qantas's cabin crew primary evacuation commands did not include phrases such as 'leave everything behind' and 'jump and slide'; instead, these phrases were optional. Consequently, passengers would generally not receive specific guidance until they reached an exit, which would likely slow down the evacuation. (Safety issue)
• Some passengers evacuated utilising the slides and aerobridges carrying their cabin baggage. As a result, the evacuation was delayed and the risk of injury to themselves and others was increased.
• Following the evacuation, the cabin crew did not assist the passengers who had evacuated using the slides on the tarmac (as required by Qantas’s procedures).
• Following the evacuation, the passengers were cleared from the cabin, but the cabin crew and other staff members re-entered the cabin prior to the aircraft being deemed safe by emergency services (as required by Qantas’s procedures).
• Qantas did not have a procedure for a rapid disembarkation, or other similar procedure that would effectively enable rapid deplaning at a slower and more controlled pace than an emergency evacuation. Therefore, the only option for rapid deplaning was an emergency evacuation utilising slides, which unnecessarily increased the risk of injuries in some situations. (Safety issue)

Other findings

• Just after the cabin crew at the rear of the aircraft were alerted to the haze/smoke in the cabin, they completed a verbal review of evacuation procedures together, which included discussion about the need to rearm their doors if an evacuation was required. As a result, they were prepared for the evacuation, rearmed their doors when the evacuation command was given, and successfully deployed both escape slides.

Safety issues and actions

Passenger safety information

Safety issue number: AO-2019-073-SI-03
Safety issue description: Qantas’s method of briefing passengers provided limited and inconsistent information about how to use the escape slides safely and what to do with cabin baggage in an emergency.

Evacuation commands

Safety issue number: AO-2019-073-SI-01
Safety issue description: Qantas's cabin crew primary evacuation commands did not include phrases such as 'leave everything behind' and 'jump and slide'; instead, these phrases were optional. Consequently, passengers would generally not receive specific guidance until they reached an exit, which would likely slow down the evacuation.

Cabin crew training

Safety issue number: AO-2019-073-SI-02
Safety issue description: Qantas's cabin crew recurrent training did not include any situation whereby a disarmed door would have to be rearmed in an emergency. This increased the likelihood that a door would be opened without the escape slide deployed, reducing the number of available exits.

Procedure for a rapid disembarkation

Safety issue number: AO-2019-073-SI-05
Safety issue description: Qantas did not have a procedure for a rapid disembarkation, or other similar procedure that would effectively enable rapid deplaning at a slower and more controlled pace than an emergency evacuation. Therefore, the only option for rapid deplaning was an emergency evacuation utilising slides, which unnecessarily increased the risk of injuries in some situations.

Safety action not associated with an identified safety issue

Additional safety action by Qantas Airways Limited

Replacement of hydraulic hoses in 4 of the oldest A330’s

Even though the manufacturer did not recommend proactive replacement of the hoses, the operator advised that it had replaced the hoses for the green system on its 4 oldest A330 aircraft as a precautionary measure.

Periodical replacement program for all 3 hydraulic systems

Qantas implemented a periodical replacement program (discard limit) for the pressure supply line to the rudder hydraulic servo on all 3 hydraulic systems on its A330 fleet. This was to be repeated at 8 years or 12,000 flight cycles, whichever came first, on both mechanical controlled rudder aircraft (hose part number AE2464379H0316) and fly-by-wire rudder (different hose part numbers).

Procedure for the management of smoke/fumes on the ground

Following the occurrence, in April 2021 the operator made changes to its procedures in its Flight Administration Manual (FAM) to include further considerations when a smoke/fumes event occurs on the ground:

FAM Section 22.10.X Management of Smoke / Fumes Events On The Ground (A330 Only) Smoke/Fumes Abnormal Procedures should be utilised to manage both on ground and inflight events. On the ground and after an associated system failure e.g. hydraulic system leak, the APU BLEED valve should remain closed until Engineering personnel (where available) perform an external visual inspection to confirm that there is no risk of fluid ingestion into the APU inlet.

In addition, the following caution was added to the Flight Crew Operating Manual (FCOM) in the section that instructed flight crew on what to do if there was a nose-wheel steering fault:

If the NWS is inoperative due to hydraulic fluid loss, APU bleed air should not be used to supply the air-conditioning packs during towing due to the risk of hydraulic fluid ingestion into the APU inlet and resulting smoke and/or fumes in the cabin. If cabin temperatures become excessive, APU bleed may be used to supply the air-conditioning packs only after an engineer performs an external visual inspection to confirm there is no risk of fluid ingestion into the APU inlet.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew and cabin crew on VH-EBC
• Qantas Airways Limited
• the Civil Aviation Safety Authority
• Airbus
• Airservices Australia
• the Sydney Airport Corporation Limited.

References

Australian Transport Safety Bureau (2004) Public attitudes, perceptions and behaviours towards cabin safety communications’, ATSB Research and Analysis Report.

Corbett C L (2005) Caring for precious cargo, Part II: Behavioural techniques for emergency aircraft evacuations with infants through type III overwing exits. Federal Aviation Administration.

Meng-Yuan L (2014) An evaluation of an airline safety education program for elementary school children. Evaluation and Program Planning. 

National Transportation Safety Board 2000, ‘Safety Study: Emergency Evacuation of Commercial Airplanes’, NTSB/SS-00/01 PB2000-917002, Washington DC, USA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Civil Aviation Safety Authority (CASA)
• the flight crew and cabin crew on board VH-EBC
• French Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile
• Qantas Airways Limited
• Airbus
• Airservices Australia.

Submissions were received from Qantas Airways Limited, Airbus and CASA. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Glossary

Appendices

Appendix A – Hydraulic system supply overview

Figure 16 shows the hydraulic system architecture on the Airbus A330 and the system redundancies in design. The diagram shows that the green hydraulics are the primary system with the blue and yellow systems providing redundancy for flight controls and secondary functions such as engine thrust reversers.

Figure 16: A330-200 hydraulic system supply diagram

Source: Qantas

Appendix B – Operator cabin crew land evacuation impact drill

Appendix C – Research and previous occurrences related to rapid disembarkations

The National Transportation Safety Board (NTSB) in its Safety study: Emergency Evacuation of Commercial Airplanes (2000) discussed the importance of the assessment and utilisation of all available exits in an evacuation, rather than the nomination of certain exits by flight crew or cabin crew. There was however recognition of an alternative procedure (rapid deplanement) that permitted the use of only some exits that had stairs already available and when there was no imminent threat to the passengers.

Qantas utilised this NTSB report, in part, to justify a response to an ATSB recommendation that was issued following the evacuation of VH-OJH in July 2003, during which an over-wing slide was used during the evacuation following a brake fire. The ATSB recommendation text included:

Safety Recommendation R20050003

The Australian Transport Safety Bureau recommends that Qantas Airways Ltd, review the adequacy of their procedures for the deployment of over-wing slides during known brake fire situations. This review should take into consideration the visual cues used and potential risk to passengers of evacuating within close proximity of a fire zone.

The operator’s response to this recommendation also identified the precautionary disembarkation procedure as an alternative to an evacuation where exits could be nominated:

Qantas has a Precautionary Disembarkation procedure that caters for disembarkation in non-normal circumstances when a evacuation is not yet but maybe required. This allows certain doors to be directed for use during disembarkation in an expeditious but planned manner.

The ATSB has reported on the use of a precautionary disembarkation procedure in a number of previous investigations, including 2 other investigations into occurrences that involved the operator.^[25] Following the investigation into an in-flight uncontained engine failure involving an Airbus A380-842 (QF32) in November 2010, the ATSB noted:

The crew’s decision to perform a precautionary disembarkation via the stairs likely provided the safest option, particularly given the low immediate safety threat and the elevated risks associated with an emergency evacuation into a potentially hazardous external environment.

The French Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA) investigation into an occurrence involving smoke in the cabin during boarding and evacuation of passengers involving a Boeing 777 in July 2013^[26] identified a problem with the operator not having a rapid evacuation (rapid deplaning) procedure. The investigation report noted that the captain did not have a procedure for the strategy that they wanted to implement, which was to get passengers and crew off quickly using the aerobridges. In this case the captain used language that was not suited to the situation, and, with the absence of a procedure, cabin crew were in doubt about what the evacuation instruction meant. It was noted in this investigation that other airlines had implemented such a procedure. Safety action taken by the French operator included the development of a rapid deplaning procedure as an alternative to an evacuation.

The United Kingdom Air Accidents Investigation Branch (AAIB) investigated a smoke event resulting in an evacuation at London Heathrow airport on 26 June 2016, involving an Airbus A330-323 aircraft.^[27] In this instance, just following boarding, while still connected to the aerobridge, smoke filled the aircraft cabin. The cabin crew attempted to contact the captain but were unsuccessful. As a result, the cabin crew initiated an evacuation, which the captain tried to stop. It was noted in the investigation report that an ‘Emergency Deplaning’ drill may have been more appropriate but did not exist at the time. Safety action taken by the operator included the development of an emergency deplaning procedure as an alternative to an evacuation.

Research conducted by the Royal Aeronautical Society published in its paper Emergency Evacuation of Commercial Passenger Aeroplanes (2020) discussed the relevance and use of a procedure as an alternative to an evacuation, stating:

Some incidents might require passengers to leave the aeroplane with some degree of urgency, but not necessarily via evacuation slides. Rapid disembarkation might be preferable to an evacuation in circumstances where, for example, there are fumes in the passenger cabin, or there has been a large fuel spillage outside the aeroplane, or the commander has been advised that an explosive device might be on board.

The report also advised that conducting a rapid disembarkation rather than the use of evacuation slides has the potential to avoid external hazards such as ground service equipment and vehicles, as well as ground personnel. In such circumstances, injury to aircraft occupants and ground personnel can be avoided. However, unlike the operator’s previous rapid disembarkation procedure that had the option to use slides, the report suggested that the rapid disembarkation could only be achieved when airstairs and/or aerobridges were connected to the aircraft or could be rapidly repositioned at floor level emergency exits.

Appendix D – Airbus response to recommendation SR49/2016

__________

25. ATSB investigation 199904538 Boeing 747-438, VH-OJH Bangkok, Thailand 23 September 1999 and ATSB investigation AO-2010-089 In-flight uncontained engine failure overhead Batam Island, Indonesia 4 November 2010 VH-OQA
26. BEA investigation into Boeing 777-300, F-GSQA Smoke in cabin during boarding, evacuation of passengers, Paris Charles de Gualle Airport, 28 July 2013
27. AAIB investigation into Airbus A330-323, N276AY Emergency evacuation at parking stand after APU failure filled cabin with smoke, London Heathrow Airport, 26 June 2016

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 14 December 2019, two pilots were conducting a private flight in an Angel Aircraft Corporation Model 44 aircraft, registered VH-IAZ, at Mareeba, Queensland. An instructor seated in the right pilot seat was conducting a flight review of the pilot (and aircraft owner) in the left seat.

The aircraft took off from Mareeba Airport at 1058 Eastern Standard Time,^[1] after which witnesses reported hearing one of the engines hesitating and backfiring, accompanied by a sooty smoke trail from the right engine. The aircraft operated in the training area until returning to the airport circuit area at 1112. Witnesses observed the aircraft touch down on the runway, accelerate and take off again. After take-off, the aircraft climbed to about 100-150 ft above ground level before entering a right descending turn. The aircraft was airborne for about 20 seconds before witnesses observed it rolling rapidly to the right and impacting terrain in a cornfield 475 m north of the runway. The pilots sustained fatal injuries and the aircraft was destroyed.

What the ATSB found

Based on the witness reports of abnormal engine sounds and because the instructor had planned to conduct a simulated engine failure after take-off, the ATSB assessed whether the accident occurred following a simulated or real engine failure.

Examination of the fuel system found that two of the fuel injectors in the right engine showed evidence of partial blockage by corrosion particles. Such blockage would have resulted in the over-fuelling of the other injectors and the engine running overly rich; reducing the maximum power available from that engine. There was, however, no evidence of a complete power loss, with both engines producing power at the time of impact.

The ATSB found that shortly after take-off, the flight instructor very likely conducted a simulated failure of the right engine in environmental conditions and a configuration in which the aircraft was unable to maintain altitude with one engine inoperative. Power was not immediately restored to the right engine to discontinue the exercise and the pilots were unable to maintain altitude or heading, particularly with the aircraft banked towards the inoperative engine. The pilots did not reduce power and land ahead, as required by the Airplane Flight Manual, resulting in a loss of directional control and roll. The loss of control occurred at a height too low to recover and the aircraft impacted terrain.

The instructor had limited experience in multi-engine aeroplanes with retractable landing gear and only one short flight in the Angel 44 aircraft several years earlier. Therefore, the instructor was likely unfamiliar with the time necessary for the landing gear and flaps to retract (significantly longer than other aircraft the instructor had flown) and the associated detrimental effect that extended flaps and landing gear had on the aircraft’s single-engine climb performance. This likely influenced the decision to initiate a low-level simulated engine failure and diminished the instructor’s ability to interpret and manage the situation.

Additionally, the pilot (in the left seat) had not flown for 3 years prior to the accident flight, which likely resulted in a decay of skills at managing tasks such as an engine failure after take-off. The pilot probably over-estimated their self-assessed competency for the planned task and did not demonstrate proficiency at a safe height before the low-level simulated engine failure.

The ATSB found that the right-side altimeter was probably set to an incorrect barometric pressure, resulting in it over-reading the aircraft’s altitude by about 90 ft.

The aircraft had not been flown regularly for more than 2 years and the engines had not been preserved in accordance with the manufacturer’s procedures. Both engines had mild internal corrosion and the right engine had signs of water contamination within the fuel system, including in the engine‑driven fuel pump and fuel injection servo. Corrosion particles in the fuel injection servo likely originated from the fuel tank. These particles lodged in two of the fuel injection nozzles and contributed to the right engine running overly rich, backfiring and a reduction in maximum power available.

Safety message

Flight reviews

Flight reviews that are conducted without the oversight of a training organisation remove the opportunity to include training. Due to the known limitations of self-assessed competency, pilots who choose this option should have recent demonstrated proficiency in all of the required exercises.

Simulated engine failures

In light twin-engine aeroplanes, loss of power on one engine shortly after take-off poses a high risk due to low altitude, low airspeed and generally limited single-engine climb performance. The asymmetric thrust can lead to a loss of directional control that, if mishandled, will likely result in an accident due to insufficient height above the ground to recover.

The regulatory requirement to use simulators for conducting engine failure after take-off exercises has eliminated the risk for those aircraft where simulators are available. However, where simulators are not available, there is still a requirement to perform the exercise in the aircraft. In those situations, it is essential to understand the risks and ensure effective controls are in place to prevent the simulation turning into a loss of control at low level, where recovery will probably not be possible. Consideration of these risks should include:

• the method of simulating engine failure
• instructor/check pilot training, experience and proficiency specific to the aircraft make and model
• ensuring the pilot/student has first demonstrated the ability to maintain asymmetric control at a safe height and understands handling one engine inoperative flight and associated risks
• thorough pre-flight briefing including minimum control speed, configuration including flaps and landing gear, safe intentional single-engine speed, one engine inoperative climb performance and limitations
• ensuring the aircraft is in a configuration and at an airspeed at which climb with one engine inoperative is possible
• criteria for aborting the procedure including airspeed, height above terrain/obstacles, directional control and bank angle
• effect of, and time required to restore power to the simulated inoperative engine
• understanding when a reduction in power and landing ahead may be ultimately necessary to avoid a loss of control.

Attempting to continue flight with one engine inoperative in a multi-engine aeroplane when directional control cannot be maintained, carries a high risk of an accident and fatal injuries.

Airframe and engine preservation

If an aircraft is not flown regularly, the airframe and engine/s should be preserved in accordance with the manufacturer’s procedures. Incorrect or inadequate preservation can increase the likelihood of in-flight failures, with the associated safety risks.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.

The occurrence

On 14 December 2019, at 1046 Eastern Standard Time,^[2] an Angel Aircraft Corporation Model 44 aircraft, registered VH-IAZ (Figure 1), commenced taxiing at Mareeba Airport, Queensland. On board the aircraft were two pilots. The pilot in the left seat (‘the pilot’) owned the aircraft and was undertaking a flight review,^[3] which was being conducted by the Grade 1 flight instructor in the right seat (‘the instructor’). The planned flight was to operate in the local area, as a private flight and under visual flight rules.^[4]

Figure 1: VH-IAZ (when formerly registered as VH-IOZ)

Source: Aircraft maintainer

As the aircraft taxied towards the runway intersection, the pilot broadcast on the common traffic advisory frequency (CTAF)^[5] that VH-IAZ was taxiing for runway 28.^[6] The pilot made another broadcast when entering and backtracking the runway, then at 1058, broadcast that the aircraft had commenced the take-off roll.

Witnesses who heard the aircraft during the take-off reported that it sounded like one of the engines was hesitating and misfiring. An aircraft maintainer who observed the aircraft take off, reported seeing black sooty smoke trailing from the right engine. The maintainer then watched the aircraft climb slowly and turn right towards the north. Another witness who heard the aircraft in flight soon afterwards, reported that it sounded normal for that aircraft, which had a distinctive sound because the engines’ exhaust gases pass through the propellers.

Once airborne, the pilot broadcast that they were ‘making a low-level right-hand turn and then climbing up to not above 4,500 [feet] for the south-west training area.’

About 2 minutes later, the instructor broadcast that they were just to the west of the airfield in the training area at 2,500 ft and on climb to 4,000 ft, and communicated with a helicopter pilot operating in the area. After 8 minutes in the training area, the pilot broadcast that they were inbound to the aerodrome.

At 1112, the aircraft’s final transmission was broadcast by the pilot, advising that they were joining the crosswind circuit leg for runway 28.

Witnesses then saw the aircraft touch down on the runway and continue to take off again, consistent with a ‘touch-and-go’ manoeuvre, and heard one engine ‘splutter’ as the aircraft climbed to an estimated 100–150 ft above ground level. At about 1115, the aircraft was observed overhead a banana plantation beyond the end of the runway, banked to the right in a descending turn, before it suddenly rolled right. Witnesses observed the right wing drop to near vertical and the aircraft impacted terrain in a cornfield. Both pilots were fatally injured and the aircraft was destroyed (Figure 2).

Figure 2: Accident site showing the take-off direction, initial impact point and fuselage resting position

Source: ATSB

__________

2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. Flight reviews are required to ensure pilots continue to be competent in exercising the privileges of their licences and ratings.
4. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
5. The CTAF is the frequency on which pilots operating at a non-controlled aerodrome should make positional radio broadcasts.
6. Runway number: the number represents the magnetic heading of the runway. Runway 28 at Mareeba was on a magnetic heading of 283°.

Context

Flight crew information

Pilot medical status, qualifications and experience

The 73-year-old pilot’s Class 1 aviation medical certificate had expired in February 2017. Although the pilot had attended a general practitioner and completed a Class 2 medical examination on 12 August 2019, the requirements to be issued with a medical certificate had not been completed at the time of the accident.

The pilot held a commercial pilot licence (aeroplane) and had accrued over 20,000 flying hours, approximately 300 of which were in VH-IAZ. When purchasing the aircraft, the pilot had completed aircraft type training in the Angel 44 aircraft with the manufacturer in the United States (US). The pilot had operated the aircraft for commercial passenger-carrying charter flights and had previously been authorised by the Civil Aviation Safety Authority (CASA) to perform training in it, although that authority had lapsed.

In 2015, the pilot had completed flight instructor and instrument rating proficiency checks, but those ratings were no longer current. The pilot had last flown in June 2016, in VH-IAZ (which at the time was registered VH-IOZ). Also in 2016, the pilot had completed a flight review, valid for 2 years, which expired in February 2018.

Instructor medical status, qualifications and experience

The 63-year-old instructor had a valid a Class 1 medical certificate, and was in the process of renewing it, as it was due to expire in January 2020.

The instructor held an air transport pilot licence (aeroplane), current multi-engine aeroplane class, instructor and instrument ratings, and had accrued 5,029.5 hours of aeronautical experience.

According to the instructor’s logbooks, most of the recorded 976 hours of multi-engine command time was obtained in Vulcanair (formerly Partenavia) P68 C and Britten-Norman Islander aircraft, both aircraft types having fixed (non-retractable) landing gear. The instructor had also recorded limited hours in several multi-engine aeroplanes with retractable landing gear, including Piper PA34, PA31 and Cessna 421 aircraft. The instructor’s most recent experience in an aeroplane with retractable landing gear was in January 2018, when the instructor conducted flight training in a Piper PA34 aircraft.

From available evidence, the instructor’s only Angel 44 experience was ‘a circuit’ in VH-IAZ with a senior pilot on board, about 4 years prior to the accident flight. At that time, the instructor was assessed as ‘not ready’ to be employed as a charter pilot operating the aircraft.

The day before the accident flight, the instructor had satisfactorily completed a multi-engine instructor rating proficiency check^[7] in a P68 C aircraft with the chief flying instructor (CFI) of a flight training school based at Mareeba Airport. The CFI reported that the proficiency check involved the instructor giving a briefing on asymmetric operations and a pre-flight briefing on single-engine (simulated one engine inoperative) circuits. The flight included upper airwork in the training area near Mareeba followed by simulated engine failures in the aerodrome circuit including after take-off, which were initiated between 400 and 500 ft above ground level (AGL).

The CFI reported that the instructor came across as quite professional, with handling skills slightly above average and ‘really good’ non-technical skills.

Post-mortem and toxicology results

Post-mortem examination established that both pilots received severe, non-survivable injuries as a result of the accident.

The examination also found that the pilot had 75 per cent narrowing of one of the major coronary arteries and the instructor had 75 per cent narrowing of two of the major coronary arteries. The instructor also had significant heart enlargement with thickening of the major heart chamber and stiffening and hardening of the aortic heart valve. However, neither the pilot nor the instructor had any features to indicate a recent heart attack.

The forensic pathologist reported that:

both pilots had a sufficient degree of coronary artery narrowing (atheroma) that is associated with a significant increase in the possibility of a potentially lethal heart rhythm disturbance that might render a pilot (or passenger) unconscious or have onset of chest pain or shortness of breath that might incapacitate a pilot.

It is possible that this may have led to some level of incapacitation of either the pilot or the instructor during the accident flight, however, this can be neither confirmed nor excluded on the basis of autopsy examination.

Toxicology results included the presence of a blood pressure lowering medication in the pilot’s blood, which was consistent with that prescribed by the pilot’s general practitioner.

Aircraft information

Angel 44, VH-IAZ

The Angel Aircraft Corporation Model 44 is an eight-seat, twin-engine aeroplane with retractable tricycle landing gear (Figure 1). It was designed as a utility aircraft, with short take-off and landing capability. The aircraft is powered by two Lycoming IO-540-M1C engines with ‘pusher-configuration’ aft-mounted Hartzell three-blade constant speed feathering propellers.^[8]

The occurrence aircraft, serial number 004, was manufactured in the US in 2008. It was the only Angel 44 aircraft in Australia, where it was first registered in January 2010 as VH-IOZ. It was deregistered in November 2017 for sale and international export. The sale did not proceed, and the aircraft was re-registered, this time as VH-IAZ, in March 2019. VH-IAZ was approved to operate under instrument flight rules^[9] and in the charter category and was fitted with dual flight controls. The aircraft had a maximum gross weight for take-off and landing of 2,630 kg (5,800 lb).

Aircraft maintenance history

The aircraft was to be maintained as per the CASA maintenance schedule, with a periodic inspection required every 100 hours or 12 months, whichever came first. Table 1 details the recent maintenance and operational history of VH-IAZ.

Table 1: Recent maintenance and operational history

Source: Aircraft maintainer

The two licenced aircraft maintenance engineers who maintained VH-IAZ reported that the aircraft had been ground run a few times since it was last flown, but not to a specified schedule. These ground runs were not recorded, nor were they required to be.

The last recorded flight time was on 30 September 2017 and no flights had been recorded since the aircraft was reregistered in March 2019.

A certificate of airworthiness is issued when CASA, or an authorised person, has assessed that the aircraft complies with applicable airworthiness requirements and has been satisfactorily maintained, ensuring the aircraft is in a condition for safe operation. VH-IAZ was issued with a certificate of airworthiness on 26 April 2019. This involved a review of the aircraft logbooks and continued airworthiness requirements, a visual inspection of the aircraft, and verification that engine and airframe serial numbers were in accordance with the documentation.

The authorised person reported that, at the time of the inspection, they were aware the aircraft had not been flown for some time. Therefore, the authorised person sought confirmation from the maintainers that the engine fuel components had been assessed for serviceability and that the engine internals had been checked for evidence of corrosion. Following discussion with the maintainers, the authorised person was satisfied these items had been addressed and did not identify any issues regarding the engines’ serviceability.

The current maintenance release, issued on 30 April 2019, recorded that the aircraft had accrued 1,803.5 hours total time in service. Records show that evidence of water contamination was found in the right engine fuel system at that time. Therefore, both fuel tanks were drained and flushed, filters were cleaned, and the fuel lines were flushed. After draining the tanks, 70 L of fuel was uploaded into them. They were then stored until the accident flight with significantly less fuel than the total capacity of 840 L. No flights, or additional maintenance, had been recorded on the maintenance release and the required daily inspection had not been endorsed prior to the accident flight.

Weight and balance

The aircraft was operating within the approved weight and balance envelope during the flight, at a take-off weight of 2,344 kg (5,169 lb) and a centre of gravity (CG) forward of mid-range.

Hydraulic system

The hydraulic system operates the nose, left main and right main landing gear and flaps. Hydraulic pressure is provided to the gear and flap control valves by an electric pump located in the nose of the aircraft. The landing gear and flaps were held up by hydraulic pressure and when fully extended, the landing gear was locked down by a mechanical stop and springs.

The Airplane Flight Manual (AFM) stated:

9.4.8 It is normal for the landing gears not to retract simultaneously. Since all 3 landing gears are interconnected hydraulically, the gear requiring the least pressure will retract first, then the next, and the one requiring the most pressure will be last.

9.4.9 When the landing gear and flap operations are selected simultaneously, their systems are interconnected. Since the flaps require less pressure, they will retract first. A check valve in the gear pressure line prevents the gear from going back down while the flaps are moving.

According to the aircraft manufacturer and pilots who had flown the aircraft, the landing gear took about 14 seconds to move from the extended (down) to fully retracted (up and locked) positions when selected up. As the gear and flap systems were interconnected, this time would increase if the flaps were selected up while the gear was retracting. If hydraulic pressure is lost, the landing gear will free-fall down and be locked over centre by springs.

Engine preservation

Unprotected surfaces in the engine, including cylinder walls, valves and fuel system components are susceptible to corrosion from moisture that naturally occurs in aviation fuels and the atmosphere. It is widely acknowledged that aircraft located in humid regions, and near the ocean and lakes, are at a greater risk of damaging corrosion than those in dry, low humid areas.

When a six-cylinder engine is stationary, generally at least one valve will be open in four of the six cylinders. With the day/night heating and cooling cycle, there is an exchange of air via the inlet or exhaust systems. If the air is warm and humid when it flows in and the engine then cools down, the water vapour can condense in the cylinders. This accumulation of moisture on the surfaces can lead to corrosion. Similarly, air exchange via the crankcase breather results in condensation in the oil. This can lead to formation of acidic compounds that promote surface corrosion.

In-service engines will generally self-purge the moisture through the combustion process and heating of the lubricating oil, which will provide a degree of protection to this corrosion. Engines in aircraft that are not flown frequently, and those that have flown less than 50 hours in total, are especially susceptible to corrosion. In this instance, effective storage procedures are required to ensure that the serviceability of the engine is maintained.

Storage procedures

The aircraft maintenance manual detailed three storage procedures when the aircraft is not expected to be flown for a period. For all three storage methods, the pitot^[11] tube should be covered.

Flyable storage procedures – where the aircraft is not expected to be flown for an indefinite period but is kept in a condition to ‘fly quickly’ included:

• Turn each engine by hand at least 5 revolutions each week to redistribute the oil and ensure the engine does not ‘end up in the same place each time.’
• Keep fuel tanks as ‘full’ as possible.
• The aircraft wheels should be chocked and the aircraft tied down securely, if stored outside.
• After 30 days, the aircraft should be flown for at least 30 minutes, or ground run until the oil reaches operating temperature.

Short-term storage procedures – where the aircraft is not expected to be flown for a period of up to 3 months included:

• The engine is to be inhibited by spraying a small amount of corrosion inhibitor through the spark plug holes and oil filler tube.
• Cover exhausts, pitot, static and cowl openings.
• Lock landing gear retraction linkage.
• Disconnect or remove the battery.

Long-term storage procedures – where the aircraft is not expected to be flown for an extended indefinite period included:

• The aircraft should be stored inside or under some type of cover if possible.
• Replace the engine oil with a defined lubricating mixture and fly the aircraft for 15-30 minutes, then spray the lubricating mixture into the cylinders and replace upper spark plugs with blanks. Respray the cylinders and interior of the engine at least every 6 months.
• An alternate method is as per short-term storage, but de-inhibit the engine and run it every 90 days, before reapplying corrosion inhibitor.

The engine manufacturer, Lycoming, also had procedures for corrosion prevention in engines that will be inactive for a period up to 30 days. These were similar to the aircraft maintenance manual procedure for short-term storage, in that the engine is sprayed with corrosion preventative oil. In addition, the engine manual had the note:

Ground running the engine for brief periods of time is not a substitute for the following procedure; in fact, the practice of ground running will tend to aggravate rather minimise this corrosion condition.

Lycoming Service Letter L180B Engine preservation for active and stored aircraft reinforced the requirement for short-term storage, of up to 30 days, and long-term storage practices, particularly in humid environments. Long-term storage also included the use of a desiccant,^[12] which should be inspected at least every 15 days.

Further, CASA airworthiness bulletin 85-021 Piston engine low utilisation maintenance practices reinforces following the manufacturer’s procedures to prevent corrosion.

The fuel injector manufacturer, Precision Airmotive also published short- and long-term storage requirements in their operation and service manual. In addition, this manual stated:

A complete overhaul is mandatory regardless of any FAR [US Federal Aviation Regulation] operational category when the injector or fuel system component has been subjected to severe environment such as but not limited to…contaminated fuel such as water, rust sand, etc.

Recorded data

The aircraft was not equipped with a flight data recorder or cockpit voice recorder, nor was it required to be.

Post-accident examination and assessment

Accident site

The accident site was located in a cornfield about 475 m north of the runway at Mareeba Airport. Based on an analysis of the wreckage and ground marks, it was evident that the aircraft impacted terrain right wingtip first, while travelling in a northerly direction. The nose landing gear impacted the ground about 33 m beyond the initial impact point, after the right wing had fractured and collapsed under the weight of the aircraft. At that point, the fuselage was at, or slightly over, vertical, and the cockpit folded under and to the left.

The aircraft then slid on its left wing at about mid-span, until the left wingtip dug into the terrain, resulting in the fuselage lifting and clearing a section of corn, before coming to a halt, upright, and 67 m from the initial impact point.

An assessment of the area beyond the runway identified that obstacle-free forced landing areas were limited to a road which ran perpendicular to the runway (Figure 2).

On-site examination

From the accident site examination, there was no evidence of an in-flight breakup or discontinuity of the flight controls that may have contributed to a loss of aircraft control. The rudder trim lever was in the neutral position and the elevator trim was fully forward in the down position.

The left altimeter QNH was set to 1013^[13] and the right altimeter QNH was set to 1009. Due to the design of the selector, these settings were unlikely to have moved during impact. An aerodrome forecast service for Mareeba Airport was available from the Bureau of Meteorology, which included forecast QNH. Additionally, an Aerodrome Weather Information Service was available by phone or VHF radio, which provided actual QNH. However, it could not be determined whether the pilots accessed either service prior to the flight.

Landing gear and flaps

The landing gear selector was in the up position. The nose landing gear was fully or almost fully retracted, the right main landing gear was partially extended, and the left main landing gear was extended and on the mechanical (down) lock. However, the electric pump for the hydraulic system detached from the aircraft when the nose impacted the ground. This removed the hydraulic pressure required to hold the landing gear and flap up. After that, the main landing gear (and flap) was able to free-fall. As such, the main landing gear was either retracted and free-fell down during the impact sequence, or was not fully retracted before impact. From the observed flight path, the aircraft was airborne for about 20 seconds; for approximately 5 of those seconds after take-off, the landing gear remained extended. This left a maximum of about 15 seconds for all three wheels to retract to the up-and-locked position. As it took about 14 seconds for the landing gear to retract, and longer as the flaps also retracted (see section Hydraulic system), it was probable that the landing gear had not fully retracted prior to impact.

The normal take-off flap position was 20 degrees extension. At the accident site, the flap was extended 5-15 degrees, however, the associated paint transfer mark on the fuselage indicated that the flap was likely up or almost fully up prior to impact and was pushed down in the accident sequence. The flap selector lever was at about a 45-degree angle, indicative of the flaps selected in the fully extended position, but due to disruption of that part of the panel during the impact sequence, it was not indicative of the actual flap position.

Engines and propellers including controls and indications

Both of the fuel mixture levers were fully forward in the ‘rich’ position, with the fully aft position denoted ‘lean’. The propeller pitch levers were both fully forward in the full fine position, denoted ‘Hi RPM’, with the fully aft position denoted ‘feather’. The left throttle lever was fully forward in the ‘open’ position, with the aft position denoted ‘close’. The right throttle lever was at mid-travel and was likely at that position prior to impact, as the lever had been bent to the right during the impact sequence. That position was consistent with the right engine tachometer, which was stuck at about 1,300 RPM and was likely in that position immediately prior to impact.

For both a normal take-off and in response to an (actual) engine failure after take-off, the expected lever positions would be all six levers in the fully forward position.

Initial on-site examination found no evidence of pre-impact mechanical, electrical or other catastrophic failure to either engine or propeller assembly. The propeller blades indicated that both engines were making power at impact, with the right engine operating at lower power than the left. The propellers and engines were taken to specialist facilities for further examination.

Propeller examination

Chord-wise scoring and leading-edge damage was present on both propellers, consistent with the propellers operating under engine power (not windmilling) during the impact sequence.

The left propeller had all three tips missing, one of which was severed twice and another had twisted during separation. This was consistent with the left engine producing significant power at the time of impact. The right propeller blade tips had not detached.

The location of the pusher-propellers and impact sequence, including the materials the blades passed through, likely affected the blade damage signatures. The right blades typically showed less substantial markings from having passed through soil, vegetation and the fuselage. The left propeller blades had more damage, due to impact with the airframe including the wings.

Engines and fuel system examination

There was no evidence of catastrophic failure of the engines or fuel system components. All magnetos and spark plugs were tested and found serviceable.

Mild corrosion was evident in cylinder bores of both engines. While the internal corrosion was consistent with inadequate preservation and storage of the engines, it was unlikely to have contributed to significant power loss or engine failure.

There was no evidence of water contamination in the left engine fuel system. The right engine-driven pump and right fuel injection servo unit carried a black residue – consistent with water contamination. For this to occur, the right engine would have to have been run with water contamination in the fuel.

When tested, the fuel injector nozzles from cylinders No. 2 and 4 on the right engine had reduced flow due to particulate contamination. Partially obstructed fuel injectors had the potential to contribute to the unaffected cylinders running overly rich. This was consistent with carbon deposition observed in the No. 2 and No. 4 cylinder exhaust and witness reports of a dark sooty trail emitting from the right engine on the first take-off of the flight.

ATSB examination found the particulates were consistent with iron-oxide (corrosion). The contamination and deposits in the right engine had the possibility to reduce engine efficiency and performance, but the broader effect on the flight could not be determined.

Weather and environmental information

At 1115 EST, the temperature at Mareeba Airport was 34 ºC, the dewpoint 15 ºC, and the wind from 266º (westerly) at 6 kt gusting to 9 kt. There was no cloud and the QNH was 1012 hPa.

The aerodrome elevation was 1,650 ft and with the given temperature and QNH, the density altitude^[14] was 4,440 ft.

Planned flight

Purpose

The purpose of the flight was to conduct a flight review so the pilot could exercise the privileges of a multi-engine aeroplane class rating.

Preparation

The ATSB obtained evidence to determine what opportunities the instructor had to gain familiarity with the aircraft prior to the flight. On 30 November 2019, the pilot contacted the instructor to ask whether they could do this flight review. The instructor responded being happy to do the review and would be qualified to do so following completion of an instructor rating renewal (proficiency check). The instructor anticipated needing about 1 hour on the ground to become familiar with the aircraft and reported having flown it previously, with an experienced pilot. On December 10, the instructor arranged to conduct the instructor rating renewal on December 13 and confirmed with the pilot that they would do the flight review on December 14.

Documents that the instructor carried immediately before and/or during the accident flight included information about the P68 C aircraft flown the previous day for the instructor rating renewal and regulations pertaining to flight reviews. There was no information about the Angel 44 aircraft.

Pre-flight planning

On the morning of the accident flight, the pilot departed from a friend’s house at about 0800. A witness saw the pilot conducting engine run-ups in VH-IAZ at about 0915 and closed-circuit television (CCTV) footage showed the aircraft taxi and park near the maintainer’s hangar at 0922.

CCTV footage showed the pilot and instructor walking past the hangar together in a westerly direction at 0950, both carrying flight bags. About 21 minutes later, they walked east towards the parked aircraft. It is probable that the plan for the flight was discussed between them during that time, and as they walked to the aircraft, the pilot can be heard to say ‘right circuit’, which was the circuit direction for runway 28. Another 35 minutes elapsed before the aircraft commenced taxiing.

In-flight exercises

Table 2 shows a transcription of a document found at the accident site, confirmed to be in the instructor’s handwriting. The aircraft registration, model and date were written across the top of the page, followed by the numbers ‘10-58’ and ‘10-44’. The pilot broadcast rolling on runway 28 at 1058, consistent with the instructor logging the time the aircraft became airborne. The second time (1044) may have been the engine start time, as the aircraft commenced taxiing at 1046.

The document listed items that were required to be demonstrated for a multi-engine flight review. Of the standards required to demonstrate competency for a flight review, the list represented what could be considered a bare minimum of the required procedures (see section Flight reviews). Of the listed exercises, some had been ticked, presumably to indicate they were complete. The item ‘Missed approach’ was ticked. The next item on the list was a short-field landing, which was consistent with witnesses observing the aircraft touch down just before commencing the second take-off, rather than a missed approach, where it would not be expected to touch down. A simulated engine failure after take-off was next in the sequence, which was to be followed by a single-engine approach and landing. A diagram that the instructor had drawn on the same document as the list, showed a missed approach followed by an engine failure after take-off in a single circuit pattern.

Table 2: Transcribed copy of handwritten plan for the flight

Source: Retrieved from the accident site by Queensland Police, transcribed by ATSB

Flight reviews

Flight instructor requirements

The instructor held grade 1 training and multi-engine aeroplane training class rating endorsements and was authorised to do the flight review in accordance with Civil Aviation Safety Regulations (CASR) including 61.1175. However, the instructor was not authorised to include any training, as the review was not being conducted under the oversight of a training organisation.

General competency requirement

To operate an aircraft, pilots are required to be competent. CASR 61.385 Limitations on exercise of privileges of pilot licences—general competency requirement, included:

1. The holder of a pilot licence is authorised to exercise the privileges of the licence in an aircraft only if the holder is competent in operating the aircraft to the standards mentioned in the Part 61 Manual of Standards for the class or type to which the aircraft belongs, including all of the following areas:

a) operating the aircraft’s navigation and operating systems;

b) conducting all normal, abnormal and emergency flight procedures for the aircraft;

c) applying operating limitations;

d) weight and balance requirements;

e) applying aircraft performance data, including take-off and landing performance data, for the aircraft.

Flight review requirements

CASR 61.745 Limitations on exercise of privileges of aircraft class ratings—flight review, required a pilot to complete a flight review within the previous 24 months to exercise the privileges of a rating, in this case a multi-engine aeroplane class rating. As the pilot had not completed a flight review within the 24 months prior to the accident flight (or completed CASA medical requirements), the instructor was the pilot-in-command for the flight.

The CASA publication Flight crew licensing—Flight reviews, described a flight review as an opportunity to receive training that refreshes your flying skills and operational knowledge.

It stated that the instructor is responsible for designing appropriate content for your flight review. A flight review should include training, so it is not just an assessment.

It explained that if the review includes training, it must be done under an approved training organisation.

However, while CASA strongly encourages pilots to include training within their flight reviews, flight reviews could be conducted as a private flight, not under the oversight of a training organisation, as long as training was not included.

The publication further stated that the requirements of a flight review are met when the instructor conducting the review is satisfied you have demonstrated competency for the rating according to the Part 61 Manual of Standards (MOS).

If on initial assessment, the instructor deemed that the pilot needed training, that would then have to be conducted with the oversight of a training organisation.

CASR 61.400 Limitations on exercise of privileges of pilot licences—flight review, required the pilot to demonstrate in the flight review, that they are competent in each unit of competency mentioned in the Part 61 MOS for the rating.

Relevant standards

Of particular relevance to this occurrence, the Part 61 MOS standards required to demonstrate competency for a multi-engine aeroplane class rating flight review, included:

2.6 FR-MEAC.6 – Manage non-normal and emergency conditions

(a) manage a simulated engine failure in the take-off segment;

(b) manage a simulated partial engine failure;

(c) manage a simulated complete engine failure and execute a simulated asymmetric approach and landing;

(d) manage aircraft system malfunctions.

CASA does not provide a definition of the ‘take-off segment’ or what maximum height above the runway this extends to. However, CASA guidance recommends that instructors consider not conducting simulated engine failure in the take-off segment exercises below 400 ft (see Simulated engine failures after take-off).

Comparison flight review requirements

The US Federal Aviation Regulations also required a flight review every 2 years with an instructor, with some exemptions. A US flight review must consist of a minimum of 1 hour of ground training and 1 hour of flight training. The FAA did not permit flight reviews to be conducted without including training. The US Federal Aviation Administration (FAA) advisory circular (AC) 61-98D – Currency requirements and guidance for the flight review and instrument proficiency check, provided the intent of a flight review as ‘a training event in which proficiency is evaluated.’ The AC advised that flight reviews should always include abnormal and emergency procedures.

Regarding instructor qualifications, the FAA AC advised that:

For aircraft in which the flight instructor is not current or with which he or she is not familiar, he or she should obtain recent flight experience or sufficient knowledge of aircraft limitations, characteristics, and performance before conducting the review.

Additionally, US Federal Aviation Regulation 61.195 stipulated that a flight instructor may not give training in a multi-engine aeroplane, unless they have at least 5 flight hours of pilot-in-command time in the specific make and model aeroplane.

Transport Canada provides several means for private pilots to remain current and proficient, including a biennial component, of which one option is a flight review conducted by an instructor. The alternative options to a flight review include attending a seminar or completing on-line study.

The European Union Aviation Safety Agency’s multi-engine piston rating for aeroplanes was valid for 1 year. To revalidate the rating, a pilot must pass a proficiency check with an approved examiner, in a multi-engine piston (single-pilot) aeroplane or an approved simulator. During the rating validity period, the pilot must have completed at least one route sector of a single-pilot multi-engine aeroplane with an examiner.

Multi-engine class rating and the Angel 44

The Angel 44 aircraft was included in the multi-engine aeroplane class rating. This means that CASA assessed it as not having unusual performance or handling characteristics compared with other light (under 5,700 kg) twin-engine aeroplanes. International Civil Aviation Organization Annex 1 recommended (2.1.3.1.1) that class ratings should be established for aircraft for single-pilot operations which have ‘comparable handling, performance and other characteristics.’

The last pilot to fly the aircraft prior to the accident flight had about 30 hours of experience in it. That pilot reported that the controls were all familiar but slightly unusual. Having previously conducted a simulated engine failure after take-off at about 500 ft above the ground, the pilot reported that the aircraft handled normally when the yaw was corrected, the standard actions performed and blue-line speed (see section Key speeds below) was maintained. While that pilot would not recommend a pilot flew it without any training, the pilot’s expectation was that any commercial multi-engine rated pilot should be able to manage a circuit with both engines operative.

A pilot with extensive experience flying Angel 44 aircraft advised that the aircraft was more ‘docile’ than other twin-engine aeroplanes and had less propeller torque effect due to the geometry of the engines and propellers. That pilot reported that during take-off, unlike other twin-engine aeroplanes, it yaws right (rather than left), so left rudder is needed to keep straight. However, with one engine inoperative, it is the same as other twin-engine aeroplanes in that opposite rudder (to the inoperative engine) is used to counteract the yaw. That pilot confirmed that the initial actions following an engine failure are the same as for other twin-engine aeroplanes.

The experienced pilot further commented that if a pilot was new to the aircraft, it would take several hours in the aircraft to be competent and 5 to 12 hours to get comfortable with it. The pilot advised that in the US, although the regulations require an instructor to have 5 hours before they can instruct in an aircraft, insurers generally require 12 hours experience in the aircraft make and model.

Asymmetric flight

Asymmetric control

In light twin-engine aeroplanes, with one engine inoperative, the asymmetric thrust will cause the aeroplane to yaw (rotate about its vertical axis) towards the inoperative engine. As a secondary effect of yaw, it will also roll. The yawing needs to be countered by deflection of the rudder and a small aileron deflection to raise the inoperative engine wing in order to maintain straight flight or ‘directional control’. The amount of rudder deflection needed increases as the operative engine power increases and airspeed reduces, to a minimum control speed, below which the rudder is ineffective in maintaining directional control. Angle of bank has a large effect on the minimum control speed, and if the aeroplane is banked towards, instead of away from the inoperative engine, the minimum control speed increases significantly.

Below the minimum control speed, the pilot must reduce power on the operative engine to reduce the asymmetric force, and/or lower the aircraft nose to increase airspeed, to prevent a loss of control. If directional control is lost, the aircraft will yaw and then roll rapidly. While controlled flight can be recovered if enough height is available, reducing power and lowering the nose when close to the ground may result in a landing. The US FAA Airplane Flying Handbook Chapter 12 stated:

Landing under control is paramount. The greatest hazard in a single-engine take-off is attempting to fly when it is not within the performance capability of the airplane to do so. An accident is inevitable.

Performance requirement

Subsection 8 of Civil Aviation Order 20.7.4 required multi-engine aeroplanes below 5,700 kg to be able to climb at a gradient of 1 per cent, or to maintain height, as follows:

8.1 Multi-engined aeroplanes engaged in charter operations under the Instrument Flight Rules or aerial work operations under the Instrument Flight Rules must have the ability to climb with a critical engine inoperative at a gradient of 1% at all heights up to 5 000 feet in the standard atmosphere in the following configuration:

(a) propeller of inoperative engine stopped;

(b) undercarriage (if retractable) and flaps retracted;

(c) remaining engine(s) operating at maximum continuous power;

(d) airspeed not less than 1.2 VS [stalling speed].

8.2 Multi-engined aeroplanes (other than those specified in paragraph 8.1) must have the ability to maintain height at all heights up to 5 000 feet in the standard atmosphere in the configuration specified in subparagraphs 8.1 (a), (b), (c) and (d).

Key speeds

Three key ‘V’ speeds critical to understanding the accident flight were specified in the Angel 44 AFM. They are stalling speed, best rate of climb speed with one engine inoperative, and minimum control speed.

These reference V speeds are published for specific configurations and the actual V speeds will be different in any other configuration. The ATSB investigation considered the published V speeds and the likely actual V speeds associated with the aircraft’s probable configuration when the loss of control occurred.

The aircraft configuration was:

• approximately 5,100 lb (2,313 kg) weight
• CG slightly forward of mid-range
• flaps up or nearly up
• landing gear partially retracted
• 15 degrees right wing down angle of bank
• left engine at full power
• right engine between idle and 1,300 RPM
• right propeller not feathered.

Stalling speed

Stalling speed (V_S) is defined as the minimum steady flight speed at which the aeroplane is controllable in a given configuration. V_SO is the stalling speed in the landing configuration.

The AFM specified V_SO as 57.5 kt calibrated airspeed (KCAS)^[15] for the aircraft in 1G flight at maximum gross weight, most forward CG, power off and in the landing configuration (flaps and landing gear fully extended).

However, an aircraft will stall when the critical angle of attack is exceeded, regardless of airspeed. To this end, the AFM provided a table from which to derive stalling speeds including:

• at weights less than the maximum gross weight
• flap at 0°, 20° and 37° (fully extended)
• landing gear up and down
• 0°, 15°, 30°, 45° and 60° angle of bank
• aft CG.

The stalling speed in the probable configuration at the point of loss of control was about 68 KCAS. Flight testing for aircraft certification found that full power (on both engines) reduced stalling speed by about 12 kt. Therefore, the stalling speed with 1,300 RPM on the right engine may have been 4–6 kt lower, that is, 62–64 kt.

As increase in power reduces the stalling speed, asymmetric thrust will also produce asymmetric stall characteristics, with the inoperative engine side wing stalling at a higher airspeed than the operative engine wing.

The AFM also stated that when recovering from single-engine stall, an altitude loss of 800 ft could be expected.

Best rate of climb speed with one engine inoperative

The best rate of climb speed with one engine inoperative (single-engine) (V_YSE) is marked on the airspeed indicator with a blue radial line and is therefore also known as the ‘blue-line speed’. In the Angel 44 aircraft it was a thick line or ‘sector’ marked from 90–92 KIAS (Figure 3). This represented the single-engine best rate of climb speed at maximum weight, with the lower value of 90 KIAS for 5,000 ft AMSL and the higher value of 92 KIAS for sea level. According to the AFM, the single engine best rate of climb is established in the following configuration:

• gear and flaps up
• the critical (left) engine^[16] feathered [note that the flight test data detailed in the next section states that the right engine was the critical engine but that the difference was not significant]
• full power on the right engine
• the inoperative engine wing up about 1°.

The AFM Climb performance summary table specified single-engine climb performance in feet per minute (fpm) and the associated best rate of climb speed. These were provided for gross weights of 5,800 lb (2,631 kg) and 4,800 lb (2,177 kg) and altitudes at the associated international standard atmosphere (ISA) temperatures from sea level to 20,000 ft AMSL.

Interpolating from the AFM table for the 4,500 ft density altitude (at 100 ft above ground level on the accident flight) and the aircraft weight (which was less than maximum weight), the single engine climb rate was approximately 169 fpm at a single engine best rate of climb speed of 89 KIAS. Note this equates to a climb gradient of about 1.87 per cent. Therefore, a positive rate of climb could have been expected on the accident flight if the aircraft had been configured for the best rate of climb as above.

However, compared with the configuration for best single engine climb performance, at the time of the loss of control on the accident take-off, the landing gear was probably not fully retracted, the right engine was probably simulated inoperative and the propeller was not feathered (although an engine speed of 1,300 RPM may have been selected to simulate the reduced drag from a feathered propeller) and the right wing was banked down about 15 degrees rather than up 1 degree. Therefore, the aircraft was not configured to achieve the expected rate of climb. Moreover, in the environmental conditions and with the landing gear extended, the aircraft was almost certainly unable to maintain altitude. This was specified in the AFM, which warned:

The airplane will not maintain altitude at most weights, altitudes and temperatures with gear or flaps extended.

Figure 3: Airspeed indicator from VH-IAZ showing red-line (V_MC) and blue-line (V_YSE) speeds

Source: VH-IAZ annotated by ATSB

Minimum control speed

Definition

The CASA Civil Aviation Advisory Publication (CAAP) 5.23-1(2) Multi-engine aeroplane operations and training, defined minimum control speed (V_MC) as:

a speed that is associated with the maintenance of directional control during asymmetric flight. If the pilot flies below this speed the tail fin and rudder are unable to generate enough lift to prevent the aircraft from yawing. If uncorrected, the yaw causes roll, the nose drops, the aircraft rapidly assumes a spiral descent or even dive, and if the aircraft is at low altitude, it will impact steeply into the ground. This type of accident is not uncommon in a multi-engine aircraft during training or actual engine failure.

Flight test and published figure

Minimum control speed (V_MC) is published in the AFM and obtained from testing in a specific configuration. There is both a ground value (V_MCG) and an airborne value (V_MCA), but for simplicity, V_MC usually refers to V_MCA. V_MC is marked with a red line on the airspeed indicator, and often referred to as ‘red-line speed’ (Figure 3).The AFM specified the aircraft’s minimum control speed (V_MC) as 65 KIAS and stated:

This is the minimum speed at which the airplane is controllable with takeoff power on one engine, the other engine suddenly made inoperative, 5° bank toward the operating engine, takeoff flaps (20°), and the landing gear retracted.

At the time of the Angel 44’s certification, V_MC was tested in accordance with US Federal Aviation Regulations (FAR) 23.149 Minimum control speed. This has since been replaced with FAR 23.2135 Flight characteristics - Controllability, which includes:

(c) V_MC is the calibrated airspeed at which, following the sudden critical loss of thrust, it is possible to maintain control of the airplane. For multiengine airplanes, the applicant must determine V_MC, if applicable, for the most critical configurations used in takeoff and landing operations.

The aircraft manufacturer provided details about the V_MC flight testing for the aeroplane. Because aircraft weight does not appreciably affect V_MC but does affect V_S, it is conducted at a light weight (and aircraft loaded to aft CG) to demonstrate that V_MC does not exceed 1.2 V_S1^[17] (which was 69 KCAS).

There were two steps to determining V_MC. These were conducted in the take-off configuration with flap extended 20° and landing gear down, full power on the left engine, right engine inoperative and propeller windmilling in the fully fine pitch setting.

Step 1: The aircraft was gradually slowed until directional control (heading) could not be maintained with the right wing raised 5°. This was done at various altitudes and extrapolated to sea level. For the Angel 44 aircraft, the V_MC obtained was about 61 kt and the published V_MC value was 65 kt.

Step 2: Engine cuts were performed (by pulling the mixture control) at 65 kt. The ability to maintain control (heading) and not allow speed to decay below 61 kt was verified.

The flight data computed V_MC obtained from testing decreased linearly from 65 kt at mean sea level to 54 kt at 10,000 ft, so at 5,000 ft the V_MC would be 60 kt.

The manufacturer advised that the pusher-propeller configuration significantly reduced some of the asymmetric effects of single-engine operation. While the amount of yaw was still large, the amount of roll was much less (than for a normal ‘tractor’ propeller aeroplane).

Actual minimum control speed

The published V_MC is for the specified configuration. The actual V_MC that a pilot will experience in flight varies depending on weight, altitude, rudder, thrust settings, configuration and, most significantly, on bank angle. Flight testing is generally not performed at bank angles other than with the inoperative engine wing raised 5°, as it is not required. Therefore, there is limited published data to show the effect of different configurations.

The CASA CAAP 5.23-1(2), stated that flight tests conducted in a Cessna Conquest aircraft, which had a published V_MCA of 91 kt, found that if the wings were held level instead of the inoperative engine wing raised 5°, the actual minimum control speed was 115 kt – an increase of 24 kt. Further, the testing found that lowering the wing towards the failed engine (instead of raising it), increased the minimum control speed by about 3 kt per degree of bank.

Other light twin-engine aeroplanes would similarly show an increase in actual minimum control speed with bank.

In the accident flight, witnesses assessed the aircraft’s bank angle during the right turn at 15–30 degrees. That is, 20–35 degrees in the wrong direction of bank from the published VMC. The density altitude, some power on the right engine and flap retracted, would have reduced the actual V_MC but would not diminish the bank angle effects. Additionally, as the right main landing gear was likely last to retract, due to the forces during the right turn, it would have further compounded the asymmetric drag, increasing the actual V_MC.

The US FAA Airplane Flying Handbook Chapter 12 – Transition to multiengine airplanes, stated:

The first consideration following engine failure during takeoff is to maintain control of the airplane. Maintaining directional control with prompt and often aggressive rudder application and STOPPING THE YAW is critical to the safety of flight…At least 5° of bank should be used initially to stop the yaw and maintain directional control. This initial bank input is held only momentarily, just long enough to establish or ensure directional control.

At speeds below the actual V_MC, the aircraft will lose directional control – yaw and then roll towards the inoperative engine. Transport Canada’s Instructor Guide: Multi-engine class rating (TP 11575) stated:

It cannot be too strongly emphasized that control will be regained only by a reduction in power of the good engine or by increasing airspeed through a change in pitch attitude, or both.

V_YSE as a safety margin above V_MC

In the accident flight, banking towards the inoperative engine significantly increased the actual V_MC to the extent that it probably exceeded the V_YSE (blue line) speed (90-92 KIAS). This is important as pilots often use blue-line speed as a safety margin above V_MC for initiating a simulated engine failure and assume that if blue-line speed is maintained, there is sufficient margin above red-line speed (published V_MC) to prevent an asymmetric loss of control.

However, for aircraft certification, the configurations used to determine the V_MC (red-line) and V_YSE (blue-line) speeds are different. For V_MC, the inoperative engine propeller is windmilling and wing raised 5°, the landing gear is down and the flaps are extended 20°. For V_YSE, the inoperative engine propeller is feathered, and wing raised 1°, the landing gear and flaps are retracted. Even with the propeller feathered and landing gear and flaps retracted, if the pilot turns towards the inoperative engine, actual VMC can exceed V_YSE. As it is essential to achieve and maintain an airspeed above actual V_MC in order to maintain directional control, understanding the effect of bank angle is vital to maintaining asymmetric control; particularly during take-off.

Rudder trim

Rudder deflection will be needed to control the yaw for the duration of the asymmetric flight. The rudder force that the pilot must apply can be reduced by adjusting the rudder trim. In the accident flight, the rudder trim was in the neutral position at the time of impact, however there was limited time to adjust the rudder trim before the loss of control and impact with terrain.

Engine failure procedures

The AFM contained the following emergency procedure for engine failure during take-off:

After Airborne, Gear and Flaps Still Extended:

a.  Airplane Control……………….MAINTAIN

b.  Action……………………….….LAND STRAIGHT AHEAD

             WARNING

The airplane will not maintain altitude at most weights, altitudes and temperatures with gear or flaps extended.

If airspeed is below 65 KIAS, reduce power on operative engine as required to maintain lateral & directional control.

After Gear & Flaps Retracted:

a.  Airplane Control……………...…MAINTAIN

b.  Airspeed…………………...........VYSE OR GREATER

c.  Throttle (inoperative engine)…..CLOSE

d.  Propeller (inoperative engine)…FEATHER

e.  Throttle (operative engine)…….AS REQUIRED

f.  Enroute Checklist……………….COMPLETE AS ABLE

Point a. Airplane Control, is maintained with use of rudder to counteract yaw and aileron to raise the inoperative engine wing 5°. The warning that ‘if airspeed is below 65 KIAS…’ only applies in the demonstrated VMC configuration. If the inoperative engine wing is not raised 5°, a speed higher than 65 KIAS will be needed to maintain directional control.

Consistent with the warning in the published procedure, the FAA Airplane Flying Handbook stated:

When operating near or above the single-engine ceiling and an engine failure is experienced shortly after lift-off, a landing must be accomplished on whatever essentially lies ahead…

Remaining airborne and bleeding off airspeed in a futile attempt to maintain altitude is almost invariably fatal. Landing under control is paramount. The greatest hazard in a single-engine takeoff is attempting to fly when it is not within the performance capability of the airplane to do so. An accident is inevitable.

The manufacturer reported that on take-off, the Angel 44 aircraft accelerates to the 90 kt take-off safety speed ‘pretty quickly.’ In case of engine failure below that speed, a pilot would need to lower the aircraft nose and descend to achieve the required speed.

The Angel 44 AFM did not contain guidance for conduct of simulated engine failures (after take-off), provide a safe intentional single-engine speed,^[18] or specify a safe altitude at which to conduct them. At the time of the aircraft certification, it was not required to provide this information.

Simulated engine failures after take-off

Civil Aviation Safety Authority guidance for simulated engine failures

Civil Aviation Advisory Publication (CAAP) 5.23-1(2) – Multi-engine aeroplane operations and training was produced by CASA in part, to provide advice on multi-engine training following ‘a number of multi-engine aeroplane accidents caused by aircraft systems mismanagement and loss of control by pilots, flight instructors and persons approved to conduct multi-engine training’.

The CAAP specified risks associated with multi-engine training as:

• inappropriate management of complex aircraft systems
• conducting flight operations at low level (engine failures after take-off)
• conducting operations at or near VMCA or VSO with an engine inoperative^[19]
• errors
• asymmetric operations including:
  • inadequate pre-take-off planning and briefing
  • decision making
  • aircraft control
  • performance awareness and management
  • operations with feathered propellers
  • missed approaches and go-arounds
  • final approach and landing
  • stalling.

To mitigate these risks, it suggests that:

Instructors should consider not simulating engine failures below 400 ft above ground level (AGL) to provide a reasonable safety margin. The use of simulators has reduced the perils of this activity. Other mitigating factors are:

• well trained instructors

• complete knowledge of the theoretical factors involved during asymmetric operations

• proven procedures, provided these are strictly adhered to

• comprehensive pre-flight and pre-take-off planning and briefings

• ongoing training

• situation awareness

• flying competency.

Section 6.5 of the CAAP, Simulating engine failures, advised instructors to ‘be aware of the implications and be sure of their actions,’ before simulating an engine failure. Further, that they ‘must ensure that the aircraft is not in a dangerous situation to start with, such as the aircraft is flying too slow, too low, is in an unsuitable configuration or hazardous weather (wind, ice or visibility) is present. There is no benefit introducing more risks than the emergency being trained for.’

A CASA subject matter expert provided the following comments regarding simulated engine failures after take-off.

• The risk of not doing practice engine failures after take-off exceeded the risk of doing them. However, CASA had not conducted a risk assessment and were not required to do so by legislation for historical regulations.
• The suggested 400 ft AGL minimum height in CAAP 5.23-1(2) is general in nature and not specific to a particular aircraft type. This suggested minimum is consistent with a common point in the take-off path utilised in the certification. [US Federal Aviation Regulation 23.2120 for level 3 (7-9 passengers) low speed (VNO and VMO less than or equal to 250 KCAS)^[20] aeroplanes requires a 1 per cent climb gradient at 400 ft above the take-off surface with the landing gear retracted and flaps in the take-off configuration. This was not in effect at the time VH-IAZ was certified and no similar criteria then applied to the aircraft. Based on data provided in the AFM, in the accident environmental conditions, and in the stated configuration, VH-IAZ would have met (and exceeded) this criterion.]
• Simulating engine failures after take-off is necessary because it is representative of what may occur. At lower density altitudes the operative engine will have better performance and the aircraft will have better climb performance.
• Conducting these at a higher altitude such as 3,000 or 5,000 ft AGL would still not ensure recovery in all instances, such as from a VMCA departure. However, altitude provides an opportunity to regain speed [by lowering the aircraft nose and descending].
• The drills and hand and muscle movements should be practised at height then that skill and muscle memory taken to the after-take-off scenario, where there is potential for the ‘startle effect’. Conducting engine failures after take-off invokes an emotional response necessary to train for a real engine failure at low height above the ground.
• The competency check must be done in the environment where the skill is going to be used.

US Federal Aviation Administration

The US Federal Aviation Administration (FAA) Flying light twins safely brochure included the following training recommendation:

Low-altitude engine failure is never worth the risks involved. Multiengine instructors should approach simulated engine failures below 400 feet AGL with extreme caution, and failures below 200 feet AGL should be reserved for simulators and training devices.

The US FAA 

included the following guidance regarding altitude and speed for simulating engine failures.

When training in an airplane, initiation of a simulated engine inoperative emergency at low altitude normally occurs at a minimum of 400 feet AGL to mitigate the risk involved and only after the student has successfully mastered engine inoperative procedures at higher altitudes. Initiating a simulated low altitude engine inoperative emergency in the airplane at extremely low altitude, immediately after liftoff, or below VSSE creates a situation where they [sic] are non-existent safety margins.

US National Transportation Safety Board

Due to a number of fatal accidents in the US where pilots did not maintain control following a loss of power in one engine while flying multi-engine aeroplanes, the US National Transportation Safety Board issued safety alert SA-081 – Maintain airplane control with one engine inoperative. It stated:

These accidents demonstrate that having a multiengine rating alone may not be enough to avoid the risk of loss of aircraft control with one engine inoperative (OEI), especially if engine failure occurs during a critical phase of flight.

Recommendations in the safety alert included:

• Be thoroughly familiar with the recommended procedures and checklists for OEI operations—particularly the memory checklist items—in the airplane flight manual and pilot operating handbook.

• Ensure that you have a multiengine rating and establish multiengine proficiency.

• Seek training in any new multiengine airplane model you fly to ensure that you fully understand the relationship between OEI and VMC for each phase of flight and the proper recovery techniques for that airplane.

Flight training organisations

Based on the assessment that a large number of simulated engine failures after take-off are conducted every day in Australia without incident, the ATSB spoke to flight instructors from several flight training organisations to see what risk controls were used. Instructors usually used 400 ft AGL as a minimum height but would start higher until the student was proficient. The aircraft would be accelerated to the manufacturer-recommended minimum safe intentional one-engine inoperative speed or blue-line speed before simulating the engine failure. As soon as the student either did not maintain heading or airspeed, the instructor would restore power and discontinue the exercise.

Related occurrences

Training accidents

A review of the ATSB occurrence database revealed that in the 10 years between 2008 and 2017, there were 24 accidents for twin-engine, VH-registered, aircraft under 5,700 kg^[21] conducting training or checking. Of these, three involved an asymmetric simulated engine failure on take‑off or climb.

The only fatal training accident during that period occurred on 30 May 2017. An inductee pilot undergoing a proficiency check, a chief pilot conducting the check and a CASA flying operations inspector observing the flight were on board a Cessna 441 (Conquest II) aircraft. Shortly after take-off from Renmark Airport, South Australia, a simulated engine failure was conducted at about 400 ft above the ground. The expected single-engine climb performance and airspeed were not achieved, and the exercise was not discontinued. Consequently, about 40 seconds after initiation of the simulated engine failure, the aircraft experienced an asymmetric loss of control, from which recovery was not made.

The aircraft impacted the ground, all on board were fatally injured and the aircraft was destroyed. (ATSB investigation AO-2017-057). The investigation’s safety message was:

Conducting a simulated engine failure after an actual take-off is a high-risk exercise with little margin for error. For that reason, Cessna recommended practicing this sequence in the [Cessna] 441 aircraft at a height of 5,000 ft above ground level to allow the opportunity for recovery in the event that control is lost.

A review of past accidents indicates that, while accidents associated with engine malfunctions are rare, training to manage one engine inoperative flight (OEI) after take‑off is important. The ATSB recommends that such training should follow the manufacturer’s guidance and, if possible, be conducted in an aircraft simulator. If the sequence is conducted in the aircraft close to the ground, then effective risk controls need to be in place to prevent a loss of control as recovery at low height will probably not be possible. Such defences include:

• defined OEI performance criteria that, if not met, require immediate restoration of normal power

• use of the appropriate handling techniques to correctly simulate the engine failure and ensure that aircraft drag is minimised/OEI performance is maximised

• ensuring that the involved pilots have the appropriate recency and skill to conduct the exercise and that any detrimental external factors, such as high workload or pressure, are minimised.

The two other asymmetric training accidents were:

• On 23 December 2010, a flight instructor and student pilot departed Camden Airport, New South Wales on an instrument training flight in a Piper PA-30 (Twin Comanche) aircraft. Shortly after take-off, the instructor simulated an engine failure by moving the mixture control on the right engine rearwards at 400 ft above the ground. In response, the student reduced the engine control/s on the left engine. Shortly after, the airspeed decayed, and the aircraft stalled. The aircraft rolled abruptly, with the right wing dropping to a 120° angle and the aircraft entered a spin. The instructor regained control of the aircraft at about 10 ft above ground level, with the aircraft in a relatively level attitude. As the nose of the aircraft was raised the airframe began to shudder, indicating that a stall was imminent. Consequently, the instructor elected to reduce the throttles to idle and land the aircraft. The aircraft subsequently impacted the ground resulting in minor injuries to the instructor. The student was not injured. (ATSB investigation AO-2010-111).
• On 10 July 2009, a flight instructor and student were conducting asymmetric circuit refresher training in a Beechcraft Aircraft 76 at Bunbury Airport, Western Australia. During a go-around from a practice asymmetric landing, the flying pilot flared too high and bounced on one wheel. While the instructor said ‘I have control’, the student pilot applied power on the good engine, and (under 50 ft above the ground) the aircraft yawed right then impacted the ground in a flat attitude. The aircraft was seriously damaged but there were no reported injuries (ATSB occurrence number 200904058).

Engine failure and malfunction occurrences

For the same 10-year period (2008-2017) and types of aircraft, there were 405 actual engine failures or malfunctions reported to the ATSB. Of these, 43 per cent were in the take-off/climb phases of flight. Only 9 resulted in accidents (2%), but 78 per cent of accidents were in the take-off/climb phases of flight. Five accidents followed a single engine failure on take-off or climb that resulted in asymmetric thrust:

• On 6 February 2009, a Piper PA-31 aircraft was on a business flight departing from Darwin, Northern Territory. During the initial climb, the right engine gradually lost power. The aircraft failed to climb, and the pilot shut the engine down and feathered the propeller. The aircraft did not maintain altitude and subsequently the pilot landed the aircraft on water. The pilot and five passengers walked to shore in knee deep water (ATSB occurrence number 200900366).
• On 23 March 2010, a Piper PA-30 was conducting a ferry flight to the United States. During the initial climb from San Francisco Airport, the left engine failed at 60 ft above the ground. The aircraft veered left and lost height until it struck the ground. The aircraft was seriously damaged but the pilot was not injured (ATSB occurrence number 201001978).
• On 15 June 2010, a Piper PA-31P aircraft, with a pilot and a flight nurse on board departed Bankstown Airport, New South Wales for a repositioning flight to Archerfield Airport, Queensland in preparation for a medical patient transfer flight. While the aircraft was climbing to 9,000 ft the right engine sustained a power problem and the pilot subsequently shut down that engine. Following the engine shut down, the aircraft’s airspeed and rate of descent were not optimised for one engine inoperative flight. As a result, the aircraft descended to a low altitude over a suburban area and the pilot was then unable to maintain level flight, which led to a collision with terrain. Both occupants were fatally injured and the aircraft was destroyed (ATSB investigation AO-2010-043).
• On 14 November 2010, a Piper PA-31 aircraft was being operated on a passenger charter flight from Marree, South Australia. During the climb, at 2,500 ft, the pilot detected an unusual noise in the right engine followed by a gradual decrease in engine performance. The pilot returned to Marree Airport, however during the turn back the aircraft was unable to maintain altitude and elected to conduct a forced landing about 22 km south-east of the airport. The pilot did not feather the right engine as he assessed that the right engine was still producing some power. The aircraft was substantially damaged, however, the passengers and crew were able to exit the aircraft safely (ATSB investigation AO-2010-094).
• On 8 March 2015, the pilot of an Aero Commander 500 aircraft taxied for a charter flight from Badu Island to Horn Island, Queensland, with five passengers. The pilot commenced rotation and the nose and main landing gear lifted off the runway. Just as the main landing gear lifted off, the pilot detected a significant loss of power from the left engine. The aircraft yawed to the left, which the pilot counteracted with right rudder. He heard the left engine noise decrease noticeably and the aircraft dropped back onto the runway. The pilot immediately rejected the take-off; reduced the power to idle, and used rudder and brakes to maintain the runway centreline. Due to the wet runway surface, the aircraft did not decelerate as quickly as expected and the pilot anticipated that the aircraft would overshoot the runway. To avoid a steep slope and trees beyond the end of the runway, he steered the aircraft to the right towards more open and level ground. The aircraft collided with a fence and a bush resulting in substantial damage. The pilot and passengers were not injured (ATSB investigation AO-2015-028).

Risks associated with simulated and actual engine failures

While the risks associated with practice engine failures have mostly been eliminated for large air transport category aeroplanes through the use of simulators, accidents continue to occur worldwide as a result of simulated engine failures after take-off in flight in smaller (under 5,700 kg) multi-engine aeroplanes. The ATSB was unable to find any analyses or studies that had been conducted into the relative benefits versus risks of conducting simulated engine failures after take-off.

The above data on Australian accidents and incidents from 2008 to 2017 was used in the ATSB investigation into the fatal accident at Renmark in 2017 (described above) to conclude:

A review of the ATSB occurrence database identified that there were three accidents during asymmetric training/checking flights in the last 10 years, with this accident being the only one with a fatal outcome.

Over the same time period there were nine accidents associated with actual engine failures/malfunctions in ‘small’ aeroplanes like the Cessna 441, four of which followed a single engine failure on take-off/climb that resulted in asymmetric thrust but no injuries. One of the accidents was fatal and followed an engine failure at an altitude of about 7,500 ft. The nine accidents represented two per cent of the total number of engine failure/malfunction occurrences. However, 78 per cent of the accidents occurred during the take-off/climb phase of flight despite only 43 per cent of the total engine failures occurring during that flight phase.

The data indicates that while accidents associated with engine malfunctions are rare, training to manage OEI flight after take-off is important.

At present there is insufficient information available to accurately assess the accident rate associated with simulated engine failures, compared to the accident rate of actual engine failures occurring after take-off. Specifically, there is no data collected about the number of times asymmetric exercises are conducted in aircraft in Australia, in either flight training or company-based training and checking, which means the exposure is unknown.

Without knowing the exposure rate and how the training exercises are being conducted, including whether they accurately represent the conditions of a real engine failure, the ATSB could not determine whether the benefits of conducting simulated engine failures at low level outweighed the risks. Further research in this area is required to answer that question.

Skill decay

A pilot’s technical and non-technical skills decay when they are not used. To mitigate against this, pilots are subject to recency requirements to assess, practise and retain their skills.

Childs and Spears (1986) suggest that cognitive and procedural elements of flying skills decay more rapidly than control-oriented skills. Pilots whose skills had decayed, had difficulty correctly identifying cues and classifying situations, but once a situation was correctly classified, they remembered what to do.

Casner and others (2014) noted that hand-eye skills were quite resistant to forgetting, but decay was more significant for ‘…the set of cognitive skills needed to recall procedural steps, keep track of which steps have been completed and which steps remain, visualize the position of the aircraft, perform mental calculations, and recognize abnormal situations.’ In addition, skill decay is more significant for procedural tasks with many steps and where the steps must be recalled in a specific order (Wisher and others 1999).

Simulated engine failures are predominantly procedural tasks, which require a set of actions to be completed. They are an abnormal situation and have serious consequences if not managed appropriately. These require well-rehearsed, proficient physical and mental skills as well as rapid cognition of the situation and decision making.

__________

7. A proficiency check is an assessment of a pilot’s skills and knowledge in a particular operational area. Pilots are required to undertake proficiency checks to ensure they continue to be competent conducting particular kinds of operations. After gaining a qualification, it is normal for some skills to deteriorate over time.
8. Feathering: the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.
9. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
10. The aircraft had a total fuel capacity of 840 litres.
11. The pitot tube is part of the aircraft’s pitot-static system, which is used to determine airspeed and altitude. A pitot tube blocked by insects or other foreign matter will result in erroneous airspeed indications.
12. Desiccant: a hygroscopic substance used as a drying agent.
13. QNH: the altimeter barometric pressure subscale setting used to indicate the height above mean seal level.
14. Density altitude is pressure altitude corrected for temperature. In layman's terms, it directly affects the performance parameters of any aircraft, and in effect it is the equivalent altitude of where, performance-wise, the aircraft ‘thinks’ it is. The higher the density altitude, the lower the aircraft performance, and vice versa. (Skybrary)
15. According to the AFM, the calibrated airspeed was within about 1 kt of the indicated airspeed.
16. The critical engine of a multi-engine fixed-wing aircraft is the engine that, in the event of failure, would most adversely affect the performance or handling abilities of an aircraft. (Skybrary)
17. V_S1: The stalling speed with power off, at the maximum take-off weight with gear and flaps up.
18. Safe single-engine speed (VSSE): a speed above both VMC and the stall speed, selected to provide a margin of lateral and directional control when one engine is suddenly rendered inoperative. An intentional failing of one engine below this speed in not recommended. [Source: Transport Canada]
19. See definitions in section Key speeds
20. VNO – normal and VMO – maximum operating speeds
21. The same light multi engine aeroplane as the Angel 44, with a maximum certificated takeoff weight of 5,700 kg or less.

Safety analysis

Introduction

During a planned flight review, VH-IAZ touched down on the runway at Mareeba Airport and after accelerating, took off again. About 20 seconds after take-off, the aircraft rolled rapidly to the right and impacted terrain, fatally injuring the pilot and instructor.

Although post-mortem examination identified coronary atherosclerosis in the pilot and instructor, which increased the risk of incapacitation, there was no evidence that this occurred. The nature of the loss of aircraft control was consistent with the aircraft slowing to below the minimum control speed and as such, a medical event affecting the pilot flying was unlikely.

The following analysis will consider the operational factors associated with the development of the accident.

Development of the accident

Engine failure scenario

After the aircraft took off, witnesses observed it climb to 100–150 ft above ground level (AGL) and one witness heard an engine splutter. The aircraft was seen to turn and bank to the right, descend slowly then suddenly roll right wing down and impact the ground. Due to the low height reached and the abnormal engine sounds reported by witnesses, the ATSB analysed whether the loss of control occurred following an actual engine failure or an intentional simulated one.

Actual engine failure

Neither pilot declared an emergency on the common traffic advisory frequency, which would be expected following an actual engine failure but not a simulated one. In any case, however, there was very limited time available to make such a call.

Technical examination of the engines did not reveal any pre-impact failure that would have prevented the left engine from producing full power, and although the right engine was likely running overly rich,^[22] there was no indication of an uncommanded power loss or complete engine failure.

Had the right engine actually failed shortly after take-off, when a witness heard spluttering, the immediate pilot actions called for the fuel mixture, propeller pitch and throttle levers to be pushed fully forwards, the landing gear and flaps selected up, and once the failed engine had been identified (as the right-hand engine) the right propeller feathered by moving the right pitch lever to the fully aft position. All of which could have been achievable within a few seconds.

However, at the accident site, the right propeller pitch lever was fully forward in the full fine pitch position, the propeller was not feathered and damage to the right propeller blades indicated that the right engine was making low power (and driving the propeller). These aspects were also consistent with the right engine’s tachometer indication and mid-range throttle lever position; collectively suggesting a deliberate reduction in right engine power.

While an attempt to resolve or reduce rough engine operation may have involved movement of the right fuel mixture lever aft to a position lean of full rich, moving the right throttle lever aft would be very unlikely to do so. In this manner, the right throttle lever position was inconsistent with an attempt to resolve a partial power loss. Notably, witnesses reported similar engine sounds on the first take-off of the flight, after which there was no indication that the pilots had attempted or needed to resolve any partial loss of power, nor considered it an issue that required a return to land.

Simulated engine failure

Unlike for an actual engine failure, feathering a propeller following a simulated engine failure after take-off is not recommended. Emulating the reduced drag from feathering is often accomplished by moving the throttle lever from idle to a ‘zero thrust’ position once the student or pilot has identified the correct simulated failed engine. This was consistent with the right throttle lever mid-range position.

In further support of the most likely scenario leading up to the loss of control being an intentional simulated failure of the right engine, was the requirement for a pilot to demonstrate management of a simulated engine failure after take-off as part of the flight review standards. Simulation of an engine failure by rapidly retarding the throttle was also consistent with the witness report of an audible ‘splutter’. Additionally, the flight instructor’s hand-written plan included a simulated engine failure after take-off, following a short-field landing, which had very likely just been conducted.

Aircraft performance

Given the density altitude at the time of the occurrence, the aircraft had minimal climb performance in the optimal one engine inoperative configuration, which included the propeller of the inoperative engine feathered, and the landing gear and flap retracted. However, while either the landing gear or flap were extended, the aircraft would not maintain altitude with one engine inoperative.

While the landing gear and flaps were probably selected up after take-off, the landing gear took 14 seconds to fully retract and gear retraction paused while the flaps retracted. Additionally, as the aircraft yawed and banked to the right, the right main landing gear would have experienced the greatest resistance and therefore would have been last of the three wheels to retract – principally as a result of gravitational forces and the inward landing gear retraction design. The extended right main landing gear would have increased the asymmetric drag and therefore the amount of rudder input required to counteract the yaw.

Therefore, commencing the simulated engine failure before the landing gear was fully retracted, likely resulted in the aircraft having insufficient performance to maintain altitude and reduced its ability to accelerate or maintain airspeed.

Response to simulated engine failure

With the aircraft unable to maintain altitude with one engine inoperative until the gear and flaps were fully retracted, a descent was necessary to maintain airspeed. Attempting to maintain altitude would have caused the airspeed to decrease. At the low height at which the simulated engine failure was commenced, this provided very limited time for the pilots to interpret the situation and abort the simulated engine failure exercise by restoring full power to the inoperative engine.

The fact that the aircraft was observed to turn and bank right and slowly descend, indicated that directional control was not achieved following the simulated engine failure.

The emergency procedure specified in the Angel 44 Airplane Flight Manual (AFM) for an engine failure after take-off with the landing gear and flaps extended, was to maintain control of the aeroplane and land straight ahead. There was, however, no obstacle-free area ahead for landing, because the simulated engine failure was commenced after a touch-and-go landing, in which the aircraft became airborne close to the end of the runway.

The next steps in the AFM emergency procedure were to be conducted after retraction of the landing gear and flaps. These required the pilot to maintain directional control and airspeed at or above the best rate of climb with one engine inoperative airspeed (‘blue-line speed’). The procedure stated that if below the published minimum control speed (VMC or ‘red-line speed’), ‘reduce power on the operative engine as required to maintain lateral and directional control.’

As the aircraft turned and banked right, towards the inoperative engine, the actual minimum control speed increased significantly above the red-line speed, due largely to the bank angle. Therefore, increased airspeed was needed to regain directional control; to be achieved by lowering the aircraft nose. The aircraft was then at very low height above the ground with the decreasing airspeed rapidly approaching the actual minimum control speed, which was significantly higher than the red-line speed and may also have exceeded the blue-line speed.

Without adequate height above terrain available to descend and increase airspeed, when airspeed reduction below the actual minimum control speed was imminent, preventing a ‘VMC roll’ required the pilots to reduce power on both engines and land ahead. However, the aircraft departed controlled flight with no indication of a reduction in power on the left engine or an attempt to land. Once the aircraft departed controlled flight, there was insufficient altitude available to effect a recovery before the aircraft collided with terrain. The aircraft was at a height where reducing power and landing ahead would have resulted in a landing beyond the aerodrome confines and almost certain collision with vegetation. Landing ahead with the aircraft under control would almost certainly have resulted in a safer outcome. Despite this, it can be a difficult decision for a pilot to make, particularly when faced with a simulated, rather than actual engine failure.

The Angel 44 flight manual did not specify a safe altitude for conducting simulated engine failures, nor was it required to. The aircraft almost certainly did not reach the Civil Aviation Safety Authority’s (CASA’s) recommended minimum height of 400 ft AGL at which to simulate an engine failure. Even with the right-side (instructor’s) altimeter likely reading about 90 ft above the actual barometric altitude, it would have been indicating an altitude 190 to 240 ft above the aerodrome elevation when the simulated engine failure commenced.

Instructor experience and proficiency

The instructor had almost no experience in the aircraft make and model, and limited opportunity to prepare for the flight. While the accident flight had initially been discussed two weeks prior, there was no evidence that the instructor obtained a flight manual or had any information specific to the aircraft make and model. Given that the pilot owned the aircraft and had over 300 hours experience in it, the instructor may have assumed that the pilot was competent in the aircraft and would not have to intervene, particularly as the flight review was not to include training, as it was being conducted as a private flight. Had the instructor known the pilot had not flown for over 3 years however, it could be expected that the instructor would consider pilot recency when planning the flight.

On the morning of the accident flight, the pilot and instructor had the opportunity to discuss the flight for around 20 minutes at the airport then about 30 minutes in the aircraft prior to taxiing, however, it could not be known what was discussed during that time. During the 14 minutes that the aircraft was airborne before re-joining the aerodrome circuit, the pilot had demonstrated several items of the planned flight review. There was insufficient time for the instructor to also gain proficiency at operating the aircraft during the short flight.

The Angel 44 aircraft was included in the multi-engine aeroplane class rating as CASA considered that it did not have any unusual performance or handling characteristics. It also required the same standard actions in response to an engine failure as other aircraft in the same class. Although the instructor had the previous day demonstrated proficiency at managing engine failures after take-off in a twin-engine aeroplane with fixed landing gear, it had been nearly two years since the instructor had last flown one with retractable landing gear (the Piper PA-34). The Angel 44’s landing gear took twice as long to retract as that aeroplane’s, during which time it would not maintain altitude with one engine inoperative. With inexperience in the Angel 44 and limited preparation for the flight, the instructor was likely unaware how long the landing gear took to retract and the resultant negation of effective climb performance.

Pilot proficiency

The pilot had demonstrated proficiency in handling simulated engine failures in the Angel 44 and other aircraft types over many years and thousands of hours of flying experience. Additionally, because this was the only aircraft of its type in Australia, when it was operated by a charter company, the pilot had CASA approval to conduct check flights for company pilots in the aircraft—including managing simulated engine failures. Significantly however, the pilot had not flown at all for over 3 years before the accident.

Research shows that skills decay significantly after 1 year and then continue to do so, particularly for procedure-based tasks such as managing an engine failure after take-off. This decay probably increased the pilot’s workload and the time taken to complete the required actions following simulation of the engine failure, and likely affected the pilot’s ability to interpret the situation and act to prevent a loss of control.

Research has also established that people are generally poor at assessing their own competency. Under the general competency requirements, pilots must be competent for the planned flight. A meta-analysis showed that in general, people overestimate their abilities and performance – this can stem from being too optimistic and a belief they are above average (Dunning, Heath & Suls, 2004). In the medical industry, surgeons were found to be able to self-assess ability in technical skills, but less able to assess their own non-technical skills (Arora et al., 2011).

The pilot may not have appreciated the likelihood of skill decay and over-estimated their ability to manage a simulated engine failure. Regular demonstrated proficiency, including in abnormal and emergency procedures, is required in commercial aviation settings, which reduces the reliance on self-assessed competency.

To regain a level of proficiency following the absence from flying, it would have been prudent to spend time conducting familiarisation at a safe height prior to attempting low-level asymmetric exercises. As the aircraft was airborne for 14 minutes prior to the simulated engine failure, there was limited time for the pilot to become proficient.

Aircraft preservation

The aircraft’s engines exhibited levels of internal corrosion inconsistent with their service life. In the years preceding the accident, the aircraft went through several periods of limited to no operation. While the aircraft’s maintainers reported that the engines had been run on several occasions, there was no indication that prescribed periodic storage maintenance practices had been conducted. Additionally, the engine manufacturer advised that ground running the engines was not a substitute for flying and had the potential to worsen corrosion. Further, storing the aircraft with fuel tanks less than full increased the potential for water to enter the fuel system components.

The corrosion in the fuel system of the right engine indicated that the engine had been run with water contamination in the fuel. This may have occurred in April 2019 when the fuel contamination was found, or during engine ground runs conducted by the aircraft’s maintainers. Where water contamination is evident, in addition to draining the fuel tank, it is necessary to disconnect the fuel lines before running the engine to ensure water is not introduced to the engine fuel system.

There was no evidence that inadequate engine preservation directly contributed to the accident, however, the corrosion-related debris located in the fuel system likely resulted in the right engine running overly rich, producing black smoke and backfiring, as well as a probable reduction in maximum power available. It is also likely that the service life of the engines would have been adversely affected, which had the potential to increase the risk of premature engine performance issues.

__________

22. Overly rich mixture means there is incomplete combustion because the quantity of fuel injected exceeds the stoichiometric ratio, which is the correct fuel to air ratio where all fuel is burnt. This leads to soot visible in the exhaust and deposited in the cylinders.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving an Angel Aircraft Corporation Model 44 aircraft, registered VH-IAZ, which occurred near Mareeba Airport, Queensland, on 14 December 2019.

These findings should not be read as apportioning blame or liability to any organisation or individual.

Contributing factors

• The flight instructor very likely conducted a simulated engine failure after take-off in environmental conditions and a configuration in which the aircraft was unable to maintain altitude with one engine inoperative.
• Having not acted quickly to restore power to the simulated inoperative engine, the pilots did not reduce power and land ahead (in accordance with the Airplane Flight Manual procedure) before the combination of low airspeed and bank angle resulted in a loss of directional control at a height too low to recover.
• The instructor had very limited experience with the aircraft type, and with limited preparation for the flight, was likely unaware of the landing gear and flap retraction time and the extent of their influence on performance with one engine inoperative.

Other factors that increased risk

• The pilot had not flown for 3 years prior to the accident flight, which likely resulted in a decay in skills at managing tasks such as an engine failure after take-off and in decision-making ability. The absence of flying practice before the flight review probably affected the pilot’s ability to manage the asymmetric low-level flight.
• The aircraft had not been flown for more than 2 years and had not been stored in accordance with the airframe and engine manufacturers’ recommendations. This very likely resulted in some of the right engine cylinders running with excessive fuel to air ratio for complete combustion and may also have reduced the expected service life of both engines’ components.
• The right-side altimeter was probably set to an incorrect barometric pressure, resulting in it over-reading the aircraft’s altitude by about 90 ft.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft maintainer
• witnesses
• aircraft, engine and propeller manufacturers
• Bureau of Meteorology
• Civil Aviation Safety Authority
• Queensland Police and forensic pathologist.

References

Arora et al., (2011). Self vs expert assessment of technical and non-technical skills in high fidelity simulation. The American Journal of Surgery, 202, 500-506.

Arthur Jr, W; Bennett, Jr, W; Stanush, PL and McNelly, TL 1988, Factors that influence skill decay and retention: A quantitative review and analysis. Human Performance 11(1) 57-101.

Campbell, K. S., Mothersbaugh, D. L., Brammer, C., & Taylor, T. (2001). Peer versus self assessment of oral business presentation performance. Business Communication Quarterly, 64(3), 23-42.

Civil Aviation Safety Authority 2002, Even worse than the real thing. Flight Safety Australia, March-April 2002.

Civil Aviation Safety Authority 2015, Civil Aviation Advisory Publication 5.23-1(2): Multi-engine aeroplane operations and training. Civil Aviation Safety Authority.

Dunning, D., Heath, C., & Suls., J. M. (2004). Flawed self-assessment. Implications for health, education and the workplace. Psychological Science in the Public Interest, 5(3), 69-106.

Federal Aviation Administration 2016, Airplane Flying Handbook FAA-H-8038-3B. US Department of Transportation, Federal Aviation Administration, Flight Standards Service.

Raaijmakers et al., (2017). Effects of self-assessment feedback of self-assessment and task-selection accuracy. Metacognition and Learning, 14, 21-42.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the aircraft maintainer
• the aircraft, engine and propeller manufacturers
• the certificate of airworthiness issuer
• the Civil Aviation Safety Authority
• the US National Transportation Safety Board
• the UK Air Accidents Investigation Branch.

Submissions were received from:

• the aircraft manufacturer
• the certificate of airworthiness issuer
• the Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the morning of 12 December 2019, a student pilot took off for a series of solo circuits in a BRM Aero Bristell, registered VH-YVF, at Moorabbin Airport, Victoria. Just after crossing the runway threshold for the first touch and go landing, witnesses observed the aircraft about 10 ft above the runway, when it suddenly pitched up to about 40 ft. The left wing dropped, with the bank angle increasing to the point where the aircraft became inverted.

The witnesses described what they saw as similar to the aircraft being in the first half rotation of a spin entry. The nose then dropped and the aircraft impacted terrain in a steep inverted attitude. The student pilot was severely injured, and the aircraft was destroyed.

What the ATSB found

The ATSB found that the pilot commenced a go‑around at low level when the aircraft deviated from the runway centreline in crosswind conditions. During the go‑around, the aircraft aerodynamically stalled and commenced a spin.

It was also identified that the student pilot did not have the necessary qualifications and skills to safely operate the Bristell solo.

Finally, the required Soar Aviation solo flight dispatch procedures were not followed. As a result, it was not identified that the student pilot was not authorised for, nor met the required competencies, to conduct the flight.

What has been done as a result

Soar Aviation implemented enhanced measures to ensure student pilots were fully briefed and authorised, before conducting a solo flight. These amended procedures included changes to the aircraft booking procedure and having aircraft keys stored such that they were only accessible by flight instructors.

Soar Aviation ceased flight training on 29 December 2020.

Safety message

Familiarity with an aircraft’s specific systems, controls, handling and limitations is essential for safe flight.

Safety-critical procedures and regulations are in place to ensure that pilots have the required level of skill and experience to safely operate an aircraft. The outcome of this accident, which could just as easily have been fatal, illustrates a consequence of deviating from them.

The investigation

The occurrence

On the morning of 12 December 2019, a student pilot conducted a pre-flight inspection of a BRM Aero Bristell S-LSA,^[1] registered VH-YVF, in preparation for a solo flight. A second student (student 2) also conducted a pre-flight inspection of their aircraft at the same time and, after completing their aircraft checks, they returned together to the flight school’s main building. Student 2 reported they then ‘walked into navigation planning to organise dispatch of my flight’ however, they observed that the other student pilot did not. Student 2 later observed the student pilot walking back to the where the aircraft were parked, with their ‘flight bag and aircraft folder’.

The student pilot had the aircraft keys however, they had not endorsed the aircraft’s maintenance release or conducted the required solo flight briefing and sign out procedure with a flight instructor. The student pilot stated to the ATSB that they believed they were authorised for the solo flight. However, they also reported a level of confusion as to whether the solo dispatch procedure was required at their stage of training.

At 0950 Eastern Daylight-saving Time,^[2] the student pilot was cleared by air traffic control (ATC) to take off from runway 17L^[3] at Moorabbin Airport, Victoria, for a series of circuits. The pilot reported feeling ‘uncomfortable’, with the aircraft and its systems during the flight, and that they surmised this was due to their limited experience in the Bristell.

While on the downwind leg of the first circuit, the student pilot advised ATC of their intent to conduct a touch and go, which was subsequently cleared at 0954. During the approach to the runway, the student pilot described that they felt the nose ‘wanted to pitch up’, even though they believed the aircraft was neutrally trimmed.

The student pilot stated that, just after crossing the runway threshold, what felt like a sudden gust of wind pushed the aircraft to the left of the runway centreline. At that point, the student pilot decided to initiate a go-around. The pilot reported that, after commencing the go-around. the aircraft was then ‘ripped up very violently, straight up into the air and then ripped very violently toward the left’. They attempted to recover with full right rudder ‘as far as it would go, but by that time it was too far gone’ (Figure 1).

Witnesses reported observing the aircraft, about 10 ft above the runway, when it suddenly pitched up to about 40 ft. The left wing dropped, with the bank angle increasing to the point where the aircraft became inverted. The nose then dropped, and the aircraft impacted terrain in a steep inverted attitude. The witnesses described what they saw as similar to a spin entry to the left.

Figure 1: Flight track, with the approach to land phase highlighted in yellow

Source: Google Earth, annotated by ATSB using VH-YVF flight data

ATC also observed the accident and initiated an emergency response. The student pilot was severely injured, and the aircraft was substantially damaged. There was no post-impact fire.

Context

Pilot information

The student pilot commenced flying training with Soar Aviation in March 2019 and gained a Recreational Aviation Australia (RAAus)^[4] Pilot Certificate on 30 September 2019. The student pilot then converted their pilot certificate to a Civil Aviation Safety Authority (CASA) Recreational Pilot Licence (RPL), which was issued on 13 November 2019.

Operation of VH‑registered aircraft such as VH-YVF (YVF) required a minimum of an RPL. In order to exercise the privileges of the RPL, the student pilot was first required to complete an aircraft flight review. At the time of the occurrence, this had not been completed. In addition, the student pilot did not hold an RAAus endorsement for ‘in-flight adjustable propeller’, nor the CASA-equivalent ‘manual propeller pitch control’ as fitted to the Bristell (see the section below titled Aircraft information).

The student pilot had accrued about 72 hours flight experience, which included 10 hours of solo flight, all in the RAAus-registered Aeropakt A-32 Vixxen (refer to the Aircraft information section). The student pilot’s last recorded solo flight was on 21 October 2019.

The student pilot underwent their baseline CASA medical examination in March 2019 and at the time of the accident held a current Class 1 medical certificate, with nil restrictions or conditions.

Aircraft information

BRM Aero Bristell

The BRM Aero Bristell S-LSA is a two-seat, all-metal, low-wing aircraft, with fixed tricycle landing gear, steerable nose wheel and stick control. YVF, serial number 330, was powered by a Rotax 912 ULS horizontally opposed four-cylinder normally aspirated engine and a variable pitch MT-Propeller. The aircraft was manufactured in the Czech Republic in 2018 and registered in Australia the same year.

YVF was flown for 2.3 hours on the day before the accident, with no reports of any issues, and had a total time of 997.8 hours. A review of the maintenance logbooks did not identify any prior accidents or major repairs.

Figure 2: VH-YVF

Source: Used with permission

The aircraft manufacturer’s Aircraft Operation Instructions manual had the following guidance on headwind and crosswind limitations (Figure 3).

Figure 3: Bristell wind limitations

Source: Soar Aviation

With regard to the different crosswind limitations, the manual did not define the terms ‘average’ or ‘skilled’ pilots.

Aerokprakt A-32 Vixxen

The Aeroprakt A-32 Vixxen (Vixxen) aircraft is a Ukranian-built two‑seat, high-wing, tricycle gear ultralight. The Vixxen is powered by a Rotax 912ULS engine and a 3-blade KievProp ground‑adjustable propeller.^[5] In addition, the Vixxen is configured with an all‑flying horizontal ‘stabilator’^[] and conventional flight control yoke.

Figure 4: Typical A-32 Vixxen

Source: Ian McDonell

Differences in handling between the Bristell and the Vixxen

When asked about the differences between the Bristell and the Vixxen, in general handling and stall characteristics, flight instructors advised that:

• it would typically take three to four flights to get used to the new type, particularly yoke versus stick
• the Bristell’s elevator was significantly smaller and therefore less sensitive
• significant forward movement of the Bristell’s flight control stick is required with the in‑flight application of power to counter a pitch‑up tendency
• in a stall, the Bristell ‘really did like to drop a wing’, usually the left, and ‘if it does so, it is not normally as gentle as other planes that I’ve flown …, if I was to compare it to the Vixxen, I would say you’d want to be much more aware of what you’re doing in the Bristell’.

Site and wreckage examination

Examination of the wreckage (Figure 5) did not identify any evidence of pre-existing faults or engine issues which may have contributed to the loss of control.

The site and wreckage examination identified that YVF impacted terrain in a nose-down, inverted attitude. In addition, damage to the airframe and engine was indicative of the aircraft being in a moderate spin/yaw to the left, at the point of impact. This was consistent with witness reports that the aircraft pitched up, rolled to the left and impacted the terrain inverted, in what appeared to be the commencement of a spin.

Figure 5: Accident site

Source: ATSB

Recorded flight data

The aircraft was fitted with a Garmin G3X avionics system, which was an integrated flight instrumentation, position, navigation and communication system. The G3X unit had a flight data logging feature which automatically stored flight and engine data to its memory module.

The ATSB was able to download the data from the occurrence flight however, the data stopped just as the aircraft flew over the runway 17 threshold (Figure 6). It is likely the final seconds of data were lost due to the interruption of electrical power to the unit at impact. The last 5 seconds of recorded data captured:

• indicated airspeed reducing from 60 to 51 kt
• altitude decreasing from 106 ft to 76 ft
• vertical speed stable at -255 fpm
• roll no more than 5° either side of wings level
• pitch increasing from about -0.5 to +5.0° but not stable
• yaw varying from 0 to -5°/s
• wind speed and direction: stable at 223° and 15 kt (13 kt crosswind)
• engine RPM decreasing from 3,730 to 2,580 and fuel flow relatively stable at 2.2‑2.4 gallons/hr
• GPS track was aligned with the runway centreline.

Figure 6: Accident site overview

Source: Google Earth and ATSB, annotated by ATSB

Weather

The Bureau of Meteorology (BoM) automatic weather station at Moorabbin Airport recorded observations at one-minute intervals (Table 1), with the loss of control occurring at about 0955. The temperature was steady, at about 15°C, at the time of the occurrence.

Table 1: Moorabbin Airport weather observations

The crosswind component at the time of the loss of control was calculated to be about 13 kt, accounting for the observed 15 kt gust. The Moorabbin automatic terminal information service was advising of a 12 kt crosswind at that time and the student pilot reported noting this during the flight.

Soar Aviation procedures

Gobel Aviation, trading as Soar Aviation (Soar), was a CASA Part 141 authorised flight training organisation. Soar provided flight training from ab-initio through to obtaining a commercial pilot licence (CPL). Soar’s training syllabus, in conjunction with the Soar Operations Manual and CASA Part 61 MOS Competencies into individual flight lesson for training and assessment, outlined the competency requirements for each phase of the flight training, including suggested lesson content and duration. Where a pilot required additional flying training to complete a competency, these flights could be added to the training schedule.

Students typically commenced training on the RAAus-registered Aeroprakt A-22 Foxbat or Vixxen aircraft, and then transitioned to the VH-registered Bristell for the command-building flights during the CPL phase. The syllabus identified 3 hours of familiarisation flight training when transitioning between aircraft types.

Solo training flight procedures

Soar Advanced Flight Training Operations Manual Part 3B Conduct of training operations detailed the procedures for ‘authorisation of training flights’. The procedures for flight preparation and planning, ‘prior to any training flight’ included pre- and post-flight briefings and that ‘the flight is authorised by an approved person’. The student pilot’s records showed that they had ‘read and understood’ the procedures. In addition, they had followed these procedures during their flight training on the Vixxen.

The procedure for solo flights stated that ‘the authorising instructor will only dispatch the flight’ when they had confirmed 13 checklist items, which included:

• the student had completed all training and examinations as prescribed by the syllabus for the solo flight
• the student flight training records indicate that they have achieved the required standard for all elements of competency for the flight, including flight crew licence and endorsements, as applicable
• the student had been briefed on the objectives, conditions and limitations of the intended solo flight, including that task or route to be flown, number of circuits (if applicable), traffic and ATC consideration, and actions to be taken during an emergency
• the student was clear on what they are authorised to do while on their solo flight
• the actual and forecast weather conditions, including runway crosswind and last light limitations were suitable considering the student’s previous competence in similar conditions
• the daily inspection was complete and certified
• solo risk matrix has been completed and authorised by a flight instructor.

The solo risk matrix form included considerations for aircraft serviceability, pilot experience and weather. Pilot experience included a check for ‘5 hours dual training on aircraft type’. The weather section included consideration to wind (gusts and turbulence) and crosswind (Table 2), among other factors.

Table 2: Solo risk matrix crosswind and wind gusts component

The risk rating detailed that dispatch of the flight, at level 3, was at the discretion of a Grade 1 instructor. Level 2 was at the discretion of a Grade 2 instructor and level 1 was ‘limited by the student’s personal minimums’. The solo risk matrix form was to be signed by the student and authorising instructor, prior to flight.

Soar advised the ATSB that, had a solo flight been scheduled for the student pilot, in a Vixxen, the risk assessment would likely have resulted in level 2 ‘at the discretion of a Grade 2 flight instructor’. This would factor in the pilot’s skills and experience in the Vixxen, which indicated 10‑14 kt crosswind for the equivalent skill level of the student pilot. Further, Soar advised that the instructor and the pilot would have reviewed the weather, and discussed operational aspects, prior to the flight being approved.

Flight booking system

Soar required students to book flights in advance, by liaising with operations staff, to ensure their flight training was progressing at an acceptable rate. An aircraft, and an instructor where applicable, were assigned to the booking however, the exact nature of the flight was not assigned until amended by the instructor, as part of the pre-flight briefing.

Bristell flight training

In preparation for their commercial pilot licence training phase, the pilot received a 2-hour familiarisation flight in a Bristell, on 11 December 2019. Due to weather limitations, the lesson entry report noted that the following required competencies were unable to be assessed:

• take off in a crosswind
• land aeroplane in a crosswind
• enter and recover from a stall
• recover from incipient spin
• perform recovery from missed landing.

The lesson entry report identified these items as competency grade 5 ‘the element has not been assessed’^[6] and the instructor noted they were to be completed on a future flight.

The student pilot reported, from their recollection of the post-flight debrief with the instructor, that the aircraft flight review and endorsement for the manual pitch propeller control had been ‘signed off’. Further, they believed they were advised by the instructor as ‘you’re good to go’. From this, the student pilot believed they were instructed, and authorised, to conduct a solo flight in a Bristell.

Despite that belief, the student pilot also advised the ATSB that prior to the solo flight on 12 December 2019, they were:

• feeling apprehensive, ‘after only 1 hour of training’ and still getting used to the different controls and trim mechanism
• aware that they hadn’t received any crosswind or stall training
• only going to conduct circuits, instead of navigation practice, as they didn’t feel comfortable flying the Bristell and wanted ‘to get used it more’.

The flight instructor’s recollection from the 11 December 2019 Bristell dual training flight included:

• describing the critical differences between the Vixxen and the Bristell
• the student pilot ‘tended to pitch the aircraft more than necessary’ and the importance of avoiding this was ‘stressed a number of times in the circuit’
• the student pilot ‘tended to allow the speed to drift down’ during landing
• landings were fine but on the touch and go, with full power, tended to pitch up too soon
• the requirement to remind the student not to handle the Bristell like the Vixxen
• their belief that the student pilot ‘definitely was not ready for a solo on that aircraft’.

The instructor reported that they didn’t specifically say the student pilot ‘was not cleared for solo’ flight but ‘they don’t normally do that, it is clear from the debrief’’. In addition, the student pilot was advised of the requirement for stall training on their next flight. Finally, the lesson entry report had been endorsed by the both the instructor and the student, indicative of them having received and understood the post-flight briefing.

Following this accident, a number of procedural changes relating to the conduct of solo flights were implemented (see the section titled Safety action).

Go-around

Whenever landing conditions are not satisfactory, a go-around should be initiated. A go‑around is considered a normal procedure and, although it is not often required, with appropriate training, planning and preparation it should not result in increased risk.

The Federal Aviation Administration publication, The Airplane Flying Handbook, Chapter 8 (pages 12 and 13) provides the following guidance for go-arounds:

Although the need to discontinue a landing may arise at any point in the landing process, the most critical go-around is one started when very close to the ground. The earlier a condition that warrants a go-around is recognized, the safer the go-around/rejected landing is. The go-around maneuver is not inherently dangerous in itself. It becomes dangerous only when delayed unduly or executed improperly…

… Attitude is always critical when close to the ground, and when power is added, a deliberate effort on the part of the pilot is required to keep the nose from pitching up prematurely. The airplane executing a go-around must be maintained in an attitude that permits a buildup of airspeed well beyond the stall point before any effort is made to gain altitude or to execute a turn. Raising the nose too early could result in a stall from which the airplane could not be recovered if the go-around is performed at a low altitude.

The Civil Aviation Safety Authority Flight Instructor Manual (p47) provides the following guidance for instructor on go-arounds:

The following points must be emphasised [by the instructor]:

(iv) That large changes of trim may be experienced during this procedure.

Safety analysis

On the morning of 12 December 2019, a student pilot took off from Moorabbin Airport, Victoria, intending to conduct a series of circuits in a BRM Aero Bristell, registered VH-YVF. After passing the runway threshold during the first approach for a touch and go landing, the student pilot lost control of the aircraft and collided with terrain, on a grassed area alongside the runway.

The analysis discusses the student pilot’s preparation for the flight in the context of the flight school’s requirements, as well as the contributing factors that led to the loss of control and collision with terrain.

Solo flight dispatch procedure

Following completion of an instructional familiarisation flight in the Bristell the day before the accident flight, the student pilot incorrectly believed that they were ‘authorised’ to conduct a solo flight in the aircraft. The flight instructor who conducted the familiarisation flight acknowledged that, while they ‘didn’t specifically say that [the student pilot] was not cleared for solo’, it should have been evident as the student had not conducted any crosswind or stall training in the Bristell. Additionally, the post‑flight briefing, signed by the student, detailed that these required sequences were to be conducted on the next flight.

Further, the student pilot continued with the solo flight, despite reporting they were ‘not comfortable operating’ the new aircraft type. They also advised their belief that, as they were in the ‘command building’ phase of their training, the solo flight procedures were not required. There was no statement to that effect in the Operations Manual. In addition, there was no evidence the student pilot sought to clarify whether or not they were authorised and/or if the solo procedures were required.

Had the solo flight approval procedures been followed, they would have identified that the student pilot had not yet achieved the competencies required for solo flight in the Bristell. More generally, following these procedures would have identified the hazard associated with the crosswind conditions and allowed an assessment of the risk for pilots with limited experience on the aircraft type.

Aircraft handling

The student pilot had undertaken only one supervised training flight in the Bristell aircraft, which did not include any go-arounds, crosswind landings or stall training. Therefore, the student pilot’s familiarity with the aircraft type was very limited.

The Bristell exhibits different handling characteristics to the other aircraft type the student pilot had previously operated. Specifically, instructors reported that it is less docile and has a stronger tendency to pitch up when engine power is applied for a go-around. The instructors also reported that the Bristell has less elevator authority to counter the nose-up effect and a greater tendency to drop a wing (usually the left) during a stall.

During the flare prior to touching down, the student pilot detected the aircraft drifting left of centreline, most likely due to the prevailing crosswind, and elected to commence a go-around. After initiating the go-around, they felt the aircraft forcefully pitch up, a behaviour consistent with instructor’s description. Being unfamiliar with the aircraft type, the student pilot was not adequately prepared for this pitch up tendency and did not anticipate or respond effectively to prevent the aircraft stalling.

Once the aircraft stalled, it entered an incipient left spin. Recognising that recovery from the stall at such a low height may not have been possible, as the student pilot was unfamiliar with the aircraft’s stall behaviour, their capability to prevent further rotation or recover the aircraft prior to the collision with terrain was also very limited.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving BRM Aero Bristell, VH-YVF on 12 December 2019.

Contributing factors

• The student pilot did not have the necessary qualifications and skills to safely operate the Bristell solo.
• The required Soar Aviation solo flight dispatch procedures were not followed. As a result, it was not identified that the student pilot was not authorised for, nor met the required competencies, to conduct the flight.
• During the conduct of a go‑around at low level following deviation from the runway centreline, the aircraft aerodynamically stalled and commenced a spin.

Safety actions

Safety action by Soar Aviation

Soar Aviation advised the ATSB that they had implemented revised procedures to ensure an aircraft could not be taken by a student for a solo flight, either deliberately or inadvertently. Aircraft keys were now secured and could only be accessed by an instructor once the procedures had been followed and solo flight was authorised.

Further, the booking system was changed so that operations ‘reserve’ an aircraft for a student and allocated an instructor, with the instructor required to change the reserve booking to the authorised ‘flight lesson’.

Soar Aviation ceased flight training operations on 29 December 2020.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority
• BRM Aero
• witnesses
• Airservices Australia

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority
• BRM Aero
• Air Accidents Investigation Institute of the Czech Republic.

Submissions were received from:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. An S-LSA is a special light-sport aircraft, where the certification and continuing airworthiness is the responsibility of the manufacturer. The aircraft are manufactured to defined standards, which are then accepted by the regulator.
2. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours. 
3. Runway numbering: the number represents the magnetic heading closest to the runway (runway 17 at Moorabbin Airport is oriented 164° magnetic) and L indicates the left most of two parallel runways.
4. Recreational Aviation Australia (RAAus) administers ultralight, recreational, weight shift microlight and LSA aircraft. RAAus train and certify pilots, flying instructors and maintainers, register their aircraft fleet and oversee a large number of flight training schools across Australia.
5. A ground-adjustable propeller can be adjusted between pre-set limits of coarse and fine pitch, to optimise the aircraft for flying conditions. Following adjustment, only on the ground and when the engine is not running, its operation is similar to a fixed pitch propeller.
6. Soar’s competency grading scale ranged from 5 up to 1, where 2 was the level required before solo flight and 1 was where the student had achieved ‘competency to the standard required for qualification issue’.

Safety summary

What happened

On 7 December 2019, at about 1034 Eastern Daylight-saving Time, the pilot of an Overseas Aircraft Support UH-1H helicopter (formally known as Bell UH-1H or ‘Huey’ helicopter), registered VH-OXI, experienced a main driveshaft failure and hard landing near Crawford River, New South Wales, while engaged in fire control aerial work. The pilot was not injured, and the helicopter was substantially damaged.

What the ATSB found

The ATSB found that the pilot elected to abort the fire control aerial work and conduct a precautionary landing as a result of the failure of the driveshaft. While attempting to land, the pilot experienced an uncontrollable yaw to the right, resulting in a hard landing and substantial damage to the helicopter when the main rotor blades struck the ground and forcibly ejected the main gearbox, mast, rotors and KAflex® driveshaft from the airframe.

The helicopter’s KAflex® driveshaft, which transmits power from the engine to the main gearbox, failed due to a fatigue crack prior to the hard landing. 

What's been done as a result

Following the accident, the Civil Aviation Safety Authority emailed Australian operators of UH‑1 helicopters a brief on the accident, which included a copy of a previously issued (2007) airworthiness bulletin on the subject of pre-flight inspection requirements for the KAflex® driveshaft. The requirements included checking the condition of all driveshaft hardware in addition to the pre-existing inspection requirements.

As a result of this occurrence, the helicopter operator replaced the KAflex® driveshaft on their other UH-1H helicopter with a new driveshaft. For the new driveshaft, they implemented a maintenance routine to monitor the hours flown and time-in-service and included a scheduled retirement time of 5,000 hours.

Safety message

In 2018, the driveshaft manufacturer provided a position paper to the United States Federal Aviation Administration, which recommended that driveshafts with the same part number as the accident helicopter should be replaced at 5,000-hours service, or, if the time-in-service could not be determined, removed and replaced. Any legacy driveshafts of the accident part number SKCP2281-103 can be sent to the manufacturer for modification to a new ‘safety of flight’ part number SKCP3303-1.

This accident highlighted the importance of pilots operating helicopters in the low-level environment to respond to the early symptoms of a problem immediately, and to be prepared to commit to a precautionary landing before the condition deteriorates to the point of a forced landing. In this case, the pilot responded without delay and was able to reach a safe landing site before a catastrophic failure of the driveshaft occurred.

The investigation

The occurrence

On 7 December 2019, at about 0918 Eastern Daylight-saving Time (EDT),^[1] the pilot of an Overseas Aircraft Support (OAS)^[2] UH-1H helicopter, registered VH-OXI, departed the town of Wauchope, New South Wales for fire control aerial work 128 km to the south-west. The tasking was for fire-fighting, which involved the helicopter using a 150 ft long-line and a 1,200 L bucket to drop water on the fire grounds under the direction of the ‘air attack’ crew.^[3]

On arrival at the fire ground at about 1028, the pilot of VH-OXI made contact with the air attack crew. They directed him to the water source (Crawford River) for the uplifts, and the fire grounds for the drops. The pilot made an approach to the river where the operation of the bucket was tested, and the first water drop on the fire ground was conducted.

On return to the Crawford River for the second uplift, and immediately prior to filling the bucket, the pilot heard a momentary ‘burring’ noise with a ‘buzzing’ vibration through the airframe. The pilot aborted the uplift and started to transition away from the hover when the noise and vibrations resumed. The pilot noted the intensity increased when the collective lever was raised.^[4]

The pilot radioed the air attack crew the intention to land, released the bucket, and initially tracked towards a clear area that was not a confined area.^[5] However, the continuing noise indicated to the pilot that the condition of the helicopter was deteriorating and the pilot elected to divert to a small clearing, which required an approach to the hover prior to landing. The air attack crew broadcast an emergency radio call for the pilot while the helicopter was tracking to the clearing.

On approach to the hover, at a height of about 10 ft, the helicopter started to yaw to the right, which the pilot was unable to stop with the left pedal. At about 90° rotation to the right, the pilot closed the throttle to idle, which did not appear to slow down the rotation, and then ‘dumped’ the collective lever. The helicopter rotated about 180° from the approach heading before landing hard. The main rotor blades struck the ground in the forward left position (reference to the pilot’s seat), which resulted in the failure of the main gearbox mounts and the ejection of the main gearbox, mast, rotors and driveshaft from the airframe.

Rural Fire Service and National Parks personnel responded immediately and arrived at the accident site shortly after the pilot had exited from the wreckage (Figure 1). They extinguished a small grass fire that had been started by the helicopter. The pilot was transported to hospital by ambulance for observation and then released with nil injuries. The helicopter was substantially damaged.

Figure 1: Main wreckage site

Source: Operator

Context

Airframe inspection

The ATSB inspected the airframe at one of the operator’s hangar facilities on 20 December 2019. Due to the damage and disassembly for transport, the flight controls and transmission could not be inspected for mechanical continuity and correct operation. The engine could not be rotated and there was evidence of fine metallic particles present on the exhaust and combustion side of the power turbine, which indicated metal debris passed through the engine during the accident sequence.

The KAflex® driveshaft (part number: SKCP2281-103), which transmits the drive power from the engine output to the main gearbox input, was found to have fractured into multiple pieces. The driveshaft uses flexible plates (Figure 2) to accommodate relative movement between the engine and gearbox, and was designed with an integral failsafe feature for continued flight in the event of a single flex frame fracture. It will permit a limited continued power operation (20 minutes demonstrated during qualification), enabling pilots to safely land the helicopter.

Figure 2: KAflex® driveshaft – key parts identified with the number of each part fitted annotated in brackets

Source: Kamatics Corporation, annotated by the ATSB

The visual inspection of the driveshaft noted a failure of one of the outer flex plate bolt holes, where the plate was bolted to the main gearbox-end fitting. In addition, there were five recessed washers missing from various fasteners. The rear transmission mount support assembly exhibited scoring below the location of the driveshaft gearbox-end fitting (Figure 3). Discoloration of a section of the failed outer flex plate was consistent with the scoring to the support assembly. The ATSB retained the helicopter’s KAflex® driveshaft (serial number 2136) for materials examination.

Figure 3: Scoring to the rear transmission mount support assembly

Source: ATSB

Materials examination

The flex plates from the driveshaft had fractured into multiple segments. The outer flex plate at the main gearbox-end fitting had fractured through the bolt hole, with a small section remaining attached at the join (Figure 4). Examination of the flex plate fracture surfaces revealed evidence of beachmarks, consistent with fatigue crack progression. The fatigue crack had propagated across about 90 per cent of the fractured surface. The surfaces surrounding the fatigue fracture exhibited evidence of surface corrosion and pitting (Figure 5).

Figure 4: Fractured bolt hole (left) and small section remaining attached (right)

Source: ATSB

Figure 5: Fatigue failure of flex plate

Source: ATSB

The five missing washers were from four fasteners, and in each of these locations the fasteners were loose and the flex plates free to move with respect to each other. Damage to the fasteners at these locations precluded any useful information with regard to torque values. A witness mark, consistent with a washer, was observed in all the locations. While some marks were more distinct than others, it was considered very likely that a washer had been present at each location at some stage in the life of the component. Figure 6 depicts the location of one of the missing washers.

Figure 6: Missing washer

Source: ATSB

KAflex® driveshaft overhaul and inspection

The manufacturer (Kamatics Corporation) reported that driveshaft SKCP2281-103, serial number 2136, was purchased in 1980 by the then owner, the United States (US) Army, as part of the UH‑1H driveshaft retrofit program. There was no time-between-overhaul (TBO) or retirement life for the driveshaft. There was a period in which the US Army implemented an overhaul program, but this was discontinued, and the driveshaft TBO/retirement became ‘on condition’. This was the accepted practice when the UH-1H helicopters were transferred to the civilian register in the restricted category.^[6]

As the UH-1H was the driveshaft manufacturer’s only program without a TBO or retirement life, they worked with the US Army to develop a new safety of flight part number (SKCP3303-1). These driveshafts have a formal TBO of 5,000-hours, which is in accordance with the manufacturer’s other driveshaft programs. Any legacy driveshafts of part number SKCP2281-103 can be sent to the manufacturer for modification to part number SKCP3303-1.

In 2018, the manufacturer provided a position paper to the US Federal Aviation Administration with their concerns and recommendations for driveshafts in civilian UH-1H helicopters.^[7] Their paper identified several different legacy part number driveshafts for the UH-1H. Part number SKCP2281-103 was identified as the only legacy part number that should be remaining in the field, and those with a serial number below 635 should be removed from service. In addition to recommending a ‘thorough Out of Aircraft inspection’, the manufacturer recommended to the FAA a removal from service for part number SKCP2281-103 driveshafts at 5,000-hours, or, if the time cannot be determined from historical records, ‘removal and replacement with a serviceable unit’.

The manufacturer reported that the Federal Aviation Administration has assigned a case number to review the issue of the UH-1H driveshaft in response to the manufacturer’s position paper.

The KAflex® driveshaft should not be disassembled outside of the factory. The manufacturer’s position paper and instructions for continued airworthiness for part number 3303 (Revision B), stated that all inspections should include checking for missing hardware (bolts, nuts, and washers), and a warning not to ‘disturb or tighten flex frame nuts or bolts. Evidence of turning fasteners by wrench or other means is cause for rejection.’

The maintenance organisation reported that the driveshaft was not being tracked as it did not have a service life and was an ‘on condition’ component. It was removed for an engine change about 74.5 hours prior to the accident and received a general visual inspection prior to installation. They reported that disassembly of the KAflex® driveshafts was not permitted and therefore there was no disassembly of it during the engine change.

Maintenance organisation comments

The maintenance organisation reported that they could not explain how the washers came to be missing, but were confident that they were all installed prior to the accident for the following reasons:

• Quality pictures of the KAflex® bolts securing the end fittings were taken post-installation after the engine change. As the pictures were focused on the bolt securing the two clamps together, some of the KAflex® fasteners were not visible. However, the fasteners that were visible were all correctly assembled.
• During the engine change, the licenced aircraft maintenance engineer, with more than 15 years of experience on the ‘Huey’, was doing some training with another engineer. They focused on the KAflex® and how to inspect the driveshaft correctly, especially when it was removed from the helicopter. During that training, they attempted to turn each fastener by hand to check if any were loose. In addition, they inspected for any evidence of fretting or cracks. No defects were found, and the driveshaft was installed.
• The organisation used an unserviceable KAflex® driveshaft to check if it was possible to have one or two washers missing and the nut not be ‘shank bound’.^[8] They found that a fastener with one washer removed could be tightened up enough that it could not be turned by hand. However, a fastener with two washers removed was shank bound with about a 10 thousandth of an inch gap between the nut and the flex plate.
• In the case of the fastener missing two washers, they considered that the damage caused by a driveshaft having a shank bound bolt would cause a large amount of fretting. That damage would have been easily visible over the past 1,000 hours they had maintained it. In addition, they considered that the flex plate bolt hole would have elongated or caused large amounts of damage to the bolt. This damage was not evident.

Airworthiness bulletin

In 2007, the Civil Aviation Safety Authority released an Airworthiness Bulletin (AWB 63-004: Kamatics Corporation KAflex Drive Shafts – Bell 407) for the purpose of alerting industry to an ‘inadequacy in a detail in the pre-flight check requirements of the approved Bell 407 Flight Manual with regard to checking the KAflex© drive shaft’. They recommended that pre-flight checks include the specific condition of all hardware and included the warning not to ‘disturb or tighten flex frame nuts or bolts. Evidence of turning fasteners by wrench or other means is cause for rejection’.

Discovery of broken washer

On 14 November 2020, following publication of the ATSB’s investigation report, an aircraft maintenance engineer found a broken washer in the wreckage while removing salvageable parts. The maintenance organisation notified the ATSB of the discovery and the broken washer was sent to the ATSB facilities in Canberra for analysis. In addition, the maintenance organisation provided further details, including photographs, about the maintenance history of the driveshaft.

Based on a photographic review of the broken washer, Kamatics reported the washer was consistent with those used on the KAflex® driveshaft. Analysis conducted by the ATSB revealed a high aluminium content, which was consistent with the SermeTel® coating used on these washers.^[9]The dimensions were consistent with those for the KAflex® driveshaft recessed washer part number, the surface exhibited signs of fretting and there was no evidence of fatigue on the fracture surfaces. Kamatics reported that fretting is the usual type of wear found on the washers for driveshafts that have accumulated 4,500-6,000 hours operation, but they have never recorded cracked or broken washers during overhaul. Figure 7 below provides a comparison of the broken washer with a KAflex® driveshaft recessed washer.

The additional maintenance information and analysis of the broken washer suggested the most plausible scenario was that the missing washers failed as a result of the break-up of the driveshaft when the main gearbox was forcibly ejected from the airframe.

Figure 7: Comparison of washers

Source: Maintenance organisation, annotated by the ATSB

Safety analysis

Precautionary landing

As the helicopter approached a high hover over the Crawford River for a water uplift, the pilot experienced a ‘buzzing’ airframe vibration and ‘burring’ noise. The pilot immediately aborted the uplift, released the water bucket and tracked to a nearby clearing for a precautionary landing.

When in a hover position, just prior to landing, the helicopter started to yaw right. Despite the pilot’s attempt to stop the yaw, directional control could not be regained, which resulted in a hard landing. During the landing, the main rotor blades struck the ground, resulting in the failure of the main gearbox mounts and the forced ejection of the main gearbox, mast, rotors and KAflex® driveshaft from the airframe.

Flex plate fatigue failure

An inspection of the airframe revealed the KAflex® driveshaft exhibited a fatigue failure of the outer flex plate at a bolt hole where the plate was fastened to the main gearbox-end fitting. The observed scoring marks to the rear transmission mount support assembly were consistent with the failed driveshaft flex plate striking it during operation. This indicated that the driveshaft failure started before the hard landing and was consistent with the symptoms of noise and vibration reported by the pilot when overhead the Crawford River.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• While conducting fire control operations, the pilot detected a 'buzzing' vibration through the airframe with an associated noise, which necessitated a precautionary landing. During the landing directional control could not be maintained, resulting in a hard landing.
• The helicopter's KAflex® driveshaft failed as a result of a fatigue failure of the outer flex plate attached to the main gearbox fitting.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Civil Aviation Safety Authority

As a result of this occurrence, the Civil Aviation Safety Authority advised the ATSB that they took the following safety action:

Communication

The Civil Aviation Safety Authority inspected the driveshaft and then distributed an occurrence brief to all Australian operators of the UH-1 helicopters and variants with a copy of Airworthiness Bulletin 63-004: Kamatics Corporation KAflex Drive Shafts – Bell 407. This included the statement that the bulletin for the Bell 407 helicopters ‘is considered equivalent information for all UH-1 rotorcraft.’

Helicopter operator

As a result of this occurrence, the operator advised the ATSB that they took the following safety action:

Replacement part

The operator replaced the KAflex® driveshaft on their other UH-1H helicopter with a new driveshaft. They implemented a maintenance routine to monitor the hours flown and time‑in‑service of the new driveshaft and included a scheduled retirement time of 5,000 hours.

Maintenance organisation

As a result of the occurrence, the maintenance organisation advised the ATSB that they took the following safety action:

Addition of maintenance worksheet line item for all KAflex (and similar) driveshafts over-and-above the maintenance manual data checks. This line item covers a step to check all hardware against IPC [illustrated parts catalogue]/data (i.e. correct quantity and part number for all bolts, washers and nuts) and visual verification by means of applying Torque Sealant specified by KAflex OEM [original equipment manufacturer] as well as signing off the task. Subsequent checks will require that this torque seal is checked and reapplied if required, in order to verify a subsequent check of hardware has been made. This checklist item references Kamatics (OEM) ICA [instructions for continued airworthiness] 3303 Rev. B.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) +11 hours.
2. Formerly Bell UH-1H (‘Huey’ helicopter).
3. The ground-based air attack (helicopter) crew provide the airborne supervision for the fire control air assets.
4. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
5. A confined area is an area where the departure or approach flight path is limited in some direction by terrain or the presence of obstructions, natural or manmade.
6. Restricted category indicated that additional limitations on operations were required as the design did not comply with the normal category.
7. Kamatics Corporation (KER-2355A): Current State Conditions of Concern, Army Surplus KAflex Driveshafts Fielded in UH-1H Civil Rotorcraft, dated 8 March 2018. The paper included reports on four non-fatal UH-1H driveshaft failure accidents.
8. Shank bound describes the condition when the nut is inhibited by the shank (grip or unthreaded portion of the bolt) before clamping torque is achieved.
9. SermeTel® coating is used for protection of metal components operating in severe environments at high temperatures.

On 6 July 2019, a Brumby Aircraft Brumby 610 Evolution amateur-built aircraft, recreational registration 24-8552, collided with terrain near Leigh Creek, South Australia. The pilot and single passenger were fatally injured.

In response to this accident, Recreational Aviation Australia (RAAus) commenced an investigation and subsequently requested technical assistance from the ATSB in the recovery of flight data from a Dynon EFIS and Garmin GPS.

To protect the information supplied by RAAus to the ATSB and the ATSB's investigative work to assist RAAus, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003.

Flight path data was successfully recovered from a Garmin GPSMap 495 – a representation of which is shown as Figure 1. This data was provided to RAAus investigators on 6 February.

Data was not recoverable from the Dynon FlightDEK-D180 (combined electronic flight instrument system and engine monitoring), and RAAus was advised on 29 May 2020.

Figure 1: Recovered Flight Data representation

This concludes the ATSB involvement in the investigation of this accident.

Any enquiries relating to the accident investigations should be directed to RAAus at: www.raa.asn.au.

_____________

The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003.

Overview of the investigation

At 0347 (Australian Eastern Daylight time – AEDT) on Tuesday 19 November 2019, at Picton NSW, the driver of a Qube freight train 3112 was checking on a report of a wheel defect on the fifth axle of the third locomotive in the train consist.

The possible defect was previously detected by the trackside inspection system at Exeter and the driver stopped 3112 at Burradoo to safely inspect the train. No defect was found.

The driver subsequently stopped the train on the mainline at Picton and disembarked in order to conduct a second inspection of the train. A Pacific National freight train passing on the adjacent line came within two metres of the driver of 3112.

ATSB’s preliminary evidence collection revealed:

• The detection of the potential wheel defect was made by the appropriate wayside detection equipment and was notified correctly to the train crew.
• The driver initially followed process and safely inspected the locomotive at Burradoo with no defect being found and continued the journey.
• The driver took advantage of a routine stop at Picton to re-inspect the locomotive on the safe side of the train (i.e. the side of the train away from the opposing main line) and found a minor wheel defect.
• The driver then made a decision to inspect the locomotive wheels from the other side of the train, next to the opposing main line, without seeking track protection, when the Pacific National freight train approached his location, leading to the near miss.
• The driver acknowledged the decision was an individual action.
• The driver of the Qube train was standing next to the train and took evasive action by holding onto the handrails of the locomotive ladder to avoid being struck by the Pacific National train.

ATSB comment 

Given the acknowledged individual action taken by the driver of the Qube train 3112, and based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.

Overview of the investigation

On 2 December 2019, the ATSB commenced an investigation into a runway overrun involving a Gippsland Aeronautics GA-8, VH-MTX, at Rurruwuy, Northern Territory.

The aircraft departed Garrthalala for Rurruwuy at 1240 Central Standard Time^[1] on a chartered passenger flight, with the pilot and three passengers on board. The pilot described the conditions at Rurruwuy as a ‘turbulent, thermally day’ and she elected to land on Runway 11 based on the windsock direction.

On final approach, the pilot noticed the airspeed was 2 knots above the planned reference landing approach speed. The pilot then assessed she was too high for her aiming point, which was the first tyre marker, and chose to aim for the second. The aircraft touched down beyond the second tyre marker, but then lifted off the runway. When the aircraft touched down again, it was beyond the halfway point of the runway.

The pilot attempted to stop the aircraft, but it overran the end of the runway resulting in substantial damage. There were no injuries to the pilot or passengers. Once the aircraft had stopped, the pilot noted that the windsock had shifted during the approach, favouring a landing on Runway 29.

Due to its relatively short length, Rurruwuy was classified by the operator as a ‘Marginal Airstrip’ for a GA-8, which meant specific pilot training was required. The pilot had completed this training prior to the occurrence.

As a result of the occurrence, the operator organised a pilot training day to discuss stabilised approaches.

As part of its investigation, the ATSB interviewed the pilot, and obtained information such as flight plans, photographs, maintenance information and details of the operator’s training procedures.

ATSB comment

Unexpected events during the approach and landing can exacerbate what is often a high workload period. Following standard operating procedures and correctly monitoring the aircraft and approach parameters provides assurance that an approach can be safely completed. If the criteria for safe continuation of an approach are not met, a go-around should be initiated.

Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

____________
[1]     Central Standard Time: Coordinated Universal Time (UTC) + 9.5 hours

Safety summary

What happened

On 25 November 2019, a Cessna 210M, registered VH-SJW and operated by Mistar Holdings, was conducting a charter flight with four passengers from Darwin to Tindal, Northern Territory. Soon after departure, the pilot diverted 5 NM right of the planned track to avoid a large storm cell that was 5 NM left of track. About 10 minutes after departure, while maintaining 3,500 ft, the aircraft encountered sudden and sustained severe turbulence. Control of the aircraft was lost for over 3 minutes, and three passengers sustained minor injuries.

After landing at Tindal and inspecting the aircraft for potential damage, the pilot ferried the aircraft to Millingimbi. At Millingimbi, the pilot picked up four more passengers for a charter to Galiwin’ku (Elcho Island). The pilot reported the incident to the operator that evening. Upon receiving notification of the turbulence encounter, the operator grounded VH-SJW at Galiwin’ku, pending an engineering inspection.

What the ATSB found

At 10 NM from the thunderstorm, the pilot did not have sufficient separation to ensure safe passage.

Following the incident, the inspection carried out by the pilot was not sufficient to ensure the airworthiness of the aircraft beyond doubt. Flying another charter flight without an aircraft inspection by a qualified person exposed the operator, the pilot, and the passengers to elevated risk. In addition, the operator did not have guidance to direct pilots to seek advice or peer support following abnormal events.

What has been done as a result

The operator has developed case studies for pilots, emphasising weather avoidance and management of abnormal events. These have been integrated into proficiency checks to ensure solid understanding of theory, and practical application of weather avoidance, escape and post encounter management.

Safety message

The primary protection against thunderstorm related turbulence is avoidance. In this case, 10 NM was not far enough. Operators, pilots and passengers can work together to avoid flying in adverse weather. For instance, by starting a day’s flying early it can be completed before weather becomes a problem in the afternoon.

A pilot with the best intentions may make a suboptimal decision after experiencing an abnormal event. Operators can provide guidance to assist pilots to make good decisions in these situations, by providing peer support and emphasising the importance of reporting abnormal events in a timely manner. Early reporting reduces pressure in operations, allowing ample time to make alternative arrangements.

To support continuous improvement in performance, pilots should regularly review operational documents and industry advice, to build on experience, and develop a comprehensive knowledge of issues and strategies available.

The investigation

The occurrence

Planned flights

On 25 November 2019, at 1119 Central Standard Time,^[1] a Cessna 210M, registered VH-SJW and operated by Mistar Holdings, departed Galiwin’ku (Elcho Island), Northern Territory, for a passenger charter flight with the pilot and three passengers on board. The flight had a planned stopover in Darwin, to collect another passenger, before continuing on to Tindal. From Tindal, the pilot planned to fly to Millingimbi empty, collect passengers, and return to Galiwin’ku (Figure 1). The flights were being conducted under visual flight rules (VFR).

The pilot briefed the passengers that seatbelts were to be worn at all times, and that they should be tight. The pilot visually checked the passenger’s seat belts before departure.

Figure 1: Charter flight route for VH-SJW

Source: Google Earth, annotated by the ATSB

Turbulence encounter

As per the forecast, on approach into Darwin Airport, the pilot noticed a large thunderstorm to the south of the city crossing the intended departure track. After landing at Darwin, the passengers disembarked and had about a 30-minute break before boarding the aircraft again.

The pilot accepted a departure delay from air traffic control (ATC) of 28 minutes. The air traffic controller recalled that multiple aircraft were requesting diversions due to storm activity. During this time, the pilot reviewed graphical area forecasts issued by Airservices Australia, and used Bureau of Meteorology weather radar to track the progress of the storm cell.

The aircraft departed Darwin at 1418 and the pilot was cleared to depart via VFR route 4. The pilot had identified that the storm cell was about 5 NM left of the planned track, so requested a diversion of 5 NM right of track to provide a 10 NM separation from the weather. ATC approved the pilot’s request. One of the passengers photographed the weather after they diverted (Figure 2).

Figure 2: Photograph taken by right centre row passenger

Source: Supplied by passenger aboard VH-SJW

About 10 minutes after take-off, the pilot reported maintaining an altitude of 3,500 ft. At about this time, and shortly after the photograph was taken, the aircraft was subjected to sudden severe turbulence.^[2] The mobile phone used to take the photograph fell under the pilot’s rudder pedals with the first significant drop in altitude. The pilot’s checklist and an iPad were also loose in the cabin.

The pilot was wearing a four-point harness and the passengers, seated in the centre and rear rows, all wore lap belts. There was no facility for the pilot and passengers to communicate over an intercom. Due to the high noise environment in the aircraft cabin, the pilot could only communicate with passengers using hand signals. As a result, the passengers were not warned of potential turbulence, or instructed to check their seatbelts were tight, and stow loose items.

The pilot reported tightening their own harness and initially aimed to climb to 4,500 ft, hoping to climb over the turbulence. This strategy changed in order to retain visual meteorological conditions.

Turbulence penetration speed^[3] for the Cessna 210M was 119 kt. The pilot stated that, during the incident, airspeed could not be controlled through changing power settings, and for the most part the airspeed could not be held below 155 kt. For extended periods, the pilot had no control over bank angle, height, or heading. At one stage, the airspeed dropped below 140 kt, and the pilot lowered the landing gear in order to create drag and slow the aircraft down.

The backrest of the centre row of seats in VH-SJW could be folded forwards for access to the rear row of seats, which was standard. One centre row passenger found it difficult to brace against the moveable seat back, and though wearing a seatbelt, reported not being sufficiently secure. This passenger’s neck was injured in the incident.

The turbulence encounter lasted about 3.5 minutes. Radar at Darwin recorded the aircraft’s highest groundspeed as 210 kt, and rate of descent at one point to be 5,000 ft/minute with a lowest altitude of 1,200 ft.

The pilot gave the passengers a ‘thumbs-up’ indication when control was returned and continued to Tindal Airport in mild turbulence and rain.

After landing

The aircraft landed at Tindal Airport at 1538, and the passengers disembarked 5 minutes later. The passengers reported that the pilot asked if they were okay but said the pilot did not de-brief them on the incident other than to say that it was normal turbulence. The pilot did not report the turbulence encounter to the operator or the ATSB.

A passenger stated that the group was distressed by the incident, and, with no debriefing or advice, they went directly to their accommodation. In retrospect, the passenger believed the group should have instead gone to hospital to be checked over. Three of the passengers later visited hospital for shoulder and neck injuries, and one case of damage to a pre-existing leg injury.

Recognising the potential for damage to the aircraft from the turbulence encounter, the pilot reported conducting a thorough daily inspection at Tindal. The pilot spent a total of 31 minutes on the apron at Tindal before departing for Milingimbi at 1614. At Milingimbi, the pilot met four passengers and flew them to Galiwin’ku.

At Galiwin’ku, the pilot told the operator’s base manager about the turbulence encounter. The base manager advised the pilot to contact the head of flight operations (HOFO). The pilot did so and the HOFO instructed the base manager to ground the aircraft and ordered an engineering inspection of the aircraft for flight under abnormal loads. An engineer carried out the inspection the following day and returned the aircraft to service after finding no defects.

Context

The pilot

The pilot of VH-SJW held a commercial pilot licence (aeroplane) and had 802 hours’ aeronautical experience, with 550 hours as pilot in command, and had flown in the region for the operator for 11 months. Upon commencement with the operator in December 2018, the pilot underwent a course of training designed to bridge the gap between commercial licence training and commercial operations in general aviation. This included exposure to decision making around adverse weather.

Weather information

Meteorological conditions over the northern half of Australia are favourable for thunderstorms from October through to March. Abundant moisture and instability is present through most of the Wet Season. During this time, low pressure lies across northern and central Australia, giving rise low-level convergence and vertical motion necessary for thunderstorm development. During these months, thunderstorms during the afternoon are a common occurrence due to the convergence of sea breezes with an east to south-easterly synoptic wind regime (Figure 3).

The Bureau of Meteorology, in its guide Flying the Tropics (2012), stated:

The convective cloud bases can be very high (sometimes up to 15 000 feet), with very severe downdraughts from the cloud base to the surface. For this reason, flights should never be conducted under or through precipitation (including virga) from towering cumulus or cumulonimbus clouds.

Figure 3: Mechanism of local storm generation

Source: ATSB

The weather forecast for Darwin received by the pilot before departure stated:

PROB30 TEMPO 2505/2514 VRB20G45KT 1000 THUNDERSTORMS WITH MODERATE RAIN BKN010 SCT025CB

That translated as a 30 per cent probability of thunderstorms for periods of at least 30 minutes but less than 60 minutes, and wind variable in direction with gusts up to 83 km/h (45 kt), accompanied by low cloud and rain with low visibility around Darwin from 1430 local time onwards. Tindal shared similar predicted conditions although any thunderstorms were expected for periods of less than 30 minutes.

The routine report of meteorological conditions at Darwin Airport at the time VH-SJW was readying for departure stated:

METAR YPDN 250430Z 31010KT 9999 VCSH FEW045 FEW045CB 34/21 Q1008 TEMPO 0530/0730 VRB20G45KT 1000 TSRA BKN010 SCT025CB RMK RF00.0/000.0

This translated as surface wind from the north-west at 18 km/h. Visibility was 10 km or greater, with showers in the vicinity of the airport. Cloud at 4,500 ft covered up to one half of the sky, and the layer included embedded cumulonimbus. The air temperature was 34 °C and the pressure (QNH) was 1,008 hPa. Additionally, a trend forecast was included with the report, warning of the expectation of periods of thunderstorms. These would have low cloud at 1,000 ft covering three quarters of the sky and cumulonimbus at 2,500 ft covering up to half the sky, bringing rain with variable wind gusting from 35 to 83 km/h, and reduced visibility of 1,000 m.

The pilot used information from a Bureau of Meteorology high-resolution Doppler radar, located 5.5 NM to the east of Darwin, to aid awareness of the weather conditions. There are, however, limitations to that technology. Heavy rain closer to the radar will absorb energy and reduce the displayed intensity of other cells behind it. Additionally, the image is a composite of the last 6 to 10 minutes of data and shows where the weather was, not where it is. A cell could be much closer and more intense than displayed.

Figure 4 shows satellite images that captured the build-up of thunderstorm activity on the day. In the first frame at 1230 Darwin (YPDN) is relatively clear of cloud. After VH-SJW arrives in Darwin, the next hour shows significant build-up of cloud on VH-SJW’s intended track to Tindal (YPTN).

Figure 4: Satellite images of thunderstorm development at the time

Source: Bureau of Meteorology annotated by ATSB

Procedures and guidance

In August 2019, the operator amended its operations manual with a section titled ‘Adverse weather operations’. This section required pilots to avoid thunderstorms by 20 NM during the cruise phase of flight. The pilot had signed to confirm receipt of the operations manual amendment on the day it was issued. The operator also created a training program to support the amendment. The pilot had not received the training before the incident flight.

The safety message of ATSB report AO-2017-102,^[4] an investigation of a fatal turbulence penetration event involving a Cessna 210 in the Northern Territory, stated that diversions of 10 NM may not be sufficient. That report was presented by an ATSB investigator in the pre-season Top-End safety briefing hosted by the Civil Aviation Safety Authority in Darwin on 9 October 2019. The operator’s pilots on Galiwin’ku (Elcho Island) could not attend, and instead got together to watch the 2018 briefing which was available via the internet.

In interview, the HOFO stated that pilots were encouraged to report incidents, and in some cases, such as for birdstrike, there were written requirements and instructions for reporting and managing the event. Even though the operator provided pilots with extensive guidance on avoidance of adverse weather, the HOFO stated that there was no formal guidance for the actions for pilots to follow after encountering severe turbulence.

Safety analysis

Anticipating and avoiding turbulence

The primary tool for reducing the risk of turbulence encounters of this type is avoidance of the associated weather phenomenon. Advice existed for the pilot in the operations manual that a 20 NM separation was required. A previous ATSB investigation report stated that 10 NM separation may not be enough, and a recent seminar repeated the message. Unfortunately, partially due to the reality of remote area operations, the pilot missed these recent reminders.

By diverting 5 NM right of track, and being 10 NM from the cell, the pilot was still too close to the weather phenomenon. Although the extent of loss of control was unexpected, some turbulence could be reasonably foreseen.

The pilot was well secured by wearing a harness, yet the passengers and cabin were not sufficiently prepared. The brief before flight stated that seatbelts were to be worn at all times, and that they should be tight, and the pilot conducted a visual check before departure. During flight when turbulence is anticipated or encountered, these instructions should be repeated with instruction to stow all loose items. In this case, an inability to communicate via intercom with the passengers while airborne limited the pilot’s ability to prepare the cabin.

Post incident reporting

A loss of control due to weather is an immediately reportable matter for an air transport operation under Regulation 2.3 (3)(s) of the Transport Safety Investigation Act 2003. In accordance with section 18 of this Act, the occurrence must be reported as soon as is reasonably practicable to the ATSB by telephone and a follow up written report must be made within 72 hours. The requirement to ensure a report is made resides with all responsible persons having knowledge of the occurrence.

The pilot did not report the turbulence encounter to the operator until after the last flight. From that point, the pilot and operator both had a responsibility to report the encounter to the ATSB. The encounter was reported by the operator 7 days after it occurred. It is important for preservation of perishable evidence that occurrences are reported as soon as practicable.

Operational support and management of risk

During the turbulence encounter and loss of control, the pilot was sure that no airframe limitations were exceeded. If the limitations were not exceeded, the pilot was not legally required to cease operations in that aircraft. However, when encountering such a high level of turbulence, the aircraft instruments may not present an accurate picture of what the aircraft experiences. It was reasonable to assume that airframe limitations could have been exceeded.

A pilot may not recognise or appreciate the implications of an abnormal event until a much later time. An objective view from a peer or senior person can lead pilots to make better decisions after an abnormal event.

Without formal guidance as to next steps following an encounter with severe turbulence, the pilot did not report the incident, or seek outside input into decision-making. Subsequently, the pilot prescribed a suboptimal inspection for the circumstances. The pilot did recognise the potential for damage, and inspected the aircraft to the extent that a pilot could. Licenced aircraft maintenance engineers are qualified to inspect aircraft for abnormal flight loads, yet the pilot did not consider such an inspection was necessary. Although the later engineering inspection found no defects, continuation of flight without an appropriate inspection exposed the pilot, operator, and passengers to additional, avoidable risk.

The operator demonstrated active risk management by grounding the aircraft to ensure its airworthiness after receiving a report of the occurrence. This set a visible benchmark of risk tolerance, which if supported by formal guidelines, would clearly set the operator’s expectations of its pilots.

Even in remote areas, pilots are not expected to manage the safety of a flight on their own, and facilities exist for pilots to enlist support and seek alternative solutions. Operators should ensure that there are well-communicated and structured solutions in place.

On the operational level, reporting issues as early as possible gives an operator time to develop alternative solutions for customers, which takes any acquired operational pressure away from the pilot. This supports pilots in cautious decision-making.

Another tool to assist in pilot decision-making is passenger debriefing. It is an opportunity for the pilot and passengers to process the occurrence and develop strategies for next steps and future avoidance.

Findings

From the evidence available, the following findings are made with respect to the turbulence encounter and loss of control involving VH-SJW on 25 November 2019.

Contributing factors

• Although the pilot diverted 5 NM right of track to avoid a large storm cell that was 5 NM left of track, the 10 NM separation from the storm was not sufficient and the aircraft encountered severe turbulence, resulting in a loss of aircraft control.

Other factors that increased risk

• The operator provided no formal guidance to pilots with respect to immediate reporting of abnormal events, and the pilot did not make an immediate report.
• The pilot flew another passenger charter flight in the incident aircraft before reporting the turbulence encounter and loss of control to the operator. Upon receiving the notification, the operator immediately grounded the aircraft for a precautionary airframe inspection.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot of VH-SJW
• passengers aboard VH-SJW
• Mistar Holdings (operator of VH-SJW)
• Department of Defence (air traffic control provider)
• Bureau of Meteorology
• Civil Aviation Safety Authority.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• pilot of VH-SJW
• Mistar Holdings
• Bureau of Meteorology
• Civil Aviation Safety Authority
• Department of Defence.

Submissions were received from the Bureau of Meteorology and Mistar Holdings (safety action only). The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

1. Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours.
2. Severe turbulence: turbulence resulting in an inability to control the aircraft.
3. Turbulence penetration speed: an airspeed designed to protect the airframe from overstress in turbulent conditions.
4. ATSB AO-2017-102, In-flight breakup involving Cessna 210, VH-HWY, 22 km east of Darwin Airport, Northern Territory, on 23 October 2017.

Safety summary

What happened

On 19 October 2019, a Piper PA-28-161, registered VH-XDI (XDI), operated by the Australian Airline Pilot Academy (AAPA), was inbound to Albury, New South Wales (NSW) from Wagga Wagga, NSW, on a training flight. The pilot was the only person on board. An ATR72-212A, registered VH-FVR (FVR), operated by Virgin Australia Airlines, was also inbound to Albury on a scheduled passenger flight from Sydney, NSW. There were two flight crew, two cabin crew and 66 passengers on board.

During the approach, the pilot of XDI turned on to the base leg of the circuit in front of FVR. The crew of FVR received a traffic collision avoidance system (TCAS) traffic advisory (TA) and conducted a missed approach to increase separation. Separation between the two aircraft reduced to about 110 metres horizontally and 75 feet vertically.

What the ATSB found

The ATSB found that the pilot of the PA-28 did not sight the ATR aircraft, which the controller had instructed them to follow, and did not advise the controller they did not have the aircraft sighted before turning in front of the ATR aircraft, resulting in a near collision. The crew of the ATR were aware that there was traffic in the area but did not assess the position of the PA-28, in relation to their aircraft until activation of the TCAS TA.

The ATSB also identified that the air traffic controller did not confirm that the pilot of XDI correctly understood the planned method of sequencing the two aircraft by requiring readback of the instruction to sight and follow the ATR, nor did they seek confirmation that it had been sighted. The controller did not identify the developing near collision as they were not effectively monitoring the aircraft in the circuit area due to their attention being focussed on another aircraft.

What's been done as a result

Following this occurrence AAPA implemented additional controls for students operating to Albury Airport. The academy also took action to ensure their pilots receive additional education and training on procedures for airports in Class D airspace (controlled airspace that surrounds general aviation and regional airports equipped with a control tower such as Albury) and complete training on air traffic control clearance requirements and compliance.

Virgin Australia have reminded all their crews of the separation that is provided in Class D airspace. Additionally, Virgin Australia and Airservices Australia have begun discussions to convene a cross industry stakeholder meeting to include operators, Civil Aviation Safety Authority, ATSB and the broader industry to discuss the ongoing risk to operations at non-controlled and airports in Class D airspace.

Safety message

This serious incident illustrates the danger of assumption and incomplete situational awareness.

Although separation between the two aircraft was the pilots’ responsibility on this occasion, the controller had recognised the potential conflict and implemented a plan to sequence their arrival. However, confirmation was not sought from the pilot assigned to follow the ATR that they understood the plan. Additionally, all parties made incorrect assumptions about the aircraft movements rather than taking positive action to confirm that adequate separation would be maintained.

The occurrence

What happened

On the 19 October 2019, at 1100 Eastern Daylight‑saving Time,^[1] a Piper PA-28-161, registered VH-XDI (XDI), operated by Australian Airline Pilot Academy, was inbound to Albury, New South Wales (NSW), from Wagga Wagga, NSW. The pilot was conducting a training flight and was the only person on board. At the same time, a Virgin Australia Airlines ATR72-212A, registered VH‑FVR and operating as Velocity 1174, was also inbound to Albury on a scheduled passenger flight from Sydney, NSW. On board the aircraft were two flight crew, two cabin crew and 66 passengers.

The pilot of XDI contacted the controller and was cleared to enter Albury airspace from the north via Holbrook at 3,500 ft, below a broken cloud base at 4,000 ft but with visibility in excess of 10 km. While the aircraft was inbound, the crew of Velocity 1174 contacted the controller and was cleared to conduct an RNAV Z RUNWAY 25 approach.

Figure 1: Aircraft tracks as recorded by the ADSB systems on-board the aircraft

Image shows the inbound tracks of VH-XDI joining a right circuit and Velocity 1174 conducting a straight-in approach. The area a third aircraft was operating is also marked.
Source: Airservices Australia, Google Earth - annotated by ATSB.

At approximately 1118, another aircraft (Aircraft 3) departed Albury on a local scenic flight towards Bethanga (Figure 1). Shortly afterwards, the controller tried to contact the pilot of XDI and after not receiving a response, they attempted contact a second time. This time the pilot responded and was instructed to join the mid‑downwind leg of the right circuit for runway 25. The pilot was then provided with an onwards clearance after the touch-and-go landing. Immediately after this, the crew of Velocity 1174 advised the controller that they were at the final waypoint^[2] and the controller cleared them to land.

The controller subsequently advised the pilot of XDI that ‘…you’re number two following an ATR on about a four‑mile final, report traffic in sight’. The pilot acknowledged the instruction by advising the aircraft’s callsign but did not repeat any part of the instruction back to the controller. About 40 seconds later, XDI joined the downwind leg (Figure 1) for a right circuit to runway 25 (Figure 2).

Figure 2: XDI turning downwind with Velocity 1174 on approach

Source: Airservices Australia annotated by ATSB

After advising the pilot in XDI to report sighting the ATR and observing the aircraft join downwind, the controller diverted their attention to Aircraft 3 to ensure that aircraft did not pass in front of the ATR. The pilot of the third aircraft advised the controller that they had the Virgin aircraft sighted shortly after XDI turned on to downwind. The controller acknowledged this and requested that the pilot report with their intentions at Bethanga.

The controller advised the ATSB that, due to their focussed attention on the third aircraft, they were not monitoring XDI as the aircraft continued on the downwind leg and turned on to the normal base leg of the circuit (Figure 1). At that point the pilot of XDI had not sighted the ATR or advised the controller that they did not have it sighted (Figure 3).

Figure 3: XDI turning base with Velocity 1174 on about 3 km (1.8 NM) final

Source: Airservices Australia annotated by ATSB

As Velocity 1174 passed approximately 600 ft above ground level (AGL), the crew received a traffic collision avoidance system^[3] traffic advisory (TCAS TA)^[4] and, in response, began to visually acquire the aircraft causing the alert. They quickly identified the PA-28 below them; the aircrafts’ separation at that stage was about 111 metres (.06 NM) horizontal and 75 feet vertical. Due to the proximity of the two aircraft, the crew of Velocity 1174 immediately commenced a missed approach.

The controller reported not observing the near collision, only shifting attention back to the involved aircraft when the crew of the ATR reported the missed approach. This occurred 2 minutes and 14 seconds after the controller had instructed the pilot of XDI to report sighting the ATR. The controller advised that, as the ATR was already conducting a missed approach, a safety alert was not issued.

The pilot of XDI advised the ATSB that when Velocity 1174 was first sighted it was so close that the pilot lowered the nose of the aircraft to increase separation. The crew in Velocity 1174 was conducting a missed approach and passing above the PA‑28 when the controller contacted the pilot of XDI and advised that their aircraft had turned in front of Velocity 1174 and requested the pilot’s intentions. After the pilot of XDI acknowledged this request with registration only, the controller cleared the aircraft to land. However, due to an assessment by the pilot that the aircraft was too fast, a go-around was conducted. The controller then cleared XDI to depart the airspace.

Pilot of XDI

The pilot of XDI was an international student, completing flying training in Australia and had obtained a private pilot licence on the day before the incident (the pre‑requisite aviation English Language Proficiency test had been successfully passed a few months before). On the day of the occurrence, the pilot was conducting a navigation exercise as part of the commercial pilot licence syllabus. The pilot had flown to Albury on a number of occasions, both with an instructor and solo.

The pilot reported understanding the controller’s instructions during the incident flight, specifically the requirement to track as number two to the ATR. The ATSB reviewed recordings of the radio communications while XDI was inbound to Albury Airport. This review found that the radio transmissions from the controller and both Velocity 1174 and the third aircraft were spoken slowly and clearly, although the crew of Velocity 1174 referenced a radial and an inbound instrument flight rules (IFR)^[5] waypoint that may not be familiar to some VFR pilots.

The pilot recalled that there was only one other aircraft operating in the circuit area (that is, the Velocity aircraft as per the controller’s instructions) at the time, which indicated that they were unaware that the third aircraft had departed. The pilot was also unaware that the Velocity call sign was that of a commercial aircraft.

After joining downwind, the pilot assumed the crew of the aircraft to be followed (Velocity 1174) had sighted XDI. Before turning on to the base leg of the circuit, the pilot recalled carrying out normal visual checks to ensure the base and final legs were clear. The check did not involve looking along the long final flightpath, as the pilot assumed that Velocity 1174, which had been cleared to land before XDI joined downwind, was either on short final or had landed.

Flight crew of FVR

The flight crew of FVR had been operating in cloud, becoming visual at around 4,000 ft AGL. The first officer, who was the pilot monitoring,^[6] advised being aware of another aircraft in discussion with the controller but did not receive information on that aircraft and did not expect to, as the controller had instructed XDI to follow FVR in the circuit. They did not assess where the other aircraft was in relation to their approach.

The crew advised completing their required pre-landing checklists when the captain, who was the pilot flying, detected the TCAS TA. They immediately began scanning to visually acquire the aircraft. They advised that, as they sometimes received traffic advisories during approach from aircraft operating on the ground or at low level near an airport, they initially started looking on the runway surface. The TCAS display gave an indication that the aircraft was operating in the forward right quadrant from the aircraft. The first officer quickly identified the PA-28 on the base leg of the circuit and assessed that the aircraft, while very close, would pass behind them. The captain immediately initiated a missed approach.

The TCAS system was designed such that when the aircraft was on descent and passed below 900 ft AGL, the system would not generate a resolution advisory (RA) or an aural alert. The crew advised that they have regular training on responding to a TCAS RA but have not discussed how to manage a TCAS TA during an approach when the aircraft is below 900 ft and the RA and aural warning functions were inhibited.

Provision of separation in Class D airspace

The controlled airspace around Albury Airport was classified as Class D airspace.^[7] In accordance with the Manual of Air Traffic Services (MATS) 2.4.1.1, when operating in Class D airspace, controllers were required to provide separation between two or more aircraft operating under IFR, and between aircraft operating under IFR with aircraft operating under Special Visual Flight Rules (VFR).^[8] There was no requirement to apply a separation standard between an aircraft operating under IFR with an aircraft operating under VFR.^[9] There was, however, a separation standard applied to all aircraft operating on the runway.

The Aeronautical Information Publication (AIP) En Route 1.1 section 2.2.1 stated that an air traffic control (ATC) clearance was required for all flights operating in Class D airspace. MATS stated that the objective of an ATC clearance^[10] (clearance) was ‘to prevent collisions, and to expedite and maintain an orderly flow of air traffic’. Flight crews were required to follow all clearances and ATC instructions (instructions).^[11]

En Route 1.4 section 2.2.1 stated that in the traffic circuit, pilots were ‘required to position their aircraft in such a manner that, while complying with clearances and instructions from ATC, they maintain the necessary separation from other traffic’. En Route 1.1 section 2.13.1.4 stated that when a pilot was ‘issued with a sequencing instruction, a pilot must follow the preceding aircraft and continue to do so unless otherwise instructed by ATC’. It also required that ‘if the preceding aircraft cannot be sighted and identified, the pilot must advise ATC’. MATS section 10.8.1.4.3 stated that the controller should ‘when necessary, obtain corroborative evidence from the pilot of one aircraft on the relative position of the second aircraft’.

MATS section 12.5.1 stated that ‘significant traffic information' is required to be given to pilots, where applicable, when they request a clearance to enter the aerodrome traffic circuit. MATS defined ‘traffic information’ as ‘information issued by an ATS unit to alert a pilot to other known or observed air traffic which may be in proximity to the position or intended route of flight and to help the pilot avoid a collision’. However, MATS 10.7.2.5 stated that traffic information should be provided where in the controller’s judgement, ‘one aircraft may observe the other aircraft either visually or by ACAS^[12] and could be uncertain of the intention of that aircraft’.

Visual separation methods

MATS 10.7.2 permits the controller to base separation on the aircrafts’ projected flight paths, where the projected flight paths do not conflict. In this case, the controller observed one aircraft on straight-in final and observed the other turn on to the downwind circuit leg.

MATS 10.8.1 allows for the responsibility for visual separation to be assigned to the pilot. The controller passed traffic information in sufficient time and detail (ATR on 4 NM final) to enable the pilot of XDI to identify and maintain separation from FVR. MATS 10.1.5.2 advised that when the pilot acknowledged the instruction, they assumed responsibility for separation from FVR.

Summary

Apart from runway operations, there was no separation standard required between VFR and IFR aircraft operating in Class D airspace, but flight crew were required to follow the instructions provided by controllers. An instruction given by a controller is to prevent collisions, however, separation between aircraft was the responsibility of flight crew. While not applying separation standards, controllers use separation methods to ensure aircraft do not conflict. Additionally, traffic information should be passed in situations where the controller considers pilots may be uncertain of the intentions of a second aircraft.

Clearance readback

According to the AIP General 3.4–13 4.4 the pilot must read back ‘ATC clearances, instructions and information which are transmitted by voice’. According to MATS 9.2.2.13 ATC must ‘obtain a readback in sufficient detail that clearly indicates pilot's understanding of and compliance with all ATC clearances, including conditional clearances, instructions and information which are transmitted by voice’.

Airservices Australia assessed that the pilot was not required to read back the instruction that XDI was ‘…number 2 following an ATR on about a four-mile final…’, and to ‘…report traffic in sight.’ as the pilot had acknowledged the instruction and did not request clarification. Readback requirements were detailed in MATS section 9.2.2.13 subsections 1 and 2:

• an ATC route clearance in its entirety, as well as any amendments
• en route holding instructions
• any route and holding point specified in a taxi clearance
• any clearances, or instructions to hold short of, enter, land on, line-up on, wait, take-off from, cross, taxi or backtrack on, any runway or helicopter landing site (HLS)
• assigned runway or HLS
• any approach clearance
• altimeter settings directed to specific aircraft, radio and radio navigation aid frequency instructions
• secondary surveillance radar codes, data link logon addresses
• level instructions, direction of turn, heading and speed instructions.

Airservices Australia advised that if the pilot of XDI had reported sighting the ATR, then they would have been issued a subsequent instruction to follow the aircraft, which would have been required to be read back.

Previous occurrences

A search of the ATSB database revealed that between 1 January 2010 and 31 December 2019, there were three near collisions (including this occurrence) involving regular public transport (RPT) aircraft in the vicinity of an airport, below 2,000 ft. Two of these occurred on short final at Albury Airport in 2019.

Safety analysis

The pilot of XDI understood the requirement to track as number two to the ATR but was unaware Velocity 1174 was a transport category aircraft conducting a straight-in approach to the airport. The assigned traffic sequence was intended to ensure separation was maintained, and hence it is likely the controller assessed that XDI was not significant traffic for the ATR and did not pass traffic information to its crew. Nevertheless, the crew of the ATR were aware that an aircraft was operating in the area but did not visually assess the position of XDI in relation to their approach path until the activation of the TCAS TA.

As the ATR was cleared to land prior to the PA‑28 entering the circuit area, the pilot of XDI assumed the ATR was either on short final or had landed before XDI turned on to the base leg of the circuit. Consequently, they did not check for aircraft on long final before turning base. However, when the pilot of XDI did not report sighting the ATR as expected, the controller was required to obtain corroborative evidence from the pilot on the position of the ATR. This was a missed opportunity by both the pilot and the controller to ensure separation was maintained.

While there was no requirement for the controller to provide separation between the two aircraft, the potential conflict between them had been identified by the controller and a plan established to sequence their approach. The controller passed responsibility for separation to the pilot of XDI with the instruction to sight and follow the ATR. However, they did not require the pilot of XDI to readback the instruction, removing the opportunity for the controller to confirm the pilot correctly understood the sequencing plan.

Additionally, once the instruction was given to the pilot of XDI, the controller focussed their attention on the third aircraft. This resulted in limited visual scanning of the ATR and PA-28, which in turn prevented visual identification of their developing proximity. In combination, these factors led to the near collision not being identified by the controller or the pilots until the crew of the ATR received the TCAS TA and reported commencing the missed approach.

Findings

From the evidence available, the following findings are made with respect to the near collision between Piper PA 28, VH-XDI and ATR72, VH-FVR at Albury Airport, New South Wales, on 19 October 2019.

Contributing factors

• The pilot of the PA-28 did not cite the ATR aircraft, which the controller had instructed them to follow, and did not advise the controller they did not have the aircraft sighted before turning on to the base leg of the circuit in front of the ATR aircraft, resulting in a near collision.
• The crew of the ATR were aware that there was traffic in the area but did not assess the position of the PA-28, in relation to their aircraft until activation of the TCAS TA.
• The controller did not seek confirmation that the pilot of XDI had sighted the ATR before diverting attention to an aircraft outside the circuit area. This interrupted the effective monitoring of the aircraft in the area and the developing near collision was not identified.

Other factors that increased risk

• The controller did not confirm the pilot of XDI correctly understood the planned method of sequencing the two aircraft.

Safety actions

Virgin Australia Airlines and Airservices Australia have commenced discussions to convene a cross industry stakeholder meeting to include operators, the Civil Aviation Safety Authority, ATSB and the broader industry to discuss the ongoing risk to operations at non‑controlled and Class D airports. Virgin Australia Airlines also reiterated to their crews the separation that is provided within Class D airspace.

Australian Airline Pilot Academy

Following this occurrence, AAPA conducted an internal investigation and implemented the following additional risk controls:

• regular face-to-face seminars have been organised between controllers at Albury Tower and new students to explain operations in Class D airspace before students complete their first solo flight to Albury
• a presentation on Albury Class D airspace has been prepared for inclusion in ground school together with a training package simulating ATC interactions and clearances
• additional approvals and briefings are required before a student can flying solo to Albury.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the involved pilots and air traffic controller
• Australian Airline Pilot Academy
• Virgin Australia Airlines
• Airservices Australia.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the involved pilots and air traffic controller
• Australian Airline Pilot Academy
• Virgin Australia Airlines
• Airservices Australia
• Civil Aviation Safety Authority.

Submissions were received from:

• the involved air traffic controller
• Australian Airline Pilot Academy
• Virgin Australia Airlines
• Airservices Australia
• Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. Waypoint: A defined position of latitude and longitude coordinates, primarily used for navigation.
3. Traffic alert and collision avoidance system (TCAS): a type of airborne collision avoidance system (ACAS).
4. Traffic advisory (TA): an alert issued by an airborne collision avoidance system (ACAS) when the detected traffic may result in a conflict. Pilots are expected to initiate a visual search for the traffic causing the TA.
5. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
6. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
7. Class D airspace: Controlled airspace that surrounds general aviation and regional airports equipped with a control tower.
8. Special VFR: A VFR flight cleared by air traffic control to operate within a control zone in meteorological conditions below visual meteorologic conditions.
9. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
10. Clearance: Authorisation for aircraft to proceed under conditions specified by an ATC unit.
11. Instruction: Directives issued by ATC for the purpose of requiring a pilot to take a specific action.
12. Airborne Collision Avoidance System: Air system based on secondary surveillance radar (SSR) transponder signals which operates independently of ground-based equipment to provide advice to the pilot on potential conflicting aircraft that are equipped with SSR transponders.