Safety summary

What happened

On 6 November 2017, the fully laden, mini cape-size dry bulk carrier Orient Centaur was transiting the South Channel, Weipa, Queensland, outbound under the conduct of harbour pilots as part of a trial introduction of this size of ship to the port. While in the South Channel, the ship’s main engine shut down due to a loss of water from a cracked engine cooling component, and propulsion was lost. Shortly after, the ship grounded on the northern batter of the channel. The stern then slowly swung across the channel and grounded on the southern batter.

Under the guidance of the harbour pilots, three tugs were used to successfully refloat the ship. The ship was subsequently towed out of the channel to an anchorage. Surveys conducted over the following days identified that the ship did not sustain any damage.

What the ATSB found

The ATSB found that the approval process for this size of ship had only considered the risks associated with a main engine failure before the departing ship’s entry into the narrow South Channel. The port risk assessment did not require the use of an escort tug for any ships transiting the South Channel during outbound voyages, and the tug masters had not been trained in the specifics of escort towage nor in emergency response.

What's been done as a result

The ship’s managers advised there is now weekly on board testing of cooling water and every 6 months at a shore laboratory. Also, only manufacturers’ original spares are to be used during maintenance.

In addition to the trial conditions, an escort tug is now used for all departing bulk carriers. All departing ships over 200 m now have an escort tug made fast, from the wharf to the South Channel exit. Further, two continuously manned, 85 tonne bollard pull azimuth stern drive tugs are now based at the Port of Amrun, about 60 minutes steaming time from the Port of Weipa.

All pilots and tug masters have completed emergency response and escort towage training at the Smartship simulator. The training included emergency towage scenarios, positioning and use of tugs in an emergency, competency in standard escort tug manoeuvres and indirect towage.

Arrival and departure briefs developed for the Port of Weipa have been updated with safety settings for the electronic chart display and information system, tidal information, weather conditions, wind limits and tug positions/line lengths. All masters and ship bridge teams are briefed before arrival and departure.

Safety message

The introduction of this size of ship to the Port of Weipa was preceded by identification, and risk assessment, of a number of hazards. However, aspects of tug escort and the potential for malfunction of the heavily‑laden ships within the confined channel were not considered. This occurrence highlights the importance of considering potential hazards from end to end in order to provide the best opportunity to manage safety risk.

Video animation

The occurrence

At 1120 Eastern Standard Time^[1] on 6 November 2017, the 255 m dry bulk carrier Orient Centaur (cover) completed loading a cargo of bauxite in Weipa, Queensland. The draught survey was completed shortly thereafter, with departure draughts of 12.97 m fore and aft.

At about 1415, the Port of Weipa’s dynamic under keel clearance (UKC) system became inoperative. As a result, the Weipa Vessel Traffic Services (VTS) duty officer was unable to determine the ship’s UKC. Two harbour pilots allocated to Orient Centaur for its departure then calculated that, based upon the ship’s draughts, tide and channel information, the static UKC would be 1.31 m.

At 1515, the ship’s crewmembers commenced pre-departure checks for a 1615 departure from Lorim Point Wharf (Figure 1), to sail on the evening high tide^[2] to China. Shortly after, and as required for this size of ship (mini cape-size)^[3], the two harbour pilots boarded the ship. The pilot taking the conduct^[4] (conning pilot) had worked in Queensland ports for 9 years and was a check pilot for the Port of Weipa. The second pilot (comms pilot) had worked in Queensland ports for 10 years and was also a check pilot for the Port of Weipa. Both pilots had also recently piloted sister ships to Orient Centaur departing Weipa.

Figure 1: Port of Weipa

Source: Australian Hydrographic Service annotated by the ATSB

The pilots were escorted to the navigation bridge and met by the master. By 1537, the ship’s crewmembers had completed the pre-departure checks. At 1540, the master and pilots commenced the master-pilot information exchange (MPX) and discussed the pilotage. During the exchange, they discussed the Port of Weipa pilotage plan and the Full Mission Bridge Simulation (FMBS) departure report. ^[5] The ship’s route, speeds, and UKC in the channel were detailed and the tug requirements, position and repositioning were explained. Two tugs were to be in attendance, Peter Crooke (48 t bollard pull)^[6][7] on the centre lead forward, and SL King (69 t bollard pull)^[8] on the centre lead aft. The master was informed Peter Crooke would let go when the ship was off the berth and in the centre of the channel. SL King would let go at Gonburg Point.

The MPX form also noted that a flood tide setting from the north-west was expected at Urquhart Point, the entrance to the South Channel. The master and pilots completed the MPX at 1602, and the tugs were made fast shortly after. At 1610, the ship’s last mooring line was retrieved on board, and shortly after, the tugs started pulling the ship off the berth. By 1615, the ship was in the centre of the channel off Lorim Point, and the conning pilot ordered slow ahead. At 1618, the conning pilot ordered half ahead, and Peter Crooke was let go and stood by off the starboard quarter as the ship proceeded north of Cora Bank, to Gonburg Point.

At 1643, as the ship passed Gonburg Point, SL King was let go and stood by on the quarter, and the conning pilot ordered full ahead. Shortly after, as the ship passed beacon SC24, the conning pilot ordered port helm and started altering course into the South Channel. At about 1654, when the ship was steady in the South Channel, the conning pilot released the tugs as they passed SC22, and they headed back to their berth (Figure 2). The ship then proceeded outbound in the South Channel as planned, at a speed of about 8 knots.

Figure 2: Orient Centaur passing Urquhart Point and entering the South Channel

Source: Orient Centaur VDR, annotated by ATSB

At 1716, as the ship passed SC13 and SC14, the ship’s main engine jacket water header tank went into low‑level alarm, followed by low‑pressure and high‑temperature alarms. The chief engineer phoned the bridge and asked the master to stop the main engine for repairs, as there was a cooling water issue. The conning pilot advised the master that half ahead was acceptable and the master moved the telegraph to half ahead. He then advised the chief engineer, the main engine could not be stopped as the ship was in a narrow channel.

At 1717, the conning pilot asked the master to contact the chief engineer and confirm if half ahead was available for about an hour. Shortly after, the main engine’s automatic slowdown was activated. The master tried to contact the chief engineer regarding the main engine status. The comms pilot reported the ship was experiencing engine problems to Weipa VTS, and then issued a general call to all tugs for assistance.

At 1718, the main engine shut down, with the ship’s speed at 8.6 knots (Figure 3). Peter Crooke was the first tug to respond to the call for assistance, and the comms pilot asked the tug master to attend the ship as soon as possible. The comms pilot then made several further radio calls to Weipa VTS, stating ‘the ship had lost the main engine, taking a sheer, and was about to ground in the vicinity of SC12’.

Figure 3: Orient Centaur’s main engine shutdown to the grounding at 1 minute intervals

Source: Orient Centaur VDR, annotated by ATSB

The ship’s speed reduced to 8.3 knots as it passed beacons SC11/SC12, and it started to turn to starboard with an increasing rate of turn. The conning pilot ordered hard to port, but this had little effect. The ship continued to turn to starboard and at 1723 (Figure 4), the ship’s starboard shoulder grounded on the northern batter (bank of the channel) of the South Channel, at a speed of 6.7 knots, on a heading of 270°, and the rudder positioned amidships.

Figure 4: Orient Centaur aground in the South Channel at 1723

Source: Orient Centaur VDR, annotated by ATSB

Shortly after, SL King’s tug master responded to the comms pilot’s radio call and was asked to keep him advised of their position, as the ship’s stern started to swing across the channel. The tug master advised that SL King had just passed the wharf and would be at the ship as soon as possible. Peter Crooke’s master also advised that they were about 3 minutes behind SL King. The comms pilot then made a radio call to Weipa VTS and requested a third tug, due to the need to control the situation before the tide dropped (high water was at 1737).

At 1728, Weipa VTS advised the comms pilot that the third tug, Harry Evans (43 t bollard pull)^[9] had been raised and would head out to the ship as soon as possible. At 1730, the comms pilot phoned the Regional Harbour Master (RHM) to inform him of the grounding. Unable to reach him, he called the Assistant Regional Harbour Master (ARHM). Subsequently, the ARHM gave the pilots authorisation to act in whatever manner was required to get the ship off the bank and prevent it from being aground forward and aft, across the channel, with a falling tide.

Several minutes later, the comms pilot requested the pilot boat, Windah, to read the draughts on both sides of the ship and take depth soundings around the ship’s stern. The comms pilot then advised SL King’s master to have lines ready to do heavy lifting upon their arrival.

By 1739, the ship had come to rest with the starboard shoulder aground on the northern batter, on a heading of 279°, south-west of SC 12 with the port quarter across the channel and drifting towards the southern batter.

At 1745, the comms pilot managed to contact the RHM and provided a situation update. At the same time, the ship’s crew activated their emergency procedures for a grounding. The ship’s stern continued moving slowly across the channel, before coming to rest on the southern batter at 1759, on a heading of 289°.

At 1800, the ship’s engineers identified that the cooling jacket of the cylinder head of number one main engine unit cylinder had cracked, which led to the loss of the jacket water, and the subsequent shutdown of the engine. They then started a cylinder liner jacket overhaul for the failed unit.

Shortly after, SL King arrived off the ship’s starboard quarter and put a line up through the starboard side panama lead. At 1805, the tug moved abeam and started holding the stern. At about the same time, the third tug, Harry Evans departed its berth and proceeded to Orient Centaur.

At 1808, the starboard anchor was lowered to one shackle^[10] in the water to control the bow on refloating of the ship.

By 1810, Peter Crooke had arrived off the port quarter and put a line up through the port side panama lead. After the tug’s line was fast, the tug started laying back to start pulling the ship astern from the grounded position.

Orient Centaur’s stern started to slowly swing clear and away from the southern batter and, at 1820, the ship was refloated. Shortly after, SL King was relocated forward, to run a long line up the ship’s centre lead. By 1823, the line was fast and the ship’s deck crewmembers started heaving up the anchor.

By 1826, the ship’s anchor was aweigh and, at 1830, Orient Centaur was back in deep water and being manoeuvred back into the centre of the channel. The pilot’s plan from here involved SL King towing the ship, and for Peter Crooke (port quarter) and Harry Evans (starboard quarter), to steer the ship (Figure 5). The comms pilot then updated the RHM on the situation and the intended plan. The RHM advised the pilots that the ship should be towed to the emergency anchorage, that the Australian Maritime Safety Authority (AMSA) had taken charge of the incident, and that the ship was officially detained pending inspections.

Under towage, the ship passed between SC10 and SC9 at 1838, at a speed of 3.8 knots with an UKC of 3.2m. At 1843, the third tug, Harry Evans was off the starboard quarter and by 1848, had made fast a line through the starboard side panama lead.

By 1856, the ship had passed SC7 at a steady speed of 4.5 knots and shortly after 1948, passed the fairway buoy and was clear of the South Channel.

The pilots and Orient Centaur’s master checked the proposed route to the emergency anchorage, and determined that the emergency anchorage position would not provide a satisfactory UKC for the ship in the loaded condition. At 2010, the comms pilot informed RHM that the emergency anchorage area did not have sufficient water for the ship’s draught and an alternative position was agreed.

Figure 5: Tugs Harry Evans arriving at Orient Centaur and Peter Crooke fast on the port quarter

Source: Ports North pilots

At 2120, the tugs started slowing the ship in preparation for letting go the starboard anchor. Shortly after, SL King was cast off and the ship’s crew prepared the anchor for letting go.

The ship’s starboard anchor was let go at 2137. By 2206, all three tugs were clear of the ship and the pilots disembarked at 2218.

Orient Centaur remained at anchor throughout 7 November 2017, during which time the ship’s engineers completed the cylinder liner jacket replacement. The main engine was tested and made ready for departure.

At 0800, 8 November 2017, marine surveyors from AMSA and the ship’s classification society attended the ship with a dive team. The dive report noted some loss of paint on the starboard shoulder and no damage or paint loss on the port quarter.

The AMSA surveyor revoked the detention order at 1345, and at 1518, the ship weighed anchor and proceeded to China.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Weipa has a diurnal tide range, which is characterised by one high water (tide) and one low water (tide) per day. Typically, with a diurnal tide each successive high or low tide is 24 hours and 50 minutes apart, this is the length of one lunar day.
3. A size that is at the lower end of the range of cape-size ships, which have dimensions larger than that allowable for transit of the Panama Canal.
4. Conduct of the ship’s passage means directing the navigation and movement of the ship.
5. Weipa Port Procedures - Vessels in excess of 240 m in length with a beam greater than 38 m may be subject to Full Mission Bridge Simulation (FMBS) exercises before any approval will be considered.
6. The capacity of tugs is measured by their rated Bollard Pull. The Bollard Pull of a tug is the force it exerts at zero forward speed, in calm water conditions, with the engine working at its full power.
7. Bollard pull test measuring the static pull from the vessel undertaken in July 2012.
8. Bollard pull information from the Port Procedures and Information for Shipping – Port of Weipa, August 2017.
9. Bollard pull test measuring the static pull from the vessel undertaken in July 2012.
10. One shackle equals 90 feet or 27.43 m.

Context

Orient Centaur main engine cooling system

Orient Centaur was fitted with a Hyundai MAN B&W 6S60MC-C7 slow speed engine (appendix A). The six-cylinder engine is cooled by a central cooling system.^[11]

Figure 6: Jacket water cooling diagram

Source: MAN Two-stroke MC/MC-C Engines

The cylinder liner is made of alloyed cast iron and suspended in the cylinder frame with a low‑situated flange. The top of the cylinder liner is fitted with a cooling jacket. The cylinder cover, made of forged steel, is attached to the cylinder liner and has bores for cooling water.

The jacket cooling water system (Figure 6) is used for cooling the cylinder liners, cylinder covers, and exhaust valves of the main engine, and for heating the fuel oil drainpipes.

The engine manufacturer had issued a service letter (SL2014-584/LRA) in January 2014, regarding the cooling water systems associated with engines of this type. The service letter provided a number of possible actions to prevent corroded or cracked engine parts (cylinder cover, cylinder liner and cooling jackets) and cooling water leakage. It stated:

…most cases of heavy corrosion in the cooling water system or cracked cylinder cooling jackets on the cylinder cover, were related to insufficient cooling water maintenance. Heavy deposits tended to find the way into the clearances between the cylinder cover and the cooling jacket. This made heat expansion of the cylinder cover impossible without also exposing the cooling jacket to significant stress as the heat expansion is reducing the clearances. In combination with heavy corrosion of the engine components caused by insufficient cooling water treatment, the cooling jacket may consequently crack.

Consistent with the detail in the service letter, the engine jacket water needed to be carefully treated, maintained and monitored to avoid corrosion, corrosion fatigue, cavitation, and scale formation.

The crewmembers who were in the engine room at that time of the occurrence sighted water coming from a crack in the cylinder cooling jacket of the cylinder head of cylinder number 1 (Figure 7). The loss of jacket water triggered the main engine to shut down.

Figure 7: Cylinder cooling jacket failure and crack (after cleaning)

Source: Interorient accident investigation report annotated by ATSB

The engine manufacturer subsequently inspected the failed cylinder cooling jacket and identified that:

• the jacket had one vertical crack that passed through a securing bolt hole
• there were four bulges around the crack but no evidence of any impact marks
• the cooling space of the inner cooling jacket had heavy corrosion/rust and metal peeled off.

The cooling water systems were tested for nitrites, chlorides and pH after the incident. All were within limits, however the chloride tests of the high temperature cooling water were slightly high.

Port of Weipa

Located on the north-west coast of Cape York Peninsula, the Port of Weipa’s primary export is bauxite (aluminium ore) from the Rio Tinto Alcan mine (RTA). North Queensland Bulk Ports Corporation (NQBPC) is a statutory Queensland government‑owned corporation charged with overseeing the commercial activities in the port, including the maintenance of the port infrastructure. The primary function of NQBPC, under the Transport Infrastructure Act 1994, is to establish, manage and operate effective and efficient facilities and services within the port, while maintaining appropriate levels of safety and security.

Port Procedures

Maritime Safety Queensland (MSQ), the maritime regulator, administers the State’s shipping legislation. MSQ appoint Regional Harbour Masters (RHM), who are authorised to give direction under the relevant provisions of the Transport Operations (Marine Safety) Act 1994. An RHM controls the pilotage areas within their region and has the authority to direct the master of a ship to navigate or operate a ship in a prescribed way.

Each pilotage area has a Port Procedures and Information for Shipping Manual (PPM).^[12] The PPM details services, mandatory regulations and procedures to be observed. The manual also includes guidelines and information to assist masters, owners and agents of vessels arriving and departing the area.

MSQ operates a Vessel Traffic Service (VTS) for the Port of Weipa. The VTS is based at the RHM's office in Cairns, Queensland. VTS operators at Cairns have direct contact with shipping. In the event of an emergency, the VTS centre is the key notification and communications facility and activates the appropriate response agencies.

Pilotage

All ships that are 50 m or more in length, proceeding within a Queensland pilotage area, must carry a licensed marine pilot or be under the command of a master who holds a pilotage exemption certificate for the area. Far North Queensland Ports Corporation Ltd (Ports North) provide the compulsory pilotage service for the Port of Weipa, as well as for the ports of Cairns, Cape Flattery, Mourilyan, Karumba, Thursday Island (Port Kennedy) and Skardon River.

Sailing times

Ships can only depart Lorim Point on a flood tide and are scheduled so as to depart the berth 1 hour 15 minutes before the high water at Humbug Point (Figure 1). This scheduling allows ships about 30 minutes to enter and steady in the South Channel by the time they are off Urquhart Point. By that time, the tidal stream should have reduced to less than one knot.

First-strike response

The Port of Weipa had an emergency response plan (First-strike Oil Spill Response Plan), prepared by the Queensland Department of Transport and Main Roads, for dealing with pollution from ships. The plan detailed the operational arrangements between MSQ and Ports Corporation of Queensland and the response and handover arrangements for oil spills within the port. Further, the plan identified available resources and key contact information for responding to an oil pollution incident.

The plan was to be used in conjunction with the following:

• the Queensland Coastal Contingency Action Plan (QCCAP)
• Maritime Safety Queensland's Standard Operating Procedures for oil spill response
• the Oil Pollution First-Strike Response Deed for the Port of Weipa.

MSQ is both the statutory and combat agency for ship‑sourced oil spills and the incident controller for all incidents within the scope of the plan. North Queensland Bulk Ports (NQBP) are responsible for ensuring that an adequate first‑strike oil spill response capability is maintained within the port. The incident controller was the RHM, assisted by the NQBP Port Manager. The local first-strike response team consisted of six personnel, with either the NQBP Port Supervisor or MSQ representative as local incident controller, with five personnel from Rio Tinto Alcan.

Although the grounding incident did not result in any pollution, the incident debrief attended by all directly involved parties identified an issue with the first-strike response. As NQBP and MSQ have only one officer each based in Weipa, NQBP utilises Rio Tinto personnel to meet their responsibilities. It was not clear whether the first‑strike response team could have been assembled in a timely manner with the number of local personnel as required by the QCCAP.

Mini cape-size bulk carrier

Weipa arrival and departure simulation

In 2017, Rio Tinto Marine submitted a written application to the RHM for mini cape-size ships that were 255 m in length with a 43 m beam to export bauxite from Weipa. As the ships exceeded the port’s size limits, Full Mission Bridge Simulation (FMBS) exercises were required. In May and July 2017, the RHM, pilot manager, several senior pilots and a Rio Tinto shipping specialist, attended the MSQ Smartship simulator in Brisbane, Queensland, to conduct the FMBS exercises. The exercises (Figure 8) used a model of the mini cape-size bulk carrier for arrivals in a ballast condition and departures in a fully laden condition, to a maximum draught of 12.8 m.

Figure 8: Port simulation exercise report

Red arrows show areas of bank effect, yellow arrows show flood tide, other annotations show ship’s course, past positions and tidal information.

Source: MSQ regional harbour master (Cairns)

The ship’s manoeuvrability was tested in normal^[13] and extreme^[14] weather conditions. The recommendations included, among others:

The vessels push the limits for the channel, but simulation indicated they can safely enter and leave the port in conditions expected at Weipa.

Before final sign off can be given the following will need to be completed:

All pilots will need to spend two days in the simulator before handling the vessels to ensure they get “the feel”. These vessels are marginal and it was shown in the initial simulation that the pilots need to get used to the lack of power and the effect on the steering capability.

It was further recommended another 2-day simulation exercise be conducted to train two more pilots to handle the vessels. On the completion of the (Full Mission Bridge Simulation) exercise and risk assessment, a vessel of this class is chartered to Weipa for a couple of voyages to “prove” the feasibility. Provided this is successful more pilots would be trained and the number of mini cape vessels be limited to 5 vessels of the same class.

Risk assessment

The RHM’s risk treatment action plan, based on the outcomes of the FMBS exercises for mini cape-size ships entering the Port of Weipa was completed prior to any shipment trials. The plan covered four areas, general, channel entry, berthing and departure. The plan also covered the risks, current controls, interventions and identified the responsible officer in each area.

The general risk controls included the PPM requirements, simulated arrival and departure conditions, bridge resources management issues, and ship characteristics among others. The risk controls also required that two pilots, appropriately qualified and trained in the simulator, were to be on board for the ship’s transit.

The arrival channel entry risks detailed environmental effects, wind and leeway limits related to the 106 m wide South Channel widening to Cora Bank (Bell Mouth). The average draught of the mini cape-size bulk carriers in ballast was 7.5 m and the ships arrive on a rising tide, with the maintained channel depth at 11.1m. The risk assessment identified the possibility of main engine failure during arrival, and the ship’s anchors ready and tugs available as the mitigating risk controls. This was on the basis that ships in ballast have shallower draught, and therefore have less chance of grounding in the 11.1 m deep approach channel. Further, with this greater clearance under the keel (compared to fully‑laden deep draught departure channel clearance) the ships’ anchors can be used to assist manoeuvring and control.

In addition, during arrivals, a tug is required to be on stand-by at SC24 beacon, at the entry into Cora Channel. The tug is positioned adjacent to the section of approach channel with the more shallow water outside the channel and thus the greater risk to grounding should a ship leave the channel. From this position, the tug is immediately available to assist ships on approach to Urquhart Point if needed.

The berthing risks included control measures for the ship’s draught, usage of tugs, speed of approach and use of sound navigational methods. An intervention measure required that only pilots with an endorsement for mini cape-size ships would be assigned to this type of ship.

The departure risks identified the same areas of risk as for the channel entry, with the same controls and intervention measures. Engine failure was also identified as a risk, with controls being escort tugs, and that they be available.

At the conclusion of the exercises, the RHM recommended ship trials into the Port of Weipa under the following conditions:

• the vessels must be one of the five sister ships
• vessel to be loaded no deeper than 12.8 m and use static UKC of 10 per cent draught
• entry and departure for first six visits to be in daylight only
• two senior pilots who have attended the simulation to be on board
• wind conditions maximum 25 to 30 knots
• departure from Lorim Point to be 1 hour 15 minutes before high water at Humbug Point to minimise current at Bell Mouth
• tugs to be available to escort until vessel has entered the South Channel – this may restrict other departures or arrivals
• 6 trial shipments to be permitted subject to the above conditions
• following trial, review pilot observations
• should further shipments be approved all, pilots who conduct the vessel to have completed 2 days simulator training.

Tug requirements

The PPM stated that all ships over a certain size that used the Lorim Point (Figure 1) berths were required to use a minimum of two azimuth stern drive (ASD) tugs for all movements. In addition, guidance for ships departing Lorim Point stated that the forward tug should be let go after the ship responded to helm movements, and the aft tug as required, when the ship was steady and passing Gonburg Point. Further, during the trials, tugs were to be available to escort until the ship had entered the South Channel. One of the objectives of escorting a ship is to apply high steering and braking forces via a towline to limit to impact of grounding. Escort tugs are specifically designed for this role to operate over long distances and at relatively high speeds. At the time of the occurrence, the Port of Weipa did not have any escort-rated tugs and the tug masters were not trained in the specifics of escort towage nor in emergency response.

ASD tugs can be operated in either direct or indirect towage methods (Figure 9). The method used in the Port of Weipa was direct towage, as the tugs were predominantly used for harbour work and assisting ship berthing and un-berthing manoeuvres. Direct towing is performed at low speeds from about 0‑ 5 knots. The tug uses its engines and propellers to generate the tow force (directly), which is governed by the conventional bollard pull of the tug.

Indirect towing can be performed at speeds in the range of 5‑12 knots. The tug generates a tow force (indirectly) by putting tension on the tow line using a combination of the tug’s weight, water pressure (from the tug’s skeg) and the resultant drag of the propeller wash. The tug can assist swinging and steadying by working around the radius of the towline. When working at the stern of a ship, the pull on the towline can be increased by a factor of 1.5 to 2 times the bollard pull.

The effectiveness of the towage methods is also dependent on the availability of safe water to work in. In a narrow channel, the ability to work around the radius of the towline is restricted. Therefore, with the ship at speed (about 8 knots) in the South Channel (106 m) it was prohibitive for a tug to effectively steer it using dynamic arrest mode. However, direct arrest mode remained an effective option when retarding (braking assistance) forces were required.

Figure 9: Azimuth stern drive tugs - direct and indirect towage methods

Source: Tug Use in Port, A Practical Guide, Captain Henk Hensen, annotated by ATSB

__________

•  
  11. The cooling water system has three circuits: a seawater system, a low temperature freshwater system and a jacket cooling water system.
  12. Port Procedures and Information for Shipping – Port of Weipa, August 2017.
  13. Normal weather conditions – wind, 20 knots gusting 25 knots from south-east and current, 2.7 knots maximum on flood and ebb tides.
  14. Extreme weather conditions – wind, 30 knots gusting 35 knots from south-east, south-south-west, west and northwest and current, 2.7 knots maximum on flood and ebb tides.

Safety analysis

Main engine failure

As Orient Centaur proceeded outbound in the South Channel, the main engine shut down due to low cooling water flow, and a loss of propulsion.

The loss of cooling water was the result of a crack in a main engine unit’s cylinder cooling water jacket through a securing bolt hole, an area of inherent stress concentration. Furthermore, consistent with the engine manufacturer’s service letter, it is possible that the effects of corrosion products found in the cooling water space contributed to the cracking due to increased stress in the area of the failure.

Mini cape-size bulk carriers operation

Port risk assessment

The hazards associated with engine failure (loss of propulsion) during departure from Weipa was considered during the approval risk assessment process and were to be mitigated by having tugs in attendance until the ship was steady in the South Channel. On the day of the occurrence, and after the ship had passed beacon SC 21, the tugs were stood down and instructed to return to the berth. Consequently, when the loss of propulsion occurred in the narrow South Channel, there was no effective mitigation against grounding. The time taken for tugs to reach the ship would depend on its position in the channel, as well as the proximity of the tugs.

The subsequent investigation report observations prepared by the Regional Harbour Master (RHM) stated:

Completed Risk Assessment shows having tugs standing by until vessel is steady in channel would help prevent the vessel “T boning” the shoreline in areas where the channel is wide enough for the vessel to sheer sufficiently to be 90 or almost 90 degrees to the bank when grounding could be more violent and lead to hull damage.

Slope of batter in vicinity of Beacon SC 12 was beneficial to grounding as it slowly brought the vessel to a stop.

Further to seaward increase in depth and reduction in slope of batter would have seen the vessel get further out of the channel and may have been grounded for more of the length of the vessel.

No vessel discharge facility or equipment is available in Weipa.

As the South Channel was only 106 m wide, the ship was too long to ‘T bone’ in the channel. However, after grounding on the northern batter, the stern swung on the falling tide and grounded on the southern batter, effectively blocking the channel. There was then a significant risk the ship’s structural integrity could be compromised and at that time, the pilots estimated they had about 30 minutes to refloat the ship. Fortunately, the actions taken by the tugs and the pilots on board enabled the ship to be re‑floated before the falling tide rendered the task impossible.

The subsequent grounding debrief, attended by the RHM, Maritime Safety Queensland, Far North Queensland Ports Corporation Ltd (Ports North), North Queensland Bulk Ports and Smit Lamnalco, identified this risk:

If the Orient Centaur hadn't been successfully floated the vessel may have grounded forward and aft across the channel. The steep channel batters coupled with the ebbing tide may have compromised the hull's integrity. This could have blocked the channel and essentially closed the Port of Weipa. Due to the potential complexity of the salvage and also the remote location and long transit times for suitable salvage equipment this could have led to a salvage and port closure lasting many months, which would have an effect on the Queensland economy.

Further:

If the vessel had grounded further west where the gradient of the batter was more gradual, the refloat may have been more difficult, although hull integrity may not have been such a concern.

Simulation

The pilots stated that, during departure, Orient Centaur handled in the same manner as during simulation. However, during the simulation exercises for the mini cape-size ships, emergencies such as loss of propulsion and/or steerage were not simulated in the South Channel. The pilots had previously been trained in simulated emergency scenarios and escort towage, but only for events such as loss of propulsion and engine failure in smaller vessels when entering/departing the less confined Bell Mouth.

After the incident, the ATSB attended the Smartship simulator to observe several pilots participating in a 2‑day mini cape-size ship simulation. During this time, the incident was simulated with and without tug assistance. With tug assistance (tow line centre lead aft), the ship was kept directionally stable and its speed reduced significantly, to control a grounding. Without tug assistance, the ship grounded in an uncontrolled manner.

The inclusion of a loss of propulsion simulation in a confined channel during the mini cape-size approval process would have informed the likelihood of grounding and the subsequent impact on port operations and provided the opportunity to practice the response to such an event.

Tug usage and availability in the Port of Weipa

In addition to the requirements of the Port Procedures and Information for Shipping Manual and the Ports North pilotage operations safety management system, the RHM required two tugs to escort a mini cape-size ship until it was steady in the South Channel. The tug crews then had to remain with the tugs until the ship had departed the South Channel.

The contingency for a ship grounding in the South Channel was that the tugs would be manned and ready to proceed to the ship. After Orient Centaur grounded, the tugs started to arrive at the ship after about 47 minutes.

The pilot’s orders to the tug masters during the refloating of the ship were standard and well understood, and the required tug movements were also standard practice. However, during the recovery, the operation of two tugs working in close proximity on the stern of the ship was different to that of the day-to-day operations of the tugs.

With a ship at speed, and with two tugs working at the stern, interaction forces between water flow patterns are generated by both the ship and tugs, and between the tugs themselves. When tugs are towing on a line, the situation is further complicated, as they are frequently changing position and heading, therefore operating in areas where they experience different interaction effects. The tug masters were conscious of these effects and reported spending a lot of time avoiding contact with each other during the recovery. This was particularly apparent when asked to either layback, or move out to lift the ship’s stern from port or starboard. This shows that a higher skill set than those associated with standard harbour towage practice was required during the response to the occurrence and for escort towage more generally.

However, the tug masters had not been trained in indirect towage methods, multiple tug usage or emergency scenarios. Additionally, at the time of the occurrence, the tugs were considered to be used as a means of controlling grounding and were not escort rated.

Emergency response to a pollution incident

This grounding occurrence did not produce any pollution however, in different circumstances activation of the pollution emergency response plan would been required. That response relied on trained personnel from North Queensland Bulk Ports to form the First-strike Oil Spill Response team. However, due to the limited availability of personnel at the time of the occurrence it was unlikely that that an emergency response to a pollution incident in the Port of Weipa would have been initiated in a timely manner. As detailed in the Safety issues and actions section of the report, appropriate proactive action has been taken to improve the emergency response.

Findings

From the evidence available, the following findings are made with respect to the grounding of Orient Centaur, which occurred in the South Channel, Weipa, Queensland on 6 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• As the ship was transiting the South Channel, its main engine shut down due to a loss of cooling water associated with failure of the number 1 cylinder cooling jacket. Following the loss of propulsion, the ship’s starboard shoulder grounded on the northern batter and its port quarter drifted across the channel to ground on the southern batter.

Other factors that increased risk

• In pre-trial simulations, the risks associated with engine failure during departure were only considered up to when a ship had entered the South Channel. Consequently, the tugs were not in attendance to assist if propulsion was lost. [Safety issue]
• The conditions for trial shipments required all pilots to complete extensive arrival and departure simulations, including transit through the South Channel. However, the simulations did not include contingencies, such as loss of propulsion and/or steerage that would have assisted in determining the risk of, and response to, such occurrences.
• Tugs were to be available to escort the mini cape-size ships until they had entered the South Channel, where they were stood down. However, the tug masters had not been trained in the specifics of escort towage nor in emergency response. [Safety issue]

Other findings

• At the time of the incident, it was unlikely that that an emergency response to a pollution incident in the Port of Weipa would have been initiated in a timely manner. Subsequently, appropriate proactive action has been taken to address the emergency response issues.
• The actions of the pilots, ship's crewmembers and tug masters following their arrival at the ship were timely and significantly reduced the consequences of the occurrence.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to initiate safety action proactively, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the marine industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Mini cape-size risk assessment

Safety issue number: MO-2017-010-SI-01

Safety issue description: In pre-trial simulations, the risks associated with engine failure during departure were only considered up to when a ship had entered the South Channel. Consequently, the tugs were not in attendance to assist if propulsion was lost.

Usage of tugs

Safety issue number: MO-2017-010-SI-02

Safety issue description: Tugs were to be available to escort the mini cape-size ships until they had entered the South Channel, where they were then stood down. However, the tug masters had not been trained in the specifics of escort towage nor in emergency response.

Additional safety issues

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Interorient, the ship’s managers advised the following proactive actions will be taken:

• water analysis on board weekly

• water analysis at shore every 6 months

• checking appropriate tightening of Cylinder Head every 8000 hrs

• proper overhaul of cooling jacket (replacement of o rings and cleaning) and use of original spares according to manufactures instructions, service letters and manual every overhaul

• checking securing bolts as per manufactures service letters every overhaul

• proper tracking of running hours monthly

• original spare cooling to be available on board at all times

• all cylinder jackets renewed within 1 year from incident

• maker guidance/recommendations and service letters are followed as per planned maintenance system schedule.

North Queensland Bulk Ports (NQBP) advised their operations have been reviewed and have taken the following proactive actions:

NQBP have prepared a tender package for the provision of Salvage and Casualty Advice for all NQBP Ports to include:

- guidelines to assist NQBP on items that may be included in vetting requirements to minimise the likelihood of an incident in the future

- the establishment of appropriate minimum insurance requirements for ships using NQBP ports

- provide response timing and plans, which are considered for reasonably foreseeable events within their Ports.

Obtained quotes for Vessel Vetting Service (Rightship) to facilitate implementation of additional vetting protocols. Implementation is planned following the review of Salvage Planning, as this work will also consider vetting parameters that can be enforced to minimise the likelihood of an incident occurring.

As part of this process, NQBP has already sought from each of our Terminal Operators detail of their vetting processes, specifically the criteria that they are vetting to.

Completed a First Strike Oil Response exercise in Weipa

NQBP was added to the Weipa VTS Incident Notifications

NQBP are currently in the process of undertaking a Risk Assessment & Management review of our Ports for marine operations. This process is being completed in conjunction with the RHM, Terminal Operators and Towage Providers for each Port.

General details

Ship details

Appendices

Appendix A – Engine cross section MAN B&W 6S60MC-C7

Sources and submissions

Sources of information

The sources of information during the investigation include:

• the master and involved crewmembers of Orient Centaur
• Interorient
• the Australian Maritime Safety Authority
• the Regional Harbour Master (Cairns), Maritime Safety Queensland
• the Manager Pilotage Services, Ports North
• North Queensland Bulk Ports
• Smit Lamnalco.

References

Rowe, Captain RW (with Russell, Captain PJD). The Ship Handler’s Guide, The Nautical Institute in conjunction with the Warsash Maritime Centre, London.

Hensen, Captain Henk. Tug Use in Port, A Practical Guide, The Nautical Institute, London.

Maritime Safety Queensland (MSQ) 2017, Port Procedure and Information for Shipping – Weipa, MSQ, Brisbane. Available at https://www.msq.qld.gov.au

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to master and directly involved crew and managers of Orient Centaur, the ship’s flag State, the pilots and manager pilot services, the Regional Harbour Master (Cairns), North Queensland Bulk Ports, Smit Lamnalco and the Australian Maritime Safety Authority and Regional Harbour Master (Cairns).

Submissions were received from the Australian Maritime Safety Authority, the pilots and manager pilot services and the Regional Harbour Master (Cairns). The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

At 1242 Eastern Standard Time^[1] on 18 November 2017, a Bell 206 helicopter, registered VH‑SDZ (SDZ), departed from Middlemount Airport, Queensland with a pilot and crew member on board to conduct power line inspections 32 km to the south.

At approximately 1255, the pilot positioned the helicopter in a hover 30 ft above the ground and 40 metres from a transmission tower so that it could be photographed by the crew member. After 3-4 minutes of hovering, the pilot heard what was described as a ‘very loud bang’ through the airframe, which was also felt through the controls. The helicopter began to shake violently and bounce vertically. The pilot also reported seeing tiny pieces of debris falling in front of the helicopter.

In response, the pilot immediately lowered the collective, intending to land in a clear area below the helicopter, but it did not respond to collective or cyclic control inputs. Instead, the helicopter began to pitch upward and drift backwards. The helicopter then yawed to the right, most likely due to contact with trees behind. The yaw could not be controlled with the tail rotor pedals so the pilot moved the throttle to the idle position. Despite attempts to level the aircraft, the left skid contacted the ground first and the helicopter rolled over.

The pilot moved the throttle and fuel shut off valve to the off position and switched off the battery before both occupants exited the helicopter. The pilot and the crew member were uninjured as a result of the occurrence.

Figure 1: VH-SDZ following collision with terrain

Source: Operator

Component examination

Examination of the helicopter following the occurrence identified that the mast, both pitch links, and the swashplate were fractured. The mast collar set was also fractured and not engaged with the mast^[2]. The operator initially suspected that the mast collar set had disengaged in flight.

The mast collar secures the swashplate’s rotating ring to the mast. It is designed to drive the rotating ring at the same speed as the main rotor. If the mast collar is not engaged, the pitch links connecting the swashplate to the rotors are exposed to transverse forces for which they are not designed. This can result in the pitch links winding around the mast.

The fractured components and trunnion bearings (connecting the pitch links to the rotor blades) were sent to Bell Helicopter’s Engineering Laboratories for detailed examination (Figure 2). The initial examinations were also attended by the United States Federal Aviation Administration. Bell provided a report of their findings to the ATSB.

Figure 2: Components examined at Bell Helicopter’s Engineering Laboratories

Source: Bell Helicopter

The hypothesis of mast collar separation was considered by Bell Engineering Laboratories. It was determined that an in-flight separation would likely have resulted in rotational damage on the mast and mast collar splines, which was not observed. The damage observed in the pitch links was also not consistent with a separated mast collar.

Bell Helicopter concluded that all of the fractures, including that resulting in the mast collar separation, were a result of overstress. No pre-existing defect was found and all damage observed was secondary to the occurrence. Seized or damaged trunnion bearings were also considered for inhibited movement of the pitch links, which could result in abnormal bending loads. However, the condition of the trunnion bearings was found to be typical for bearings removed from service.

In summary, there were no findings made during the inspection at Bell Helicopter’s Engineering Laboratories that identified the probable factors contributing to this occurrence. The reason for the loss of control was therefore not determined.

Findings

While hovering, the pilot experienced a loss of cyclic and collective control that resulted in a ground collision. The reason for the loss of control was not able to be determined.

Safety message

This accident highlights how rapidly an emergency situation can develop. Recognising that the pilot had limited control authority on this occasion, regular practice and/or briefing of emergency actions will increase the likelihood of a correct response.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Universal Coordinated Time (UTC) + 10 hours.
2. The Drive Link Assembly (including the drive link and mast collar set) connects the swashplate to the mast, so that they rotate together. The swashplate adjusts the pitch of the main rotor blades via the pitch links.

What happened

On 8 November 2017, at about 1508 Eastern Standard Time,^[1] the pilot of a Robinson R44 helicopter, registered VH-WRR and operated by Whitsunday Air Services, ditched about 49 km north of Hamilton Island Airport, Queensland. In addition to the pilot, there were three passengers on board.

Prior to the flight, the passengers received a safety briefing and were instructed to wear seatbelts and life jackets. At about 1430, the helicopter departed Hamilton Island for a 1 hour scenic (charter) flight over Whitehaven Bay and the Great Barrier Reef.

When about 40 minutes into the flight, on return to Hamilton Island, the pilot heard the engine sound decrease and noted that the helicopter was unable to maintain the cruise altitude of 1,000 ft. The pilot checked the manifold pressure^[2] gauge and noted it was at 22 inches Hg, however, it was set at 24.5 inches Hg when leaving the reef between 500 and 1,000 ft. In response to the reduction in power, the pilot raised the collective^[3] to increase power and maintain altitude, but the manifold pressure did not change. The pilot reported that the indicated main rotor revolutions per minute (RPM) decreased and the low rotor RPM horn activated. The engine RPM indication was also oscillating throughout the range.

In response to the low RPM horn, the pilot increased throttle and again raised the collective. The rotor RPM initially spiked and then decreased with associated re-activation of the low rotor RPM horn. The engine RPM gauge continued to oscillate and the helicopter could not maintain altitude. The pilot noticed the engine noise was changing with the fluctuations in the indications. However, there were no further indications that suggested a problem with the helicopter.

Consequently, when at 700 ft, the pilot elected to conduct an autorotation^[4] onto the water. The pilot activated the emergency flotation system^[5] and broadcast a MAYDAY^[6] call on the common traffic advisory frequency. The engine RPM gauge continued to provide erratic readings and the low engine sound continued during the landing. About 30 seconds later, the helicopter landed on the water with the emergency floats deployed (Figure 1).

The pilot contacted another company pilot who was operating in the area and informed them of the situation and their location. The pilot shut down the engine and applied the rotor brake.^[7] The pilot activated the emergency locator transmitter and instructed the passengers to prepare to inflate their life jackets and undo their seatbelts in readiness to exit the helicopter.

About 10 to 15 minutes later, the company aircraft was circling overhead. The pilot and passengers remained in the helicopter until they were rescued by the crew of a local vessel about 1 hour later. All occupants were uninjured. While there appeared to be no observable damage sustained to the helicopter, it later sank and was unable to be recovered.

Figure 1: VH-WRR after ditching about 49 km north of Hamilton Island Airport, Queensland

Source: Australian Maritime Safety Authority, modified by the ATSB

Additional comments

The following additional comments were made with regard to the accident:

• The pilot reported refuelling the helicopter prior to the flight and conducting a check for contaminants, none of which was found. After the helicopter had landed on the water, the fuel gauges indicated that the tanks were half full.
• A review of the meteorological conditions around the time of the accident indicated they were conducive to serious carburettor icing conditions with descent power selected.
• The Civil Aviation Safety Authority noted the partial power loss described in this accident may be consistent with a magneto/governor failure, which has reported to have occurred on other R44 helicopters.
• A maintenance logbook entry around 2 weeks prior to the accident noted that the helicopter had intermittent tachometer/governor fluctuations. The right magneto points were found to be out-of-tolerance and adjusted. A ground run to test the adjusted magneto was completed satisfactorily. Robinson Helicopter Company had issued Service Letter 62, which stated that the throttle governor signal source was ‘the tachometer breaker contact (points) assembly located within the engine-right magneto…excessive wear causing insufficient point gap…(that) could cause an erratic tachometer indication.’
• Post-accident discussions between the manufacturer, operator and maintenance provider resulted in a consensus of opinion that the power reduction was associated with either a governor control failure and or a compromised engine RPM signal from poor tachometer points.

Similar occurrences

A search of the ATSB’s database found the following occurrences involving an engine power loss followed by a ditching in helicopters:

• On 3 January 2011, a Robinson R44 helicopter, departed Cairns Airport, Queensland for a 30-minute charter flight (ATSB investigation AO-2011-001). About 25 minutes into the flight, when at about 400 ft above mean sea level, the engine failed and the rotor low RPM horn sounded. The pilot broadcast a MAYDAY and entered autorotation. During the descent, he deployed the emergency floatation system, however, the right float did not fully inflate. When at about 50 ft above the sea, the helicopter entered an uncommanded 360⁰ yaw to the left. The pilot was unable to control the yaw and the helicopter impacted the water heavily and turned onto its right side. The pilot assisted the passengers to egress and inflated their life jackets. A post-occurrence engine strip and examination found no fault that would give reason for the engine to fail in flight.
• On 26 January 2011, a Robinson R44 helicopter departed the Knuckle Reef helipad, Queensland, for a 20-minute charter flight (ATSB investigation AO-2011-008). On board the helicopter were the pilot and three passengers. While returning to the helipad 15 minutes later, at about 950 ft above sea level, the helicopter experienced engine problems, including a sudden loss of cylinder head temperature indication and variations in the engine manifold pressure. The helicopter was unable to maintain altitude and began to descend at 200 ft per minute. The pilot inflated the emergency floatation system, commenced an autorotation and landed on the sea. Following the safe recovery of the occupants, the helicopter was unable to be recovered.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During the cruise, for undetermined reasons, the helicopter experienced a partial engine power loss. After unsuccessful attempts to increase power, the pilot manually deployed the emergency floatation system and performed a successful ditching.

Safety message

Power loss

Without the recovery of the helicopter, the reasons for the partial engine power loss could not be conclusively determined. However, the indications were consistent with a magneto/governor failure, which Robinson Helicopter Company have published a revised service letter Governor troubleshooting / magneto maintenance describing how the failure occurs and the compliance procedure.

The pilot commented that this was the first time he had been involved in an emergency situation and the training he received prepared him well for executing the autorotation and managing the situation after landing on the water.

The United States Federal Aviation Administration Helicopter Flying Handbook stated that, when rotor RPM begins to decrease, it is essential to recover and maintain RPM. Low rotor RPM and ensuing blade stall can result in a total loss of rotor lift, allowing the helicopter to fall to the surface and possibly resulting in blade strikes to the tail boom and other airframe damage. Low rotor RPM during an autorotation may result in a less than successful result.

Survival factors

This accident highlights the importance of being adequately prepared for an emergency situation such as a ditching. In this case, the helicopter was fitted with an emergency floatation system, the passengers were wearing life jackets, and the pilot’s post-landing actions resulted in a positive outcome where no injuries occurred. Without a floatation system the risk of the helicopter sinking with the occupants on board would be greatly increased.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time is Coordinated Universal Time (UTC) + 10 hours.
2. Manifold pressure: Pressure in the inlet manifold of a piston engine, normally local atmospheric, measured in inches of mercury (Hg).
3. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
4. Autorotation is a condition of descending flight where, following engine failure or deliberate disengagement, the rotor blades are driven solely by aerodynamic forces resulting from rate of descent airflow through the rotor.
5. Emergency floatation system: inflatables fitted to the aircraft to provide water buoyancy in an emergency.
6. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
7. The rotor brake is a device used to stop the rotor blades during shutdown.

What happened

On 18 November 2017, the flight crew of a Boeing 777-319(ER) aircraft, registered ZK-OKN and operated by Air New Zealand, was conducting a scheduled passenger service from Auckland, New Zealand, to Brisbane, Queensland. The flight crew consisted of the aircraft captain, who was the pilot flying (PF), and the first officer, who was the pilot monitoring (PM).^[1]

The flight crew commenced duty at 0525 Eastern Standard Time,^[2] and the aircraft departed Auckland at 0630. As the aircraft approached descent into Brisbane, the flight crew copied the expected arrival procedures and weather conditions from the ATIS.^[3] The ATIS, information ‘OSCAR’ (O), stated that arriving aircraft were to expect an instrument approach to runway 01,^[4] and that the wind at the threshold of runway 01 was 180° at 5 kt, with a maximum tailwind of 5 kt. The flight crew programed and briefed for an expected SAVER1P standard arrival procedure with an RNAV-P (RNP) RWY 01 approach. The PF reported that, in response to the expected tailwind on final approach and landing, the approach briefing included the importance of ensuring that the aircraft did not get high during the descent and approach.

Prior to commencing the descent, the aircraft was cleared to conduct a SAVER1A standard arrival procedure for an ILS approach to runway 01 (Figure 1).The flight crew reprogrammed and re-briefed the arrival before commencing the descent.

Figure 1: An extract of the Jeppesen SAVER1A chart

The aircraft’s quick-access recorder (QAR)^[5] provided information on the aircraft’s flight parameters, autoflight system altitude targets, and autoflight system modes. During the descent, the aircraft was being controlled by the PF through the use of an autopilot, with flight profile changes being achieved through selections on the mode control panel (MCP) (see Figure 2). Under normal procedures, the flight crew were required to verify autoflight system mode changes, such as those selected on the MCP, had been activated through the required mode being displayed on the flight mode annunciator (FMA). The FMA, located just above the primary flight display (see Figure 2), displayed the active flight modes for, from left to right, the autothrottle, roll and pitch.

Figure 2: Flight deck panels identifying the mode control panel with associated controls, and the primary flight display with the flight mode annunciator expanded.

Source: Boeing, annotation by ATSB.

The aircraft commenced descent at 0856 with the autopilot selected on and the autoflight system being selected to the LNAV and VNAV modes.^[6] Approaching DUNNI, at 0919 with a descent clearance limit of 5,000 ft, air traffic control (ATC) cleared the aircraft to continue the descent to 4,000 ft. In response, the PF set 4,000 on the MCP and the aircraft continued the descent while tracking towards VETIS. At about 0921:15, a change of controllers commenced at the ATC workstation. The handover to the new controller was completed at about 0922:30. During this period the aircraft was approaching VETIS, and the flight crew reported that they were keen for further descent, being mindful of the desire to ensure that the aircraft did not get high on the descent.

Shortly after passing VETIS, at 0922:45, and while maintaining 4,000 ft, ATC cleared the aircraft to descend to 3,000 ft and for the ILS runway 01. The PF selected 3,000 ft in the MCP altitude window (see Figure 3 at 0922:52) and pressed the altitude selector^[7] to initiate further descent. The PF later observed that the altitude selector was probably not properly pressed. As a result, the expected flight mode change did not occur and the aircraft did not commence the descent as expected. The QAR data recorded the autoflight pitch remaining in the VNAV mode, however, the flight crew later reported that the VNAV mode changed from VNAV PTH to VNAV ALT. The PF reported that this pitch mode change was unexpected and unfamiliar. The flight crew operations manual stated the following with respect to the pitch mode entering VNAV ALT:

When a conflict occurs between the VNAV profile and the MCP altitude, the airplane levels and the pitch flight mode annunciation becomes VNAV ALT. The airplane maintains altitude. To continue the climb or descent, change the MCP altitude and push the altitude selector or change the pitch mode.

In response, and with the intent of ensuring that the aircraft did not get high on the desired descent profile, the PF selected the V/S^[8] mode, and then the FLCH^[9] mode, to initiate the descent. The aircraft commenced descending and at 0923:33 the autoflight system commenced reducing the rate of descent to capture the cleared altitude of 3,000 ft—indicated by the ALT^[10] mode activating. Shortly after, and as the aircraft passed through LOGAN, the autoflight system transitioned back into the VNAV mode and then the ALT mode.

Figure 3: Flight data for the period 0922.45 (at about VETIS) to 0925.00 (just before GLENN).

Source: ATSB

As the aircraft was turning towards GLENN, and maintaining the cleared altitude of 3,000 ft, the PF selected 1,000 ft in the MCP and then the FLCH mode with the intent of continuing the descent further. About 5 seconds later, at 0924:03, the aircraft commenced descent from 3,000 ft. At 0924:14, as the aircraft had passed 2,850 ft, ATC instructed the aircraft to maintain best speed, and at least 180 kt until 5 NM final. The PM acknowledged the instruction.

At 0924:35 the PF raised the MCP target altitude to 2,000 ft and changed the flight mode to V/S. At 0924:50, ATC alerted the aircraft that it was cleared to 3,000 ft and that it was descending through 2,200 ft, which was acknowledged. The aircraft levelled at about 2,000 ft and maintained that altitude until it intercepted the glideslope for the ILS. The aircraft landed at 0929 without further incident.

Pilot comments

The PF later reported that, as a result of not properly pressing the altitude select push button to commence the descent from 4,000 ft, the workload experienced increased significantly. This resulted in what the PF described as a loss of situational awareness. After being alerted by ATC that the aircraft was below the cleared altitude of 3,000 ft, and at that time having the runway in sight and being able to maintain visual conditions until landing, the PF decided to maintain 2,000 ft until the aircraft re-joined the approach profile to reduce the workload.

The PM reported that the PF’s actions in descending below the cleared level were not challenged, as this was the first time that the PM had flown this approach.

Operator’s comments

The crew underwent a training session in the B777 simulator to replicate the event and to identify how the error was able to manifest. The training also represented an opportunity to reinforce the use of the various modes for the approach phase.

The RNAV approaches are regularly treated as step down approaches by controllers. The RNAV approaches were designed to reduce pilot and controller workload, however, they regularly increase the pilot workload and increase the opportunity for crew errors. It is also not uncommon to be taken off an RNAV path, given radar vectors then put back on the RNAV at some point in the RNAV path sequence which also increases pilot workload.

Related occurrences

A number of ATSB investigations have examined occurrences that included altitude deviations in flight path involving foreign crew operating within Australia. Of these, two recent examples are summarised below. Full reports are available at the ATSB website.

ATSB investigation AO-2017-026

On the morning of 22 February 2017, a Singapore Airlines Boeing 777-212, from Singapore Changi Airport, Singapore, to Canberra Airport, Australian Capital Territory, was conducting a standard arrival into Canberra when it descended through an altitude constraint associated with the arrival procedure. The error was the result of FMC entry omissions and the flight crew not identifying the relevant altitude limitation.

ATSB investigation AO-2016-012

During a second approach into Perth Airport, Western Australia, an Airbus A320 aircraft operated by PT Indonesia AirAsia was conducting a VOR approach to runway 06 when the flight crew descended the aircraft earlier than normal, but believed that they were on the correct flight path profile. While descending, both flight crew became concerned that they could not visually identify the runway, and focused their attention outside the aircraft. At about that time, the approach controller received a ‘below minimum safe altitude’ warning for the aircraft. The controller alerted the crew of their low altitude and instructed them to conduct a go-around.

Safety analysis

The approach and landing are phases of flight known to have high workload. That workload can increase exponentially when errors and the unexpected occur. As a result of not pressing the altitude selector properly, and then checking that the required flight mode change occurred on the FMA, the PF’s workload increased substantially. This resulted in the PF losing awareness of the aircraft’s descent profile, and in particular the aircraft’s altitude versus the distance to landing, a component of what is commonly referred to as situational awareness. This loss of descent profile awareness, combined with a preconception that the aircraft should not get high on profile during the positioning for final approach, resulted in the PF initiating a descent below the altitude limit of 3,000 ft that was required to be maintained until the aircraft was established on final approach. The PF identified the error and began levelling the aircraft just before the flight crew were notified by ATC that the aircraft had breached the descent clearance limit.

The PM role requires an awareness of the PF actions as well as an awareness of the aircraft’s flight profile relative to the clearance limit and any limitations associated with the approach procedure. While the PM had not flown this approach before, the monitoring role during the approach was not effectively executed.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• As a result of high workload, a loss of awareness of the aircraft’s descent profile, and a preconception with ensuring that the aircraft did not get high on the approach flight path, the flight crew initiated a descent below the cleared altitude of 3,000 ft as the aircraft was positioning for final approach. The flight crew corrected the error and levelled the aircraft at about 2,000 ft shortly before being alerted of the altitude breach by ATC.

Safety message

This investigation identifies how an error can increase workload, particularly during a phase of flight that has an already high workload. It also highlights the importance of confirming mode changes on the FMA. Handling of approaches to land continues to be a safety priority for the ATSB.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10.0 hours.
3. Automatic terminal information service, a continuous and repetitive broadcast that provides current, routine information to arriving and departing aircraft. That information normally includes current meteorological conditions at the airfield, as well as expected approach requirements.
4. Runway number: the number represents the magnetic heading of the runway.
5. A QAR is an airborne flight data recorder that provides quick and easy access to raw flight data. QARs provide a limited scope of flight data. The QAR data did not identify which autopilot was engaged, nor the specific component of VNAV that was the active mode.
6. The lateral navigation (LNAV) and vertical navigation (VNAV) modes command the autoflight system to follow the flight management system generated optimum lateral and/or vertical navigation flight path. VNAV is a general descriptor for three sub-component modes, VNAV PTH, VNAV SPD and VNAV ALT. QAR pitch data only identified that VNAV was active, not the specific component.
7. With the aircraft in level flight, in VNAV PTH or VNAV ALT pitch modes, and the selected altitude as displayed in the altitude window being below the current altitude, pushing the inner altitude selector will result in the aeroplane commencing a descent to the selected altitude.
8. The vertical speed mode, an autoflight mode that enables the flight crew to command a desired rate of climb or descent from the autoflight system.
9. Flight level change mode, an autoflight mode that enables the flight crew to command an immediate climb or descent to the target altitude as selected in the altitude window, without reference to any flight management system altitude or speed constraints.
10. The altitude hold mode (ALT) is activated by either pushing the MCP altitude HOLD switch, or capturing the selected altitude from a V/S, FPA, or FLCH climb or descent.

What happened

On 27 October 2017, at about 1900 Co-ordinated Universal Time,^[1] a Jetstar Airways Airbus A320 aircraft, registered VH-VGY, was being prepared for a scheduled passenger service from Auckland International Airport, New Zealand to Sydney, Australia. The captain was designated as the pilot flying and the first officer was the pilot monitoring.^[2]

At about 1909, the leading hand had finished loading the last container into the aircraft hold and was organising his paperwork. As it was raining, he decided to put the clipboard in the right engine (No. 2) cowling to stop his paperwork from becoming wet and blown by the wind, with the intention to retrieve it later. The leading hand went to the flight deck, gave some paperwork to the flight crew, and returned to the ground to organise the aircraft’s push back.

At about 1919, the dispatcher cleared the ground and servicing equipment from the aircraft and conducted the ‘duty of care’ walk-around. During the walk-around, she noticed the clipboard in the right engine and thought that the leading hand would return for it, so she continued with the walk-around. Soon after, the engines reportedly started normally.

At about 1925, when the aircraft was taxiing, the leading hand realised his clipboard with the paperwork was missing and thought the dispatcher had the paperwork. The leading hand asked the dispatcher about the clipboard and she mentioned she saw it in the right engine during the walk-around. The ground crew returned to where they were preparing the aircraft and noticed paper debris on the ground. The ground crew organised for their operations area to contact the flight crew.

At about 1937, the aircraft departed. Shortly after, when on climb through flight level^[3] 150, the flight crew received a radio call from the Auckland Approach air traffic controller to contact the surface movement controller. The captain handed control of the aircraft to the first officer and contacted the surface movement controller who advised that the ground crew had lost their paperwork and it may have been placed on the engine. The captain requested further information about the paperwork, specifically whether the paper was on top of the engine or inside the inlet. The flight crew checked the engine instruments and there were no abnormal indications. The surface movement controller confirmed that the paperwork was placed within the inlet and paper debris was found on the tarmac (Figure 1). The captain then contacted the company engineer at the airport and asked whether it was just paperwork or a clipboard with a metal clip. The engineer advised that a piece of sheared metal had been found. The flight crew decided to return to Auckland.

After landing at about 2048, the engine was inspected by engineers and paper was found throughout the engine. They also found minor damage to an engine fan blade and attrition liner.^[4]

Figure 1: Foreign object debris on the ground behind the aircraft (circled)

Source: Aerocare, modified by the ATSB

Additional comments

The leading hand stated that, due to the wind and rain, he felt the need to shelter the paperwork. Normally, staff use the pushback tractor for shelter during adverse weather and to prepare paperwork for the flight. There is a metal box on the loader to store the folder. However, as the pushback tractor was not yet present at the bay, he used the engine cowling. He recalled that he did not feel pressured to rush the departure.

The dispatcher stated that she did not view the clipboard as a foreign object as it belonged to the leading hand and had the paperwork for the flight. She assumed that the leading hand would retrieve it later, prior to engine start-up.

The captain stated that, to obtain more information about the incident, numerous calls were made to other agencies, which took considerable time. Further, due to poor communications, he was unable to contact the operator’s maintenance controller to discuss the engine’s status.

Procedures

The internal investigation into the incident by the ground handling operator, Aerocare, noted that the Jetstar Airways operational manual detailed the responsibilities of the dispatcher when conducting the ‘duty of care’ walk-around and provided a table of the steps involved for this process. While there was no specific requirement to check the engine cowlings/intakes for foreign objects, the manual stated that all staff operating near the aircraft were to be constantly observant for abnormalities and to report these to the leading hand or supervisor prior to the aircraft departing.

The investigation also noted that there was no procedure for the ground crew to establish communications with the flight crew in the event of a non-normal or emergency situation, either prior to or after the aircraft had departed. Further, there was no guidance on how paperwork was to be prepared and managed by ground crew during adverse weather conditions.

Previous occurrences

A search of the ATSB database found the following occurrence where a foreign object has been left on an aircraft:

• On 3 November 2015, the pilot conducted a maintenance test flight in a Eurocopter AS365 N3 helicopter, registered VH-WPX, at Jandakot Airport, Western Australia (ATSB investigation AO-2015-127). During the post-flight inspection, following this test flight, a licenced aircraft maintenance engineer noticed two large gouges to the leading edge of one of the main rotor blades. A spanner that had been used during the track and balance related adjustments could not be located. It was later located on an adjacent taxiway about 43 m from the hangar. Due to the scuff marks and scratches found on the spanner, it was determined that it had been left in the rotor head area and was likely ejected during engine start up.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• While preparing the aircraft for departure, the leading hand placed a clipboard in the right engine, which was subsequently ingested during start-up.
• During the walk-around, the dispatcher noticed the clipboard in the right engine, but believing it would be retrieved prior to the aircraft departing, the dispatcher did not notify the leading hand or supervisor of the foreign object debris as per company procedures.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety notices

Both Jetstar Airways and Aerocare have released a notice, which outlines that foreign object debris also includes items accidentally left behind. It further states that engines are not to be touched or used for the placement of items, and emphasises the responsibilities of ground crew to manage foreign object debris by clearing them and reporting their presence to other crew.

Updated procedures

As a result of this incident, Jetstar Airways released an updated aircraft dispatch procedure, which included:

• a specific warning about not placing items in the engine cowling
• improved detail around checks and responsibilities
• a section on emergency and non-normal procedures
• detailing methods for re-establishing communications between ground crew and flight crew such as visually gaining the attention of the flight or contacting them via radio.

Safety message

The presence of foreign object debris poses a significant threat to aircraft safety. It has the potential to cause aircraft damage during critical phases of flight, costing airlines and airports millions of dollars each year. This incident demonstrates the effect foreign object debris has on aircraft operations and emphasises the importance of not placing objects in aircraft engines. It further highlights that all staff operating near aircraft are responsible for reporting any non-normal events they encounter. It should not be assumed that others will perform a task where a hazard has been identified. Assuming other people will undertake a task, such as removing a hazard increases the risk of the task not being completed.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

1. Co-ordinated Universal Time (UTC): the time zone used for aviation. Local time zones around the world can be expressed as positive or negative offsets from UTC.
2. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL150 equates to 15,000 ft.
4. A layer of material lining the inside of the fan case adjacent to the fan blade tips. The attrition liner is designed to abrade away during abnormal, or extreme, engine operation without damaging the fan blades.

Safety summary

What happened

On 19 November 2017, a GIE Avions de Transport Regional ATR 72-212A aircraft, registered VH‑FVZ, was being operated by Virgin Australia Airlines as flight VA646 from Sydney, New South Wales to Canberra, Australian Capital Territory. On board the aircraft were the captain, first officer, a check captain, two cabin crewmembers and 67 passengers.

During the landing approach, the aircraft speed increased above the maximum allowable and the first officer (the pilot flying – the captain was the pilot monitoring) assessed that the aircraft was overshooting the desired approach profile. In response, the first officer reduced engine power to idle at a height of 118 ft above the runway elevation, leading to an increasing descent rate and reducing speed.

The aircraft subsequently landed heavily on the main landing gear, tail skid and underside of the rear fuselage. No persons were injured, however the aircraft sustained substantial damage.

What the ATSB found

During the late stages of the aircraft’s approach to land, the approach became unstable in speed and then in power setting. The flight crew did not recognise the unstable approach, however the pilot monitoring recognised the incorrect power setting and called for an increase in power then physically intervened shortly before touchdown. However, these actions were not effective in preventing the hard landing.

The aircraft also encountered a change in the wind direction and strength immediately before touching down, which increased the descent rate. This, combined with the already high descent rate, increased the amount of damage sustained by the aircraft.

What's been done as a result

Following this occurrence, the operator strengthened its guidance on the effects of sustained low power settings during approach and landing and the importance of avoiding that situation. These aspects are also being reinforced in training.

The operator also added additional criteria to its operational monitoring program to detect instances of low power settings at low level.

Safety message

Unstable approaches continue to be a leading contributor to approach and landing accidents and runway excursions. This occurrence demonstrates the importance of crews adhering to standard operating procedures and conducting a go-around when an approach becomes unstable. It also highlights the risks associated with the incorrect handling of an approach to land and the need for prompt and decisive action as the available time to remedy the situation is limited.

The occurrence

At about midday Eastern Daylight-saving Time ^[1] on 19 November 2017, a GIE Avions de Transport Regional ATR 72-212A aircraft, registered VH‑FVZ, was being operated by Virgin Australia Airlines as flight VA646 from Sydney, New South Wales to Canberra, Australian Capital Territory. A captain, first officer, check captain, two cabin crewmembers and 67 passengers were on board the aircraft.

The first officer was pilot flying (PF), and the captain was pilot monitoring (PM).^[2] The check captain was positioned in the observer seat on the flight deck, conducting an annual line check of the captain along with a six-month line check of the first officer.

Prior to commencing descent for Canberra, the first officer briefed the captain for the approach and landing. The first officer advised that the calculated target approach speed was 113 kt, the expected landing weight was 21,600 kg and that the reported weather indicated a crosswind from the right of 15 kt for a landing on runway 35. He also advised the captain that due to the heavy aircraft weight and the possibility of a tailwind at times during the approach, he would slow the aircraft earlier than normal to ensure the approach commenced at the target speed.

At 1319, the flight crew were conducting a visual approach to runway 35 at Canberra in conditions of light turbulence and with the autopilot engaged. As the aircraft descended through about 400 ft above the airport elevation, the first officer disconnected the autopilot and continued flying the approach manually. Later, as the aircraft descended through 265 ft above runway level in conditions of light turbulence, the aircraft speed reduced. In response, the PF increased power.

As the aircraft descended through 193 ft, the turbulent conditions combined with the increased power setting to increase the speed further. Eight seconds later, the speed had increased to 127 kt – 4 kt above the stabilised approach criteria upper limit (see the section titled Approach and landing). At this time, the aircraft was 118 ft above the airport elevation. The PF did not recognise the stabilised approach criteria exceedance. However, having assessed the presence of overshoot windshear,^[3] he reduced the engine power to idle. The selection of idle power at that stage of the approach also did not comply with a further stabilised approach criteria requirement. As a result of the power reduction, the descent rate increased and the speed reduced. At about this time, the check captain recognised that the power setting was too low, but assessed that input from him would not assist in the recovery of the approach.

At 1320:56, five seconds prior to the touch down, the PM recognised the inappropriate power setting and advised the PF to ‘ease on a bit’ [of power], the PF verbally responded to the advice, but did not increase power.

As the aircraft descended through about 50 ft above the runway, the recorded descent rate increased to 784 feet per minute, above the normal descent rate for the approach of about 575 feet per minute. At 1320:59, at a height of 27 ft and two seconds prior to touch down, the aircraft encountered a wind shift (see the section titled Recorded flight data) which further increased the descent rate. The PF and PM both reported that they felt a sudden increase in descent rate at that point. In response, the PM immediately called more urgently for an increase in power and manually intervened by advancing the power levers slightly, increasing power on both engines from 1.5 per cent torque to 3 per cent torque. Two seconds later, anticipating a bounced landing, the PM instructed the PF to commence a go-around. However, almost immediately the aircraft touched down at a normal pitch attitude, but heavily on the main landing gear, tail skid and underside of the rear fuselage (Figure 1). The aircraft did not bounce and the PM cancelled the go-around, took control and completed the landing roll.

Figure 1: Occurrence touchdown

Source: Aircraft Operator

The flight crew then taxied the aircraft to the gate. After shutting down the engines, the flight crew reviewed the recorded landing data which indicated that a hard landing had occurred, requiring maintenance inspections. The captain also inspected the aircraft and tail skid.

No persons were injured during the hard landing, however the aircraft sustained substantial damage.

__________

1. Eastern Daylight-saving time (EDT): Coordinated Universal Time (UTC) +11 hours.
2. Pilot Flying (PF) and Pilot Monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for upcoming stages of the flight. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. Overshoot windshear: A sudden change in wind direction and/or strength resulting in an increase of headwind.

Context

Flight crew

Captain

The captain held an Air Transport Pilot Licence (Aeroplane), an instrument rating for multi-engine aircraft and a Class 1 Aviation Medical Certificate. He had over 8,160 hours of flying experience, of which over 1,900 hours were on the ATR 72.

The captain also held the role of a training captain with the operator. In that role, he had undertaken operational training of other flight crew, including the first officer. During this training, the captain found the first officer to be a ‘good operator’.

First officer

The first officer held an Air Transport Pilot Licence (Aeroplane), an instrument rating for multi‑engine aircraft and a Class 1 Aviation Medical Certificate. The first officer had over 1320 hours of flying experience, of which over 320 hours were on the ATR 72.

The first officer completed ATR 72 aircraft-type training and began flying the aircraft type 6 months prior to the accident flight.

Fatigue

While prior to the day of the occurrence, the captain had two rostered days off and good sleep opportunities for the two previous nights, he later recalled that at the time of the occurrence he was feeling ‘a bit lethargic and a little tired’.

The ATSB examined the effect of fatigue on the performance of the flight crew and determined that the captain and first officer were not experiencing a level of fatigue known to have a demonstrated effect on performance.

Check flight

The accident flight was the last of four flights on the day comprising a routine annual operational line check of the captain and six-month operational line check of the first officer by a check captain. The check captain was positioned in the observer seat at the rear of the flight deck (Figure 2). The check captain was assessing the competency of the flight crew as part of regular cyclical checks and his role did not include participation in the normal operation of the flight.

Figure 2: Flight deck seating positions

Source: Operator

Prior to the first of the four flights comprising the check, in accordance with the operator’s procedures, the check captain briefed the flight crew of his observation and non-participatory role in the conduct of the flight and to operate the flight ‘as if he wasn’t there’.

The captain later reported that during check flights, he had a tendency to modify his behaviours and allow first officers more margin than normal when correcting deviations in the operation of the aircraft. He did this in order to allow the first officer an opportunity to rectify any deviations. The captain advised that during normal operations, he would intervene more quickly after identifying a deviation from the desired operation of the aircraft.

Check captain intervention

The operator provided the following guidance to check captains acting in an examiner’s role:

When the check is conducted with the examiner on the jump seat the examiner should only intervene to ensure that flight safety/company regulations and/or policies are not breached.

The check captain later stated that he would have intervened in the conduct of the flight if he felt that the safety of the flight was compromised. However, after recognising that the approach had become unstable, the check captain assessed that the landing would be ‘untidy’, but not unsafe. He stated that at that stage, input from him was outside of his role, might distract the flight crew and would not assist in the recovery of the approach.

Post-flight assessment

The check captain’s assessment for the performance of the first officer during the check flight was ‘unsatisfactory’. The check captain assessed that the performance of the captain was ‘satisfactory’. However, the operator required both flight crew to undergo retraining prior to resuming normal flying duties.

Meteorological information

The Canberra Airport automatic terminal information service (ATIS) provided the flight crew with the following weather information:

A north-easterly wind of 12 kt prevailed, which was all crosswind for runway 35 with an occasional tailwind of up to 3 kt. Visibility exceeded 10 km with scattered^[4] cloud at 4,500 ft.

Recorded weather observations at Canberra Airport at the time of the accident were broadly consistent with the ATIS, wind conditions being a north-easterly wind of 12 to 16 kt and scattered cloud at about 7,000 ft.

The approach to runway 35 passes in proximity to undulating ground, which can be a source of mechanical turbulence^[5] and windshear leading to minor excursions in speed from the target speed. The flight crew reported that they regularly experienced turbulence at all stages of approach and landing at Canberra Airport.

Aircraft information

The ATR 72-212A is a twin-engine, high-wing, turboprop regional airliner with a maximum take-off weight of 23,000 kg and maximum landing weight of 22,350 kg. At the time of the landing, the aircraft gross weight was about 21,700 kg

VH-FVZ (Figure 3) was manufactured in 2013 and first registered in Australia in May 2013. The aircraft was configured with 68 passenger seats.

Figure 3: VH-FVZ

Source: ATSB

The twin-engine turboprop configuration of the aircraft was such that a reduction in power to idle during approach would result in a significant increase in drag, as described in the United States Federal Aviation Administration publication, Airplane Flying Handbook Chapter 14: Transition to Turbopropeller-Powered Airplanes:

Landing some turboprop airplanes can result in a hard, premature touchdown if the engines are idled too soon. This is because large propellers spinning rapidly in low pitch create considerable drag.

Landing gear

The ATR 72 landing gear and associated structure is designed to absorb energy equivalent to a maximum descent rate of 600 feet per minute when landing at the aircraft’s maximum landing weight. The landing gear is designed to absorb reserve energy equivalent to a descent rate of up to 720 feet per minute when landing at the maximum landing weight.

Tail skid

The aircraft is equipped with a non-retractable tail skid on the underside of the rear fuselage to avoid fuselage contact with the runway when the take-off or landing pitch angle is 8° or more (Figure 4). Pitch attitudes of 5.5° or more accompanied with a high rate of descent may also result in ground contact.

Figure 4: ATR 72 Tail skid

Source: Operator

On both sides of the tail skid, the fuselage is equipped with red painted limit stroke detectors (Figure 5). The limit stroke detectors deform when the tail skid compression is greater than 112 mm to provide a visual indication of tail skid compression.

Figure 5: Tail skid limit stroke detector

Source: Operator

The flight crew operating manual provides the following guidance to flight crew regarding tail skid inspection:

At each walk around, inspect skid shoe.

If it is stripped, check the red indicator

If this indicator does not show evidence of wear, aircraft can be dispatched.

If this indicator shows evidence of wear, maintenance action is required.

Inspection and damage

Flight crew inspection

After the passengers disembarked, the captain inspected the aircraft and tail skid. He later recalled observing that the red limit stroke detector was visible and that there was no other visible damage to the aircraft. The captain therefore assessed that the rear fuselage had not contacted the runway and did not inspect the underside of the rear fuselage. He then made an entry in the aircraft technical log regarding the hard landing and contacted the operator’s maintenance engineering department to advise them of the occurrence. This entry required maintenance actions prior to any subsequent flight, grounding the aircraft. The subsequent engineering inspection identified the damage to the aircraft.

The check captain and first officer did not inspect the aircraft for damage.

Damage

Technical examination identified that the aircraft sustained impact and abrasion damage to the tail skid and the underside of the rear fuselage forward of the tail skid (Figure 6). Reskinning of sections of the fuselage underside, replacement of the tail skid and a drain deflector mast was required before the aircraft was returned to service.

Figure 6: Damage to the tail skid and underside of the rear fuselage

Source: ATSB

Damage and wear to the tail skid and associated stroke indicator indicated that the tail skid was fully compressed during the landing (Figure 7). After landing, the main landing gear oleos^[6] remained fully compressed, indicating they had lost gas pressure.

Figure 7: Figure showing the limit stroke detector from FVZ (left) and an undamaged stroke indicator (right).

Source: Operator

Analysis of the loads sustained by the nose and left main landing gear determined that these were below certification limits and the assemblies were returned to service. The loads sustained by the right main landing gear were above certification limits, this assembly was subject to a stress analysis and assessment prior to being returned to service.

Approach and landing

Stabilised approach criteria

The operator’s procedures included a stabilised approach criteria, which included the following relevant items:

• Thrust setting is appropriate for the aircraft configuration and trajectory
• Speed within -5 [kt] to +10 [kt] of the speed target.
• The PM should continue to monitor basic flight parameters and ANNOUNCE deviations.
• TRANSIENT exceedances of the stabilised approach criteria associated with changing environmental conditions are permissible providing the stabilised criteria can be quickly recovered.
• The PF must initiate a go-around for sustained or repeated exceedances of the stabilised approach criteria.
• The PM must announce "NOT STABLE" if the PF does not initiate a go-around for a sustained unstable approach.
• If either pilot is unsure about the safe outcome of the landing then a go-around must be initiated or called for.

Technique

After the occurrence, the captain commented that for the aircraft weight at the time of the approach, a typical power setting would have been about 22 per cent torque. The flight crew operations manual instructed that during landing, flight crew should reduce power from the approach power setting to flight idle when passing a height of 20 ft. The check captain also advised the ATSB that reducing power to idle at about 100 ft was the incorrect technique and would lead to an excessive descent rate.

Missed approach guidance

The operator’s standard operating procedures provided the following guidance for the conduct of a missed approach:

A major cause of approach and landing accidents is the failure to recognise the necessity to execute a missed approach. The captain is ultimately responsible for the decision to continue or to discontinue an approach. However, the first officer is expected to take the decision and carry out the manoeuvre if acting as PF, or call a go-around if acting as PM and it becomes necessary.

A missed approach shall be executed if any of the following occur:

An approach is not stabilised.

The approach becomes unstable in altitude, airspeed, glide path, course or configuration.

Unexpected wind shear is encountered.

Flight crew training

The operator provided approach handling training to flight crew during type conversion training and their recurrent operational training in accordance with manufacturer recommendations and as approved by the Civil Aviation Safety Authority. Each flight crewmember had undergone this training on multiple occasions, exposing them to various approach scenarios. The operator also provided intervention training to flight crew during recurrent operational training and rank upgrade training.

Recorded flight data

The ATSB analysed relevant data from the aircraft’s flight data recorder (FDR) and the cockpit voice recorder (CVR).

FDR data

The recorded flight data showed that the aircraft speed fluctuated in the turbulent conditions throughout the approach, and generally exceeded the speed target of 113 kt (Figure 8).

At 13:20:50, speed increased above 123 kt, to a maximum of 127 kt, exceeding the stabilised approach criteria speed limitation by up to 4 kt for a total period of 9 seconds. Engine power then reduced from about 26 per cent torque to flight idle as the aircraft descended through a height of 118 ft. The power remained at flight idle until increasing marginally to 3 per cent, one second before touch down. Over the last six seconds of the approach, the recorded speed reduced from 125 kt to 105 kt.

The data also showed that at touchdown, the aircraft pitch attitude was 6° nose-up.

Figure 8: Graphical representation of flight recorder data

The ATSB also analysed the recorded flight data to determine the wind conditions experienced by the aircraft during the final six seconds of the approach. This analysis showed that during the final seconds of the approach, the aircraft encountered a significant shift in wind direction and strength, as shown in Table 1.

Table 1: Wind conditions for final 6 seconds of approach

Prior to the reduction in power to flight idle, the approach descent rate was in the normal range of 500 to 600 feet per minute. After the power reduced to idle, the descent rate increased from 560 feet per minute at 13:20:53, reaching 784 feet per minute four seconds later as the aircraft encountered the wind shift, and 928 feet per minute at touchdown.

The recorded peak vertical acceleration at touchdown was 2.97 G.^[7]

CVR data

The cockpit voice recorder captured the following relevant items:

Table 2: Cockpit voice recorder key items

Similar occurrences

Portuguese Gabinete de Prevenção e Investigação de Acidentes com Aeronaves e de Acidentes Ferroviários investigation 15/ACCID/2016 (CS‑DJF)

On 22 October 2016, White Airways ATR 72-212A, registered CS-DJF, performed a regular commercial passenger transport flight at night, between Porto Airport, Portugal and Lisbon Airport, Portugal.

Following a continued unstable approach, the aircraft touched down on the nose landing gear and bounced multiple times. This resulted in separation of the wheels and respective axles of the nose landing gear. After a fourth touchdown, the aircraft stabilized and completed the landing with the nose landing gear leg in contact with the runway surface.

ATSB investigation AO-2015-032 (9M-MTA)

On 14 March 2015 Malaysia Airlines Airbus A330, registered 9M-MTA, began its approach to Melbourne Airport, Victoria after a flight from Kuala Lumpur, Malaysia. In the final stages of the approach, the approach became unstable, however the approach was continued. At approximately 50 feet, the captain reported feeling the aircraft sink and manually increased the thrust to the engines in an attempt to slow the rate of descent. Despite this action, the aircraft experienced a hard landing of a magnitude requiring replacement of the aircraft’s main landing gear.

ATSB investigation AO-2008-007 (VH-NXE)

On 7 February 2008, a Boeing Company 717-200 aircraft, registered VH-NXE, was being operated on a scheduled passenger service from Cairns, Queensland via Nhulunbuy (Gove) to Darwin, Northern Territory with six crew and 88 passengers.

The flight crew were conducting a visual approach to runway 29 at Darwin Airport and elected to follow the instrument landing system to the runway. The aircraft was above the glideslope for the majority of its approach and temporarily exceeded the operator's stabilised approach criteria shortly before landing however the approach was continued. The aircraft sustained a hard landing resulting in structural damage.

__________

4. An amount of cloud covering the sky of three or four oktas (eighths).
5. Interaction between flowing air and terrain, in particular irregular terrain and man-made obstacles, causes turbulence known as mechanical turbulence.
6. Oleo strut - a pneumatic air–oil hydraulic shock absorber.
7. G load: the nominal value for acceleration. In flight, g load represent the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value.

Safety analysis

During a check flight of both flight crew members, the aircraft’s approach to runway 35 at Canberra Airport became unstable. The flight crew did not conduct a go-around and the approach continued with an increasing descent rate. The descent rate was not reduced before the aircraft touched down, resulting in a hard landing.

This analysis will examine the reasons for the unstable approach and subsequent hard landing.

Approach and handling

The approach was conducted in conditions of light turbulence leading to minor speed excursions. As the aircraft descended through 265 ft above runway level, the aircraft speed reduced. In response, the PF increased power. Four seconds later, the aircraft encountered a wind change that, in combination with the now higher power setting, increased the airspeed to 127 kt – 4 knots more than the 10 kt limitation stipulated by the operator’s stabilised approach criteria. The airspeed exceedance was not detected by the PF and therefore no corrective action, or initiation of a go‑around, occurred.

While the PF did not identify the stabilised approach criteria exceedance, he assessed the presence of overshoot windshear. In response, he reduced power to flight idle at a height above the runway of 118 ft. The selection of flight idle power was initiated at a point significantly higher than the 20 ft directed by the operator’s procedures. That action was contrary to the operator’s stabilised approach criteria which required a thrust setting appropriate for the aircraft configuration and trajectory. The PM identified the incorrect power setting, but did not detect the further stabilised approach criteria exceedance and did not call for a go‑around at that stage.

The continuation of the approach when a go-around should have been conducted allowed the subsequent conditions to develop, leading to the hard landing.

Pilot monitoring response

After the power was reduced to flight idle, the PM identified that the power was incorrectly set. In an attempt to recover the approach, the PM twice called for an increase in power and then subsequently manually increased power. The first call was acknowledged by the PF, however no corrective action was taken, possibly due to his focus on controlling the aircraft. The second call occurred too late to enable a response from the PF and the physical intervention also occurred too late to alter the aircraft trajectory.

The captain held the first officer in high regard; this may have increased the captain’s confidence the first officer would recover the undesirable aircraft state. The captain also reported that during check flights, he had a tendency to modify his behaviours and allow first officers more margin than normal when correcting deviations in the operation of the aircraft in order to prevent any adverse impact on the check flight assessment of the first officer. These factors may have delayed or reduced the intervention by the captain.

Orasanu (2010) outlines that analytical decision making is difficult if not impossible in high-risk environments (such as aviation) where there is limited time and information and where conditions change unexpectedly.

In this occurrence, the PM needed to make a quick decision on how to recover the approach. Due to the limited time available in the final phase of approach and a perception that the condition of the aircraft would not lead to a significant event, the PM attempted a verbal correction of the aircraft state. The verbal intervention did not result in a correction and the unstable approach continued. Just prior to touchdown, the PM also attempted a physical intervention, but it came too late to prevent the hard landing.

The check captain reported that he recognised the approach was unstable. While the operator’s guidance permitted intervention in some circumstances, the check captain assessed that the approach and landing, while ‘untidy’, would be safe. Additionally, he reported that he did not call for a go‑around as he was not part of the operating crew and had assessed that a call from the rear of the cockpit may have distracted the flight crew in the critical phase of flight.

Wind change

Four seconds prior to touchdown, the aircraft was descending at a rate of 784 ft/min, already greater than the design limit of the undercarriage. At that time, the aircraft was subjected to a change in wind from a 10 kt headwind component to a 2 kt tailwind component. This resulted in a further reduction in lift produced by the aircraft and at this time, the captain felt the aircraft ‘drop out from under him’.

The already high descent rate of 784 ft/min, combined with the wind change, led to the aircraft reaching a recorded 928 feet per minute at touchdown, resulting in the 2.97 G hard landing and substantial damage to the aircraft.

Findings

From the evidence available, the following findings are made with respect to the hard landing involving ATR 72, VH-FVZ at Canberra Airport, Australian Capital Territory on 19 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During the approach, the pilot flying did not identify that the speed had exceeded the stabilised approach criteria, which required immediate correction or initiation of a go-around.
• In response to an assessment of overshoot shear, the pilot flying reduced power to idle at a height greater than that stipulated by operator procedures. This resulted in an abnormally high descent rate that was not reduced prior to touchdown.
• A significant change in the wind direction and strength immediately before the aircraft touched down further increased the aircraft's descent rate and contributed to the resultant damage.
• Verbal and physical intervention by the pilot monitoring did not prevent the hard landing.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence

Training and guidance

The operator, Virgin Australia Airlines, has amended ATR 72 operational documentation to strengthen guidance on the effects of sustained low power settings during approach and landing and the importance of avoiding that situation.

The operator has also reinforced existing training regarding speed management during approach and landing.

Operational monitoring

The operator has added additional criteria to its operational monitoring program to detect low power settings at low heights during normal operations.

General details

Captain details

First officer details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Operator
• Aircraft crew
• Canberra Airport
• Bureau of Meteorology
• Airservices Australia.

References

Federal Aviation Administration of The United States 2016, Airplane Flying Handbook.

Orasanu, J. (2010). Flight Crew Decision-Making. In B. G. Kanki, R. L. Helmreich, & J. Anca (Eds.), Crew Resource Management, (pp. 147-179).

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the operator, flight crew, aircraft manufacturer and French Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) and the Civil Aviation Safety Authority (CASA).

Submissions were received from the operator, flight crew, aircraft manufacturer, BEA and CASA. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 7 November 2017, a chief flying instructor (CFI) and pilot under instruction (PUI) were flying a Eurocopter AS350BA Squirrel, registered VH-BAA. They were conducting practice emergencies under visual flight rules at Hobart Airport, Tasmania. During hydraulic system failure practice, control of the helicopter was lost and the aircraft collided with terrain. The CFI was fatally injured and the PUI was seriously injured.

What the ATSB found

Flight manual emergency procedures stipulate that in order to maintain control following a hydraulic system failure (or simulated failure), a shallow approach should be made into wind and the helicopter should not enter a hover. On this occasion, the aircraft approached crosswind and came to a high hover without hydraulic assistance. Consequently, the helicopter was rendered uncontrollable. A delay in restoration of the hydraulic system prevented the crew from regaining control before collision with terrain.

The ATSB also identified that:

• An intermittent fault in the hydraulic cut-off switch may have delayed restoration of flight control hydraulic pressure.
• A pre‑flight brief was not conducted between the CFI and PUI which may have led to confusion over aircraft control and delayed restoration of the hydraulic system.

Due to a lack of available information, the influence, if any, of these two factors on the accident sequence could not be determined.

What's been done as a result

Following this accident, the operator:

• employed a trained and regulator-approved safety manager
• updated the training school operations manual with stricter controls on performing AS350 sequences as per the flight manual requirements
• installed an electronic system for tracking competencies and currencies.

The operator has also separated key roles of chief executive officer, chief flight instructor and the head of flight operations, which were previously conducted solely by the chief flight instructor.

Safety message

Compliance with the AS350 flight manual requirements following a real or simulated hydraulic failure ensures that the helicopter remains controllable during all phases of flight.

As this, and many other similar accidents illustrate, hovering an AS350 without hydraulic assistance can lead to a rapid, catastrophic loss of control even for highly experienced pilots. The Royal Australian Air Force found in evaluation of the AS350, while hovering without hydraulics, that the AS350 is subject to random perturbations, and reduction in control authority. Additionally the AS350 flight manual notes that without hydraulics the helicopter is subject to rapid changes in control direction and force.

In a training context, the rapid development of this accident, reinforces the need for a clear understanding and coordination between instructor and student when conducting hazardous activities such as simulated system failures.

Summary video

The occurrence

What happened

On 6 November 2017, a commercial helicopter pilot commenced a 2‑day AS350 helicopter endorsement as a pilot under instruction (PUI). The first day was spent with an instructor covering aircraft systems, and pre‑flight inspection. The PUI and instructor also conducted a 1.1-hour flight that afternoon covering the initial flying components of the endorsement.

On 7 November 2017, the PUI studied the aircraft’s electrical system, and theory on handling of in-flight emergencies, including hydraulic system emergencies, with the same instructor. Following the classroom session, the PUI conducted an inspection of the aircraft under the supervision of the instructor.

Flight records showed that at 1002 Eastern Daylight‑saving Time,^[1] the PUI and instructor commenced a training flight of 1.2 hours covering pinnacle approaches and confined areas, followed by run-on landings.^[2] The PUI’s next planned flight was with the chief flying instructor (CFI) at 1500 for the conduct of emergency sequences. The CFI was unable to depart at the pre‑arranged time as he was attending to business matters. The PUI reported that he also took the opportunity to catch up on his own business needs during the delay. The actual takeoff was delayed by 1 hour and 22 minutes.

The instructor advised the ATSB that, prior to the accident flight, the CFI conducted a brief handover with him to ascertain the standard of the PUI’s flying and the sequences briefed. At the aircraft, the PUI explained his requirement for a low-level approval and type endorsement with the CFI however, no pre‑flight brief was conducted.

The PUI and CFI boarded the aircraft and began the flight at 1622. Pre-flight checks included testing of the hydraulic system and switches with no apparent faults identified. The PUI recalled that following the low-level phase of the training flight, the CFI demonstrated some upper air emergencies and had the PUI perform them. After satisfactory completion, they flew back to Hobart Airport for a continuation of practice emergencies.

The PUI recalled that upon joining the circuit at left base for approach to area X-Ray parallel to runway 12 (Figure 1),^[3] the CFI announced a simulated hydraulic failure and activated the hydraulic test (HYD TEST) switch. As expected, a warning light and horn sounded. The PUI slowed from 90 kt to below 60 kt, consistent with the flight manual profile for hydraulic failure (see the sections titled Hydraulic failure training and Hydraulic system). The PUI then activated the hydraulic cut-off (HYD CUTOFF) switch. Following that, it is highly likely that the HYD TEST switch was released, though it is not known specifically when that occurred.

The PUI was to fly a run-on landing at around 10 kt without hydraulic assistance as per the requirements of the flight manual procedure. The PUI said he was comfortable to do so knowing the CFI was there to step in if anything were to go wrong. The PUI had very little further recollection, beyond the initiation of the event.

Table 1 and Figure 1 show the progression of the helicopter through the accident sequence. Paths, angles and rates are inferred from CCTV footage, air traffic control (ATC) data, and airport photographs. Due to limitations in the data available, these are approximate values only.

Table 1: Accident sequence from CCTV

Figure 1: Approximate path of VH-BAA

Source: Hobart Airport, annotated by the ATSB

At the end of the observed flightpath, the front left side of the cabin impacted the ground first. The CFI, seated on the left, was fatally injured, and the PUI in the right seat was seriously injured. The helicopter was destroyed.

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. Run-on landing: Touching down with forward speed with the skids aligned with the direction of travel of the helicopter, and slowing to a full stop while maintaining constant contact with the ground.
3. Runway number: the number represents the magnetic heading of the runway in ten degree increments.

Context

Personnel

Chief flight instructor

The chief flight instructor (CFI) had 30 years of experience flying helicopters and had accumulated 14,200 hours of aeronautical experience. His time on type for the AS350 was over 1,000 hours. He held an Air Transport Pilot License (Helicopter) and an authority to examine pilots for issuance of licences and endorsements. He had accumulated 45.3 hours flight in the previous 28 days.

The CFI was medically fit, qualified for the flight, and had demonstrated proficiency through flight checks in:

• Flight instruction on 3 August 2017
• Single Engine Helicopters on 30 June 2016
• Low level flight on 31 March 2016.

Instructor

The instructor was an experienced helicopter pilot with 4,000 hours’ total aeronautical experience and 1,000 hours of AS350 experience. He had previously flown with the pilot under instruction (PUI) while working for a different operator. The PUI sought out this instructor to conduct his endorsement.

Pilot under instruction

The PUI was a commercial helicopter pilot with over 1,200 hours of rotary wing experience and he was medically fit for the flight. The PUI was also managing director of a local helicopter company. The endorsement was associated with the company’s introduction of AS350 helicopters to their fleet.

Organisational and management information

The operator had been in business for 26 years and established in Tasmania at Hobart International Airport for 17 years. They specialised in charter, aerial work, and flight training operations.

The CFI was also the owner of the business, head of flight operations, chief executive officer, and undertook operational flying.

Flight endorsement training

General information

The Civil Aviation Safety Authority, through Civil Aviation Advisory Publication 5.14‑2(0) Flight Instructor Training (Aeroplane), established the need for two briefings prior to flight: a classroom brief and a pre-flight brief. These two forms of briefing prepare students for learning and performing complex sequences. A long brief in the classroom links theoretical knowledge of emergencies to practical application of those principals in the aircraft. The pre-flight brief establishes procedures and management of the aircraft between the crew. This format was not applied for the accident flight. The first instructor conducted the classroom brief, but there was no pre-flight brief between the CFI and PUI.

Hydraulic failure training

Training for loss of hydraulics in the AS350 required adherence to instructions in two rotorcraft flight manual (RFM) sections: Supplement 7 for the training procedure itself, and Section 3 for emergency procedures for management of the aircraft without hydraulics.

Supplement 7 training procedure

Supplement 7 of the AS350 RFM was incorporated in 2003; it carried specific instructions for hydraulic failure training. The sequence was divided into two distinct phases, and the hydraulic cut-off (HYD CUTOFF) switch and hydraulic test (HYD TEST) switch would not be engaged at the same time. This prevented depletion of tail rotor hydraulic pressure accumulators (not fitted in VH‑BAA) and ensured only one switch would be required to restore hydraulics at any time. Figure 2 illustrates the two phases of the procedure.

Figure 2: AS350 Rotorcraft flight manual hydraulic failure training procedure

Source: ATSB. Flow chart derived from AS350 Rotorcraft Flight Manual

Incorrect sequence taught during endorsement

The instructor and the PUI advised that the flight school taught a different version of the hydraulic failure training procedure during the endorsement and used it during the accident flight.

The procedure used had the student activate the HYD CUTOFF switch before the HYD TEST switch was released. This was a commonly‑used procedure before the release of Supplement 7. An investigation into a similar accident in Canada (A13Q0021) related that flight instructors found this sequence accurately simulated a hydraulic failure. Figure 3 illustrates the procedure.

Figure 3: Hydraulic failure training procedure as taught

Source: ATSB. Flow chart derived from accounts of procedure used by flight school

VH-BAA was not fitted with a yaw load compensator. Using this procedure on an AS350 equipped with a yaw load compensator will cause total loss of tail rotor control hydraulic assistance.

Section 3 hydraulic failure emergency procedure

For completion of the transition to landing referred to in phase 2, the hydraulic failure emergency procedure from Section 3 of the RFM was to be applied. It stated:

Keep the aircraft to a more or less level attitude. Avoid abrupt manoeuvres.

The RFM also carried the following caution:

DO NOT ATTEMPT TO CARRY OUT HOVER FLIGHT OR ANY LOW SPEED MANEUVER. THE INTENSITY AND DIRECTION OF THE CONTROL FEEDBACK FORCES WILL CHANGE RAPIDLY. THIS WILL RESULT IN EXCESSIVE PILOT WORKLOAD. POOR AIRCRAFT CONTROL. AND POSSBILE LOSS OF CONTROL.

RFM Instructions for approach and landing were:

Over a clear and flat area, make a flat final approach, nose into wind.

Perform a no-hover/slow run-on landing around 10 knots.

Do not hover or taxi without hydraulic pressure assistance.

Helicopter details

General information

The Eurocopter AS350BA,^[4] was manufactured in France in 1987 (serial number 2015). It was first registered in Australia on 4 April 2000 and at the time of the accident, had accumulated 5,612 hours total time in service. It was previously registered as VH-RLU and the registration mark was changed to VH-BAA by its current owner on 20 March 2007.

VH-BAA had seating for a pilot and five passengers and was certified for day and night charter operations under the night visual flight rules. The helicopter was powered by one Turbomeca Arriel 1B turboshaft engine.

A review of Maintenance Release entries for maintenance due, showed that a 6-month inspection was required on 7 October 2017, with an over-run tolerance of 60 hours or 18 days. With the tolerance applied, the maintenance would fall due on 25 October 2017. The maintenance related to periodic greasing of the main rotor blade retaining pins.

At the time of the accident, the maintenance had not been certified on the maintenance release as complete and was overdue. No record was found in the aircraft logbook that the maintenance had been completed. While it is a pilot responsibility to ensure that a flight does not commence unless all maintenance has been completed, it is highly unlikely that the non-lubrication of the main rotor blade pins contributed to the accident.

The operator reported that VH-BAA was on temporary hire for the purposes of the endorsement training. Between 5 November and 7 November, the helicopter was operated for about 2.5 hours in the training role. Neither the initial instructor nor the PUI reported problems with the performance of the helicopter or its operation.

Hydraulic system

The aircraft was equipped with a single hydraulic system, energised by a belt-driven hydraulic pump. The hydraulic pump was regulated to provide a constant pressure of 40 bar to four flight control servo actuators. A red warning light will light at hydraulic system pressures of less than 30 bar.

There were three Dunlop servo actuators for control of the main rotor and one Dunlop servo actuator for control of the tail rotor (Figure 4). With hydraulics operating, the input force required to move the rotor blades, at the cyclic,^[5] is less than or equal to 0.3 kgf. For that cyclic input, at 40 bar, the system provides an output of 183.5 kgf.

Because the aircraft exhibits increasing control loads without hydraulics at high speed, and control may be lost without hydraulics in the hover, back-up accumulators are available in the hydraulic system. These accumulators store hydraulic pressure and deliver it to the servo actuators in the event of a hydraulic failure. The accumulators carry enough stored pressure for the pilot to establish the aircraft at the safety speed from cruise or from a high hover to a landing. A safety speed of 40-60 kt was stipulated in the emergency procedures section of the rotorcraft flight manual (RFM).

Figure 4: AS350 servo locations

Source: Airbus Helicopters

A yaw load compensator was fitted to later iterations of the aircraft in order to overcome excessive forces in yaw control in the absence of hydraulic assistance. VH-BAA was not fitted with a yaw load compensator and did not have an accumulator on the yaw control. In the AS350BA, in the absence of hydraulic assistance, yaw control loads are felt directly and immediately.

Hydraulic system switches

The hydraulic system is managed via two switches. The guarded, console-mounted push-button HYD TEST switch, and the recessed, collective-mounted^[6] HYD CUTOFF switch (Figure 5).

The HYD TEST switch exists to test the accumulators for the main rotor servo actuators before flight. The HYD TEST switch is OFF (out) in normal operation. Pressing the HYD TEST switch to TEST (in) creates a bypass in the hydraulic distribution block, routing pressurised fluid from the pump directly to the reservoir. This leaves the back-up accumulators to supply pressure to the main rotor servo actuators.

The HYD CUTOFF switch is ON (out) in normal operation. Pressing the HYD CUTOFF switch OFF (in) bypasses the servos by connecting the pressure inlet and return outlet in each one. The effect is to depressurise the servos and the back-up accumulators of the main rotor servo actuators. It is used in the event of an in‑flight emergency, once the safety speed of 40-60 kt has been established, to ensure that residual accumulator pressure causes no asymmetry in forces across the flight controls.

In emergency procedure training, the HYD TEST switch is used to induce hydraulic failure in flight and the HYD CUTOFF switch is used to conduct hydraulic off landings. If either switch is in, the system will not provide hydraulic pressure to the controls. As previously detailed in the section titled Hydraulic failure training, they should not be activated together in the AS350BA, so hydraulics can be restored with one switch.

Figure 5: HYD TEST switch and HYD CUTOFF switch locations

Source: Airbus Helicopters

Main rotor system

The AS350 was fitted with a starflex hub (Figure 6). This design replaced hinges with elastomeric (rubber type) bearings. Without hydraulic assistance, the pilot must exert significant effort to push or pull the flight controls to deform the elastomeric bearings, change the pitch of the blades, and control the helicopter.

Figure 6: AS350 main rotor pitch change mechanism

Source: Airbus Helicopters

The RFM states in section 3.2 that the expected control input forces without hydraulic pressure are:

• Left-hand cyclic load 4 to 7 kgf
• Forward cyclic load 2 to 4 kgf
• Collective 20 kgf.

The RFM states in section 7.7 that the maximum forces a pilot should have to exert are:

• Lateral cyclic 15.3 kgf
• Longitudinal cyclic 17.3 kgf
• Collective forces were not stated.

Tail rotor system

The AS350 tail rotor is built on one continuous composite spar (Figure 7). Without hydraulic assistance, the pilot must push the pedals and twist the spar to change the pitch of the tail rotor blades. While helicopter weight and speed affect pedal force, the Royal Australian Air Force (RAAF) Aircraft Research and Development Unit (ARDU) (see section titled Research) found that a tail rotor pitch change requires a force of up to 50 kgf. Airbus Helicopters advised they were able to demonstrate significantly lower required forces in flight tests while observing flight manual limitations.

Figure 7: AS350 Tail rotor

Source: Airbus Helicopters

Automatic pilot

The aircraft was fitted with a two-axis automatic pilot system. The installation included two servos in line with the cyclic control’s pitch and roll control rods. The optional collective-to-yaw linkage, that can accompany this equipment, was not a part of this installation. The automatic pilot system was not a component of the endorsement, nor was it used during the endorsement. When the automatic pilot is disengaged, the servos of the automatic pilot system act in the same way as a push/pull rod. There was no evidence to indicate that the automatic pilot system was a factor in the occurrence.

Site and wreckage inspection

Aerodrome information

Hobart Airport is on the south-east coast of Tasmania and has a single north‑west/south‑east runway (Figure 8). Helicopter training area X-Ray was used on the day of the accident.

Area X-Ray was on the western side of, and 60m outside of, the runway. It was under the control of air traffic control (ATC), who provided clearances for all aircraft movements on and around the airport. A clearance was required for helicopters to overfly active taxiways and cross the runway.

Figure 8: Helicopter training area X-ray at Hobart International Airport

Source: Google earth, annotated by the ATSB

Site inspection

As the accident closed the only runway, Tasmania Police assisted the ATSB by documenting the site prior to the arrival of the on‑site investigators. This allowed the wreckage to be removed, and the airport to be reopened, without jeopardising important physical evidence such as ground contact marks. ATSB investigators examined the wreckage in a secure location nearby.

There was evidence that the engine was running for a period of time after the helicopter impacted with terrain, as indicated by burnt grass in the area of the engine exhaust, though there was no fire on site. Figure 9 shows the aircraft before removal.

Figure 9: Accident site image

Source: Tasmania Police

Survivability

Immediately after the accident, ATC activated the emergency response and closed the runway. The aviation rescue and firefighting services (ARFF) stationed at the airport responded immediately to the event, reaching the accident site in 1 minute 40 seconds. The ARFF recovered the CFI from the left seat and assisted the PUI from the right seat.

Damage was indicative of significant impact on the front left side. The flexible steel legs of the skid gear, four-point harnesses, crash-resistant seats and light alloy frame of the cabin floor, all offer protection to occupants during accidents if the helicopter contacts the ground in a level attitude. The polycarbonate construction of the cabin offers very little protection to occupants if the collision involves contact with the canopy.

Investigation of previous AS350 hydraulic failure accidents identified that on initiation of the loss of control event the aircraft often rolled to the left, and initial impact with ground was on the left-hand side. Consequently, the left seat occupant is likely to experience the highest impact forces during a collision. In this accident, the helicopter impacted the ground nose down while rolling to the left. As a result, there was significant disruption to the survivable space on the left side of the helicopter’s cabin.

Both pilots were wearing seatbelts with upper torso restraints, and the seatbelts and seats held during the accident sequence. This kept the right-seat pilot within a disrupted but liveable space within the cabin, contributing to his survival.

Wreckage inspection

The aircraft was inspected at a facility in Hobart.

Engine controls were found connected and secured with all attaching hardware present. The engine oil system was inspected, the oil filter, chip detector and oil were free from debris and discoloration. Fuel was tested for presence of water with no positive indication. The fuel had a clear appearance, the fuel filter was clean, and the bypass indicator was indicating normal operation.

The main rotor transmission had clean oil, the casing was intact, and the chip detector was free of debris. The tail rotor gearbox rotated freely with no binding, and the chip detector and gearbox oil was free of debris. The oil quantity was at the correct level.

Flight control linkages to the main rotor and tail rotor were connected, and securing hardware was in place. The hose supplying the tail rotor servo with pressure was found fractured; detailed examination concluded that was a result of impact damage.

The hydraulic system lines were mounted and connected correctly, and the hydraulic pump and drive belt were intact. The hydraulic fluid had a clear appearance, and the oil, chip-detector and filter were free of debris.

The back-up accumulators fitted to main rotor servos were checked for nitrogen charge and found to be serviceable. All hydraulic system shutoff valves (main and servo-mounted) were present and in place, with the wiring connected. Servo actuators were securely mounted with all electrical plugs and control rods securely in place.

Hydraulic system configuration

The HYD CUTOFF switch and the HYD TEST switch were found in the correct position for restoration of hydraulic pressure at the time of impact (Figure 10). It is possible that one or both switches moved during the impact sequence. The HYD TEST switch unit was found outside of the aircraft, in the off (normal operation) position.

Figure 10: HYD CUTOFF switch and control console as found

Source: ATSB

No pre-existing defects were identified. All damage noted was consistent with impact forces during the accident sequence.

The following items were collected for further assessment:

• Pilot’s collective lever HYD CUTOFF switch
• HYD TEST switch
• Caution and Warning panel.

Hydraulic cut-off switch examination

The HYD CUTOFF switch is an ‘on condition’^[7] component which is tested during pre-take-off checks, prior to every flight. Neither the initial instructor nor the PUI reported any anomaly with the switch prior to the accident flight.

Laboratory examination and comparative analysis of the HYD CUTOFF switch from VH-BAA was conducted with a new switch. They found that the switch fitted to VH-BAA at the time of the accident was susceptible to intermittent operation. The switch had a level of wear, corrosion, contamination and internal damage (Figure 11). Consequently, the mechanical latching and unlatching which cycled the internal contacts to ON or OFF could stick, and require additional effort to latch or unlatch.

Therefore, it was possible to action the HYD CUTOFF switch without restoring hydraulics, inducing a genuine emergency. The system’s normal 3-second activation period could delay diagnosis of a fault.

Additionally, Part 4.3 of section 7.7 of the RFM describes abnormal operations of the hydraulic system. It discusses the possibility that the switch may fail to dump hydraulic pressure from the accumulators in the event of an emergency.

The HYD CUTOFF switch may not be effective in opening all the electro-valves, and dumping all the pressure in the accumulators simultaneously…if the hydraulic cut-off switch is rendered ineffective due to the loss of electrical power, broken wires, or a faulty switch.

The manual made no comment on the opposite case of the switch failing while restoring hydraulics after hydraulic failure training.

It could not be determined if the intermittent operation was due in part to impact‑induced damage.

Figure 11: Corrosion, contamination, and wear in VH-BAA switch

Source: ATSB

Hydraulic warning system light bulb analysis

When the hydraulic system is inoperative, two incandescent bulbs light the red HYD warning light (Figure 12). Both of these bulbs were inspected for impact damage (Figure 13). The left bulb was intact and the right bulb exhibited pole whip damage (Carver, 1987). The pole whip created a brittle fracture between the terminal and the support post. There was some observed filament sag, which is consistent with an aged bulb exposed to high-impact forces. If the bulbs were illuminated at impact, provided the impact forces were sufficient, it is likely that the filaments would show evidence of stretch-type deformation damage. Therefore, it is considered probable that the HYD warning light was not illuminated at the time of impact.

Figure 12: VH-BAA Warning – Caution – Advisory Panel

Source: ATSB

Figure 13: HYD. Warning Light bulbs

Source: ATSB

Meteorological information

The automated weather information service^[8] for Hobart Airport at the time of the accident on 7 November 2017 recorded the following conditions:

• wind from 200°, minimum 15 kt maximum 25 kt
• visibility greater than 10 km
• cloud scattered^[9] at 5,000 ft.
• temperature 15° C
• barometric pressure (QNH) 1019 hPa.

Recorded information

The aircraft did not carry any recording devices, nor was it required to.

Closed circuit television

Closed circuit television (CCTV) from the regular public transport apron of the Hobart Airport captured VH-BAA during approach, loss of control and impact. Figure 14 shows the point of view from the apron CCTV.

Figure 14: Apron CCTV point of view

Source: Hobart Airport, Google Earth, annotated by the ATSB

Related occurrences

The ATSB reviewed 34 investigations of accidents involving AS350 series helicopter’s hydraulic systems worldwide. Figure 15 collates the data from ten of the accidents that occurred prior to the accident in VH-BAA, involving simulated hydraulic failure during flight training. It indicates that loss of control accidents during training do happen to highly experienced pilots. Refer to Appendix A for a synopsis of the reports and the Transport Safety Board of Canada’s report A05F0025 for a list of AS350 loss of control events.

Figure 15: Overview of related hydraulic failure training accidents.

Source: ATSB

Reports of unmovable controls have been a feature of a number of accidents following commanded/uncommanded hydraulic failures in AS350 helicopters. First-hand accounts relate that, as well as the rapid and intense changes in direction and magnitude of control forces described in the flight manual, the controls can become immobile.

The manufacturer is clear on avoidance of loss of control, yet the concern of unmovable controls, which is still reported in contemporary production models of the AS350 (see AAIB report EW/C2017/05/01 page 5), is not accepted by the manufacturer. Airbus Helicopters contends that pilots are surprised by the forces required and that prevents pilots from applying sufficient force to the flight controls.

Research

AS350BA controllability research and recommendations

In 1997, the RAAF ARDU conducted an evaluation of the handling characteristics of the AS350BA, in flight without hydraulic assistance.

ARDU found lateral forces with a 30 kt wind from 30° to the front right (a 15 kt crosswind component) caused lateral cyclic forces to vary continuously and ‘satisfactory lateral control could not be achieved’.

The forces required at the controls without hydraulics recorded during that evaluation were:

• longitudinal cyclic 14.8 kgf forwards at 1,700 kg all up weight while established in a hover
• lateral cyclic 6.8 kgf with a crosswind component of 15 kt
• collective (lifting) 16.2 kgf at 1,950 kg all up weight into wind at 15 kt.

Furthermore, ARDU found that at low speed with hydraulics out, pedal authority was reduced by up to 27 per cent, and that passage through free play in the pedals was required to effect a change in heading. These conditions made control difficult to retain and harder to recover. Right pedal force of 50 kgf was required to maintain a heading into wind at 15 kt.

The ARDU report concluded that with hydraulics out:

• reduced authority, free play, and excessive control forces in primary flight controls were unacceptable
• controllability below 15 kt airspeed was not reliable, and hover flight could lead to loss of control.

Following the evaluation, ARDU recommended that when conducting hydraulic failure training:

• use only one hydraulic switch at a time to simulate failure of the hydraulic system
• maintain over 15 kt during the run-on landing
• do not use over 30° angle of bank
• conduct run-on landings into wind.
   

4. AS350 Squirrel: The AS350 Squirrel was originally designed and manufactured by Aérospatiale in 1975, which became Eurocopter through merger in 1992. Eurocopter was purchased and became Airbus Helicopters in 2014. At the time of writing, the AS350 was manufactured as the H125.
5. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.
6. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
7. On condition: an on condition item has no designated service or replacement schedule. These items would only be replaced when found to be unserviceable.
8. Aerodrome weather information service (AWIS): actual weather conditions, provided via telephone or radio broadcast, from Bureau of Meteorology (BoM) automatic weather stations, or weather stations approved for that purpose by the BoM.
9. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky.

Safety analysis

Introduction

The pilot under instruction (PUI) was unable to recall the majority of the practice hydraulic failure exercise after the accident. As such, there was no firsthand account of the final stages of the accident flight and the sequence of events was largely assembled from closed circuit television (CCTV) footage and wreckage examination.

This analysis will examine the observed aircraft behaviour associated with the simulated hydraulic system failure, instructor intervention, and crew coordination.

Flight manual requirements

In order to safely conclude a practice hydraulic failure sequence, the rotorcraft flight manual (RFM) requires a flat final approach into wind and a no-hover/slow run‑on landing around 10 kt. This is a compromise to keep the helicopter in ground effect and avoid hovering while maintaining a manageable run-on landing speed for potentially unprepared surfaces. Additionally, the requirement to conduct the run-on landing into wind provides a level of consistency in the direction of airflow across the main rotor. This simplifies the pilot’s task by minimising changes to direction and magnitude of cyclic input.

Assurance of control does not require restoration of hydraulics if the helicopter is accelerated into forward flight before the aircraft slows too much. The aircraft becomes easier to control as it is accelerated from 10 kt to the RFM safety speed of 40‑60 kt. If restoration of hydraulics fails at the safety speed, the pilot in command has ample controllability to manage the genuine emergency.

Loss of control

Approaching crosswind

While the RFM requires an into wind approach, the sequence in VH-BAA was planned for approach and landing in a right crosswind of 15-25 kt. Crosswind changes the airflow across the main rotor as the aircraft slows and the crosswind becomes the dominant flow. As detailed in the Royal Australian Air Force Aircraft Research and Development Unit (ARDU) research report, this creates unpredictable changes in direction and magnitude of cyclic input, which are more pronounced when the crosswind is variable, as it was on the day. This significantly increased the pilot’s workload and can render the helicopter uncontrollable.

Analysis of the flight path of VH-BAA from the CCTV footage showed the helicopter to be controlled during the early stages of the approach. As the aircraft slowed, and the crosswind became the dominant airflow the helicopter was observed to drift and vary in pitch and yaw, consistent with the ARDU flight test observations.

Hovering without hydraulic assistance

The PUI recalled feeling a need to prevent the helicopter’s airspeed from decaying late in the approach; CCTV shows he was unable to do so. For a 3-second period, as the helicopter slowed to a hover, there appeared to be no positive control on the aircraft. Despite that, there was no apparent intervention to prevent the helicopter slowing to an out of ground effect (OGE) hover, and the sequence progressed past the boundary of assured control.

The helicopter yawed left, putting the wind behind the helicopter, and facing into an active runway. It is unlikely that this situation was commanded by choice. Instead, it is indicative of the tail rotor returning to a neutral pitch in the absence of hydraulic assistance and reduced, or ineffective, control inputs.

The OGE hover increased the magnitude of control inputs required and induced rapid random changes in intensity and direction of control feedback forces. Due to aerodynamic couplings between controls and lag in control input and response, pilots must anticipate control inputs, and make them before they are required. However, a pilot cannot anticipate the inputs required for an aircraft subject to random perturbations in flight controls.

CCTV showed that after the aircraft came to a hover and yawed left, a positive collective input was made, and the aircraft climbed. It is not known who made that input. Shortly thereafter, control of the aircraft appeared to be lost as it crossed the active runway, with excessive pitch nose down, and left roll developing. Given the nature of the helicopter movement and proximity to the ground, there was little opportunity at that point to restore control.

It is extremely unlikely that the chief flying instructor (CFI) would have entered an active runway without clearance in normal operations. An air traffic controller stated that the CFI had never previously departed area x-ray without announcing his intentions and gaining a clearance. It is therefore virtually certain that entering the runway must have been unavoidable once the aircraft departed controlled flight or considered necessary to regain control of the aircraft.

Deviation from standard operating procedures decrease safety margins and increase opportunity for an accident (Sumwalt and Lemos, 2010). Both the flight manual and the ARDU research paper identified that operating outside of the prescribed procedure would probably result in a loss of control.

Control not restored

Hydraulic system restoration

Light bulb analysis of the hydraulic system fault warning lights indicated that it was probable that the HYD fault light was not illuminated at the time of impact with terrain. Further, both the HYD TEST and the HYD CUTOFF switches were in the normal flight (hydraulic system on) configuration during post-accident examination. While the switch position is less reliable than the light bulb analysis, in combination the ATSB concluded that it was likely that the switches were moved to restore hydraulics prior to impact.

The collective input immediately prior to crossing the runway was 9 seconds prior to collision with terrain. The hydraulic system was likely restored at a point between 9 seconds and 4 seconds before impact. As identified during the investigation of past similar accidents, delays in restoration of the hydraulic system can prevent control recovery.

Restoration of the hydraulic system was potentially delayed due to:

• use of an incorrect hydraulic failure training procedure
• lack of a pre-flight brief to develop common understanding between crew
• a potential intermittent failure of the HYD CUTOFF switch.

The level of contribution, if any, of each factor could not be determined, though each increased risk in the operation.

Incorrect hydraulic failure training procedure

The procedure used to simulate failure of the hydraulic system did not match the requirements of the RFM and overlapped the two phases of the procedure. It released the hydraulic test (HYD TEST) switch after activation of the hydraulic cut-off (HYD CUTOFF) switch. This introduced a hazard into the operation.

Distraction could lead to the HYD TEST switch being forgotten and remaining in. In this configuration, a pilot must activate two switches to restore hydraulics. This would lead to a failure to restore hydraulics when commanded via the HYD CUTOFF switch. Such an event would lead to delayed restoration, due to time taken to diagnose the problem and release the HYD TEST switch. Although as detailed in the section above, it is probable that the HYD TEST switch was released during the occurrence flight, it could not be determined at what point that occurred.

Crew coordination and pre‑flight preparation

Instructing is a complex task and instructors must balance the benefit to the student’s learning and experience with safe margins of operation in a dynamic environment. Instructor intervention is a critical control in flight training. It is often the final opportunity to retain control of the aircraft.

In intervention, an instructor has three time-sensitive options:

• adjust – fix the issue and allow student to continue
• restore – return to normal flight
• complete – take over and complete the sequence.

Intervention is supported by clear assessment, communication, and planning. The PUI received a classroom briefing on emergencies from the original instructor and the CFI received a briefing on the status of the PUI from the same instructor. However, possibly due to the delayed departure, the CFI and PUI did not conduct a pre-flight briefing.

The requirement for a pre-flight brief, especially where non-normal operations are conducted is well-established. Such a briefing reaffirms standard operating procedures, promotes predictable behaviour, and sets expectations among crew (Sumwalt and Lemos, 2010). In this case, the absence of a brief was a missed opportunity to establish correct procedure and generate a common understanding of how the practice emergencies would be conducted.

Once in the aircraft, the CFI advised he would announce practice emergencies and expected the PUI to fly and manage the aircraft. Any unannounced emergencies were to be considered real and the PUI should take immediate essential actions; the CFI would take over if necessary. This is a commonly relied upon arrangement in flight training yet, as an unsafe condition can develop rapidly during the simulation of emergencies, it often requires further definition and understanding between the pilots to be effective.

Additionally, during emergency training, the transition from practice emergency to a genuine emergency is not always clear. Ordinarily available cues for an emergency are defeated, warning lights may already be illuminated, and alarms may or may not sound. The PUI has, by definition, little working knowledge of the aircraft to support diagnosis. Not knowing the aircraft state creates ambiguity, which is known to delay decision-making (Orasanu, and others, 2001).

On this occasion, the absence of a shared mental model of when or how to terminate the sequence may have led to:

• no one controlling the aircraft
• both pilots controlling the aircraft
• a late intervention to prevent hovering
• a delay in restoration of hydraulics.

Due to a lack of available information however, it was not possible to determine to what extent the lack of pre-flight brief contributed to the accident.

Findings

From the evidence available, the following findings are made with respect to the fatal loss of control accident involving Eurocopter AS350BA, registered VH-BAA at Hobart Airport on 7 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The rotorcraft flight manual hydraulic failure emergency procedures were not followed. Specifically, the final approach was flown with a significant right crosswind and the helicopter was allowed to slow to a high hover.
• The hydraulic failure training sequence was allowed to progress to a point where control was no longer assured.
• Hover flight without hydraulic assistance led to loss of control of the aircraft.
• The hydraulic system was restored too late in the sequence to recover control of the aircraft. The reason for late restoration could not be determined.

Other factors that increased risk

• The operator did not follow the hydraulic failure simulation procedure required by the manufacturer. This introduced a hazardous condition with potential to delay restoration of hydraulic assistance.
• The collective mounted hydraulic cut off switch showed signs of excessive wear and intermittent operation. The switch may have required multiple actions to return hydraulic assistance when activated, potentially delaying restoration of the hydraulic system.
• The chief flying instructor and pilot under instruction did not conduct a pre-flight brief, to develop a shared understanding of how the hydraulic failure sequence would be conducted. This may have led to confusion over aircraft control and delayed restoration of the hydraulic system.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft operator
• pilot under instruction
• instructor
• Airservices Australia
• Civil Aviation Safety Authority
• previous accident investigation reports
• ATSB aviation occurrence data
• Airbus Helicopters.

References

Civil Aviation Safety Authority 2012, Civil Aviation Advisory Publication 5.14-2, Flight Instructor Training, on-line, www.casa.gov.au/rules-and-regulations/current-rules/civil-aviation-advisory-publications

Kouabenan, D.R., Ngueutsa, R., Mbaye, S. 2015, Safety climate, perceived risk, and involvement in safety management, Safety Science, 77, 72-29.

Orasanu, J, Martin, L, & Davison, J. (2001). Cognitive and contextual factors in aviation accidents, in E Salas and G Klein (Eds.) Linking expertise and naturalistic decision making, Lawrence Erlbaum Mahwah NJ. 209–226.

Sumwalt, R.L., Lemos, K.A. 2010, The Accident Investigator's Perspective, Crew Resource Management, pp. 399-423.

Weber, E.U., Milliman R.A. 1997, Perceived risk attitudes: Relating risk perception to risky choice, Management Science, 43(2), 123-144.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight-training organisation, pilot under instruction, instructor, Airservices Australia, the Civil Aviation Safety Authority, the Bureau of Meteorology, and the aircraft manufacturer.

Submissions were received from the flight-training organisation, the Civil Aviation Safety Authority, the instructor and the aircraft manufacturer. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A - Synopsis of related occurrences

National Transportation Safety Board (US) LAX92FA025 - 1991

At an airspeed of about 2 knots and a skid height of about 1 foot, the helicopter began an uncommanded turn to the left. The pilot attempted to counter the turn but was unable to move the flight controls. The helicopter's left bank angle, nose down attitude and left turn continued until the main rotor blades struck the ground.

National Transportation Safety Board (US) IAD99GA056 - 1999

The aircraft developed an uncontrollable roll to the left while hovering without hydraulic assistance.

…the helicopter began an uncontrollable roll to the left while at the hover…I tried to level the helicopter by using both hands to attempt to pull the cyclic control to the neutral/level position. The helicopter continued to roll left and subsequently the main rotor blades hit the ground.

Excessive flow rates were detected in all servos and two were rejected in a speed test.

National Transportation Safety Board (US) LAX00LA195 - 2000

The student struggled to control the aircraft towards the end of an approach with hydraulics off. The instructor took over and requested return of hydraulics. The student switched on the hydraulic system. Controls remained stiff and the helicopter impacted terrain.

He reported that just prior to touchdown, the aircraft controls became very stiff. At that point, the flight instructor directed the pilot trainee to re-engage the hydraulics isolation switch on the collective control. The student re-engaged the hydraulics but reported that the controls remained stiff, and he was having difficulty applying forward cyclic. As the instructor got on the controls it started a slow turn to the left. As the instructor attempted to counteract the turn rate increased. The helicopter impacted the ground in a left turn with rear lateral movement.

National Transportation Safety Board (US) ATL02LA097 - 2002

The training and checking captain was unable to control the aircraft while hovering without hydraulic assistance.

The check airman then stated that he would demonstrate the handling characteristics of the helicopter in the hydraulics off configuration. The check airman brought the helicopter to a hover approximately three feet above the ground. At that time the helicopters nose appeared to pitch up dramatically. This attitude was followed by a simultaneous rotation about the yaw axis. As the spin accelerated the check airman instructed the airline transport rated pilot to restore the hydraulics, which was done by depressing the switch on the collective. The rotation of the helicopter continued, and the helicopter impacted the ground coming to rest on the right side of the fuselage.

National Transportation Safety Board (US) ANC02FA029 - 2002

He brought the helicopter to a hover about four feet above the road. According to the pilot, the cyclic was frozen in the full aft left position when he lost control. The helicopter rolled left and struck the ground inverted.

Air Accidents Investigation Branch (UK) EW/C2004/10/05 - 2004

The AAIB found that the instructor did not follow flight manual procedure for hydraulic failure training, leading to the HYD TEST switch being activated at the same time as the HYD CUTOFF switch. The instructor did not attempt to restore hydraulics and was unable to recover the aircraft.

Transportation Safety Board of Canada A05F0025 - 2005

As the pilot gradually descended, and at a height of about 10 feet above ground level, he experienced significant binding in the flight controls. The pilot was unable to rectify the control binding and had considerable difficulty maintaining attitude and altitude control of the helicopter.

It should be noted that the pilot had not received any of the conventional alerts of hydraulic malfunction, such as the klaxon or the warning light.

National Transportation Safety Board (US) LAX07GA217 - 2007

While attempting to regain control at the bottom of a failed hydraulics off approach, the student did not restore hydraulics when requested by the instructor. The student stated that they were told it was dangerous to do so as it could induce over control. The instructor was unable to recover the aircraft.

The CFI [chief flying instructor] noted that the slowest airspeed the helicopter ever reached was a minimum of 8 kts. He added that he was not sure if the cyclic was immobile in any additional direction, aside from the forward-right position, as he did not move it into another direction to prevent possible further loss of control of the helicopter. The CFI estimated that he performs hydraulics-off simulated emergency procedures on a regular basis; he has never experienced any problems or difficulty controlling the helicopter.

A lateral servo was found to be rigged out of limits and mushroom deformation existed on the longitudinal servo.

National Transportation Safety Board (US) LAX08IA042 - 2007

Unlocking pressure on one hydraulic servo was too high and created a control lock. The instructor landed the helicopter by following the emergency procedure from the flight manual.

The CFI immediately noticed that an abnormal force was required on the cyclic control to prevent the helicopter's nose from pitching up and to the left.

The CFI elected to continue the landing with the hydraulics off …. He managed to complete a run-on landing without mishap by maintaining an airspeed of about 10 kts. When the helicopter came to rest, the pressure was released on the cyclic and the second pilot restored the hydraulics via the collective switch. Immediately thereafter, the cyclic began a hard over and displaced to the left against the CFI's leg. He attempted to center the cyclic with both hands, but he was unable to move the control.

National Transportation Safety Board (US) WPR10LA046 - 2009

The student lost control during hydraulic failure training. The instructor’s delayed input and a lack of positive exchange of control contributed to accident.

The instructor told the PUI [pilot under instruction] to turn the hydraulics back on. The helicopter continued in a nose low attitude and in a left bank of about 15-30 degrees. The pilots both stated that they could not move the cyclic in the lateral axis. The helicopter continued the rotation with the nose low attitude until ground impact.

Transportation Safety Board of Canada A13Q0021 - 2013

The TSB found that the instructor did not follow flight manual procedures for flight without hydraulic assistance. The instructor encountered heavy unpredictable control forces and could not recover from a steep left roll.

The flight instructor took off in manual mode and again flew a tight left pattern at low speed and low altitude. At the end of the base leg, at the beginning of the final approach, the helicopter momentarily reached a level attitude. Just before the flight instructor handed the controls to the pilot in training, the helicopter banked slightly to the left and then quickly rolled to the left in a nose-down attitude, and the main rotor struck the runway.

Air Accidents Investigation Branch (UK) EW/C2017/05/01 - 2017

The instructor lost control while flying a tight low-level left-hand circuit without hydraulic assistance and at a high angle of bank.

When interviewed, the instructor stated that he had been unable to move the cyclic control to the right to arrest the roll to the left.

Appendix B

For a full copy of the safety information notice click the hyperlink

Airbus Helicopters Safety Information Notice 3246-S-29 Rev1 2019

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

During the afternoon of 28 October 2017, a Cessna Aircraft Company T310R, registered VH-JMW (JMW) was conducting a return flight from The Lakes airstrip, New South Wales to Toowoomba Airport, Queensland with the pilot and one passenger on board.

On the return flight from Toowoomba, during descent to The Lakes, and while about 8 km from the runway, a witness recalled hearing the sound of what he thought was a single-engine aircraft ‘cough’ and then stop. Shortly afterwards, JMW was seen descending slowly with the landing gear extended. The aircraft then ‘jerked’ suddenly, rolled to the left and descended rapidly to the ground.

The pilot and passenger were fatally injured, and the aircraft was destroyed.

What the ATSB found

The ATSB identified that during the final descent towards The Lakes airstrip runway, the left engine was not producing power and the right engine was operating at low or intermittent power.

Following the loss of engine power a safe flying speed was not maintained resulting in a loss of control and collision with terrain due to either an aerodynamic stall, asymmetric power effects or a combination of both.

The loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Safety message

A loss of power in an aeroplane requires different responses depending on whether the aircraft has single or multiple engines. However, regardless of the configuration, in order to maximise the survivability outcome it is imperative that the pilot retains control of the aircraft and maintains a safe airspeed. Where the aircraft’s performance degrades to the point that continued safe flight is not possible, the pilot must shift focus to conducting a forced landing.

Pilots also need to routinely exercise good fuel-management practices in order to maintain the highest level of safety and avoid fuel exhaustion or starvation events. Civil Aviation Advisory Publication 234-1(2) provides guidance on the current fuel requirements and good fuel-management practices.

The occurrence

What happened

At about 1000 Eastern Daylight-saving Time^[1] on 28 October 2017, a Cessna Aircraft Company^[2] T310R, registered VH-JMW (JMW), departed The Lakes airstrip, New South Wales, for a private flight to Toowoomba Airport, Queensland with the pilot and one passenger on board. The aircraft arrived in Toowoomba at about 1130 and remained on the ground for a few hours.

At about 1437, the pilot and passenger departed for the return flight to The Lakes. The aircraft was not refuelled at Toowoomba and weather forecasts and reports indicated that conditions were suitable for flight under the Visual Flight Rules.^[3] There was a light westerly crosswind at the cruising altitude of 9,500 ft and a light easterly wind at lower altitudes near the destination.

At about 1541, the passenger sent a cheerful text message to a friend, which indicated that all on board the aircraft was normal. A short time later, the pilot began the descent from 9,500 ft and continued tracking towards The Lakes.

At about 1554, a witness located close to JMW’s track heard a low-flying aircraft to the west of his position travelling south (Figure 1, ‘Witness 1’). He described the aircraft as sounding like a single‑engine aircraft and recalled hearing the engine ‘cough’ and then stop as the aircraft flew past him.

Figure 1: Flight path of VH-JMW

Source: Google Earth modified by the ATSB

A minute later, two other witnesses, both driving south along the Pacific Highway, saw JMW to the west of the highway at low altitude (Figure 1, ‘witnesses 2 & 3’). One witness recalled the aircraft was descending slowly at first with the landing gear extended. Soon after, the witness saw the aircraft ‘jerk’ then roll to the left, pitch down and descend rapidly to the ground.

At about 1555, JMW impacted trees and then collided with terrain. The aircraft came to rest in a narrow wooded strip of land between the highway and the main northern railway line (Figure 2). The wreckage was about 800 m (0.4 NM) from The Lakes runway 16 threshold.

One of the witnesses driving on the Pacific Highway was the first to arrive at the accident site. He recalled smelling fuel on arrival, and the ground around the aircraft’s wreckage being wet. He also noticed a momentary wisp of smoke from sparking electrical components behind one of the wings however, there was no fire. Emergency services personnel arrived at the accident site shortly afterwards. A couple of the first responders reported a fuel smell near the aircraft, but others did not recall smelling fuel.

The pilot and the passenger were fatally injured, and the aircraft was destroyed in the accident.

Figure 2: Accident site

Source: ATSB

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. On 29 July 2015, the Type Certificate Holder transferred from the Cessna Aircraft Company to Textron Aviation. All information related to the aircraft manufacturer in this report pre-dates that transfer.
3. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions clear enough to allow the pilot to control and navigate the aircraft visually.

Context

Pilot information

The pilot held a:

• Private Pilot (Aeroplane) Licence issued on 10 October 2000
• current Class 2 aviation medical certificate issued in 2017 without restriction
• Night Visual Flight Rules rating and a Private Instrument Flight Rules rating.^[4]

The pilot had owned a number of single- and multi-engine aircraft and was endorsed for the Cessna 310 in December 2001.

Extracts from the pilot’s logbook showed that he had in excess of 3,200 hours total flying experience on aeroplanes, with more than 300 hours experience on multi-engine aircraft. He last completed a multi-engine flight review with a flight instructor in May 2017. As part of that review, the pilot demonstrated his ability to manage asymmetric power conditions and simulated one‑engine inoperative exercises at various phases of the flight. The instructor recorded the pilot’s response to these exercises as ‘normal’.

Aircraft information

The Cessna Aircraft Company T310R is a low-wing, twin-engine aircraft equipped with retractable landing gear. In 1988, VH-JMW was modified under supplementary type certificates to replace the original Continental IO-520-MB engines with turbocharged engines (TSIO-520-NB) and fit new three-bladed propellers (Figure 3).

Figure 3: VH-JMW – Cessna T310R

Source: Flightaware.com

In December 2016, a periodic inspection was conducted. The maintenance release did not identify any defects. The release was valid for 100 hours or until 14 December 2017. The only scheduled maintenance task carried out during this release period was an engine oil change. Documentation for the aircraft’s prior maintenance history, including fuel gauge calibration, was not available.

At the time of the accident, the aircraft’s optional equipment included:

• a multifunction display
• a digital fuel flow indicator and totaliser (digital fuel system), which had replaced the standard Cessna analogue fuel flow gauge
• an electronic primary navigation display.

Fuel system

The aircraft’s fuel system consisted of two main tanks located on the tip of each wing, two auxiliary tanks and two wing locker tanks. The dual indicating fuel quantity gauge provided a continuous indication of the fuel remaining in the selected tanks based on fuel weight, for both the left and right sides of the aircraft. The aircraft was not equipped with optional low fuel level indicator lights. The total capacity of the main tanks and the auxiliary tanks was 628 L, with 617 L being usable. The total capacity of the wing locker tanks was 155 L with 151 L of usable fuel.

The main tanks were integrally sealed aluminium tanks, which were vented to atmospheric pressure by a flush vent located on the lower aft portion of each main tank. Each auxiliary fuel tank consisted of two interconnected bladder-type fuel cells located between the wing spars in the outboard section of each wing. The wing locker fuel tanks were located in the forward part of each wing locker baggage area and were also bladder-type cells that supplemented the main tank fuel quantity. The wing locker fuel could not be fed directly to the engines; instead, it was transferred to the main tanks by manually‑selected wing locker fuel transfer pumps.

Two fuel selectors, one for each engine, were located on the floor between the pilot and co-pilot seats. The fuel selectors controlled the wing selector valves to enable switching between the main and auxiliary fuel tanks.

The fuel system comprised the following pumps (for each side to the aircraft):

• engine-driven fuel pump (to transfer fuel from the centre sump to the engine)
• auxiliary boost fuel pump (to provide fuel pressure for priming during engine starting, and to supply fuel to the engine in an emergency)
• main fuel tank transfer pump (to transfer fuel from the nose of the main tank to the centre sump and allow steep descent with low fuel quantity)
• wing locker fuel tank transfer pump (to transfer fuel from the wing locker tank to the main tank).

Fuel tank selection

The Cessna T310R Pilot’s Operating Handbook (POH)(Revision 3, 1982) stated:

If auxiliary fuel tanks are to be used, select main fuel for … 90 minutes of flight. This is necessary to provide space in the main tanks for vapour and fuel returned from the engine-driven fuel pumps when operating on auxiliary fuel. If sufficient space is not available in the main tanks for this diverted fuel, the tanks can overflow through the overboard fuel vents.

The POH also stated that in the event of an engine failure, the fuel in the auxiliary tank on the side of the failed engine would become unusable.

The Cessna Aircraft Company’s Pilot Safety and Warning Supplements (1 June 1998) also included this important fuel tank selection sequence. If auxiliary tanks were to be used, this sequence would ensure excess fuel supplied to the engine was collected in the main tanks, and not vented overboard. The incorrect sequence could result in venting fuel, reducing the fuel available to complete the planned flight.

The potential for accidental venting of fuel overboard described above and guidance on correct tank sequence had been widely promulgated for a many years. As such, it was considered unlikely that an experienced pilot would make such an incorrect selection.

Digital fuel system

The aircraft was equipped with a digital fuel system that measured the instantaneous fuel flow to each engine and calculated the aircraft’s endurance based on current fuel flow and the system‑totalised quantity of fuel remaining.

The system did not measure the actual fuel quantity on board the aircraft, instead it relied on a manually entered starting quantity and the system‑calculated quantity of fuel consumed. Additionally, the data presented did not provide the pilot with the quantity of fuel in individual fuel tanks. The pilot had the following manual data entry options:

• input the quantity of fuel added
• update the system’s computation of fuel remaining
• selection of a ‘full’ fuel default.

The ATSB examined the digital fuel system and found that it was correctly configured for the aircraft and operational at the time of the accident. The default ‘full’ value was set to 616 L in the system settings, which closely corresponded with the usable capacity in the main and auxiliary tanks. The system was set to display ‘Lo FUEL’ when the pre-programmed fuel level of 100 L was reached. Once ‘Lo FUEL’ was displayed, the fuel flow information would not display until the pilot acknowledged the warning by pressing ‘enter’.

The system was also configured to display a warning for the flying time remaining (endurance time). When the endurance time reduced below the pre-programmed endurance time of 45 minutes, the data in the right half of the display flashed. This warning required the pilot to acknowledge the warning by pressing ‘enter’.

Operational information

Fuel management

At the time of the accident, the Civil Aviation Advisory Publication, CAAP 234-1(1) Guidelines for Aircraft Fuel Requirements, was in effect.^[5] The CAAP recommended a 45-minute fixed fuel reserve^[6] and that pilots use at least two independent fuel check methods to establish the quantity of fuel.

Fuel quantity

The last known fuel uplift by JMW was recorded on 12 September 2017. The number of flights undertaken between 12 September and the accident flight meant that the aircraft must have been refuelled during that time. However, no records were found to indicate where, when and how much fuel was uplifted. Consequently, it was not possible to determine the fuel quantity on board the aircraft on departure from either The Lakes or Toowoomba.

There was some indication that the pilot considered the runway length at The Lakes was weight limiting on take-off. While this could suggest JMW did not depart from there with full fuel, that could not be verified. The aircraft was not refuelled in Toowoomba prior to the return flight.

The ATSB found the refuelling facility at The Lakes airstrip had appropriate maintenance placards affixed to the bowser indicating that it was in use. The facility’s fuel tank was about one‑third full, and a test of the fuel indicated no fuel quality issues. The facility was not required keep fuel records.

The supplemental type certificate for JMW under which the turbocharged engines were installed did not provide revised fuel consumption rates. No other documents, such as pilot calculations for the aircraft’s fuel consumption or similar records, were found. In the absence of that information, the ATSB used the fuel consumption rates of a Cessna aircraft (of similar size to JMW and fitted with the same engines) to estimate fuel consumption for the accident flight. This calculation indicated that fuel consumption for the round trip from The Lakes to Toowoomba would be in the order of 425 L.

The on-board digital fuel system recorded a consumption of 563 L (based on the pilot’s last entry and system calculations) and displayed 53 L remaining. If the starting fuel quantity was accurate, there should have been 53 L (616 – 563 L) of usable fuel based on calculations remaining at the time of the accident. However, this could not be verified by independent calculations or physical evidence.

Asymmetric operations

The Cessna 310 has two wing-mounted engines that produce symmetrical propeller thrust during normal operation. When one engine is inoperative, the resulting asymmetric forces will cause the aircraft to yaw in the direction of the inoperative engine, which can be countered through the application of rudder and aileron control inputs. The minimum control speed (V_mca^[7]) of 84 KIAS^[8] must be maintained to ensure that the rudder and aileron retain sufficient control authority to maintain directional control of the aircraft. The value of the minimum control speed will vary from the published value with engine power level on the operable engine and aircraft configuration. With the operable engine at low power, the minimum control speed will reduce to a value close to the stall speed.

The intentional one engine inoperative section of the Cessna T310R POH stated that while the aircraft is controllable at V_mca, the performance is so far below optimum that continued flight near the ground is improbable. Therefore, the handbook recommended that a more suitable safe single-engine speed was 92 KIAS. At this speed, altitude could be maintained more easily while the landing gear is being retracted and the propeller is being feathered.^[9]

A single inoperative engine on a twin-engine aircraft may not always result in controllability issues that are immediately obvious to the pilot. This point was highlighted in the United States Federal Aviation Administration (FAA) Airplane Flying Handbook:

An engine failure in a descent or other low power setting can be deceiving. The dramatic yaw and performance loss will be absent. At very low power settings, the pilot may not even be aware of a failure.

Aircraft handling following engine failure

The Cessna 310 POH stated that, following an engine failure, the pilot’s first consideration is to maintain control of the aircraft and ensure the airspeed remains above the minimum control speed. It then stated that the pilot needed to identify the inoperative engine, adjust the operative engine as required, and perform a number of checks relating to fuel flow, tank selection and quantity; engine oil pressure and temperatures; magneto switches and mixture. If the engine could not be re-started, the pilot must ‘secure’ or shutdown the engine, which includes feathering the propeller.

The FAA Airplane Flying Handbook provides further practical guidance for managing such a situation. Importantly, the handbook stated that completely securing a failed engine may not be necessary or even desirable depending upon the failure mode, altitude, and time available.

It is recognised that if both engines lose power, the best gliding range will be achieved when the aircraft is flown at the optimum gliding speed and configured for the minimum aerodynamic drag. Guidance for configuring an aircraft following engine failure is provided in the Multi-Engine Pilot Manual by Jeppesen Sanderson (1992):

It is important that the pilot be familiar with the correct order for drag reduction following an engine failure. Normally, a windmilling propeller contributes the greatest amount of drag, followed by full flaps, extended landing gear, and the control deflections required to stop the airplane from turning. Since it is considered unwise to immediately feather an engine before it has been positively identified, drag is normally reduced by first retracting flaps and gear. Next, the failed engine is identified and the propeller is feathered. However, the specific order of drag reduction may vary between types of twin‑engine airplanes, so the manufacturer’s recommendations should be followed.

Based on the estimated weight of JMW, its best glide speed was about 102 KIAS at a glide angle of 4°. Any variation from that target airspeed would have reduced the gliding range. Shortly before the collision, the aircraft’s airspeed was about 67 kt, 35 kt less than the best glide speed.

Aircraft performance degradation

In relation to a previous Cessna 310 accident, the aircraft manufacturer provided information that an unmodified Cessna 310 at maximum landing weight has a single-engine climb rate of about 375 feet per minute at sea level. However, the drag penalties of an unfeathered windmilling^[10] propeller, extended landing gear and full flap significantly degrade single-engine climb performance. Under these conditions with one engine inoperative, a penalty to the climb rate of about 850 feet per minute could be expected.

In comparison to standard engines for its aircraft type, JMW’s engines were higher performing. At the time of the accident, JMW had its landing gear extended, propellers unfeathered and flaps at 15° (see the section titled Aircraft configuration). In this configuration, the aircraft descended about 1,100 ft during the last minute of its flight (see the section titled Recorded data).

Recorded data

The aircraft was fitted with an electronic primary navigation display. The recorded data on the navigation system included aircraft pitch, roll and ground speed.

ATSB analysis of the recorded data (partly illustrated in Figure 4) determined that:

• About 140 seconds before the collision, the aircraft rolled to the left and then to the right. The aircraft was travelling at about 150 kt at an altitude of 1,600 ft and was approximately 4.5 NM from the The Lakes runway threshold. There was a corresponding heading change to the left of approximately 4° followed by a change to the right of approximately 6°. This sequence could be consistent with asymmetric forces on the aircraft due to the loss of left engine power or a course correction onto the final approach path.
• Shortly after, the speed of the aircraft decreased below the maximum flap extension speed (158 KIAS) and the maximum landing gear extension speed (138 KIAS) indicating the pilot did not configure the aircraft into its final configuration until the last 100 seconds of the flight.
• From about 1554 (60 seconds before control of the aircraft was lost) the pitch of the aircraft trends upwards from -5° (nose down) to a maximum of 6.5° nose up just before the loss of control.
• Just after 1554, the aircraft’s altitude was about 1,100 ft^[11] (last known altitude). The aircraft was approximately 2 NM from the runway threshold.
• About 30 seconds before the collision and again about 10 seconds before the collision, the aircraft rolled to the left and pitched down with a heading change to the left (Figure 4). This sequence was consistent with asymmetric forces on the aircraft due to the loss of left engine power.
• Over the last 30 seconds of the flight, the rate of speed decay increased with the aircraft’s speed reducing to below the published (and likely actual) V_mca, and into the stall speed range (68–74 kt).^[12] Constant variations in pitch and roll were evident throughout this stage of the flight, with a continual upward trend in pitch (Figure 4).
• Just before 1555, the aircraft’s speed decayed to 67 kt^[13] (ground speed). The nose continued to pitch up, attaining a maximum pitch of about 6.5 degrees. Shortly after, the left wing dropped and the nose pitched towards the ground.

Figure 4: Last 280 seconds of recorded flight data

Source: ATSB

Wreckage and impact information

The ATSB’s examination of the accident site confirmed that the aircraft was in a left-wing, nose‑down attitude when it collided with terrain. It came to rest between a railway line and the Pacific Highway in a thicket of gumtrees and coastal scrub. The distribution of the wreckage and the damage to the trees indicated that the aircraft had little forward momentum on impact (Figure 2). The impact forces from the collision destroyed the aircraft.

Aircraft structure

All of the aircraft structure was identified at the accident site. There was no evidence of inflight break-up or post-impact fire. Continuity of the flight control cables and aircraft control surfaces were confirmed as secure or fractured due to overstress, consistent with the ground collision.

There were no pre-existing mechanical defects identified during the examination that would have prevented normal operation of the aircraft. However, there was severe disruption to the aircraft pitot tubes, seats and fuel selector system, making it impossible to determine their serviceability.

The aircraft’s occupant restraint system had been in use during the flight and was working normally.

Aircraft configuration

The wreckage examination showed that the aircraft was configured with the landing gear down and locked, and the flaps extended to 15°. Both the left and right engine propellers were towards the fine pitch, and not feathered.

The position of the flight controls, engine controls and fuel tank selectors immediately prior to the loss of control could not be determined due to the severe disruption of the cockpit and fuselage.

Engines

Continuity of the right engine propeller pitch control was established by visual inspection. The left engine propeller pitch control cable had separated at the governor connecting rod, consistent with overstress failure from impact forces.

The left propeller blades showed no evidence of bending, twisting or chord-wise (that is, across the width of the blade) scratching. This indicated that the left engine was not producing power on impact. On the other hand, one blade of the right propeller showed evidence of forward compound bending, and chord-wise scratching across its face. The spinner and propeller hub were partially buried in the ground with evidence of corkscrewing of the propeller pressure dome cover attached to the spinner. The propeller hub fractured at the crankshaft. Examination of the fracture surface showed that dominant failure load was bending, consistent with no significant power on the right engine at the time of impact with terrain.

An external visual inspection of the left and right engine and engine controls did not identify any pre-existing damage or defects. All of the damage identified (including to the left engine fuel pump and oil sump) was consistent with impact damage from the collision.

The cylinders, sparkplugs, crankcase and external accessories were confirmed secure on both the left and right engine. All of the fuel supply and return lines between the engine firewall and the engine were disconnected and inspected. Negligible fuel was found in the lines (they should contain fuel under normal operating conditions). No blockages in the lines that would have prevented fuel reaching either engine were found.

The left engine oil sump was breached during the impact and a quantity of oil had leaked out and been absorbed in the soil. However, the oil cap was secure and some oil was noted on the graduated dipstick. Oil was also identified in the right engine.

The spark plugs, fuel pump, vacuum pump and all cylinder rocker covers on both engines were removed and inspected. Rotation of the crankshaft on each engine demonstrated continuity of the major engine components. During rotation, the pistons, cylinder rocker arms, vacuum pump drive, fuel pump drive and magneto gears were found to move through their normal range. An endoscope was used to determine that the pistons, valves and cylinders were in normal operational condition.

The left and right engine turbo charger inlet and outlet impellors were inspected and nil damage identified. The absence of damage provided inconclusive evidence to indicate whether the turbo chargers were powered at the time of impact.

There was no evidence found during examination of the engines to indicate that either engine was incapable of normal operation.

The fuel system

Both the left and right main fuel tanks separated from the wings following overstress failure at the spar attachments, and were found between 5 and 10 m from the main wreckage. Impact forces from the accident breached both the tanks, but their fuel caps were found in place and secured.

The left and right auxiliary fuel tanks were holed and crushed during the accident. There was some evidence of discolouration under the left wing resulting from fuel weeping from the left auxiliary tank. This weep was assessed as minor and therefore considered to have had a negligible impact on the usable fuel quantity.

The left- and right-wing locker tanks were intact but the interconnecting pipes had fractured during the accident. There was no evidence of fuel in either tank.

There was no fuel-fed post-impact fire or evidence of fuel tank deformation resulting from a large quantity of fuel impacting the internal walls of the fuel tank during the accident. While the first persons to arrive at the accident site reported smelling fuel, others who arrived shortly afterwards did not smell fuel. This could be indicative of the smell of fuel vapour from ruptured tanks, which then dissipated. Further, ATSB investigators found a negligible quantity of fuel in any of the tanks or around the wreckage. They also observed no dieback of vegetation at the accident site in the days following the accident that is typical of a fuel spill.

The main fuel tank transfer pumps were tested and found to be operational; therefore, even with the aircraft in a steep descent all of the usable fuel in the main fuel tank was available for use. The left engine fuel pump could not be tested due to severe impact damage, while the right engine fuel pump was not tested as it was evident that the right engine was producing some power at the time of the collision. A small amount of fuel was found in each of the fuel distributors, indicating that both of the engine fuel pumps were operational prior to the accident. The small quantity of fuel may have been due to a low fuel volume in the tanks.

Related occurrences

The ATSB research report, Power loss related accidents involving twin-engine aircraft (Research and analysis report B2005/0085), found that:

• Power loss accident rates in twin-engine aircraft were almost half that for single-engine aircraft.^[14] However, a power loss accident in a twin-engine aircraft was more likely to be fatal and overwhelmingly the result of in-flight loss of control.
• Of the 58 accidents identified between 1993 and 2002 that resulted in damage following the power loss, seven occurred during the approach phase of flight. Three of these involved a loss of control, including one fatal accident. When compared to the take-off phase, the approach phase is considered to be equally risky, with low altitude and only a little more energy available than during the take-off phase.
• Just over one-third of power loss accidents in twin-engine aircraft occurred during a non‑asymmetric power loss. The majority of these were related to fuel management, and no benefit was derived from the presence of a second engine.

Another ATSB research report, Starved and Exhausted: Fuel management aviation accidents (AR-2011-112) summarised key occurrences related to fuel management and outlined procedures pilots can use before and during the flight to ensure they land with reserve fuel intact.

This report includes the following key safety messages.

• Accurate fuel management starts with knowing exactly how much fuel is being carried at the commencement of a flight. If the tanks are not filled to a known setting, then a different approach is needed to determine an accurate quantity of usable fuel.
• Keeping fuel supplied to the engines during flight relies on the pilot’s knowledge of the aircraft’s fuel supply system and being familiar and proficient in its use. Adhering to procedures, maintaining a record of the fuel selections during flight, and ensuring the appropriate tank selections are made before descending towards your destination will lessen the likelihood of fuel starvation at what may be a critical stage of the flight.

__________

4. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than flights conducted using the visual flight rules (VFR). Procedures and training are more complex as a pilot must demonstrate competency in IMC conditions while controlling and navigating the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
5. In November 2018, CASA 29/18 – Civil Aviation Fuel Requirement Instrument was released which re-introduced a fixed fuel reserve requirement (30 minutes for daytime VFR pilots) and required pilots to conduct in-flight fuel management with regular fuel quantity checks, and, if required, declare MAYDAY fuel. At the same time, the advisory publication was updated to include the new requirements.
6. For visual flight rules flights in an aircraft with piston engines.
7. V_mca is defined as the indicated airspeed at which it is possible to maintain control of the aeroplane when the critical engine is suddenly made inoperative, and thereafter to maintain straight and level flight at the same speed with an angle of bank of not more than 5° towards the operative engine.
8. Minimum control speed taken from STC.
9. Rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.
10. Windmilling: a rotating propeller being driven by the airflow rather than by engine power; this results in increased drag at normal propeller blade angles.
11. The aircraft’s altitude was sourced from the flightradar24 website.
12. A range for the stall speed has been specified because the stall speed will vary with a number of parameters including weight, which was unknown at the time of the accident. The range has been estimated assuming the aircraft was lightly loaded and had less than 20 degrees angle of bank.
13. The aircraft’s system recorded ground speed of the aircraft. The weather reports for the area around the time of the accident indicate that the winds were light and therefore the groundspeed closely represents what the indicated airspeed would have been.
14. Only aircraft below 5,700 kg maximum take-off weight were included in the analysis.

Safety analysis

Physical evidence at the accident site allowed the ATSB to establish, that VH-JMW (JMW) was operating in a low engine power state when it collided with terrain. Similarly, recorded flight data and witness reports enabled analysis of the sequence of the aircraft’s loss of control in the lead up to the collision. The following analysis details the factors that contributed to the development of the accident.

Engine power loss

Examination of the wreckage identified that the aircraft was configured for a powered approach, in a high‑drag configuration - left and right engine propellers unfeathered, landing gear down and the flaps partially extended. Based on the recorded data, the landing gear and flaps were extended within the last 100 seconds of the flight and the airspeed reduced significantly over the same time period. Maintenance of a high‑drag configuration while the aircraft’s performance declined indicated that either the pilot did not recognise any engine abnormalities until late in the approach, or he assessed that sufficient engine power remained to reach the runway.

The nature, type and extent of damage to the propellers (bending, twisting and scratching to each), and examination of the fractured right propeller flange showed that, at the time of collision:

• the left engine was not producing power
• the right engine was not producing significant power.

No evidence was found to indicate a mechanical defect that would have prevented either engine from developing full power.

The ATSB considered whether the assessed low engine power levels at the time of the collision also existed immediately before the loss of control. While it is possible that the pilot may have reduced the engine power in the final moments, given the significant recorded decline in aircraft performance over the last two minutes of the flight, the low power state probably existed immediately prior to the accident. Distortion of the engine controls during the collision prevented identification of the selected power setting.

The positive nature of the text message sent about 14 minutes before the collision, indicated that the aircraft was performing as expected at that point in the flight. However, about 2 minutes and 20 seconds before the collision, at an altitude of 1,600 ft, the recorded data showed a large deviation in the aircraft roll and heading. Those deviations were consistent with a left engine power loss. Control of the aircraft’s pitch, roll, heading and speed declined from this point on (Figure 4).

In the last minute of flight, JMW’s descent rate was higher than expected for the aircraft type when operating on one engine in a high drag configuration. That indicated that the operative right engine was likely producing reduced power. Based on witness observations, it is possible that the right engine had intermittent power rather than a consistently low output.

In summary, the ATSB assessed that, shortly before the collision, the left engine had stopped producing power and the right engine was operating at low or intermittent power.

Loss of control

From the available evidence, it could not be determined when the pilot became aware of the left engine power loss. Consistent with the guidance in the United States Federal Aviation Administration Airplane Flying Handbook, it is possible that the power loss may not have been obvious as the aircraft was descending. Similarly, apart from extension of the landing gear and flap, it was impossible to determine the pilot’s response to the power loss and his subsequent actions. However, it is relevant to note that he had started an apparently normal descent minutes earlier (soon after 1541). He was also flying over thickly‑wooded terrain, and was very close to the destination before control was lost.

Recorded data enabled the loss of control to be better explained (Figure 4). The low engine power combined with the high-drag configuration meant that the aircraft’s speed and altitude could not be maintained. This in turn led to the airspeed declining to below the published V_mca and into the stall speed range. As the right engine was likely not operating at full power, the actual V_mca was less than the published figure and likely in the region of the aircraft’s stall speed. As the speed continued to decline, the nose was progressively pitched up to about 6.5°. The left wing and nose then dropped towards the ground resulting in a collision with terrain. That flight behaviour with the airspeed in the region of both the stall speed and V_mca, indicated a loss of control due to either a low-speed stall, asymmetric effects or a combination of both.

Fuel-related factors

There was no evidence of a mechanical defect to explain the apparent engine power losses. However, the absence of fuel in the supply and return lines indicated that sufficient fuel was not reaching either engine at the time of the collision. This, and other fuel-related evidence, resulted in the ATSB exploring potential fuel starvation and exhaustion scenarios, and related factors.

As no fuel uplift occurred in Toowoomba before the accident flight, JMW departed The Lakes with a fuel quantity that the pilot considered sufficient for the return flight. However, with no fuel records or other evidence available, that quantity could not be determined. It is possible that there was sufficient fuel for the return flight as anticipated by the pilot and the wreckage examination did not identify any pre-existing fuel tank leaks that could have affected the storage capacity.

After the aircraft began its descent to The Lakes, recorded roll and heading deviations indicated that the left engine lost power first due to insufficient fuel supply. The right engine’s loss of power, some time later, was consistent with the expected slight variation in fuel consumption and tank fuel quantities between the left and right systems.

The on-board digital fuel flow indicator and totaliser indicated there were 53 L of usable fuel in the tanks at the time of the collision. However, this was not a measured quantity but a system‑calculated figure based on consumption, and relied on an accurate starting quantity. While the system was correctly set up, the ATSB could not verify this figure because there were no fuel records or fuel consumption rates. The absence of fuel damage to vegetation at the accident site, no post-impact fire and no strong, persistent fuel smell, supported a conclusion of minimal fuel on board. The ruptured fuel tanks made it impossible to determine (or estimate) the fuel quantity that they had contained.

The investigation considered the possibility of inadvertent venting of fuel overboard due to the incorrect sequence of selecting fuel tanks (auxiliary before main tanks). However, given the pilot’s significant experience and familiarity with the aircraft type, and the well-known tank selection sequence, it is unlikely that he would have made such an error.

The investigation also considered a scenario where the pilot attempted using all usable fuel in the auxiliary tanks before switching the fuel selector to main tanks for landing (to avoid having unusable fuel in the auxiliary tanks in the event of an engine failure on approach). Mis‑timing the switchover could interrupt the fuel supply if the auxiliary tanks were exhausted. This would introduce air into the fuel lines, and manifest as struggling engines, such as observed by the witness. There was insufficient evidence to determine the likelihood that occurred.

In summary, based on the scenarios and fuel-related factors considered, it is possible to state that:

• the fuel quantity when the aircraft departed either The Lakes or Toowoomba could not be determined but may have been sufficient to complete the return flight
• the left engine lost power after its fuel supply was interrupted when approaching The Lakes
• the right engine lost power due to a restriction to its fuel supply (it could not be determined if this was due to control inputs or otherwise)
• at the end of the flight, there was probably less than 53 L usable fuel
• it is unlikely that fuel was vented overboard due to incorrect tank selection sequence
• it is possible that a fuel tank switchover was intended and mis‑timed.

Therefore, the ATSB concluded that the loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving a Cessna Aircraft Company T310R, registered VH-JMW that occurred 40 km south‑south‑west of Port Macquarie, New South Wales on 28 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During the final descent towards The Lakes airstrip runway, the left engine was not producing power and the right engine was operating at low or intermittent power.
• After losing engine power at low altitude, a safe flying speed was not maintained resulting in a loss of control and collision with terrain due to either an aerodynamic stall, asymmetric power effects or a combination of both.
• The loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• a number of witnesses
• the aircraft manufacturer (Cessna)
• aircraft refuellers
• Textron Aviation
• The Civil Aviation Safety Authority
• The United States Federal Aviation Administration.

References

• Jeppesen Sanderson Inc 1992, Multi-Engine Pilot Manual, Jeppesen Sanderson, Colorado.
• ATSB aviation research investigation report B2005/0085, Power loss related accidents involving twin-engine aircraft.
• ATSB aviation research investigation report AR-2011-112, Starved and exhausted: Fuel management aviation accidents.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to representatives of the aircraft’s occupants, the United States National Transportation Safety Board, the Civil Aviation Safety Authority, and the aircraft manufacturer.

Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 27 October 2017, at 1410 Eastern Daylight-savings Time (EDT),^[1] a captain and first officer signed on for flight duty at Brisbane Airport, Queensland. The planned duty was to operate a JetGo Embraer ERJ135 aircraft, registered VH-ZJG, on four scheduled passenger transport sectors: from Brisbane to Dubbo, New South Wales, Dubbo to Essendon, Victoria, Essendon to Dubbo, and Dubbo to Brisbane.

The aircraft was scheduled to depart Brisbane at 1510. However, the flight crew were advised of an engineering delay of up to 45 minutes for unscheduled maintenance to change a main landing gear tyre. A replacement tyre was not immediately available, which resulted in an extended delay that eventually totalled 4 hours 15 minutes.

The aircraft departed Brisbane at 1925 and, after an uneventful flight, departed Dubbo for Essendon at 2116. The first officer was the pilot flying (PF) and the captain was the pilot monitoring (PM) for the sector from Dubbo to Essendon.^[2]

Prior to commencing descent, the flight crew programmed the aircraft’s flight management guidance system and briefed for an instrument landing system^[3] (ILS) approach to runway 26. It was the first time either pilot had operated into Essendon at night, and therefore their preferred approach was a runway 26 ILS approach. The flight crew also discussed the possibility of receiving radar vectors^[4] from air traffic control (ATC).

ATC informed the flight crew that due to aircraft traffic at neighbouring Melbourne Airport, runway 26 was unavailable. Therefore, ATC provided radar vectors for a visual approach to runway 35. As the aircraft passed abeam Melbourne Airport, the captain had Melbourne and Essendon runways in sight.

At 2220:18, ATC advised the flight crew that they would be positioned for a 5 NM (9.3 km) final approach at 2,100 ft above mean sea level (AMSL). This altitude was the radar lowest safe altitude for that sector of airspace. At 2221:48, ATC instructed the flight crew to descend to 2,100 ft.

The first officer recalled setting 2,100 ft on the aircraft’s altitude preselector. This directed the automatic flight control system (AFCS) to continue descent to 2,100 ft. He also recalled confirming the 2,100 ft set altitude on his primary flight display, as well as the flight director modes of heading and vertical speed mode. The captain recalled verifying the assigned altitude being set and flight director modes. Both flight crew recalled the autopilot was engaged at this time.

At 2223:02, as the aircraft passed about 2,300 ft on descent, ATC requested the flight crew to report sighting runway 35. At this time, the captain had lost sight of the runway. Becoming concerned that the captain could not visually identify the runway, the first officer also focused his attention looking outside the aircraft to the left to help locate the airport.

At about 2223:35, when 7.1 NM (13.1 km) from Essendon Airport and on a heading of 080°, the aircraft descended below the assigned altitude of 2,100 ft. Neither flight crew detected the aircraft was now below the radar minimum safe altitude and continuing to descend. When the captain next looked inside the aircraft at his primary flight display, he recalled seeing the altimeter indicating 1,600 ft, and he then called ’height’. The first officer also recalled seeing that they were below the assigned altitude at the same time.

At 2223:52, ATC instructed the flight crew to climb to 2,100 ft. However, that instruction was over transmitted by another aircraft and not heard by the flight crew. At 2223:58, ATC issued another instruction to climb immediately to 2,100 ft, which the flight crew acknowledged.

At 2224:05, a cleared level adherence monitoring (CLAM) alarm^[5] activated (Figure 1), further alerting ATC of a difference between the aircraft’s assigned altitude and its actual altitude. ATC immediately issued a terrain safety alert, advising the flight crew that the lowest safe altitude was 2,100 ft.

Recorded radar data showed the aircraft’s lowest altitude was about 1,500 ft during 2224:05 to 2224:10 (Figure 1).

Figure 1: Image of air traffic controller’s monitoring screen showing CLAM alarm activation following the aircraft’s descent below 2,100 ft

Image shows the aircraft (JG044) with a current altitude of 1,500 ft (‘015’), a cleared altitude of 2,100 ft (‘021’), a radar vectored heading of 070° (‘H070’) and a groundspeed of 160 kt (‘16’).

Source: Airservices Australia

As the aircraft climbed above 2,100 ft, ATC advised the flight crew of their position relative to runway 35 and asked if they had the runway in sight. When they confirmed that they did, ATC asked if they wanted to continue the approach. The flight crew elected to discontinue the approach and ATC subsequently vectored the aircraft for another approach. The aircraft landed without further incident at 2236.

At 2259, the aircraft taxied for departure from Essendon and then completed the service to Dubbo and Brisbane. The flight crew finished duty in Brisbane at 0245.

Airport information

Essendon Airport is located about 8 km south-east of Melbourne Airport. The proximity of the two airports adds complexity to operations at Essendon.

The airport has two runways aligned 17/35 and 08/26, and it is bounded on two sides by freeways with substantial amber lighting and well-lit residential areas. At night, the lights around the airport present a complex picture. The published aerodrome chart had a caution note describing that amber freeway lighting may confuse flight crews when attempting to identify runway 08/26 lighting.

Runway 35 did not have an instrument approach procedure. Instead, pilots were required to conduct visual approaches to this runway. It was equipped with a precision approach path indicator light (PAPI) array to provide pilots with vertical profile guidance during visual approaches.

At the time of the occurrence, visibility was greater than 10 km, and the wind was a northerly at 14 kt.

Essendon Airport had a curfew prohibiting aircraft movements from 2300 until 0600 for all operations other than emergency services. Operators would incur financial penalties for flights arriving or departing during the curfew period.

To continue the service from Essendon to Dubbo (and then Brisbane), the aircraft had to commence taxiing for departure before the curfew. Missing curfew would result in the aircraft being grounded until 0600 the next morning, disrupting the current service and that of the following day.

The aircraft taxied for the return flight from Essendon at 2259, 1 minute before the commencement of the curfew period. Both flight crew reported feeling significant pressure to complete the service and return the aircraft to Brisbane. Both pilots reported being aware of the potential problem with the curfew prior to departing Brisbane, and the first officer reported considering the potential problem with the curfew during the visual approach into Essendon.

Air traffic control information

Airservices Australia provided an ATC service to the aircraft for the entire flight, including the descent to Essendon. The approach controller who provided radar vectors to the flight crew was also responsible for sequencing a large number of aircraft arrivals into Melbourne at the same time.

In an effort to manage the risk that neither pilot had operated at night into Essendon, the captain’s preferred arrival was to runway 26 as it was equipped with an ILS and was the longer runway. However, due to the congestion of arriving and departing aircraft at Melbourne, ATC advised this request was not available. Although the captain maintained the ability to instruct ATC that he required the ILS approach, he was likely aware that doing so would possibly result in ATC needing the aircraft to enter a holding pattern until the controller could sequence the flow of aircraft traffic at both airports.

When conducting a visual approach to a runway, ATC can provide radar vectors to the pilot until the aircraft is aligned with the runway centreline. A pilot is required to report that they have sight of, and can maintain sight of, the landing runway in order for ATC to clear a pilot to conduct the approach.

The flight crew reported that during the radar vectoring towards Essendon, they felt pressure from ATC to sight runway 35. The ATSB reviewed audio recordings between the approach controller and the flight crew. The flight crew first contacted Melbourne Approach at 2213:58. At 2223:02, the approach controller asked them to report Essendon runway 35 in sight. This was the only recorded request made by the approach controller to the flight crew to sight runway 35.

Automatic flight control system

Flight crews normally manage flight of an ERJ135 using the aircraft’s AFCS. This system consists of dual autopilots, a flight guidance controller (FGC) and flight instrument displays.

To manage the aircraft in all flight phases, pilots select various modes on the FGC. Selected descent modes included flight level change, speed hold and vertical speed.

The pilot can engage the autopilot by pressing a button on the FGC. Intentional disengagement of the autopilot by a pilot generates an audible voice AUTOPILOT alert. Failure and disconnection of an autopilot results in the same audible voice alert and generates a warning message illuminated on a separate indicating system.

In the ‘vertical speed’ (VS) selected descent mode, the AFCS will maintain a selected vertical speed. The rate of vertical speed can be changed as needed by the pilot. With the autopilot engaged, the VS mode would automatically change to altitude capture mode as the aircraft approached a preselected altitude.

An ‘altitude preselect’ (ASEL) mode armed automatically if the aircraft climbed or descended towards a preselected altitude. Altitude preselect mode would then automatically capture and cancel any existing mode at an appropriate point based on preselected altitude error and vertical speed. The system would then automatically switch to altitude hold mode after the aircraft had levelled off at the preselected altitude.

The first officer recalled selecting the descent mode to vertical speed at the time ATC commenced issuing radar vectors. The flight crew reported that the autopilot was engaged during the descent and that the AFCS failed to capture the preselected altitude (2,100 ft) as expected. Further, the flight crew recalled that no alert was heard, either for autopilot disconnect or altitude exceedance, which should have sounded when the aircraft was 200 ft below the preselected altitude.

After descending below 2,100 ft, the flight crew reported that the flight director pitch bars, which indicate the direction of the preselected altitude, were providing guidance that the aircraft should climb.

The ATSB requested the aircraft’s flight data recorder. However, at the time of the request, the data for the occurrence flight had been overwritten.

Following the flight, no technical log entry was made regarding a problem with the autopilot capturing the selected altitude. Nevertheless, an engineering inspection of the AFCS was conducted following the aircraft’s arrival back in Brisbane, and no fault was found.

The flight crew advised that they were aware of other recent AFCS problems associated with the aircraft and the operator’s other ERJ135 aircraft. A review of maintenance records for the operator’s ERJ135 fleet identified that several AFCS-related problems had been reported during the period from 3 August. However, none of those problems were similar to what occurred during the occurrence flight. In addition, no subsequent problems that were similar in nature were reported on the occurrence aircraft.

Flight crew information

The captain held an Air Transport (Aeroplane) Pilot Licence (ATPL) and had 10,100 hours total flight experience, including 155 hours on the aircraft type. The first officer held a Commercial (Aeroplane) Pilot Licence and had 2,100 hours total flight experience, including 473 hours on type.

Both flight crew had operated into Essendon on many previous occasions, but neither had operated to that airport at night.

Flight and duty times

The captain had the two previous days (2526 October) rostered off duty, and had conducted administrative work from 10001600 on the 24 October. The first officer had the four previous days rostered off duty.

On the day of the occurrence, both flight crew signed on to commence duty at 1410 EDT. Due to the delay before the first flight, they ultimately signed off duty at 0245, a duty period of 12.6 hours. However, the captain advised that he commenced administrative duties, unrelated to the subsequent flights, at about 1200 EDT. Therefore, his actual duty time was 14.8 hours.

The captain recalled waking up at about 0700 EDT on the day of the occurrence after a ‘normal’ sleep. He therefore had been awake for 15.4 hours at the time of the occurrence, and 18.8 hours at the end of the extended duty period. The first officer recalled waking up at 0630 EDT on the day of the occurrence after a ‘reasonable’ sleep, and was therefore awake for 15.9 hours at the time of the occurrence and 19.3 hours at the end of the extended duty period.

The operator managed its flight crews’ flight and duty times to comply with a standard industry exemption to Civil Aviation Order (CAO) 48.0, which was issued to the operator by the Civil Aviation Safety Authority (CASA). The exemption stated that duty included any task associated with the business of an operator.

The operator’s rostering personnel managed flight crew flight and duty times in order to comply with the exemption. The operator’s procedures required that all work-related activities for the operator be reported and considered as duty time.

The rostered flight duty limit for a pilot signing on after 1300 local time for a four-sector duty was 12 hours. However, a pilot could elect to extend a duty already started for up to 2 hours as long as they felt mentally and physically fit to continue (and they submitted a report upon completing the duty). Although the captain’s recorded duty time did not exceed 14 hours by the end of the trip, the actual duty time did exceed the limit.

During the delay on the ground in Brisbane, the crew were offered an option to stand down as they were now facing a long duty period. The captain reported that he was told his standing down would mean his four scheduled flights that day would be cancelled as there were no replacement captains available. Both pilots reported feeling fit to continue and elected to continue the flights. However, the captain later reported that he felt some pressure to operate the flights. The cabin crewmember stood herself down and was replaced.

Safety analysis

During radar vectoring to runway 35 at Essendon Airport, the aircraft descended below the radar minimum safe altitude of 2,100 ft. The flight crew reported that the autopilot was engaged and the altitude of 2,100 ft was preselected at the time of the occurrence. A subsequent engineering inspection found no fault with the AFCS. Because no flight data was able to be obtained, the ATSB was unable to confirm what the AFCS mode(s) and settings were at the time of the occurrence, or the reason why the aircraft descended below the preselected altitude.

Regardless of the reason for the aircraft descending through the prescribed altitude, flight crew have a vital role in monitoring the aircraft’s flight path, particularly during descent. In this case, the first officer (pilot flying) relied upon automation to capture the assigned altitude and diverted his attention outside of the aircraft to assist the captain (pilot monitoring) in sighting the runway. As a result, neither pilot was monitoring the aircraft’s flight instruments or descent path as it approached and subsequently descended through the assigned level, which was also the minimum safe altitude.

The flight had been significantly delayed from its scheduled time of operation. The flight crew were aware of the reduced time margin for their scheduled return flight to depart Essendon prior to the 2300 curfew. In addition, neither pilot had operated at night into Essendon Airport, and the captain’s requested option of conducting an ILS approach to runway 26 had been declined by ATC due to traffic. The captain’s subsequent difficulty in identifying runway 35 at night, the delayed arrival of the aircraft at Essendon and the proximity of the curfew time probably contributed to the first officer (pilot flying) focussing his attention outside the aircraft at a critical time of flight.

Both flight crew had the previous days off duty and had a reasonable amount of sleep the night before. Although both flight crew had been awake for 1516 hours at the time of the occurrence, there was insufficient evidence to conclude that they were operating at a level of fatigue known to influence performance at the time of the occurrence. Nevertheless, they would probably have been operating at an elevated risk of fatigue during the subsequent two flights.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During radar vectoring to runway 35 at Essendon, the aircraft descended through the radar lowest safe altitude (2,100 ft). The extent to which there was a problem with the functioning of the aircraft’s automatic flight control system could not be determined.
• Due to the captain (pilot monitoring) having difficulty sighting the runway, as well as perceived pressure to complete the flight, the first officer (pilot flying) focussed his attention outside the aircraft at a critical time during the descent.
• The flight crew did not detect that the aircraft had descended through the assigned level (2,100 ft) until the aircraft reached 1,600 ft.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.

Aircraft operator

As a result of this occurrence, JetGo advised the ATSB that they had taken the following safety actions:

• The flight crew involved in the incident were subsequently provided with ground and simulator training for operations into Essendon at night.

Safety message

Flight crew should be mindful that during higher workload phases of flight, such as during approach and landing at an unfamiliar airport, introducing tasks that divert both flight crew members’ attention from monitoring the aircraft’s flight profile and altitude should be minimised. Further, during a visual approach, pilots must ensure that at least one pilot monitors the aircraft’s flight path profile and energy state.

The ATSB SafetyWatch highlights the broad concerns that come out of our investigation findings and from the occurrence data reported to us by industry.

An increasing trend has been identified where pilots do not effectively manage their aircraft’s flightpath when unexpected events arise during the approach to land.

When compared to other phases of flight, the approach and landing has a substantially increased workload and is traditionally the phase of flight associated with the highest accident rate. Flight crews must continuously monitor aircraft and approach parameters, and the external environment, to ensure they maintain a stable approach profile and make appropriate decisions for a safe landing.

The selection of inappropriate autoflight modes, unexpected developments, or any confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.

The ATSB SafetyWatch information on Descending too low on approach provides more resources and information.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours. EDT was the time zone relevant where the occurrence took place and it has been used throughout the report to minimise confusion. The time in Brisbane was Eastern Standard Time, or UTC + 10 hours.
2. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. Instrument Landing System: A landing aid which provides lateral and vertical guidance to flight crew during approach to land.
4. Radar vectoring: ATC provision of track bearings and altitudes used to guide and position an aircraft.
5. System-detected non-conformance alert that checks the conformance of the actual flight level of a surveillance track with respect to the cleared flight level inputted by the controller.

Safety summary

What happened

On 24 October 2017, the owner-pilot of a Cessna 210B, registered VH-DBU, was operating the aircraft on a private flight without passengers from Albany to Bunbury, within Western Australia. Following take-off, the pilot made a radio broadcast at 1033 Western Standard Time, which was the last recorded transmission from the pilot. The pilot did some local flying before tracking to the north-west of Albany in the general direction of the destination.

At about 1100, people on properties about 30 km to the north-west of Albany heard and in some cases saw the aircraft fly over, and shortly afterwards, witnesses heard a loud cracking sound then one witness saw the aircraft in a steep descent until it disappeared out of sight. Smoke indicated a post-impact fire.

Aircraft wreckage was located in Mount Lindesay National Park and it was established that the pilot was deceased. The wreckage was dispersed over an area of approximately 700 m by 250 m and the fuselage, detached from each wing, was significantly fire affected.

What the ATSB found

The ATSB found that for reasons that were not established, abnormal operation of the aircraft produced high levels of unusual aerodynamic loading on the right wing that exceeded the strength of the wing and initiated an in-flight break-up and impact with terrain.

The aircraft did not have a pre-existing structural deficiency or damage that would have contributed to the in-flight break-up and the local meteorological conditions were not conducive to inadvertent aircraft overstress.

The ATSB found that the presence of methylamphetamine in the pilot’s system increased the risk of operational misjudgements and aircraft mishandling, and pilot incapacitation. This did not necessarily contribute to the accident.

The pilot had worked for a number of organisations which had the required risk controls for problematic alcohol and other drug (AOD) use in place. There was no data that indicated a systemic problem with problematic AOD use in Australian aviation.

What's been done as a result

No safety issues were identified and no proactive safety action was reported to the ATSB. Nonetheless, the ATSB considered that there were opportunities for aviation organisations to collect more data and to enhance the extant risk controls for problematic AOD use.

Safety message

The ATSB acknowledges that self-referral by a pilot with problematic AOD use to a Designated Aviation Medical Examiner, a Drug and Alcohol Management Plan, or the Civil Aviation Safety Authority (CASA), may be perceived as a threat to ongoing employment in aviation. However, the risks to pilots associated with self-referral are less than the health, safety, and legal risks of continuing to operate with problematic substance use.

A defined protocol exists within the CASA aviation medical framework for pilots in stable remission from the problematic use of substances to return to work. Employer and independent peer support organisations are becoming more widely available to assist pilots with the safe return to work.

The ATSB suggests that operators and industry associations consider the availability of information and services to pilots and safety sensitive aviation activities within their area of influence.

The occurrence

Sequence of events

On 24 October 2017, the owner-pilot of a Cessna 210B, registered VH-DBU was intending to operate the aircraft on a private flight from Albany to Bunbury, within Western Australia (Figure 1). The pilot was travelling to Bunbury to participate in training and assessment activities in preparation for the forthcoming aerial firefighting season.

Figure 1: Nominal intended flight path

Source: Google Earth (modified by the ATSB)

According to the aviation forecasts, there was no significant weather expected on the intended route at the time of the flight. The lower-level winds were from the west at between 10 and 15 kt, and cloud was broken cumulus or stratocumulus cloud between 2,500 and 7,000 ft. Visibility was reduced to 8 km in smoke. The observed conditions were consistent with the forecast and considered suitable for operation under the Visual Flight Rules.

Information about the pilot’s activities before the flight was limited. The ATSB is aware that on the day of the accident the pilot conversed with three people at different times who recalled that the pilot appeared to be in good spirits. The pilot did not discuss the forthcoming flight with anyone.

It was reported that the pilot kept the aircraft in a hangar at Albany Airport. There is no information about the pilot preparing the aircraft for the flight; however, someone did observe the aircraft near the hangar with the wheels chocked, engine operating, and the pilot outside of the aircraft nearby. No one was observed at the controls and no one has reported being at the controls at that time. This was contrary to safe practice and the regulatory requirement that a pilot needs to be at the controls while an engine is operating and no reason for this action was identified.

The pilot taxied the aircraft to the fuel bowser and was seen to refuel the aircraft. From there, the pilot was observed to taxi for departure.

The pilot made routine transmissions to check his radio and on entering the runway to position for take-off. Then, at 1033 Western Standard Time (WST), the pilot transmitted that he was airborne from runway 14, maintaining runway heading to the south-east, intending to make a right turn at 1,500 ft above mean sea level (AMSL) to track to Bunbury and climb to 6,500 ft AMSL. That was the last recorded radio transmission from the pilot.

People who observed the aircraft start, taxi, and take-off did not notice anything abnormal about the aircraft. From aerial photos of coastal scenery around Albany that the pilot sent to an acquaintance and a report from an Albany resident, it appears that the pilot undertook some local flying before departing the area (Figure 2).

A few people between Albany and the accident site area heard an aircraft that could have been VH-DBU, but there was insufficient information to establish the aircraft’s flight path.

The key witnesses were located between 3 km and 5 km from the accident site in the general direction of Albany. Some witnesses related that prior to any apparent problem with the aircraft, the noise from the aircraft was loud and the aircraft seemed to be lower than was usual for aircraft operating in that area. Some witnesses described the noise as indicative of an aircraft manoeuvring.

With regard to weather, the witnesses reported some cloud but generally clear and calm conditions.

The first sign of a problem with the aircraft was a loud and distinctive noise that witnesses described as a sharp bang, crack of a whip, gunshot, and thunder or lightning. Some witnesses associated the noise with the aircraft they had just seen or heard, drawing their attention and prompting them to look for the aircraft.

Only one of the witnesses, located about 4 km from the accident site, saw the aircraft following the sharp noise. That witness recalled the aircraft was in a nose-down vertical descent rotating to the right and the engine noise was rising and falling. The witness watched the aircraft until it disappeared from sight due to terrain and trees. The witness did not recall seeing anything separate from the aircraft, nor did they recall any smoke or vapour coming from the aircraft.

Other witnesses recalled hearing a series of sounds over an extended period following the initial sharp noise. The sounds, over a period of about 10 to 15 seconds, according to one witness, were described as similar to angle grinding or crashing through trees. Other descriptions were chopping, whirring, striking, whining, and high-pitched. One witness also recalled the engine revving during this time. These irregular noises were reported as stopping suddenly, probably upon impact with the terrain. Smoke was observed in the area shortly afterwards.

These events were reported to the authorities and the pilot of a nearby aircraft was diverted to conduct an aerial search. Aircraft wreckage was located in dense bushland within the Mount Lindesay National Park and the deceased pilot was found in the main wreckage.

Figure 2: Accident site and other locations of interest

Source: Google Earth (annotated by the ATSB)

Accident site information

ATSB investigators gained access to the accident site and located wreckage during ground and air searches with the assistance of Western Australia Police and the Parks and Wildlife Service. A subsequent ground search of the accident site by local State Emergency Service personnel located some more pieces of wreckage.

As the pieces were located and identified, their position was recorded on a GPS receiver. Those positions have been referenced to a Google Earth image (Figure 3) and the icons for the pieces coded according to the following:

• Green – Right wing pieces
• Red – Left wing pieces
• Yellow – Fuselage and tailplane
• White – Nil significant and unidentified pieces
• Small – Fragments and smaller pieces
• Large – Significantly sized assemblies.

For ease of reference and interpretation, three zones were delineated and named according to likely chronology of events from A to C.

Figure 3: Wreckage plot

Source: Google Earth (annotated by the ATSB). Please note that the cleared areas evident near zone C were established in response to the accident.

From examination of the aircraft wreckage at the accident site and interpretation of the wreckage plot, the ATSB has made the following observations about the disposition of the wreckage:

• most but not all of the aircraft parts have been identified and these were found within an area of about 700 m long and 250 m wide that was oriented in a south-westerly direction
• not accounted for are the right cabin door and small sections of the right wing (areas identified in Figure 7)
• the main wreckage, that included the fuselage, engine and propeller, was severely affected by fire (Figure 4)
• the left wing (Figure 5), inboard right wing (Figure 6), tailplane, and fuselage (main wreckage) were grouped in zone C but not structurally contiguous, which is consistent with an in-flight break-up
• the items furthest from the main wreckage were pieces of right wing skin and rear fuselage skin (zone A)
• many of the major parts of the aircraft had been damaged in-flight and during the ground impact
• the right wing outboard of the fuel tank had fragmented in-flight (Figure 6).

Figure 4: Fuselage viewed from front to rear

Source: ATSB

Figure 5: Left wing in as found position

Source: ATSB

Figure 6: Right wing inboard section in as found position (zone C)

Source: ATSB

Wreckage examination

The ATSB recovered the wing, tailplane, and selected fuselage pieces and moved them to a secure storage location for further examination. With the parts loosely reassembled (Figure 7), the ATSB mapped the damage and inspected the fracture surfaces in context. The ATSB summarises the results of that process in the dot points following.

Overall:

• no signs of pre-existing material deficiencies such as corrosion or metal fatigue
• all fractures were consistent with over-stress of the material
• all flight controls were connected or disrupted during the break-up.

The left wing was mostly intact but exhibited the following characteristics:

• separation of the outboard leading edge skin, outboard aileron section and wing tip fairing
• a downward bend near the wing strut attachment and general nose-up twisting of the outboard section. Some distortion was related to post-break-up impact with vegetation and the ground
• overload failure of the wing-fuselage attachments.

The right wing exhibited the following characteristics:

• significant fragmentation and distortion with two primary fracture lines in front to rear orientation
• bending in multiple directions with some torsional effects
• overload failure of the wing-fuselage attachments.

The tail section separated from the rear fuselage as a mostly intact assembly bending in multiple directions; with some distortion related to contact with another object—probably from the right wing.

Figure 7: Wreckage loosely reassembled at storage facility

Source: ATSB

To characterise the break-up sequence, the ATSB considered the observations derived from examination of the wreckage and the disposition of the wreckage at the accident site. Due to the wreckage fragmentation and complexity of wreckage indications, this analysis was constrained.

The ATSB was able to establish that the break-up occurred rapidly with high stresses generated over a large area of the aircraft. The break-up sequence likely began with separation of the right-wing tip and progressed inboard, with some fragments striking the tail section. As the right wing broke up, it was subject to a high level of torsion and reverse—both upward and downward—bending. There was no evidence that the un-located right door and right-wing parts had any primary role in the break-up.

The ATSB notes that the orientation of the wreckage trail on a south-westerly heading was about 90 degrees to the nominal north-westerly track to Bunbury. This was not necessarily significant as the pilot’s intentions and aircraft track immediately before the break-up are unknown and the trajectory of the aircraft during and after the break-up would be unpredictable.

Context

Aircraft information

Cessna 210B design characteristics

The Cessna 210 is a single-engine high-wing aircraft with retractable landing gear. In the earliest models of the aircraft, including the B model manufactured in 1962, the Cessna Aircraft Company^[1] designed and built 210s with strut-braced wings and with ailerons that were comparatively longer in span than the flaps.

Changes introduced (after the manufacture of VH-DBU) for the D model produced in 1964 included a redesign of the wing structure. Although strut-bracing was retained, Cessna changed the type of aileron control surfaces so that the ailerons were comparatively shorter in span and the flaps were correspondingly longer in span. Then, in the G model produced in 1967, Cessna introduced a new cantilever wing design that removed the strut-bracing. This configuration was retained for subsequent models.

The Cessna 210B was certified as a normal category aircraft and was not approved for acrobatics (aerobatics) or spins. The specified limits included:

These airspeed limitations are defined as calibrated airspeeds (CAS) in the Cessna 210B Owner’s Manual. In general, the CAS of a Cessna 210B corresponds closely to the airspeed indicator readings (IAS).^[3] The IAS at any particular point in a flight will vary according to selected engine power, aircraft angle of attack, aircraft configuration, and environmental conditions.

In the Owner’s Manual, manoeuvring speed was described as the maximum airspeed at which abrupt control travel can be used without exceeding the design load factor. The ATSB estimated that the aircraft weight was about 200 kg below the maximum take-off weight (MTOW) of 1,361 kg. At weights below MTOW, the effective Va will be marginally less than the specified limit.

Load factors are defined in terms of G loading, which is a measure of the forces acting on the aircraft structure to produce the accelerations involved in changing speed and direction in flight. One-G is the loading on the aircraft structure in un-accelerated straight and level flight produced by the lift force needed to balance the gravitational force, or the weight of the aircraft.

Given the potential relevance of IAS, the ATSB sought to establish some reference points. In the Owner’s Manual, the top (cruise) speed at sea level was specified as 198 mph (172 kt) and maximum cruise speed at 7,000 ft specified as 189 mph (164 kt). These speeds are true airspeeds (TAS) that correspond to IAS values that diminish as air density reduces with elevation in altitude and/or temperature. For example, a true airspeed of 164 kt at 7,000 ft above mean sea level (AMSL) at a temperature of 10 degrees above standard corresponds to an IAS of 145 kt.

History of VH-DBU pre-2012

The aircraft was registered in Australia as VH-DBU in July 1962. In the first decade of operation, there were no reports of any serious incidents or accidents until the end of that period.

The ATSB database recorded that on 31 March 1972, the aircraft was overstressed when a non-instrument rated pilot became disoriented in cloud near Moruya, New South Wales (NSW). According to the aircraft history file held by the Civil Aviation Safety Authority (CASA), the upper surfaces of both wings sustained stress deformation. Both wings were removed for repair and the aircraft was returned to service later that year.

Details about the wing repair were not available as the original aircraft logbook that would have contained the applicable certifications was reported as lost in the mail in early 1973. The extant aircraft logbook recorded maintenance from December 1972 onwards, when the aircraft total time in service was recorded as 3,800 hours.

During a flight on 26 March 1983, the main landing gear did not extend fully. On landing at Canberra, Australian Capital Territory, the main landing gear folded up completely with consequent damage to the lower surface of the fuselage, landing gear doors, and tailplane. That damage was repaired and other work carried out to both wings before the aircraft was returned to service on 29 July 1983 (aircraft total time in service recorded as 5,708 hours).

The only other recorded incident or accident of any significance was a propeller strike during taxi on 11 December 2004. The engine and propeller were overhauled and the aircraft returned to service on 20 May 2005 (aircraft total time in service recorded as 8,988 hours).

In general, certifications in the aircraft logbook indicated a pattern of periodic and major inspections, including compliance with airworthiness directives and rectification of defects. This was consistent with the maintenance regulations prevailing at the time and with the age and total time in service of the aircraft. It was noted that there was no maintenance recorded in 2006, 2008, 2009, and 2012, which indicates that the aircraft was not operated for some or all of that time.

History of VH-DBU from 2012 onwards

In February 2012, the aircraft was registered to a company owned by the pilot involved in this accident. As the registration holder, the company was required to manage the airworthiness of VH-DBU, which included ensuring that suitably qualified personnel carried out the required maintenance in accordance with approved data (instructions for continuing airworthiness).

The aircraft was initially based in NSW and operated by the new owner, and flown by other pilots in 2012. Other than a landing gear problem that was resolved before landing at Albury there were no reports of any defects or anomalies.

During 2013, the owner-pilot operated the aircraft on a number of flights and there were two periodic inspections carried out. By the end of 2013, the pilot had transferred the aircraft to Albany, Western Australia (WA).

There is no record of the aircraft being operated in 2014 or in 2015 up to December of that year. It was reported that during this period the owner paint-stripped the aircraft and made minor cosmetic repairs.

Cessna have developed a program of Supplemental Inspection Documents (SIDs) to ensure that any damage or defect related to time in service from fatigue, overload, or corrosion is found and rectified. The focus of the SIDs was on principal structural elements and control systems including the wings, wing/strut attachment fittings, and aileron mechanisms. In the 29 supplemental inspections for the Model 200 Series (1960-1965), Cessna specified removal of access panels, fairings, or interior linings and visual inspection of the applicable area. If anomalies were identified and/or aircraft hours exceeded a threshold figure (in some cases 12,000 hours), the applicable area was subject to detailed inspection that could involve disassembly and specialised non-destructive inspection techniques.

CASA ruled that, irrespective of the nominated maintenance schedule, all 200 series aircraft, including the Cessna 210B, were required to be compliant with the applicable SIDs by 31 March 2016.

At the request of the owner, on 14 December 2015, CASA issued a special flight permit for a single flight from Albany, WA to Manjimup, WA, to allow maintenance to be conducted.

On arrival in Manjimup, the aircraft was withdrawn from service for a periodic inspection and compliance with the Cessna SIDs. The ATSB reviewed the aircraft logbooks and maintenance worksheets, which recorded that a CASA-approved maintenance organisation carried out the applicable elements of the CASA maintenance schedule and complied with applicable airworthiness directives and service bulletins.

The approved maintenance organisation recorded compliance with the applicable SIDs in their maintenance worksheets and in the aircraft logbook. These records showed that no significant defects were identified and no specialised non-destructive inspections were carried out. Final certification as to coordination of maintenance was carried out on 20 May 2017 and a maintenance release valid for 12 months or 100 hours of operation was issued for the aircraft. At this time, the aircraft total time in service was recorded as 9,380 hours.

No further maintenance was recorded in the aircraft logbook and the current maintenance release was not recovered. At the time of the accident, the aircraft was within the calendar-time and probably within the time-in-service validity periods of the maintenance release. It is not known if there were any defects endorsed on the maintenance release but no one reported that the pilot had any concerns about the serviceability of the aircraft.

Following the maintenance, the owner-pilot flew the aircraft to a private airstrip east of Perth for it to be painted. The spray painter advised that aviation products were used and the only disassembly carried out during the process was removal of some access panels and fairings for painting. The flight control surfaces were reportedly not painted or otherwise disturbed. Although there were no logbook certifications for the maintenance activities of paint-stripping and repainting, the ATSB considered there was a low risk that those processes had any adverse effect on the continuing airworthiness of the aircraft.

CASA participated in the examination of the aircraft wreckage and reviewed the maintenance records to assess the implications, if any, of this accident for the continuing airworthiness status of the aircraft type and ageing aircraft in general. No concerns were reported to the ATSB.

The ATSB reviewed the records of routine CASA surveillance of the approved maintenance organisation that carried out the recent periodic inspection and SIDs. In the two audits carried out in the 5 years preceding the accident, CASA auditors identified some non-conformances in the control of tooling, storage of aircraft parts, in‑progress tracking of maintenance tasks, and certification protocols. Based on advice and evidence of corrective action, CASA acquitted the non-conformances.

In periodic assessments of the performance of the approved maintenance organisation, CASA did not identify any significant risks. For the type of maintenance carried out on VH-DBU, the ATSB considered there was a low risk that the process conformance deficiencies identified by CASA auditors had any adverse effect on the continuing airworthiness of that aircraft.

Pilot information

The pilot had held a Commercial Pilot (Aeroplane) Licence since 1997. Between January 2002 and November 2003, the pilot operated a Cessna 206 aircraft for a charter company operating in north Queensland. During that period, in May 2003, the pilot qualified for an Instrument Flight Rating applicable to single engine aircraft.

From December 2004 to March 2006, the pilot was engaged in training for aerial agricultural operations and gaining related experience. In March 2006, the pilot added an Agricultural Pilot (Aeroplane) Rating to his licence. After two years of operating piston-engine agricultural aircraft, he progressively gained endorsements on turbine-powered agricultural aircraft. In July 2011, the pilot qualified for a Class 1 Agricultural Pilot Rating and aerial firefighting approval.

Since October 2013, the pilot had been employed on a seasonal basis as a firefighting pilot based at Albany. Each year the pilot completed a pre-season proficiency check with an aerial firefighting operator. This satisfied the requirement for a flight review.

After the 2016-17 firefighting season ended in March 2017, the pilot provided contract flying services to two aerial agricultural operators. The pilot completed employment with one of those operators as pre-arranged the day before the accident.

At the time of the accident, the pilot held a pilot’s licence issued in accordance with Part 61 of the Civil Aviation Safety Regulations 1998. This licence included class ratings for single and multi-engine aircraft and design feature endorsements such as manual propeller control and retractable undercarriage. As such, the pilot was qualified to operate the Cessna 210B.

The pilot’s logbook for the period after 30 January 2012 was not recovered; however, based on CASA and operator records, the ATSB estimated that the pilot’s total aeronautical experience was 6,500 hours, of which 4,200 hours was aerial application.

A search of the ATSB occurrence database did not identify any other occurrences involving the pilot. From other sources, there was a report that the pilot experienced a birdstrike in July 2014 with minor facial injuries and no ongoing health effects. There was also report of a wirestrike in 2010 but no details were available.

The pilot held an aviation medical certificate with Class 1 validity until 16 December 2017. Further information about aviation medical examinations is in a following section.

A general practitioner (GP) reported that while he had not been involved in the pilot’s medical care, the pilot’s family had a history of coronary and cerebro vascular disease with associated events suffered by two close relatives when they were in their sixties. In at least one of those cases, there were no preceding symptoms or events. In addition, a family member advised the GP that the pilot was a long-term smoker and had a poor diet with a high intake of ‘fast food’.

According to the GP:

… given [the pilot’s] significant family history combined with his lifestyle risk factors, the probability of sudden cardiac event leading to in-flight collapse/death resulting in loss of control of the aircraft with the subsequent crash would be within the realm of reasonable possibility.

While the GP suggested the potential for a medical condition, there was no direct evidence that the 40-year-old pilot had been diagnosed with any significant medical condition or had been taking any prescribed medication. No one reported that the pilot was showing signs of ill-health before the accident.

Post mortem examination and toxicology analysis

Toxicology results

Forensic pathologists carried out a post mortem examination at the direction of the coroner. The findings of their report were consistent with injuries characteristic of an aircraft accident. The examiners found no evidence of significant underlying natural disease.

A NATA-accredited^[4] forensic science laboratory also carried out a toxicological examination. It was not possible to conduct screening analysis of blood samples. Analysis of liver samples was possible for some substances and this detected a significant concentration of methylamphetamine and a lower concentration of amphetamine. The toxicology report noted that the sample was in an advanced state of decomposition and that interpretation of results must be made in the context of the entire case details.

Methylamphetamine, commonly known as ‘ice’, is a highly addictive central nervous system stimulant that is administered most commonly by smoking, but may also be administered orally and by intravenous injection. People who use the drug in large doses or frequently, almost always administer it intravenously or by smoking.

Amphetamine is a metabolite of methylamphetamine, and is commonly found in the body when methylamphetamine is present. It has effects similar to methylamphetamine but is less potent.

In Australia, methylamphetamine is not prescribed for pharmaceutical purposes and is only available as an illicit drug. There is no evidence that methylamphetamine is produced naturally in the human body by any biochemical processes (ante or post mortem), and few prescription drugs are known to metabolise to methylamphetamine. In this case, there was no recorded medical evidence that the pilot was taking any prescribed medication, and therefore no legitimate (non-illicit) source for the methylamphetamine.

There was insufficient information for the ATSB to establish the method or timing of administration of methylamphetamine. In the case of intravenous administration, the peak effects occur within a few minutes. When methylamphetamine is smoked or taken orally, the drug is absorbed into the blood and the concentration will gradually rise until a peak concentration is reached after approximately 2.5 to 3 hours. After reaching the peak, the concentration will gradually decline. The decline rate is highly variable between individuals, but the average half-life^[5] is approximately 10 hours.

Methylamphetamine and amphetamine concentrations can vary significantly between individuals and studies show a substantial overlap in methylamphetamine concentration between drug-caused deaths (due to the direct toxic effects of the drug) and drug-related deaths (present but not considered the direct cause – recreational use).^[6] Similarly, the effect on individuals and the duration of those effects can vary significantly, the latter usually over 4-6 hours but may last somewhat longer if administered by smoking or orally.

Analysis of toxicology results

The toxicology results indicated a significant concentration of methylamphetamine and amphetamine in a liver sample showing an advanced state of decomposition.

The ATSB sought the assistance of the Bioaeronautical Sciences Research Branch of the Civil Aerospace Medical Institute within the US Federal Aviation Administration (FAA) to review the methodology and results of the liver tissue toxicology. The FAA expert toxicologist advised that:

• the reported methodology produces a low risk of false positive results
• the presence of methylamphetamine and amphetamine (as metabolite) at their respective concentrations are consistent with the expected ratios
• the concentrations may be falsely elevated by evaporation of tissue fluids due to the fire (post-impact) and decomposition/dehydration of the liver (post mortem)
• the interpretation of effects on an individual at a particular time is not possible from tissue concentrations
• the individual was exposed to the compound.

The ATSB noted the toxicologist advice that drug concentrations may undergo post-mortem changes and interpretation of individual effects during a specific time period was not possible. Nevertheless, since the toxicology review advised that the individual was exposed to the compound, the ATSB considered that there would be a safety investigation benefit to further explore the potential effects on the performance of the pilot.

For this assessment, the ATSB engaged a consultant with a PhD in Psychology and post-doctoral training in pharmacology. The consultant had extensive experience in the treatment of alcohol and drug problems and contributed to publications on topics including the effects of drugs on the brain and behaviour, role of alcohol and drugs in road accidents, and psychopharmacology. This assessment was peer reviewed by two independent consultants specialising in forensic pathology and aviation medicine.

Based on empirical data and the toxicology report, the consultant advised it was reasonable to conclude that at the time of the accident, the concentration of methylamphetamine was at least sufficiently high for the pilot to have been significantly affected by the drug. It is possible that the pilot was very markedly affected and there was potential for lethal effects of the drug, most commonly as a result of effects on cardiac function.

Both the aviation medical specialist and the forensic pathologist agreed that the detected presence of methamphetamine and amphetamine were likely to have significantly affected the performance of the pilot.

Aviation safety considerations

Research^[7] has found that methylamphetamine can have a significant adverse effect on the user. However, the range of dosage and the corresponding effect can vary significantly between individuals. Nonetheless, it is recognised that no dose is considered safe in an aviation context.

From a safety education perspective, the effects can be increased heart rate and subjective feelings of methylamphetamine intoxication. Exaggerated confidence may be associated with risky, impulsive or reckless behaviour as well as impairment of cognitive function. The ability to concentrate on the operation of an aircraft can be impaired and there is a risk of experiencing psychotic symptoms, particularly paranoia. At relatively high concentrations, there is some risk of death due to the cardiac effects of methylamphetamine.

Management of alcohol and other drugs risk in aviation

Introduction

A key objective of ATSB occurrence investigations is to identify the occurrence events, actions, and local conditions that increased risk and those that contributed to the incident/accident. In more complex investigations, the ATSB will also review the risk controls and organisational influences that relate to identified safety factors and are expected to reduce the likelihood or consequences of those factors.

Given the toxicology result and pilot engagement in commercial operations, the ATSB reviewed the alcohol and other drugs risk controls in the aviation industry. The ATSB also sought to inform pilots of the means available to seek treatment and return to flying. Following is an outline of the main elements of the applicable risk control framework.

Regulatory framework

From a regulatory perspective, the risk of alcohol and other drugs in civil aviation was managed through Civil Aviation Safety Regulation (1998) Part 99 (CASR Part 99). This required certain organisations to implement drug and alcohol management plans (DAMPs) covering their personnel, including contractors, who performed safety sensitive aviation activities (SSAA). It also established a program for CASA to conduct no-notice (also known as random) testing for alcohol and other drugs (AOD).

Another regulatory provision that addressed the risk of alcohol and other drugs was Civil Aviation Safety Regulation Part 67 (CASR Part 67). This prescribed the requirements for medical certification of personnel including the appointment of Designated Aviation Medical Examiners (DAMEs) and standards for issue of medical certificates.

Drug and alcohol management plans

For organisations required to have a DAMP, the regulations stipulated that the plan include the following programs:

• drug and alcohol education – initial then refresher every 30 months, satisfied in some cases by CASA eLearning online course
• drug and alcohol testing
• drug and alcohol response – following a non-negative drug test result.

With regard to the testing program, the regulations stipulated that personnel be tested prior to conducting SSAA for the organisation and in the following circumstances:

• after an accident or serious incident involving personnel performing a SSAA
• if the organisation’s DAMP supervisor has reasonable grounds to believe that personnel performing SSAA may be affected by a testable drug or alcohol
• if personnel that would be performing SSAA return to work after a period of exclusion from SSAA due to testable drug use.

Although the regulations specified that DAMP organisations submit a bi-annual report, a post‑implementation review found that the initial data set was incomplete or inconsistent and the cost to DAMP organisations and CASA was not warranted. Consequently, CASA issued successive exemptions that removed the reporting requirement.

Drug and alcohol management plans – related operation

In the 12 months preceding the accident, the pilot contracted to three aerial application operators at different times. As holders of an Air Operators Certificate, each operator had implemented a DAMP that applied to the pilot who was performing SSAA on behalf of the operator. The following is a summary of the pilot’s interaction with each DAMP.

Operator A: The pilot had been employed as a contractor in previous seasons and received AOD education and testing when the pilot was inducted in 2013. Those test results were negative. In subsequent seasons, the operator repeated the AOD education without further AOD testing, consistent with the operator’s DAMP. The operator recalled that the pilot had been tested for drugs in a previous season (possibly 2015) due to a report that the pilot might have been so affected. Those test results were negative and no further action was taken or required.

Operator B: The pilot was a new contractor. The operator arranged AOD testing in June 2017 when the pilot was inducted. Those test results were negative. The operator did not establish the pilot’s history of AOD education and none was arranged. The operator provided records of employee AOD education and testing provided to employees.

Operator C: The pilot was a new contractor. The operator did not establish the pilot’s history of AOD education, or arrange for AOD testing that was required by operator’s DAMP. This was reportedly due to logistical constraints that also applied to other new pilots that season.

The ATSB noted that, consistent with CASR Part 99, the operator DAMPs did not require regular or no-notice/random AOD testing.

Alcohol and other drugs education

The online course provided by CASA for personnel performing SSAA described the effects of alcohol and other drugs, outlined the operation of DAMPs, and advised of CASA testing. It was noted that amphetamines were addressed as a substance within the group of stimulants. The risk of stimulants as a group was summarised as impairment of attention and increased risk taking.

The course material relating to DAMPs was consistent with the regulations and the guidance provided by CASA. It was clear that if DAMP-related testing or CASA no-notice testing produced a non-negative result, the consequences included an immediate stop to SSAA activities and initiation of a strict legal process with limited choices. Alternatively, if someone self-referred and sought help, there was more opportunity for the individual to choose from support and assistance programs. These included public and private health drug and alcohol treatment centres, mental health organisations, the CASA wellbeing webpage, and employee assistance programs.

In response to a request from the ATSB, CASA advised that the pilot had a user account for the CASA Learning Management System but there was no record of the pilot having completed the online AOD/DAMP course. This was qualified by CASA with advice that the third-party provider who hosted the training prior to 2014 did not have any records of completion.

Operator A provided AOD education to pilots during induction in 2013. The course material provided to the ATSB was comprehensive and clear about the AOD testing that would be carried out with serious consequences of a non-negative result. The ATSB noted that the course communicated a zero-tolerance approach and did not provide any guidance about self-referral for treatment or provision of support services.

As adopters of the CASA micro-business DAMP, operators B and C referred employees to the CASA on-line AOD course.

Alcohol and Other Drugs testing by CASA

The ATSB obtained data from CASA regarding no-notice testing carried out in 2015, 2016, and 2017. This data is presented in Table 1.

Table 1: CASA no-notice testing in 2015, 2016, and 2017

Similar drug use levels have been observed in other aviation jurisdictions. In a study published in 2011, it was reported that the US Federal Aviation Administration (FAA) conducted 1.13 million random drug tests between 1995 and 2005.^[8] The FAA found a prevalence rate of drug violations of between 0.61 and 0.65 per cent, and a prevalence of drug violations in flight crew members of 0.05 per cent (position-specific figures limited to 2003–2005). The FAA found that between 1995 and 2005, amphetamine-type drug violations as a proportion of all drug violations increased from 3.4 per cent to 10.3 per cent.

Of note, the FAA data only cover employees of major airlines, commuter air carriers and air taxis, and do not cover individuals engaged in general aviation. The authors of the FAA study note that:

Given the differences in demographic characteristics, flight environments, and regulations between commercial aviation and general aviation, (this research is) unlikely to be applicable to private flights.

Aviation medical certification

In all three aviation medical standards specified in CASR Part 67, the following behavioural characteristic applied: ‘does not engage in any problematic use of substances.’ If there was personal history of such use, the requirements extended to certification of abstinence, no ongoing safety‑relevant effects, and evidence of successful therapy.

It was a requirement that the holder of a class 1 medical certificate and a commercial pilot’s licence tell CASA or a DAME about a medically significant condition that continued for longer than 7 days and impaired their ability to perform the actions authorised by the licence. As defined by CASA, drug addiction and drug dependence were medically significant conditions. CASA did not have any record of a report from the pilot about any medically significant conditions.

Since 1996, the pilot had been subject to regular medical examinations by a DAME and these were conducted annually from 2002. The questionnaire part of the examination includes questions relating to mental health problems and use of alcohol and drugs. In all but one of those examinations, the pilot’s responses are recorded as ‘no’. The exception was in November 2015 when the pilot disclosed an event in 2010 of driving with a low-range blood alcohol content.^[9] The DAME was also required in each examination to assess if there was any clinical evidence of alcohol, drug or other substance abuse. In each case the DAME response was ‘no’.

CASA advised the ATSB that due to variations between the old paper question-set and old medical records system questions-set, non-disclosures were difficult to notice. With the release of the new medical records system in March 2016, these are easier to note and act upon. At the time of the medical records assessment in 2015, the disclosure of the 2010 event was not noted as a previous non-disclosure.

If there are indications of problematic use of alcohol or other drugs by a certificate applicant or holder, CASA will request further information that may include alcohol and drug testing. For confirmed cases, CASA will suspend the certificate until the applicant or holder can demonstrate that they meet the relevant medical standard. CASA advised the ATSB that this process to address suspected or confirmed problematic AOD use was applied to 691 individuals during the period 2015-2017. Of that group, 576 individuals were subsequently issued with a certificate and 115 individuals withdrew their application or were refused a certificate. On average, CASA issues about 42,000 aviation medical certificates per year.

Industry association

The Aerial Application Association of Australia (AAAA) advised that information related to AOD risk management was integrated into a number of resources currently provided to members. This included guidance about general health and alcohol risks for pilots. Alcohol risk was also addressed in a course for chief pilots that was pending CASA approval. The AAAA did not have data related to problematic AOD use by personnel in their industry sector and were under no obligation to gather such data.

Self-referral and support services

In addition to the regulatory provisions of CASR 67 and CASR 99, CASA promoted the wellbeing of pilots on their website. The stated CASA approach was to encourage an environment of trust where pilots feel comfortable reporting any wellbeing issues, so they can receive the help and support they need to continue with their aviation career. In addition to the supports referenced in the on-line AOD course, CASA referred to an external organisation, the Human Intervention Motivation Study (HIMS), which provides peer support to pilots.

HIMS is a structured peer support and accountability process to assist pilots diagnosed with a substance use problem, to navigate the treatment and monitoring requirements. It is modelled on well-established overseas programs that have assisted 6,000 pilots return to work in the US over a 40-year period. Note that HIMS is not a regulatory process or recovery program.

Although the number of pilots that have self-referred to HIMS Australia is relatively small (less than 20), all of those were assisted by pilots within the HIMS network to satisfy the medical standards for return to work. Some of the pilots involved were general aviation pilots. HIMS Australia expects that the long-term success rate for self-referrals and assistance from HIMS will be similar to the US, which is 90 per cent.

Other occurrences and reviews

In-flight break-up

The ATSB identified four other in-flight break-ups involving Cessna 210 series aircraft in Australia. All four break-ups were to cantilever (no strut) wing models (unlike the 210B model) and three of those were associated with severe weather, including an in-flight break-up near Darwin on 23 October 2017, the day before this accident.^[10]

An in-flight break-up not involving severe weather occurred to Cessna 210L, VH-DJT, 26 km east-south-east of Cloncurry, Queensland, on 11 June 1976.^[11] The investigation carried out by a predecessor to the ATSB found that the left wing failed as a result of torsional loading in excess of design limits. That torsional overload resulted from rapid application of a large amount of right-wing-down aileron control when the aircraft was flying at a speed considerably greater than the specified manoeuvring speed. A reason for the critical aileron input was not determined but consideration was given to pilot incapacitation and potential for a birdstrike.

A search of the ATSB database for in-flight break-ups of any aircraft type since 1969 identified 15 occurrences involving certified aeroplanes, including the four involving Cessna 210 aircraft.

• Eight were associated with severe weather or non-visual meteorological conditions.
• Another three were attributed to structural deficiencies such as metal fatigue.
• In the remaining four, the primary factors were related to aircraft handling or were unverified, including one in which tailplane flutter was a possible factor in the break-up of an ex-military Strikemaster aircraft.^[12]

Alcohol and Other Drugs

In June 2006, the ATSB published Accidents and incidents involving alcohol and drugs in Australian civil aviation 1 January 1975 to 31 March 2006 (B2006/0169). This reported that the prevalence of drug and alcohol accidents was very low in Australian civil aviation. However, the author considered that where alcohol and drugs were reported as being involved, there was a very high chance of an accident, especially a fatal one.^[13] The report anticipated the introduction of a mandatory drug and alcohol-testing program with education and training to reduce the risk of pilots attempting to fly while impaired by alcohol or drugs.

Indirectly relevant to this accident is ATSB study Pilot incapacitation occurrences 2010–2014, published by the ATSB in February 2016. In this study, the ATSB found that there was an average of 23 flight crew incapacitation occurrences per year across the 5-year period 2010–2014, with 25 per cent of these affecting low capacity air transport and general aviation. Although this grouping had fewer occurrences than high capacity air transport, there was a wider variation of causes of incapacitation. In this group there was one incapacitation specifically linked to illicit drugs.

The ATSB conducted a search of the database for occurrences involving alcohol and other drug factors since 1 April 2006. This yielded seven occurrences including four fatal accidents. Some of these were occurrences where a drug/alcohol was in the pilot’s body at the time but may not have played a major or any role in the accident. A summary of these occurrences is provided in the table below.

Table 2: Occurrences since April 2006 where alcohol or drug were present

The ATSB notes that pilots engaged in non-commercial flying are generally not subject to mandatory AOD testing following an aircraft incident or accident (non-fatal). Although pilots are required to report occurrences to the ATSB, there was no assurance that pilots would include details of any problematic AOD use in their reporting.

To qualify further the ATSB occurrence data, there was no requirement for DAMP organisations to report the results of post incident or accident AOD testing to the ATSB unless it was specifically requested in accordance with the Transport Safety Investigation Act 2003.

It is probable that AOD use by flight crew involved in incidents and non-fatal accidents was under-reported to the ATSB.

__________

1. The Type Certificate Holder transferred from the Cessna Aircraft Company to Textron Aviation Inc. on 29 July 2015. All of the actions and data relating to the aircraft manufacturer in the report pre-dates the transfer.
2. When the C210B was manufactured in 1962, the Cessna Aircraft Company specified speed in (statute) miles per hour (mph). For operation of the aircraft in Australia, the airspeed indicator was modified to indicate knots (kt), which is nautical miles per hour. The placards on the instrument panel and extant documentation produced by Cessna were unmodified.
3. The airspeed parameters specified as calibrated airspeeds (CAS) are accurate values derived during the aircraft certification process using specialised equipment. On production aircraft, there are known variations between CAS and IAS associated with the position of the sensing devices and calibration of the airspeed indicator instrument. For the Cessna 210B, there was minor variation between CAS and IAS except when flap was extended and at low airspeeds.
4. National Association of Testing Authorities, Australia.
5. Half-life is the time taken for the concentration to decrease by 50 per cent.
6. Logan, Fligner & Haddix (1998) Cause and manner of death in fatalities involving methamphetamine. Journal of Forensic Sciences 43: 28-34
7. Logan, Fligner & Haddix (1998) Cause and manner of death in fatalities involving methamphetamine. Journal of Forensic Sciences 43: 28-34.
8. Li, Baker, Zhao, Brady, Lang, Rebok and Di Maggio. (2011) Drug violations and aviation accidents: findings from the US mandatory drug testing programs. Addiction. 21: 1287-1292.
9. Low-range blood alcohol content (BAC) is between 0.05 mg/L and 0.079 mg/L of breath.
10. ATSB investigation AO-2017-102 In-flight breakup involving Cessna 210, VH-HWY, 22 km E of Darwin Airport, Northern Territory, on 23 October 2017.
11. Investigation number 197600023 Cessna Aircraft Company 210L, VH-DJT, 26 km ESE of Cloncurry, Queensland, 11 June 1976.
12. Investigation number 200605843 In-flight break-up 20 km NE Bathurst, NSW, 5 October 2006 BAC 167 Strikemaster, VH-AKY.
13. This is probably influenced by under-reporting of alcohol and drugs for incidents, and the more thorough testing for substances in fatal accidents via post-mortem toxicology tests.

Safety analysis

Introduction

It was apparent from the distribution of the aircraft wreckage that the Cessna 210B, registered as VH-DBU, had broken up in flight. From analysis of the available evidence, the ATSB was able to discount a number of potential factors commonly associated with in-flight break-ups. The ATSB identified two safety factors that led to a review of the associated risk controls and a general finding.

In-flight break-up scenarios

Contextual information

In the absence of information about the aircraft flight path immediately before the break-up, the ATSB was reliant on interpretation of the accident site and wreckage characteristics in conjunction with witness information to ascertain the likely sequence of events.

It was apparent that substantial aerodynamic stresses were applied to the aircraft and the break‑up likely started with separation of the right-wing tip and progressed rapidly inboard. As that occurred, the aircraft would have immediately become uncontrollable and that would have generated further abnormal aerodynamic loading with consequent disruption.

The break-up of the right wing was notable in terms of the degree of fragmentation and the high level of torsional and reverse bending. This is not characteristic of a simple overstress situation where the excessive aerodynamic forces on the wings are generally symmetric in direction and magnitude. In that case, if the aircraft breaks up in flight, the sequence typically begins with separation of a substantial piece of each outboard wing. The failure characteristics of both wings is likely to be consistent and further in-flight disruption would be variable but not necessarily extensive.

According to the witnesses, the first indication of something wrong with the aircraft was a loud and distinctive noise described by witnesses as a sharp bang, crack of a whip, gunshot or thunder. This is consistent with a sudden structural failure caused by a high degree of aerodynamic stress, which was probably the initial failure of the right wing. The subsequent period of other noises and the witness observation of the aircraft in a steep dive are consistent with abnormal flight and progressive break-up as a consequence of right-wing failure. Witness information was not instructive as to development of the break-up.

Given the break-up likely started with complex and excessive aerodynamic forces on the right wing, the ATSB considered two scenarios in which a high level of torsional and reverse bending could be generated.

Aeroelastic flutter scenario

Aeroelastic flutter is a high-speed phenomenon involving the oscillation of a structure under the combined influence of aerodynamic, inertial and elastic forces. If unchecked, the structure will be subjected to divergent bending and torsion until the structure is overstressed and breaks up.

Certified aircraft are designed so that flutter will not occur during operation within the approved flight envelope. Based on the margins applied to establish the Vne of 196 kt for the Cessna 210B, the aircraft type was demonstrated to be resistant to flutter at airspeeds up to 218 kt.

If, however, an aircraft does not conform to the design standard, the airspeed at which flutter occurs may be lower than designed. Following are examples of airworthiness deficiencies that may reduce the airspeed at which flutter can occur:

• a reduction in structural stiffness
• unbalanced control surfaces
• incorrect control system cable tensions
• changes in the mass distribution of the wings.

The ATSB found that damage to the primary structure was consistent with aerodynamic loading and that structural integrity was not compromised by material fatigue or corrosion. There was no evidence of any defects, non-conforming repairs, or modifications that would have diminished structural strength. This was consistent with the maintenance records that showed the aircraft had been maintained in accordance with the applicable requirements including the Supplementary Inspection Documents.

Although there was no evidence of any airworthiness deficiencies, the ATSB considered the possibility that the major repairs carried out in 1972 following overstress deformation of the wings subtly affected structural stiffness of the right wing. This could not be discounted, in part because of the lack of maintenance records and fragmentation of the wing. Nevertheless, any alteration to structural stiffness was not considered to be significant, given the aircraft was subsequently operated for 5,500 hours over 45 years, including multiple maintenance inspections, without any apparent related problem. Furthermore, the left wing was repaired at the same time but was not similarly affected.

The fragmentation of the aircraft prevented a conclusive finding regarding the balance-state of the control surfaces and control system cable tensions prior to the break-up. There was nothing to indicate these were non-conforming as the recent aircraft repaint did not include the flight control surfaces and the aircraft had recently been returned to service after extensive inspection.

Another consideration in this scenario was that the abnormally high airspeed required for aeroelastic flutter to occur did not disrupt the left wing to the same degree as the right wing. This was not fully reconciled, but the ATSB considered that subtle differences between the wing shape and structure, and a variation of aerodynamic forces from control inputs and manoeuvring, could account for the observed asymmetry of effect. Additionally, as the right wing broke up, the aerodynamic loading of the left wing would be significantly altered with consequent variation in effect.

Based on analysis of the wreckage and consideration of aerodynamic principles, the ATSB found that aeroelastic flutter scenario was a viable explanation for the complex and excessive aerodynamic forces on the right wing. Given there was no metal fatigue or corrosion and no evidence of any airworthiness deficiency, there were probably no conditions that would lower the resistance of the right wing to flutter. The operational implications of this scenario are considered in a following section.

Aileron input scenario

The other scenario considered by the ATSB—aileron input—was identified as a factor in the Cessna 210L occurrence near Cloncurry in 1976 in which the left wing failed in overload. A direct comparison between the Cloncurry event and this event was not feasible because of limited information and VH‑DBU was fitted with a strut-braced wing that was different in structural configuration and aerodynamic properties to the cantilever wing of the Cessna 210L.

Nevertheless, the same scenario could apply in which the pilot rotates the control column which deflects the ailerons differentially, as designed, to create an upward force on one wing (aileron down) and a corresponding downward, or reduced upward, force on the other wing (aileron up). If the control column is rotated rapidly and to a large degree while the airspeed is above the manoeuvring speed, the aerodynamic loading on the outboard section of the wing influenced by the ailerons can exceed the design strength.

The ATSB considered the capacity of the relatively long span ailerons of Cessna 210B models to generate torsional loading over a larger area of the wing than would be the case for later model 210 aircraft with different wing design. It was noted that one area of disruption of the right wing was roughly coincident with the span of the ailerons, which could be related to aileron input but could also be attributed to the span-wise variation in wing strength and stiffness. Even if the wing design did account in part for the pattern of disruption, there is no evidence that the design did not meet the required standard or was problematic in this occurrence.

Another consideration in this scenario was accounting for the variation in magnitude between right- and left-wing damage. Although aileron deflections are differential, the down-going wing (aileron up) in normal manoeuvring flight results in a reduction of lift whereas the up-going wing (aileron down) results in an increase of lift. This produces higher aerodynamic loading on the up‑going wing, which in this scenario would be the right wing.

A single large aileron input would not produce the reverse bending observed in the wreckage. This may be attributable to multiple reverse control inputs, or complex loading of the wing during the break-up sequence.

Aileron inputs also induce torsional loads in the wing, which due to the differential aileron inputs would be in opposite directions on the left and right wings. There was no clear indications of opposing torsional (twisting) deformation in the wings; however, the magnitude of these loads before failure of the structure may not have been sufficient to have left evidence.

Based on analysis of the wreckage and consideration of aerodynamic principles, the ATSB found that there was not strong evidence for the aileron input scenario but it could not be discounted. The operational implications of this scenario are considered in the next section.

Operational considerations

Contextual information

The pilot’s radio transmission after getting airborne at Albany indicated the pilot would track to the north-west towards Bunbury and climb to a cruising altitude of 6,500 ft above mean sea level (AMSL). If the pilot had departed as indicated, the aircraft would have passed over the area 30 km to the north-west of Albany at around 1045, at or close to 6,500 ft.

This, however, did not occur as the pilot did some flying in the local area and was then observed operating to the north-west of Albany before the in-flight break-up occurred at about 1100. The pilot’s intentions regarding this local flying are not known but the apparent variation to the pilot’s departure broadcast was not necessarily significant for operations outside of controlled airspace.

Aircraft limitations and handling

The Cessna 210B airspeed limitations relate to the aerodynamic forces the aircraft could sustain without structural damage. With regard to the flutter scenario, the key limitation was Vne as any airspeed above that figure reduced the margin to onset of divergent and destructive aeroelastic forces.

For the aileron input scenario, the key limitation was maximum manoeuvring speed (Va). Essentially, if the indicated airspeed (IAS) was above 115 kt and the pilot made abrupt or large control inputs, the consequent aerodynamic forces could exceed the design strength of the aircraft. As the IAS increases, the risk of excessive aerodynamic forces from control inputs increases at a disproportionately higher rate according to the square of the airspeed value.

Based on the likely airworthiness of the aircraft and the absence of any significant weather, it follows that for both scenarios, aeroelastic flutter and aileron input, the aircraft was operated outside of the relevant airspeed or handling limitations up to the point of failure of the right wing. This is analysed in terms of the pilot functioning normally and, in the following section, in terms of pilot impairment or incapacitation.

The pilot was qualified for the flight and was reported to be competent and experienced in the challenging field of aerial application operations. No one reported that the pilot was in the habit of handling aircraft aggressively or was inclined to perform aerobatic-type manoeuvres. There was no apparent reason for the pilot to operate outside of the limitations.

It is possible that the pilot of VH-DBU encountered a large bird in the vicinity of the accident and acted instinctively to avoid a collision with excessive control inputs. The pilot reportedly sustained injuries from a birdstrike in July 2014 and that experience might have influenced the pilot to respond differently to any subsequent bird encounters. There was no evidence that a bird hazard was involved in the accident but the ATSB could not rule it out as a possibility.

Given the pilot operated the C210B in the private category on the basis of a class endorsement and flight reviews in other aircraft types, there were no records relating to pilot awareness and understanding of C210B operating limitations. Nevertheless, it is likely that the experienced commercial pilot was aware of limitations such as the Vne (never exceed airspeed) marked on the airspeed indicator and the Va (manoeuvring airspeed) as specified on an instrument panel placard and defined in the Owner’s Manual.

The ATSB notes that the Va was specified as 132 mph which has equivalent value as an airspeed indication of 115 kt. If the pilot had applied large control inputs on the basis that a safe indicated airspeed for that manoeuvring was 132 kt (rather than 132 mph/115 kt), there would have been increased risk of aircraft overstress at indicated airspeeds above 115 kt. It is likely that the experienced commercial pilot was aware of the variation between the two airspeed units and operated accordingly.

In relation to the pilot’s general awareness, the airspeed limitations of other aircraft types flown by the pilot were similar to or lower than the Cessna 210B’s. The aerial application aircraft flown by the pilot are typically certified in the utility category with higher maximum load factors but the difference and the potential effect was not significant.

Normal category aircraft such as the Cessna 210B are not generally equipped with G indication or warning systems so pilots rely on feedback from the flight control systems and physiological indications to ascertain the approximate load factor exerted on the aircraft. Although these methods are imprecise, in normal circumstances a pilot (and especially an experienced pilot) would be expected to recognise development of an abnormally high load factor as it related to the aircraft as a whole, and respond accordingly.

The situation is more complex in the aileron input scenario because flight load factor is not directly related to torsional loading of the wings. If rapid rolling motion is induced during a high-G manoeuvre to produce additional and imperceptible asymmetric loading known as ‘rolling G’, the pilot may not be aware that the cumulative effect exceeds the maximum load factors.

A key factor in both scenarios is airspeed. In the absence of direct information about airspeed, the ATSB considered the cruise airspeed of 145 kts to be a useful reference point. In normal operation of a Cessna 210B, the indicated airspeed will be above the Va of 115 kt once the aircraft is in cruise or descent.

To exceed the Vne of 196 kt, the aircraft would need to be in a steep descent with substantial engine power. There is no direct evidence of this but there is insufficient information about the flight path and engine power to disqualify it as a possibility.

Based on the information available to the ATSB, there was no evidence of any conditions that would dispose the pilot in normal circumstances to exceed the operational limitations of the aircraft. In this context, the ATSB analysis below considers the abnormal circumstances of pilot impairment or incapacitation.

Pilot incapacitation or impairment

Pilot incapacitation or impairment can occur due to a number of reasons, such as a medical condition or the effects of drugs or alcohol.

The medical history of other family members and the reported lifestyle risk factors indicated to the family GP that a sudden cardiac event was a reasonable possibility. However, the postmortem examination did not identify any cardiac disease and the aviation medical examinations did not detect any cardiac condition that would increase susceptibility to incapacitation due to cardiac arrest. Irrespective of whether the pilot was at elevated risk of a cardiac event, the presence of methylamphetamine in this case increased risk of pilot incapacitation.

Based on expert opinion, the ATSB considered that the concentration of methylamphetamine detected in the liver corresponded to a likely concentration in the blood at the time of the accident that exceeded therapeutic levels.

The effects of methylamphetamine at any particular time will vary according to method and timing of administration, substance amount, individual physiology, and history of use. However, methylamphetamine can significantly impair important cognitive and psychomotor functions necessary for safe operation of an aircraft. In this case, details about administration and dosage were not available.

Although the presence of methylamphetamine in the pilot’s system was established, the lack of information about dosage and variability in the effects of methylamphetamine on individuals prevented the ATSB making a finding as to its influence on this accident.

Nevertheless, the ATSB was not able to discount that the presence of methylamphetamine in the pilot’s system had an adverse effect on the accident and found that it increased the risk of operational misjudgements or mishandling due to impairment and involuntary action or inaction due to incapacitation. Examples of involuntary actions are slumping forward with forward pressure on control column, erratic control inputs, and no control inputs in response to developing loss of control.

Management of alcohol and other drugs in aviation

The ATSB acknowledges the complexities and sensitivities of substance use and considers that deliberation of the pilot’s personal circumstances and motivations would not enhance aviation safety. It should be noted, also, that there is no evidence that the pilot operated any flights, other than the accident flight, while under the influence of alcohol or other drugs.

Although the in-flight break-up occurred during a private flight, the pilot held a commercial pilot's licence with a Class 1 aviation medical certificate and was active in the aerial application industry. As such, the ATSB sought to understand how the risk of substance use was being managed by organisations in relation to the pilot and more generally.

As the aviation safety regulator, the Civil Aviation Safety Authority (CASA) had an important role in managing five key activities:

• oversight of organisations to ensure implementation and compliance of Drug and Alcohol Management Plans (DAMP)
• on-line alcohol and other drug (AOD) education
• no-notice AOD testing across the aviation industry
• certification of pilots and other licence holders according to medical standards
• promotion of flight crew wellbeing, self-referral, and treatment.

Based on the sample of three aerial application operators and this pilot, and on 3 years of no-notice test data, there was evidence that CASA was carrying out the regulatory activities as prescribed. It was beyond the scope of this investigation to establish whether the scope, frequency and implementation of no-notice testing was effective in deterrence and detection of drug use.

In general, the aviation medical certification process was identifying individuals at risk of problematic AOD use and for confirmed cases was preventing further operation until the individual demonstrated ongoing conformance with the medical standard. A relatively large proportion of identified individuals were issued with an aviation medical certificate and there was no data to indicate that the process was ineffective. In relation to this accident, the pilot did not disclose relevant information during annual medical examinations and, when the pilot disclosed a driving under the influence of alcohol offence from a previous period, CASA did not identify this as a risk indicator.

The ATSB observes that as a once a year, or less frequent, snapshot of medical status and with reliance in part on pilot disclosure, the aviation medical certification process has limited opportunities to identify problematic AOD use.

The promotion of wellbeing and facilitation of self-referral plays an important part in reducing the risk posed by alcohol and other drugs. This was a developing area of CASA activity. Outside of the regulatory framework, the aerial application industry association provided guidance about AOD to pilots and operators with an emphasis on the risk of alcohol. This did not extend to advisory information about self-referral or support organisations.

Aircraft operators have an important role in implementing DAMPs, as the three operators that employed the pilot in the 12 months prior to the accident had done. In the five-year period before the accident, the pilot had been AOD-tested three times, each with no detection of alcohol or drugs.

The pilot received AOD education in 2013, which informed that the use of substances such as methamphetamine are not compatible with aviation, and that pilots could be tested at any time. This training explained the serious consequences of non-negative test results, but did not identify that self-referral was an option that allowed for a return to employment. It was reported that this AOD education was repeated in following seasons.

As was the case for CASA no-notice testing, the ATSB notes that there are inherent limitations to induction AOD testing and other DAMP testing in the ongoing detection of problematic AOD use. In the case of pilots employed seasonally and as contractors, sometimes in remote locations, there are relatively less opportunities for operators to educate, test and monitor.

As part of the review of AOD risk controls the ATSB reviewed the following studies and data:

• ATSB study of occurrences involving alcohol and other drugs for period 1969–2006
• ATSB study of data for incapacitation 2010-2014
• CASA no-notice testing data for 2015-2017
• CASA Aviation Medicine data for 2015-2017
• research on no-notice testing by the US FAA from 1995-2005
• Australian aviation occurrence data.

Although infrequent, past occurrences have shown that there is potential for alcohol and other drugs to contribute to accidents either through cognitive impairment or incapacitation.

Overall, these studies and data did not indicate that the use of alcohol and other drugs was problematic across the aviation sector. However, the ATSB study of occurrences involving alcohol and other drugs was completed 12 years ago (before implementation of DAMPs) and situational factors may have changed during the intervening period. There was also no aggregate data about DAMP testing results or self-referrals managed through DAMPs.

In summary, the ATSB found that the required risk controls for problematic AOD use were in place and generally operated in a compliant manner. There was no data that indicated AOD use was a systemic problem within aviation.

Nonetheless, the ATSB considered that there were opportunities for organisations to collect more data and to enhance the extant risk controls for problematic AOD use.

The ATSB acknowledges that self-referral by a pilot with problematic AOD use to a Designated Aviation Medical Examiner (DAME), DAMP, or CASA may be perceived as a threat to ongoing employment in aviation. However, problematic AOD use is a clear threat to aviation safety and self-referral initiates a defined process to counter the hazard while providing an opportunity to return to work with support. In other words, the risks to pilots associated with self-referral are less than the health, safety, and legal risks of continuing to operate with problematic substance use.

A defined protocol exists within the CASA aviation medical framework for pilots in stable remission from the problematic use of substances to return to work. Employer and independent peer support organisations, such as the Human Intervention Motivation Study (HIMS), are becoming more widely available to assist pilots with the safe return to work.

The ATSB acknowledges that CASA is providing information to pilots about the self-referral pathway and suggests that operators and industry associations consider the availability of information and services to pilots and safety sensitive aviation activities within their area of influence.

Findings

From the evidence available, the following findings are made with respect to the in-flight break-up involving a Cessna Aircraft Company C210B, registered VH-DBU, 30 km north-west of Albany, Western Australia on 24 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• For reasons that were not established, abnormal operation of the aircraft produced high levels of unusual aerodynamic loading on the right wing that exceeded the strength of the wing and initiated an in-flight break-up that fatally injured the pilot.

Other factors that increased risk

• The presence of methylamphetamine in the pilot’s system increased the risk of operational misjudgements, aircraft mishandling, and incapacitation.

Other findings

• No structural deficiency or damage that would have contributed to the in-flight break-up were identified and the local meteorological conditions were not conducive to inadvertent overstress.
• The required risk controls for problematic alcohol and other drug (AOD) use were in place and generally operated in a compliant manner. In addition, there was no data that indicated a systemic problem with problematic AOD use in aviation.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Civil Aviation Safety Authority
• Textron Aviation (Type Certificate Holder for Cessna Aircraft)
• Aircraft operators
• Aircraft maintenance organisations
• Expert pharmacologist.

The ATSB acknowledges the support of Western Australia Police in Albany, Parks and Wildlife Service (Department of Biodiversity, Conservation and Attractions) personnel in Albany and Walpole, and State Emergency Service personnel in Albany and Denmark.

References

Li, Baker, Zhao, Brady, Lang, Rebok and Di Maggio. (2011) Drug violations and aviation accidents: findings from the US mandatory drug testing programs. Addiction. 21: 1287-1292.

Logan, Fligner & Haddix (1998) Cause and manner of death in fatalities involving methamphetamine. Journal of Forensic Sciences 43: 28-34.

McIntyre, Hamm & Bader (2011) Postmortem methamphetamine distribution. Journal of Forensic Research 2: 122 doi: 10.4172/2157-7145.1000122

Nagata, Kimura, Hara & Kudo (1990) Methamphetamine and amphetamine concentrations in postmortem rabbit tissues. Forensic Science International, 48:39-47

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority and other organisations that provided input to the report. Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.

General details

Pilot details

Aircraft details

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.