On 8 January 2019, as The Overland passenger train, 3MA8, approached the Thompson Road level crossing at North Geelong, Victoria, the train crew noticed that the flashing lights had not activated and the boom gate had not lowered as expected. While the crew noticed the irregularity, it was too late to take substantive action and the train passed through the level crossing unprotected. The crew reported that several road vehicles were in the vicinity of the level crossing at that time, but none were in the danger zone.
What the ATSB found
The ATSB found that, in preparation for stage one track work, the Thompson Road level crossing was to be isolated for the broad and dual-gauge tracks only. The level crossing protections for the adjacent standard-gauge track, which was to continue operating as normal until stage two works at a later date, were to remain active. However, the signalling tester, following the isolation plans provided, mistakenly isolated the level crossing for the stage two work, in addition to stage one. While the stage one and stage two works were to be conducted separately, the signalling tester‑in-charge provided the signalling tester with the isolation plans for both stages in one package.
VicTrack, through their contractor UGL Engineering Limited, did not provide the tester-in-charge or signalling testers with specific instructions detailing the scope of work to be conducted at each stage of the project, but rather, only provided packaged isolation plans for the entire project. The absence of these instructions increased the risk of the works being incorrectly implemented.
What has been done as a result
As a result of this occurrence, VicTrack has advised that improvements had been made at the task‑based level by including specific work instructions for each task associated with each isolation plan.
Safety message
A work instruction is a step-by-step guide on how to perform a specific task or activity, in support of a process or procedure. They are an important defence within a safety system for ensuring the work is performed safely and as intended. This occurrence highlights the importance of providing clear, concise, and detailed work instructions to reduce the risk of errors during critical safety work.
The occurrence
Preparation for planned track work
On the morning of 8 January 2019, planned track work was to commence at the North Geelong, Victoria ‘C’ signal box. The work, managed by VicTrack, involved the removal, modification, and installation of signalling equipment and was to be performed in several stages over January 2019. Stage one affected the two broad-gauge and single dual-gauge tracks (managed by V/Line) and would temporarily impact the operation of several level crossings including those at Thompson and Anakie Roads. Stage two involved works on the adjacent Australian Rail Track Corporation (ARTC) standard-gauge track, to be performed at a later date (see Planned work).
At about 0734 Eastern Daylight-saving Time,[1] a track warrant possession (TW2)[2] was issued to exclude rail traffic and allow the work to proceed safely. The exclusion applied to trains operating on the two broad-gauge and single dual-gauge tracks (stage one). The ARTC standard‑gauge track would be protected between train services,[3] but remain operational, as specified in the project planning documents and ARTC Train Notice 2668,[4] until stage two.
Prior to commencing the work, several briefings were conducted involving the various project work teams. The signalling tester-in-charge (TIC) also conducted a separate pre-work briefing with the signal test teams (see Personnel involved). Specifically, the TIC reported mentioning that the standard-gauge track would remain open for normal traffic, but would be protected. The ARTC certified signalling tester (signalling tester) also attended the briefings, but could not recall any discussions regarding train movements.
The TIC, that morning, provided the signalling tester a package of isolation plans (wiring drawings) for the work (see Isolation plans and package), which included the plans for both the stage one and stage two works. Following this, a test team (test team 1), consisting of the signalling tester and an assistant, made their way to the equipment relay room[5] near the Thompson Road level crossing at North Geelong.
For the work, some of the signalling infrastructure at the Thompson and Anakie Road active level crossings needed to be electrically isolated for the broad-gauge and dual‑gauge tracks. In preparation for this, the signalling tester assembled the electrical jumpers needed to isolate each circuit identified on the isolation plans.
Level crossing isolation
At 0954, the TIC contacted the network control officer (NCO) to arrange an infrastructure booking advice[6] for Thompson Road. Shortly after, the TIC notified the signalling tester at the equipment relay room to commence work. The tester began applying the jumper cables[7] to the relay contacts of all four tracks to isolate the Thompson Road level crossing, as detailed within the packaged isolation plans provided (see Isolation plans and package).
At about 1048, after applying the jumper cables, the tester verified that the level crossing was functioning by activating the local push-button.[8] Upon verification, the team left and made their way to the next crossing at Anakie Road. The test triggered an alarm on the Phoenix control system[9] display in the ARTC train control centre in Adelaide, South Australia. The NCO received a level crossing fault alarm, and the ‘Thompson Road’ text changed colour to red to indicate it had been activated (Figure 1). The NCO immediately contacted the operations coordinator[10] and asked if the crossing was okay, and not affected, and would operate as normal. The operations coordinator advised the NCO that the crossing should operate as normal.
Figure 1: Phoenix replay of the Thompson Road level crossing alarm
Note: The level crossing fault alarm is a pop-up dialog box, not shown in this image. Time is Central Daylight-saving Time (CDT), Coordinated Universal Time (UTC) +10.5 hours.
Source: ARTC, annotated by the ATSB
Once at Anakie Road, the tester began applying the isolations, similar to the process followed at Thompson Road.
Train 3MA8 approaching Thompson Road
Soon after, The Overland passenger train 3MA8 was nearing the Thompson Road level crossing, operating on the ARTC standard-gauge track. The train crew had been previously made aware by the NCO that track workers were operating at the North Geelong ‘C’ signal box. As the train approached, the crew noticed that the level crossing lights had not activated and the boom gates had not lowered. In response, they commenced braking, reduced the throttle, and sounded the horn to alert approaching road traffic. At about 1054, the train passed through Thompson Road at a reported speed of about 50 km/h, with the level crossing protections inactive. Although there was road traffic in the vicinity of the crossing, no vehicles were in the danger zone[11] at the time the train passed through. The Phoenix replay (Figure 2) showed the ‘Thompson Road’ text white, indicating the crossing was not active as 3MA8 passed (represented by the red line).
The crew contacted the NCO and advised of the occurrence. The train continued its journey as normal. The Anakie Road level crossing, about 650 m further along from the Thompson Road level crossing, operated normally for train 3MA8.
Figure 2: Phoenix replay of the occurrence
Note: Time is Central Daylight-saving Time (CDT), Coordinated Universal Time (UTC) +10.5 hours.
Source: ARTC, annotated by the ATSB
The NCO immediately called a project representative in the site office near Separation Street who spoke with the TIC about the occurrence. The TIC then contacted the tester, now located at Anakie Road. The tester, who was in the process of applying the jumper cables (but had not yet isolated the level crossing), stopped work and returned to Thompson Road. The TIC also proceeded to Thompson Road.
From about 1120, the TIC reinstated and tested the affected level crossings. During this process, it was determined that the tester had applied jumper cables to all tracks, consistent with stage two implementation. All further work was suspended until further notice. Later that day, an ARTC representative validated the reinstatement actions and normal working resumed through the Thompson Road level crossing.
The Thompson Road level crossing at North Geelong is located about 72 track kilometres south‑west from Melbourne, on the main line between Melbourne and Adelaide. The level crossing had active protections, which included physical barriers, warning signs, line markings, lights, and audible devices to alert vehicular or pedestrian traffic that a train was approaching or crossing.
The level crossing consisted of four railway tracks and a dual carriageway road, including a pedestrian pathway. All tracks ran adjacent to each other within the rail corridor.
V/Line managed both the broad-gauge and single dual-gauge tracks (yellow shading in Figure 3), and Australian Rail Track Corporation (ARTC) managed the single standard-gauge track (red shading in Figure 3). ARTC had primary maintenance responsibility for the level crossing infrastructure.
Figure 3: Aerial view of ARTC and V/Line responsibility boundaries
Source: VicTrack, annotated by the ATSB
Planned work
The North Geelong ‘C’ signal box allowed the management of rail traffic at Thompson Road, Separation Street, the Geelong grain loop, and the Corio independent goods line. The Victorian Government engaged VicTrack to undertake works to replace the current mechanical interlocking and signal control systems to allow the remote operation of the signal box from V/Line’s Centralised Train Control (Centrol). VicTrack engaged UGL Engineering Limited (UGL) as the principal contractor for the works, who in turn sourced suitably qualified staff from other third party providers as required. VicTrack retained oversight and responsibility for the project.
The scope of works undertaken were the disarrangement of track circuits and infrastructure to enable signal upgrades in the V/Line leased area only (Figure 3). The work was to be undertaken during the month of January 2019 in several stages as part of Train Notice 2668:
Stage one (yellow shading in Figure 3): 8‑22 January 2019, isolation of the dual-gauge, broad‑gauge, arrival, and departure tracks at Thompson Road; and south line at Anakie Road.
Stage two (yellow and red shading in Figure 3): 13 January 2019, isolation of all tracks at Thompson and Anakie Roads.
Stage three: 21 January 2019, testing.
Stage four: 22 January 2019, commissioning.
Regular planning meetings were held detailing the scope of work required, including the staged track possession of the ARTC standard-gauge track.
Personnel involved
As part of the broader project, an electrical work group was tasked with the electrical isolations of the signalling system. The group consisted of a signalling tester-in-charge (TIC) supervising two test teams, test team 1 and test team 2. Each team consisted of a signalling tester and assistant, who were appropriately qualified.
The TIC had the responsibility to ensure that the new and altered works were planned, installed, inspected and tested to design, standard and schedule. The signalling testers carried out testing activities as directed by the TIC and in accordance with relevant V/Line and ARTC procedures. Assistant signalling testers assisted with testing activities as directed by the TIC or a signalling tester.
Isolation plans and package
A work instruction is a step-by-step guide on how to perform a specific task or activity, in support of a process or procedure. They are an important defence within a safety system for ensuring the work is performed safely and as intended.
The isolation plan for each location was designed by UGL, then reviewed, and approved by all stakeholders[12] before the work commenced. The plans (Figure 4) contained critical information on what circuits were to be isolated, and identified each isolation jumper cable for each circuit. While each plan was associated with a certain stage of the project (see Planned work above), there was no supporting instructions provided in the package specifically detailing the scope of work to be conducted at each stage, nor were the plans marked to clearly identify at which stage that plan applied to.
The package was provided to the TIC by UGL prior to the commencement of the work. The package included the train notices, project planning documents, and isolation plans for the project.
Figure 4: One of the isolation plans for the North Geelong works stage 1
In preparation for planned track work for the upgrade of the North Geelong, Victoria, ‘C’ signal box, the Thompson Road level crossing was to be isolated for the broad and dual-gauge tracks only (V/Line tracks). The level crossing protections for the adjacent standard-gauge track (Australian Rail Track Corporation (ARTC) track), which was to continue operating as normal, were to remain active as trains would continue to use this track during stage one of the works. However, as The Overland passenger train (3MA8) approached the crossing on the ARTC track, the train crew noticed that the level crossing protections had not activated as expected. While the crew noticed the irregularity, it was too late to take substantive action and the train passed through the level crossing unprotected. The crew reported that several road vehicles were in the vicinity of the level crossing at that time, but none were in the danger zone. The ARTC Phoenix train control system replay confirmed the non-operation of the Thompson Road level crossing.
This analysis will examine why the level crossing protections did not activate as expected and review the documentation provided to signalling testers for isolating the Thompson Road level crossing.
Level crossing isolation
Following the packaged isolation plans provided by the tester‑in‑charge (TIC), the signalling tester applied the jumper cables to the V/Line track in preparation for the stage one works. Additionally, the tester also mistakenly applied the cables to the ARTC track, which should have been performed at a later time as part of the stage two works. The implementation of both stages isolated the V/Line tracks as well as the ARTC track, which was still operational for scheduled train movements. This resulted in the Thompson Road level crossing not operating for the approach and passage of train 3MA8.
While a pre-work brief had been conducted, the tester could not recall the specific details of that briefing. This was a missed opportunity for knowing that the level crossing for the ARTC track was to remain active.
The tester was notified about the occurrence before there was an opportunity to isolate the next level crossing at Anakie Road. However, it was possible that, had the tester applied the jumper cables for the Anakie Road level crossing, it too would have been incorrectly implemented, resulting in the isolation of the crossing protections for all tracks.
Packaged isolation plans
The TIC was provided the isolation package for the entire project by the principal contractor for the works, UGL Engineering Limited (UGL). This package contained the isolation plans for each location, including those for the stage one and stage two works, which were to be conducted separately. The TIC subsequently conducted a verbal pre-work brief with the signalling testers and assistants. During this brief, the TIC reiterated that the ARTC track would remain operational (stage one) and the level crossings active, distinguishing between the two stages. Despite this, the TIC provided the signalling tester with the entire isolation package, without modification, prior to the work commencing. Consequently, the tester had the plans for both stages, although the plans for stage one were only to be applied on the day of the occurrence.
No specific instructions provided
The principal contractor employed by VicTrack for the works, UGL, led the project planning, including the development and approval of the isolation plans. During this process, specific instructions detailing the scope of work to be conducted at each stage of the project had not been developed to support the isolation plans. Consequently, the absence of these instructions increased the risk of the works being incorrectly implemented.
In this case, UGL provided the TIC with a package containing the isolation plans for the entire project including the work to be conducted at Thompson Road, which in turn was provided to the signalling tester. However, without specific written instructions for each plan (at each stage), the tester mistakenly applied the isolation plans both stage one and two at the same time.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the Thompson Road level crossing failed to operate for the passage of passenger train 3MA8 on 8 January 2019.
Contributing factors
The Thompson Road active level crossing at North Geelong failed to operate as train 3MA8 approached and passed through the level crossing.
In preparation for stage one track work (broad and dual gauge-tracks) the signalling tester, following the isolation plans provided, isolated the level crossing for the stage two work (standard-gauge track), which was still operating trains.
The signalling tester-in-charge provided the signalling tester with the packaged isolation plans for both stage one and stage two works, which were intended to be conducted separately.
VicTrack’s contractor,UGL Engineering Limited, did not provide signalling testers with specific instructions detailing the scope of work to be conducted at each stage of a project, but rather, only provided packaged isolation plans for the entire project. The absence of these instructions increased the risk of the works being incorrectly implemented. (Safety issue)
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are provided separately on the ATSB website, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website as further information about safety action comes to hand.
Safety issue description: VicTrack’s contractor, UGL Engineering Limited, did not provide signalling testers with specific instructions detailing the scope of work to be conducted at each stage of a project, but rather, only provided packaged isolation plans for the entire project. The absence of these instructions increased the risk of the works being incorrectly implemented.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
The Office of the National Rail Safety Regulator
VicTrack
Australian Rail Track Corporation
Pacific National.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Australian Rail Track Corporation
Office of the Rail Safety Regulator
Pacific National
UGL Engineering Limited
VicTrack
V/Line
Submissions were received from:
Australian Rail Track Corporation
Office of the Rail Safety Regulator
Pacific National
UGL Engineering Limited
VicTrack
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the 10 January 2019, a Bell Helicopter 205A-1, registered VH-HUE (HUE), was being used for external sling loading operations near Talbingo, New South Wales with the pilot as the sole occupant. As the helicopter approached the drop‑off site, the load unexpectedly disconnected from the remote cargo hook. One of two ground personnel was struck and seriously injured by the falling load.
What the ATSB found
Despite examination of the involved components, the reason why the load disconnected unexpectedly from the remote cargo hook could not be determined. However, the ATSB found that the loadmasters were not maintaining a safe distance from the load. Their positioning, in combination with the significant movement of the load as it contacted the ground, resulted in one of them being struck and seriously injured.
What's been done as a result
As a result of this accident, all contractors involved reviewed the procedures being used for helicopter lifting operations during this project. They have reviewed the risk controls for receipt and positioning of loads, based on the positioning precision required.
The operator who supplied the loadmasters has reviewed and updated their procedures. They have identified a ‘dynamic exclusion zone’ as a position above a person’s head height that is in the pathway of a potential uncontrolled load that may drop and impact onto a person. In recognition that the zone may vary due to a number of variables, specific guidance will be provided as part of pre‑activity briefings.
The lead contractor is overseeing a range of initiatives, including a behavioural safety review of the project with the intention to implement an appropriately designed program to positively influence behaviours across their projects.
Safety message
This incident highlights the dangers associated with external sling load operations. Unexpected events can occur and ground personnel should ensure they maintain their separation from external slung loads that are above head height. Each sling load operation can be unique, with different locations, load shape and environmental conditions creating different safety considerations. As a consequence, clear written procedures and detailed discussions prior to commencement of each operation are essential to ensure all participants are aware of the unique dangers of the operation.
Transport Canada commissioned a video titled ‘Keep your eyes on the hook’, which shows some of the dangers for ground crew when working around helicopters and longline loads.
The occurrence
What happened
On the 10 January 2019, a Bell Helicopter 205A-1, registered VH-HUE (HUE), was being used for external sling loading operations near Talbingo, New South Wales with the pilot as the sole occupant. As the helicopter approached the receiving site, the load unexpectedly disconnected from the remote cargo hook. One of two loadmasters assisting on the ground, was struck and seriously injured by the falling load.
Preparation for the operation
There were a number of different organisations involved in lifting operations on the day. The lead contractor had sub‑contracted two helicopter operators to move the equipment from a staging area near Tantangara Dam to a drilling site about 3 km away. The three organisations had conducted this type of work together a number of times. One helicopter operator (operator A) supplied an AS350B3 helicopter, long line, remote cargo hook, lifting equipment and three experienced loadmasters. The second operator (operator B) supplied HUE, a long line and remote cargo hook.
At around 0800 Eastern Daylight Time,[1] two of the loadmasters arrived at the staging site to begin preparations for the day. Both helicopters and the third loadmaster were delayed due to fog. The loadmasters checked all the lifting equipment, including the slings and shackles, for integrity and ensured they had been checked during the last routine equipment inspection. They then began working with the drilling crew to organise, weigh and rig the loads to be moved by the helicopters. The third loadmaster arrived after the fog had lifted, and they all worked together to finish rigging the loads.
Among the loads were three lots of drill rods on drill racks (Figure 1). The loadmasters decided not to use the lift points on the drill racks, as the lift points were not rated or stamped. Working together, the loadmasters ensured the weight of the loads were equal, secured the drill rods to the rack and rigged the slings, so the loads would be balanced during flight. To do this, they used two 6 m round slings, rated to carry 2,000 kg, choked at either end of the rod rack. The slings were then attached to a shackle, which connected directly to the remote cargo hook. A 5.6 m tag line was attached to the load, to assist with manoeuvring the load into the required position at the receiving site. The loadmasters rigged the loads a number of times before they were happy with the rigging.
Figure 1: Drill rods ratcheted to the rack and slings attached
The figure shows the drill rods ratcheted to the drill rod rack and the slings which are choked at the ends of the drill rack.
Source: NSW police, annotated by ATSB
After all the loads were rigged to their satisfaction, the pilots and loadmasters then held an aviation briefing where they discussed a helicopter lift plan. One of the loadmasters then led a toolbox talk, with all people involved in the day’s operations. They discussed every item on their company’s safe work method statement, which included known hazards. It was reported that the discussion clearly identified:
safe sites for people not involved in the helicopter lifting operations
the routes the helicopters would be taking
being mindful of avoiding the ‘crush zone’.
Inside the ‘crush zone’ there was an injury risk from contact with the external loads. There was no definition for the extent of the crush zone.
The loadmaster also highlighted that:
as taglines were being used, people should not become fixated on getting hold of them
ground personnel should not put themselves in a dangerous position and were to remain within the view of the pilot at all times.
The lead contractor then conducted a third briefing, which discussed their company’s expectations including radio communications, transfer of crew between the loading and receiving zone, staff resourcing of both the loading and receiving areas, and emergency procedures. It was reported that all three briefings were done methodically, with clear instructions and time for all involved to ask questions and understand their role.
The people who were being flown to the drill site were then given a helicopter induction. While this was occurring, inspections of the helicopter's cargo hook on the underside of the helicopter, long lines and remote cargo hook connections were conducted. This involved a number of release and reattachments of the long line to the cargo hook on the underside of the helicopter and a number of pilot-operated releases and manual releases by the loadmasters of the remote cargo hook. After the loadmasters had checked the shackles to ensure they fitted in the cargo hook throat (Figure 2), the group split up and went to their designated areas. One loadmaster went to the loading site and two went to the drill site, which was receiving the equipment. At the drill site, the supervisor identified the designated safe zone ensuring all personnel not involved in the lifting operations were within this zone and placed the emergency equipment to ensure easy access if required.
Figure 2: Cargo hook
Source: ATSB
Lifting operations
Operations commenced after lunch with a check of the radios. The loadmasters had VHF radios in their helmets, which they used to communicate with each other at the drill site and with the helicopter pilots. The pilot of HUE conducted the first lift and, having requested to start with a light load, moved an 800 kg load to the drill site with no issues. Loadmaster 1 conducted all radio communications with the pilot at the drill site. He reported that when the helicopter was clear of all obstacles along the approach path, he advised the pilot and then gave directions to position the load where it was required, with clear advice of the height of the load above the ground.
It was reported that one load carried by the AS350B3 was spinning on arrival at the drill site. In response, the pilot touched the load to the ground away from the loadmasters to stop the spin. The helicopter then lifted the load off the ground to about knee height and the loadmasters manoeuvred the load to its position on the site while directing the pilot.
Accident load
After moving two lighter loads, the pilot of HUE requested a heavier load be connected. The loadmaster selected one of the drill rod racks, weighing about 1,200 kg, and connected the shackle to the hook. As the load lifted, it was slightly uneven and the loadmaster instructed the pilot to return the load to the ground, so he could re-adjust the slings. The pilot lowered the load and placed the hook on the load. After adjustment to the sling, the load lifted evenly and was flown to the drill site (Figure 3).
Figure 3: Images showing the occurrence load during departure from loading site
The image on the left shows that on departure the load was slightly uneven, the image on the right shows the load after loadmaster had adjusted the slings.
Source: Helicopter Operator A, annotated by the ATSB
As the helicopter approached the drill site, the pilot contacted the loadmasters and advised them that he was carrying the drill rods. Loadmaster 1 told him that the load was to go to a different area of the site and advised that the wind had dropped to around 3–5 km/h (0.5–1.5 kt). Loadmaster 1 subsequently told the pilot that they could see the helicopter and gave him advice on directions and distance to run to the drill site. He then advised the pilot he could descend, calling out the load’s height above the ground. The loadmasters began to approach the load when it was at about 7 m above the ground. Loadmaster 1 later advised that the plan was to lower the load to touch the ground and then raise it to knee level before moving it to its final resting position. Both loadmasters were reportedly careful to maintain clearance with the area under the load and stood at 45° to the load. They were both on the same side of the load. It was reported that the load was steady as it was flown in to the drill site.
The load was moved very slowly down to an area having an estimated 10˚ slope, with loadmaster 1 being downhill of loadmaster 2. Loadmaster 1 observed loadmaster 2 step toward the load, reach up, take hold of the tagline and immediately step back out to regain their 45˚ spacing. Loadmaster 1 reported that the load was about 5 m above the ground at this stage and the pilot reported that the end of tagline appeared to be near the ground.
Loadmaster 1 reported that as loadmaster 2 returned to their position, the slight forward motion of the load stopped and the load moved back slightly towards the rising ground. As the load moved back, the load detached unexpectedly from the hook.
It was reported that as the load fell, it seemed like one end of the load fell faster than the other and after it struck the ground, the load either bounced or pivoted around. Both loadmasters had to scramble backwards away from the load but the movement resulted in loadmaster 2 being struck by the drill rods and knocked to the ground under the load.
The pilot reported that he felt the helicopter ‘pop up a bit’ and thought that a sling had snapped as he had not released the load. Loadmaster 1 advised that he did not hear the ‘clack’ sound associated with the solenoid release of the hook (see the section titled RemoteCargo hook). He advised that the sound of the solenoid activation was audible over the helicopter noise and while wearing a helmet.
Loadmaster 1 spoke to the helicopter pilot on the radio and advised him that the sling had not separated, the hook was useable and to bring the helicopter back to lift the load. The pilot re‑positioned the helicopter and loadmaster 1 re‑connected the load, which was then lifted off the seriously injured loadmaster.
Remote cargo hook
The remote cargo hook used by the operator of HUE was a TALON 6K half-cage cargo hook (Figure 2). This was the first operational use of this hook following a recent overhaul and was also the first time the helicopter (HUE) was used with this long line and remote hook combination.
The load beam on the remote cargo hook can be made to release by two methods:
a pilot-activated switch on the cyclic, which activated a solenoid in the hook to release the load beam
a manual release on the hook itself.
The hook and long line inspections conducted prior to the flight, included a number of activations of both of these release systems.
The pilot advised that, due to a previous injury to his hand, he had to deliberately move his hand to the top of the cyclic and move the switch sideways to activate the hook. As such, unintended load release by that mechanism was considered very unlikely. The ATSB viewed video footage of the helicopter pilot operating the switch at the top of the cyclic, which supported that conclusion.
The keeper was designed to allow items to enter the hook throat but not return. It opened toward the inside of the load beam and had a spring-loaded automatic return to the closed position.
Loading equipment examination
The slings, shackle and hook were examined by the ATSB. The inspection of the slings determined they were intact. To check that the load had not released through dynamic rollout,[2] the ATSB ensured that the hook and shackle combination did not allow the shackle to pass the end of the load beam. The cargo hook owner’s manual specified that the shackle used with this hook should have an inside diameter less than 11.4 cm. The internal diameter of the shackle used was 5.5 cm. A physical examination of the hook was conducted and it was determined that the manual release and the keeper worked as expected. The ATSB did not dismantle the hook or connect the hook to an electrical supply.
The ATSB examined video footage of the helicopter lifting the load from the loading site. It showed that the ‘D’ shackle was behind the keeper (Figure 4) when the helicopter departed and that the load was evenly balanced as the helicopter flew towards the drill site (Figure 3).
Figure 4: Image shows that the ‘D’ shackle was behind the keeper
The image shows that on departure after the load had been adjusted, the ‘D’ shackle was behind the keeper.
Source: Helicopter operator A, annotated by the ATSB
Electromagnetic interference
The ATSB also considered whether electromagnetic interference (EMI) could have resulted in the inadvertent release of the load. While this accident occurred in an area which has high voltage power lines from the Tumut 3 power station, the aircraft was about 35 km from the power station and 10 km from the closest high voltage power lines. Research suggests that magnetic radiation returns to normal levels at about 150 m from power lines.
A licenced aircraft maintenance engineer inspected the electrical system used on the helicopter to control the hook release mechanism and they reported that the system was working as expected. It was reported that there were no exposed wires within the system that could have resulted in a short circuit if exposed to electromagnetic interference from equipment in the aircraft. The helicopter operator also reported that the system has not had any issues with the hook release system since the accident.
Procedures used for this operation
The ATSB reviewed the procedures used by the different operators involved on the project on the day. The lead contractor had conducted a risk assessment of the overall project, which involved all of the contractors involved.
Operator A had completed a helicopter lift plan for the day and a safe work method statement that identified hazards and the mitigations for lifting operations. There were a number of areas in the procedures indicating that no one should be located below the suspended load. The procedures also specified that people should not be within the ‘crush zone’ but did not identify where the crush zone was. The operator advised that the crush zone was dependent on a number of job-specific variables, including the load shape and size, and the length of sling required. While there was no specific section in the safe work method statement to prompt this discussion, the loadmasters worked together to rig the loads, adding tag lines where required, and so were aware of the individual load’s size, shape and aerodynamic stability.
Safety analysis
The ATSB considered a number of inadvertent load release mechanisms, including:
the pilot release system
dynamic rollout
failure of the manual load release
electromagnetic radiation
failure of the hook mechanism.
A previous injury meant that accidental release by the pilot was unlikely and the loadmaster did not hear the audible ‘clack’ of the solenoid, associated with operation of the pilot‑activated release.
The shackle was the appropriate size, to ensure a dynamic rollout would not occur. The video footage shows that the ‘D’ shackle was securely behind the keeper as the helicopter departed from the loading area.
While flying in an area of electricity production, the helicopter was 35 km from the closest power station and around 10 km from the closest power lines. The wiring was also checked and there were no bare or loose wires in the system. If the load had released through EMF activation of the release system, the loadmasters would have heard the ‘clack’ of the solenoid releasing.
There were no indications that the remote hook release mechanism was faulty after the previous overhaul and the pilot and loadmasters conducted an operational check of the mechanism before operations began on the day. It also successfully lifted the two previous loads and lifted the load off the loadmaster after the incident. In addition, the manual release mechanism operated correctly at the ATSB facility and an examination of the hook release electrical system in the helicopter did not reveal any faults. Despite this, a transient hook fault that resulted in an inadvertent release of the load could not be ruled out.
In summary, based on the available evidence, the mechanism that led to the release of the load could not be determined.
Immediately prior to the accident, the load was being positioned without needing to be adjusted. The plan was that it would touch the ground and then be lifted to knee height before being moved to its final position. Therefore, being in the vicinity of the load when it was above head height was an unnecessary risk.
When the load released, one end fell first and there was likely a movement back toward the rising ground. The loadmasters were reportedly standing to the side and at 45˚ angles from the load, but they were still close enough for one of them to be struck when the load pivoted.
The procedures and briefings for the operation contained several references for individuals not to place themselves in a dangerous position with respect to the load. While the extent of the crush zone was not defined in general, there were a number of variables unique to each job that made this difficult. The opportunity to discuss these aspects was during the briefing, although there was no discussion on the specific loads in this instance. Despite this, the loadmasters did discuss and adjust the different loads, adding tag lines where required. This would imply they were aware of the load size, weights and aerodynamics of specific loads for this job.
ATSB comment
In response to a previous accident, CASA released Airworthiness Bulletin, AWB 25-006 Issue 2, which provided advice to operators involved in sling load operations. While not directly relevant to this occurrence, it details important information relating to external sling load operations. This included information related to the inadvertent release of the load through the use of the incorrect shackle size and electromagnetic radiation (EMI).
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The load released from the hook unexpectedly for reasons that were not determined.
The loadmasters were not maintaining a safe distance from the load. Their positioning, in combination with the significant movement of the load as it contacted the ground, resulted in the loadmaster being struck and seriously injured.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
As a result of this accident, all the contractors jointly reviewed the processes used on this project. They determined that the existing documentation contained sufficient warning for personnel to not enter the ‘crush zone’ or ‘work under loads’, but also identified enhancements to the existing processes. This included a control that removed all people (including loadmasters) from the receiving area where there was no requirement for precision in the placing of the load and increased controls where a precision placement of the load was required.
Helicopter operator who supplied the loadmasters
Operator A advised the ATSB that they have reviewed their own safe work method statement and made changes including identifying a ‘dynamic exclusion zone’[3] under the moving helicopter. Recognising that the zone may vary due to a number of variables, the intention is that specific guidance will be provided as part of pre‑activity briefings.
Lead contractor
The lead contractor is overseeing a range of initiatives, including a behavioural safety review of the project with the intention to implement an appropriately designed program to positively influence behaviours across their projects.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 6 January 2019, a Cessna 182G, registered VH-DGF, took off from Tooradin Airfield to conduct parachuting operations. The pilot reported that soon after take-off, at about 400 ft above the ground, the engine sustained a sudden power loss. After being unable to resolve the problem, the pilot conducted a forced landing in a nearby paddock.
During the forced landing, the aircraft collided with trees and a fence, which resulted in substantial damage. There were no injuries.
What the ATSB found
The ATSB found that the carburettor contained aluminium oxide corrosion deposits which, when loosened, likely blocked fuel flow within the carburettor, resulting in the aircraft engine losing power. Periodic inspections (every 100 hours or 12 months) play a vital role in ensuring the serviceability of an aircraft’s engine, and these inspections had a requirement to drain and flush the carburettor. However, the extent to which this action was actually conducted during the six inspections since the engine and carburettor were overhauled could not be determined.
The engine had periods of inactivity over the preceding years, and maintenance on the engine had not always been conducted at the appropriate time intervals. However, it was not possible to determine exactly when the corrosion started and propagated.
After the engine lost power, the decision by the pilot to conduct a forced landing rather than turn back to the departure runway minimised the risk of loss of control during the forced landing.
The pilot was not wearing an upper torso restraint (UTR), but fortunately was not injured on this occasion. However, by not wearing his UTR, he significantly exposed himself to unnecessary injury risk.
What's been done as a result
The operator advised that it intends to direct pilots to wear upper torso restraints and that this requirement will be incorporated into its training and induction schedule.
Safety message
Corrosion was able to form within the carburettor that was not prevented or detected. This occurrence highlights the importance of following the maintenance program for the aircraft. Particularly in this case, this included draining and flushing the carburettor at its periodic inspection.
When available, upper torso restraints should be worn. While the pilot was uninjured during the accident, a substantial amount of research has shown that wearing an upper torso restraint significantly reduces the risk of injury compared to lap belts only.
The occurrence
Pre-flight preparation
On the morning of 6 January 2019, the pilot of a Cessna 182G, registered VH-DGF, prepared the aircraft for parachuting operations for Skydive south-east Melbourne at Tooradin Airfield, Victoria. The single-engine aircraft had been refuelled from the bowser at the airfield on the previous day.
The pilot reported that, on the morning of the flight, he checked the quantity of fuel on board by dipping the aircraft’s fuel tanks with a calibrated dipstick. He also conducted a normal pre-flight inspection of the aircraft, which included conducting a water drain check of each of the aircraft’s three fuel drains.
After conducting the pre-flight inspection, the pilot started the aircraft’s engine and taxied to the apron area. He allowed the engine to warm and carried out further operational checks. When complete, he repositioned the aircraft to pick up parachutists for the first sortie of the day. However, the flight was then delayed for about 90 minutes by unsuitable weather.
The passenger load consisted of a tandem master, a tandem passenger and two sport parachutists.
Take-off and engine power loss
The pilot conducted the take-off at about 1045 Eastern Daylight-saving Time,[1] toward the south-west. As the aircraft passed over the end of the runway, he raised the flaps and continued to climb.
The pilot reported that, at about 400 ft above ground level, there was a sudden loss of power and aircraft climb performance, and he observed the propeller was windmilling[2] without sound. He later described the power loss as being similar to the mixture control being pulled back. A witness at Tooradin Airfield recalled that the power loss sounded like a sudden closing of the throttle and there was no rough running.
The pilot lowered the aircraft nose and identified a suitable area to make a forced landing which required a heading change of about 45º to the west. He checked the engine controls and fuel selector were correctly configured and had not been disturbed by parachutists entering the aircraft.
The pilot recalled that he conducted a flapless approach at about 70 kt to the identified landing area. During the descent, he instructed the passengers to prepare for a forced landing.
The aircraft touched down in a relatively flat, open paddock. It initially bounced on the unprepared surface before settling on the ground and passing through two boundary fences. The pilot attempted to slow the aircraft and manoeuvre to avoid trees. As the aircraft passed through a gap in the trees, the left-wing strut collided with a tree, which resulted in the left wing folding over on top of the right wing and fuel leaking from it onto the fuselage. The aircraft further collided with a third fence, crossed a private road, and collided with a fourth fence, which collapsed the nose landing gear (Figure 1).
Figure 1: Accident site of Cessna 182, registered VH-DGF
Source: Victoria Police.
Egress from the aircraft
The pilot ordered the passengers to evacuate. Both doors were displaced open during the accident sequence and an interior panel from the rear of the cabin had propelled forward onto the parachutists. The panel obstructed emergency egress and was removed by the pilot.
The sport parachutist located at the right[3] rear position attempted to egress the aircraft but had not released his single-point restraint. After doing so, he was first to egress. The sport parachutist located at the right forward position also had not released his restraint prior to attempting egress. After doing so, he was next to egress. The tandem passenger was assisted out of the aircraft, followed by the tandem master and the pilot. Video footage showed that, after the aircraft came to rest, it took about 20 seconds for the occupants to egress.
The pilot returned to the aircraft to confirm the master switch and magnetos were off. The passengers and pilot moved away from the aircraft and waited for emergency services to arrive.
The aircraft was substantially damaged and there were no injuries.
The Cessna 182G is a high-wing, all-metal, unpressurised aircraft with a fixed landing gear. It has a single, reciprocating piston engine driving a constant speed propeller.
VH-DGF was manufactured in 1964 and was first registered in Australia in 1965. The aircraft was reconfigured for parachuting operations in 2017.
The Cessna 182G has two fuel tanks, one in each wing. Fuel from each tank is gravity-fed to the fuel selector valve. Depending on the setting of the valve, fuel from the left tank, right tank or both tanks flows through a fuel strainer (also known as a ‘gascolator’), then the carburettor and the engine.
The Cessna 182G Owner’s Manual stated that pilots should take off with the fuel selector in the BOTH position. The pilot reported that the fuel selector was in the BOTH position during the take-off. Video footage taken during part of the accident flight confirmed that the fuel selector was in the BOTH position, and the fuel tanks indicated that sufficient fuel was on board.
A review of the video footage identified that the mixture was full rich and the carburettor heat was off during take-off. However, a review of the meteorological conditions and other information at the time of the occurrence indicated that the risk of carburettor icing was low.
The aircraft was within the required weight and balance limitations.
Examination of the aircraft and components
The ATSB did not attend the accident site or conduct a detailed examination of the engine. Examination by other parties did not identify any problems with the aircraft’s fuel system or the engine itself. However, a significant amount of debris was recovered from the fuel strainer, the carburettor float bowl and directly below the carburettor nozzle and main jet assembly. The debris in the fuel strainer appeared to include a range of different foreign materials.
The carburettor and the recovered material were examined by the ATSB. Most of the recovered material had a white, chalky appearance and ranged in size up to 5 mm. Inside the carburettor bowl, a significant amount of the material had accumulated at the drain area, and a 'tide' line was visible on the sides of the drain area. The inside surface of the bowl exhibited pitting corrosion where the material had dislodged (Figure 2).
A small amount of similar white chalky material was also observed on a ‘dip’ in the carburettor bowl, slightly above the drain. Other than the areas described, the internal surfaces of the bowl appeared to be relatively clean and in good condition, although some other foreign material was observed in the bowl.
ATSB analysis of the debris found in the carburettor showed that it was primarily comprised of aluminium and oxygen. It was considered likely that the particles were aluminium oxide, a corrosion product from the aluminium carburettor bowl.
Figure 2: Material inside the carburettor bowl of VH-DGF
Source: ATSB.
Engine history
The engine fitted to VH-DGF at the time of the accident was originally fitted to another Cessna 182, registered VH-EIZ. In December 2011 the engine (serial number 67386-7-R) and carburettor (serial number H-11-5085) were removed, overhauled and refitted to VH-EIZ.
In October 2016, the engine and carburettor were removed from VH-EIZ for fitment to VH-DGF. At that time the engine had accumulated 328.1 hours since overhaul. VH-DGF was rebuilt over a 2-month period, and a maintenance release was issued in early January 2017.
No flights were documented on the maintenance release during:
the 4-month period from early January to early May 2017
the 3-month period from mid-May to mid-August 2017
the 7 weeks up until the end of January 2018.
Other than these periods of inactivity between October 2016 and August 2017, the lowest utilisation of the engine since last overhaul was 44.5 hours over an 18-month period between 2013 and 2014.[4]
The last periodic (100-hourly) inspection was carried out on 30 May 2018 at 7,730.1 airframe hours and 393.9 engine hours since overhaul. At the time of the accident, the engine had accumulated 438.4 hours since overhaul.
Between the overhauled engine commencing service in 2011 and the accident, six periodic inspections were conducted which examined the engine (four inspections when it was fitted to VH‑EIZ and two when fitted to VH-DGF).
Periodic maintenance requirements
The aircraft was being maintained in accordance with Civil Aviation Safety Authority (CASA) maintenance schedule 5 and all airworthiness directives applicable to the aircraft.[5] Maintenance schedule 5 outlined requirements for daily inspections (conducted prior to the first flight of each day) and periodic inspections (conducted every 100 hours or 12 months, whichever came first).
The periodic inspection requirements included a requirement to ‘drain and flush the carburettor fuel bowl and refit the plug and lockwire’. This requirement was reiterated in a number of advisory publications.[6]
The six periodic inspections carried out after the engine was overhauled were conducted by four different maintenance organisations. Maintenance records from these periodic inspections indicated that the task of draining and flushing the carburettor had been conducted. During interviews, personnel from three of these maintenance organisations noted that, although this task was required for every periodic inspection, they were aware that it was not always carried out.
A review of the recent maintenance releases for VH-DGF identified a number of anomalies:
The second last periodic inspection and maintenance release were certified for on the 3 and 4 January 2017. The aircraft was ferried to Queensland on 11 December 2017 to be used by another parachuting operation. The maintenance release expired on 3 January 2018, after which the aircraft was used for numerous flights (totalling 4.2 hours flight time) during the period from 27 January until 25 March 2018. As the maintenance release was expired, a special flight permit[7] was issued and the aircraft ferried from Seventeen Seventy to Caboolture on 18 April 2018 (2.1 hours flight time). A second special flight permit was issued and the aircraft was ferried to Tyabb, Victoria, on 26 May 2018 which involved approximately 6.5 hours flying. In summary, based on documented records, the aircraft was operated for 12.8 hours over a period of 4 months without a valid maintenance release (and without a periodic inspection having being conducted within the previous 12 months).
Between periodic inspections, oil and oil filter changes were required. The requirement for the engine fitted to VH-DGF was for an oil and oil filter change after 50 hours flight time or 4 months (whichever came first), and any such change had to be certified on the maintenance release. The second last maintenance release showed two oil and oil filter changes. The first was on 11 December 2017, 11 months since the last periodic inspection. The second occurred on 22 May 2018, 5 months after the previous oil and oil filter change.
The last periodic inspection occurred on 30 May 2018, with a maintenance release issued on the same day. The maintenance release included a requirement to test the pitot static system as per Civil Aviation Order 100.5 (required every 24 months) by 4 January 2019. There was no annotation on the maintenance release to indicate that the inspection was conducted prior to the accident flight (6 January 2019).
On the last maintenance release there was a requirement to carry out an oil and oil filter change on 30 September 2018, however there was no record of this being done.
It is widely acknowledged that piston engines that are not flown frequently are susceptible to damage from corrosion and contamination, which may adversely affect their expected service life.
Susceptibility to corrosion is influenced by a number of factors, including but not limited to, geographical location, season, usage and storage.
When a piston engine is exposed to adverse environmental conditions such as coastal areas and areas of high relative humidity, corrosion attack can occur within a few days. Conversely, engines under more favourable environmental conditions can remain inactive for several weeks without evidence of damage by corrosion.
Experience has shown that the best course of action to reduce the likelihood of corrosion attack on engine internal surfaces is to fly the aircraft regularly. In circumstances where this action is not possible engine preservation procedures have been promulgated within engine manufacturer’s instructions for continuing airworthiness to combat and minimise the corrosion condition a direct result of engine inactivity…
In general, manufacturers recommend that for engines which won’t be flown for 30 days or more, a preservation regime should be instigated.
The need for engine preservation should be evaluated by the aircraft operator having regard to the prevailing environmental conditions and period of aircraft inactivity.
The aircraft manufacturer (Cessna) specified various maintenance actions if an engine was not being utilised for various periods of time. For periods up to 30 days (flyable storage) and 90 days (temporary storage), there was no required actions for preserving the carburettor, whereas there were such requirements for indefinite storage periods.
The engine manufacturer (Continental Motors) advised[8] operators to inject corrosion preventative oil into the carburettor while the engine is running for:
an engine, which has been in operation, is to be stored much longer than a week under normal climatic conditions…
There was no indication in the aircraft’s maintenance records regarding whether any storage or preservation measures were applied to the aircraft’s engine during the periods of inactivity from October 2017 until January 2018.
Related occurrence
On the 14 February 2017, a Yakovlev 52 experienced a loss of engine power en route to its destination. While conducting a forced landing, the aircraft collided with a tree, pitched down and collided with the ground. The pilot was seriously injured and the aircraft was substantially damaged.
The Belgian Federal Public Service Air Accident Investigation Unit investigated the accident[9] and found:
The engine loss of power was most probably caused by the internal corrosion of the carburettor which partially blocked the fuel flow at the pressure regulator valve. The corrosion of the magnesium alloy casing of the carburettor was likely caused by water contamination.
Occupant restraint
Pilot seat
Civil Aviation Safety Regulations 1998 (CASR) 90.105 required that the seats in the front row of an aircraft must be fitted with an approved safety harness. For small aeroplanes (with maximum take-off weight less than 5,700 kg) and helicopters, the safety harness needed to consist of a lap belt and at least one shoulder strap.
The pilot’s seat of VH-DGF was fitted with a lap belt and upper torso restraint (UTR),[10] consistent with the regulatory requirements. Given the age of the aircraft, the UTR did not have an inertia reel (that is, when fitted correctly it was fixed in position and the person’s movement was somewhat restricted). On the accident flight, the pilot wore the lap belt but the UTR was stowed in the seat pocket. The pilot noted that he was 165 cm tall and, when the UTR was worn and correctly adjusted, he could not reach the fuel selector or cowl flaps.
Previous ATSB investigations have found that pilots or passengers in the front seats of small aeroplanes and helicopters have not always worn the available UTRs, exacerbating the severity of their injuries in many accidents (for example, ATSB investigations 199800442, 200605133, AO-2010-053, AO-2012-083, AO-2012-142 and AO-2016-074).
A substantial amount of research has consistently shown that seat belts in small aircraft that include a UTR significantly reduce the risk of injury compared to lap belts only. UTRs minimise the flailing of the upper body and reduce the risk of impacts involving the head and upper body.
For example, a safety study by the United States’ National Transportation Safety Board (NTSB) in 1985[11] examined 535 accidents involving small aircraft in 1982.[12] The NTSB estimated that 20 per cent of the 800 fatally injured occupants would have had only serious injuries or minor injuries if they had been wearing a UTR. In addition, 88 per cent of 229 seriously injured occupants would probably have had less severe head or upper body injuries, only minor injuries or no injuries if they had been wearing a UTR.
A 2011 safety study by the NTSB[13] examined the rate of serious and fatal injuries of pilots in single-engine aeroplanes during the period 1983–2008. It found that pilots wearing only a lap belt had a 49 per cent greater likelihood of a serious or fatal injury compared with pilots wearing a lap belt and a UTR. Another study which examined take-off and landing accidents involving an engine power loss during 1983–1992 found that pilots wearing only a lap belt were 70 per cent more likely to be fatally injured than pilots wearing a seat belt and a UTR.[14]
Parachutists
Civil Aviation Regulation (CAR) 251 (Seat belts and safety harnesses) required seat belts to be worn during take-off and landing, during instrument approaches, when the aircraft was flying less than 1,000 ft above terrain and at all times when in turbulent conditions. CAR 251 had provision to change the type of restraint. In the case of aircraft used for parachuting operations, this was usually a single-point restraint.
Civil Aviation Order (CAO) 20.16.3 (Air service operations – carriage of persons) stated:
Where a parachutist is not provided with a seat of an approved type, he or she shall be provided with a position where he or she can be safely seated.
Except when about to jump, parachutists were required to wear a seat belt, safety harness or parachute that was connected to an approved single-point restraint.
Additionally, the Australian Parachute Federation (APF) Operational Regulations, section 5.2.4, required an aircraft used for parachuting to be fitted with sufficient parachutist restraints that are manufactured to a standard approved by CASA and the APF, labelled accordingly, or have sufficient aircraft seats and seatbelts.
The ATSB and other investigation agencies have previously expressed concern about the suitability of single-point restraints for parachuting operations, with research showing that dual-point restraints offer occupants better protection in the event of an accident. In addition, in some previous take-off accidents, parachutists were not wearing the single-point restraints.[15]
The requirements of CAR 251, CAO 20.16.3 and APF regulation 5.2.4 were met by the operator of VH-DGF by using an approved single-point restraint for each parachutist. The parachutists on board the accident flight were wearing the approved single-point restraints during the accident flight.
The available evidence indicates that there was sufficient fuel on board the aircraft for the flight, the risk of carburettor icing was low and there appeared to be no mechanical defects with the engine.
The Cessna 182 fuel system was designed to provide gravity-fed fuel, free from contamination, to the carburettor. There are multiple components that remove contamination, such as filters and drain points. After the fuel has entered the carburettor bowl, there are no further defences in place prior the fuel being atomised for combustion.
The carburettor fitted to VH-DGF contained aluminium oxide corrosion deposits. These were of sufficient size such that, when loosened, they probably blocked fuel flow within the carburettor, resulting in the aircraft engine suddenly losing power shortly after take-off.
As the carburettor bowl is on the ‘downstream’ side of the defences to prevent contamination, there are maintenance and storage processes to ensure its serviceability. The corrosion was probably able to form in the carburettor bowl during periods of inactivity. However, it was not possible to determine exactly when the corrosion started and propagated.
Periodic inspections (every 100 hours or 12 months) play a vital role in ensuring the serviceability of an aircraft’s engine, and these inspections had a requirement to drain and flush the carburettor. However, the extent to which this action was actually conducted during the six inspections since the engine and carburettor were overhauled could not be determined.
Maintenance overrun
It was also noted that a periodic inspection was not conducted at the required interval. A periodic inspection was required by 3 January 2018, but was not conducted until 30 May 2018. During the period from 27 January 2018 to 25 March 2018, the aircraft was flown without a valid maintenance release, and a further two flights conducted under special flight permits. However, given the last periodic inspection was done 7 months prior to the accident, the extent to which this previous omission contributed to problems with the carburettor was unclear.
There was also no indication on the last maintenance release that oil and oil filter changes were being conducted every 4 months. However, these omissions (if they occurred) should not have had an impact on the condition of the carburettor.
Use of occupant restraints
In general, the forces transmitted to occupants in light aircraft involved in an accident are higher than those transmitted in large transport aircraft involved in an accident. This is primarily due to the lack of protection from a crushable fuselage structure and therefore reduced energy absorption in a small aircraft.
A substantial body of research has shown that the risk of serious and fatal injuries can be significantly reduced if the occupants of small aircraft wear upper torso restraints (UTRs). In this case, the pilot was wearing a lap belt but not wearing the UTR.
It was fortunate that the pilot was not injured on this occasion. However, by not wearing his UTR, he significantly exposed himself to unnecessary injury risk. Noting that a UTR without an inertial reel can be restrictive, this should not prohibit the use of UTRs during critical phases of flight, such as take-off and landing.
Preparation for an emergency landing
During the accident flight, the parachutists were wearing the single-point restraints and given the relatively low impact forces, the restraints were sufficient to minimise injury risk during the forced landing.
However, after being ordered to evacuate by the pilot, the parachutists adjacent to the right door attempted to exit the aircraft without releasing their single-point restraints, delaying the egress of all on board. Fuel leaking from the damaged left wing of the aircraft increased the likelihood of a post-accident fire, and therefore the importance of rapid evacuation.
In this case, the parachutists knew how to undo their restraints, and would have been aware of the required actions for exiting the aircraft in the case of an emergency during take-off. However, this investigation highlights the additional benefits of mentally rehearsing the required actions immediately prior to or during take-off. According to the Civil Aviation Safety Authority’s Cabin safety bulletin 12 – General aviation passenger briefings (October 2018):
Survivors of aircraft accidents have provided anecdotal evidence as to the importance of their recollection of information… Adequately briefed passengers, who understand how to help themselves, will assist in the quick and successful evacuation of an aircraft.
Pilot response to the engine power loss
Airborne emergencies can be dynamic, fast-paced, and place a high cognitive workload on the pilot. When confronted with an airborne emergency, a pilot’s hierarchical priorities are to ensure the aircraft remains in controlled flight, navigate (in this case to a suitable landing area) and, if time permits, communicate the nature of the emergency to authorities enabling them to respond appropriately.[16]
Standard flight training and guidance for pilots is to land straight ahead, or within 30º either side of straight ahead, following an engine failure or power loss at a low height. Pilots are also taught to only consider a turnback manoeuvre once they have achieved a minimum height, which may vary depending on the aircraft type and other factors.
A substantial amount of guidance material has been published about managing engine failures after take-off, and such guidance material continually emphasises the importance of not considering a turnback until a pre-determined safe altitude has been reached. For example, a recent article in CASA’s Flight Safety Australia publication[17] (Stobie 2019) provided the following guidance:
Something that should have stuck from basic training was that you should never turn back following engine failure immediately after take-off. There’s good reason for this lesson—countless fatal accidents have involved pilots unsuccessfully attempting to turn back to the airport following an engine failure on upwind at low level. It’s often labelled the impossible turn, and it’s a procedure fraught with risk.
In this case, when the power loss occurred at about 400 ft, the pilot correctly assessed there was insufficient height to conduct a turnback to the departure runway. He selected a suitable landing area off the airfield 45º to the right of his current heading which, given the height of the aircraft, was able to be reached safely. The pilot automatically lowered the nose of the aircraft to maintain controlled flight and attain best glide speed, and he then focussed on navigating the aircraft to the suitable landing area.
With the limited time and height available, the pilot displayed sound airmanship and decision-making by conducting a forced landing and accepting the risk of a minor accident, rather than turning back and risking a loss of control and an accident involving much more serious consequences.
From the evidence available, the following findings are made with respect to the loss of power on take-off and forced landing involving a Cessna 182, registered VH-DGF at Tooradin Airfield, Victoria on 6 January 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The carburettor contained aluminium oxide corrosion deposits which, when loosened, likely blocked fuel flow within the carburettor, resulting in the engine losing power shortly after take-off.
The engine had periods of inactivity over the preceding years, and corrosion was able to form within the carburettor that was not prevented or detected by maintenance providers during periodic inspections (every 12 months or 100 hours flight time).
Other factors that increased risk
During the period from 27 January 2018 to 25 March 2018, the aircraft was flown without a valid maintenance release, and a further two flights conducted under special flight permits, without a periodic inspection having been conducted in the previous 12 months.
The pilot was not wearing an upper torso restraint during the accident flight, thereby increasing the likelihood of serious injury during the forced landing.
The parachutists adjacent to the door attempted to exit the aircraft without releasing their single-point restraints, delaying the egress of all on board.
Other findings
After the engine lost power, the decision by the pilot to conduct a forced landing rather than turn back to the departure runway minimised the risk of loss of control during the forced landing.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Aircraft operator
The operator advised that it intends to direct pilots to wear upper torso restraints and that this requirement will be incorporated into its training and induction schedule.
Australian Parachute Federation
As a result of a separate occurrence prior to the accident involving VH-DGF, the Australian Parachute Federation has advised the ATSB that in February 2019 it distributed ‘Continuing Improvement Package 4 – Aircraft Emergency and Evacuation Procedures’ to 60 parachuting clubs to incorporate into their operations and to prompt discussion on the subject.
The aims of the package were to:
reduce the risk and resultant injuries in the event of an aircraft emergency
discuss procedures in the event of aircraft emergency and/or evacuation
discuss multiple aircraft emergency and evacuation scenarios
implement aircraft evacuation training/drills.
Additionally, the Australian Parachute Federation advised in January 2020 that it was in the process of conceptualising a dual point, single release restraint.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the pilot of VH-DGF
the parachuting school that was operating the aircraft (Skydive South East Melbourne)
various maintenance providers
Civil Aviation Safety Authority
the carburettor manufacturer (Marvel).
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the pilot, the aircraft operator / parachuting school (Skydive South East Melbourne), the maintenance organisation that conducted the last periodic inspection on the aircraft, the carburettor manufacturer (Marvel, via the United States National Transportation Safety Board (NTSB)), the engine manufacturer (Continental, via the NTSB), the aircraft manufacturer (Cessna, via the NTSB), Civil Aviation Safety Authority and the Australian Parachute Federation (APF).
Submissions were received from the pilot, aircraft operator / parachuting school and APF. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 26 December 2018, a Kavanagh B-350 hot air balloon, registration VH-ZYO, operated as a scenic charter flight by Go Wild Ballooning, departed from Wandin, Victoria with the pilot and 15 passengers on board.
After 20 minutes in flight, and while operating at an altitude of about 800 ft, the pilot recalled hearing a small explosion from the front left burner and observed that a small fire had started on the outside of the burner. The pilot switched off the vapour valve at the fuel tanks to the front two burners and disconnected the hoses.
About a minute later, the pilot attempted to put out the fire using one of two on-board extinguishers, but the fire re-ignited almost immediately. After a further minute, the pilot discharged the second fire extinguisher, but again the fire re-ignited.
Moments later, the pilot’s compartment caught fire. The pilot was wearing a cotton shirt, synthetic vest, rolled-up pants, and rubber slip-on shoes and began to feel uncomfortable with his proximity to the fire. He then moved from the pilot’s compartment to the back left compartment of the basket.
About 8 minutes after the fire started, the pilot identified a suitable landing position and began the approach. During the descent, the basket struck some treetops and the ropes became tangled in the branches. Passengers reported that the branches whipped around and into the basket, with one passenger sustaining cuts to his hand. The pilot freed the ropes from the tree and brought the balloon to rest in the paddock below. As the basket touched the ground, the passengers jumped out and ran to safety.
The fire continued to burn as the pilot secured the balloon. When emergency services arrived on site, flames had engulfed the balloon. By the time firefighters extinguished the flames, the fire had destroyed the balloon.
What the ATSB found
The ATSB found that the in-flight fire was the result of a fuel leak at the front left burner. Due to severe fire damage, the source of the leak could not be determined conclusively, but it was considered most likely to be the main ball valve, liquid fire valve or liquid fire valve connection to the main valve block.
The hand-wheel valve on the liquid outlet of the fuel tank and the pilot burners were not shut-off, which resulted in the pilot being unable to control the fire. Installation of a 90-degree valve on the liquid fuel outlet may have assisted the pilot to recognise that the liquid fuel valve was not shut-off.
In addition, the pilot's clothing did not meet the recommended industry standards for personal protective equipment, which increased the risk to his personal safety.
What's been done as a result
As a result of this occurrence, the Civil Aviation Safety Authority released an Airworthiness Bulletin (AWB 02-063) to address some of the pertinent issues surrounding this occurrence. The AWB included:
a recommendation to inspect critical componentry
the use of 90-degree shut-off valves for the fuel tank liquid outlets
a reminder to close off liquid and vapour valves in the event of a fire
a reminder to wear appropriate personal protective equipment.
In addition, Go Wild Ballooning has advised the ATSB that they have replaced all hand-wheel valves with 90-degree valves on all fuel tanks and reviewed the company policy on protective clothing.
Safety message
In the event of an in-flight balloon fire, the first priority is isolation of the fuel supply at the fuel tank. It is good practice to rehearse emergency procedures by standing in the basket to run through the checklist steps.
Further ways to reduce risk to individuals and improve survivability outcomes include:
wearing appropriate protective clothing that includes cotton long‑sleeved shirts and long trousers, leather gloves, and enclosed footwear
utilising componentry that provides a visual indication of the system status, for example, 90‑degree valves on liquid outlets.
On-board view of in-flight fire involving VH-ZYO
Source: Passenger photo
The occurrence
What happened
On 26 December 2018, at about 0500 Eastern Daylight-saving Time,[1] a Kavanagh B-350 hot-air balloon, registration VH-ZYO, operated as a scenic charter flight by Go Wild Ballooning, was being prepared for departure from Wandin, Victoria.
Prior to take-off, the pilot, together with another ground crew member, conducted the pre-flight check on the balloon, while a ground crew member conducted a safety briefing with the passengers. Neither person inspecting the balloon observed any defects during the pre-flight check.
At 0537, the balloon lifted off with the pilot and 15 passengers on board. After about 15 minutes in flight, the balloon reached an altitude of 4000 ft. The pilot maintained level flight for a few minutes and then began to descend. At about 800 ft, the pilot recalled hearing a small ‘explosion’ from the front left burner (Figure 1) and observed that a small fire had started on the outside of the burner. The passengers observed that the fire was concentrated around the base of the burner, shooting outwards to the front of the basket.
The pilot switched off the vapour valve (see the section titled Aircraft information) at the fuel tanks to the front two burners and disconnected the hoses. Shortly after, the vapour hose connected to the front left burner burnt through and fell away from the burner.
About a minute later, the pilot attempted to put out the fire using one of two on-board extinguishers, but the fire re-ignited almost immediately. After a further minute, the pilot discharged the second fire extinguisher, but again the fire re-ignited. The first flames appeared in the vicinity of the burner can base, towards the front side of the basket, with the flames directed outwards.
Moments later, the pilot’s compartment caught on fire. The pilot was wearing a cotton shirt, synthetic vest, rolled-up pants and rubber slip-on shoes and began to feel uncomfortable with the proximity of the fire. As a result, the pilot moved from the pilot’s compartment to the back left compartment of the basket. The pilot made a call over the radio, repeating MAYDAY[2] three times followed by the balloon registration. Air traffic control acknowledged the call and initiated the appropriate emergency procedures in response.
About 8 minutes after the fire started, the pilot identified a suitable landing position and began the approach. During the descent, the basket struck treetops in the landing area undershoot and the ropes became tangled in the branches. Passengers reported that the branches whipped around and into the basket, with one passenger sustaining cuts to his hand. The pilot freed the ropes from the tree and brought the balloon to rest in the paddock below. As the basket touched the ground, the passengers on the right hand side of the basket jumped out causing the right side of the basket to lift off the ground again. In response, the pilot quickly pulled the red line[3] to evacuate the hot air from the envelope and brought the basket back down to the ground. The remaining passengers then jumped out and ran to safety.
The fire continued to burn as the pilot secured the balloon. When emergency services arrived on site, flames had engulfed the balloon. By the time firefighters extinguished the flames, the fire had destroyed the balloon.
Pilot's comments
The pilot later commented that:
he was carrying a long woollen coat in the basket as additional protective clothing, however, it was not accessible
he had not been wearing protective gloves, as they had been burnt earlier in the flight, when he had put them aside to adjust the radio
during the incident, he followed the priority of, ‘aviate, navigate, communicate’.
Aircraft information
VH-ZYO was a Kavanagh B-350 balloon. The balloon consisted of an envelope, a 16-person basket, a quad burner system and four propane fuel tanks.
Kavanagh Balloons series 3 burner and fuel system
A Kavanagh series 3, quad burner system was installed on the aircraft. The burner unit consisted of four high-pressure propane burners. Each of the burner units had two connections to the fuel tank: a vapour hose (connected to the pilot burner) and a liquid hose, which connected into the burner coil (Figure 1). A standard feature of the system included a secondary burner, known as ‘liquid fire’. This system bypassed the heat exchanger coil and fed liquid propane directly into the burner. The vapour hose drew gaseous propane from the top of the fuel tank and the liquid hose drew liquid propane from the bottom of the fuel tank. The fuel tanks on VH-ZYO had hand-wheel shut-off valves installed at the connections for both the liquid and vapour hoses. The alternative certified configuration was a 90-degree valve. Both valve configurations are shown in Figure 3.
Figure 1: Basket and burner arrangement similar to VH-ZYO
Source: Kavanagh Balloons, annotated by ATSB
An illustrated diagram of a burner unit is shown in Figure 2 below.
Figure 2: Illustrated diagram of the burner system on VH-ZYO
Source: Kavanagh Balloons, annotated by ATSB
Figure 3: Valve types on propane tank
Source: Kavanagh Balloons, annotated by the ATSB
The European Aviation Safety Authority (EASA) has previously published a safety information bulletin (SIB 2018-14) highlighting the advantages of using 90-degree valves over the hand‑wheel valves. EASA recommends operators of hot air balloons use the 90‑degree valves for propane fuel cylinders as they had been found to improve the survivability outcome in the event of fire due to their easy and quick actuation.
Liquid and vapour hoses
The Kavanagh Balloon’s maintenance manual mandates that the liquid fuel hoses have a 10-year life from the date of manufacture. The liquid hoses on VH-ZYO were last replaced in October 2018. Leak checks were conducted as part of the standard replacement procedure and the aircraft had been used multiple times since the replacement.
The liquid hoses were constructed from three layers of material: an inner rubber tubing, an encasing metal braid, and a rubber outer casing. Vapour hoses have a similar construction but do not have a time-limited life.
Main valve block
The main valve block (Figure 2) was an assembly of two solid pieces of aluminium, fastened either side of the main ball valve with four bolt and nut combinations. The liquid fire valve, liquid fuel hose, pressure gauge and cross flow plug each screw into a threaded hole in the main valve block.
Pressure gauge
The manufacturer rated the pressure gauge to a maximum operating pressure of 230 psi,[4] with design testing conducted to around 345 psi. The normal operating range for the series 3 burner (the same burner installed on VH-ZYO) is 50 – 218 psi. The pilot indicated that the system was generally operated at around 180 psi.
Liquid fire valve and main ball valve
The liquid fire valve was a small ball valve, housed in a steel casing, with no replaceable parts. The maintenance manual specified that the valve was to be replaced as a full unit (based on the valve’s condition). Conditions indicating replacement was necessary included seizing of the valve, the valve not shutting off, or signs of leaking.
The main ball valve was a 90-degree, quick shut-off valve, designed to stop the flow of fuel into the burner can.
Kavanagh Balloons flight manual
Mandatory equipment
The flight manual specified that at least one dry powder (1 kg capacity) fire extinguisher must be carried during each flight.
In-flight fire
The manufacturer’s required actions for managing an in-flight fire were:
turn off fuel at main tank valves and turn off pilot burners
put out fire with the fire extinguisher
if it is safe, re-light pilot burner, proceed as normal and make a landing as soon as possible
if it is unsafe to re-light the burner, prepare to make an emergency hard landing.
Clothing recommendations
The regulatory bodies in Europe and America have developed guidelines for balloon operators, including the following recommended protective clothing:
long sleeves and trousers, preferably made of natural fibres
protective footwear
leather gloves.
Component examination
The ATSB conducted an examination of a number of balloon components. The examination was severely hindered by the extensive fire damage but the following observations were possible:
the burner from which the fire was emanating still had the liquid fire valve, the mini ball valve (vapour pilot burner) and the burner coil attached (Figure 4)
the main ball valve was not attached to the coil (Figure 4)
in-flight photographs showed that the main ball valve was shut during the fire
all of the main valve block assembly bolts (with nuts attached) and cross-flow plugs were found intact in the wreckage
examination of the components did not identify any possible sources of a leak or failure that may have contributed to the in-flight fire
determination of the integrity of the main ball valve and liquid fire valve could not be established as the internal structures were completely disrupted by the fire.
Figure 4: Underside of burner and main ball valve – fire location
Source: ATSB
Previous occurrences
A review of the ATSB occurrence database for similar occurrences identified that in the last 10 years there had been 10 instances of a hot air balloon catching fire. Of these, two incidents were the result of a fuel leak. In the first instance, the leak occurred at the main ball valve and in the other at the liquid fire valve. The pilots of the balloons controlled the fires by shutting off the fuel at the tank and then extinguishing the flames.
Safety analysis
The pilot first observed the fire coming from the front left burner. Physical examination of the components did not identify any possible sources of a leak or failure that may have contributed to the in-flight fire. However, the location of the fire (front left burner) eliminated any of the connections at the fuel tanks as a source of the leak. With the main valve switched off and the liquid fuel remaining on at the tank, only the pressurised components in between could have been the source of the initial leak. The most likely were considered to be the:
threaded connection between the liquid fire valve and main valve block
liquid fire valve
main ball valve.
The direction of the flame (towards the front of the balloon) was in line with the connection of the liquid fire valve into the main valve block. On installation, over-torquing or cross-threading the connection could result in damage to the aluminium valve block. Stresses from pressurisation and thermal cycling over time can cause the damage to develop into a crack, resulting in a fuel leak. However, as this joint did not require frequent adjustment, the likelihood of damage due to installation error or handling was reduced.
The flames emanated from a location near the main ball valve and the liquid fire valve. The valves (moving components) were prone to wear and therefore at higher risk of leaking than static components. The valves were oriented vertically with a handle on the base. It can be expected that any leaking fluid would spray downwards, into the handle, making it unlikely to see the directional flame pointing outwards from the basket. However, given the fire continued for an extended length of time, it is likely that the initial fire heated the surrounding structure causing failure of seals and joint sealant in other components, leading to further leaks and a larger fire. In that context, images and accounts of the flames directed outwards from the basket may be the result of subsequent failures.
As the pilot did not shut the liquid fire valve on the fuel tanks or the pilot burners, the situation escalated rapidly and increased the pilot’s workload in managing the situation. The leaking fuel near to the pilot flames on the adjacent burners caused the fire to re‑ignite immediately after the removal of the fire extinguishers. Use of a 90-degree valve on the liquid fuel outlet may have better assisted the pilot to recognise that he had not shut off the liquid fuel valve, enabling him to control the fire.
The pilot’s clothing did not provide adequate protection from burns, increasing the risk of personal injury. The pilot was carrying additional protective clothing, however, it was not kept in a readily accessible location, and therefore could not be used.
Finally, the MAYDAY broadcast did not provide air traffic control with a current or last known location of the aircraft. In this instance, the lack of information did not result in a delayed response from emergency services. It is important, however, for pilots to follow standard broadcast procedures when declaring an emergency.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
A fuel leak at the front left burner resulted in an in-flight fire. Due to severe fire damage, the source of the leak could not be determined conclusively, but it was considered most likely to be the main ball valve, liquid fire valve or liquid fire valve connection to the main valve block.
The hand-wheel valve on the liquid outlet of the fuel tank and the pilot burners were not shut off, which resulted in the pilot being unable to control the fire.
The pilot's clothing did not meet the recommended industry standards for personal protective equipment, which increased the risk to his personal safety.
Installation of a 90-degree valve on the liquid fuel outlet increases survivability in the event of fire and, may have assisted the pilot to recognise that the liquid fuel valve was not shut off.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Civil Aviation Safety Authority
As a result of this occurrence, the Civil Aviation Safety Authority released an Airworthiness Bulletin (AWB 02-063) to address some of the pertinent issues surrounding this occurrence. The AWB included the following recommendations:
Inspect the condition and operation of the fuel pressure gauge, stem seal and liquid fire valve.
Review the fuel system pressurisation limitations. Pressurisation of the fuel gauge beyond the maximum reading may cause catastrophic failure of the pressure gauge.
Use 90-degree (quick shut-off) valves for the fuel tank liquid outlets.
Review and rehearse all emergency procedures including in-flight fire and burner malfunctions.
Both the liquid and vapour valves must be closed on any tanks connected to the burner with a leak or malfunction before any effective firefighting methods can be performed.
Minimum industry standard protective clothing should be worn, which includes fire-resistant gloves, long-sleeved cotton shirt and sturdy, enclosed footwear
Carry fire blankets of a size of at least 1.5 m x 2 m.
In addition, CASA conducted a surveillance audit on Go Wild Ballooning. The audit returned a number of findings that the company will be required to rectify.
Go Wild Ballooning
As a result of this occurrence, Go Wild Ballooning has advised the ATSB it has taken the following actions:
upgraded one basket to the new Kavanagh Quad Burner system and is considering phasing out the older Kavanagh series 3 systems
replaced hand-wheel valves with 90-degree valves on all fuel tanks
reviewed the company policy on protective clothing, and are researching new fire-proof gloves.
Safety message
Pilots experience a high workload during in-flight emergencies. However, in the event of an in‑flight balloon fire, the first priority must be isolation of the fuel supply at the fuel tank.
The complex nature of emergencies highlights the importance of rehearsing response procedures. It is also good practice to do this standing in the basket. Further ways to reduce risk to individuals and improve survivability outcomes include:
wearing appropriate protective clothing, which includes cotton long-sleeved shirts and long trousers, leather gloves and enclosed footwear.
utilising componentry which provides a visual indication of the system status and is easy to use, for example, 90‑degree valves on liquid outlets.
Civil Aviation Order 201.11, Appendix IV and Civil Aviation Regulation 5.143 provide requirements for pilots to maintain currency of skills. It is important to remember, however, that it is up to individuals to ensure that they maintain a good working knowledge of how to deal with the full range of abnormal indications. Civil Aviation Advisory Publication 5.81-1(1) provides a clear interpretation of the requirements.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 13 December 2018, a GIE Avions De Transport Regional ATR72-212A registered VH-FVN was operated by Virgin Australia Airlines on a scheduled passenger flight from Sydney to Canberra. The aircraft encountered icing, turbulence and rain associated with thunderstorm activity in the area, so the crew diverted and held as required in order to avoid the adverse weather. Shortly after commencing descent into Canberra, passing 11,000 ft, the No.2 engine flamed out. The engine’s automatic ignition system engaged and the engine recovered within five seconds without pilot input. Approximately one minute later, passing 10,000 ft, the No.1 engine flamed out and automatically recovered within five seconds, again without pilot input.
Because of the quick nature of the automatic recovery, the crew did not action any checklists. The crew selected manual ignition as a preventative measure and continued to Canberra without further incident.
What the ATSB found
The ATSB found no evidence to suggest a mechanical fault or failure caused the engines to flameout and that the flameouts were likely to have been caused by the environmental conditions during the flight, most likely either icing or moderate/heavy rain, or a combination of both.
Aircraft systems and procedures for protection and recovery from flameouts in these conditions were reliable and effective in relighting the engines. However, the decision to select manual ignition following the flameouts potentially reduced the recovery and protection of the engines in the event of any potential further flameout.
What's been done as a result
The operator has conducted an internal investigation, released internal communications for awareness of the occurrence and ensured its pilots are aware of the appropriate use of manual ignition.
The manufacturer is ensuring all operators of the ATR72-212A are aware of the appropriate use of manual ignition. They are also reviewing operational documentation as to whether this requirement could be explicitly included.
Safety message
An engine flameout event is not common in today’s modern turbo propeller engines, but it is still possible. Reliable and effective systems and procedures exist to protect and recover from such events and it is important that pilots follow manufacturer procedures for these systems. In the case of the ATR72-212A, the automatic ignition system worked as designed, correctly identifying the loss of engine power, initiating ignition and successfully relighting the engines without pilot input. The selection of manual ignition potentially reduces the recovery mechanism effectiveness against flameouts, and should only be used when directed by checklist or a minimum equipment list.
The occurrence
On 13 December 2018, a GIE Avions De Transport Regional (ATR) ATR72-212A 600 series (ATR72), registered VH-FVN, was operated by Virgin Australia Airlines (Virgin) on scheduled passenger flight VA660 from Sydney, New South Wales (NSW) to Canberra, Australian Capital Territory (ACT). Two pilots, two cabin crew and 42 passengers were on board. The captain was the pilot monitoring (PM) and the first officer (FO) was pilot flying (PF).
During planning for the flight, the crew were aware of significant weather en route, with a line of thunderstorms approaching Canberra. A second line of thunderstorms was approaching and the crew assessed that the aircraft would arrive in Canberra at about the same time as the second line of storms. Sufficient fuel was loaded to enable the duration of the flight to Canberra, to hold for one hour, return to Sydney and hold for another hour.
Following departure at about 1741, the crew were able to observe the weather ahead and formulated plans to avoid the storms. About 10 minutes after departure, the crew requested a diversion 5 NM left of track to avoid weather. About 15 minutes after departure, air traffic control (ATC) cleared the aircraft to climb to flight level 160 (FL160[1]) and to increase their diversion left of track up to 10 NM.
Shortly thereafter, the clearance to divert left of track was cancelled by ATC and the crew were requested to provide a heading which would keep them clear of weather. ATC then directed the aircraft to maintain FL130 due to passing traffic, later clearing a further climb to FL140.
After being cleared for the standard arrival route (STAR) BUNGO 3A into Canberra, the crew accepted direct tracking to waypoint HIPPO. En route to HIPPO, the aircraft entered visible moisture with a total air temperature (TAT) below 7 °C, which were icing conditions as defined by the aircraft manufacturer (ATR). The crew acknowledged this and turned on anti-icing systems in accordance with the aircraft procedure for entering such conditions.
The crew requested an update on the weather at Canberra. ATC advised there was significant showers in the area with greatly reduced visibility. The crew commenced descent in accordance with their arrival clearance and ATC directed them to stop descent at FL120. ATC asked the crew if they would like to attempt an approach but the crew elected to hold at HIPPO at FL120 until the weather passed. Shortly thereafter, icing was visible on the aircraft and the crew selected de-icing systems ON as required by ATR FCOM procedures.
After holding at HIPPO for about 7 minutes, the crew requested to track south then west to fly around the weather and then back to Canberra. ATC cleared the aircraft to do so with headings at crew discretion.
The aircraft tracked south until about 1830 when it turned back north to assess the weather at Canberra (utilising radar). The crew decide to track to waypoint POLLI for the POLLI 7 STAR and advised ATC accordingly. ATC advised the crew that a STAR clearance was available, but the crew advised ATC to standby as they were busy avoiding weather. Shortly after, ATC advised that an approach was now viable (a previous aircraft had landed) but the crew continued to POLLI and assessed the weather for themselves.
The crew elected to hold at POLLI and held there until about 1849 when ATC vectored them to the north to commence the STAR. At 1853, the aircraft was cleared by ATC to resume its own navigation direct to waypoint HUNNI, descend to 9,000 ft to commence the STAR.
At about 1854, shortly after descent had commenced, the aircraft passed FL110 with both power levers close to flight idle when No.2 engine lost power and flamed out. The master warning and ENG 2 OUT annunciators displayed, and No.2 engine torque reduced to zero. In the time it took the crew to acknowledge the warning and confirm what it was, No.2 engine self-recovered, torque returned to normal and the warnings ceased. The crew discussed that they likely encountered icing, confirmed engine power had returned to normal and confirmed that anti-icing and de-icing systems were on. Due to the automatic recovery, the crew were not required to action any checklist or procedures associated with an engine flameout in flight.
At about 1855, both power levers were at flight idle when No.1 engine lost power and flamed out. The master warning and ENG 1 OUT annunciators displayed, and No.1 engine torque reduced to zero. In the same way that No.2 engine had recovered, No.1 engine self-recovered by the time the crew had acknowledged and confirmed the flameout. Again, no checklist or associated procedures were required to be actioned.
The captain immediately identified the de-ice mode selector switch in order to ensure the de-ice cycle was in ‘fast’; however, the captain inadvertently selected the slow cycle. The captain then selected ignition to ‘manual’, in order to provide continuous ignition in an attempt to prevent any further flameouts.
Satisfied that power in both engines had been restored to normal, the crew discussed the situation, but were unable to determine the cause of the flameouts. They confirmed manual ignition ON, icing protection ON and observed that the temperature was 12 degrees, prompting further discussion on the use of icing protection. The crew decided that they would not turn any of the icing protection systems off at that stage and would fly at icing speeds[2] if they needed to keep the icing protection on for landing.
The crew stated that the aircraft was in heavy rain at the time of the flameouts but they did not notice any significant icing at the time. Figure 1 depicts the rainfall recorded by radar at about the time of the first flameout.
The crew continued the approach, and at about 1901, the crew confirmed the aircraft was no longer in icing conditions and selected the de-icing OFF but left the anti-icing systems ON.
No further flameouts occurred and the aircraft landed at 1906.
Figure 1: Radar image at time of flameouts
The radar image at 1854, about the time of the first flameout. Areas of yellow depict moderate rainfall with red depicting heavy rainfall.
The captain commenced flying the ATR72 with Virgin in 2013 as a first officer, becoming a captain in April 2018. At the time of the incident, the captain had accumulated 204 hours command on the ATR72. The captain had a total flying time of 6,660 hours with 2,225 hours on ATR72.
Previous flying experience included charter and regular public transport (RPT) operations on aircraft including the Embraer 120 and Cessna 441 (Conquest). The captain had also undertaken flying instructor roles prior to that.
The captain’s most recent line and simulator check records did not highlight any major or ongoing proficiency concerns. Engine malfunctions and adverse weather operations were included in those assessments.
First officer
The first officer (FO) commenced flying the ATR72 with Virgin in 2012 as a first officer. At the time of the incident, the FO had a total flying time of 6,700 hours, with over 3,000 hours on the ATR72.
Previous flying experience included charter and RPT and flying instruction.
The FO’s most recent line and simulator checks did not note any major or ongoing proficiency concerns. Engine malfunctions and adverse weather operations were included.
Aircraft Information
General
VH-FVN was an ATR72-212A 600 series aircraft manufactured in 2012. The aircraft is a twin-engine turboprop regional airliner that seats up to 78 passengers (dependant on configuration) and is crewed by two pilots and two cabin crew.
Engine combustion and flameout
The ATR72 is powered by two Pratt & Whitney Canada (PWC) PW127M turbo propeller engines. The engine operates by continuous internal combustion of a fuel air mix. A flameout is an unintentional extinguishing of the flame in the engine. This may result from interruption of any of the requirements for sustaining combustion, being fuel, air and heat.
The ATR Flight Crew Operating Manual (FCOM) provided information on possible causes of a flameout. Pilots were able to use this to assist in identification of the likely cause in the event of a flameout and to allow appropriate action to take place. The FCOM stated:
The causes of engine flameout can generally be divided into two categories:
- External causes such as icing, very heavy turbulence, fuel mismanagement. These causes, which can affect both engines can generally be easily determined and an immediate relight can be attempted.
- Internal causes such as engine stalls or failures, usually affect a single engine. These causes are not so easily determined. In these cases, the engine is shut down then the cause of the flameout investigated. If the cause of the flameout cannot be determined, the need for engine restart should be evaluated against the risk of further engine damage or fire that may result from a restart attempt.
‘Icing’ is not quantified. However, another section of the FCOM stated that very large ice accretion on the engine intake may generate an engine flameout when the ice breaks free. Rain is not specifically included in the FCOM as an external cause of flameouts.
Fuel system
Fuel management and fuel quality was considered as a possible external contributor. There was no evidence to suggest fuel mismanagement and inspection of the fuel system did not identify any contaminants. Fuel management and fuel quality were not considered contributory to the flameouts.
Ignition system
The PW127M engine has a high-energy ignition system which provides for engine start on ground or in flight. Following a successful engine start, the ignition system is automatically disengaged and no longer providing a spark as combustion is self-sustaining. Under control of the electronic engine control (EEC) unit, the ignition system will activate if NH[3] drops below 60 per cent.
A guarded manual ignition switch is available to allow the crew to manually select continuous ignition. The FCOM referred to manual ignition in situations where an EEC is OFF (fault or malfunction). If one or both EECs are OFF, manual ignition is required for flight in the following cases: icing conditions, engine(s) flame out, emergency descent, severe turbulence and heavy rain, or when operating on a contaminated runway for take-off or landing.
The ATSB noted that there was no FCOM reference that prohibited the use of manual ignition in other situations and there was no explicit direction for ignition to remain in its automatic initiation state.
Prior to the engine flameouts on VH-FVN, the ignition system was in its normal state, being OFF, but primed to be initiated by the EEC as previously described. For both flameouts, the ignition system automatically engaged as designed and successfully relit the engines. Following the automatic recovery, the crew reported that they selected manual ignition as a safety measure to prevent further flameouts. The crew could not recall any specific guidance from ATR for flights in heavy weather.
Following notification of the occurrence, ATR advised Virgin that selection of manual ignition was not appropriate and that use of manual ignition other than as directed lowered the flameout recovery and protection afforded by automatic ignition. ATR explained the difference as follows:
On ATR72-600, each engine is equipped with a high-energy ignition system. Triggering of auto-relight energizes igniter boxes, which deliver sparking rate of 5/6 per sec for 25s.
MAN IGN [manual ignition] is a guarded push button at overhead panel and is to be used in case of EEC Fault or under dispatch minimum equipment list (MEL[4]) with EEC OFF as per ATR procedures.
When selecting MAN IGN, ignition system is activated at a sparking rate of 5/6 per sec for 25s. Then, the sparking rate becomes slower after 25s (changing from 5/6 per sec to 1 per sec).
ATR later clarified their explanation for automatic initiation in that following the initial 25 seconds, the sparking rate also reduces to one spark per second.
The implication is that if manual ignition has been ON for more than 25 seconds at the time of a flameout, it would be steady at one spark per second and not at the high spark rate of automatic ignition, therefore potentially delaying the relight process.
Icing and rain protection system
The ATR72-600 is fitted with various protection systems for operations in various environmental conditions, particularly icing.
The system consists of:
Ice detector, mounted on left wing which electronically monitors ice accretion.
Ice evidence probe (IEP) near captain’s windshield for visible detection of ice accretion.
Electrically heating (anti-ice) of propeller blades, windshields, probes and flight control horns.
Pneumatic boots (de-ice) on wing and horizontal tailplane leading edges and engine air intakes and gas paths.
Windshield wipers for rain removal from front windshields.
An aircraft performance monitoring system works in conjunction with the above components, through alerts to the crew if an aircraft aerodynamic performance degradation is detected due to ice accretion.
The aircraft engines are protected from icing through the de-ice system controlled via two push button switches, one for each engine. Pneumatic boots, located in the engine air intakes and gas paths, inflate on an automatically controlled cycle to dislodge ice accretions.
The selection of engine de-ice is not a recorded parameter. However, it is monitored for faults and any faults triggered are recorded. No engine de-icing faults were recorded for the incident flight. There was no indication of any problems with the engine de-icing system that may have contributed to the flameouts. Similarly, there was no damage to the engine intakes which may indicate impact due to large ice accretions having broken away during the de-ice process.
Water ingestion margin testing
The PW127M engines had been tested and certified for water ingestion requirements, and in addition to this, another water ingestion test was undertaken by PWC in 2016 to identify engine capability in terms of water ingestion. This was on one PW127M engine mounted on a test bed with a non-bypass intake duct. This configuration tested a worst-case scenario with all water entering the engine.
The test concluded that the engine demonstrated significant margin over the certification requirements and a resilience to adverse operational environments. The certification required the engine to maintain steady operation with an ingestion of water at a 4 per cent water to air ratio (WAR). The test engine performed such that a power loss and flameout occurred at 15.8 per cent WAR.
Procedures
Operations in adverse atmospheric conditions
Volume A1 of Virgin’s operations manual suite included a section on adverse atmospheric conditions. Requirements for avoiding thunderstorms and severe weather as well as specific sections on lightning, cyclones and volcanic ash were included. Rain was not specifically mentioned.
The ATR FCOM also provided guidance and procedures for operations in adverse weather conditions. There were several sections with procedural guidance on icing conditions and turbulence and general adverse weather.
Rain was not afforded any specific guidance in the FCOM nor was it mentioned, except with regard to the use of windshield wipers and in the EEC fault procedure.
During the flight, the crew diverted and held as required to maintain the aircraft clear of the weather. On several occasions, the crew requested diversion off track to maintain safe separation from the approaching weather and entered a holding pattern on two occasions to allow for passage of thunderstorms over Canberra. The flight was initially flown at turbulence speed[5] due to moderate the turbulence encountered. From about 1807, the aircraft was flown at icing speeds. Although turbulence continued for the remainder of the flight, icing speeds were flown from that point as the crew assessed that icing was a higher threat than the moderate turbulence.
Engine flameout recovery procedure
An engine flameout procedure was included in the aircraft operational documentation. The initial actions for an engine flameout is to move the power lever on the affected engine to flight idle. If NH drops below 30 per cent (no immediate relight) then the engine is to be shutdown.
For this incident, upon warnings being displayed for the first flameout, the crew acknowledged the master warning and whilst assessing the situation, the engine power restored prior to any action being required. The second flameout occurred in a similar manner and engine power restored whilst the crew were assessing the situation. No checklist procedures were carried out given the timeframe from flameout to automatic recovery.
Recorded flight data
The ATSB downloaded and analysed the data from the aircraft flight data recorder. Figure 2 below presents the key recorded aircraft and engine parameters at the time of the flameouts. During both flameouts, the master warning was active for 5 seconds. This included the time from flameout, initiation of automatic ignition and full recovery.
Figure 2: Recorded flight data
Source: ATSB
Weather information
Weather forecasts provided to the crew included significant meteorological information (SIGMET), forecasting squall line thunderstorms with hail, with tops up to FL400. The weather was forecasted to move to the east-south-east at 15 knots. At the time of planning, operational dispatch notes indicated this weather was within 50 NM to the west of Canberra. A significant weather (SIGWX) chart covering FL100-FL250 forecast moderate turbulence between FL100-FL250 and moderate icing from FL120-FL240 with isolated embedded cumulonimbus clouds.
The Bureau of Meteorology (BOM) graphical area forecast, covering mean sea level to 10,000 ft, indicated a broad area of thunderstorms including reduced visibility down to 2,000 m associated with heavy rain and areas of 4,000 m visibility associated with widespread rain. BOM always assume that severe icing is coincident with the convective activity of forecast thunderstorms and therefore do not forecast icing separately.
The aerodrome forecast (TAF) for Canberra, issued at 1608 and valid from 1700 until 1700 the next day, forecast temporary deterioration periods where thunderstorms, reduced visibility, rain and hail would occur, broadly consistent with the area forecasts and significant weather charts. However, the prevailing conditions at Canberra suggested an approach and landing would be achieved in between the temporary deteriorations.
The crew were well aware of the expected weather for the flight and in conjunction with Virgin operation staff, sufficient fuel was loaded to allow the crew to hold and/or divert as required in order to allow for passage of the weather. Both crew commented that at no stage did they consider that the flight should be cancelled due to the weather.
BOM radar imagery around the time of the incident shows lines of moderate rainfall, which the BOM describe as indicative of thunderstorm activity.
Special observations at Canberra from 1800 confirmed thunderstorm activity and continued to be reported at Canberra until 1900.
The crew observed the actual weather was as expected but commented that turbulence was the prevalent issue. The crew described the turbulence as moderate throughout the flight with a highest recorded G load[6] of +1.76. Icing conditions were encountered, with the crew observing visible moisture and total air temperature (TAT) below 7 °C. Ice accretion was observed shortly thereafter.
The crew recalled that rain was heavier in the POLLI area. The captain described being in heavy rain at the time of the flameouts although BOM radar imager indicates moderate rain at the time. Ice was not evident on the IEP at that time and the captain recalled that the windscreen looked like ‘a bucket of water had been thrown on it’. Consistent with their pre-flight assessment that they could fly, the crew noted that the weather, although significant, was not anything that they had not encountered previously.
Post occurrence maintenance inspection
Following the occurrence, a number of maintenance inspections were undertaken. The inspections that took place included:
Visual inspection of the inlet compressor blades and exhaust outlet (a detailed inspection of the engine core was not undertaken as the visual inspection of outer section did not identify any damage indicative of ingesting foreign objects. This was based on ATR/PWC guidance).
Chip detector inspection.
Severe turbulence inspection.
Low pressure fuel filter and housing inspection.
Fuel tanks checked for water contamination.
Although not exhaustive, there was no indication of any mechanical fault or failure and no indication that further detailed inspections were required.
Related Occurrences
PWC provided information regarding 21 flameout events on PW127M engines on ATR aircraft during bad weather (rain or icing). It included this occurrence and three subsequent events. These events were on ATR72-500 and -600 variants as well as one ATR42-600.
Figure 3 shows breakdown by year:
ten were in icing conditions
seven were in heavy rain
four were in moderate rain.
In all cases, the automatic ignition system initiated successfully, and power was restored without pilot intervention.
The earlier related occurrences prompted a water ingestion test in 2016 by PWC of the PW127M engine. As previously discussed, the engine performed in excess of the certification requirements, satisfying both PWC and ATR that the engines were capable of operating in significant adverse environmental conditions.
ATR concluded that extant guidance and standard operating procedures were sufficient. That is, in the case of a temporary power loss with automatic relight there was nothing specific to do. Should an automatic relight not occur, the checklist provided guidance for securing the engine and any subsequent restart attempt.
Figure 3: Flameout events during bad weather by year
The ATSB considered internal causes such as a mechanical fault or failure. The engines were running smoothly and producing the required power as commanded with no signs of the impending flameout. Post occurrence maintenance was in conjunction with ATR and PWC guidance and did not identify any mechanical fault or failure. There was no evidence to suggest that a mechanical fault or failure contributed to the flameout.
Of possible external causes, fuel management and fuel quality were not considered contributory to the flameouts. However, evidence indicates that the aircraft encountered significant weather during the flight, including rain, icing and turbulence. Despite this, the ATSB considered that the flight crew managed the weather conditions appropriately and there was no evidence to suggest that the flight should have been cancelled due to those conditions.
The flight crew operating manual (FCOM) listed heavy turbulence as a possible cause of flameout. The crew described the turbulence as moderate and the recorded G load of +1.76 is consistent with crew description of the turbulence. The ATSB did not consider turbulence as contributory to the flameouts.
Icing was also included in the FCOM as a possible cause of flameout. There was no evidence of damage to engine inlets (suggesting no ingestion of large ice accretions) and the crew did not note any significant ice accretion during the flight. Engine de-ice had been on for at least 40 minutes prior to the flameouts which indicates that significant ice accretions would have been very unlikely. The aircraft exited icing conditions approximately 1 minute prior to first flameout (TAT had risen above 7 °C) suggesting that the conditions were suitable for dislodging any ice accretion or that they were not suitable for ice to form. There was insufficient evidence to determine if icing did or did not contribute to the flameouts.
The crew recalled that the aircraft was in heavy rain and Bureau of Metrology (BOM) radar imagery indicates moderate rain at the time. Although the engines passed certification requirements for water ingestion, numerous flameout occurrences have previously been associated with moderate or heavy rain conditions. Testing takes place in a controlled environment but does not account for engine installation and other variables of actual flight conditions. There was insufficient evidence to determine if rain did or did not contribute to the flameouts.
In the absence of evidence to the contrary, it is likely the flameouts were the result of the environmental conditions during the flight. Although the exact environmental influence could not be confirmed, it is likely this was either ice or rain, or some combination of the two.
Flameout recovery
The automatic ignition function performed as designed, recognising the drop in NH below specified criteria and automatically engaging the ignition system to relight the engines without pilot input.
The known flameout events on ATR aircraft all involved icing or moderate/heavy rain. The auto ignition system has been proven effective and reliable in providing flameout recovery and in all 21 events, as the engines successfully relit without pilot input.
In the absence of specific guidance against the use of manual ignition, the crew selected manual ignition, which operates continuously at one spark per second after the initial 25 seconds. Given the uncommon situation of two engine flameouts, the crew considered that manual ignition was a safety measure to prevent any further flameouts in that a continuous source of ignition may prevent the flame from being extinguished. This is in contrast to automatic ignition, which in the event of a further flameout, would have initially operated at a higher spark rate.
ATR advice to Virgin and other ATR operators is that in the case of a temporary power loss with automatic relight, there is nothing else to do, the system has worked as designed and restored engine power. ATR advice is that selection of manual ignition potentially lowers the flameout protection of the engine, and that manual ignition should only be used when directed by a checklist. However, ATR documentation does not contain this guidance.
Findings
From the evidence available, the following findings are made with respect to the engine flameouts on descent involving ATR 72-212A, VH-FVN that occurred near Canberra, Australian Capital Territory on 13 December 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The two engine flameouts were probably the result of the environmental conditions (likely icing and/or heavy/moderate rain) during the flight.
Other factors that increased risk
The crew selected manual ignition as a preventative measure against further flameout. While ATR recommend that manual ignition should not be selected unless directed by checklist or under minimum equipment list, this was not specifically mentioned in the ATR documentation.
Other key finding
The aircraft automatic ignition system performed as designed by automatically relighting both engines without pilot input following flameout.
Safety actions
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Action taken by Virgin Australia Airlines Pty Ltd
Virgin has advised the ATSB that the following safety actions have been taken:
Provided a statement of facts of the occurrence to all ATR flight crew.
Provided an update to ATR flight crew with regard to use of manual ignition.
Released a flight crew operational notice formalising previous information on manual ignition use.
Updated internal documentation (Standard OperatingProceduresManual) to include direction on use of manual ignition as well as reference to rain as a possible cause of flameout.
Action taken by GIE Avions De Transport Regional
ATR has prepared communications to be provided to ATR operators (on request), advising details of this occurrence and that manual ignition is only to be selected when directed by checklist or under minimum equipment list.
ATR commenced an internal review of aircraft documentation with the following modifications on going:
The addition of ‘rain’ in the potential external causes of engine flameouts
The addition of detailed differences between manual and automatic ignition, including a description of the role of the manual ignition push button.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Flight crew of VH-FVN
Flight data recorder and cockpit voice recorder from VH-FVN
Virgin Australia Airlines
GIE Avions De Transport Regional
Pratt & Whitney Canada
Bureau of Meteorology
Airservices Australia.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the flight crew, Virgin Australia Airlines, GIE Avions De Transport Regional, Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile, Pratt & Whitney Canada, the Transportation Safety Board of Canada, Australian Bureau of Meteorology, Airservices Australia and the Civil Aviation Safety Authority.
Submissions were received from Virgin Australia Airlines and GIE Avions De Transport Regional. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 8 December 2018, a Desert-Air Safaris Beech Aircraft Corporation B200, registered VH-ODI operated a charter flight from Adelaide Airport to Mount Gambier Airport, South Australia with a pilot and seven passengers on board. One of the passengers held a commercial pilot licence and acted in an observer role from the right flight deck seat, but was not a member of the flight crew.
During the landing at Mount Gambier, the aircraft touched down with the landing gear retracted, with the propellers contacting the runway twice before the pilot initiated a go‑around. During the go-around, the left engine failed. The aircraft then landed without further incident.
What the ATSB found
The ATSB found that upon reaching the minimum descent altitude for an approach to Runway 18 at Mount Gambier, the pilot had not yet obtained visual reference with the runway. He therefore commenced a go-around and retracted the landing gear. After retracting the landing gear, the pilot sighted the runway and decided to continue the approach, but inadvertently did not re-extend the landing gear.
During the continued approach, the pilot likely did not detect the retracted landing gear due to an expectation that it was already extended. This was possibly also compounded by the now‑increased workload.
Further, the ATSB found that the pilot’s decision to conduct a go-around after the wheels-up landing stemmed from his misunderstanding of the situation, and an assessment that a runway overrun was imminent.
Safety message
This accident highlights the hazards of spontaneous decision-making, particularly during a high‑workload phase of flight in a complex aircraft. The Civil Aviation Safety Authority Resource booklet and video Decision Making provides the following tips to improve the quality of decision making, mitigate the possibility of errors and ensure a considered approach in resolving issues or problems:
You cannot improvise a good decision, you must prepare for it. You will make a better and timelier final decision if you have considered all options in advance. This is why good briefings are important.
Use decision-making aids—operational checklists—to ensure you have not forgotten anything important.
Always have reserve capacity for reacting to unexpected events.
Delegate your load to other team members (if multi-crew) when time is critical.
Keep the big picture in mind rather than focusing on one aspect of a problem.
The occurrence
On the morning of 8 December 2018, the pilot of a Desert-Air Safaris Beech Aircraft Corporation B200, registered VH-ODI (ODI), prepared to conduct a charter flight from Adelaide, South Australia to Mount Gambier, South Australia with seven passengers on board. One of the passengers occupied the right flight deck seat as an observer. This observer held a commercial pilot licence, but was not a member of the flight crew.
At about the scheduled departure time of 1000 Central Daylight‑saving Time,[1] the pilot reviewed the weather forecast for Mount Gambier Airport which provided the following information:
A southerly wind of 10-14 kt throughout the forecast period.
Visibility greater than 10 km for the forecast period, with light rain showers until 1230.
A broken[2] cloud base of 712 ft above mean sea level (AMSL) (500 ft above aerodrome level (AAL)) until 1130.
From 1130, the broken cloud base would remain, but rise to 1,212 ft AMSL (1,000 ft AAL).
From 1230, the cloud coverage was forecast to reduce to scattered and the cloud base rise further to 1,712 ft AMSL (1,500 ft AAL), with an overlying broken layer at 2,212 ft AMSL (2,000 ft AAL).
The pilot also contacted the Mount Gambier Airport aerodrome reporting officer. The aerodrome reporting officer advised that the observed cloud ceiling was about 300 feet above the aerodrome level and that a scheduled flight from Adelaide to Mount Gambier had delayed their departure due to the low cloud. The pilot of ODI noted that the forecast indicated conditions would improve, and he elected to delay the departure, until 1100.
At 1109, the flight departed Adelaide Airport. During the flight to Mount Gambier, the pilot prepared for the arrival. He anticipated conducting an area navigation (RNAV) instrument approach to Runway 18 (see the section titled Operation) (Figure 1). The pilot also determined an estimated time for the commencement of the approach of 1157. Air traffic control advised that another aircraft would be commencing an RNAV approach to Runway 18 at Mount Gambier at 1155. The pilot of ODI therefore elected to slow the aircraft to allow the preceding aircraft to conduct their approach.
Figure 1: Mount Gambier Airport overview
Source: Google Earth, annotated by ATSB.
During the flight, the pilot also received a Special Weather Report (SPECI).[3] This observation reported overcast cloud at 512 ft AMSL, below the approach minimum descent altitude (MDA) of 730 ft AMSL. The SPECI also reported visibility greater than 10 km and a southerly wind of 11 kt.
At 1200, ODI commenced the Runway 18 RNAV approach behind the preceding aircraft. As the preceding aircraft continued the approach, the flight crew of that aircraft received an alert indicating the loss of the Global Navigation Satellite System[4] receiver autonomous integrity monitoring (RAIM)[5] and conducted a go-around.
Despite not receiving a similar alert, the pilot of ODI also elected to conduct a go-around. He climbed the aircraft to an altitude of 5,000 feet and proceeded with the missed approach procedure to waypoint[6] MTGNE to commence another approach. The other aircraft then advised that they would hold at waypoint MTGND while ODI conducted another approach.
At 1215, ODI commenced a second approach to Runway 18 from waypoint MTGNE.
During the flight and approaches, the observer contributed to the operation of the aircraft by:
Monitoring the operation of the aircraft (with autopilot engaged) while the pilot briefed the passengers.
Calculating RAIM availability.
Calling out operational checklists.
Providing details of the instrument approach to the pilot, including the upcoming waypoints, tracks between waypoints and descent altitudes.
Communicating to the pilot the details of external radio broadcasts.
Monitoring the approach and calling out excursions from the target altitude.
The approach chart indicated that a normal descent profile should position the aircraft at 980 ft, 2 NM prior to the missed approach point at MTGNM. As the aircraft crossed this point, the pilot announced that the aircraft was ‘too fast by far’ and ‘high’.
On multiple occasions throughout the approach, the pilot questioned and corrected information provided by the observer and educated her on the operation of the flight.
As the aircraft descended to 730ft, the observer announced that they had reached the MDA. Upon reaching the MDA, the pilot could see the ground directly beneath the aircraft, but could not see the runway ahead. He then announced that he would conduct a go-around and retracted the landing gear, without announcing that he had done so. The observer was unaware that the landing gear had been retracted. After the pilot announced the go-around, the engine power level did not increase.
Nine seconds after the landing gear was retracted, the pilot and observer sighted the runway. The pilot then reduced power and selected full flap to continue the approach. He noted that the required approach profile from that position was ‘very steep’.
At that time, the landing gear warning tone activated. As the approach continued, the ground proximity warning system (GPWS) ‘check gear’ aural alert also activated. In response, the pilot incorrectly announced that the landing gear was extended. The approach continued, and 5 seconds later the GPWS alert ‘pull up’ also activated. The observer announced that the ‘pull up’ warning had activated. The pilot acknowledged this call, announced ‘I’ve got it’ and continued the approach. One second later, the ‘pull up’ and ‘check gear’ alerts ceased, but the landing gear warning tone continued (the pilot and observer both later recalled not hearing the landing gear warning tone or GPWS ‘check gear’ alerts).
At 1222, the aircraft briefly touched down on the propellers and bounced (Figure 2). Two seconds later, the propellers again contacted the runway. The pilot, believing the landing gear was down and the aircraft had landed on the runway, twice attempted unsuccessfully to engage reverse thrust.
Figure 2: Left propeller strike marks
Source: Airport operator, annotated by ATSB.
The aircraft continued flying above the runway at low level and began to drift right toward the runway edge. The pilot, believing the aircraft to be rolling on the landing gear and not responding to brake inputs, assessed that it could not be stopped in the remaining runway and elected to conduct a go-around. He then increased engine power and observed good initial response from both engines followed shortly after by failure of the left engine.
The pilot completed the initial engine failure actions and announced ‘gear up, flap up’ and the landing gear warning tone then ceased operating, consistent with flap retraction (see the section titled Aircraft details). Following the flap retraction, the stall warning activated intermittently for 16 seconds.
The pilot shut down and secured the left engine and assessed that the right engine was performing as expected. He then conducted a visual left circuit at an altitude of about 600‑650 ft AMSL, and at 1224 the aircraft landed on Runway 18 and vacated on to Runway 29 where it was shut down (Figure 1).
The observer assisted with passenger disembarkation onto Runway 29 and escorted them clear of the runway. No persons were injured during the accident however, the aircraft was substantially damaged.
The pilot held an Air Transport Pilot Licence (Aeroplane) and a Class 1 aviation medical certificate. He also held pressurisation system, retractable undercarriage and gas turbine engine ratings along with an instrument rating applicable to multi-engine aircraft and instrument approach procedure ratings for both two-dimensional and three-dimensional approaches.
At the time of the accident flight, the pilot had over 14,200 hours of aeronautical experience, of which about 2,460 hours were on the B200.
The investigation found no indicators that increased the risk of the pilot experiencing a level of fatigue known to have affected performance.
Following the accident, the Civil Aviation Safety Authority (CASA) suspended the pilot’s licence.
Observer
The observer held a Commercial Pilot Licence (Aeroplane), an instructor rating and a Class 1 aviation medical certificate.
The observer had not held a flying role for a number of years and was observing the operation to re‑familiarise herself with flying operations. She had acted in that role on the B200 over the preceding 4 months. At the time of the accident flight, the observer had about 440 hours of aeronautical experience, of which none were on the B200.[7]
The pilot commented that the interactions between himself and the observer did not increase his workload, were not distracting, and reinforced his actions.
Operation
The flight was a passenger charter flight from Adelaide to Mount Gambier and had been arranged the previous day. The company typically operated such flights as single-pilot operations, often with an observer, as was the case for the accident flight.
The observer was not a member of the flight crew and her role was not defined in operational documentation. Typically flight crew roles are defined as ‘Pilot Flying’ and ‘Pilot Monitoring.’ The Pilot Flying does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The Pilot Monitoring carries out support duties and monitors the Pilot Flying’s actions and the aircraft’s flight path.
The pilot was also the Chief Pilot and owner of the company; he defined the observer role as purely an observational role with limited participation in the operation of the flight. He did describe the observer taking on some operational support duties such as recording operating parameters and providing instrument approach information to the pilot. The observer understood the role not to include any flying or radio broadcasts, but to observe the operation of the flight, act as a support to the pilot during flight and to assist with ground duties.
There was no evidence that the observer made radio broadcasts or manipulated the flight controls during the accident flight.
Mount Gambier Runway 18 RNAV-Z approach
Runway 18 at Mount Gambier was provisioned with an area navigation (RNAV) straight-in approach. The approach was flown along a path of GNSS waypoints. The passage of each waypoint allowed a pilot to descend in accordance with segment minimum safe altitudes and, after passing the final approach waypoint (MTGNF), descend to the MDA.
The MDA was 730 ft AMSL,[8] which was 518 ft AAL (Figure 3). Upon descending to the MDA, further descent must not be made unless the pilot is able to proceed visually.
Figure 3: Mount Gambier RNAV-Z Runway 18 approach
Source: Airservices Australia, modified by ATSB
The Airservices Australia publication, Aeronautical Information Publication (AIP) section ENR 1.5, paragraph 1.8.2, provided the following requirements to be met to allow descent below an MDA during a straight-in approach:
Descent below the straight-in MDA may only occur when:
visual reference can be maintained;
all elements of the meteorological minima are equal to or greater than those published for the aircraft performance category; and
the aircraft is continuously in a position from which a descent to a landing on the intended runway can be made at a normal rate of descent using normal flight manoeuvres that will allow touchdown to occur within the touchdown zone of the runway of intended landing.
Section ENR 1.5, paragraph 1.10.1 (relevant sections only), further instructed:
A missed approach must be executed if:
c. visual reference is not established at or before reaching the missed approach point from which the missed approach procedure commences; or
d. a landing cannot be effected from a runway approach
Workload
In the context of aviation, workload has been described as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. It represents the cost incurred by the human operator in achieving a particular level of performance’ (Orlady & Orlady, 1999). A person experiences workload differently, based on their individual capabilities and the local conditions at the time.
Research on unexpected changes in workload during flight has found that pilots who encounter abnormal or emergency situations experience a higher workload with an increase in the number of errors compared to pilots who do not experience these situations (Johannsen & Rouse, 1983). Additionally, Harris (2011) states that:
‘The underlying concept is that cognitive workload is a product of competition for limited information processing resources.' Wickens and others (2016) add that when workload becomes excessive, ‘people may shed tasks in a non-optimal fashion, abandoning those that should be performed.’
In particular, the task of monitoring the state of important items in the cockpit can be one of the tasks shed by a single pilot. The United Kingdom Civil Aviation Authority publication Monitoring Matters provides the following information regarding monitoring:
…whilst you are ahead of the game, concentrating on the next event, keeping an eye on all the flight parameters, system modes etc everything runs fairly smoothly. But as soon as something draws your attention away and you become out of the loop it becomes difficult to play catch up.
While it is possible to attend to more than one task using selective attention techniques, there is a limit to cognitive capacity. If tasks consume this capacity, task shedding will occur. This publication further advises that under high workload, especially during approach and descent, attention capacity diminishes. This includes the ability to detect when the configuration of the aircraft is not correct, even when there is an aural or visual alert, particularly in the case in single pilot operations as:
…the processes and procedures will be equivalent to multi crew operation except there will only be one person in the cockpit and the systems may be less automated. Hence the need to monitor the flight profile, flight instruments, fuel state, engines, radio, etc. diligently. The instrument scan must be carried out very frequently, especially during departure and approach in order to monitor the aircraft state and planned profile.
Aircraft details
The Beech 200 is a pressurised, twin-engine turboprop aircraft with retractable landing gear and was approved for single-pilot operation. VH-ODI was manufactured in 1980 and was configured with two flight deck and 11 passenger cabin seats (Figure 4). One of the flight deck seats was also available for passenger use.
Figure 4: VH-ODI
Source: Mike Didsbury, modified by ATSB
Operational warning systems
The aircraft was fitted with a landing gear warning system. This system is designed to help prevent a pilot from landing with the landing gear retracted. The system in ODI was designed to activate when the flaps were selected to the ‘full’ position and the landing gear was not down and locked. When activated, the system emitted a warning tone through the flight deck speaker and illuminated red lights within the landing gear position selector handle (Figure 5).
Figure 5: Exemplar landing gear control lever and warning light extinguished (left) and illuminated (right) (see note)
Source: Aircraft maintainer
Note: the image is only intended to illustrate the handle warning light. It is not intended to represent the landing gear configuration at the time of the occurrence.
The aircraft was also equipped with a ground proximity and warning system (GPWS). This system was designed to alert a pilot if an unsafe aircraft terrain closure rate or aircraft configuration was detected. When activated, the system emitted aural spoken word alerts through the pilot and observer’s headsets.
The aircraft was fitted with a stall warning system to provide the pilot with aural warning of an imminent aerodynamic stall. The stall warning system senses angle of attack through a lift transducer actuated by a vane mounted on the leading edge of the left wing. Depending on aircraft configuration and flight condition, the stall warning system will activate between 5‑14 kt prior to a stall occurring.
Damage
The aircraft sustained damage to both propellers, the left engine and the fuselage (Figure 6). The damage resulted in fragments of the left propeller penetrating the left side of the fuselage and a significant oil leak from the left propeller shaft (Figure 7). The damage to the left engine led to the failure of that engine upon the application of power for the go-around.
Figure 6: Forward fuselage damage
Source: Airport operator.
The right propeller sustained less severe damage. The pilot and observer did not detect any deterioration in performance from the right engine and were not aware of the damage to this propeller until after landing.
Figure 7: Propeller and engine damage
Source: Airport operator.
Recorded data
Cockpit voice recorder
The aircraft was equipped with a Fairchild Model A100S cockpit voice recorder (CVR). The recorder captured the final 22 minutes of the flight. The aircraft was not required to be, and was not, fitted with a flight data recorder.
Table 1 is a list of key events captured by the CVR during the accident flight. Events marked with inverted commas (‘’) are automated voice alerts from the ground proximity warning system.
Table 1: Cockpit voice recorder key events
Time
Event
1215:19
Commencement of accident approach
1218:55
Pilot announces commencement of approach descent
1218:59
Sound of landing gear extension
1221:18
Observer announces that the minimum descent altitude has been reached
1221:27
The pilot announces that a go-around will be conducted
1221:31
Sound of landing gear retraction
1221:34
GPWS alert - ‘check gear, check gear, check gear’
1221:40
Both the pilot and observer announce that the runway is in sight
1221:40
Engine power reduces
1221:40 – 1222:17
Landing gear warning tone commences and activates continuously for this period
1221:49
GPWS alert - ‘check gear, check gear, check gear’
1221:50
The pilot announces that the landing gear is down
1221:50
GPWS alert - ‘pull up, pull up’
1222:03
Sound of first propeller contact
1222:05
Sound of second propeller contact
1222:10
Observer announces that an engine has failed
1222:14
Pilot announces landing gear and flap retraction. (No landing gear retraction sound is audible.)
1222:17
Landing gear warning tone ceases activating
1222:19 – 1222:35
Stall warning activates intermittently during this period
1224:05
Sound of landing gear extension
1224:34
Sound of touch-down
Security camera footage
A Mount Gambier Airport security camera overlooking the apron area of the airport captured ODI during the occurrence approach and the subsequent landing approach (Figure 8).
The magnification of the footage led to a reduction in image quality. However, the footage showed the landing gear as dark objects beneath the aircraft during the landing approach. The dark objects were absent in the footage of the occurrence approach, consistent with the retracted landing gear.
Figure 8: Mount Gambier Airport CCTV captures of ODI and representative images of a B200
On 4 July 2016, a Piper PA31-325 aircraft, registered VH-ETW, arrived at Birdsville Airport, Queensland. At the end of the downwind leg of the circuit, the pilot selected the landing gear handle down and noted that the landing gear selector moved out more easily than normal. During the turn onto the base leg, the pilot felt something against his right knee and found that the landing gear selector handle had become partially detached. The pilot inserted the handle back into the landing gear selector lever and retracted and extended the landing gear to ensure that it operated correctly. The landing gear subsequently retracted without the pilot’s knowledge.
The aircraft touched down with the landing gear retracted and the pilot assessed that the safest option was to conduct a go-around. The pilot then conducted a circuit and landed without further incident. The pilot and passengers were uninjured and the aircraft had minor damage to the propellers.
During an approach to Runway 18 at Mount Gambier in poor weather conditions, the aircraft touched down with the landing gear retracted, with the propellers contacting the runway twice before the pilot initiated a go‑around. The following analysis will consider the development of the occurrence and the subsequent decision to conduct a go‑around.
Continued approach and non-detection of retracted landing gear
Upon reaching the minimum descent altitude, the pilot could see ground directly below the aircraft, but could not obtain visual reference with the runway ahead. Therefore, he appropriately elected to conduct a go-around and retracted the landing gear. However, prior to beginning to climb the aircraft, the pilot sighted the runway and elected to continue the approach, but inadvertently did not re-extend the landing gear.
In response to the landing gear configuration, a number of automated aural and visual alerts activated. However, neither the pilot nor observer recognised that the landing gear was retracted.
It has been well-demonstrated that people are more likely to detect targets when they are expected and less likely to detect targets when they are not (Wickens & McCarley, 2008). This lack of detection occurs even when targets are salient, important and in an area to which a person is looking (known as inattentional blindness) (Chabris & Simon 2010).
When considering expectancy, a range of conditions may have influenced the pilot not detecting that the landing gear remained retracted (despite the automated alerts), including:
He retracted the landing gear during a time of high task loading associated with obtaining visual reference with the runway environment, which may have precluded the recollection that it was actually retracted.
The pilot was likely highly focussed on the landing at the time.
Errors of omission are often difficult to detect by the people who make them (Sarter & Alexander 2000).
In summary, the pilot’s ability to detect the retracted landing gear was likely reduced by his expectation that it was extended. In addition, he retracted the landing gear during a high task loading time which could have precluded the recollection that this was its latest state. This, combined with the high task loading during the continued approach in a complex aircraft, possibly meant that the task of confirming the configuration of the aircraft was shed.
Although the observer was also a pilot, she did not have the defined responsibility of monitoring the operation of the aircraft and was not assigned a ‘pilot monitoring’ role as is the norm in a formal multi-crew operation. In addition, the pilot did not announce that the landing gear had been retracted, further reducing her ability to detect the landing gear position.
She later recalled not hearing the landing gear-related aural alerts, although the cockpit voice recorder captured that she did emphasise to the pilot the ‘pull up’ EGPWS alerts. However, when these alerts were emphasised, the pilot announced that he would continue the approach. Therefore, a similar call regarding the landing gear may also have gone unheeded, as evidenced by the pilot’s reaction to the GPWS ‘check gear’ alert.
Go-around after the wheels-up landing
Prior to the wheels-up landing, the pilot understood the landing gear to be extended and stated so in response to the GPWS ‘check gear’ alert. This misperception of the landing gear position persisted through the two touch-downs and go-around.
The pilot, believing that the aircraft had bounced twice on the landing gear, that it was not responding to wheel brake inputs and that he could not engage reverse thrust, assessed that a runway overrun was imminent. This indicated that he was also very likely unaware of the substantial airframe damage sustained and why he assessed a low‑level go-around clear of cloud as the safest option.
Findings
From the evidence available, the following findings are made with respect to the wheels-up landing involving Beech Aircraft Corporation B200, VH-ODI that occurred at Mount Gambier Airport, South Australia on 8 December 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The pilot elected to continue the approach after initially deciding to conduct a go-around. The pilot's expectation of the landing gear position, possibly coupled with the effects of the now increased workload, probably led to him not detecting the retracted landing gear before the aircraft contacted the runway.
Other findings
After the wheels-up landing, the decision to conduct a go-around resulted from the pilot’s misunderstanding of the situation and assessment that a runway overrun was imminent.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Chabris & Simons, 2010. The invisible gorilla. Random House: New York, USA
Johannsen, G & Rouse, WB, 1983. Studies of planning behaviour of aircraft pilots in normal, abnormal, and emergency situations. IEEE Transactions on Systems, Man and Cybernetics, (3).
Orlady, HW, & Orlady, LM, 1999. Human factors in multi-crew flight operations. Ashgate: Aldershot, UK.
Wickens and others, 2016. Engineering Psychology and Human Performance. Psychology Press: New York, USA.
Harris D, 2011. Human Performance on the flight deck. Ashgate: Aldershot, UK.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the pilot’s next of kin,[9] the observer and the Civil Aviation Safety Authority (CASA).
Submissions were received from the pilot’s next of kin and CASA. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Single Engine Aircraft, Multi Engine Aircraft, DC3, Instrument Rating Multi Engine Aircraft, Instrument Approach Procedure 3D, Instrument Approach Procedure 2D
Medical certificate:
Class 1, valid to March 2019
Aeronautical experience:
Approximately 14,200 hours
Last flight review:
November 2018
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 8 December 2018, the pilot of a Pilatus Britten-Norman BN2A-20 Islander, registered VH‑OBL and operated by Airlines of Tasmania, was conducting a positioning flight from Cambridge Airport to Bathurst Harbour, Tasmania, under the visual flight rules. The aircraft departed Cambridge and was scheduled to arrive at Bathurst Harbour about 45 minutes later to pick up five passengers for the return flight. The aircraft did not arrive and the Australian Maritime Safety Authority received advice that an emergency locator transmitter allocated to VH-OBL had activated. That evening, the wreckage was located near the Western Arthur Range in the Southwest National Park. The pilot was fatally injured and the aircraft was destroyed.
What the ATSB found
The ATSB found that the pilot was using a route through the Arthur Range due to low cloud conditions and had continued over a saddle in the range at a lower altitude than previous flights. During this, the pilot likely encountered reduced visual cues, as per the forecast conditions. This led to controlled flight into terrain while attempting to exit the range.
Specific guidance provided by Airlines of Tasmania to their pilots for the Bathurst Harbour operations was primarily given verbally and was not well documented. This resulted in the pilots having varied understanding of the expectations regarding in-flight weather-related decision-making at the Arthur Range saddle.
Although not contributory, the ATSB identified that Airlines of Tasmania’s safety management processes for identifying hazards extensively relied on safety occurrence reports. This limited the opportunity to proactively identify the risks in all operational activities and assess the effectiveness of any controls in place.
Further, and also not contributory, the Civil Aviation Safety Authority did not conduct any formal surveillance activities relating specifically to the operator’s safety management system, despite having repeat safety findings system and hazard identification in the year prior to the accident. However, it was noted that there were ongoing communications with the operator throughout this time. In addition, it was identified that the Civil Aviation Safety Authority’s processes for acquitting repeat safety findings were not effective in ensuring that earlier findings were appropriately assessed prior to the current findings being acquitted.
What has been done as a result
In January 2020, the operator introduced specific guidance for the south‑west operations, which introduced visibility requirements for pilot’s using the direct route through the Arthur Range saddle. Additionally, further information and guidance has been added to the training syllabus, and the safety management system around weather assessment criteria and seeking further guidance when required. The operator has also implemented a number of changes to make the safety management system more proactively assess risks from sources other than safety reports.
Safety message
This accident highlights the hazards associated with flying in mountainous terrain, the challenges of in-flight weather-related decision‑making and the importance of maintaining an escape route. Further, it demonstrates the importance of using multiple sources to identify the hazards potentially affecting the safety of an organisation, rather than relying on one key source. Such sources include safety occurrence reports, inspections, audits, flight data, and expert judgment. Likewise, it is equally important to monitor and evaluate the ongoing effectiveness of existing risk controls to ensure that they remain appropriate.
The occurrence
On 8 December 2018, the pilot of a Pilatus Britten-Norman BN2A-20 Islander, registered VH‑OBL and operated by Airlines of Tasmania, was conducting a positioning flight under the visual flight rules[1] from Cambridge Airport to the Bathurst Harbour aeroplane landing area (ALA), Tasmania. The aircraft departed Cambridge at about 0748 Eastern Daylight‑saving Time[2] and was scheduled to arrive at Bathurst Harbour about 0830 to pick up five passengers for the return flight. The passengers were part of a conservation project that flew to south‑west Tasmania regularly, and it was the pilot’s only flight for that day.
Automatic dependent surveillance broadcast (ADS-B) [3] position and altitude data (refer to the section titled Recorded information) showed the aircraft tracked to the south-west towards Bathurst Harbour (Figure 1). At about 0816, the aircraft approached a gap in the Arthur Range known as ‘the portals’. The portals are a saddle (lowest area) between the Eastern and Western Arthur Range, and was an optional route that Airlines of Tasmania used between Cambridge and Bathurst Harbour when the cloud base prevented flight over the mountain range. After passing through the portals, the aircraft proceeded to conduct a number of turns below the height of the surrounding highest terrain. The final data point recorded was at about 0828.
Figure 1: Track of VH-OBL from Cambridge Airport towards Bathurst Harbour, showing the accident location
Source: Google earth and Aireon, modified by the ATSB
At about 0829, the Australian Maritime Safety Authority received advice that an emergency locator transmitter allocated to VH-OBL had activated. They subsequently advised the Tasmanian Police and the aircraft operator of the activation, and initiated search and rescue efforts. The rescue efforts included two helicopters and a Challenger 604 search and rescue jet aircraft. The Challenger arrived over the emergency locator transmitter signal location at around 0925, however, due to cloud cover the crew were unable to visually identify the precise location of VH‑OBL. A police rescue helicopter arrived at the search area at about 1030. The pilot of that helicopter reported observing cloud covering the eastern side of the Western Arthur Range, and described a wall of cloud with its base sitting on the bottom of the west portal.
Multiple attempts were made throughout the day to locate the accident site, however, due to low‑level cloud, and fluctuating weather conditions, the search and rescue operation was unable to confirm visual location of the aircraft until about 1900. The aircraft wreckage was found in mountainous terrain of the Western Arthur Range in the Southwest National Park (Figure 2) . The search and rescue crew assessed that the accident was unlikely to have been survivable.
The helicopter crew considered winching personnel to the site, however, due to a number of risks, including potential for cloud reforming, the time of day and lighting, and other hazards associated with the mountainous location, the helicopter departed the area. The aircraft wreckage was accessed the following day, when it was confirmed that the pilot was fatally injured.
Figure 2: Accident location of VH-OBL in the Western Arthur Range
The pilot held a valid Commercial Pilot Licence (Aeroplane) that was issued on 29 May 2017. The licence included the following ratings and endorsements:
single-engine and multi-engine aeroplane class ratings
low-level rating
manual propeller pitch control and retractable undercarriage design feature endorsements.
The pilot had also completed a multi-engine instrument rating on 14 November 2017, however, it was not current at the time of the accident.
The pilot’s logbook, combined with the operator’s records, showed a total flying experience of 540.9 hours to the last recorded flight on 7 December 2018. The pilot’s total flying experience on the Pilatus Britten-Norman BN2A-20 Islander (Islander) aircraft was 80.4 hours. In the previous 90 and 30 days, the pilot had flown 65.5 hours and 26.5 hours respectively on this aircraft.
Training
The pilot underwent training at the Airlines of Tasmania flight school, and upon completion, started working for the operator in the office and then transitioned to flight duties. The records indicated that the pilot:
started in-command under supervision (ICUS) training on the single-engine Cessna 206 on 2 October 2017 and conducted 22.8 hours before commencing solo commercial flights
completed ground-based training for the Islander on 26 April 2018 and commenced flight training, which included 1.5 hours with an instructor and 13.4 hours ICUS before a line check on 26 September 2018
completed the first solo commercial flight to Bathurst Harbour in the Islander on 27 September 2018.
Bathurst Harbour flight experience
The chief pilot stated that the accident pilot was experienced on the route from Cambridge to Bathurst Harbour and had flown it five times in the previous 7 days. It was also reported by the operator that the pilot had completed about 180 return flights on that route in the current and previous seasons.[4]
Observations of the pilot’s decision making
The accident pilot was described by the chief pilot and other Airlines of Tasmania pilots as being competent and conscientious. The pilot was reported to be a high achiever who liked a challenge and was considered a good decision maker. It was also mentioned several times that the pilot had demonstrated a willingness to turn back when weather conditions were unfavourable.
72-hour history
The pilot was reported to normally wake at around 0600 and go to bed around 2130 most nights. Table 1 summarises the pilot’s flight and duty times in the preceding days. The accident occurred on the pilot’s fifth day of the duty period.
Table 1: Summary of pilot’s duty and flight times
Date
5 December 2018
6 December 2018
7 December 2018
Duty time
1100 – 1500 (4 hours)
0700 – 1730 (10.5 hours)
0600 – 1000 (4 hours)
Flight time
1.6 hours
3.9 hours
1.6 hours
The 1.6-hour flight time on 7 December was a return flight to Bathurst Harbour conducted by the pilot in a Cessna 206. On the morning of the accident, the flight to Bathurst Harbour was the only one scheduled for the pilot that day, as it was reported they had requested the afternoon off to attend a social engagement.
The pilot’s specific personal routine in the 3 days prior to the accident was largely unknown. However, a flatmate reported that, on the night prior to the accident, the pilot went to bed at their usual time of around 2130. One of the company pilots reported receiving the last text from the pilot at about 2000. On the morning of the accident flight, the flatmate reported hearing the pilot in the kitchen at about 0600. Although an entire sleep and wake history was not available, there were no indications to suggest that the pilot was experiencing a level of fatigue known to have an effect on performance.
Aircraft information
General
VH-OBL was a Pilatus Britten-Norman BN2A-20, twin-engine piston-powered aircraft with constant speed variable pitch propellers and a fixed landing gear system. The aircraft was manufactured in 1986 and first registered in Australia on 4 July 1995.
The aircraft’s current maintenance release was issued on 17 August 2018 at a total time‑in‑service of 12,344.8 flight hours. The most recent maintenance, a scheduled 50-hourly service, was carried out on 6 November 2018. The aircraft was approved for operation under both the instrument and visual flight rules during the day and night.
At the time of the accident, the aircraft had accumulated a total of about 12,428 flight hours. From the evidence available, no outstanding defects were identified in the maintenance documentation.
Garmin GNS 430 global positioning system
The aircraft was fitted with a Garmin GNS 430 global positioning system (GPS) that incorporated a non‑certified terrain awareness and warning system to increase pilot situational awareness. The operator’s guidance on the use of this system specifically stated that ‘This particular system is an aid only to help assist in the prevention of controlled flight into terrain [CFIT]’. The operator advised that this statement was predominantly applicable when performing flights under instrument flight rules.
The system’s main pages were divided into four separate page groups (navigation, waypoint, auxiliary and nearest), with each page group having a number of sub‑pages. The navigation page included a terrain sub-page,[5] which had two selectable display settings; a 360° view of the aircraft from above depicting the surrounding terrain on all sides, and a 120° degree view of the terrain ahead of, and 60° either side of, the aircraft (Figure 3 top). The terrain page display included the following:
the aircraft’s GPS-derived mean sea level altitude and range marking rings
aircraft ground track and heading indicator
terrain range, indicating the terrain elevation in colours relative to the aircraft’s altitude:
black: the terrain/obstacle was more than 1,000 ft below
yellow: the terrain/obstacle was between 100 ft and 1,000 ft below
red: the terrain/obstacle was above or within 100 ft below
range marking rings for various distances
obstacles and potential impact points.
Terrain alerts were issued to the pilot when the flight conditions met the parameters set within the system. When the terrain page was selected, a visual annunciation would appear in the left corner of the display. The alerts were either advisory, displayed as constant black text on a yellow background, or cautionary with flashing black text on a yellow background. However, if the terrain page was not selected, a pop-up alert would appear, which required the pilot to action (Figure 3 bottom).
Figure 3: GNS430 alert functions in 360° (left) and 120° (right) views above; alert types below
Source: Garmin, annotated by the ATSB
The forward looking terrain avoidance alert would be issued when the aircraft was above the terrain but projected to come within a certain distance of the terrain/obstacle, or when the aircraft was below the elevation of the terrain/obstacle in the aircraft’s projected flight path.
A number of company pilots reported that they would often select the terrain inhibit mode, which would deactivate the forward looking terrain avoidance alert, as the flights to the south-west were under visual flight rules. They also reported that, if the terrain mode was selected, they would often receive alerts as the aircraft approached the higher ground near Bathurst Harbour , which would make the navigation page disappear, and could potentially be disconcerting to the passengers.
From the evidence available, the ATSB was unable to determine if the pilot was using the GPS during the flight, or if they were, what page was selected or if the terrain alerts were inhibited. If the terrain page was displayed, depending on the range selected, the majority of the display would have been yellow, as the aircraft was generally tracking between 300-700 ft above ground level. Patches of red would also have been visible at various points. It should be noted however, that for at least the last 2 minutes of the flight, the aircraft was manoeuvred within 700 ft of multiple areas of terrain higher than the aircraft’s altitude. If the GPS was on, this would have resulted in terrain alerts throughout this section of the flight.
Meteorological information
Bureau of Meteorology
Forecasts
A Bureau of Meteorology (BoM) graphical area forecast was issued at 0342 and was valid for the period 0400 to 1000, encompassing the accident flight. The forecast was applicable for all of Tasmania. The BoM reported that the forecast included mist (visibility reduced to 2,000 m) and broken[6] stratus cloud with a base of 200 ft above mean sea level (AMSL) for areas within 20 NM (37 km) of the coast (encompassing the Bathurst Harbour ALA),[7] associated with the low‑level moist onshore flow. The forecast also included areas of scattered light rain (visibility reduced to 7,000 m) throughout the entire area from a layer of broken altocumulus/altostratus cloud at 9,000 ft, and scattered stratus cloud between 500 ft and 1,000 ft. The forecast indicated that severe turbulence below 8,000 ft and widespread sea fog was expected.
The subsequent graphical area forecast issued at 0348 and valid from 1000 to 1600 was divided into two regions and showed a deterioration in the conditions in the south-west. Broken cumulus and stratocumulus cloud was between 2,000 ft and 8,000 ft, and visibility reduced to 7,000 m in scattered light rain.
The search and rescue helicopter pilot advised that the forecast on the day:
…was quite unusual (I have not seen one like it to date) which had broad brushed the entire state. This made me wonder if there was a technological issue behind it…
As a result, the pilot contacted the BoM who advised that the:
forecast for the South West region was poor, as the weather would be pushing inland from the south west and there was a high probability of low cloud but they could not quantify an accurate cloud base.
The closest aerodrome forecasts[8] (TAF) were available at Strahan (about 145 km north-west of the accident site) and Hobart (about 100 km east-north-east of the accident site).
The TAF for Hobart, issued at 0405, indicated 8 kt winds from the west and CAVOK [9] conditions, with a 30 per cent probability of deteriorations of less than 30 minutes due to thunderstorms and rain until 0900. From this time, the TAF indicated a change to the prevailing weather conditions, with a reduction in visibility, and increasing rain and cloud.
The Strahan TAF was issued at 1737 (the day before the accident) and indicated that the conditions were deteriorating at 0300 the next day. The cloud base was broken stratus cloud with a base at 500 ft. It was subsequently updated at 0005 showing a deterioration at 0400, with broken stratus cloud with a base of 200 ft. A special report of the meteorological conditions at Strahan, issued at 0800 and 0830 on 8 December 2018, indicated that there was overcast cloud at 1,300 ft above ground level (AGL). At 0900, the cloud had deteriorated to include broken cloud at 600 ft.
Analysis of the conditions
There were no recorded observations of the conditions at the location of the accident. The BoM provided the following analysis based on satellite imagery, forecasts, and observations. Specifically, they noted that:
On the night of 7 December 2018, Tasmania was under a very moist north-easterly airstream, with dew point temperatures in excess of sea surface temperature thus sea fog, coastal mist and very low cloud were expected to develop around the coastal areas of Tasmania. A surface trough moving over the southwest in the morning of 8 December 2018 was expected to extend low cloud over southern Tasmania during the morning.
The satellite images showed that there was an ‘extensive layer of middle and high cloud associated with the passage of the trough’. Similarly, high-resolution images also indicated the presence of low-level cloud in the area, including the accident location (Figure 4).
Figure 4: Visible satellite image at 0800 showing the approximate accident location
Source: Bureau of Meteorology, annotated by the ATSB
The aerological diagram from Hobart indicated ‘a likelihood that cloud would form via orographic ascent[10] on the windward side of ranges’. Likewise, the relative humidity at other nearby locations was also high during the morning.
The nearest cloud and visibility observation sites to the accident location were at Hobart (100 km to the north-east) and Strahan Airports. However, Strahan Airport was considered to be more representative of the onshore flow at the accident site in the wake of the trough. Between 0345 and 0840, the cloud base at Strahan was between 1,000 ft and 2,000 ft. After this time, the cloud base lowered to below 1,000 ft, before gradually lifting later in the day. In addition, there were several instances where the visibility reduced to below 5,000 m during the night and morning, likely associated with areas of mist.
In summary, the BoM concluded that:
Conditions on the morning of 8 December 2018 were characterised by coastal sea fog and mist, low orographic cloud developing and the passage of a mid-level cloud band with light rain and virga.[11]
The relevant forecasts were consistent with the weather conditions in the area of the incident.
Weather observations
Early in the accident flight, the pilot took a photograph as the aircraft passed near Huonville (about 40 NM (74 km) south-west of Cambridge Airport) and sent this to a colleague. Another company pilot viewed the photograph and reported that there was a ‘little bit of low-lying stratus cloud around, but it was blue skies’ (Figure 5).
Figure 5: Photograph captured by the pilot as the aircraft passed near Huonville
Source: Supplied
After being notified that one of their aircraft was missing, a helicopter pilot from Airlines of Tasmania flew to the site about 1.5-2 hours after the accident. The pilot reported that, on departure from Cambridge, it was looking like a nice day. However, when they arrived at the Arthur Range, the cloud base was initially down to the tree tops (Figure 6) at the portals and there was nil wind. The pilot reported that, it looked like there was light coming through the cloud and they tried to pass through the portals. However, they only got part way through before they encountered a ‘wall of cloud’ and had to turn back (Figure 6). The pilot spent over an hour trying to find a different way to enter the area where the emergency locator transmitter signal was detected, however, in each direction they were stopped by low cloud.
Figure 6: Photograph taken from the company helicopter in the vicinity of the accident location at about 1100
Source: Supplied
Similarly, the search and rescue helicopter pilot advised that, when they arrived on-site near the accident area at 1030, they:
…observed cloud (orographic in nature) engulfing the Eastern side of the Western Arthurs (a wall of cloud with its base sitting on the bottom of the West Portal). The saddle between the West and East Portal (Eastern Arthur Range) is a low point between the Ranges and sits approximately 1500 feet (above mean sea level). The saddle was not visible on our approach.
They also reported that the cloud base continued to fluctuate all afternoon, but was never high enough to locate the aircraft until that evening.
A passenger who was familiar with the local area, having conducted in excess of 100 flights with the operator, was waiting at Bathurst Harbour for the return flight. They stated that the weather in the morning was overcast, with the occasional blue patch, showers passing to the south, and nil wind. There was cloud to the east of their location, which was reported to be ‘right down in the valleys at the north and east’. The passenger reported that it was not unusual for the aircraft not to turn up as a result of weather, and given the ‘marginal’ conditions that morning, they did not necessarily anticipate the flight to go ahead. However, if it had, they would have expected the aircraft to arrive from the coastal direction.
Accessing meteorological information
The operator’s aircraft operations manual stated that the National Aeronautical Information Processing System[12] (NAIPS) was to be the only source for weather forecasting and reports used to make operational decisions. Pilots were also ‘encouraged to use other forms of weather information, including alternate weather modelling services and weather camera observations to aid interpretation of authorised weather information’.
It was reported that the company pilots would normally print the meteorological aerodrome report[13] (METAR) and TAF for Hobart Airport and graphical area forecast and would generally check the weather information at Maatsuyker Island[14] . The pilots also routinely accessed the web cameras at Bathurst Harbour to check the conditions at the destination as well as checking the online application ‘Windy’.[15]
The operator advised that the pilot had logged into the NAIPS between 0705 and 0710 on the morning of the accident to submit the flight plan. While it could not be confirmed, it was considered likely that the pilot would have also accessed the relevant weather information at that time.
Bathurst Harbour web cameras
Bathurst Harbour ALA was equipped with web cameras, which were owned and operated by Airlines of Tasmania. There were normally four cameras oriented in different directions, however, on the day of the accident, only two were operational as a result of exposure to severe weather conditions. While neither of the operational cameras were directed towards the north-east, and even if they were, they did not provide a view of the Arthur Range due to several mountains in between Bathurst Harbour and the range. As a result, there were no images available showing the aircraft’s expected approach from the north‑east after passing through the portals, or images of the weather in that direction.
The cameras were able to be accessed by the company pilots prior to departing Cambridge, to obtain an indication of the actual weather conditions at Bathurst Harbour. The flight planning computer used by the pilots was reviewed to determine if the accident pilot had accessed the web camera, however, there was no information available. It was also possible that the pilot may have accessed it from a mobile phone or tablet, which was the normal practice of many company pilots. Therefore, it was not known if the accident pilot had accessed the cameras prior to departing Cambridge.
Following the accident, the chief pilot accessed the cameras and recorded a number of images. The images during the earlier part of the day were not saved by the camera. Figure 7 was taken from the south facing camera at 1020 on 8 December 2018, looking out toward the landing area.
Figure 7: Web camera image from Bathurst Harbour
Source: Airlines of Tasmania
Requirements for visual flight rules
Visual meteorological conditions are the minimum conditions in which a VFR flight is permitted. These conditions ensure pilots have sufficient visibility to control the aircraft and maintain visual separation from terrain and other aircraft.
The Aeronautical Information Publication, En Route, section 1.2 Visual Flight Rules required that pilots operating under the VFR below 10,000 ft AMSL have a minimum of 5,000 m flight visibility, and 1,500 m horizontal and 1,000 ft vertical separation from cloud in non‑controlled airspace. However, when operating at or below 3,000 ft AMSL or 1,000 ft AGL (whichever is the higher), the pilot must have a minimum of 5,000 m flight visibility and be clear of cloud and in sight of the ground or water.
Recorded information
The aircraft was not fitted with a cockpit voice recorder or flight data recorder, nor was it required to be. Airlines of Tasmania used Spidertracks[16] to monitor aircraft operations, which recorded an aircraft’s position every 2 minutes. As a result, this data provided a general aircraft track, however, it did not provide high fidelity information about the accident flight.
The aircraft was fitted with a Mode S transponder that broadcast automatic dependent surveillance broadcast (ADS-B) data. The ADS-B information included the position and altitude of the aircraft and was received by Airservices Australia. However, due to the lack of ground receivers in the south-west of Tasmania, the Airservices ADS-B coverage in that area was limited. Instead, the ATSB was able to contact a third-party ADS-B provider, Aireon, who provided satellite-based tracking data, including coverage of the accident location, as well as publicly available ADS-B data (Flight Aware).
The ADS-B data recorded data points at a higher frequency[17] than that recorded by Spidertracks. Analysis of that data showed that (Figure 8):
The aircraft approached the portals at about 0816 and 2,100 ft AMSL (1,400 AGL). This meant the aircraft was below the height of the east and west portal on either side of the saddle (3,100 ft and 3,800 ft AMSL respectively).
The aircraft’s altitude continued to decrease as it passed through the portals (from about 0816:30), despite the rising terrain at the saddle. At times, the aircraft came within about 500 ft of the terrain.
At about 0818, after the aircraft passed through the portals, the pilot made a controlled left turn and continued down the valley in a south-easterly direction.
Shortly after, at about 0819 (3 minutes after passing through the portals), the pilot initiated a controlled 180° left turn. The aircraft then continued to track north-west back along the valley.
At about 0824, the pilot initiated a second controlled left turn, after which the aircraft tracked in a south-easterly direction along the valley.
At about 0827 and 12 minutes after the aircraft had entered through the portals, the pilot made a turn to realign with the saddle and proceeded to track toward the portals.
At 0828:08, the data showed the aircraft was at 1,875 ft AMSL (about 350 ft AGL).
The next recorded data point was 08:28:13, and the aircraft was on a slight climb, and had initiated a turn to the left.
The next data point following this was 16 seconds later, at 08:28:29, and in that time the aircraft had climbed 380 ft (to about 730 ft AGL). Due to the longer time between the data points, the exact flight path was unable to be determined. However, when considering the ground speed of the aircraft and distance travelled, it was unlikely to have deviated substantially from the apparent course.[18]
At 0828:29, the aircraft was observed turning toward the ridge of the Western Arthur Range. Over the next 7 seconds, the aircraft climbed about 50 ft at an approximate ground speed of 90 kt.
In the final 5 seconds of the recording, the aircraft was climbed from 2,425 ft to 2,550 ft AMSL (a climb rate of about 1,500 ft/min) at a ground speed of about 90 kt. The recording stopped at 0828:41.
Figure 8: Aircraft track within the valley (yellow track) and height above ground level (lower graph)
Note: The yellow line on the Google earth images shows the track of the accident flight. The lower graph shows the aircraft’s altitude (green) compared with the elevation of the terrain (red), with the approximate location of the portals shaded blue.
Source: Google earth, Aireon and GeoScience Australia, annotated by the ATSB
Wreckage and impact information
The aircraft wreckage was located on the south-eastern side of the west portal at an elevation of about 855 m (2,805 ft AMSL) (Figure 9). This was about 50 m below the ridgeline. The site was described as steep terrain, almost vertical in nature, and in a densely forested area.
Review of evidence provided by Tasmania Police
Due to the remote location, access difficulties, and other risks associated with the mountainous location of the wreckage, the ATSB did not attend the accident site. Tasmania Police first accessed the site by winching officers from a helicopter at about 1100 on 9 December 2018. At that time, they photographed the site and collected several items from the aircraft. They returned on 22 December 2018 to collect additional information related to the aircraft and engine components, and to perform further examination of the wreckage. All evidence collected by Tasmania Police was provided to the ATSB.
The ATSB’s review of the accident site photographs and statements by Tasmania Police officers, indicated that the aircraft impacted the terrain while heading in a westerly direction. The location of the wings in the photographs and the narrow line of fire damage indicated that the aircraft impacted the terrain in a relatively steep, left angle of bank. The aircraft was destroyed by the impact and a post-impact fuel-fed fire.
The empennage (tail) section of the aircraft was detached from the main wreckage and came to rest inverted, but appeared mostly intact and not affected by the post-impact fire.
Figure 9: Accident site
Source: Tasmania Police, annotated by the ATSB
Wreckage examination
The wreckage was removed from the accident site on 26 February 2019 and re-located to the National Parks and Wildlife depot at Lake Pedder. The ATSB inspected the wreckage on 8‑10 March 2019. During the 3-month period between the accident and the ATSB’s examination, the wreckage was subjected to the elements with no preservation. This, combined with the post‑impact fire, severely degraded the available evidence as fracture surfaces and components were corroded.
Major components recovered from the site included the left and right engines and propellers, the empennage, about two-thirds of the left wing, the forward section of the fuselage, and a large number of small sections of the aircraft and various components (Figure 10).
Figure 10: Recovered wreckage
Source: ATSB
The following observations were made from the wreckage examination:
The left wing was mostly intact from the wing root to outboard of the flaps. Some continuity of the flap and aileron system was identified.
The right wing was severely fragmented and subjected to post-impact fire.
The fuselage from the aircraft nose, including the cockpit and cabin to the wing box section was severely and uniformly compressed.
The empennage section was relatively intact, and some continuity of the elevator, trim tabs and rudder was established.
The position and movement of the flight controls could not be established.
Overall, continuity of the flight controls in their entirety could not be determined due to the severe disruption and post-impact fire.
From the examination conducted on the wreckage, there were no pre-existing faults identified that may have contributed to the accident. However, a significant portion of the wreckage was fragmented or consumed by post-impact fire.
Medical and pathological information
The pilot had a Class 1 Aviation Medical Certificate issued on 11 February 2018 and valid to 26 February 2019. There were no restrictions indicated on the medical and no indications of any medical issues in the pilot’s aviation medical records. In addition, a number of people described the pilot as having a high level of health and fitness.
Due to the disruption to the aircraft, the accident was not considered survivable.
Operational information
South-west operations
Airlines of Tasmania conducted charter operations to the remote south-west region of Tasmania, which predominantly consisted of sightseeing tours and passenger transport (for bushwalkers and conservation volunteers). During the peak season (from about December to March), the passenger transport operations occurred in the early morning (departing Cambridge around 0800) and late afternoon (departing Cambridge around 1600). The tours operated in the middle of the day (departing Cambridge around 1000) and included a boat tour on Bathurst Harbour and a return flight to Cambridge.
Training and checking requirements
The operator maintained a training and checking program to ensure company pilots remained current and competent in the conduct of the operation. According to the Airlines of Tasmania operations manual, to conduct VFR charter operations to Bathurst Harbour, new pilots were required to complete specific training for that location. In addition, the manual stated that ‘Due to the operational hazard associated with the limited runway length [430 m] at YBHB [Bathurst Harbour] an additional company line check is required before VFR charter operations are conducted into YBHB [Bathurst Harbour]’.
The chief pilot reported that, due to the difficulties of flying in the south-west of Tasmania, which included reduced and changing visibility conditions in an area of mountainous terrain, and the short runway length, the operator did considerable training for pilots commencing flights to the south‑west. This included completing additional ICUS flights beyond the minimum required by the Civil Aviation Safety Authority (CASA).[19] This was to ensure that pilots were aware of the unique hazards associated with flying to the south-west, and that the operator was comfortable with a pilot’s decision-making prior to being approved for in-command operations.
Route selection
Operations into south-west Tasmania were generally conducted via two standard routes between Cambridge and Bathurst Harbour (Figure 11):
The ‘direct’ route was approximately on a straight line between Cambridge and Bathurst Harbour. This route was a distance of about 68 NM (126 km) and about 30 minutes in duration. When the weather was fine, with a high cloud base, the route was south of Mount Picton and Federation Peak. However, in lower cloud conditions, the route passed north of Mount Picton and then through ‘the portals’ gap between the Western and Eastern Arthur Range.
The ‘coastal route’ was about 90 NM (167 km) and about 40 minutes duration. The route tracked south from Cambridge, past Bruny Island and then along the southern coastline to Bathurst Harbour.
Figure 11: Routes commonly used between Cambridge and Bathurst Harbour
Note: The white track is the coastal route, the blue track is the direct route in high cloud conditions and the yellow track is in lower cloud conditions via the portals.
Source: Google earth and Spidertracks, annotated by the ATSB
The route selected was at the pilot’s discretion based on their assessment of the weather and type of flight being performed. For the sightseeing tours, it was reported that, weather permitting, the pilot might fly coastal one way, and direct on the return flight to provide the optimum tour experience for the passengers. However, if it was a charter for transporting passengers and/or freight to Bathurst Harbour, normally the direct route was chosen. The accident pilot had selected the direct route, and the flight track showed that the aircraft had passed through the portals, which indicated that the cloud base was not high enough to pass directly over the mountain range.
Operator guidance
There was no guidance in the Airlines of Tasmania Operations Manual, Volume 3 Aerodrome & Routes on the routes to the south-west, from Cambridge Airport to Bathurst Harbour. However, the manual did include details of the ALA’s used in regular operations, of which the Bathurst Harbour ALA was included.
The operator reported that they provided some informal verbal guidance during ICUS flights to its pilots’ when flying to the south-west, which included information about the different weather conditions that may be encountered, and the implication for route selection. However, there was no record of what information was provided to pilots regarding weather, nor what weather conditions were encountered during these flights. They were also advised of the various tools available to assist in assessing weather conditions. However, the operator’s pilots reported that if the weather was suitable at Hobart, the pilots were generally encouraged to depart Cambridge for flights to the south-west, even if the weather forecast indicated there was a chance of encountering marginal weather. It was mentioned that the weather was always changing, and that sometimes the forecast could be unreliable.
As discussed above, the portal route was used in lower cloud conditions. The operator advised, that, while a diversion or turn back could be made at any point in the flight, it was noted by the ATSB that the portals were considered to be a critical location on the route, due to the surrounding mountainous terrain. In discussion with the chief pilot, and a number of other company pilots who regularly flew to the south-west, the general procedure was to approach the portals at a safe altitude no lower than 500 ft AGL. The pilots were directed to pass to the west of Mt Picton (Figure 11) to allow sufficient room to manoeuvre for a turnback if required. If the pilot could maintain visual contact with Bathurst Harbour (the water) the flight could proceed through the portals. If visual contact was unable to be established or maintained, the pilot was to divert to Bathurst Harbour via the coastal route. It was also reported that there was an emphasis on always having an ‘escape’ route.
However, during interviews, there appeared to be differences between the company pilots’ perceptions on how far to continue with the direct route through the portals. Some of the pilots reported that the portals was their decision point, and if they were unable to see through to Bathurst Harbour due to weather, they would not continue and instead try the coastal route. However, one pilot mentioned passing through the portals to ‘take a look’, and another pilot reported passing through the portals and having to turn around and come back out. Some of the pilots also mentioned a number of routes, including a number of river valleys that led out to the coast.
In addition, there was no written guidance or procedure for VFR flights that encountered deteriorating weather conditions or inadvertent instrument meteorological conditions (IMC) during the flight. The chief pilot reported that there were some discussions about using other river valleys as escape routes if pilots got into trouble and slowing the aircraft down to increase decision‑making time. However, there was a reluctance to be too prescriptive or detailed, as each situation might require a different course of action, and it was also felt this may have suggested entering through the portals in marginal weather was an option.
Spidertracks data
The ATSB conducted a review of the operator’s Spidertracks data for flights performed to the south-west from December 2017 to December 2018. The altitudes of these aircraft at similar locations[20] were analysed for comparison with the accident flight. The data showed that:
Over the year prior to the accident, the operator conducted about 690 flights from Cambridge to Bathurst Harbour. Of these:
About 430 (62 per cent) flights went via the coastal route.
About 128 (19 per cent) flights tracked via the direct route, straight over the top of the mountains.
About 80 (12 per cent) flights used the direct route through the portals.
Four flights approached the portals, but then backtracked to around Huonville and the coast and followed that route to Bathurst Harbour.[21]
An additional 13 flights deviated as they approached the portals to track over Federation Peak.
There were about 36 flights that did a round trip, where the aircraft arrived at Bathurst Harbour, but did not land and returned to Cambridge.
Of the 80 fights that used the direct route through the portals, the accident flight descended lower than all other flights after it entered the portals:
the accident flight crossed the portals (saddle) at about 2,100 ft AMSL and descended to about 1,500 ft over the next 2 minutes, with the next closest flight descending from about 2,000 ft to about 1,700 ft
a total of 63 flights went through the portals between 2,000 and 3,500 ft
a further 16 flights tracked through the portals over 3,500 ft.
While four other flights were lower than the accident flight at the comparison points prior to reaching the portals, these flights appeared to have a relatively stable altitude as they approached the mountains. Two of the flights were on 29 November 2018, one on 15 May 2018 and the other on 28 March 2018. From a review of the pilot’s logbook, the accident pilot did not conduct any of those flights.
Five flights in the dataset showed the aircraft taking non-standard routes through the portals area (Figure 12). On one occasion, when two aircraft were in convoy, the aircraft appeared to track on a similar route to the accident flight (shown in green and orange in Figure 12), in that they turned left after passing through the portals. However, they were about 1,000 ft higher when at the same position as the accident flight. In this instance, the aircraft tracked all the way to the coast along a valley. This flight occurred 1 month prior to the accident, and the accident pilot was in the lead aircraft (green).
Figure 12: Comparison of aircraft tracks through the valley, including about 1 month prior to the accident (green – lead aircraft; orange – second aircraft) and the accident track (pale yellow)
Source: Google Earth and Spidertracks, annotated by the ATSB
Influences on in-flight weather-related decision-making
VFR into instrument meteorological conditions
Weather-related general aviation accidents remain one of the most significant causes for concern in aviation safety (ATSB, 2005; ATSB, 2019). Between 1 July 2009 and 30 June 2019, 101 VFR into instrument meteorological conditions (IMC) occurrences were reported to the ATSB. Of these, nine were accidents resulting in 21 fatalities. That is, about one in 10 VFR into IMC events resulted in a fatal outcome. While flying into IMC can occur in any phase of flight, the ATSB’s 2005 study into General Aviation Pilot Behaviours in the Face of Adverse Weather concluded that the chances of a VFR into IMC encounter increased as the flight progressed until they reached a maximum chance occurring during the final 20 per cent of the flight distance. This result highlighted the danger of pilots ‘pressing on’ to reach their destination. The research also noted:
A VFR pilot may exhibit a range of behaviours when faced with adverse weather. For example, at the first hint that conditions are deteriorating, a pilot may decide that discretion is the better part of valour and immediately return to their point of departure…At the other extreme, a pilot may ‘press on’ into deteriorating weather, either unable or unwilling to see the increasing danger of their actions, until the aircraft suddenly enters IMC...A more typical scenario might involve a pilot who, in response to deteriorating conditions, initially continues the flight as planned, but subsequently decides to return, divert, or perhaps even carry out a precautionary landing.
A study by Wiegmann and Goh (2000) suggested a number of possible factors that contribute to instances of VFR flight into adverse weather conditions. These included situation assessment (an inaccurate assessment by a pilot of the conditions), risk perception (a pilot may not appreciate the risks involved with continuing the flight) and motivational factors (‘get-home-itis’ or personal/social pressures to complete the flight). The study also found that, during the conduct of a simulated cross-country flight, a significant proportion of participants overestimated the visibility and cloud base. That is, they perceived the conditions to be better than what they actually were.
A United States National Transportation Safety Board (NTSB) study (2005) also stated that one class of decision making in weather-related occurrences was the presence of plan continuation error. This was defined by Orasanu and others (2001) as the continuation of the original flight plan in the face of cues that suggested changing the course of action.
Rather than revisiting the intended route by making a decision such as returning to the departure airport, pilots ‘may opt to press on in deteriorating weather’. Wiegmann and Goh (2000) explained that ‘pilots may diagnose and perceive the risks accurately, but other motivational factors bias their decisions’.
Pilot experience
Pilots’ in-flight weather decision-making relies on past experience and similar circumstances. This type of decision-making is based on the naturalistic decision-making process, which focuses on how people with domain expertise use their knowledge to make decisions, typically in safety‑critical environments (Cannon-Bowers and others, 1996; Zsambok & Klein, 1997, cited in Orasanu, 2010). Part of this type of decision-making involves situation assessment, which is developing an adequate solution to manage the perceived risks. In addition, Oritz and others (2017) stated that:
…a pilots’ ability to choose an optimal course of action out of a variety of potential responses is thought to be naturally developed through experience (Campbell & Bagshaw, 2002). However, “experts do not merely possess more knowledge, they are better at using it” (Tsang & Vidulich, 2006, p. 261).
Achieving an effective situation assessment involves the ‘recognition and response to a familiar pattern of environmental features’, which is seen to be the basis of weather-related expertise. This enables ‘accurate and rapid responses’ even in situations of high workload (Wiggins and others, 2014). Developing some useful cues can help shortcut the decision-making process, but these cues only come with increasing expertise. Therefore, as pilots have differing experiences, and subsequently, understandings of weather conditions, there will be differences in their situation assessment and decision‑making.
Risk perception
Pilots who appear to be intentionally engaging in what could be considered ‘risky behaviour’ may actually be making choices they believe to be safe (NTSB, 2005). Wiegmann and Goh (2000) explained why pilots may fly into deteriorating weather conditions, outlining that:
…decision-making under uncertainty also involves the perception of risk…In the case of VFR flight into IMC, pilots may assess the situation accurately…but they may not realize the risks involved in continuing with the flight.
Hunter (2006) outlined that, in some cases, a person will not perceive the risk inherent in a situation, and therefore does not mitigate the risk adequately. In other circumstances, the risk is simply not considered sufficiently threatening, demonstrating a greater risk tolerance in that individual.
Risk assessment can also vary with factors such as experience and prior exposure to a similar event. Research by McMurtie and Molesworth (2017) indicated that more experienced and older pilots were more conservative in their risk estimates. Schuch (1992) showed that a pilot’s repeated exposure without an incident may make them more likely to perceive a lower risk.
Perceived pressure to complete flights
When making weather-related flight decisions, it is possible that, in some situations pilots may perceive that there are pressures to continue a flight, as opposed to returning or diverting. In small commercial operations, there can be a risk that ‘balancing the competing demands of safety and productivity [becomes] difficult for many small operators, which places a heavy reliance on the decision making of individuals’ (Bearman, et al., 2009). The paper also stated that, as well as managers discouraging pilots to take, or continue with flights in marginal conditions, operators can mitigate the pressures with organisational practices. This included paying pilots regardless of whether they were able to complete a flight and educating customers so that they develop realistic expectations. The operator reported that, pilots were paid regardless of whether they flew or not. They also stated that they reduced perceived pressures on the pilots by managing customer expectations. This included cancelling flights as early as possible, offering alternative tours or refunds, and clearly stating in advertising material that flights and tours were subject to weather. The operator’s pilots were asked about whether they had felt pressure to proceed with a flight. Some commented that they had never perceived any pressure from the company to either depart, or to continue on a specific route, one said that it was always their decision as the pilot, and another cited examples of where they had cancelled flights. The chief pilot stated that a lack of detailed localised weather information for the Bathurst Harbour ALA, meant that it was not always practical to make a decision from Cambridge. It was further reported that the philosophy was generally to encourage pilots to depart, and if the weather was not conducive to completing the flight, then to just turn around and come back. The majority of pilots who operated to the south-west confirmed that it was their understanding that if conditions at Cambridge Airport were suitable, they were strongly encouraged to at least take-off to assess if the conditions were suitable if there was uncertainty about the weather.
Overall, although many pilots reported that they perceived some organisational pressure to depart and assess the weather conditions en route, there was not necessarily any pressure to take a particular route or continue the flight if they did encounter marginal conditions. Further, as stated above, the operator advised that they had strategies in place to mitigate the risk of perceived company pressure, including paying pilots regardless of whether or not they flew, and managing customer expectations. However, ultimately, it was the pilot’s decision to select an appropriate course of action, with no repercussions for deciding to turn back.
Organisational information
Airlines of Tasmania
Airlines of Tasmania, operating as Par Avion, commenced operation in 1978. They operated regular public transport services, charter, and scenic flights across a number of locations in Tasmania and conducted aerial work and flight training. At the time of the accident, they operated single-engine and multi-engine aircraft, including the Cessna 206, Cessna 404, Piper Navajo, Beechcraft Duchess and the Islander.
Air operator’s certificate
A CASA air operator’s certificate (AOC) was re-issued to the operator on 9 November 2018, valid until 30 November 2021. The AOC included authorisations for regular public transport operations using other than high-capacity aircraft. The operator was approved to conduct flight training, training and checking, aircraft maintenance activities, and provide continuing airworthiness services.
Safety management system
The operator’s AOC included authorisations for regular public transport operations using aircraft other than high capacity. Therefore, under the requirements of Civil Aviation Order 82.3 - Conditions on Air Operators’ Certificates authorising regular public transport operations in other than high-capacity aircraft, they were required to have a safety management system (SMS). While only needed for the regular public transport services, the operator’s SMS was designed to be implemented across the various operations, including charter. The International Civil Aviation Organization (2018) and CASA (2007) defined an SMS as:
A systematic approach to managing safety, including the necessary organizational structures, accountability, responsibilities, policies and procedures.
A Safety Management System is an integrated set of work practices, beliefs and procedures for monitoring and improving the safety and health of all aspects of your operation. It recognises the potential for errors and establishes robust defences to ensure that errors do not result in incidents or accidents.
A safety management system comprised of 12 elements within four components (Table 2).
Table 2: Elements of a safety management system
Component
Element
Safety policy and objectives: a safety policy outlines what the organisation will do to manage safety and safety objectives state an intended outcome.
Management commitment
Safety accountability and responsibilities
Appointment of key personnel
SMS documentation
Safety risk management: the identification, analysis, and elimination (and/or mitigation to an acceptable or tolerable level) of the hazards, as well as the subsequent risks, that threaten the viability of an organisation.
Hazard identification
Safety risk assessment and mitigation
Internal safety investigations
Safety assurance: the systematic and ongoing monitoring and recording of safety performance, and evaluation of the safety management processes and practices.
Safety performance monitoring and measurement
The management of change
Continuous improvement of the SMS
Safety promotion: communicating lessons learned, broader safety information, and the distribution of the SMS manual and safety procedures in the organisation.
Training and education
Safety communication
Source: ICAO and CASA, modified by the ATSB
The operator was required to demonstrate their safety management capability in relation to each of the SMS elements. This was to be demonstrated through the:
operating effectiveness of the SMS
competence of each of the operator’s relevant personnel with respect to the SMS elements
comprehensive nature of the information, procedures and other material contained in the SMS manual that is relevant to the SMS elements.
Continuous improvement of the SMS
The operator’s SMS manual stated that the organisation should continually seek to improve their safety performance. Continuous improvement can be achieved by (Civil Aviation Authority, 2014):
proactive evaluation of day to day operations, facilities, equipment, documentation and procedures through safety audits and surveys
reactive evaluations in order to verify the effectiveness of the system for control and mitigation of risk e.g. incidents, accidents and investigations
tracking organisational changes to ensure that they are effective
regular review of the organisation’s safety performance and safety action plans.
Safety risk management process
At the core of an SMS is a formal risk safety management process (Civil Aviation Authority, 2014), which is used specifically to:
identify hazards associated with an organisation’s operations
analyse and assess the risks associated with those hazards
implement controls, to prevent future accidents, incidents or occurrences (Civil Aviation Safety Authority, 2018).
The operator’s SMS manual provided an overview of the risk management process to be applied based on the Australian risk management standard (AS/NZS ISO 31000:2009) (Figure 13). The SMS process started with identifying the hazards affecting the safety of the organisation and then assessing the risks associated with the hazards in terms of likelihood and severity. Once the level of risk was identified, appropriate remedial action or mitigation measures could be implemented to reduce the level of risk to as low as reasonably practical.
A risk assessment form was developed and included in the manual, where the risk, its assessed rating, mitigations, and an action plan would be recorded. The risk management process was to be conducted for safety occurrence reports, change management, and other activities as required.
Figure 13: Risk management process
Source: Airlines of Tasmania
As recognised by the International Civil Aviation Organization (2018), the safety risk management process is continuous, as systems are constantly changing new hazards can be introduced, and some hazards and associated risks may change over time. Further, ‘the effectiveness of implemented safety risk mitigation strategies must be monitored to determine if further action is required’.
The operator’s SMS manual stated that the safety manager would review the SMS every 12 months. This process involved reviewing the hazard identification and hazard register,[22] any risk assessments conducted, and investigations completed (refer to sections titled Hazard identification and Hazard register).
Hazard identification
A hazard can be considered a dormant potential for harm, which is present in one form or another within the system or its environment (International Civil Aviation Organization, 2018). Hazards exist at all levels in the organisation and are detectable through many sources including safety occurrence reporting systems, inspections, audits, brainstorming sessions, and expert judgment. Hazard identification may also consider hazards that are generated outside of the organisation and those that are beyond their control, such as weather. The three main methods for identifying hazards are:
Reactive: involves analysis of past outcomes or events, and through the investigation of safety occurrences.
Proactive: involves the assessment of normal operations and objectively determining possible outcomes.
Predictive: involves collecting safety data for trends to try and identify, and mitigates risks before they become evident.
The operator’s SMS manual identified potential internal sources of safety information in the hazard identification process. These included safety occurrence reports, change management, internal investigations, audits, analyses of safety data, safety culture surveys, safety committee meetings, and brainstorming. Any identified hazards were to be recorded in the hazard register and assigned actions as appropriate.
Hazard register
The operator kept a hazard register in a spreadsheet, which was transitioned into a system called Air Maestro,[23] by mid-2018. The SMS manual outlined that all hazards must be documented in the hazard register and would contain information relating to:
hazard details and associated safety reports
risk rating attributed to the hazard
existing controls to mitigate the hazard.
The safety manager’s annual review of the hazard register was to determine whether there had been any changes to the nature and extent of each recorded hazard and its associated risk. The review was also to identify hazards that appeared systemic in nature and warranted further investigation or consideration by the operator’s safety review committee. The annual review of the 2018 risk register was completed in 2019.
The ATSB reviewed the operator’s hazard register for the period 2013 to 2018 and found that:
The register was mostly populated by safety occurrence reports sourced internally or from Airservices Australia, with very little other sources of safety information included.
In 2018, none of the hazards identified included risk mitigators or action plans, and there was no content related to weather-related hazards.
Over the period, there were only two reports related to weather, both of which occurred during training flights:
On 19 October 2016, a ‘pilot divert due weather and penetrated controlled airspace’.
On 8 September 2015, there was a ‘diversion to maintain VMC [visual meteorological conditions][24] on training flight’.
Both included a risk rating, a recommendation action date and date completed, however, there was no detail on what these actions included.
Safety reporting culture
The effectiveness of a safety reporting system partly relies on the promotion of a positive reporting culture and proactive identification of safety deficiencies. One way of achieving this is by clearly stating that reported information will be used solely to support the enhancement of safety (International Civil Aviation Organization, 2018). This also included a culture where people can report without fear of punishment (Reason, 1998).
The operator’s pilots reported that, generally the organisation had a good reporting culture. However, there appeared to be some different opinions on when to report turn-backs due to weather when conducting operations to the south-west. It was mentioned that some pilots would submit a safety report for any turn back or believed that one should be submitted. However, a number of other pilots felt that it did not constitute a safety report as it was a routine decision made by pilots and the safety of flight was never compromised.
In addition, one of the company pilots recalled a previous situation where they had inadvertently entered IMC during a VFR flight in the mountainous area near the portals. The pilot mentioned that this incident had not been entered into the safety reporting system, as it had happened prior to the implementation of Air Maestro, but it had been mentioned to the pilot’s supervisor.
Safety committee meetings
Safety committee meetings were held quarterly and were chaired by the managing director and attended by the chief pilot, safety manager, chief flying instructor, and other managers. These meetings would review safety occurrence reports, discuss new hazards, review management of change requirements, review training requirements, discuss aviation security, and address other SMS‑related business.
An ATSB review of the safety committee meeting minutes found that various aspects of the south‑west operations had been discussed during the years prior to the accident. The minutes for the December 2016 committee meeting stated that a review meeting with all south‑west pilots raised at the September committee meeting had been held in October. It was noted that nothing new had been raised, but the chief pilot had added weather to the hazard register. It was also mentioned that more work was required on weather and risk for south‑west operations, This was subsequently added to the action items for the meeting. The chief pilot was to develop a weather risk model and to conduct a further review, to be completed by 31 March 2017.
The south-west operations were further discussed in a committee meeting in March 2017. It was noted that the planned review by the chief pilot had been put on hold until the end of the season due to possible changes in personnel. There was no further mention of south-west operations in subsequent meetings.
Airlines of Tasmania have operated in the south-west area of Tasmania for more than 30 years. While a number of hazards had been identified during that time, they were of the belief that these hazards had not changed in many years.
The operator reported that they had introduced a number of weather-related risk mitigation strategies in the previous years. These included fitment a GPS unit with terrain alerting in all aircraft, the installation of internet facilities and web cameras to assist in understanding the weather situation at Bathurst Harbour, and the use of Spidertracks. There was no accompanying guidance in the operations manual to support the pilots in the use of these tools.
This equipment was introduced to address the risks associated with the changing weather and mountainous terrain during operations in the south-west. The safety manager at the time noted that, while no new risks had been identified in the past 15 years, these measures would provide pilots with more information about their environment. The introduction of this equipment was noted in a CASA surveillance event in 2016, but there were no further details about its ongoing effectiveness.
On 29 December 2014, a Cessna 172 operated by Airlines of Tasmania, collided with water during a low‑level aerial photography flight, resulting in the pilot and photographer sustaining fatal injuries. While not contributory to the accident, the ATSB’s investigation found that:
…the operator’s safety risk management processes and practices were not sufficient to facilitate the identification of all key operational risks associated with low-level flying that was being conducted on Sydney Hobart race yachts.
In reviewing components of the operator’s SMS, it was evident that the ability to identify operational risks associated with this type of flight was affected by the following factors:
The main source of safety risk information were safety reports submitted by crew, in an environment where the reporting culture had only recently improved amongst the small flight crew workforce.
The risk management process was only utilised for managing operational or organisational changes, which precluded the proactive identification of risks in existing operational activities such as low-level flying.
The ability for managers to be aware of existing operational risks was reduced due to the narrow application of documented risk management processes and tools (including the risk register).
Quality assurance
Internal audit
As stated above, the Airlines of Tasmania operations manual stated that safety performance monitoring and measurement activities, such as quality and safety audits, were to be undertaken to determine the organisations safety performance and to effectively manage risks. The objectives of these audits are detailed in Table 3.
Table 3: Objectives of internal audits
Quality audits
Safety audits
assess regulatory compliance
the SMS has a sound structure and adequate staffing levels
assess conformance with organisational manuals
approved procedures and instructions are complied with
identify deficiencies which may affect compliance, quality or safety
the required level of competency and training to operate equipment and facilities, and to maintain their levels of performance, is achieved
recommend remedial, corrective and preventative actions where necessary
equipment performance is adequate for the safety levels of the service provided
identify systemic or administrative vulnerabilities or deficiencies that may impact on operational quality or safety
effective arrangements exist for promoting safety, monitoring safety performance and processing safety issues
adequate arrangements exist to handle foreseeable emergencies
The operator contracted an external auditor to perform a ‘full-scale’ audit, which occurred over a 5‑day period in April 2018. That audit identified that:
A formalised risk assessment for all operations had not been performed or reviewed in the last 6 months.
The risk register was not updated when there were changes to circumstances and/or during periodical reviews.
Reported risks were not rectified in accordance with the risk analysis.
An annual review of the SMS had not been conducted in the previous 12 months.
The Air Maestro system was being used for reporting hazards and occurrences, and reports were being regularly reviewed to identify potential hazards.
Civil Aviation Safety Authority
Overview
The Civil Aviation Safety Authority (CASA) had two primary means of oversighting a specific operator’s aviation activities: regulatory services and conducting surveillance of its activities. They also used a scale of prioritisation, based on risk, to determine where to focus resources. This prioritisation was based on several factors, such as the sector of operation, organisational changes and challenges.
To maintain oversight across Australian operators (authorisation holders), CASA had a number of certificate management teams in different locations, made up of CASA officers, including flying operations inspectors, safety systems inspectors, and airworthiness inspectors. Each of these teams oversighted multiple authorisation holders. At the time of the accident, the team responsible for the oversight of Airlines of Tasmania comprised of one certificate team manager, three flying operations inspectors, four airworthiness inspectors and one safety system inspector. The team had oversight of 58 AOC holders, 50 aviation maintenance organisations and four delegates.[25]
Regulatory services processes
Regulatory services included assessing applications for the issue or variation to an operator’s AOC and associated approvals, key personnel approvals, maintenance personnel approvals, and check pilot approvals and renewals. Regulatory services provided by CASA for Airlines of Tasmania in 2014–2018 included:
a review of changes to the SMS manual (2014, 2017–2018)
approval of the chief pilot (2016)
approval of the safety manager (2016 and 2018).
Surveillance processes
The Civil Aviation Safety Authority developed a surveillance program to oversight authorisation holders and monitor adherence to the regulatory requirements. The surveillance policies, processes, and procedures were detailed in the CASA surveillance manual (CSM).[26] The CSM stated:
Surveillance is the mechanism by which CASA monitors the ongoing safety health and maturity of authorisation holders. Surveillance comprises audits and operational checks involving the examination and testing of systems, sampling of products, and gathering evidence, data, information and intelligence. Surveillance assesses an authorisation holder’s ability to manage its safety risks and willingness to comply with applicable legislative obligations.
The principal obligation of conducting surveillance activities is to ‘detect and mitigate threats to aviation safety as they manifest themselves in an authorisation holder’. To achieve this, CASA applied a systems and risk-based approach, which:
…aims to encourage the development of authorisation holders’ systems and to encourage and guide the aviation industry to fully understand their responsibility for safety. This is achieved by highlighting the following to industry management:
- management’s responsibility for safety as specified in the civil aviation legislation
- deficiencies in existing safety systems with regard to applicable civil aviation legislation
- areas where the authorisation holder should be doing more to reduce the potential for deficiencies.
Risk-based surveillance adopts a structured process and is used by CASA in its oversight of authorisation holders and prioritisation of its surveillance activities based on authorisation holders’ risk profiles. It focuses on an authorisation holder’s effectiveness in managing its systems risks and enables targeted surveillance of high-risk areas of an authorisation holder’s systems. It is also a method by which CASA can evaluate that all activities conducted by an authorisation holder are as safe as reasonably practicable.
Along with the CSM, CASA used Sky Sentinel, an information technology tool designed to assist in the management of surveillance activities. Specifically, surveillance events:
…are recorded and tracked in the supporting IT system and the results analysed, which allows CASA to evaluate the authorisation holder’s safety performance. The surveillance program is dynamic, regularly reviewed and updated, taking the following issues into consideration:
- significant changes that could affect an authorisation holder, including changes to management or organisational structure, policy, technology; special projects; changes to authorisation holder’s service providers; global and/or local threats and regulatory requirements
- application of the authorisation holder’s Safety Management System (SMS) where applicable
- results of previously conducted surveillance and/or investigations
- surveillance resource requirements
- the authorisation holder’s willingness and ability to identify and control its aviation safety-related risks.
In July 2018, CASA made changes to the oversight surveillance program with the introduction of the national surveillance selection process (NSSP). The NSSP formed part of the national oversight plan, which was an overarching operating model incorporating four pillars of safety oversight, being:
planned surveillance (NSSP)
response activities
regulatory services
national sector campaigns.
CASA stated that the NSSP was an objective, evidence-driven approach to creating a national schedule that prioritised planned surveillance activities across CASA. It included:
a system for prioritising the planned surveillance of authorisation holders
a CASA-wide annual planned surveillance schedule
a process that facilitated prioritisation, scheduling, and monitoring of planned surveillance.
Using a classification and ranking approach, a prioritised list of authorisation holders was created and used as the basis for the annual development of a CASA-wide annual planned surveillance schedule.
Types of surveillance
The CSM outlined two levels of surveillance events and the associated activities. A level 1 surveillance event was a structured, forward-planned, larger-type, surveillance event, which examined an authorisation holder’s systems, safety risk controls, and processes, and covered:
Systems audits: an audit based on a defined scope taking into account the specific activities conducted by the authorisation holder and their associated systems.
Health checks: similar to a systems audit, but usually shorter in scope and duration.
Post-authorisation reviews: conducted within 6-15 months following the initial issue of an authorisation.
Level 2 surveillance events were less formal interactions with authorisation holders and were more compliance-based to verify the process in place. These events were significantly shorter in duration than level 1 surveillance events and included:
Operational checks: the inspection of an aircraft, documentation, and preparation for flight (ramp inspection); site inspections; observation (en route) flights; a review of operating manuals; key personnel interviews; and safety meetings with the operator.
Unscheduled checks: occurrence investigations and events requested by the CASA Executive.
Surveillance findings
In accordance with the CSM, once a surveillance event was completed, the surveillance team members ‘review the evidence obtained for each assessed system risk to determine the level of effectiveness of the associated controls’. Depending on the nature of the deficiencies identified in these controls, written notices in the form of a safety observation or safety finding are issued to the authorisation holder to highlight potential and/or actual breaches.
Safety observations advise an authorisation holder of latent conditions resulting in system deficiencies that have the potential to result in a breach if not addressed. They also identify potential areas of improvement in safety performance. Safety observations do not require a response from the authorisation holder.
Safety findings (previously known as a notice of non-compliance or NCN), were issued for the ‘purposes of identifying a breach of a legislative provision or a provision of the authorisation holder’s written procedures’. These findings will generally be issued when CASA is satisfied that the authorisation holder has the willingness and ability to take remedial and corrective actions to address this.
When a safety finding was issued, the authorisation holder was required to respond to CASA within a specified period of time, providing evidence of any remedial action, root cause analysis, and corrective action taken. The response and associated evidence would be reviewed to determine whether the authorisation holder ‘has returned to a compliant state’ and ‘is actively working towards implementing the corrective action to mitigate the potential of recurrence of the identified deficiency’. If CASA rejected the response, the authorisation holder would be provided another opportunity to respond. If the response was accepted by CASA, the safety finding was acquitted and the authorisation holder notified accordingly.
However, if CASA could not be satisfied that the authorisation holder was willing or able to do so, the finding would be issued and the CASA coordinated enforcement process would be initiated.
A repeat safety finding was issued when the same breach was identified during subsequent audits. To issue a repeat finding, the criteria of the breach had to be exactly the same, that is, the same section of the regulations was not being complied with. The CSM provided limited details about assessing and acquitting repeat safety findings aside from referring the operator to coordinated enforcement. The CSM and CASA Enforcement Manual stated that:
When conducting the post-surveillance review and analysis, if the authorisation management team identify repeated breaches of a similar nature from the review of previous surveillance events, the authorisation management team, in conjunction with the Controlling Office Manager, must initiate the Coordinated Enforcement Process (CEP)...The CEP will provide a forum for better informed decision making and for discussing alternative options. [CSM]
This [process] may identify which particular enforcement tool or combination of tools that would be most likely to achieve the optimal safety outcome…However, the most appropriate response may ultimately involve a combination of: enforcement and compliance tools, compliance tools alone, or voluntary action initiated by the industry participant. [Enforcement Manual]
Periodic assessment tool
The authorisation holder performance indicator (AHPI) was a questionnaire-based tool used by CASA to assess ‘the apparent risk to safety presented by an authorisation holder’. According to the CSM, an AHPI assessment was to be conducted:
at least every 6 months
where a significant operational change had occurred or an area of concern had arisen
after completing a surveillance event or after surveillance findings had been finalised or acquitted.
Specifically, the tool assessed the authorisation holder against 19 parameters using word pictures with a one to five scoring system, where one indicated a lower apparent risk to safety and five indicated a higher risk to safety. These parameters focussed on a number of behavioural factors that were commonly recognised as affecting or relating to safety performance. While the score itself did not have a particular meaning in terms of further action required, it was reported that the entry in the Sky Sentinel system will change colour if the score is above about 150, which indicated a heightened risk.
The score was used to assist the certificate management team to assess whether any risk-based surveillance of an organisation was required, and to scope the areas for that assessment. The results would then be discussed either monthly, or 6-monthly, depending on the category of the operator.
A summary of the overall scores and comments made during AHPI assessments for Airlines of Tasmania in 2017 (AOC only)[27] are shown in Table 5. In these assessments, high scores were given for the parameters under ‘safety outcomes’, which included regulatory history breaches and enforcement. This related to repeat safety findings and the associated unsatisfactory responses (refer to the section titled Surveillance events for Airlines of Tasmania). There were also several comments in the assessments that noted the SMS was not operating effectively. There were no AHPI assessments conducted in 2018.
Table 4: AHPI assessments on Airlines of Tasmania AOC in 2017
Enforcement underway re safety management recurring NCNs and unsatisfactory responses.
18 July 2017
133
Safety-related decision-making (SMS having various issues)
Regulatory history - breaches (Breaches in relation to the SMS).
Regulatory history - enforcement (safety management)
Other safety issues or concerns (weaknesses in SMS and limited training and checking capacity).
Improvements in the management of South West operation[s] noted.
19 December 2017
164
Control - SMS capability not effective
Safety occurrences - repeat findings; lack of management commitment with recruitment of safety manager and ensuring SMS is effective.
Source: CASA, modified by the ATSB
Frequency of surveillance activities
It was reported by CASA that, while a level 1 surveillance event required approval by the controlling office manager, a certificate management team was able to carry out as many level 2 surveillance events as they deemed required. The recommended frequency of surveillance activities in the CSM for regular public transport and small charter (aircraft with a maximum take‑off weight less than 5,700 kg), and when these were conducted for Airlines of Tasmania is detailed in Table 5.
Table 5: Flight operations surveillance frequency guide
Type of operation
Type of surveillance
Recommended frequency
Last conducted for Airlines of Tasmania
Regular public transport
Level 1 - systems audit
1 per year
July 2017
Level 2 - operational check
1 per year
December 2017
Small charter
Level 1 - health check
1 per year
September 2016
Level 2 - operational check
1 per year
December 2017
Training and checking
Level 2 - operational check
1 per year
October 2018
Source: CASA, modified by the ATSB
Surveillance events for Airlines of Tasmania
Overview
In reference to the scheduling of surveillance activities, and taking into account current enforcement action and organisational changes, the CSM stated:
CASA’s surveillance program scheduling is driven by the risk to safety posed by authorisation holders and is based on an assessment of a number of factors. These factors include the assessment of an authorisation holder’s safety performance, taking into account assessment factors indicated by the Authorisation Holder Performance Indicator (AHPI) assessment results and time since the last assessment, outstanding Safety Findings and findings history, time since the last surveillance event and safety-related risks specific to each authorisation holder. Based on this consolidated information, CASA has the ability to prioritise surveillance activities commensurate with resources available.
In the 4 years prior to the accident (2014-2018), CASA conducted a number of surveillance events of Airlines of Tasmania. These included two level 1 system audits, one level 1 health check and 14 level 2 operational checks. Of these events, four included a review of the SMS. A summary of all the surveillance events are shown in Appendix A – Summary of CASA surveillance activities for Airlines of Tasmania between 2014-2018. Relevant details from each of these events for each year is presented below.
Surveillance events in 2014
In February 2014, CASA conducted a level 2 - operational check, which reviewed the elements of the SMS. Several non-conformances were found and safety findings were issued relating to:
Safety risk management: occurrence investigation and the occurrence/hazard reporting system and risk register. The latter included a mismatch between the risk matrix used in the organisation’s occurrence/hazard reporting system database and risk register compared to the approved Airlines of Tasmania matrix (NCN 708925).
Safety promotion: safety management system training.
Safety policy and objectives: safety management system manual and the emergency response plan. The audit report also mentioned that the safety findings ‘indicate broader issues associated with the continuous improvement of the organisation’s management systems’. Airlines of Tasmania subsequently conducted a significant rewrite of their SMS manual and all of the safety findings were acquitted by CASA in July 2014.
In August 2014, Airlines of Tasmania, who were the operators of Cambridge Airport, changed the designation of one of its three runways without advising stakeholders in advance. In response, CASA conducted a level 2 - operational check, which included a desktop review of the operator’s assessment of the runway change through the SMS, followed by a site assessment. As part of that review, CASA requested the operator’s risk and change management records, and associated materials to support the change. The review noted that the operator’s SMS did not proactively address this matter and it was recommended that the performance of the SMS be reviewed closely through a separate surveillance event.
In October 2014, CASA conducted a level 1 - systems audit (AOC). The safety systems aspects was assessed through an interview with the safety manager, and a review of safety reports and internal audit records. There were 20 safety/hazard reports raised in 2013 and 22 safety/hazard reports raised in 2014. A review of the safety reports suggested an appropriate level of reporting for the size and complexity of the operations. The content of the reports also suggested that there was a relatively open reporting culture. Based on the sampling of the safety meetings, safety survey and newsletters, the safety activities carried out by Airlines of Tasmania was thought to be appropriate for their operations at the time.
Surveillance events in 2015
In 2015, CASA conducted several surveillance activities, such as site and ramp inspections, but none included audits of the SMS.
Surveillance events in 2016
In September 2016, CASA conducted a level 1 – health check. Overall, it was found that the operator’s SMS was not operating effectively across all four SMS elements. The audits stated that Airlines of Tasmania ‘should focus on identifying and addressed the root cause rather than the active failure and any mitigating action should take a systems approach and be accompanied by relevant supporting evidence’.
The audit identified repeat findings related to widespread non-conformance of the SMS, with eight safety findings and two observations issued relating to:
Safety assurance: the effectiveness and continuous improvement of the SMS. The latter was a repeat finding from February 2014.
Safety policy and objectives: emergency response plan (a repeat finding), and control of SMS documentation and processes.
Safety risk management: limited scope and effectiveness of the risk register (NCN 715369), management of safety decisions and actions, and risk assessments not embedded into safety risk management processes (all were repeat findings from February 2014). For the finding relating to the scope and effectiveness of the risk register (NCN 715369: repeat finding, refer to NCN 708925) it was identified that the risk register was only used for change management, rather than all operational risks. Furthermore, all operational safety hazards had not been added to the risk register and mitigations not included in the hazard and occurrence list. This led to difficulties in tracking what actions had been implemented to prevent re‑occurrence, and disagreement between personnel about the consequences for occurrences listed in the system.
Safety promotion: deficiencies found in the SMS training documentation (a repeat finding).
There was also a safety observation issued under safety policy and objectives relating potential disconnects between ‘SMS channels of information’.
Surveillance events in 2017
In early 2017, based on continued unsatisfactory responses to safety findings about ‘management of safety decisions and actions’, ‘safety management system - continuous improvement’, ‘safety management system training’, and ‘safety management system - risk register’, CASA coordinated enforcement was initiated.
In March 2017, CASA informed the operator that the responses received for the safety findings were unsatisfactory. The operator subsequently provided CASA with additional evidence and the safety findings ‘safety management system – continuous improvement’ and ‘management of safety decisions and actions’ were acquitted.
To address the outstanding safety findings, the CASA safety system inspector recommended that surveillance be scheduled to follow-up on the evidence for these findings, assess the new safety manager, and assess the capability of the SMS. The certificate management team manager indicated that before additional surveillance would be completed, the operator would be subject to the CASA enforcement meeting process as they were under enforcement, and the plan would be for a level 1 surveillance audit.
In July 2017, as part of a level 2 systems audit, it was identified that the operator had implemented various changes to the management of VFR charter flights into Bathurst Harbour. This included upgrading the airstrip facility and equipment to enhance the remote surveillance and communication capability, and the introduction of Spidertracks real-time aircraft tracking. The audit identified a safety management - risk management deficiency related to fatigue risk management.
In December 2017, a level 2 - operational check was conducted. In preparation for that audit, the inspector completed a surveillance checklist. Part of this checklist required that the inspector review the following:
authorisation holder assessment
previous surveillance history
findings
any follow-up items from previous audits, including findings with status of ‘Verification Required by CASA’
An additional document, ‘surveillance scoping and planning’ was also completed prior to this audit. This document contained a list of the previous NCNs, including the number and details. There were five NCNs on the list, including NCN 715369 - ‘Safety Risk Management Risk Register’. The document had a hand-written cross next to this entry, however, as there were no further details, the ATSB was unable to determine the meaning of this.
The post-surveillance event report stated that the operator’s SMS was not operating effectively as they had only demonstrated partial effectiveness. Specifically, the report issued four safety findings and one safety observation:
Issues relating to the incomplete transfer of the risk register into Air Maestro, and the previous ‘action hazard register’ spreadsheet contents being used within the quarterly safety committee minutes (instead of Air Maestro). The risk register also had items but no associated actions (SF 718040). This was a repeat finding from the audit conducted in 2016, titled ‘risk register’ (NCN 715369).
Outdated references in the SMS manual and the additional role of document controller not added to the safety manager role. This was a repeat finding from the audit conducted in 2016.
There were two safety findings issued regarding assurance of the SMS effectiveness and emergency response plan exercises.
An observation was raised relating to the safety manager role. The report stated that the safety manager did not feel empowered or authorised in fulfilling their role.
Surveillance events in 2018
Only one surveillance event was completed in 2018, a level 2 - operational check (site inspection). The scope of that event did not include items related to the operator’s SMS or hazard and risk identification. A second site inspection was scheduled for November 2018, however, it was cancelled.
The operator’s new safety manager, who commenced in 2018, had several interactions with the certificate management team throughout the year. The inspector who conducted the last surveillance activity believed that the SMS was functioning well. This was based on interactions with the new safety manager and the continuing work relating to re-writing the SMS. The safety manager resigned from the position in October 2018, and at the time raised a number of issues with CASA, relating to the safety manager role, the flying training school and maintenance.
Acquittal of outstanding safety findings
In February 2018, the operator submitted their responses to the safety findings from the audit in December 2017. In response, the CASA inspector who issued the findings requested further evidence. After receiving that evidence, all these findings were acquitted by March 2018. This included the repeat findings of SF 718040 (issued in 2017) and NCN 715369 (issued in 2016).
The information supplied to address the repeat finding (SF 718040) was directly related to the incomplete transfer of the risk register into Air Maestro, the previous ‘action hazard register’ contents being used within the quarterly safety committee minutes, and the risk register having items but no associated actions. However, despite the previous finding (NCN 715369) also being acquitted, from the records supplied to the ATSB by CASA, it did not appear that any information had been submitted by the operator to address the deficiencies identified in this finding. This finding related to:
The occurrence/hazard reporting system database and risk register was only used for change management. The intent of the risk register was to capture all operational safety risks including occurrences, audit findings and any proactive hazard capture.
All operational safety hazards have not been added to the risk register.
The Civil Aviation Safety Authority reported that, for repeat findings, only the most recent one will be directly acquitted, as once a repeat finding was issued, it effectively replaced any earlier findings. The planning and scoping forms were to ensure that any outstanding items from previous surveillance events would be reviewed and assessed at the upcoming surveillance event. In this case, once SF 718040 had been issued and then acquitted, this meant that the previous finding (NCN 715369) was also acquitted, potentially without being fully assessed.
As a result of the outstanding safety finding being acquitted, the coordinated enforcement case was closed in August 2018.
Civil Aviation Safety Authority comments
On 6 August 2021, in response to the draft report, CASA stated that the four safety findings identified in the December 2017 audit were regarding items of a more administrative nature related to the continuous improvement of the operator’s development of their SMS. Therefore, CASA did not consider these findings to be of an operational nature. Also, CASA indicated that their engagement with the operator to acquit the findings in February 2018 was considered formal surveillance activity. Consequently, they did not agree with the ATSB’s statement that no formal surveillance activities were conducted in the year prior to the accident.
In addition, regarding the operator’s surveillance history, CASA indicated they had conducted seven level 1 and 17 level 2 surveillance events from March 2012 up until the accident. They stated that this level of oversight was considered ‘suitable’ for the nature of operations conducted by Par Avion and that it reflected their continued positive engagement with CASA to improve the SMS.
Further, the regulatory service activities also demonstrated CASA’s ongoing oversight and provided valuable insight into the operator’s safety health. CASA stated that, this, combined with the surveillance activities, demonstrated a ‘completely appropriate oversight posture for an operator conducting flight training, charter and low capacity RPT [regular public transport] flight operations’.
Post-accident safety assurance review
After the accident, CASA conducted a safety assurance review. This type of review was undertaken after an incident or accident as part of CASA’s continuous improvement activities. It was not a function of the review to investigate the incident or accident. The CASA terms of reference for the review were to examine:
CASA’s oversight of the operator at the time of the accident, including recent surveillance, regulatory services, and recent audit activity.
Any immediate action CASA might consider necessary in the interests of aviation safety.
Any significant learnings for CASA from the accident.
Any further matters that might be considered relevant by the Regulatory Services and Surveillance Division given the circumstances of the accident.
The review noted that all findings from the surveillance report in December 2017 had been acquitted. Although concerns regarding the operator’s SMS were identified, the review noted that:
Audit scoping to test the ongoing effectiveness of the operator’s SMS, including qualifications and experience of key personnel was not evident in planned surveillance events. As an effective Safety Management System is a key safety mitigator for small air transport operations, it is imperative that CASA utilises a robust and consistent approach to surveillance.
There is an opportunity for CASA to review the apparent disconnect between the AHPI process and its relationship to the surveillance planning and scoping for this operator.
As a result of this accident and another ATSB investigation, the CSM was amended in July 2019 to include a detailed description of the surveillance technical officer role, which has an important part in the planning and scoping of audits. In addition, given the repeat findings related to the operator’s SMS, CASA considered reviewing the process around audit team composition to include inspector disciplines in relation to identified areas of risk.
Overall, the report concluded that there were no immediate actions or significant learnings from the review. It noted that the oversighting certificate management team was regularly engaging in surveillance and regulatory service activities with the operator, however, it was noted that ‘opportunities to focus surveillance on the SMS outputs of the operator were not fully realised’.
Previous investigations with surveillance and hazard identification findings
Previous ATSB investigations have identified findings relating to CASA surveillance events, activities and/or processes. These included two collision with terrain accidents in 2017 involving a Cessna 441 and another involving a Cessna 172M, and the ditching of an Israel Aircraft Industries Westwind 1124A in 2009. Specifically, the findings were:
In the 5 years leading up to the accident, the Civil Aviation Safety Authority had conducted numerous regulatory service tasks for the air transport operator and had regular communication with the operator’s chief pilots and other personnel. However, it had not conducted a systemic or detailed audit during that period, and its focus on a largely informal and often undocumented approach to oversight increased the risk that organisational or systemic issues associated with the operator would not be effectively identified and addressed. [ATSB investigation AO-2017-057]
The Civil Aviation Safety Authority’s procedures and guidance for scoping a surveillance event included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. [ATSB investigation AO-2017-005]
Although the Civil Aviation Safety Authority (CASA) collected or had access to many types of information about a charter and/or aerial work operator, the information was not integrated to form a useful operations or safety profile of that operator. In addition, CASA’s process for obtaining information in the nature and extent of an operator’s operations were limited and informal. These limitations reduced its ability to effectively prioritise surveillance activities. [ATSB investigation AO‑2009-072]
The Civil Aviation Safety Authority’s procedures and guidance for scoping an audit included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. [ATSB investigation AO-2009-072]
In addition to the above findings:
Although the operator’s safety management processes were improving, its processes for identifying hazards extensively relied on hazard and incident reporting, and it did not have adequate proactive and predictive processes in place. In addition, although the operator commenced air ambulance operations in 2002, and the extent of these operations had significantly increased since 2007, the operator had not conducted a formal or structured review of its risk controls for these operations. [ATSB investigation AO-2009-072]
Flying in mountainous terrain
A Civil Aviation Authority of New Zealand booklet titled Mountain Flying (2012) discussed operations in mountainous terrain. The booklet described those operations as challenging and cautioned that the weather conditions in that terrain can be severe and change rapidly. Specifically, a small change in the outside air temperature towards the dewpoint temperature can produce cloud almost instantaneously and an increase in wind strength can increase the intensity and extent of downdrafts and turbulence, often found in the lee of the mountain ranges.
The booklet further emphasised the need for a greater level of navigational accuracy when flying in the mountains. This, combined with poor weather conditions, can significantly increase pilot workload and result in a reduced mental capacity to make decisions and manage new tasks or problems. Additionally, in low visibility conditions, navigation will be complicated by difficulty in identifying features and normal waypoints along the route. Therefore, weather is a very important consideration for pilots when operating in the mountains.
To reduce the risk of inadvertent VFR flight into IMC, there are a number of strategies that pilots can use to avoid weather, and a framework of actions to assist recovery if they inadvertently fly into IMC (SKYbrary, 2020);
Effective pre-flight planning, including gathering all available weather information to determine most suitable route options.
Calculating the ‘minimum VFR altitude to continue’, which is typically at least 500 ft above the expected terrain/obstructions. Once airborne, this can act as a trigger for the pilot if required to descend to this level due to a lowering cloud base.
Ensuring that sufficient fuel is carried to allow for holding and/or diversions.
Further, the Mountain Flying booklet (2012) highlighted the importance of always having an escape route, specifically:
The golden rule of mountain flying is to always have an escape route regardless of whether you are flying a fixed-wing aircraft or a helicopter. The aircraft must never be placed in a situation where there is insufficient room to turn back safely, or to recover from an encounter with turbulence or downdraught, or to make a successful forced landing in the event of an engine failure.
When flying in mountainous terrain, the risks associated with encountering IMC are significant. While no advice in any manual can cover all scenarios, the general advice is for pilots to consider how they might handle such a situation should it arise. Consideration should be given to:
The use of aircraft instruments and terrain displays (including EGPWS) to retain situational awareness and assist in avoiding terrain.
Obtaining appropriate external assistance where available (e.g. air traffic services).
Controlled flight into terrain
The aviation community has invested a considerable amount of time and resources to reduce the risk of CFIT, particularly in the commercial sector. The preventative strategies have focused on three key areas: technological advancements, education and training, and research and recommendations. While these measures have substantially reduced these types of accidents, CFIT continues to occur. The ATSB’s research report titled CFIT: Australia in context 1996 to 2005 defined a CFIT as one where:
the aircraft was under the control of the pilot(s)
there was no defect or unserviceability that would have prevented normal operation of the aircraft
there was an in-flight collision with terrain, water or obstacles
the pilot(s) had little or no awareness of the impending collision.
Overall, the research found that the likelihood of a CFIT accident occurring was rare, with CFIT accidents accounting for only 1.5 per cent of all accidents recorded during the 10-year reporting period. However, 60 per cent of CFITs resulted in fatal injuries to the aircraft occupants, underscoring the severity of this type of occurrence. In summary, while infrequent, CFIT accidents have a high risk of fatal injuries.
Carriage of lightweight recorders
The benefits of onboard recording devices have long been recognised as an invaluable tool for investigators in identifying the factors behind an occurrence and assisting with the identification of important safety issues. However, in many cases, investigations involving light aircraft are hampered by a lack of definite information about the circumstances that lead to the occurrence. This contrasts with the case for large commercial aircraft that are required to be fitted with a flight data recorder and cockpit voice recorder.
Retrofitting traditional crash protected flight recorders to lighter aircraft is expensive and technically difficult. However, recent technological advancements have meant that cost-effective lightweight recorders are available and require only aircraft power to be connected. These recorders typically record cockpit audio and video. As such, they can provide additional information about the state and operation of the aircraft, the operating environment, and the actions of the crew, potentially allowing for timely and appropriate safety action.
The absence of an onboard recording device has resulted in undetermined findings for a number of ATSB investigations. Recent accidents where a lightweight recorder would have benefitted the investigation included a:
Collision with water involving a de Havilland Canada DHC-2 aircraft, VH‑NOO, at Jerusalem Bay, Hawkesbury River, New South Wales, on 31 December 2017 (AO‑2017‑118).
Loss of control and collision with terrain involving a Cessna 441, VH-XMJ, 4 km west of Renmark Airport, South Australia, on 30 May 2017 (AO-2017-057).
In contrast, there have been investigations where the availability of recording devices, although not crash protected, have greatly assisted in determining the contributing safety factors and ultimately the identification of safety issues. These included a:
Rotor revolutions per minute decay and hard landing involving a Robinson R44, VH‑HGX, 5 km south of Ayers Rock Airport, Northern Territory, on 17 January 2018 (AO‑2018‑006). A rear seat passenger captured a portion of the flight on video.
Collision with terrain following an engine power loss involving a Cessna 172M, VH‑WTQ, 22 km north-west of Agnes Water, Queensland, on 10 January 2017 (AO‑2017‑005). The front right seat passenger recorded a video of the entire flight on a mobile phone.
Collision with terrain involving a Cessna U206, VH-UYB, Willowbank, Queensland, on 2 January 2006 (200600001). Two digital video camera recorders were found in the aircraft wreckage and provided footage of a previous flight, pre-flight briefings, and elements of the accident flight.
Collision with terrain involving a de Havilland Canada DHC-6-300, P2-KSF, 12 km north‑north-east of Port Moresby, Papua New Guinea, on 20 September 2014 (14‑1005). The aircraft was fitted with an Appareo Vision 1000 video camera/data logger, which recorded visual and aural data.
Recommendations for the fitment of lightweight recording devices
The need for onboard recording devices in other than large aircraft has been recognised by other investigation agencies, who have made various recommendations for these devices to be fitted. These agencies have included the United States National Transportation Safety Board (NTSB), Transportation Safety Board of Canada, United Kingdom Air Accidents Investigation Branch, European Union Aviation Safety Agency and New Zealand Transport Accident Investigation Commission.
In 2017, the European Aviation Safety Agency issued a Notice of Proposed Amendment (NPA 2017-03) for ‘In-flight recording for light aircraft’. The proposal was for the mandated carriage of lightweight recorders for light aircraft (maximum take-off weight less than 5,700 kg) involved in commercial operations. Although not mandated yet, following consultation, an updated proposal (Opinion 2019/02) recommended new requirements for aeroplanes and helicopters that;
are used for commercial operations
are manufactured on or after the date of entry into force + 3 years
are not specified by the current flight data recorder carriage requirements and
have a maximum operational passenger seating configuration of more than nine (for aeroplanes).
On 29 January 2021, as part of the investigations into the collision with water involving a de Havilland Canada DHC-2 aircraft (AO‑2017‑118), the ATSB released the following safety recommendation to CASA (AO‑2017‑118-SR-049) regarding the carriage of lightweight recorders:
The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority consider mandating the fitment of onboard recording devices for passenger-carrying aircraft with a maximum take-off weight less than 5,700 kg.
Similarly, on 9 February 2021, as a result of its investigation (AAR-21-01) into the fatal accident involving a Sikorsky S-76B helicopter at Calabasas, California, on 26 January 2020, the NTSB reiterated a previously issued recommendation to the United States Federal Aviation Administration:
Require all existing turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with a flight data recorder or cockpit voice recorder and are operating under 14 Code of Federal Regulations Parts 91, 121, or 135 to be retrofitted with a crash-resistant flight recorder system. The crash-resistant flight recorder system should record cockpit audio and images with a view of the cockpit environment to include as much of the outside view as possible, and parametric data per aircraft and system installation, all as specified in Technical Standard Order C197, “Information Collection and Monitoring Systems.” (A-13-13) Classified “Open—Unacceptable Response”
Similar occurrences
A search of the ATSB’s database showed there had been 48 CFIT occurrences in the previous 10 years (26 November 2010 to 2020), some of which involved collisions with obstacles during visual flight. However, throughout this period, there were six fatal accidents, five of which were categorised as private operations and the other as charter. Three of the fatal accidents were the result of VFR flight into IMC in mountainous terrain. The ATSB also identified two international investigation reports, which had similarities to the accident involving VH-OBL and are summarised below.
On 8 April 2019, at 0650 Eastern Standard Time, a Cessna 182 aircraft, registered VH-DJN, departed Cloncurry Airport on a private VFR flight to Mount Garnet aerodrome, Queensland. On board were the pilot and one passenger. The aircraft landed in Mount Garnet at 0920, where the passenger disembarked and left the aerodrome. The passenger planned to return to the aerodrome at about 1500 for an onward flight in VH-DJN to Charters Towers.
At about 0934, the aircraft departed Mount Garnet for a 62 km flight to Atherton Airport, where the pilot intended to refuel the aircraft before returning to collect the passenger. However, 15 minutes after departing, the aircraft impacted trees and terrain on the Herberton Range. The impact fatally injured the pilot and the aircraft was destroyed.
The ATSB found that the pilot, who was qualified only to operate in visual meteorological conditions, flew toward and entered an area of low cloud and reduced visibility, which obscured rising terrain. This almost certainly resulted in the pilot losing visual reference with the ground and a CFIT.
National Transportation Safety Board investigation (NTSB/AAR-17/02)
On 25 June 2015, about 1215 local time, a single-engine turbine-powered, de Havilland DHC-3 floatplane, registered N270PA, collided with mountainous, tree‑covered terrain about 24 miles east‑north‑east of Ketchikan, Alaska. The pilot and eight passengers sustained fatal injuries and the aircraft was destroyed.
The investigation determined that the flight encountered deteriorating weather conditions, with the terrain at the accident site likely obscured by overcast cloud and visibility restricted due to rain and mist. The pilot had climbed the aircraft to an altitude that would have provided safe terrain clearance. However, the pilot deviated from the typical short route, which required the flight to pass two nearly identical mountains before turning west. This deviation placed the aircraft on a collision course with a 1,900 ft mountain, which it impacted at an elevation of about 1,600 ft.
In the final 2 seconds of the flight, the aircraft pitched up rapidly before colliding with terrain. This strongly supported the scenario that the pilot continued the flight into near-zero visibility conditions. However, as soon as the pilot realised that the flight was on a collision course, the pilot attempted to avoid the terrain.
On 23 October 2013, the pilot of a Cessna 182Q aircraft, registered VH-KKM, departed Moruya Airport, New South Wales on a private VFR flight to Mangalore Airport, Victoria. The flight route encompassed the Alpine National Park, where the forecast and actual weather included extensive thick cloud and severe turbulence. Shortly after passing Mount Hotham Airport, Victoria, the aircraft collided with terrain on the eastern side of Mount Blue Rag, at about 5,000 ft AMSL. The pilot sustained fatal injuries and the aircraft was destroyed.
The investigation found that the pilot had departed Moruya with less than visual meteorological conditions forecast along the planned route. It was very likely that these conditions were encountered while flying over the Alpine National Park, where the pilot likely experienced reduced visibility to the extent that terrain avoidance could not be assured. This accident highlighted the risks associated with operating VFR in adverse weather, particularly when flying in a challenging environment such as mountainous terrain.
Papua New Guinea Accident Investigation Commission investigation (AE‑2009-050)
On 11 August 2009, a de Havilland Canada DHC-6 Twin Otter aircraft, registered P2-MCB, with two pilots and 11 passengers, was being operated on a scheduled regular public transport service from Port Moresby to the Kokoda airstrip, Papua New Guinea. At about 1113 local time, the aircraft impacted terrain on the eastern slope of the Kokoda Gap at about 5,780 ft AMSL in heavily-timbered jungle about 11 km south-east of the Kokoda airstrip. The flight was planned under the instrument flight rules but was flown using visual procedures.
The investigation determined that, when the crew commenced the descent through the Kokoda Gap in the reported rapidly changing weather conditions, they committed themselves to a course of action that they could not be assured of completing safely. Further, the surrounding mountainous terrain and evident cloud in the Kokoda Gap had the potential to severely limit the crew’s escape options, increase their workload, and test their situational awareness. A reduction in situational awareness and the presence of mountainous terrain during an approach are known risk factors in instances of CFIT.
In addition, the investigation concluded that the operator did not have a published emergency recovery procedure for application in the case of inadvertent flight into IMC. In response, the operator provided additional guidance to pilots in respect of the risk of inadvertent flight into IMC. Specifically, it was noted that:
A key to safely recovering to VFR [visual flight rules] conditions, should you inadvertently find yourself in IFR [instrument flight rules] conditions, is prior planning as to how you would handle this for different conditions. No advice in any manual can cover all the scenarios...
While en route from Cambridge Airport to Bathurst Harbour, Tasmania, the aircraft entered through a gap in the Arthur Range known as the portals. The aircraft was manoeuvred below the height of the surrounding terrain and shortly after, collided with Western Arthur Range during a turn, under power and pilot control.
Due to the extent of impact damage, the ATSB was unable to verify the operation of every aircraft system. However, there were no known defects with the aircraft, and examination of the accident site photographs and recovered wreckage indicated that it was highly unlikely that a mechanical problem contributed to the accident.
The weather at Cambridge Airport and earlier in the flight suggested the conditions were initially suitable for departure, but deteriorated as the flight progressed, consistent with the graphical area forecast. While several of the operator’s pilots reported some expectation to at least take-off to examine the weather conditions, there was no evidence to suggest that they felt pressured to continue these flights if the conditions were unfavourable. Further, the pilot had no other flights for the day, and the passengers waiting at Bathurst Harbour were regulars who knew that flights might not always get through.
A number of people interviewed mentioned that the Bureau of Meteorology forecast for that morning was unusual, in that it covered the whole of Tasmania without any sub-divisions. In addition, there was no dew point reading from the closest Bureau of Meteorology weather station (Maatsuyker Island) to the destination. However, the forecast provided sufficient information that there was some adverse weather in the coastal regions, which included Bathurst Harbour, and in close proximity to the accident site. This may have influenced the pilot’s decision to choose the direct route instead of the coastal route. The forecasts were also consistent with information supplied by the operator’s pilots, who reported that adverse weather was not unusual for the south-west region.
This analysis will examine the conditions under which the accident developed, and the guidance provided by the operator to their pilot’s operating to the south-west, particularly relating to deteriorating weather conditions. The operator’s safety management system including hazard identification, and the Civil Aviation Safety Authority’s oversight will also be discussed.
Encountered reduced visibility
The aircraft’s track indicated that the pilot had selected the direct route to Bathurst Harbour. Passing through the portals in the Arthur Range, suggested altitude‑limiting cloud conditions for visual flight were present at that time. The Bureau of Meteorology’s forecast and subsequent analysis of the actual weather conditions, which were consistent, showed the presence of extensive low cloud in the accident area.
Similarly, the observations of the passenger waiting at Bathurst Harbour also indicated that the conditions were marginal and that they were expecting the aircraft to arrive from the coastal direction, if at all. Further, although almost 2 hours later, the pilots searching for the aircraft also reported low cloud and reduced visibility. While there was no onboard recording device to definitively show what the pilot encountered, given the above, it was likely that reduced visibility conditions were present when passing through the Arthur Range.
After passing through the portals, flight data showed the aircraft being manoeuvred in the valleys, before tracking back towards the portals. That aircraft movement was consistent with the pilot assessing different options for possible routes through to Bathurst Harbour before deciding that the best, or only available, course of action was to backtrack. With limited visibility, the pilot would have had reduced positional awareness of the surrounding terrain. The data also indicated that the pilot appeared to be in control, and there were no indications of a mechanical problem with the aircraft. The wreckage examination noted that the aircraft collided with terrain with a relatively steep angle of bank, which may suggest that the pilot became aware of the mountain just prior to the collision. This was consistent with controlled flight into terrain.
Entered portals at a lower altitude
When compared with other company aircraft that had been flown on the direct route in the year prior, VH-OBL passed through the portals at the lowest altitude and with a descending altitude. Given the actual weather conditions in the accident area discussed above, and without any other reasons for this, it was likely that the pilot was flying lower due to the presence of cloud. Further, about 12 minutes later, as the aircraft was exiting back through the portals, it impacted terrain. This indicated that the weather conditions had likely deteriorated in the time that the pilot spent assessing possible routes through to Bathurst Harbour.
The flight data showed that the pilot conducted two controlled 180° turns in the valleys, rather than continuing directly to Bathurst Harbour. For comparison, about 1 month prior, the accident pilot had flown the same route, but after entering through the portals, diverted down a valley to the coast and then continued to Bathurst Harbour. While the weather conditions on that flight were unknown, it was possible that this influenced the pilot’s decision to continue into the valley on the accident flight. According to ATSB research, this was considered the more typical scenario, where a pilot would continue the flight as planned, rather than return, divert or land when faced with adverse weather.
In practice, much pilot decision-making relies on accurate situation assessment that typically comes from past experience in similar circumstances. Achieving an effective situation assessment involves the ‘recognition and response to a familiar pattern of environmental features’, which is seen to be the basis of weather-related expertise. This enables ‘accurate and rapid responses’ even in situations of high workload. According to Ortiz and others (2017):
…a pilots’ ability to choose an optimal course of action out of a variety of potential responses is thought to be naturally developed through experience (Campbell & Bagshaw, 2002). However, “experts do not merely possess more knowledge, they are better at using it” (Tsang & Vidulich, 2006, p. 261).
The accident pilot was experienced in the type of operation and had flown to Bathurst Harbour many times, including recently, although it was unknown how many flights were via the portals. The pilot was also aware of the changing weather conditions that could be experienced in the south-west.
Further, although there were some observations that the pilot liked a challenge, there was no suggestion that pilot engaged in what was considered to be risky behaviour. More so, the pilot was considered a good decision maker who was willing to turn back when the weather conditions were adverse and had done so in the past.
While the actual conditions perceived by the pilot were unknown, based on the above, it was reasonable to conclude that the pilot would not have deliberately chosen to fly in adverse weather conditions. As noted by Hunter, et al. (2003), ‘meteorological conditions may change rapidly and generally require a continuous reappraisal and reinterpretation of the information available’. This not only highlights the dynamic nature of the aviation environment, but the challenges faced by pilots with in-flight weather-related decision-making. Despite this, given the surrounding mountainous terrain, the cloud evident in the area around the time of the accident would have limited the options available for the pilot to exit the valley.
South-west operations guidance
At the time of the accident, Airlines of Tasmania did not have formal procedures for their south‑west operations. Rather, most of the guidance was being provided informally during in‑command under supervision flights. According to the International Civil Aviation Organization (2015), standard operating procedures ‘are universally recognized as being basic to safe aviation operations’. They are designed to help reduce variation within a given process and ensure operations are performed correctly. Without formal procedures, pilots are required to exercise judgement to the best of their abilities, based on their experience, skills and knowledge.
In this case, if the weather was suitable at Cambridge, the operator’s pilots were strongly encouraged to depart to assess the weather in-flight, even if the forecast indicated they might not be able to get through. However, the pilots reported having a different understanding of how far to continue with the direct route through the portals when deteriorating weather conditions were encountered and what the decision points were.
This was evident from the pilot interviews and the ATSB’s analysis of the Spidertracks data for the south-west flights, where approaching the portals, some flights diverted down the valleys and tracked to the coast (including the accident pilot 1 month earlier), while others tracked over Federation Peak. There was also mention of passing through the portals to have a look. As previously highlighted by the Civil Aviation Authority of New Zealand, pilots should ensure they have an escape route when flying in mountainous terrain. However, noting that this route was typically chosen when lower cloud was present, some of these flights potentially limited the pilot’s escape options if the conditions had deteriorated.
In addition, despite encouraging their pilots to commence a flight, even when the forecasts indicated they may likely encounter adverse weather conditions en route, the operator did not provide any formal guidance on recovery options in the case of inadvertent entry into instrument meteorological conditions. This, combined with the changing weather conditions in the mountainous terrain in the south-west, lack of accurate localised forecasts, and the operator’s option of a low-cloud base route through the Arthur Range might suggest that an effective recovery procedure should be considered.
Such a procedure should not be seen as routinely applicable to such operations, nor as a replacement for sound pre-flight planning and in-flight decision-making. However, while the investigation into a controlled flight into terrain (CFIT) in Kokoda, Papua New Guinea noted that it was not practical to capture all possible scenarios in a procedure, in the south-west context, it could offer a final safety defence against CFIT. Having documented guidance for pre-flight assessment of weather, consideration of minimum continuation VFR altitudes and en route decision points would assist pilots with in-flight weather‑related decision-making. However, while it was unlikely that the pilot would have chosen to fly in adverse weather, without an appreciation of the pilot’s decision-making process at the time based on the actual conditions they encountered, the ATSB was unable to determine if having such documented guidance would have prevented this accident.
Hazard identification
As part of their safety management system (SMS), Airlines of Tasmania had some risk management practices in place, including regular safety committee meetings and the use of the hazard register. While the ATSB’s review noted that new hazards were discussed in these meetings, this, along with the register, predominately relied on safety occurrence reports for hazard identification. That practice was generally consistent with the operator’s SMS manual where the risk management process appeared to focus more on safety occurrence reports.
It was noted that other potential sources of safety information for hazard identification were also mentioned in the manual. However, the Civil Aviation Safety Authority (CASA) had also identified repeat findings relating to the limited scope and effectiveness of the register. As safety reports are one method (reactive) for identifying hazards, this may not reflect the likely risks of all their operational activities.
While adverse weather conditions were a known hazard in their south-west operations, there were very few safety occurrence reports relating to this in the register. For example, analysis of the Spidertrack data and pilots’ reports identified a number of occurrences of diverting, turning back or conducting a round trip due to the prevailing weather conditions. However, there were only two weather-related reports in the register over a 5-year period. In part, this may have been due to the differing understandings among the pilots about when to report such events. Irrespective, this emphasises the importance of utilising multiple methods of hazard identification.
Furthermore, there was limited records of the operator utilising proactive or predictive methods for assessing the risks of current operations, including flights to the south-west. The internal audit conducted in early 2018 also noted that a formalised risk assessment for all operations had not been recently performed.
While related to low flying operations, a previous ATSB investigation of an accident involving the same operator (AO-2014-192) also identified areas for improvement regarding risk identification. However, the ATSB also recognises that the operator had made a number of enhancements to their SMS since that accident.
Another ATSB investigation (AO-2009-072) similarly found that another operator extensively relied on hazard and incident reporting, and, while improving, they did not have adequate proactive and predictive SMS processes in place.
It was acknowledged that the operator of VH-OBL had introduced equipment to improve pilot awareness of the weather conditions in the south-west and allowed flights to be monitored. However, there was no record of any continuous monitoring to evaluate whether these controls were working as intended. Monitoring the effectiveness of the risk controls in place, as part of continuous improvement, is another key component of an SMS (safety assurance).
Although the SMS processes and practices were not considered to have contributed to the accident, primarily using one method of hazard identification limited the operator’s ability to identify and address associated risks across all operational activities. This was also a missed opportunity for the operator to evaluate the ongoing effectiveness of existing risk controls.
Regulatory management of repeat safety findings
In the 4 years prior to the accident, CASA had issued a number of safety findings to the operator about their SMS, including the risk register. As some of these findings were applicable to the same regulation and were identified across different surveillance events, these had become repeat findings. As a result, the operator had been referred to CASA coordinated enforcement.
For example, there were repeat findings identified in 2016 and 2017 regarding the risk register (NCN 715369 and SF 718040 respectively). When the operator provided evidence to CASA indicating action had been taken against the 2017 finding, both findings were acquitted in early 2018, 9 months prior to the accident. However, the ATSB’s review established that the specific details of the deficiencies identified in each finding differed. Further, CASA did not appear to have all the required evidence to assess the earlier finding. Therefore, some of the deficiencies identified in this finding had not been fully addressed when acquitted. This was supported by the subsequent results of the 2018 internal audit and the ATSB’s post-accident SMS review, where similar deficiencies were still present.
The CASA surveillance manual provided comprehensive material on the acquittal process for individual safety findings. However, aside from referring the authorisation holder to coordinated enforcement, there was limited guidance to CASA staff on how to manage and acquit repeat findings. This was consistent with comments received from CASA personnel who also mentioned that only the most recent finding would be acquitted for repeat findings.
While it was noted that there were some controls in place to address this shortcoming, such as the surveillance team oversight, and the surveillance planning and scoping worksheets used in preparation for a surveillance event, these were not fully effective. Therefore, without providing specific guidance, CASA’s acquittal process was not effective in ensuring that all previous findings of a similar nature were appropriately assessed before being acquitted.
No recent safety systems surveillance
In 2017 and 2018, the operator was under CASA coordinated enforcement due to repeat safety findings relating to the SMS. Despite this, CASA conducted only one formal surveillance event in 2018. In addition, records provided to the ATSB indicated that the SMS was not assessed as part of that event. Although it was noted that there were ongoing communications between CASA and the operator, which included two regulatory services for the approval of the safety manager, and review of changes to the SMS manual, an event scheduled for late 2018 had been cancelled. As there were no surveillance planning and scoping worksheets available for these events, the ATSB was unable to establish if either would have considered the SMS. Similarly, the CASA post‑accident safety assurance review mentioned that there was regular contact with the operator, however, ‘opportunities to focus surveillance on the SMS outputs of the operator were not fully realised’.
In addition, the CASA surveillance manual stated than an authorisation holder performance indicator assessment should be conducted every 6 months or if there was a significant change in the organisation, such as the acquittal of safety findings. However, despite this, and the fact that the operator’s last assessment had a high score, key personnel had changed, and there had been a revision of the SMS, no assessment was conducted on the air operator’s certificate in 2018.
Previous ATSB investigations have identified deficiencies with CASA surveillance activities, including not conducting systemic or detailed audits, or not considering the nature of the operator’s activities. For VH-OBL, no formal surveillance events relating to the SMS had been conducted in the year prior to the accident, nor had an authorisation holder performance indicator assessment been undertaken. These were missed opportunities for CASA to prioritise surveillance activities, to monitor the ongoing safety health of the operator, assess the effectiveness of the SMS in the time since the repeat safety findings had been acquitted, and identify additional potential areas for improvement.
Lack of recorded data
There was no regulatory requirement for the aircraft to be fitted with a cockpit voice recorder or flight data recorder. However, this, and previous investigations, have shown that a lack of such devices has hampered the determination of factors that contributed to the accident. In turn, important safety issues that present a hazard to current and future operations were potentially not identified. Conversely, other investigations where some form of recording device was on board, provided valuable information regarding the accident.
In this investigation, the ADS-B data provided important information about the aircraft’s flight track. However, ultimately, the ATSB was unable to determine the exact circumstances of the accident. This included what the weather conditions were as the aircraft approached the portals and how this influenced the pilot’s decision to continue, or what occurred in the cockpit.
The use of lightweight recorders on smaller aircraft conducting commercial operations has the potential to provide a relatively simple and cost-effective way of achieving many of the benefits that are provided by traditional recorders fitted to large aircraft.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual
From the evidence available, the following findings are made with respect to the controlled flight into terrain involving Pilatus Britten-Norman BN2A, VH-OBL, 101 km west-south-west of Hobart, Tasmania, on 8 December 2018.
Contributing factors
The pilot continued descending over the Arthur Range saddle to a lower altitude than previous flights, likely due to marginal weather. This limited the options for exiting the valley surrounded by high terrain.
While using a route through the Arthur Range due to low cloud conditions, the pilot likely encountered reduced visual cues in close proximity to the ground, as per the forecast conditions. This led to controlled flight into terrain while attempting to exit the range.
Other factors that increased risk
Airlines of Tasmania did not provide any documented guidance for the south-west operations, despite encouraging pilots to commence the flight, even when forecasts indicated they may be likely to encounter adverse weather en route. This resulted in the pilots having varied understanding of the expectations regarding in‑flight weather‑related decision making at the Arthur Range saddle, and increased the risk that some pilots continued into an area of high terrain in marginal conditions, where options to escape were limited. (Safety issue)
Airlines of Tasmania's safety management processes for identifying hazards extensively relied on safety reports. This limited the opportunity to proactively identify the risks in all operational activities and assess the effectiveness of existing risk controls. (Safety issue)
The Civil Aviation Safety Authority’s acquittal process for repeat safety findings was not effective in ensuring that all previous findings of a similar nature were also appropriately assessed prior to being acquitted. (Safety issue)
The Civil Aviation Safety Authority did not conduct any formal surveillance activities related to the operator's safety management system, including an authorisation holder performance indicator (AHPI) assessment for the year before the accident. This was despite a history of repeat findings related to the safety management system and the previous AHPI assessments indicating increased risk. This was a missed opportunity to monitor the ongoing effectiveness of the system and identify additional areas for improvement.
General finding
While flight tracking data was available, the aircraft was not fitted with an onboard recording device. This would have provided valuable information to better understand the pilot’s in-flight weather-related decision-making.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions will be provided separately on the ATSB website on release of the final investigation report, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website after the release of the final report as further information about safety action comes to hand.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Safety issue description: Airlines of Tasmania did not provide any documented guidance for the south-west operations, despite encouraging pilots to commence the flight, even when forecasts indicated they may be likely to encounter adverse weather en route. This resulted in the pilots having varied understanding of the expectations regarding in‑flight weather‑related decision making at the Arthur Range saddle, and increased the risk that some pilots continued into an area of high terrain in marginal conditions, where options to escape were limited.
Safety issue description: Airlines of Tasmania's safety management processes for identifying hazards extensively relied on safety reports. This limited the opportunity to proactively identify the risks in all operational activities, and assess the effectiveness of any controls in place.
Safety issue description: The Civil Aviation Safety Authority’s acquittal process for repeat safety findings was not effective in ensuring that all previous findings of a similar nature were also appropriately assessed prior to the current and all associated safety findings being acquitted.
Glossary
ADS-B Automatic dependent surveillance broadcast
AGL Above ground level
AHPI Authorisation holder performance indicator
ALA Aeroplane landing area
AMSL Above mean sea level
AOC Air operator's certificate
BoM Bureau of Meteorology
CASA Civil Aviation Safety Authority
CEP Coordinated enforcement process
CFIT Controlled flight into terrain
CSM CASA surveillance manual
EDT Eastern Daylight-saving Time
GPS Global positioning system
ICUS In-command under supervision
IMC Instrument meteorological conditions
METAR Meteorological aerodrome report
NAIPS National Aeronautical Information Processing System
NSSP National surveillance selection process
NTSB National Transportation Safety Board
SMS Safety management system
TAF Terminal aerodrome forecast
UTC Coordinated Universal Time
VFR Visual flight rules
Sources and submissions
Sources of information
The sources of information during the investigation included:
Airlines of Tasmania
Civil Aviation Safety Authority
Tasmania Police
Airservices Australia
Bureau of Meteorology
Spidertracks
Aireon
Flight Aware.
References
Alabaster, C. B., 2000. Golden Rules for Operations in Mountainous Areas. In: D. o. F. S. -. A. D. Force, ed. Operations in Tropical Mountainous Areas. Fourth ed. Laverton: Defence Publishing Service, p. 55.
ATSB, 2005. General aviation pilot behaviours in the face of adverse weather, Canberra: Australian Transport Safety Bureau.
ATSB, 2007. CFIT: Australia in context 1996 to 2005, Canberra: Australian Transport Safety Bureau.
Bearman, C., Paletz, S., Orasanu, J. & Brooks, B., 2009. Organizational Pressures and Mitigating Strategies in Small Commercial Aviation: Findings from Alaska. Aviation Space and Environmental Medicine, pp. 1055-1058.
Civil Aviation Authority, 2014. CAP 795 Safety Management Systems (SMS) guidance for organisations, London: CAA.
Civil Aviation Safety Authority, 2007. Safety Management Systems: An Aviation Business Guide, Australia: CASA.
Civil Aviation Safety Authority, 2018. CAAP SMS-01 v1.1 Safety Management Systems for Regular Public Transport Operations, Canberra: CASA.
Hunter, D., 2006. Risk Perception Among General Aviation Pilots. The International Journal of Aviation Psychology, pp. 135-144.
International Civil Aviation Organization, 2015. Model advisory circular for air operator's: Standard Operating Procedures for Flight Deck Crewmembers, Montreal: ICAO.
International Civil Aviation Organization, 2018. Safety Management Manual, fourth edition, Montréal: International Civil Aviation Organization.
McMurtie, K. & Molesworth, B., 2017. The Variability in Risk Assessment Between Flight Crew. The International Journal of Aerospace Psychology, pp. 65-78.
National Transportation Safety Board, 2005. Risk factors associated with weather-related general aviation accidents (Safety Study: NTSB/SS-05/01), Washington: National Transportation Safety Board.
Orasanu, J. M., 2010. Flight Crew Decision-Making. In: Crew Resource Management. s.l.:s.n., pp. 147-179.
Orasanu, J., Martin, L. & Davison, J., 2001. Cognitive and contextual factors in aviation accidents: decision errors. In: E. Salas & G. Klein, eds. Linking Expertise and Naturalistic Decision-Making. New York: Psychology Press.
Ortiz, Y., Blickensderfer, B. & King, J., 2017. Assessement of General Aviation Cognitive Weather Tasks: Recommendations for Autonomous Learning and Training in Aviation Weather. s.l., s.n., pp. 1861-1865.
Reason, J., 1998. Achieving a safe culture: theory and practice. Work & Stress, 12(3), pp. 293-306.
Shuch, P., 1992. The Influence of Flight Experience on Midair Collision Risk Perception. Accident Analysis and Prevention, pp. 655-660.
Wiegmann, D. & Goh, J., 2000. Visual Flight Rules (VFR) Flight into Adverse Weather: An Empirical Investigation of Factors Affecting Pilot Decision Making, Savoy: Aviation Research Lab Institute of Aviation.
Wiggins, M. et al., 2014. Cue-utilisation typologies and pilot's pre-flight adn in-flight weather decision-making. Safety Science, pp. 118-124.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Airlines of Tasmania
Civil Aviation Safety Authority
Bureau of Meteorology
United States National Transportation Safety Board
United Kingdom Air Accidents Investigation Branch.
Submissions were received from:
Airlines of Tasmania
Civil Aviation Safety Authority
Bureau of Meteorology
United Kingdom Air Accidents Investigation Branch.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendix
Appendix A – Summary of CASA surveillance activities for Airlines of Tasmania between 2014-2018
Date
Activity
Notes
20-21 February 2014
Level 2 - Operational check (other)
Scope of audit included safety policy, objectives and planning, safety risk management, safety assurance, and safety training and promotion.
7 May 2014
Level 2 - Operational check (manual review)
Review of documents and training in relation to the transition into the new Civil Aviation Order 48.1 duty and flight time limitations for regular public transport and charter.
1 August 2014
Level 2 - Operational check (site inspection)
Reviewing change to runway designation. Recommendation to review the SMS at next available opportunity.
6 August 2014
Level 2 - Operational check (site inspection)
On-site surveillance of the operator’s regular public transport port.
20-23 October 2014
Level 1 - Systems audit
Four safety systems of the safety system were reviewed: safety policy and objectives, safety promotion, safety assurance, and safety risk management.
3 December 2014
Level 2 - Operational check (manual review)
Review of operations manual amendment.
1-2 April 2015
Level 2 - Operational check (other)
Inspections related to the accident involving VH-PFT on 29 December 2014.
2 June 2015
Level 2 - Operational check (site inspection)
Dangerous goods inspection.
30 June-1 July 2015
Level 2 - Operational check (site inspection)
Ground operations inspection.
30 July 2015
Level 2 - Operational check (ramp check)
Aircraft ramp inspection.
30 October 2015
Level 2 - Operational check (site
inspection)
Aircraft and dangerous goods inspection.
28 April 2016
Level 2 - Operational check (en route check)
Route check from Cambridge - Wynyard.
13-15 September 2016
Level 1 - Health check
Scope included AOC operations, flight system, crew scheduling, operational standards, safety policy, objectives and planning; safety risk management; safety assurance and safety training and promotion.
1 August 2017
Level 2 - Operational check (en route check)
Surveillance of the Launceston - Cape Barren Island RPT service.
11-13 July 2017
Level 1 - Systems audit
(including CASR Part 42 Continuing Airworthiness Management Organisation and Part 145 Approved Maintenance Organisation).
To interview safety manager. Included audit of SMS.
16 October 2018
Level 2 - Operational check
Sector surveillance – aeromedical, transport training and checking organisation.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 04/02/2019
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
What happened
On 8 December 2018, a Pilatus Britten-Norman BN-2A-20 Islander, registered VH-OBL, operated by Par Avion, was conducting a positioning leg under the visual flight rules[1] from Cambridge Aerodrome to Bathurst Harbour, Tasmania. The aircraft departed the aerodrome at 0748 Eastern Daylight Time (EDT),[2] and was scheduled to arrive at Bathurst Harbour about 0845 to pick up five passengers for the return flight to Cambridge Aerodrome.
At 0829, the Australian Maritime Safety Authority (AMSA) received advice that an emergency locator transmitter (ELT) allocated to VH-OBL had activated. AMSA advised the Tasmanian Police and the aircraft operator of the activation, and initiated search and rescue efforts. The rescue efforts included two helicopters and a Challenger 604 search and rescue jet aeroplane. The Challenger arrived over the beacon signal location at around 0925; however, due to cloud cover it was unable to visually identify its precise location. Multiple attempts were made throughout the day to locate the accident site, however, due to low-level cloud, the search and rescue operation was unable to confirm visual location of the aircraft until about 1900. The aircraft wreckage was located in mountainous terrain near the Western Arthur Ranges in the Southwest National Park. The search and rescue crew determined that the accident was unlikely to have been survivable. The search and rescue helicopter crew considered winching personnel to the site; however, due to a number of risks, including potential for cloud reforming, the time of day and lighting, and other hazards associated with the mountainous location, the helicopter departed the area. The aircraft wreckage was accessed the following day, when it was confirmed that the pilot, the sole occupant of the aircraft, was fatally injured.
Position and altitude information was obtained from FlightAware, which recorded a combination of ADS-B[3] and Spidertracks[4] data. The data showed the aircraft tracking to the southwest towards Bathurst Harbour (Figure 1). At approximately 0816, the aircraft entered a valley near the West Portal in the Western Arthur Ranges and proceeded to conduct a number of turns. The final ADS‑B data point recorded was at 0828.
Figure 1: Track of VH-OBL from Cambridge Aerodrome towards Bathurst Harbour, showing the accident location
Source: Google earth and FlightAware, modified by ATSB
Site and wreckage
ATSB investigators travelled to Hobart, Tasmania as part of this investigation. However, due to the remote location and access difficulties, and other risks associated with the mountainous location of the wreckage, the ATSB did not attend the accident site. Investigators conducted numerous interviews, gathered relevant information and worked closely with the Tasmanian Police to gain an understanding of the accident. A number of items recovered from the wreckage and detailed photographs by the Tasmania Police forensic investigators will be examined by the ATSB.
Figure 2: Accident location of VH-OBL in the Western Arthur Ranges
Source: Tasmania Police
Pilot information
The pilot held a current Commercial Pilot Licence (Aeroplane) and had completed a flight review on 25 May 2017. The pilot also held a Class 1 Aviation Medical Certificate that was valid until 26 February 2019. The available information indicated that the pilot had about 540 hours total aeronautical experience, with 82.5 hours on Islander aircraft.
Ongoing investigation
The investigation is continuing and will include examination of the following:
recovered components and available electronic data
aircraft maintenance documentation
weather conditions
pilot qualifications and experience
operator procedures
research and previous occurrences.
Acknowledgements
The ATSB acknowledges the support of Tasmania Police for their assistance during this investigation.
_______________
The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this report. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 18 August 2018, a CZAW SportCrusier aircraft registered G-CGJS, fitted with a Jabiru engine, experienced an engine failure after take-off from Clacton-on-Sea Airport, Essex, England. The pilot conducted a forced landing into a nearby field. There were no injuries to the pilot or passenger. The United Kingdom Air Accident Investigation Branch (AAIB) conducted an investigation into this occurrence.
As Australia is the State of Manufacture of the engine type involved, the AAIB requested an Accredited Representative from the Australian Transport Safety Bureau (ATSB) be appointed.
To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.
On 2 May 2019, the AAIB advised the ATSB that the final investigation report was due for release and ATSB assistance was no longer required.
On the morning of 24 November 2018, the pilot and passenger of a Robinson R22 helicopter, registered VH-KZV, were tasked to assist with the recovery of a motor vehicle near Quartz Hill, located about 63 km east-north-east of Ambalindum Station (departure point), Northern Territory. They were also intending to visit some water bore sites.
After departing, they landed at one bore site before continuing towards Quartz Hill. Shortly after entering the MacDonnell Ranges, the helicopter collided with terrain on a downslope (125 km east-north-east of Alice Springs Airport). The pilot was fatally injured and the passenger received serious injuries. The helicopter was destroyed.
What the ATSB found
The ATSB found that the collision with terrain was very likely the result of the helicopter encountering a strong downdraft while low flying on the lee side of higher terrain in the MacDonnell Ranges. In addition, the ATSB identified a number of factors of increased risk.
Other factors of increased risk included that it was very likely the helicopter was overloaded and beyond the forward centre-of-gravity limit, which would have reduced the helicopter’s power margin and flight control available to the pilot. Secondly, there was moderate turbulence forecast at the time of the accident and the pilot did not check the weather forecast prior to departure. Thirdly, the pilot had an elevated level of alcohol in his system, which was capable of impairing his performance, and increased the likelihood of risk-taking behaviour and mishandling the helicopter in an emergency. Lastly, the helicopter’s emergency locator transmitter was selected ‘OFF’, disabling the automatic crash-activation of an emergency signal.
Safety message
It is important for all pilots to understand that flight planning and prescribed operating limits are safety barriers designed to provide a reasonable margin of safety. Thorough pre-flight planning is essential for avoiding hazardous weather conditions. It is not only important to obtain the relevant weather information to develop a mental picture of the conditions that may be encountered, but also to assess and understand how it relates to the planned flight.
Further, as the helicopter weight and balance has the potential to influence the handling characteristics, it is critical that the loading remains within the prescribed operating limits for the entire flight. Otherwise, as the safety margin steadily erodes, even an experienced pilot may not be able to recover from a rapidly developing unsafe condition.
At low altitude, there is a lower margin for error due to obstacle avoidance. Recognising the risks and hazards of low-level flying, it should be avoided when there is no operational requirement, even if a pilot has been trained and approved to conduct low-level operations. Further information is available from the ATSB publication: Avoidable Accidents No. 1 – Low-level flying.
This accident is also a reminder that blood-alcohol can persist the day after significant alcohol consumption, and the residual effects of alcohol may impair performance, especially in demanding situations.
The occurrence
On the morning of 24 November 2018, the pilot and passenger of a Robinson R22 helicopter, registered VH-KZV, were tasked to assist with the recovery of a motor vehicle near Quartz Hill, located about 63 km east-north-east of Ambalindum Station (departure point), Northern Territory. The pilot was employed by the Ambalindum cattle station for general flying duties, which included cattle mustering and inspecting water bore sites. As such, the pilot was also intending to visit some water bore sites.[1]
At about 0715 Central Standard Time,[2] the pilot refuelled the helicopter with the remaining contents of a fuel drum. A station-hand assisted with preparing the helicopter for departure, which included providing the pilot and passenger with a 20 L drum filled with diesel fuel. The station‑hand reported that this was stored at the passenger’s feet (tail rotor pedals position). He also reported that the weather appeared to be fine for the departure.
At 0732, the pilot’s global positioning system device was powered on while the helicopter was on the concrete helipad in front of the station homestead’s facilities. At 0737, the helicopter departed from the helipad and conducted an air transit to the worker’s accommodation block. The helicopter was on the ground next to the accommodation for 2.5 minutes before it departed from Ambalindum Station. The helicopter flew on a direct track at a height of between 500 and 1,000 ft across relatively open and flat terrain to a bore site, which was located near the boundary of the more rugged terrain of the MacDonnell Ranges.
The pilot and passenger stopped at the bore site[3] for 2 minutes and departed at 0753:50. On departure, the helicopter was levelled off at about 150 ft above ground level, which was below the peaks of the surrounding terrain as it tracked into the MacDonnell Ranges. The last recorded data point was at 0756:30, at which time the helicopter was about 142 ft above ground level with a ground speed of 79 kt. About 56 seconds later (based on the ground speed), the helicopter collided with terrain.
The passenger could not recall any details of the flight, but remembered activating the pilot’s Spot Tracker[4] device after the accident. At 0811, it transmitted its location in SOS mode. A helicopter company in Alice Springs was tasked by the Australian Maritime Safety Authority’s Joint Rescue Coordination Centre (JRCC) to transport a paramedic to the location and attempt a search and rescue (SAR). Ambalindum Station, which was also notified of the activation of the Spot Tracker device, dispatched two employees, the general manager and a station-hand, by road to investigate.
The SAR pilot located the helicopter wreckage at the reported location (Figure 1) and dropped the paramedic nearby to attend to the accident pilot and passenger. The SAR pilot then ferried the two station employees to the accident site. At about 1040, the paramedic found the pilot fatally injured and the passenger seriously injured. The SAR pilot and paramedic, with the assistance of the station employees, retrieved the passenger and transported him to Ambalindum Station for treatment by a retrieval doctor, before moving him to Alice Springs Hospital for further medical attention. The helicopter was destroyed.
The pilot was issued with a Private Pilot Licence (Helicopter) on 10 June 2014 with an endorsement for the Robinson R22 helicopter (R22) under the Civil Aviation Regulations 1988 Part 5 (CAR 5) licencing system. He held a Class 2 aviation medical certificate with an expiration date of 2 February 2020, with the restriction of ‘Reading Correction to be available whilst exercising the privileges of his licence’. His last flight review was completed in February 2018.
On his employment application letter to Ambalindum Station in January 2018, the pilot reported having a total flying experience of 10,000 hours in gyrocopters, 350 hours in the (amateur-built) Cicaré CH-7 helicopter and 800 hours in the R22. At the time of his last medical examination in February 2018, he reported having accrued 800 flying hours. The pilot’s personal diary indicated he had accumulated about 470.5 hours in his current job, which suggested he had about 1,270 hours in the R22.
Validity of qualifications
On 1 September 2014, the Civil Aviation Safety Regulations 1998, Part 61 pilot licencing system was introduced to replace the CAR 5 system. Part 61 included licencing, ratings and endorsements, and provided pilots with a 4‑year period to transfer a CAR 5 licence to a Part 61 licence. In the period 27–29 October 2014, the pilot received low-level and aerial mustering flying training, with an endorsement made by the approved training officer in the pilot’s logbook and on a copy of Appendix II to Civil Aviation Order (CAO) 29.10 (2006): Air service operations – aircraft engaged in aerial stock mustering operations – low flying permission.
On 3 December 2014, the Civil Aviation Safety Authority (CASA) issued the pilot with an approval to conduct aerial stock mustering operations in helicopters under CAO 29.10 subparagraph 6(a). However, subsection 6 of this order was amended on 1 September 2014 by Civil Aviation Order (Flight Crew Licencing) Repeal and Amendment Instrument 2014 (No. 1). The amendment stated that ‘A pilot must not engage in aerial mustering operation unless the pilot is authorised under Part 61 of the Civil Aviation Safety Regulations 1998 to conduct an aerial mustering operation in that kind of aircraft’. Therefore, an approval under CAO 29.10 could no longer be granted. The equivalent authorisation under Part 61 was a low-level rating and mustering endorsement, in accordance with the Part 61 Manual of standards.
During the transition period, the pilot made an application for a Part 61 licence, but with evidence of a mustering endorsement conducted after 1 September 2014 in accordance with CAO 29.10, rather than the Part 61 Manual of standards. Therefore, his Part 61 licence was not issued and he was advised by CASA to resubmit his application with completed forms 61-2I: Notification of issue of CASR Part 61 Operational Rating, and 61-1507: Low-level rating flight test. Completed copies of these forms were required to provide evidence that his CAO 29.10 training complied with the Part 61 Manual of standards requirements for a low-level rating and mustering endorsement. However, CASA did not receive a copy of these forms and never issued the pilot with a Part 61 licence. The pilot was required to hold a Part 61 licence from 1 September 2018 for his licence to be valid.
72-hour history
The pilot’s diary indicated that the accident occurred on his third day of work after 5 days leave. There were no flying hours recorded 2 days prior to the accident, but there was an entry of ‘Chopper going…4 hours’ the day prior to the accident, which suggested this was flight time. There was no indication from his diary or from his colleagues that he was working excessive hours in the week prior to the accident.
The evening prior to the accident, the pilot and station-hands had a ‘few’ alcoholic drinks before and after dinner, and then retired to their private rooms. The evening drinks were reported to be a normal habit and that nothing unusual occurred.
Helicopter information
General description
The helicopter was a two-seat Robinson R22 Beta 2 powered by a Textron Lycoming 4-cylinder O-360-J2A engine. It was manufactured in the United States in January 2010 and registered in Australia in February 2010. It was acquired by the owners on 2 August 2018.
Drive system
The engine has a V-belt sheave bolted directly to its output shaft. V-belts transmit power to the upper sheave, which has an overrunning clutch contained in its hub. The inner shaft of the clutch transmits power forward to the main gearbox, which drives the main rotors, and aft to the tail gearbox, which drives the tail rotors. Flexible couplings are located at the main gearbox input and at each end of the tail rotor drive shaft.
The V-belts are tensioned for flight after engine start by raising the upper sheave. An electric actuator, located between the drive sheaves, raises the upper sheave when the pilot engages the clutch switch. The actuator senses belt tension and automatically switches off when the V-belts are properly tensioned.
Fuel system
The helicopter was fitted with two fuel tanks, a main and an auxiliary, located behind the main rotor mast. Total usable capacity is 100 L (main – 64 L, auxiliary – 36 L). The auxiliary tank is interconnected with the main tank and with its base elevated relative to the base of the main tank, so that the auxiliary will empty first.
Maintenance
The helicopter was issued with its last maintenance release[5] on 12 October 2018, when it completed its last 100-hourly inspection, with 7,000 hours’ time-in-service. Additional work during the 100-hour inspection included replacing the number 1 cylinder, two tail rotor pitch change levers and re-rigging the main rotor flight controls. The maintenance organisation reported that the helicopter had completed four 100-hourly inspections since the last 2,200-hour major overhaul. The organisation’s licenced aircraft maintenance engineer (LAME) had completed the last two of those four inspections (since it was acquired by the new owners) and indicated that the helicopter was overall in good condition.
On 23 November 2018, the day before the accident, the LAME[6] went to Quartz Hill to replace the electric actuator fitted to the helicopter. The actuator and V-belts were replaced, followed by a cooling fan balance. No maintenance release was provided to record the work, but the pilot reported to the LAME that the helicopter had accumulated about 15 hours since the last 100‑hourly inspection. The LAME returned to Alice Springs with the understanding that the pilot would phone that evening with the actual hours but did not hear from him.
Meteorological information
When transporting the passenger from the accident site to Ambalindum Station, the SAR pilot asked him what happened. Neither the SAR pilot nor the paramedic were certain of the passenger’s reply and the passenger had no recollection of the conversation. However, the paramedic recalled words to the effect that the ‘wind lifted them up’, that the pilot had said to him (passenger) ‘look at this [expletive]’, ‘and we were lifted up in the air’. The SAR pilot recalled the passenger indicated that the accident pilot had told him they ‘better pull-up to get a bit more height/air to make it safer’.
Planning
The station homestead had a local Wi-Fi network, so that the workforce could use their personal electronic devices, and computers located in the office area. The general manager for the company, who was at the station at the time, reported that the office computers were for management staff and not a common access area. The pilot would have been granted access to use them for flight planning purposes, but he had not requested access and the manager was not aware of him ever using them. The ATSB reviewed the pilot’s iPad and iPhone. A review of applications and browsing history on the iPad and iPhone found no evidence that either was used to access any aviation-related applications or aviation-related services (such as the Bureau of Meteorology) on either the day of, or day prior, to the accident. However, both were in use in the week of the accident.
Weather forecast
The Bureau of Meteorology graphical area forecasts valid between 0230 and 1430 on 24 November included moderate turbulence below 7,000 ft above mean sea level throughout the area. The aerodrome forecast for Alice Springs Airport[7] (about 125 km east-north-east of the accident site), issued at 0249 and valid from 0330 24 November to 0330 25 November, reported CAVOK[8] conditions, but with a wind of 18 kt, gusting to 28 kt, from 320°. In addition, the remarks included moderate turbulence below 5,000 ft above mean sea level from 0630.
Reported weather conditions
On 24 November, the recorded aerodrome weather report for Alice Springs Airport between 0600 and 0730 indicated a wind direction of 330–340° at about 15 kt. However, at 0758, SPECI[9] conditions were recorded with a wind speed of 18 kt, gusting to 29 kt. The Arltunga weather station, located about 40 km east of the accident site, recorded a wind speed of 14 kt[10] from a direction of 360°, QNH 1015 hPa[11] and a temperature of 30 °C, at 0800.[12] The Ambalindum Station personnel interviewed by the ATSB reported that the weather was fine and clear in the morning at the station.
The SAR pilot reported that engine start in his Bell 206 at Alice Springs Airport was at 0940. He reported that the weather was turbulent all the way out to the accident site, and estimated it was moderate to severe in the ranges with a wind speed of 20 kt, gusting to 40 kt. He reported that, on arrival at the accident site he encountered a strong downdraft at about 100 ft above ground level.
The SAR pilot also stated that he took three approaches to land due to the turbulence at the accident site with the paramedic but could not remember what occurred when he subsequently ferried the station‑hand and general manager into the site. The paramedic recalled only one approach to land, but the station-hand recalled they took three approaches to land, that the helicopter was being thrown around and that the SAR pilot had warned him about downdrafts. The general manager recalled they took one approach but was aware that the pilot was concerned about the flying conditions.
The station-hand recalled that, while on the ground at the accident site, he felt the wind tunnelling down the ravine. He reported that it was cycling from ‘nothing, to heavy wind to slight breeze, then nothing’. In consideration of the weather forecast and reports, the ATSB requested analysis from the Bureau of Meteorology for the likelihood of mountain or lee wave activity in the area at the time of the accident.
Bureau of Meteorology analysis
The Bureau of Meteorology reported the following:
The mean sea level pressure chart for the morning of the accident showed a deep trough and low-pressure system moving into the central and southern parts of the Northern Territory from Western Australia. Conditions ahead of the trough saw moderate to fresh north-east to north-west winds. The synoptic pattern was conducive to moderate turbulence, and, particularly after sunrise, gusty and turbulent flow was anticipated as the stronger winds from aloft mixed to the surface.
At the ridge-top level of the ranges north of Alice Springs, approximately 2,000 ft to 4,000 ft above mean sea level, the winds observed at 0830 on 24 November were 25 kt. The strong north to north-west winds, being perpendicular to the ranges, were conducive to mechanical turbulence, especially in the lee of the ranges. The height of the ridge being over 1,000 ft, and the strength of the winds perpendicular to the ridge being over 25 kt, indicated the necessary requirements for the occurrence of mountain waves.
The aerological diagram showed the wind strength increasing with height above the height of the ridge, as well as instability in the atmosphere above ridge-top level. However, no evidence was found for mountain waves in the cloud patterns observed on the satellite imagery. Therefore, the occurrence of mountain waves remained inconclusive.
The breaking of an inversion layer can also be associated with moderate turbulence. The onset of gusty conditions at Alice Springs Airport at 0758 indicated the overnight inversion would have broken by then, with stronger winds aloft mixing down. Broadscale moderate turbulence was especially likely at that time.
Terrain-induced turbulence
According to the United States Federal Aviation Administration (2016) Pilot’s handbook of aeronautical knowledge, ground topography can break up the flow of the wind and create wind gusts that change rapidly in direction and speed. While the wind may flow smoothly up the windward side of higher terrain, on the leeward side it attempts to follow the contour of the terrain and is increasingly turbulent. The stronger the wind, the greater the downward pressure and turbulence. The downdrafts can be severe in valleys due to the effect of the terrain. Hence, it is recommended to avoid flying in this area when strong winds are present or likely to occur. Figure 2 depicts the potential wind conditions on the lee (right) side of terrain.
Figure 2: Potential wind conditions on the lee side of terrain
Source: Federal Aviation Administration (2012)
Recorded information
The ATSB examined the pilot’s iPad, iPhone, GoPro camera and GPS devices. There was no evidence that the iPhone was in use at the time of the accident and no location data was available to create a flight path.[13]
Global positioning system data
Data was recovered from the pilot’s GPS device. The flight profile on the day before the accident (23 November) revealed the pilot had been flying back-and-forth along a dry riverbed at low‑level (below 200 ft) near Quartz Hill. The helicopter then tracked back‑and‑forth between Quartz Hill and Ambalindum Station. The last sector recorded an arrival time at Ambalindum Station helipad of 1815.
For the accident flight, the first recorded data point was from the helipad at 0732 (Figure 3).[14] After transiting to the workers’ accommodation block, the helicopter departed at 0740 for the bore site.
Figure 3: Departure from the homestead
Source: Google earth, annotated by the ATSB
Figure 4 shows that, about 2 minutes after taking off from the bore site, at 0755:46, the helicopter was levelled off at about 150 ft above ground level and then entered the MacDonnell Ranges. The final data point, recorded at 0756:30, was located at a height of about 142 ft, with a ground speed of 79 kt,[15] on a direct track towards the accident site. Based on this ground speed, the ATSB estimated that the time between the last data point and the accident site was 56 seconds.
Figure 4: GPS track from the bore site to the accident site
Source: Google earth, annotated by the ATSB
GoPro data
The GoPro camera did not hold a recording of the accident flight. However, a total of 69 videos and 25 images were recovered, dated from 1 January 2012 to 15 June 2016. The time and date of the GoPro can be set manually or by Wi-Fi. It could not be determined if the recorded dates were correct, but the files included videos of the accident pilot flying an R22 from a different operator. It was therefore likely that the files were from his previous employment.
The video files showed the pilot engaged in low flying and cattle mustering activities throughout the time period. They included low-level contour flying between mustering tasks, along a river and along a dry riverbed (see Figure 5 example). Mustering videos included manoeuvring the R22 at up to 50° angle of bank with indeterminable pitch changes, coupled with skidding or side-slipping[16] within about 1–2 rotor diameters of the ground.
Figure 5: Example of low flying in previous employment
Source: ATSB
Wreckage and impact information
Accident site
The accident site was in the MacDonnell Ranges at an elevation of about 1,850 ft, 31 km east of Ambalindum Station. The helicopter impacted the ground on a downslope, in an easterly direction, and continued down the slope. It then came to rest on the far side of the riverbed in a southerly direction, with the left side resting against the upslope of the far bank.
The ATSB noted there was higher terrain, orientated east-west, immediately to the north of the initial point of impact. This was the reported direction for the prevailing wind at the time of the accident.
Impact sequence
The impact sequence started with the main rotor severing the upper branches of a small tree, indicating 10–15° right bank, before the tail stinger struck a rock and was separated from the tailcone. A tail rotor blade then separated after impacting a tree branch at about the same time as the right skid contacted the ground adjacent to protruding rocks (Figure 6), which were struck by the underside of the helicopter. About half way down the slope the helicopter passed through a tree, which fragmented the cabin plexiglass and removed the front landing skid cross-tube.
Just prior to crossing the riverbed, the main rotor disc struck and separated the tail rotor driveshaft and empennage from the airframe. The empennage was located just prior to crossing the riverbed, to the right of the accident path. The driveshaft was found on the far side of the riverbed to the right of the accident path and beyond the main wreckage.
Figure 6: Impact sequence
Source: Alice Springs Helicopters, annotated by the ATSB
Wreckage examination
The helicopter’s clock had stopped at about 0756 and the engine hour-meter indicated 6,893.36 hours. The helicopter was fitted with an impact activated emergency locator transmitter (ELT), which was found selected to the ‘OFF’ position.[17] In addition to the pilot and passenger, the helicopter was loaded with:
a double-barrelled shotgun and bolt action rifle with ammunition
two six-packs of beer (no evidence that any were consumed)
empty 20 L drum (perforated, but strong diesel fuel odour)
empty 10 L water container (used for testing water flow rate at bore sites)
bore test equipment (data logger)
two webbing straps and a bag of lifting equipment
between one-third and two-thirds fuel contents in the main fuel tank and unusable fuel in the auxiliary fuel tank.[18]
The ATSB found no pre-existing defects with the rotors, drivetrain or flight controls, which would have prevented normal operation. The tail rotor driveshaft was folded by the main rotor strike. It was also noted to have been pulled apart at the intermediate and aft flex couplings (Figure 7). This indicated a loss of energy from the main rotor system occurred at some time prior to the main rotor striking the tailcone.[19] A fuel test on-site and at the point of departure did not identify any visual contaminates or water.
Figure 7: Tail rotor driveshaft
Source: ATSB
The engine and a majority of the airframe was retrieved from the accident site and transported to Alice Springs Airport where further inspections of the drivetrain and engine components were performed. No pre-existing defects were found to prevent normal operation. The engine was then removed from the wreckage and transported to Brisbane for further examination under the supervision of the ATSB.
Engine tests and inspections
On 8 and 9 January 2019, tests and inspections were conducted on the recovered engine. No fault was identified that would have prevented normal operation of the engine. Damage to the engine-cooling fan and the presence of dirt inside the number 2 cylinder indicated the engine was operating at the time of initial impact.
The V-belts were found intact and scoring damage to the V-belt actuator was identified. Robinson advised the ATSB that the length of the actuator indicated it was extended in the normal position for flight and that the scoring was consistent with the upper sheave rotating on contact with the actuator as the helicopter’s structure distorted on impact (Figure 8). This indicated that the engine was driving the V-belts and upper sheave at impact.
Figure 8: Scoring to the clutch actuator
Source: ATSB
The lower third section of the engine-cooling fan exhibited ‘gathering’ of metal in the direction of fan rotation. This suggested that the engine was producing power at the time of impact. The exhaust was crushed and the carburettor throttle arm bent, resulting in the throttle butterfly valve being forced towards the full closed position. It was concluded that the damage to the engine components likely resulted in engine stoppage shortly after the initial ground impact.
Medical and pathological information
A post-mortem examination was conducted on the pilot at Royal Darwin Hospital. The forensic pathologist concluded that the pilot received multiple injuries, sustained during the impact sequence, which resulted in his fatality. A sample of bloodstained chest cavity fluid and urine contents were submitted for toxicological analysis.
The pilot’s toxicology results included 0.20 per cent alcohol detected in the bloodstained chest cavity fluid and 0.14 per cent alcohol detected in the urine. The forensic pathologist confirmed that the bladder was intact, but that fermentation with microbiologically generated alcohol might be an issue as decomposition had started.[20] Therefore, he advised seeking assistance from a subject matter expert for interpretation of the alcohol results. The ATSB consulted with the forensic scientist who conducted the toxicology, and engaged a forensic and aviation pathology consultant.
The forensic scientist reported that during their routine screen of the chest cavity fluid, they noted the presence of a number of compounds that are typically indicative of decomposition. She reported that alcohol can be produced during decomposition, ‘however the high alcohol levels observed for this case (especially in the urine, which is typically less prone to post-mortem alcohol production) don’t appear to suggest extensive post-mortem production of alcohol’.
The consultant reviewed the material, including the correspondence with the forensic pathologist and forensic scientist, and provided an interpretation for the alcohol results. She reported that, for the bloodstained chest cavity fluid, ‘the possibility that some of this level is not the result of ethanol [alcohol] ingestion prior to death but the result of decomposition changes in the blood occurring after death, exists. It is however, still a significant level… Urine is less susceptible to the effects of decomposition than blood and chest fluid, particularly in the absence of injury [intact bladder] suggesting that the finding is a significant indicator of ingested alcohol’.
According to the consultant, blood alcohol levels greater than 0.05 per cent have the effect of lowering caution, worsening of judgement and reasoning. Higher levels of around 0.1 per cent may affect these more and impair coordination and reaction time. Blood alcohol levels generally decrease at a rate of 0.01 per cent per hour. If the pilot was drinking heavily the evening prior to the accident flight, his blood alcohol level could still have been elevated during the flight such as to affect his piloting performance. It is possible that heavy drinkers may develop some tolerance to the effects of alcohol.
The consultant concluded that the time required to retrieve the pilot resulted in sub‑optimal collection of specimens on which to perform the analysis. Both samples showed the presence of considerable amounts of alcohol, but the precise level of blood alcohol could not be ascertained. However, given the measured levels and degree of decomposition [early stages], ‘it is highly likely that alcohol was present in blood at a level capable of impairing pilot performance’.
Survival aspects
The accident occurred at about 0757 at a remote location. The main rotor tree strike, and ground impact marks, suggested the initial impact was in a relatively level attitude and survivable. However, about half way downslope, the helicopter passed through a tree, resulting in the fragmentation of the plexiglass and separation of the landing skid front cross‑tube from the airframe, which compromised the liveable space of the cabin. This exposed the pilot and passenger to multiple injuries as the helicopter continued on its trajectory over rocky terrain and across a dry riverbed, before coming to rest upslope on the far side.
The pilot and passenger seats were both fitted with lap and shoulder restraints (three-point lap‑sash seatbelts). The seat harnesses were found in various conditions. The pilot’s shoulder harness was cut away by first responders and his lap belt was found unbuckled. The passenger’s lap strap had completely pulled through its clasp, leaving the clasp inside the buckle without a strap attached. The occupants were not wearing helmets and both were found with head injuries.
Emergency locator transmitter
The helicopter was fitted with an ELT in the transmission bay area, above the horizontal firewall. The ELT had a protected 3-position toggle switch. The three selections were OFF, ARM and ON. The ELT was found by the ATSB to be in the OFF position. Therefore, it could only be activated by an individual accessing the device and selecting it to the ON position. The passenger reported that he was intermittently conscious following the accident and that the pilot did not regain consciousness.
In the ARM position, the ELT will automatically activate if the deceleration is sufficient in magnitude and direction. The examination of the accident site did not indicate that the helicopter was subject to either a high vertical or horizontal deceleration. In 2013, the ATSB published a review of the effectiveness of ELTs in aviation accidents, and found that even in a high deceleration impact they only activated 40–60 per cent of the time in the ARM mode.
Search and rescue sequence
Ambalindum Station staff were provided with a Spot Tracker device. The Spot Tracker is a personal tracking device, which sends a GPS location signal at a set time interval. In addition to the routine signal, the device has a button for an SOS signal to provide an alert for emergency assistance. The pilot was carrying his device on the flight, but the passenger was not. The passenger could not recall why he did not have his device. However, at about 0811, the passenger was able to activate the pilot’s Spot Tracker in SOS mode.
The Spot Tracker service contacted the station owners and the JRCC. The SAR pilot was contacted by the station owners and then by the JRCC who also activated the paramedic. The paramedic met the SAR pilot at their Alice Springs Airport hangar.
The SAR pilot achieved engine start at 0940, and the paramedic arrived at the scene of the accident at about 1040, while the SAR pilot was ferrying the station personnel to the site.
The station-hand and general manager were left at the site while the pilot ferried the paramedic and passenger to Ambalindum Station, where a trauma doctor was waiting. Weather storm cells started to develop after arrival at Ambalindum Station and at 1350, the SAR pilot ferried the trauma doctor with the passenger to Alice Springs. His triage at Alice Springs Hospital was recorded as occurring at 1500.
Helicopter performance
The ATSB used the Arltunga weather station to calculate the accident site pressure altitude and density altitude, which were 1,796 ft and 4,000 ft respectively. According to the R22 Pilot’s operating handbook (POH), the helicopter was capable of producing at least maximum continuous power, and likely take-off power, under these conditions.
Weight and balance
The published maximum all-up-weight limit for the R22 was 622 kg.[21] However, there was no record of how much fuel was on board at departure and the fuel contents at the accident site was based on visual estimates. Therefore, the ATSB calculated the weight and balance progressively from full main tank contents to empty main tank contents. The calculations included the pilot and passenger’s weights, 20 L of diesel fuel at the passenger’s tail rotor pedals position, and 20 kg for the additional articles.
The results provided in Table 1 indicated that at full main tank fuel, the helicopter’s operating weight was above the limit for maximum all-up-weight, and the centre-of-gravity (‘Arm’) was beyond the forward limit. At the reduced fuel load of 1/3–2/3 main tank fuel observed at the accident site, the helicopter’s operating weight was still above the maximum all-up-weight and the centre-of-gravity was further forward of the forward limit.
A negative weight margin indicates a higher weight than the maximum all-up-weight, and a negative arm indicates a centre-of-gravity position forward of the forward limit. The range of the centre-of-gravity was 160 mm from the aft limit to the forward limit.
Table 1: Weight and balance
Main tank contents
All-up-weight (kg)
Weight margin (kg)
Arm (mm)
Full
659
-37
-37.7
Two-thirds
643
-21
-46.2
One-third
626
-4
-48.2
Empty
613
9
-55.9
The high all-up-weight of the helicopter would result in a high power requirement under normal flight conditions. This would have reduced the power margin available for contingency situations, such as an emergency climb. As stated in the United States Federal Aviation Administration (2012) Helicopter flying handbook ‘Excessive weight reduces the flight performance in almost every respect’.
Robinson had published a caution in the R22 POH for loading the helicopter near the forward centre-of-gravity limit, as follows:
CAUTION: Fuel burn causes the CG [centre-of-gravity] to move forward during flight. Always determine safe loading with empty fuel as well as with takeoff fuel. Payload may be limited by forward CG as fuel is burned.
The caution provided by Robinson was consistent with the advice published by the United States Federal Aviation Administration in their Helicopter flying handbook, which provided the following information for a centre-of-gravity forward of the forward limit:
A forward CG may occur when a heavy pilot and passenger take off without baggage or proper ballast located aft of the rotor mast. This situation becomes worse if the fuel tanks are located aft of the rotor mast because as fuel burns the CG continues to shift forward.
The handbook further indicated that the position of the centre of gravity will influence the handling characteristics of the helicopter. The fuselage acts as a pendulum suspended from the rotor, and when the centre of gravity is directly under the rotor mast, the fuselage should remain horizontal. If the centre of gravity is beyond the forward limit, the nose of the helicopter will tilt down. Consequently, a pilot would have to apply aft cyclic control to raise the nose and balance the helicopter. However, as fuel is consumed and the centre of gravity continues to move forward, a pilot could rapidly lose rearward cyclic control. In this condition:
A pilot may also find it impossible to decelerate sufficiently to bring the helicopter to a stop. In the event of engine failure and the resulting autorotation, there may not be enough cyclic control to flare properly for the landing.
The GPS data indicated the pilot flew the approach and departure to the bore site, just prior to the accident, in a northerly direction, which was into wind. In a headwind, the forward centre-of-gravity may be less noticeable to the pilot as the cyclic is displaced forward of the nil wind position, thereby providing a greater aft cyclic range than in a nil wind or tail wind condition.
Strong winds and turbulence
Robinson has published a safety notice (SN-32) in the R22 POH on the subject of flight in strong winds or turbulence.[22] The safety notice included the following information:
Flying in high winds and turbulence should be avoided. If turbulence is encountered, the following procedures are recommended:
1. Reduce power and use a slower than normal cruise speed. Mast bumping is less likely at lower airspeeds.
2. For significant turbulence, reduce airspeed to 60–70 knots.
3. Tighten seat belt and rest right forearm on right leg to minimize unintentional control inputs. Some pilots may choose to apply a small amount of cyclic friction to further minimize unintentional inputs.
4. Do not overcontrol. Allow aircraft to go with the turbulence, then restore level flight with smooth, gentle control inputs. Momentary airspeed, heading, altitude, and RPM excursions are to be expected.
5. Avoid flying on the downwind side of hills, ridges, or tall buildings where turbulence will likely be most severe.
Employment of the pilot
In early 2018, the pilot was employed by Hewitt Cattle Australia, the owners of Ambalindum Station and the accident helicopter, in accordance with their recruitment process. This included the pilot’s submission of a résumé with referee details and relevant aviation qualification documents. The documents included a copy of his CAR 5 private pilot licence, dated 10 June 2014, and a copy of his CAO 29.10 Appendix II and log book endorsements for low flying and mustering training, dated 29 October 2015. It was agreed that the pilot’s completion of a flight review would satisfy the employer’s requirements.
The pilot’s application was vetted by his prospective employer and their insurance company. This included a check of his log book to verify he had completed the flight review as agreed. Although the pilot did not hold a commercial licence, CASA confirmed that aerial mustering may be conducted as a private operation over land occupied by the owner of the aircraft with the appropriate licence, rating and endorsement.
At the time, the pilot submitted his documents to his prospective employer, his CAR 5 licence was still valid and there was about 7 months remaining until the end of the transition period to the Part 61 licence. It was considered unlikely that the discrepancy associated with his low flying and mustering training would have been identified by anyone who did not have an intimate knowledge of the Part 61 licencing system.
While flying in the MacDonnell Ranges, Northern Territory, VH-KZV collided with terrain on a downslope. The pilot was fatally injured and the passenger received serious injuries. The helicopter was substantially damaged. The time of the accident was within a period of a weather forecast for moderate turbulence in the area.
The on-site wreckage examination and additional testing of the engine found no evidence of a pre‑existing defect to prevent normal operation of the helicopter. Therefore, it was almost certain that the engine was operating and driving the rotors at initial impact.
This analysis will discuss the pilot’s flight planning and loading of the helicopter, the likelihood that his performance was impaired by alcohol, and the operational state of the helicopter’s emergency locator transmitter (ELT).
Collision with terrain
The pilot’s global positioning system device track data, recovered from the accident site, indicated the helicopter levelled-off at about 150 ft above ground level on entry to the MacDonnell Ranges. This flight profile was maintained to the last recorded data point (less than 1 minute before the accident) at which stage the helicopter was about 142 ft above terrain. On review of the track data for the previous day, and GoPro camera footage of previous work experience, the pilot appeared to have a habit of manoeuvring his helicopter to contour fly along dry riverbeds. The helicopter’s track from the bore site was towards rugged terrain with dry riverbeds and not a direct track towards their destination of Quartz Hill. Therefore, it was very likely the pilot was operating the helicopter at low-level and possibly engaged in contour flying, just prior to the accident.
The meteorological conditions at the time of departure were reported as fine, but moderate turbulence was forecast for the period of the accident flight. The final track of the helicopter placed its path on the lee side of higher ground for the prevailing winds. At about that time there was a change in weather conditions recorded at Alice Springs Airport, indicating stronger winds aloft were mixing with the surface winds. The Bureau of Meteorology’s analysis indicated that these winds could have generated at least moderate mechanical turbulence, with the potential for strong downdrafts in the lee of higher terrain. This was consistent with what was experienced by the search and rescue pilot on arrival at the scene of the accident site and suggestive of the comments made by the passenger during his retrieval.
In consideration of the track data, meteorological conditions, accident site and wreckage, it was likely the helicopter encountered a downdraft when low flying in the MacDonnell Ranges with insufficient height to recover, resulting in the collision with terrain.
Flight planning
Ambalindum Station was equipped with an office and computers that had internet access. However, the employer’s general manager reported that the pilot did not use, or request to use, the office computers for flight planning. Further, the ATSB found no evidence on either the pilot’s iPad or iPhone to indicate he had accessed any flight planning data in preparation for the accident flight.
Consequently, the pilot was most likely unaware of the forecast conditions of moderate turbulence and strong winds for his area of operation. Prior knowledge of potentially hazardous meteorological conditions at low-level may have resulted in him selecting an alternate flight path and/or higher altitude to mitigate the associated risks.
Helicopter performance
ATSB calculations of the loading of the helicopter indicated it was likely overweight, with a centre‑of-gravity beyond the forward limit, for the entire accident flight. However, the performance charts in the pilot’s operating handbook did not provide results beyond the published limits, and therefore, the performance of the helicopter under the actual conditions could not be determined.
The engine was capable of producing sufficient power for normal flight in the overloaded condition, which was evidenced by the fact that the helicopter had taken off and had been flying for about 20 minutes. However, a downdraft would increase the power required if the pilot attempted to recover lost height during an uncommanded descent. In this situation, the power required by the rotors could rapidly exceed the power available from the engine, resulting in a loss of power margin and a forced descent.
The location of the fuel tanks, behind the main rotor mast, meant that the centre-of-gravity would move forward in-flight as fuel was consumed. This would reduce the range of aft cyclic movement available to the pilot, used to flare and decelerate the helicopter. The into-wind approach and departure, flown to the bore site just prior to the accident, likely increased the available aft cyclic range compared with a nil wind or tail wind condition. Therefore, the pilot may not have been aware of the reduction in aft cyclic control that had already occurred.
After departure from the bore site, the helicopter’s track towards the accident site resulted in a wind direction from the left rear quarter (left of the nose between 90–130°). Any rearward component of wind, combined with a reduction of aft cyclic control, would have severely compromised the ability of the pilot to reduce the forward speed of the helicopter.
It was possible that the downdraft would have exceeded the capability of the helicopter loaded within the prescribed limits. However, without knowledge of the actual direction and strength of the downdraft encountered, it could not be determined if the overloaded condition and forward centre‑of-gravity contributed to the collision with terrain. Despite this, if hazardous weather was encountered at low-level, the combination of a reduced power margin and aft cyclic control would reduce the response available, thereby increasing the risk of a collision with terrain.
Impaired pilot performance
Research conducted for the ATSB (Newman, 2004) into alcohol and human performance highlighted that:
In simple terms, alcohol impairs human performance…
It has detrimental effects on cognitive functions and psychomotor abilities. Risk taking behaviour may result, and a full appreciation of the consequences of a planned action may not be possible… Adverse effects can also persist the day after alcohol ingestion, with reductions in alertness, concentration and vestibule-ocular function, and increases in anxiety all being reported…
Alcohol has been shown to impair registration, recall, and organisation of information, leading to increased reaction times and/or a greater number of errors…
…performance has also been found to suffer most when an unexpected or unanticipated event occurs.
The pilot’s toxicology report results indicated an elevated level of alcohol in his urine. The toxicologist, and forensic and aviation pathology consultant, concluded that the level of alcohol present was unlikely to be solely the result of decomposition. The consultant also indicated that it was highly likely there was sufficient alcohol present in his blood at a level capable of impairing his performance and that an elevated level of alcohol has the effect of lowering caution, worsening judgement and impairing coordination and reaction time, although heavy drinkers may develop some tolerance to these effects.
The ATSB noted that the evidence of previous low flying suggested his actions may have been normal behaviour and not influenced by alcohol. Therefore, it could not be concluded that his elevated level of alcohol contributed to the accident but considered that it increased the likelihood of risk-taking behaviour and mishandling the helicopter in an emergency.
Emergency locator transmitter
Emergency locator transmitters are radio beacons carried on most aircraft so that in the event of an accident in a remote location, the aircraft wreckage and its occupants can be located quickly by search and rescue (SAR) operations. Finding the aircraft wreckage quickly not only increases the chance of survival of the occupants, but also reduces the risk to pilots of SAR aircraft who commonly need to operate in marginal weather conditions and over mountainous terrain (ATSB 2013).
The inspection of the wreckage found that the emergency locator transmitter (ELT) was selected OFF, rather than ARM. The ARM mode would provide an impact-activated signal. The ELT was located in the transmission area and while selected OFF, it required an individual to access it and select the ON mode for it to transmit a signal. However, the pilot did not regain consciousness following the accident and therefore the ELT was never activated. If not for the pilot’s Spot Tracker device, it was possible that the search and rescue response may not have commenced for some time after the accident, delaying medical treatment for the passenger.
ATSB research into the effectiveness of ELTs in aviation accidents (ATSB, 2013) established that they functioned as intended in about 40-60 per cent of accidents in which their activation was expected. In the accidents where it did not work effectively or at all, the ATSB found that this was due to the ELT not being armed before flight, incorrect installation or flat batteries, a lack of water or fire protection, damage to the ELT during the impact sequence, or the way in which the aircraft came to rest after the impact. Activation of the ELT in the ARM mode requires a high deceleration. Examination of the accident site and wreckage suggested it was possible that the ELT would not have activated in the ARM mode, but this could not be verified. Therefore, it could not be concluded that the OFF-mode selection of the ELT would have hindered a response to the accident, but not having it selected to ARM was considered to increase the risk of a delayed response.
Findings
From the evidence available, the following findings are made with respect to the collision with terrain involving a Robinson R22, registered VH-KZV, 125 km east-north-east of Alice Springs Airport, Northern Territory, on 24 November 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
It was very likely that the pilot was operating the helicopter at low-level when it encountered a downdraft with insufficient height to recover, resulting in a collision with terrain.
Other factors that increased risk
The pilot did not consult any weather forecast data before departure, which increased the risk of him selecting a flight path through the MacDonnell Ranges that was not appropriate for the forecast wind conditions and turbulence.
It was very likely that the helicopter was overweight on departure and the centre-of-gravity was beyond the forward limit for the entire flight, which increased the risk of the pilot experiencing reduced control authority over the helicopter.
It was very likely the pilot's blood alcohol content was capable of impairing his performance, which increased the likelihood of risk-taking behaviour and mishandling the helicopter in an emergency.
The impact-activated emergency locator transmitter fitted to the helicopter was selected off, which increased the risk of a delayed emergency response.
Other findings
There was no fault found with the helicopter to prevent normal operation. It was almost certain the engine was operating and driving the rotors when it collided with terrain.
The pilot’s Private Pilot Licence (Helicopter), and low-level and aerial mustering qualifications had not been transferred to the Civil Aviation Safety Authority’s new licencing system and therefore, were not valid at the time of the accident.
General details
Pilot details
Licence details:
Private Pilot Licence – Helicopter (invalid from 1 September 2018)
Endorsements:
R22 (invalid from 1 September 2018)
Ratings:
Nil
Medical certificate:
Class 2, valid to 2 February 2020
Aeronautical experience:
Approximately 1,270 hours in the R22
Last flight review:
February 2018
Proactive safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence:
Operator safety management improvements
Subsequent to the accident, Hewitt Cattle Australia (HCA) elected to contract out the majority of its aviation operations to Air Operator Certificate holders, including all rotary operations.
Through their recently appointed a work health and safety manager, they commenced a review of their aviation safety system. A third party aviation expert consultant was engaged to lead the review. As a result of that review, HCA developed further improvements to their aviation safety system in order to enhance the safety standards, which included the development of:
An aviation safety management system, which borrows elements contained in Civil Aviation Advisory Publication SMS-01 v1.1: Safety management systems for regular public transport operations.
An aviation safety management manual, which is based on the recommended framework contained in the International Civil Aviation Organization’s safety management manual, and incorporates best practice from the Flight Safety Foundation basic aviation risk standard, and the International Association of Oil and Gas Producers aircraft management guidelines. The manual has been tailored for HCA’s operations, with a specific focus on the areas of safety policy, risk management procedures, hazard and occurrence reporting, ‘just culture’, and assurance, specifically focused on the audit of service providers and suppliers.
A revised safe operating procedure for pilots, which is integrated with the HCA safety management system (in which pilots operating HCA aircraft have been inducted). This includes a number of additional requirements designed to decrease the likelihood of similar accidents in the future, including: pilot minimum experience requirements based on industry best practice; the basic aviation risk standard pilot runway and helicopter landing site assessment process; a process for the conduct of an abbreviated risk assessment by pilots; safety occurrence reporting requirements; Civil Aviation Safety Authority drug and alcohol training for pilots (which pilots operating HCA aircraft have undertaken); adverse weather policy; approved and prohibited flying activities; and restriction on carriage of passengers.
The aviation safety management manual creates a framework to allow for open reporting of safety occurrences based on the ‘just culture’ philosophy. This is aimed at shaping the behaviour and the culture of pilots to ensure that activities, which are not in line with HCA’s expectations, are less likely to occur. HCA considers that this cultural shift is important as the remote and expansive location of its aviation operations affect management’s ability to constantly view and assess a pilot’s general and specific flight conduct. The manual also provides a process for monitoring and auditing the currency of pilot training, ratings and endorsements on HCA’s training management system.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Alice Springs Helicopters
Bureau of Meteorology
Civil Aviation Safety Authority
Forensic and aviation pathology consultant
Forensic Science South Australia
Hewitt Cattle Australia employees
Northern Territory Police
Robinson Helicopter Company
Royal Darwin Hospital
St John Ambulance – Northern Territory.
References
Australian Transport Safety Bureau 2019, AO-2016-156: In-flight break-up involving Robinson R44, VH-ZNZ, 41 km NW Mossman, Queensland, on 18 November 2016, ATSB, Canberra.
Australian Transport Safety Bureau 2013, AR-2012-128: A review of the effectiveness of emergency locator transmitters in aviation accidents, ATSB, Canberra.
Federal Aviation Administration 2016, Pilot’s handbook of aeronautical knowledge, chapter 12: weather theory (FAA-H-8083-25B), US Department of Transportation, Oklahoma City United States.
Federal Aviation Administration 2012, Helicopter flying handbook (FAA-H-8083-21A), US Department of Transportation, Oklahoma City United States.
Wagtendonk WJ 2011, Principles of helicopter flight, 2nd edn, Aviation Supplies & Academies, Inc. Washington United States.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Alice Springs Helicopters, Bureau of Meteorology, Civil Aviation Safety Authority, the forensic and aviation pathology consultant, Forensic Science South Australia, Hewitt Cattle Australia, Northern Territory Police, Robinson Helicopter Company, Royal Darwin Hospital, St John Ambulance Northern Territory and the United States National Transportation Safety Board.
Submissions were received from Hewitt Cattle Australia, the Civil Aviation Safety Authority, and Forensic Science South Australia. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 30/01/2019
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
What happened
On 24 November 2018, at about 0800 Central Standard Time,[1] a Robinson R22 helicopter, registered VH-KZV, collided with terrain about 125 km east-north-east of Alice Springs Airport. The pilot was fatally injured and the passenger was seriously injured. The helicopter was substantially damaged.
The pilot held a private helicopter pilot licence and was employed by a cattle station for general flying duties, which included cattle mustering. On the morning of the accident, the pilot and passenger were tasked to assist with the recovery of a motor vehicle, located about 63 km east-north-east of Ambalindum Station (departure point). A station hand assisted them with preparing the helicopter for departure. The station hand could not recall the actual time of departure, but estimated it was between 0730 and 0745.
At about 0811, the pilot’s Spot Tracker device transmitted its location in SOS mode.[2] A local helicopter company in Alice Springs was subsequently tasked by the Joint Rescue Coordination Centre to transport a paramedic to the reported location and conduct a search and rescue. In addition, Ambalindum Station dispatched two employees by road to investigate. The search helicopter pilot located the wreckage of the R22 at the reported location, and the paramedic subsequently attended to the accident pilot and passenger. At about 1045 the paramedic found the pilot deceased and the passenger in a serious condition. The rescue helicopter departed to collect the two station employees who were enroute to assist with the emergency response. The rescue helicopter pilot and the paramedic, with the assistance of the two station employees, retrieved the passenger and transported him to Ambalindum Station for treatment by a retrieval doctor, before transporting him to Alice Springs Hospital for further medical attention.
Figure 1: Robinson R22 helicopter, VH-KZV, main wreckage site
Source: ATSB
The ATSB attended the accident site on 26 and 27 November 2018. The helicopter’s clock had stopped at about 0756. The helicopter had impacted the ground on a downslope, in an easterly direction, and continued down the slope, producing debris as it struck rocks and trees, before crossing a dry creek bed. The helicopter came to rest on the far side of the creek bed, in a southerly direction, with the port side of the helicopter resting against the upslope of the far bank. The main rotor disc struck and separated the rear section of tailcone as a consequence of the accident sequence. Significant torsional deflection of the tail rotor driveshaft intermediate flexible coupling indicated that it was rotating when the strike occurred.
The ATSB found no pre-existing defect with the rotors, transmission, sprag clutch, drive belts or flight controls, which would have prevented normal operation. The main fuel tank had sufficient fuel for flight. A fuel test on site and at the point of departure did not identify any visual contaminates, including water. In addition, fuel samples were collected from the helicopter and departure point fuel pump, for future chemical analysis testing if required. The engine and a majority of the airframe was retrieved from the accident site and transported to Alice Springs. The engine was then removed from the wreckage and transported to Brisbane for further examination under the supervision of the ATSB. Several components and cockpit warning lamps were retained for examination.
Weather and terrain
The accident site was within the MacDonnell Ranges at an elevation of about 1,850 ft, 31 km east of Ambalindum Station. At the time of the accident the weather forecast included moderate turbulence throughout the area. At 0800 the Alice Springs Airport recorded a wind speed of 18 kt, with gusts to 29 kt, from 330 degrees, and a temperature of 29 °C. The Arltunga weather station, located about 40 km west of the accident site, recorded two observations each day. At 0800 it recorded a wind speed of 14 kt[3] from 360 degrees, and a temperature of 30 °C.
Engine tests and inspections
On 8 and 9 January 2019, inspections and tests were conducted on the recovered engine. Representatives from the workshop, Civil Aviation Safety Authority, insurance company and helicopter owner were present.[4] No fault was identified that would have prevented normal engine operation. Damage to the engine cooling fan and the presence of dirt inside the number 2 cylinder indicated the engine was operating at the time of initial impact. Scoring damage to the V-belt actuator was identified. The helicopter manufacturer advised the ATSB that the identified damage was consistent with the upper sheave rotating on contact with the actuator as the structure distorted on impact and that the actuator was in the extended position.[5]
Further investigation
To date, the ATSB has examined the wreckage, interviewed witnesses, consulted with the helicopter manufacturer and collected weather data and analysis from the Bureau of Meteorology.
The ATSB will conduct further enquiries into:
flight planning
the weight and balance of the helicopter
examination of individual components and warning lamps
analysis of data recording devices
pilot training and qualifications.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 8 November 2018, a Piper PA-31-350, registered VH-TWU, was being used for a freight flight from Devonport to King Island, Tasmania. During this flight, the pilot fell asleep and overflew their destination with the autopilot engaged. About 78 km past the intended destination of King Island Airport the pilot awoke and manoeuvred the aircraft back to King Island.
What the ATSB found
A fatigue analysis was conducted and determined that at the time of the occurrence, the pilot was very likely acutely fatigued to a level affecting performance predominately due to the lack of recent sleep and hours awake. Although there was opportunity, the pilot did not plan or obtain sleep prior to commencing the night shift.
After landing at King Island, the pilot continued with their shift flying to Moorabbin without obtaining additional rest.
Safety message
This occurrence highlights the importance of pilots assessing their fitness (a condition which permits a generally high level of physical and mental performance) to fly prior to commencing their shift and continuing to monitor their fitness to fly throughout the shift, specifically their level of fatigue. Pilots should modify their usual routines where necessary to prepare for a night shift to ensure they are adequately rested before they commence duty. Organisations should consider the risks of allowing a worker to continue operating in their role directly after a fatigue related incident without corrective management.
Information from the Civil Aviation Safety Authority (CASA) on fatigue management is available on their website.
The ATSB SafetyWatch information on Fatigue provides more resources and information.
The occurrence
What happened
At about 2300 Eastern Daylight-savings Time (EDT)[1] on 07 November 2018, a Piper PA-31-350, registered VH-TWU (TWU), operated by Vortex Air, departed Moorabbin, Victoria, for a scheduled freight flight to Devonport, Tasmania. The aircraft landed at about 0030 and the pilot assisted with unloading the freight. At around 0200 on 08 November 2018, the pilot commenced a three-hour break until 0500 when preparation for the next flight was required. During this break there was access to a rest facility within the Devonport Airport Terminal.
At about 0620 the aircraft departed Devonport for a scheduled freight flight to King Island, Tasmania. Air traffic control data showed that during the cruise the pilot maintained an altitude of approximately 6,000 ft and the pilot reported the autopilot was engaged. The autopilot maintained the aircraft’s track and altitude, while the pilot listened to music through the radio and continued to monitor the flight. As the aircraft reached the top of descent into King Island, the pilot started to feel tired and rapidly fell asleep.
At 0725:12 air traffic control (ATC) attempted to make contact with the pilot regarding his approach into King Island. No response was received. For approximately 8 minutes (between 0725 and 0733), ATC, with assistance from nearby aircraft, attempted contact with the pilot of TWU. At 0733:16 ATC received a transmission from the pilot of TWU who advised that operations were normal. The furthest point reached from the intended destination was approximately 78 km north-west of King Island (Figure 1).
The pilot advised ATC that they were turning back to King Island. The aircraft landed at about 0755. The pilot contacted his supervisor and ATC Melbourne Centre via telephone to discuss what had happened. The pilot then completed the shift, flying from King Island back to Moorabbin.
Figure 1: Overview of flight path for VH-TWU and distance past destination of King Island
Source: Google Earth, modified by ATSB
Fatigue
The pilot recalled not feeling unusually fatigued prior to the morning flight, and as a result did not identify fatigue as a potential hazard for the operation. He stated this overnight shift of Moorabbin to Devonport, Devonport to King Island and King Island back to Moorabbin was not uncommon. He explained that he had completed this pattern of flights many times before without any fatigue related issues.
The pilot reported that during the three-hour rest period at Devonport for these scheduled flights, he could normally obtain sleep, however, on this occasion he rested but was unable to sleep. At the time the pilot fell asleep, he was in a period of reduced workload for the flight.
This was the pilot’s first shift after five days of planned leave. The pilot reported that he did not modify his normal sleep patterns prior to commencing nightshift. From the information reported by the pilot, it was determined that at the time of the occurrence the pilot had been awake for about 24 hours.
Using the information obtained at interview and the pilot’s roster, fatigue analysis was conducted. From the fatigue analysis, including using fatigue biomathematical analysis software[2], the ATSB estimated the pilot’s level of fatigue at the time of the incident. The analysis identified it was very likely that the pilot was acutely fatigued to a level known to affect performance, predominantly due to lack of recent sleep and total hours awake.
In addition, further analysis showed even in the event of a three-hour sleep overnight in Devonport, the pilot would still have very likely been fatigued to a level known to affect performance.
After the incident, the pilot discussed what had happened with their supervisor and proceeded to continue with the shift without obtaining additional rest or taking a longer break.
Rosters
The operator generated a roster for the upcoming week and distributed this to the pilots. A review of the pilot’s rosters showed that there was no consistent pattern from week to week. Although the operator reported the pilots usually do two to three night shifts per week, there was no set pattern. The pilot further reported that the roster for the week ahead was normally provided on the Friday before a week, but sometimes not until the Sunday, and that sometimes this roster could then change substantially. The operator reported that they provided pilots as much notice as possible of upcoming night shifts.
The rostered shift of the occurrence flight was known in advance by the pilot and was not a recent change.
Safety analysis
The International Civil Aviation Organization (2016)[3] defined fatigue as:
A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety related operational duties.
The ATSB recently released research report Fatigue experiences and culture in Australian commercial air transport pilots (AR-2015-095) which was conducted to provide the air transport industry, regulators and policy makers with further insights into industry perceptions of fatigue. The safety message from this research was that:
The responsibility to manage the risk of fatigue lies with both the individual pilot and organisation. It is the individual pilot’s responsibility to use rest periods to obtain adequate sleep and to remove themselves from duty if they feel fatigued. It is important for operators to implement policies to reduce the likelihood of fatigue-related issues through rostering practices and by providing an organisational culture where crew can report fatigue in a supportive environment.
The fatigue analysis conducted as part of the investigation found that the pilot was very likely to be acutely fatigued at the time when he fell asleep. The pilot was flying the aircraft as a solo pilot operation and did not identify fatigue as a potential hazard due to not recognising any signs of fatigue.
Pilots should modify their usual routines where necessary to prepare for a night shift to ensure they are adequately rested before they commence duty. In this case, the pilot did have an opportunity to plan for and obtain sleep prior to commencing the night shift as he was on a five-day leave period leading up to these flights. Although obtaining sleep in the afternoon following sleeping each night previously can be challenging for pilots as they are not usually tired at that time, it is vital to ensure they can operate the entire night in a non-fatigued state.
Despite knowing the circumstances of the incident, the operator did not put in place measures to ensure the pilot was fit to continue the shift. This resulted in the pilot continuing to fly the aircraft while still very likely being fatigued to a level known to affect performance.
The operator did not have a consistent roster pattern across weeks, and rosters were provided at relatively short notice and subject to change. As a result, it could be difficult to predict future shifts and effectively plan sleep in advance for preparation for night shift work. While this was not a factor in this occurrence due to the pilot knowing about the night shift in advance, it is important that rosters are maintained in a way that provide pilots the best opportunity to plan and obtain sleep to avoid flying while fatigued.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The pilot was acutely fatigued to a level affecting performance predominantly due to the lack of recent sleep and hours awake. Although there was opportunity, the pilot did not plan or obtain sleep prior to commencing the night shift.
After the occurrence, the pilot continued with their shift, flying from King Island to Moorabbin without obtaining additional rest.
Although not a factor in this occurrence, the operator’s roster pattern varied considerably from week to week, and sometimes changed at short notice, so did not provide the best opportunity for pilots to plan and obtain sleep to avoid flying while fatigued.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
