On 3 July 2019, a rolling stock maintenance electrician obtained clearance from the duty controller to enter the west track at the station terminus at Bullocks Flat. The electrician sought to install a missing traction motor cover retaining clip under stationary train Alpha 24. While the electrician was under the platform, he heard the train brakes release and the electrician moved out from under the train before the train moved a short distance. The electrician was not injured.
What the ATSB found
The duty controller granted an electrician access to the west track while the daily 1700 shunt on west track was taking place. It is likely the duty controller did not connect the two activities, the 1700 shunt and the electrician accessing west track, due to other activities occurring at the time, including a visit from an off-duty controller. The Skitube system for managing access to track did not detect the conflict of the rail maintenance worker under the train at the same time the train was being shunted.
The electrician had not applied the required protection flags to the train set to indicate work was being conducted on the train. The system of placing protection flags on both ends of a train set does not isolate energy to ensure a train cannot be moved when it is being worked on.
Elements of the Skitube safety and environment management system are reliant on procedures being followed to manage safety risks. There is little scope for the system to recover when there has been a human error or other procedural error.
The ATSB also found:
The rolling stock return to service authority was ineffective as a control in providing assurance that all required tasks were completed and verified.
The electrician felt an urgency to re-install the missing R-clip with concerns a dislodged inspection cover may lead to an equipment failure from the ingress of foreign material into the traction motor.
What has been done as a result
The temporary track access procedure and form were reviewed, updated and documented. The Skitube train red flag procedure was formalised and documented as a discrete procedure. Including the requirement to lower the pantograph, apply brakes, remove the keys, lock the driver’s cab and place a “Do Not Operate” tag onto all driver’s cabs when a person is required to be in close proximity to a stationary train. The feasibility of a positive lockout within the driver’s cabin that locks the pantograph in the lowered position is being reviewed. This is not a standard mechanism available from the manufacturer and requires re-engineering and completion of a change management process.
The completed changes and other major safety rules and processes were communicated to all staff who were required to demonstrate an understanding of the requirements prior to the 2020 operating season. Further consultation and communication will be undertaken with staff on other changes that are still in progress.
Safety message
Workers must ensure they are protected and follow safety procedures before entering the danger zone or when interacting with trains. Systems should identify when conflicting activities take place that increase the risk to workers. Organisations should assess their risk controls for adequacy in protecting workers, and where required consider additional lines of defence.
The occurrence
On 2 July 2019 a Skitube 2-carriage train set (set 3) was scheduled for service at the Bullock’s Flat maintenance centre. An electrician (electrician 1) conducted the scheduled maintenance requirements on set 3, which would form part of the 4-carriage train, Alpha 24.
Electrician 1 started work on set 3 understanding the train set would re-enter service that afternoon. Nearing completion he was told set 3 would not be returning to service that day.
Electrician 1 completed the remaining tasks and then completed the return to service authority, ticking off all check tasks as complete. Thinking he had completed all tasks successfully, he did not go back under the train set to confirm.
Set 3 was signed off as complete and ready for service at 1515 AEST[1] on 2 July 2019.
On the morning of 3 July 2019 set 3 entered service as part of the 4-carriage train which would subsequently be designated Alpha 24. The train service ran throughout the day without any reported issues.
During end of shift clean-up in the maintenance centre, a maintenance technician found an R-clip on the ground and handed it to the maintenance electrician (electrician 2).
Based on the location it was found on the ground, electrician 2 understood where the R-clip may have come from and knew it to be a securing R-clip of a traction motor inspection cover.
The electrician took immediate action to ensure it was replaced.
Figure 1: R-clip securing traction motor inspection cover
The image shows the traction motor inspection cover secured with the R-clip installed.
Source: Skitube, annotated by OTSI
At 1645 the electrician approached the Skitube duty controller in the Skitube control room and asked that downhill train, Alpha 24, enter the station slowly for an inspection.
At 1652, the electrician requested formal clearance by radio from the duty controller to enter the west track at Bullocks Flat Terminal (BFT) to conduct a roll-by inspection[2] of the approaching passenger train. Alpha 24 was a 4-carriage train made up of two 2-carriage sets coupled together, set 3 (downhill) and set 4 (uphill).
Figure 2: Overhead view of Bullocks Flat Terminal
Approximate location of Alpha 24 (set 3 and 4) when it arrived at Bullocks Flat Terminal.
Source: OTSI
The inspection was carried out from a purpose built inspection pit under the track adjacent to the west platform. The electrician was looking for the location of a missing traction motor inspection cover R-clip, found on the ground in the maintenance area.
The duty controller provided the electrician clearance to enter the west track inspection pit (west pit). The duty controller’s view of the west platform was partially obstructed by train Charlie 25, stationary at the BFT east platform.
At 1653, the electrician asked the duty controller to advise the train driver (driver 1) of Alpha 24 that the electrician would be in the inspection pit and to reduce the train’s speed to under 10 km/h as the train passed over the inspection pit. Shortly after, the duty controller radioed Alpha 24 and requested that the driver “come in slow as people in the pit need to look underneath, no faster than 10km/h”. Driver 1 repeated the details back to the duty controller, confirming the request.
As Alpha 24 crossed number one points on the way into the west platform, driver 1 reduced the train speed to under 10 km/h. The electrician and driver 1 made visual contact and the electrician acknowledged driver 1 with a hand wave as the train approached the pit.
At 1657, another driver (driver 2) entered the duty control room to advise the duty controller he would be assisting driver 1 with uncoupling of Alpha 24 train into set 3 and set 4. This uncoupling procedure regularly occurred around 1700 each day. Driver 2 then walked to, and waited along the middle of the east side of the west platform.
At 1658, driver 1 brought Alpha 24 into the west platform and stopped approximately four metres from the platform dead-end. Driver 1 opened the carriage side doors and the passengers alighted from the train. Shortly after, the electrician advised the duty controller by radio that he was clear of the inspection pit. The duty controller acknowledged the electrician was clear of the pit. The electrician locked the access to the inspection pit and walked to the downhill end of Alpha 24 on the west platform.
At 1659, driver 1 and driver 2 commenced uncoupling Alpha 24, by firstly removing the hi-fog fire suppression system inter-car connector between set 3 and set 4. Driver 2 then entered the driving cab on the uphill end of set 3 and propelled set 3 (first movement) downhill towards the platform dead-end by approximately 50 cm to ensure disengagement of the Scharfenberg type couplers.
Figure 3: Coupling between set 3 and set 4
Hi-fog fire suppression system inter-car connector (A) and Scharfenberg type coupling mechanism (B)
Source: OTSI
Not long after set 3 came to a stand, at 1701:32 the electrician used the radio to request clearance from the duty controller to enter the west track at west platform and the duty controller provided clearance to enter the track.
At 1701:45, the electrician descended the ladder attached to the lead end (downhill) of set 3 and entered the crawl space between the underside of the west platform and set 3.
Moments after, driver 2 walked through the interior of set 3, and at 1701:53, entered the driving cab at the downhill end of the set. Driver 2 then drove set 3 approximately three metres towards the platform dead-end. The electrical pantographs on both sets 3 and 4 were up and in contact with the electrical overhead power supply while on the west track.
Just prior to this second movement of set 3, the electrician had located traction motor three in readiness to replace the missing R-clip. Before replacing the R-clip, the electrician heard the brakes on set 3 release, moved back against the wall under the platform and clear of the train set before it moved. When the train set stopped again, the electrician installed the missing R-clip.
Shortly after, the electrician climbed out from west track and at 1703 advised the duty controller by radio that he had cleared west track from under set 3 and the duty controller acknowledged the clearance.
Following the incident, the electrician approached driver 2 to report that he was under the train set during the second shunting movement. The incident was then reported through the company’s incident reporting system. Driver 2 advised he was not aware anyone was working on the train set.
The Skitube Alpine Railway (Skitube) operates trains between Bullocks Flat Terminal (BFT), off the Alpine Highway near Jindabyne, New South Wales (NSW), and the Perisher and Blue Cow snow-ski fields. The Skitube comprises passenger stations at the BFT and at the Perisher and Blue Cow ski-fields. Additionally, the Skitube has a maintenance facility in a siding near BFT. The rollingstock operates on a rack mechanism to enable the train to negotiate the 1 in 8 ruling grade and the track is a standard gauge configuration.
Operating at capacity, Skitube is capable of carrying up to 4,500 passengers per hour between the three passenger stations. Services run to a schedule during the ski season and typically operates from the June long weekend to the October long weekend, with a peak season from July to September. BFT experiences a morning and afternoon peak period during the ski season in line with skiers heading to and returning from the ski fields.
Passenger carriages
Skitube passenger carriages are wide-body design vehicles and operate in 2 and 4-carriage configurations. The train set will operate with a driving cab at each end to enable the train set to be operated in the opposite direction from a dead-end station.
Alpha 24 consisted of 4-carriages when it arrived at BFT. It was uncoupled into two 2-carriage configurations set 3 and set 4 just prior to the incident.
Figure 4: View from Control room window
Set 3 on west track, east track clear at Bullocks Flat Terminal.
Source: OTSI
Control room
The Control Room is located at BFT on the eastern side of the platform. The duty controller is seated in this room where there is visibility of east and west track. There is limited access to the control room to minimise disruption to the duty controller and to ensure integrity of the control room and the rail system is maintained. No more than three persons may occupy the control room during winter operations. The only staff permitted in the control room, and only whilst conducting Skitube business are; incoming and outgoing duty controllers, Skitube Manager, Assistant Skitube Manager and the Skitube Operations Supervisor. Other staff may enter the control room for work-related purposes at the request of the duty controller. Where possible other staff members should enter the visitors area only, via the terminal entry, not the concourse entry.
Duty controller
The duty controller manages activities on the Skitube by communicating with staff through a discrete two-way radio and by telephone. The duty controller monitors the railway through a network of closed-circuit television (CCTV) cameras. The duty controller also controls the movement of trains by operating signals and points through a supervisory control and data acquisition (SCADA) control system. The duty controller issues and monitors permits to work for those who are required to work in the rail corridor.[3]
The duty controller completed Skitube Duty Controller training and assessed as competent on 31 August 2018. Additionally, he completed a number of units of competency, relevant to his role as duty controller, through the Transport Industry Skills Centre. He was deemed competent in these units on 21 September 2018. The duty controller completed Skitube refresher training for train driver and duty controller and assessed competent on 31 May 2019.
Train driver 1
Train Driver 1 (driver 1) was the driver in control of the downhill train designated Alpha 24. Driver 1 commenced as a seasonal driver in 2006, completed training and assessed competent as a train driver. He worked the 2007 season then took a break and returned to work the 2015 through 2019 seasons. He completed and assessed competent in driver refresher training each year.
Train driver 2
Train Driver 2 (driver 2) was the driver assisting driver 1 to uncouple the Alpha 24 4-carriage set into two, 2-carriage sets. Driver 2 was employed by Skitube in 2003 as a seasonal train driver. Driver 2 was a permanent employee and has held roles as the Head Controller and was Skitube Operations Supervisor at the time of the incident.
Driver 2 completed and was assessed as competent for both train driver and duty controller refresher training on 4 June 2019. Driver 2 was also a qualified trainer and assessor for Skitube train drivers and duty controllers.
Maintenance electricians
The maintenance electrician conducts electrical maintenance on Skitube assets, including rolling stock, in accordance with Perisher Blue standards and procedures. The maintenance electrician will typically conduct rollingstock maintenance at the Bullocks Flat maintenance facility, however, the maintenance staff may carry out tasks at other work locations in accordance with the relevant procedures for that location.
There were two maintenance electricians involved in this incident.
The electrician that conducted the maintenance inspection on set 3 (electrician 1) commenced as an electrician in March 2016. He had certified in Electrotechnology – Systems Electrician from TAFE in 2011. He had also been deemed competent in a number of Skitube competencies, including Locomotive Operation in 2016 and Service and Repair Electric Train in 2017.
The electrician directly involved in this incident (electrician 2) commenced in February 2017. He was a qualified level 4 electrician. He had been trained and deemed competent in the Skitube’s track safety awareness program, track access and track and maintenance lock-out procedures.
Safety and environment management system
Return to service authority
At the completion of a maintenance service on a train set, the maintenance team were required to complete a rolling stock return to service authority. Depending on the type of work completed on the train set, the mechanic or electrician conducting the work was required to initial next to the work item to indicate the work had been completed.
On 2 July 2019, according to the information on the completed return to service authority, set 3 was fit to return to service at 1515. Set 3 had undergone routine mechanical and electrical work. A mechanic and electrician that worked on the set had initialled all tasks on the form, including the check task, ‘All motor covers replaced and secured’. This check task was a single check box to denote all motor covers were replaced and secured. The motor car on set 3 has four traction motors hence four motor covers to replace and secure.
Skitube duty controller’s manual – track access
The Skitube duty controller’s manual requires any person entering within 3 metres of the track (track area) have permission from the Skitube duty controller to access the track area. Additionally, the person must report to the duty controller when clear of the track area. The manual states permission to access the track may be obtained by Skitube radio.
Electrician 2 accessed the track area on two occasions, the first was to get into the west pit and the second was to get access under set 3 to replace the R-clip.
On both occasions, he made contact with the duty controller over Skitube radio and was granted permission by the duty controller prior to accessing the track area.
Skitube duty controller’s manual – protection flag
The Skitube duty controller’s manual outlines the function of the protection flag. The protection flag (red rectangular flag) is to be fitted on the end of trains to indicate the train is defective or someone is working on the train. When the flag is in place it states the action is “do not move the train”.
Electrician 2 did not place protection flags on the train prior to entering the track area below the train. The duty controller had not checked that the electrician had taken the protection flags from the control room.
Figure 5: Example of protection flag on set 3
Source: OTSI
Control room logbook
The duty controller is required to fill in the Control room logbook to provide an account of the activities that occurred throughout the shift. The logbook entries on the 3 July 2019 included the following entries amongst many others;
‘1658 - split 3 & 4 set 3 oos’
‘1702 – EM x 1 BFW under set 3 clear 1703’
The first entry referred to set 3 and set 4 being separated, with set 3 being left out of service (oos).
The second entry referred to one electrical maintenance person (EM x 1) at Bullocks Flat West (BFW) under set 3 and was clear at 1703.
Temporary track access form
The duty controller is required to follow check list, PBPL SEMS 3.6.2 – Temporary track access form before providing clearance for a worker to enter the track.
There is no reference to this form in the Skitube duty controller’s manual. Use of the form is included in duty controller training. It is not included in duty controller refresher training or assessment.
The form had been set up to provide the duty controller a set of logic gates which would aid the decision of whether track access should be granted or not.
On the day, the duty controller granted access and recorded the electrician accessing the track under set 3 at 1702 and clearing the train at 1703.
Skitube train driver’s manual – multiple unit operations
This Skitube train driver’s manual outlines the procedure to uncouple a train. The instructions in the document refer to the specifics of coupling and uncoupling the train sets only. It does not cover the requirements for the driver to notify the duty controller that uncoupling is going to take place.
Uncoupling the carriage sets was a routine task that occurred at approximately 1700 hours each day. It enabled the uphill two-carriage set to complete a return run to Perisher and Blue Cow Terminals to pick up and return staff finishing work on the mountain and to pick up rubbish from the resorts accumulated throughout the day.
When train set 3 was deemed fit to return to service at 1515 hours on 2 July 2019, the return to service authority had been completed by a Skitube maintenance mechanic and maintenance electrician (electrician 1). They were also the maintenance staff that completed the maintenance tasks on the train set.
The rolling stock return to service authority indicated all return checks had been completed and it was ready to return to service.
It is likely set 3 operated throughout the day on the 3 July 2019 without the R-clip securing the motor cover, the R-clip was found in the maintenance pit by one of the maintenance technicians during clean-up near the end of the day.
Electrician 1 had worked on the train set on the 2 July 2019 and was responsible for completing the maintenance work and completing the return to service authority, including securing the traction motor inspection covers.
In electrician 1’s statement, the electrician said,
I needed to complete this work quickly as the train was required to be put back in service.
On completion of the electrical work under the train, electrician 1 moved onto working on the pantographs (on top of the train) and on completion filled in the return to service authority. Electrician 1 stated,
I did not re-enter under the train to complete a check as I believed I had completed all the work as I moved through.
The risks of using checklists for maintenance tasks has been reviewed in past research. Pearl and Drury[4] identified,
Checklists… aid the mechanic in recalling all the numerous tasks to be performed in the check. As the worker performs these tasks repeatedly, there is a tendency to perform them partially from memory, with a block of sign offs made at a convenient time. This is not how workcards [checklists] are intended to be used, and as such use can result in errors.
The return to service authority was used in the manner described by Pearl and Drury. The task of ensuring a securing R-clip had been replaced was not checked at the same time the checklist was completed. This allowed the maintenance worker to make an error (omission) thinking they had completed the task but had not.
A process or system provides little assurance when it requires the same person doing the work to complete a check sheet to attest the work has been completed. Without a second person checking that work has been completed as required, the system is not resilient to a human error.
The rolling stock return to service authority was ineffective as a control in providing assurance that all required tasks were completed and verified.
Replacing the R-clip
At interview, electrician 2 recalled being given an R-clip found on the ground by one of the technicians during clean up. Based on the location it was found on the ground, electrician 2 understood where the R-clip may have come from and knew it to be the securing R-clip of a traction motor inspection cover. When he was given the R-clip, the electrician took immediate action to ensure it was replaced.
Electrician 2 expressed concern that the missing R-clip may lead to an equipment failure if the inspection cover dislodged and allowed the ingress of foreign material into the traction motor.
It is likely his appreciation of the potential damage risk to the traction motor caused the electrician to seek the location and replace the R-clip immediately, rather than wait for it to be replaced when set 3 was back in for scheduled service.
Managing track access
Any person entering the track area requires permission from the duty controller before accessing the track area and is also required to inform the duty controller when they are clear of the track area.
This mechanism of control ensures a single point of contact is informed of all activities occurring on the track network area. This enables the duty controller to make informed decisions about all activities on the network and ensure there are no conflicting tasks.
When electrician 2 requested access to the west track, the duty controller granted access over the radio.
There were two secondary layers of control that did not help the duty controller identify there was about to be conflicting tasks on the network.
A secondary layer of control in the Skitube system was for the duty controller to record all activities into the Control room logbook. While this task serves multiple purposes, a known benefit for the duty controller is deeper processing and understanding of the task when a written record is made in the logbook. A number of studies have found deeper processing and understanding of information when the information is summarised and written down.[5] This additional task of recording information into the logbook is likely to provide the duty controller with a greater level of processing about each task occurring on the network.
The records in the Control room logbook indicated the duty controller made entries about the train uncoupling and the electrician requesting access under set 3, however this mechanism of control did not trigger a conflict in the duty controllers mind.
Another secondary layer of control in the Skitube system was for the duty controller to record when workers were accessing the track area on the temporary track access form. The intent of the control was to aid decision making and provide greater awareness of the activities occurring on the track.
It is likely this form was not being used as intended and therefore did not assist in raising the awareness of the duty controller to the pending conflict.
The duty controller granted access and recorded the details of workers accessing the track in the first table on the form. This indicated there was no train travelling towards the area when access was granted on each of the four occasions listed. When electrician 2 requested access to the Bullocks Flat West Pit (BFW PIT), it was to observe a train pass over the west pit to determine where the missing R-clip had come from. The nature of the request suggests the temporary track access form should have had this as an entry in the second table. The train was travelling towards the area, the train was within 1,000 m and access was considered urgent.
Figure 6: Temporary Track Access Form completed 3 July 2019
Source: Skitube, annotated by OTSI
The temporary track access form recognises and seeks to address the immediate risk of a train travelling towards the area, the distance the train is from the area and how urgent access to the track is. If followed correctly, a discussion about the work being done would happen in order to determine the level of protection needed.
The temporary track access form required an input from the duty controller which is the same input required for the Control room logbook (to write details about a person entering the track area).
The input required from the duty controller is the same however the two controls serve different purposes. The control room logbook maintains a record of all activity on the rail network, the temporary track access form aids the duty controller to make the right decision when granting a person access to the rail network. The repetition of required input from the duty controller likely resulted in the temporary track access form not being followed as intended.
While other controls, such as restricted access to the control room, are in place to help minimise distraction to the duty controller, it is likely the duty controller was also distracted by a number of other activities occurring at around the same time.
The train on the east platform (Charlie 25) had just departed,
The platforms were crowded by the passengers alighting from the arriving train (Alpha 24) on west platform,
The duty controller was acknowledging radio calls from train services operating between the three terminals,
Two people that alighted from Alpha 24 (one an off-duty controller) had made their way and presented at the control room to retrieve a personal item.
These distractions likely led the duty controller to the unintended action of granting the electrician access under set 3. Reason[6] summarises similar situations in the following;
Common among the acts of humans are moments of absent-mindedness when we become aware that our actions have strayed from their intended path. Two conditions appear to be necessary for the occurrence of these slips of action: the performance of some largely automatic task in familiar surroundings and a marked degree of attentional ‘capture’ by something other than the job in hand.
The primary control for managing access to the track is the duty controller. The duty controller is subjected to various distractions which can reduce the effectiveness of duty controller to safely manage access. Skitube’s secondary layers of control, the temporary track access form and the control room logbook can assist the duty controller but require concerted effort from the duty controller to be effective.
At a time when the duty controller’s attention was captured by other activities, the procedures for managing access to the rail network did not assist in alerting the duty controller to the pending conflict.
The Skitube system for managing access to track did not detect the conflict of the rail maintenance worker under the train at the same time the train was being shunted.
Protection flags
The Skitube system requires a worker to place red protection flags on each end of the train to stop a train from being moved when the train is defective or when work is being conducted on the train. When these flags are in place it is easy for the driver of the train to see them when they step into the driver cabs at either end of a train set.
In this incident, the driver was reliant on electrician 2 installing flags across the driver’s cab windscreen on both ends of the train set to indicate work was being conducted on the train. In his statement, electrician 2 understood he had a responsibility to place protection flags on the train set but also felt there was a breakdown in communication as he was given clearance without the train set being flagged out. Skitube’s system does not specifically allocate who is responsible to ensure protection flags are in place before work commences.
The operator’s internal investigation highlighted their system contains references and documentation on the use of protection flags, although further additional information is required to clarify the protection flag process.
As protection flags had not been placed on the train set, there was nothing to alert the driver of the electrician being under the train. However, protection flags on the far ends of the train may not have been visible from the inwards cabs between set 3 and set 4. Therefore, there was a possibility of the driver missing the visual cue of the red protection flag and moving a train set when uncoupling.
The incident may have been averted if the duty controller was compelled to obtain assurance the red protection flags were in place on the train before finalising the clearance for the electrician to enter west track.
Positive isolation
The placement of protection flags on the ends of the train is not a positive isolation of energy. The protection flags do not ensure the train is isolated and cannot be moved while being worked on.
In this incident, the train was moved twice by the drivers uncoupling the train sets. The first movement of the train set occurred in order to separate the scharfenberg type couplers. If the electrician had placed protection flags on the ends of the train set, it is likely the drivers would have spotted these due to the external flag that protrudes out from the side of the train.
However, there is a possibility the drivers, when working in between train sets, could miss the visual cue of the flags and move a train set whilst a person is working on it. The protection flag is only a visual cue. There is nothing to stop a driver from moving a train set when a worker has placed protection flags on the train.
In the rail industry and in other heavy industries, the practice of de-energising equipment (e.g. turning off starter switch and lowering pantographs) and then isolating (locking the starter switch in off position) to ensure energy cannot be placed back into the equipment until repairs are complete, is a common practice.
The provision of lock-out tags to maintenance staff to prevent drivers (or other persons) operating controls could reduce the risk of recurrence significantly.
Safety and environmental management system not error tolerant
The safety factors identified in the course of the investigation highlighted a dependency these areas of the Skitube system has on workers correctly following procedures to effectively manage safety risk.
The effectiveness of the return to service authority was dependent on the diligence of the maintainer ensuring critical steps had been completed before signing off. As highlighted in this incident, it is easy for an error to occur in this process as there is no timely check on the work of the maintainer, to pick up any error that may have been made. Once the omission to replace the R-clip was made, there was no other mechanism of control to allow the system to recover.
The duty controller has responsibility for managing access to the track. The Skitube system has considered the likelihood of the duty controller making an error and has in place, two secondary layers of control to aid the duty controller. These secondary layers of control, the control room logbook and the temporary track access form, did not provide the duty controller with any greater awareness of a pending conflict. This was likely due to an unintended action where key information was not considered due to distractions and incorrect use of the temporary track access form. Once this conflict was missed, the system was reliant on electrician 2 using the protection flag procedure to indicate he was working on the train set.
The protection flag procedure relies on workers following and installing the protection flags on the train set before commencing work. As this was not done by electrician 2, there was no mechanism for the driver to realise there was a person under the train set. As the protection flag system does not isolate energy from the train set, the risk of the train set being moved whilst a worker is working on it can be realised.
These mechanisms of control in the Skitube system are dependent on people following documented procedures to be effective. When a person has made an error in judgment or by omission, the system is left open for safety risks to be realised.
These elements of the Skitube safety and environment management system are reliant on procedures being followed to manage safety risks. There is little scope for the system to recover when there has been a human error or other procedural error.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the near miss of a maintenance worker on Skitube Alpine Railway, Bullock’s Flat, on 3 July 2019.
Contributing factors
The duty controller granted an electrician access to the west track at the same time the daily 1700 shunt on west track was taking place.
The electrician had not applied the required protection flags to the train set to indicate work was being conducted on the train.
The Skitube system for managing access to track did not detect the conflict of the rail maintenance worker under the train at the same time the train was being shunted. [Safety issue]
Other factors that increased risk
The rolling stock return to service authority was ineffective as a control in providing assurance that all required tasks were completed and verified.
The system of placing protection flags on both ends of a train set does not provide a positive isolation of energy to ensure a train cannot be moved while it is being worked on. [Safety issue]
Elements of the safety and environment management systemare reliant on procedures being followed to manage safety risks. There is little scope for the system to recover when there has been a human error or other procedural error. [Safety issue]
Other findings
The electrician felt an urgency to re-install the missing R-clip with concerns a dislodged inspection cover may lead to an equipment failure from the ingress of foreign material into the traction motor.
It is likely the duty controller did not connect the two activities, the 1700 shunt and the electrician accessing west track, due to other activities occurring at the time, including a visit from an off-duty controller.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The Skitube system for managing access to track did not detect the conflict of the rail maintenance worker under the train at the same time the train was being shunted.
Safety issue description: The system of placing protection flags on both ends of a train set does not provide a positive isolation of energy to ensure a train cannot be moved while it is being worked on.
Elements of the safety and environment management system not error tolerant
Safety issue description: Elements of the safety and environment management system are reliant on procedures being followed to manage safety risks. There is little scope for the system to recover when there has been a human error or other procedural error.
Train details
Train details
Train operator:
Perisher Skitube
Registration:
Alpha 24
Type of operation:
Passenger
Departure:
Bullocks Flat Terminal
Destination:
Bullocks Flat Terminal
Persons on board:
Crew – 1
Passengers – Nil
Injuries:
Crew – 0
Passengers – 0
Damage:
None
Speed:
2km/hr
Length:
16.8m
Width:
3.8m
Sources and submissions
Sources of information
The sources of information during the investigation included:
Duty controller on shift at the time of the incident
Train driver operating set 3 at the time of the incident
Electrician that conducted the maintenance on 2 July 2019
Electrician that accessed west track
Maintenance manager and safety manager of Perisher Skitube
Recorded closed circuit television at the Bullocks Flat Terminal
Recorded audio files of Skitube network operations
Maintenance data and checklists from Perisher Skitube
Operational and maintenance procedures from Perisher Skitube.
References
Christmas A, Harris B and Lampe E, 2019, The Effects of Note-taking Strategies and Gender on Word Recognition, Spring Showcase for Research and Creative Inquiry. 15. https://digitalcommons.longwood.edu/rci_spring/15
Marin L and Sturm S, 2019, Why aren’t you taking any notes?’ On note-taking as a collective gesture, Received 15 Apr 2019, Accepted 15 Jan 2020, Published online: 10 Apr 2020. www.tandfonline.com/doi/full/10.1080/00131857.2020.1744131
Bohay M, Blakely DP, Tamplin AK and Radvansky GA, 2011, Note Taking, Review, Memory, and Comprehension, The American Journal of Psychology, Vol. 124, No. 1 (Spring 2011), pp. 63-73
Pearl A and Drury CG, 1995, Improving the Reliability of Maintenance Checklists. Human Factors in Aviation Maintenance Report No. DOT/FAA/AM-95/, Washington, D.C.: Office of Aviation Medicine. Ch. 8.
Reason J, 1990, Human error. New York: Cambridge University Press.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
PerisherBlue Pty Ltd
Office of the National Rail Safety Regulator
Transport for NSW.
Submissions were received from:
PerisherBlue Pty Ltd
Office of the National Rail Safety Regulator.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 29 June 2019, at about 1249 Eastern Standard Time, an amphibious Cessna 208 aircraft, registered VH-ZWH, was travelling from Rose Bay to Berowra Waters, New South Wales (NSW). After the aircraft landed and was slowing down to taxi speed, the front left float of the aircraft bumped into a small stationary boat. There was no damage to the aircraft or boat, and one person in the boat sustained minor injuries.
What the ATSB found
The ATSB found that the pilot did not see the boat, due to a combination of factors including the weather conditions on the day as well as the colour, size, lack of movement and location of the boat as it was positioned in the aircraft’s direct path.
What's been done as a result
The aircraft operator has introduced the requirement for company pilots to manoeuvre towards the right side of the river to reduce the risk of a blind spot near the area of the collision. Also, as a standard operation, company pilots are to reduce the speed of the aircraft to an idle power taxi speed after landing, 100 m before the start of the 4-knot zone at Berowra. In addition, the company’s safety management system was updated to reflect additional post incident response requirements.
Safety message
This incident is a reminder of the importance of scanning and assessing landing areas for any potential hazards, and of the joint responsibility of both aircraft and marine vessels to see and avoid other aircraft/vessels operating on the water. When choosing an operating speed for any vessel or aircraft on the water, consideration should be given to any potential blind spots and areas where other vessels could emerge.
The occurrence
What happened
On 29 June 2019, at about 1230 Eastern Standard Time,[1] an amphibious Cessna 208 Caravan aircraft, registered VH-ZWH (ZWH) operated by Sydney Seaplanes, departed from Rose Bay on a charter flight to Berowra Waters, New South Wales (NSW). On board were the pilot and eight passengers.
At about the same time that the aircraft took off from Rose Bay, two adults and two children departed from the Berowra Waters Marina in a hired small aluminium boat, which the marina reported as being about 4.8 metres in length. The boat hirer (boat operator) did not have a boat licence, nor was one required to operate the boat. The children were wearing lifejackets and the adults were not wearing lifejackets, nor were they required to in the circumstances in accordance with NSW Marine Safety Regulation (2016).[2] After about 15 minutes, the boat operator stopped the boat near the middle of Berowra Creek to have lunch, and turned off the motor.[3]
About 5 minutes after the boat had stopped, ZWH approached the landing area on Berowra Creek (located in Berowra Waters). The pilot assessed that the wind conditions were suitable for landing and positioned the aircraft to land on Berowra Creek in a south-westerly direction (Figure 1). After landing, because of the long distance to taxi to the restaurant, the pilot kept the aircraft’s speed up, maintaining the aircraft ‘on the step’ (see Seaplane positions) for some time. At the same time, the pilot was also monitoring a large white boat that was heading south out of Calabash Bay, ensuring that it continued moving away from the aircraft and was not going to present a hazard. As the aircraft approached the 4-knot zone of the creek (Figure 1), the pilot reduced the speed and the aircraft moved from the step to the taxiing position.
The boat operator saw the aircraft land and travel towards their stationary boat. As the aircraft approached, the boat operator became concerned that the aircraft was not going to stop. Because the boat appeared to be in the aircraft’s direct path, the boat operator started the motor and began turning the boat away from the aircraft. As the aircraft was slowing to taxi the pilot felt a bump while at a speed of about 6 to 7 knots.[3] The pilot looked around the nose of the aircraft (which was obstructing part of the forward field of view) and saw that the front left float had contacted the boat, which the pilot had not seen until then. The silver hull of the boat had been motionless on the calm, glassy surface of the creek and its dark blue canopy and dark clothing worn by the adults in the boat had blended into the surrounding area.
The aircraft is powered by a PT6 series gas turbine engine with a full reversing propeller. After seeing the boat, the pilot reported selecting full reverse thrust and the aircraft moved away from the boat. There was no damage to the aircraft or the boat and one person on board the boat sustained minor injuries.
The boat operator subsequently reported previously hiring a boat in the same area once before but was unaware that seaplanes operated in the area. The previous time, the boat operator had not seen or heard any aircraft in the area, and therefore was not expecting to see one operating nearby.
Figure 1: Image of the Berowra Waters area showing the location of the collision, the landing direction of VH-ZWH and significant landmarks
Source: Google earth annotated by the ATSB.
Seaplane positions
When moving on the water, the aircraft had two states it could be in, either ‘on the step’ or in the taxiing position (Figure 2). On the step most of the weight of the aircraft is being supported by hydrodynamic lift rather than the buoyancy of the floats, and it is the take-off and landing position.
Figure 2: Diagram of the difference between being ‘on the step’ and being in the taxiing position
Source: FAA Seaplane, skiplane, and float/ski equipped helicopter operations handbook - annotated by the ATSB.
Safety analysis
Due to a combination of factors the pilot did not see the boat prior to the collision. The factors included the weather conditions on the day, as well as the colour, size, lack of movement and location of the boat as it was positioned in the aircraft’s direct path. The colour of the boat blended into the surrounding environment.
The actions of the boat operator of starting the engine and attempting to move out of the aircraft’s direct path likely reduced the risk to the boat occupants due to the change in the angle of impact as the aircraft struck the boat.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
While slowing to taxi speed, the aircraft collided with a small boat that was motionless in the middle of the creek and in the aircraft’s direct path. The boat’s lack of movement, silver hull and dark blue canopy reduced the pilot’s ability to discern it from the background environment.
After the boat operator realised the aircraft was travelling directly towards them, the boat operator started the motor and attempted to manoeuvre the boat out of the direct path of the aircraft.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Proactive safety action
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they have taken the following safety actions:
Company pilots where possible are to manoeuvre on the right-hand side of the river to reduce the risk of a blind spot near the area of the incident.
As standard operations, company pilots are to reduce the speed of the aircraft to an idle power taxi speed after landing, 100 m before the start of the 4-knot zone at Berowra.
The company safety management system was updated to reflect additional post incident response requirements.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 10 June 2019, the driver of Xplorer service NP43 was operating a passenger service between Werris Creek and Moree. Shortly after departing Gunnedah, the driver passed signal GH19 at Caution and continued at track speed of 115km/hr, unaware that signal GH23 was at Stop. The position of the sun likely reduced the driver’s ability to sight signals GH19 and GH23 from a safe distance. When the driver did sight signal GH23 at Stop, there was insufficient distance to stop prior to points 55. NP43 traversed points 55 in excess of the maximum track speed of 50km/hr for the points. The train, travelling at approximately 110km/hr, came to a stop approximately 400m into the Whitehaven Coal Loop. When NP43 entered the coal loop three people were injured, a passenger and a member of crew were struck by flying objects, and a crew member was thrown from their seat striking their head.
What the ATSB found
It was found that the driver of NP43 was not aware signal GH23 was at Stop, in order to protect an Up movement at Emerald Hill. The driver passed signal GH19 without sighting the signal and the position of the sun likely affected the driver’s visibility of signal GH23. There was insufficient stopping distance prior to points 55 once the driver sighted signal GH23.
Safety message
Drivers are reminded of the importance of operating to the current conditions, but also with consideration to potential future conditions. If safe sighting distance is reduced due to environmental factors, it is important to reduce speed and be prepared to stop.
The occurrence
What happened
On 10 June 2019, NSW Trains were operating a passenger service between Werris Creek and Moree. This service consisted of a two car Xplorer service designated as NP43.
At 1558[1] service NP43 departed Werris Creek for Moree in the Down[2] direction. This service departed 13 minutes late due to the late arrival of service NP23 to Werris Creek. These services were operating to a modified timetable as a result of track work near Muswellbrook.
At 1636 the driver of NP43 contacted the North Panel Network Controller (NC), located at ARTC’s North Control Centre, Broadmeadow to advise that NP43 was at Gunnedah station. During the communication the NC advised there was a train ahead, after that they should get the signal to proceed. Between 1639 and 1642 a coal service designated NB933 travelled in an Up direction and entered the Gunnedah loop line north, locally referred to as the ‘Gunnedah Long Loop’.
At 1643 NP43 departed Gunnedah after signal GH7 indicated a proceed indication.
At 1645 NP43 passed signal GH19 with a yellow Caution indication. This signal is located on the right hand side in the direction of travel at 478.100km[3].
At 1646 the NC contacted the driver of NP43 to confirm that NP43 had passed the Gunnedah Long Loop, with the driver confirming he had passed the long loop. The NC acknowledged the driver’s message and advised, ‘shouldn’t be too long and that signal should set up for you’.
At 16:46:28 NP43 passed signal GH23 at Stop, located at 480.028km and entered the Whitehaven Coal Loop siding at approximately 110km/hr. The train stopped approximately 400m into the coal loop (see Figure 1 for incident location). The driver stated when he did see signal GH23 at Stop, he initiated an emergency brake application, but was unable to stop prior to points 55.
The driver of NP43 contacted the NC to advise of the signal passed at danger (SPAD), confirming that the signal was at Stop, however it was not visible to the driver due to sun glare.
The driver was checked by the Passenger Service Supervisor (PSS) as fit to continue. The NC then made arrangements for the driver of NP43 to change ends and return to the main line. NP43 was cleared to continue north, with the driver accompanied by the PSS for the remainder of the journey. The driver of NP43 was breath tested by NSW Police on arrival at Narrabri, returning a negative blood alcohol reading.
There were three reported injuries from increased lateral forces as a result of NP43 traversing points 55, in excess of the maximum track speed of 50km/hr for the points.
Figure 1: Gunnedah signal location
Source: ARTC. Modified and annotated by ATSB
Safety analysis
The late running of NP43 and time of the year meant the sun was lower than the driver was expecting or reportedly had previously seen. The driver last operated this route one month prior to this occurrence.
The position of the sun aligned directly with the path of NP43, likely reducing the safe sighting distance to within 100m of signals GH19 and GH23. The driver reported that the sun was reflecting from the stainless steel coal wagons parked in the Gunnedah long loop. This may have distracted the driver from sighting signal GH19. The driver reported wearing sunglasses and utilising the cab blind in an effort to block the sun, but reported his visibility was still affected.
The driver reported he knew the location of signal GH19, however did not see the signal on passing and continued at track speed. The driver also reported never seeing signal GH19 with a Caution indication in the previous 12 years, which likely influenced the driver continuing at track speed.
A site inspection completed the following day confirmed the position of the sun would have affected the driver’s visibility of the signal aspects for GH19 and GH23 (see Figure 2). This inspection was completed at the same time in similar weather conditions to the previous day.
Figure 2: Signal sighting at approximately 100m and 30m to GH19 and GH23
Source: ARTC. Annotated by ATSB.
The NC had set signal GH23 to Stop to protect the Up movement of a coal train into the sidings at Emerald Hill. With signal GH23 at Stop, points 55 were set in the reverse position in order to direct rail traffic travelling in the Down direction into the Whitehaven Coal Loop siding. Signal GH19 was set at Caution as signal GH23 was at Stop. The driver of NP43 was not aware of the Up movement at Emerald Hill and was not expecting signal GH23 to be at Stop, having not seen signal GH19.
The driver of NP43 was contacted by the NC after passing the end of the long loop as part of the requirement to block work[4] in this section of track. This call was made after NP43 had passed signal GH19. Although the call from the NC was made when NP43 was approaching signal GH23, it is unlikely the call from the NC distracted the driver from sighting signal GH23 at Stop.
The driver reported throwing the radio handset aside on sighting the signal at Stop, therefore it is possible the driver did not hear or comprehend the NC stating ‘shouldn’t be too long and that signal should set up for you’. It takes approximately 500m to stop a two car Xplorer from 115km/hr in emergency braking mode, therefore it is unlikely NP43 would have been able to stop prior to points 55.
The maximum sign posted speed for points 55 is 50km/hr. The speed NP43 traversed the points created lateral forces which resulted in the following:
a passenger being struck by a falling bag
the Senior Passenger Attendant (SPA) being struck with items stored in the buffet
the PSS being thrown from their seat in the rear car and striking their head, requiring first aid.
It is a requirement for a driver to be accompanied by a qualified worker following an incident until the driver is relieved[5]. If the qualified worker doubts the ability of the driver to safely operate the train, they must tell the NC and secure the train. The qualified worker in this case was the PSS as the SPA cannot perform the role of a qualified worker. Given the PSS received a minor head injury, the potential effectiveness of their assessing and monitoring the safe operation of the train could have been limited. The driver could, however, monitor the PSS post incident.
The health and fatigue of the driver were assessed and it was considered these did not contribute to this occurrence.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The driver of NP43 was not aware that signal GH23 was at Stop and continued at track speed after passing signal GH19 without seeing the signal indication.
The driver's vision of the signals GH19 and GH23 was likely impaired due to the position of the sun. The sun reflecting off the side of the coal wagons prior to signal GH19 possibly further impaired the driver's vision. Under these conditions the driver did not suitably adjust the speed of the train to allow for safe sighting of the signal.
The NC set the route so that GH23 was at Stop to allow for an Up movement of a freight train into Emerald Hill Loop.
The driver was qualified and had frequently operated passenger trains through this section. In the previous 12 years, the driver reported not sighting GH19 at Caution. This likely influenced the driver to continue after not seeing the signal indication.
The driver of NP43 was not distracted by other activities or the requirement to block work within this section of track.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 7 June 2019, Pacific National (PN) were operating freight train 6CM3 between Griffith, New South Wales and Appleton Dock, Victoria. The train arrived at the Junee Down Platform for a scheduled driver change. The relieved train crew performed a roll-by inspection when the train departed at 2159. During the roll-by inspection, the relieved train crew detected the 40th and 41st wagons had derailed and contacted the driver by radio to stop. The derailment blocked the Olympic Highway level crossing at Junee and disrupted freight and passenger services. The Down Platform road required repairs and was unfit for use until 10 June 2019.
What the ATSB found
The ATSB found that the 40th and 41st wagons derailed at a broken rail near 119A points. The broken rail allowed wheels from 6CM3 to derail, damaging the wagons and infrastructure. It was found that rails forming turnouts between main lines were not being ultrasonically tested following a change in maintenance practices. A likely detectable rail defect went undetected with the rail breaking in two places on two different occasions. The crew performing the roll-by inspection detected the derailed wagons preventing the escalation of this occurrence.
What's been done as a result
The Australian Rail Track Corporation identified rails forming turnouts that were not previously subjected to ultrasonically testing and included these in the asset management register. Scheduled testing of these identified assets has been included in the ultrasonic testing contractor’s annual testing program.
Safety message
Rail infrastructure managers should ensure that inspection techniques effectively monitor and report on asset condition. Risk controls should also be continuously assessed to control risk to an acceptable level through the life cycle of the asset, in particular, when changes are made to inspection regimes.
The occurrence
What happened
On 7 June 2019, Pacific National (PN) were operating freight train 6CM3 between Griffith, New South Wales and Appleton Dock, Victoria.
Train 6CM3 operated between Griffith and Junee on the Country Regional Network (CRN)[1], arriving at the boundary of the CRN and Australian Rail Track Corporation (ARTC) network at approximately 2147.[2]
The train crossed from the CRN network through 113 and 119 points in the Down[3] direction, arriving at the Junee platform at 2154 for a crew change. At 2159, the train departed in the Down direction with the relieved crew performing a roll-by inspection[4] from the platform. During the roll-by inspection, the crew detected the train had derailed and contacted the driver by radio to stop the train (Figure 1).
The ARTC network control centre south was advised of the incident, and safeworking protection was applied to protect the site. Inspection of the derailment site identified that the 40th and 41st wagons had derailed. The two wagons had run in a derailed state from near 119 points at 485.348 km[5] to alongside the platform at 485.688 km (Figure 2).
The derailment blocked the Olympic Highway level crossing at Junee and disrupted freight and passenger services on the Main South Line.[6] The Down Platform road required repairs and was unfit for use until 10 June 2019.
Figure 1: Junee network diagram
The path of train 6CM3 is shown in orange and depicts the train crossing from the Country Regional Network to the Australian Rail Track Corporation network by crossing points 113 and 119. Source: Australian Rail Track Corporation, modified and annotated by OTSI
Figure 2: Derailment site
Source: Australian Rail Track Corporation and Pacific National, annotated by OTSI
Safety analysis
The rail was found to be broken in two places in the closure rail[7] between 119A and 119B points at 485.348 km (Figure 3). The two rail breaks showed different failure characteristics indicating the likely failure sequence (Figure 4):
Break one exhibited signs of oxidation across the full face of the rail, end batter[8] and some worn areas on the fracture face. A small section of the rail head showed signs of fatigue cracking that likely initiated from rolling contact fatigue (RCF)[9] at the gauge face. The smooth areas of the fracture face indicate wear between the two faces as a result of vertical displacement of the broken rail.
Break two exhibited light oxidation at a fatigue crack that likely initiated from RCF. The remainder of the fracture face showed signs of a brittle overload fracture, with no visible oxidation.
Oxidation across the full fracture face of break one indicated it had occurred sometime before break two. The weight of the wagons passing over the broken rail likely created a bending moment,[10] causing increased stress in the rail head. The increased stress likely led to the progression of the fatigue crack (break two). While train 6CM3 was crossing through points 119A, the rail likely broke (break two) with sudden brittle fracture.
There was deformation and evidence of flange marks (point of mount) at break two, with witness marks to the point of drop approximately 4.5 m from the point of mount. A total of eight wheels derailed on the 40th and 41st wagons, although the first wheel to derail could not be established.
The roll-by inspection detected the derailment within approximately 340 m, preventing further damage to infrastructure. This train could have continued to operate in a derailed state had it not been detected. The condition and operation of train 6CM3 was unlikely to have increased the risk of derailment with the wheels derailing at the broken rail.
Figure 3: Broken rail segment
Source: Pacific National, annotated by OTSI
Figure 4: Broken rail analysis
Source: Australian Rail Track Corporation, annotated by OTSI
The track at Junee is subjected to routine inspection and testing in accordance with ARTC maintenance standards, including visual and ultrasonic rail defect testing. The most recent maintenance inspections completed for points 119A were:
24 January 2019 – Detailed visual inspection of points.
10 April 2019 – Manual detailed ultrasonic testing of turnout.
3 June 2019 – Track patrol visual inspection.
Maintenance records indicated that there were no known faults with points 119A prior to the derailment. It is very likely that the rail was visibly broken (break one) at the time of the track patrol[11] performed on 3 June 2019 but the break was not detected. Track patrols provide a level of assurance but are limited to large or obvious defects. It is also likely the manual detailed ultrasonic testing of turnout inspection completed on 10 April 2019 did not test the closure rail at the location of the break.
In 2017, ARTC changed the requirements for ultrasonic rail testing of turnouts in New South Wales (NSW). This change aligned the testing with other interstate areas where testing was conducted using continuous ultrasonic testing vehicles. Prior to this, in NSW, all rails in turnouts were subjected to 6-monthy manual hand-held ultrasonic testing.
It was found that at the time of the derailment, rails within turnouts between main lines were not being tested by ultrasonic testing vehicles. There were also no specific requirements in the ultrasonic testing contract for the testing of turnouts between main lines.
At the time of implementing the change to the inspection requirements, the change management process did not detect the loss of the risk control associated with ultrasonic testing of turnouts. Additionally, following the change in 2017, it was unclear which areas of turnouts continuous ultrasonic testing could test and which areas needed manual hand-held ultrasonic testing.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The derailment of two wagons of train 6CM3 occurred due to a broken rail at 119 points. It is likely detectable fatigue cracks were not identified before the rail broke as the rail was not ultrasonically tested.
ARTC maintenance practices did not ensure that rails forming turnouts between main lines were ultrasonically tested as part of scheduled testing.
ARTC’s change management process did not identify the loss of a risk control (ultrasonic testing) at the time of changing the requirements for ultrasonic rail testing in turnouts within NSW.
A roll-by inspection detected the derailed wagons preventing further damage.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Australian Rail Track Corporation
As a result of this occurrence, the rail infrastructure manager has advised the ATSB that they are taking the following safety actions:
Asset maintenance
Turnouts between main lines not previously subjected to continuous ultrasonic testing have been identified and included in ARTC’s maintenance asset register. Ultrasonic testing of turnouts not tested previously has been completed. The ultrasonic testing contractor has included these identified assets in the annual testing program.
Maintenance standard ETE-01-03 Non-Destructive Testing of Rail (for Internal & Surface Defects) is currently under review.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 28 May 2019, a Cessna 152, registered VH-JIW, was being operated by Basair Aviation College on a training flight from Archerfield Airport, Queensland. On board was a student pilot on their first flight, and a flight instructor.
During the training flight, the instructor was demonstrating the use of trim, with the student flying the aircraft. At about 2,000 ft above ground level, the aircraft abruptly pitched down and entered into a dive. The instructor took control of the aircraft and recovered from the descent at about 400 ft, about 25 seconds after the dive commenced. Subsequently the flight instructor elected to terminate the lesson and returned the aircraft to Archerfield Airport.
The instructor sustained minor injuries and the student was uninjured. An examination of the aircraft identified significant structural damage to the right horizontal stabiliser, which was indicative of in-flight overload during dive recovery. In addition, the instructor inadvertently bent the throttle control in the cockpit, which made movement of the control stiff but still operable.
What the ATSB found
The ATSB found that the student released the control wheel leading to the aircraft entering into a steep dive. The flight instructor had applied a large amount of nose-down trim during the course of instructing the lesson, resulting in a strong nose-down tendency of the aircraft when the controls were released. The flying school’s instructor guide did not specify a limit of trim input for such exercises.
It was also determined that the instructor’s hands were not in a ready position to take control in the event of any mishandling by the student pilot. The recovery by the instructor was likely further delayed after sustaining a head injury during the in-flight upset, and initially being unsure about what had happened and how to then recover the aircraft.
What has been done as a result
The operator has revised its training procedures for use of trim to include detailed instructor demonstrations prior to the student practicing manoeuvres. This ensures the student understands the required use of trim and the effect it has on the aircraft flight characteristics to maintain flight attitudes. The operator has also revised its training procedures to use a consistent moderate amount of trim.
Safety message
The first stages of flight training can be an exciting yet daunting period for a student. Any uncertainty should be raised with the instructor before taking action in case it leads to an unsafe situation. Conversely, instructors need to account for the potential for the student to carry out unexpected actions. This means that lessons should be conducted under the lowest risk conditions that still impart the lesson intent.
The investigation
The occurrence
On 28 May 2019, at about 1110 Eastern Standard Time,[1] a Cessna 152 aircraft, registered VH‑JIW and operated by Basair Aviation College, departed Archerfield Airport, Queensland, for a training flight. On board was a student pilot on their first flight, and a flight instructor.
During the flight, the instructor demonstrated a number of manoeuvres from the ‘effects of control’ flight-training syllabus. As part of this, the instructor placed the aircraft out of trim with the pitch trim wheel,[2] while the student was maintaining straight and level flight.
With the aircraft in a nose-up trim, the student then practiced re-trimming the aircraft for level flight while maintaining attitude using nose-down pressure on the control wheel. As the aircraft was approaching overhead Lagoon Island at about 2,000 ft above ground level, with the student flying, the instructor moved the pitch trim to about two-thirds travel nose down. The student maintained attitude with nose-up pressure on the control wheel. The instructor’s feet were lightly on the rudder pedals, left hand on their leg, and right hand resting on the glareshield (next to the control wheel).
The student maintained straight and level flight for a short period. When the procedure was to return the elevator trim to neutral, the student became confused about the correct procedure and let go of the control wheel. The aircraft rapidly pitched nose-down, rolled left, and entered into a dive. During these events, the flight instructor’s headset dislodged from their head.
The flight instructor took control of the aircraft and subsequently arrested the descent at about 400 ft, about 25 seconds after the descent commenced. The available radar data (Figure 1) showed that from when the dive commenced, to when the instructor regained control, the aircraft had an average rate of descent of over 3,000 ft/minute, with the rate being higher in the initial part of the descent.
Figure 1: VH-JIW’s flight path, dive and recovery as derived from radar data
Source: Google Earth, modified by the ATSB
During the occurrence sequence, the instructor pulled the throttle back quite rapidly and, at some stage during the initial stages of the sequence, the throttle was bent. The throttle then became stiff, however was still able to be moved. The instructor recalled applying right rudder during the recovery but did not fully recollect if that was to recover from a left spiral dive or spin. The instructor stated they did not re-trim the elevator system to a neutral position until after recovery from the dive.
When they had recovered from the dive, the aircraft was on a reciprocal heading. The instructor carried out a flight control function check and confirmed the aircraft was controllable. The instructor then terminated the lesson and advised air traffic control that their aircraft had descended 1,500 ft ‘quite suddenly’ and they were returning to Archerfield Airport. The aircraft landed without further incident at about 1139.
During the occurrence, the instructor sustained several minor injuries, including an injury to their left shin after it contacted the underside of the instrument panel, a head injury from impact with the cabin roof, and bruising to the right hip. The student pilot was uninjured. The aircraft sustained damage to the right horizontal stabiliser.
Context
Personnel information
The instructor pilot held a grade 3 instructor rating and had about 320 total flight hours, including 100 hours in Cessna 152 aircraft. They had instructed this lesson about seven times before this occurrence.
The student pilot was conducting their first flight.
Pitch trim system
The pitch trim system on VH-JIW consisted of a manual trim wheel located on the lower instrument panel, which controlled a full-span trim tab on the right elevator only.
Placing the aircraft in an out-of-trim condition places a load on the flight control surfaces that results in the aircraft changing attitude accordingly, if the pilot does not oppose the condition. The flight controls will have a ‘heavy’ feel to them when held against the trimmed attitude. This force is neutralised when the aircraft is either re-trimmed or allowed to adopt the trimmed attitude.
Aircraft damage
A post-flight inspection of the aircraft found that the right horizontal stabiliser was bent and twisted during the occurrence, resulting in creasing on the upper and lower skin sections (Figure 2). The left horizontal stabiliser had no significant damage.
Figure 2: Right stabiliser damage
Source: Operator, annotated by the ATSB
The deformation of the right stabiliser resulted in a number of rivets on the aft lower surface pulling through the skin. The internal structure was cracked and creased (Figure). There was no evidence of damage to attachment points of the stabiliser assembly.
Figure 3: Leading edge removed showing cracking to internal structure
Source: ATSB and Cessna, annotated by the ATSB
An ATSB examination of the right horizontal stabiliser did not identify evidence of pre-existing damage to the structure.
In addition to the bent throttle control, the aircraft compass had detached from its mount on the windscreen.
Meteorological information
The aerodrome forecast (TAF) for Archerfield Airport issued at 0907 on 28 April stated that conditions would be CAVOK (cloud and visibility ok and no significant weather phenomena). The forecast wind was 260° at 10 kt. Recorded weather conditions at 1130 were consistent with the forecast. The area forecast also did not show any adverse weather conditions, such as turbulence, that may have contributed to the aircraft experiencing a rapid change of direction or altitude.
Flight instructor guidance
The flight training school’s instructor guide outlined the procedure for teaching the use of the trim component of the effects of controls lesson. This procedure was in accordance with the guidance provided by the Civil Aviation Safety Authority in Appendix D of Civil Aviation Advisory Publication (CAAP) 5.14-2 (Flight instructor training (Aeroplane)).
The guidance stated that, with the student flying straight and level, the instructor would place the aircraft out of trim. The student then re-trimmed the aircraft to relieve the load on the controls. This was then repeated in the opposite direction of trim travel.
The CASA CAAP referred to the Federal Aviation Administration (FAA) Aviation Instructor’s Handbook, which stated:
Flight instructors should always guard the controls and be prepared to take control of the aircraft.
Safety analysis
Use of trim
When the student released the controls without re-trimming the aircraft, the aircraft entered a sudden dive. Since the flying school operator’s instructor guide did not include a limit to the amount of trim used during the ‘effects of control’ lesson, flight instructors could set the trim to differing amounts. On the occurrence flight, it had been set at about two-thirds nose-down travel. This amount meant that the aircraft’s nose-down response was more abrupt and stronger than needed to convey the intent of the lesson.
Instructor hand position
During the exercise, the instructor’s right hand was resting on the glareshield; this was not an optimal position to guard the controls and to be ready to react to any adverse student inputs. This, coupled with the suddenness of the movement and the instructor’s injuries, and being unsure as to the cause of the dive and best recovery technique, likely led to a delay in taking control of the aircraft and its subsequent recovery.
Dive recovery
The instructor attempted to regain control of the aircraft before placing the elevator trim into a neutral position, leading to the aerodynamic force being concentrated on the right horizontal stabiliser (where the trim tab was located) rather than spread across both stabilisers during the dive recovery.
These asymmetric flight loads, induced by the elevator trim imparting additional load on the right side, twisted the stabiliser at the forward outboard tip, about 30 mm downwards relative to its original position. This likely resulted in the right stabiliser being close to total failure. The large amount of nose-down trim at the time of the upset also increased the effort and effect required to recover from the dive.
Findings
From the evidence available, the following findings are made with respect to the loss of control of Cessna 152, registered VH-JIW, which occurred near Archerfield Airport, Queensland on 28 May 2019.
Contributing factors
In the course of the student pilot’s first training flight, during a lesson in the effects of control, the student released control wheel backpressure suddenly.
The instructor’s use of a large amount of nose-down elevator trim for the lesson increased the effect when the student released backpressure on the elevator, leading to a sudden nose-down pitch change and subsequent entry into a dive.
The instructor was not prepared for the sudden nose-down pitch change, leading to a delay in the recovery from the dive.
Other factors that increased risk
During the recovery from the dive, the horizontal stabiliser experienced excessive asymmetric flight loads, resulting in bending and buckling of the right horizontal stabiliser structure.
Safety action
The operator proactively revised its instructor guide for the use of trim. The new procedure introduced placing the aircraft into a cruise climb and explaining how the use of trim can reduce the control load. This ensured the student understood the required use of trim and the effect it had on the aircraft flight characteristics to maintain flight attitudes.
The revised instructor guide also included detailed instructor demonstrations prior to the student practicing the manoeuvre. The new procedure was taught with the aircraft in a nose-up condition only and ensured that all instructors were using the same trim input to maintain the best rate of climb.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the flight instructor
the student pilot
Basair Aviation College
Civil Aviation Safety Authority.
Submissions were received from:
the flight instructor
Basair Aviation College.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 5 June 2019, the pilot and passenger of a Yakovlev Aircraft Factories Yak-52 aircraft, registered VH-PAE, were conducting a private aerobatic flight from Southport Airport, Queensland. During the flight, while near South Stradbroke Island, the aircraft collided with water. The occupants were fatally injured and the aircraft was destroyed.
What the ATSB found
The ATSB found that, during the flight, a number of aerobatic manoeuvres were conducted below 500 ft above ground level. However, in the absence of recorded data or witnesses to the collision with water, it could not be determined with certainty that the pilot was conducting an aerobatic manoeuvre immediately prior to the impact, but it was considered a possibility. Despite this, for reasons undetermined, the aircraft collided with water at high speed.
It was also established that, during the accident flight and previous flights, the pilot conducted low‑level aerobatics without completing the required training or having the appropriate endorsement. This would have potentially limited the pilot’s appreciation of the risks associated with low-level aerobatics.
Some of the pilot’s low-level aerobatic flights had been witnessed by people with aviation experience and knowledge. While the pilot did receive some warnings about this, there were other opportunities and means for people to formally communicate and escalate their concerns that were not used.
Although not contributory to the accident, a pre-existing fatigue crack was found in the elevator bellcrank, which had the potential to fail in-flight, leading to a loss of control. In addition, the manufacturer could provide airworthiness information upon request for Yak-52 aircraft in Russia and overseas as long as they had not exceeded their prescribed airframe life. However, aircraft such as VH-PAE had exceeded their airframe life and therefore were no longer able to be supported. As a result, significant changes to the scheduled maintenance program relating to the elevator bellcrank were not known or included in local maintenance schedules.
Further, the ATSB established that VH-PAE, along with other Yak-52 aircraft, had exceeded their prescribed airframe life limit. Until 2007, permit index assessments were conducted by the Civil Aviation Safety Authority and included aircraft that had exceeded their life limits. While not related to the accident, when the Australian Warbirds Association Limited conducted the assessments, they did not consider Yak‑52 aircraft to have an airframe life. Subsequently, these aircraft were assigned a permit index that allowed flight over populous areas without consideration of the risk to the aircraft occupants and general public.
What’s been done as a result
In November 2020, the ATSB issued a safety advisory notice to Yak-52 maintainers and owners emphasising the importance of dye penetrant inspections to remove defective elevator bellcranks from service. The notice also noted that Russia, as the aircraft’s state of design, increased the frequency for inspections of the bellcranks to 25 ± 5 flying hours. Further, aluminium alloy bellcranks were no longer approved for use on Yak-52s operating in Russia.
Safety message
This accident highlights the inherent risks associated with performing low-level aerobatics and the reduced safety margins when recovering from manoeuvres. Even more so, it demonstrates the importance of being suitably trained and qualified to conduct these operations. It also provides an opportunity to encourage witnesses, particularly those within the aviation industry, to report any concerns regarding unsafe behaviours through mechanisms such as confidential reporting systems.
Further, as the Yak-52 aluminium elevator bellcranks have a propensity to crack, it emphasises the need to conduct more frequent dye penetrant inspections to identify and remove defective bellcranks from service, and to consider replacing them with steel bellcranks.
The occurrence
On 5 June 2019, at about 0945 Eastern Standard Time,[1] the pilot and passenger of a Yakovlev Aircraft Factories Yak-52 aircraft, registered VH-PAE, were conducting a private flight from Southport Airport, Queensland. The flight was intended to take about 30 minutes and included a scenic flight north along the coast from Broadbeach to the Jumpinpin channel, and then seawards off Jumpinpin to conduct aerobatic manoeuvres over water, before returning to Southport (Figure 2). A second passenger was waiting at the airport to complete a similar flight once the aircraft had returned.
Prior to take-off, the pilot told a witness that a low-level turn over the trees would be more exciting for the passenger. The pilot also discussed taking off downwind on runway 01 and that the aircraft could accept the tailwind component. The second passenger provided video footage showing the aircraft departing Southport from runway 01 and conducting a left turn shortly after take-off. The ATSB’s analysis of that video estimated the turn was conducted at about 200 ft above ground level (AGL) (Figure 1). This departure was described by a witness at Southport as being ‘normal’ for the pilot. The aircraft was held close to the ground after take-off to build up airspeed, which allowed a left turn to be performed just past the runway boundary.
Figure 1: Take-off from Southport Airport and left turn (inset)
Source: Google Earth and witness, annotated by the ATSB
At 0950, Airservices Australia surveillance data identified a radar return for an aircraft tracking in a southerly direction from the airport. On reaching Broadbeach, the aircraft then turned left to commence tracking to the north along the coast. This was consistent with the timing of departure and proposed flight plan for VH-PAE.
Shortly after, the pilot was heard broadcasting on the common traffic advisory frequency by another pilot who departed Southport Airport at around the same time indicating they were overhead Pacific Fair (a shopping centre located at Broadbeach) at an altitude of 500 ft, northbound.
Two witnesses reported observing the aircraft tracking on the planned scenic route. The first witness was at Surfers Paradise beach (Figure 2) and observed the aircraft flying from west to east, then northbound along the coast (refer to section titled Witness observations). The second witness was near South Stradbroke Island on the 12th floor of an apartment building. That witness saw the track north along the beach towards South Stradbroke Island with two people on board.
Another pilot who recently departed Southport Airport, heard the pilot of VH-PAE broadcast on the common traffic advisory frequency that they were at Porpoise Point and heading seaward for aerobatics at 3,500 ft.
At about 0958, Department of Defence surveillance data recorded an aircraft over South Stradbroke Island, conducting operations with significant track and speed fluctuations, consistent with aerobatic manoeuvres. Altitude data was not available (refer to section titled Recorded information). About 7 minutes later, no further radar returns were recorded. Witnesses on the western side of South Stradbroke Island adjacent to Couran Cove, reported that they observed an aircraft consistent with VH-PAE conduct a 'loop, cut right, and dive below the tree line’, but did not recall anything else unusual about the aircraft.
When the aircraft had not returned to Southport after an hour, the second passenger became concerned and asked members of the Southport Flying Club if they had heard anything. At about 1310, a representative from the club contacted Airservices Australia about the overdue aircraft and at 1400, the Australian Maritime Safety Authority’s Joint Rescue Coordination Centre initiated search and rescue operations. At about 1630, part of the propeller (initial wreckage) was located on the eastern side of South Stradbroke Island (Figure 2). In the following days, the pilot and passenger, who sustained fatal injuries were recovered, along with additional wreckage.
Figure 2: Location of areas of interest for the flight (blue), witness locations (orange), and aircraft wreckage locations (yellow)
The pilot held a current Private Pilot Licence (Aeroplane) initially issued under Civil Aviation Regulations 5[2] in 4 July 2014 and transferred to the Part 61 licencing system on 23 May 2016. The pilot’s general aviation logbook showed a total flying experience of 412.4 hours to the last recorded flight on 31 May 2019, of which 39.4 hours were in VH-PAE.
The pilot had last completed a single‑engine aeroplane flight review on 17 January 2019, which included an aerobatic flight activity endorsement. This qualified the pilot to conduct spins and aerobatics at no less than 3,000 ft AGL. After obtaining this endorsement, the flying instructor discussed the requirements for obtaining a low-level aerobatic endorsement (below 3,000 ft) with the pilot. However, the pilot did not obtain this endorsement nor hold an operational rating for low‑level flying.
The Civil Aviation Safety Authority’s (CASA) Part 61 Manual of Standards outlined that, aerobatic flight activity endorsements require pilots to operate no lower than the minimum authorised height of 3,000 ft AGL. Once proficient, and then checked for competency to the requirements of the standards, there is a progressive reduction in the minimum authorised height to 1,500 ft AGL, 1,000 ft AGL, 500 ft AGL, and then unlimited.[3] This process requires pilots to demonstrate competence at, or above each level before attempting the next level.
The pilot also held a Recreational Aviation Australia (RAAus) pilot certificate, issued in February 1999, and had accumulated a total of 413.3 hours up to 29 May 2015 with this certificate. There was no logbook for the pilot’s RAAus flying available and no further update of flying hours was noted on the RAAus pilot licence file after this date.
Medical and pathological information
The pilot held a Class 2 Aviation Medical Certificate, valid until 1 May 2021, and was required to have vision correction available for reading while exercising the privileges of the licence. A review of the pilot’s aviation medical records found there was no information that indicated a medical event may have contributed to the accident.
The nature of the pilot’s and passenger’s injuries limited the information that could be obtained from a post-mortem examination. Due to the disruption to the aircraft, the accident was not considered survivable.
Pilot’s flying history
An acquaintance described the pilot as initially ‘being disciplined’, but this had slipped as the pilot became more familiar with the accident aircraft and began ‘pushing limits too fast and too soon’. Another acquaintance mentioned having concerns about the height the pilot flew aerobatics and attempted to communicate these concerns. There were also a number of occasions in the years prior to the accident where the pilot was observed performing low-level flying and aerobatic manoeuvres without holding the required qualifications:
In October 2013, the pilot received a written warning from RAAus about performing aerobatics in an RAAus registered aircraft, which was not permitted.
In November 2018, the pilot was observed to conduct low-level aerobatic manoeuvres in the accident aircraft at about 500 ft over a residential area near Southport Airport, which was counter to the ‘flying neighbourly'[4]policy. As a result, the pilot was issued with a verbal warning by the Southport Flying Club and advised that a repeat incident would result in a revoked membership from the club.
A friend of the pilot went for a flight in late April 2019. The friend reported flying low-level as they were at the same height as the buildings along the beach and conducting aerobatic manoeuvres. An analysis of the passenger’s video footage showed that the aerobatics were conducted below 1,000 ft and that elements of the flight were conducted as low as 260 ft based on the buildings in the area. The friend recalled that the pilot had commented about knowing how to safely do a barrel roll[5] while flying low-level. The pilot had also mentioned not being approved to conduct this manoeuvre at a low height and that if too much height was lost, it would be ‘impossible’ to recover.
About a week prior to the accident, the pilot was observed to enter the circuit at Boonah airfield inverted, estimated to be at about 1,300 ft by a witness.
Three days prior to the accident, another passenger who flew with the pilot reported the flight was lower than the height of the buildings on the Gold Coast. Images provided showed the flight was conducted below the height of numerous well-known buildings at that location, which was below 500 ft.
A review of the ATSB and CASA databases found no safety reports relating to the pilot. In addition, aside from the verbal warning, the Southport Flying Club had not received any other safety reports regarding the pilot’s flying.
Aircraft information
General
The Yakovlev Aircraft Factories Yak-52 is an all-metal, two-seat, low-wing aircraft, powered by an air-cooled M-14P radial engine driving a two-bladed, variable-pitch wooden propeller. The aircraft was manufactured with front and rear flight controls. The primary flight controls are located in the front cockpit and the secondary flight controls in the rear cockpit. About 1,800 Yak-52 aircraft were produced between 1977 and 1998, which was designed as a military trainer. In 2020, there were 51 Yak-52s registered in Australia.
The accident aircraft was manufactured in 1982 by Aerostar in Bacău, Romania. In 2002, the aircraft reached the end of its airframe life and was disposed of.[6] In about 2004, the aircraft was disassembled in Russia and imported to Australia. The aircraft was first registered with the Civil Aviation Safety Authority on 5 April 2017, and was registered to the pilot on 5 July 2018. The last periodic and associated inspections were carried out on 31 October 2018. The most recent entry on the maintenance release was 5 days prior to the accident (on 31 May 2019) and showed that the aircraft had accumulated 1,164.2 hours total time‑in‑service.
A review of the weight and balance found that the aircraft was within centre of gravity limits at the time of take-off. Further, the aircraft was not fitted with a transponder, nor was it required to be.
Airworthiness
The majority of ex-military (commonly referred to as warbirds) or replica aircraft in Australia were not designed and manufactured to any known civil aviation standard. These aircraft have been allowed to operate in Australia under a special certificate of airworthiness in the limited category.[7] The special certificate of airworthiness, issued for VH-PAE on 19 September 2017, indicated the aircraft was to be operated in day visual flight rules[8] conditions.
As an ex-military aircraft, under Civil Aviation Safety Regulation 1998 (CASR) Part 132 it was required to be administered by the Australian Warbirds Association Limited (AWAL). AWAL is a self-administering recreational aviation administering organisation operating under CASR Part 132. Part of their role was to provide oversight of this sector of warbird, ex-military and replica aircraft. As such, aircraft operated under CASR Part 132 must conform to the requirements of the AWAL exposition and self-administration manual. All persons who fly an AWAL administered aircraft are to be members of AWAL.
The AWAL contacted the ATSB shortly after the accident and stated that the aircraft was purchased in about May 2018 and that the aircraft’s annual renewal with AWAL subsequently expired. Sometime later, the aircraft was observed to be operating and after attempts to contact the new owner, this was reported to CASA. The aircraft’s annual AWAL renewal was subsequently paid and the new owner became a member of AWAL, in order to operate the aircraft.
There were different design and manufacturing standards of warbird aircraft in Australia. The aircraft was maintained in accordance with AWAL’s maintenance schedule, which included the applicable airworthiness directives. In addition, the AWAL maintenance schedule included structural integrity inspection requirements, carried out every 3 years. This specified that engine mount and landing gear welds be inspected by using a 10 times magnifying glass or with dye penetrant. Other listed inspection requirements were to be carried out to a depth that the maintenance organisation performing the work deemed necessary.
Airframe life and permit index
Airframe life limits for Yak-52s as defined by the Yakovlev Design Bureau were conditional on the aircraft being maintained in accordance with Yakovlev’s scheduled maintenance program. The airframe life for Yak-52s of the same specification as VH-PAE, was 1,000 flight hours or 5,000 landings in 20 years. In 2005, the Russian Central Aerohydrodynamic Institute (ЦАГИ) established an extension to the Yak-52 airframe life to 2,000 flight hours or 10,000 landings in 30 years. To support this extension, Yakovlev issued amendment 2 of the scheduled maintenance program for the Yak-52 on 9 September 2009 and the extension was conditional on the aircraft continuing to be maintained in accordance with the revised schedule. As VH-PAE and other imported Yak-52s stopped being maintained in accordance with any of the Yakovlev schedules when they were disposed of, the life extension did not apply.
Warbird aircraft in Australia, as part of their introduction to service, underwent a permit index (PI) assessment. CASA advisory circular Limited category aircraft - permit index (AC 21-25) outlined that this was a risk assessment procedure to:
…ensure that the risk is confined to the occupants of the aircraft, while protecting the general public from risk of harm or property damage.
PI assessments were initially carried out by CASA, who performed about two-thirds of these prior to their administration being transferred to AWAL in May 2007. At the time of its registration in Australia, VH-PAE was 15 years over its 20-year airframe life. A review of the other Yak-52s in Australia found that 40 per cent were over their airframe life limit at the time of registration. At the time of publication, and with the exception of some aircraft that have been modified to a tail-wheel configuration, the remaining Yak-52s registered in Australia had exceeded their airframe life.
PI numbers are issued to individual aircraft ranging from ‘0’ with no airport or populous area[9] restrictions (other than the normal airspace and air traffic control requirements), to ‘3’ where operations over populous areas were prohibited.
The assessment procedure takes into account a range of risk categories including fatigue history, repairs and modifications, installed equipment (i.e. ejection seats or external fuel), engine type, fuel capacity, stall speed, etc. The assessment adds or subtracts points against risk category elements. The total score determines the PI number. The risk category for fatigue history had the following elements:
history not known – deduct 130 points
airframe life exceeded – deduct 130 points
not applicable or airframe life within limits – no addition or subtraction of points.
Deducting 130 points, such as if the aircraft had an expired airframe life, would result in a PI assessment that would prevent operations of aircraft over populous areas.
The AWAL exposition and self-administration manual included a procedure for issuing a certificate stating an airframe life different to the aircraft’s currently approved airframe life.[10] It required the aircraft owner or registered operator to apply with the following information:
- the name of the applicant or registered operator - the make, model and registration of the aircraft - the approved airframe (fatigue) life of the aircraft - the expired fatigue life of the aircraft - how the fatigue has been measured - the operational history of the aircraft - the maintenance history of the aircraft - the proposed future use of the aircraft - whether it is proposed to use the aircraft for adventure flights - if a detailed inspection has been made of the aircraft structure, the reports of that inspection.
An assessment of the application by an AWAL approved person considered the following:
- the existing approved airframe life and the factors and assumptions on which it is based - the intended future operations of the aircraft - the operational and airworthiness history of the aircraft - the service history of: - other aircraft of the same type and model; and - other aircraft and structures of similar design - maintenance program findings - an assessment of the structure of the aircraft.
The AWAL approved person could issue a certificate stating a new approved airframe life if they were satisfied it would maintain an acceptable level of safety of flight.
In carrying out the PI assessment for VH-PAE, the risk category for fatigue history was recorded against the risk element ‘not applicable or airframe life within limits’, and included in the comment ‘No, fatigue life’. VH-PAE was assigned a PI of ‘0’ in 2017, and there was no record of a certificate stating an airframe life different to the existing approved airframe life being issued.
AWAL advised the ATSB that they did not regard the Yak-52 as having an airframe life as they had not been presented with documentation suitable to AWAL to define it, and from their experience they did not consider it to be an issue. AWAL further advised that, for this reason, a certificate to extend the airframe life of VH-PAE was not required, and that the PIs for other Yak‑52s were assessed as ‘0’.
In 1998, the United Kingdom (UK) Civil Aviation Authority (CAA) issued Mandatory Permit Directive[11] (MPD) 1998-017 to detail airframe life limitations and the overhaul life of the Yak-52 in the UK. It stated that:
Correspondence with the Design Authority, Yakovlev Design Bureau, has confirmed that there is an initial airframe life limit, which varies with the Series of the aeroplane.
The initial airframe life limit can be extended by the implementation of an approved maintenance and inspection programme.
The MPD defined the airframe life for Yak-52s as 1,000–1,500 flight hours or 5,000–7,000 landings in 15–20 years, depending on the modification status of the aircraft. AWAL advised they did not regard MPD 1998-017 as suitable data to define Yak-52 airframe life limits as they were not required to comply with data published by foreign authorities.
Fuel
The aircraft operated on aviation gasoline (AvGas) 100LL (91/96 octane) and had the capacity to carry 120 L in two 60 L wing tanks, with about 12 L being unusable. Southport Airport fuel records indicated that the pilot uplifted 75.22 L of AvGas prior to departure. A test of the fuel bowser found no issues with the fuel quality.
Meteorological information
Bureau of Meteorology
The nearest Bureau of Meteorology automatic weather station was located at the Gold Coast Seaway, about 12 km south from the last witness observation. At 1000 on the day of the accident, the station recorded the wind at 11 kt from a southerly direction and a temperature of 19.5°C.
Witness observations
Witnesses located near Couran Cove on South Stradbroke Island, at time of sighting the aircraft, described the conditions as ‘good’ visibility, with no cloud. There were light winds at the time, but wind gusts increased over the day.
Recorded information
Surveillance data was obtained from Airservices Australia (Mount Hargrave radar) and the Department of Defence (Mount Hargrave, Somerville and Amberley radars). As the aircraft was not fitted with a transponder, only primary radar returns[12] were available. The coverage will detect aircraft at, or above heights depending on the aircraft’s proximity to radar coverage and terrain shielding. Due to the limitations of primary radar and terrain shielding, there were gaps in the radar recording. An analysis of this data showed:
the aircraft was detected at 0946:43 departing Southport Airport and heading in a southerly direction
between 0952:13 and 0953:56, the aircraft was tracking in an easterly direction towards the coast
at 0955:27, the aircraft was tracking in a northerly direction towards South Stradbroke Island
until 0958:30, the aircraft had a relatively constant speed of around 120 kt, consistent with straight-and-level flight in a northerly direction along the beach
after 0958:30, the aircraft’s speed varied between 70 kt and 160 kt
between 1003:44 and 1004:30, the aircraft’s speed further reduced from 130 kt to 72 kt, and it was at or above 1,200 ft overhead South Stradbroke Island
the last detections between 1005:36 and 1005:48 were ‘tightly grouped’ indicating the aircraft was either at very low speeds or in a steep dive; the speed was below 60 kt, which could be attributed to the aircraft being in a vertical manoeuvre.
Department of Defence analysis of the aircraft’s recorded speed and heading variations indicated the manoeuvring was consistent with the conduct of aerobatics.
Witness observations
Several witnesses who observed the aircraft on the accident flight were interviewed by the ATSB. A summary of their recollections is provided below.
Surfers Paradise beach
At around 1000, a witness located at Surfers Paradise beach observed the aircraft turn and track along the beach in a northerly direction, conducting a manoeuvre consistent with a ‘split S’[13] turn. While tracking along the beach, the pilot then conducted another manoeuvre likened to an aileron roll.[14]
From the witness’ location, it appeared the aircraft was flying below the height of the buildings and was lower than other aircraft they had observed flying along the beach. Based on this, and a comparison of another aircraft present at the time of interview, VH-PAE was estimated to be flying between 200-300 ft.
The witness also recalled that the aircraft’s speed and engine sound was constant and there did not appear to be anything unusual. Further, the weather was described as ‘fine’, with a southerly wind.
Apartment building near South Stradbroke Island
Between 1000-1100, a witness on the 12th floor balcony of their apartment saw the aircraft tracking in a northerly direction along the coast, flying straight-and-level. The aircraft was at the same height as their floor, at an estimated 100-200 ft, which was lower than aircraft usually flying in that area and direction.
Couran Cove
Around 1100,[15] witnesses were on their houseboat on the western side of South Stradbroke Island near Couran Cove, about 5 km south of the Jumpinpin channel. On the south-east side of the island, they observed an aircraft consistent with the accident aircraft conduct a ‘loop’, ‘roll’, then ‘cut’ right, and then dived behind the tree line. The aircraft did not appear to lose height after conducting the loop. The witnesses did not recall any unusual engine noises, nor did they see or hear anything that suggested the aircraft had collided with water.
Wreckage and impact information
Search area and recovered wreckage
The Australian Maritime Safety Authority and Gold Coast Water Police initiated a search for the aircraft and occupants. The search zones were around North Stradbroke Island and to the north‑east coastline of South Stradbroke Island, including the Jumpinpin channel (Figure 3). The search was interrupted for several days due to poor weather conditions. When the search resumed, it focussed on the South Stradbroke Island area, where most of the recovered wreckage was found.
Figure 3: Search area
Source: Google Earth and Queensland Police Service, modified by the ATSB
The recovered wreckage, depicted in Figure 4, included:
a number of wooden propeller blade fragments (A)
the fuselage skin and structure from the left side of the rear cockpit (B)
the tail section consisting of the rear fuselage and the inboard sections of the horizontal and vertical stabilisers (the tail section was found attached to the rear cockpit by the flight control cables) (C)
the nose landing gear, its associated components and mounting structure (this structure formed the floor of the front cockpit and included the front cockpit rudder pedals) (D)
a number of components from the front and rear cockpits, with the rear cockpit in place but significantly disrupted (E)
a section of the right wing inboard leading edge (F)
a section of the left-wing trailing edge adjacent to the aileron (G).
In addition, a seat cushion base and back, and the pneumatic system main and emergency storage tanks were also recovered.
Figure 4: Shaded areas showing the wreckage recovered from VH-PAE
The recovered wreckage was transported to secure facilities at the Gold Coast Water Police station for examination by the ATSB. That examination identified that the left-wing rear mount was present with a section of the wing structure.[16] The failure of the wing structure was likely to have been due to overstress and the failure surfaces had been eroded during their time in the ocean prior to recovery.
The left-wing trailing edge included the hinge point for the left aileron and the hinge bracket from the left aileron. The cut-out for the left flap was present along with a section of the wing upper surface skin. The inboard section of the upper surface was torn in an irregular fashion. The outboard section of the upper surface was torn along a rivet line.
The right-wing skin had been torn away from the spar. There was significant disruption to the leading edge. The right-wing fuel tank had been ejected from this section. Remnants of its mounting frames and straps were present. The impact damage to the aircraft meant it was not possible to determine the quantity or quality of the fuel on board prior to the accident. The majority of the lower surface of the recovered wreckage was the right-wing fuel tank access panel. This panel showed evidence of surface hydraulicing,[17] likely resulting from the impact with the water.
Examination of the tail section of the aircraft found the right horizontal stabiliser was extensively damaged with its forward and rear spars bent rearwards and stabiliser skin torn away from the structure (Figure 5). The centre hinge for the elevator was bent inboard. The left horizontal stabiliser had tearing mid-span, but otherwise it retained its original form. The vertical stabiliser was extensively damaged with most of its upper section missing. Further, the wreckage examination identified two small cracks on either side of the elevator bellcrank at a change in section (refer to section titled Bellcrank examination).
Figure 5: Tail section damage
Source: ATSB
A significant amount of the aircraft structure and systems were not recovered. However, from the wreckage available for examination, there was no evidence of any pre-impact failures. The significant disruption to the aircraft was indicative of a high-speed impact with significant impact forces, which were not considered survivable.
Elevator bellcrank assembly
Bellcrank examination
The elevator bellcrank is primarily loaded in the vertical plane and transmits the forward and rearward pilot inputs on the control column through the cables to control elevator movement. The ATSB’s initial examination of the elevator bellcrank identified two small cracks on either side at the location identified in previously published airworthiness directives (refer to section titled Airworthiness requirements) (Figure 6). The larger crack on the right side (aft looking forward) was relatively straight and extended about 3 mm across the rear face of the bellcrank and 10 mm along the side. A number of small indents were observed in the region of the crack. Closer examination of the crack on the left side revealed that it was two smaller cracks. One crack was located on the rear face corner, extending about 1 mm each direction, and the other followed the machined radius and extended for about 7.5 mm.
In order to perform further analysis on the cracking, the bellcrank was fractured to examine and categorise the cracks. This examination identified that the smaller cracks on the left (aft looking forward) showed features consistent with fatigue and were likely present prior to the accident. The larger crack’s features were predominantly consistent with overstress as a result of the accident.
A chemical analysis of the bellcrank found it had been manufactured from AK-4 aluminium alloy, which may have been an earlier specification due to the age of the aircraft. The most recent design specification was for the bellcranks to be manufactured from AK-6 aluminium alloy. The radius at the change in thickness from the inner to the outer section of the bellcrank was relatively consistent with that specified on the supplied engineering drawings from the manufacturer.
Figure 6: Elevator bellcrank cracks observed on VH-PAE
Source: ATSB
Previous Yak-52 elevator bellcrank failure
On 19 September 2010, in Yekaterinburg, Russia, a Yak-52 conducting aerobatics was observed by witnesses to enter a steep descent. The pilot reported a broken cable within the aircraft. The pilot was unable to regain control and the aircraft collided with terrain. The pilot was fatally injured and the aircraft was destroyed in a post-impact fire. The investigation outcomes were detailed in a paper published by the Russian Association of Independent Aviation Accident Investigators.
An examination of the wreckage found that the elevator bellcrank had fractured through the inner section, adjacent to the change in section from the inner to the outer section (see Appendix - Photographs of the elevator bellcrank from the 2010 accident). Examination of the fracture surface showed it was consistent with a fatigue failure. The bellcrank was found to have been correctly manufactured from AK-6 aluminium alloy according to the design specification for this aircraft having been manufactured in 1990. The paper concluded that high operational cyclic stresses had influenced the development of the fatigue crack, along with multiple aspects relating to the manufacture of the elevator bellcrank including:
a radius at the change in section (thickness) on the bellcrank was smaller than that specified in the engineering drawings
when manufactured, the radii on either side of the bellcrank were incorrectly aligned (Figure 7)
an unfavourable (lateral) microstructure orientation[18]
rough machining surface at the crack origin.
Figure 7: The bellcrank from the Yak-52 involved in the 2010 Yekaterinburg accident showing misalignment of the radii and incorrect radius at the change in section
Source: Society of Independent Air Accident Investigations, modified by the ATSB
The Russian investigation examined an elevator bellcrank from an exemplar aircraft that was manufactured around 1985. This bellcrank was cracked in the same area, had manufacturing defects, and was manufactured from AK-4 specification aluminium alloy. It was noted this may have been an earlier specification due to the age of the aircraft.
Airworthiness requirements
While the presence of the pre-existing cracks did not contribute to the accident involving VH-PAE, they were coincident with the location identified in the airworthiness directives and a service bulletin issued by Lithuania and the UK. Mandatory Permit Directive MPD 2000-004 was issued by the UK Civil Aviation Authority in July 2000 and was based on the Lithuanian airworthiness directive CAI‑TSD-007/2000 issued in May 2000. The Lithuanian directive was prompted by the identification of a 19 mm crack found in the elevator control pulley of a Yak-52 during an inspection. The CAA of New Zealand also had an airworthiness directive (DCA/YAK/5) related to elevator bellcrank inspections based on the UK document.
The MPD 2000-004 directive was listed as a special inspection in the AWAL Yak-52 maintenance schedule, which required the bellcrank to be inspected using dye penetrant at every periodic inspection (100 flying hours or 12 months). If cracks were identified, no further flight was permitted until the bellcrank was replaced. The aircraft was inspected in accordance with MPD 2000-004 on 31 October 2018, and since then flew about 35 hours prior to the accident.
In 2009, Yakovlev issued amendment 2 of the scheduled maintenance program for the Yak-52, which extended the airframe life of the aircraft. Among the changes was the requirement for the elevator bellcrank to be inspected at intervals of 25 ± 5 flying hours, and if cracks were detected, then no further flight was permitted until the bellcrank was replaced.
As a result of the Yekaterinburg fatal accident in 2010, Yakovlev issued a letter in 2011 reiterating the requirement for dye penetrant inspections of the elevator bellcrank every 25 ± 5 flying hours, and for the aluminium alloy bellcranks to be replaced with bellcranks manufactured from 30KhGSA (30ХГСА) specification steel.
In 2012, Yakovlev issued service bulletin 121-BD (121-БД), which required all remaining aircraft with aluminium alloy bellcranks to be replaced with steel bellcranks no later than December 2012. The dye penetrant inspection interval of 25 ± 5 flying hours, as specified by amendment 2 of the Yak-52 scheduled maintenance program, remained in place for steel bellcranks.
Despite the significance of these changes in response to the accident in 2010, AWAL was not aware of these changes and therefore had not been incorporated into maintenance schedules in Australia.
Accessing airworthiness information
The Yakovlev Design Bureau provided upon request, airworthiness information such as maintenance requirements, the airframe life, and general support for Yak-52 aircraft both within Russia and overseas. Some Yak-52 aircraft, such as VH-PAE, being operated outside of Russia had reached the end of their prescribed airframe life and were no longer supported by Yakovlev. Therefore owners, operators and maintainers of these aircraft relied on local formal requirements such as MPD 2000‑004, their peers, and unofficial sources such as the internet for maintenance information.
The ATSB asked representatives from the UK CAA, CAA of New Zealand, CASA, AWAL, and maintenance organisations about their knowledge of service bulletin 121-BD. They indicated that:
The UK CAA advised the ATSB they were aware of the service bulletin and associated documents. One of which was taken as the basis for the acceptability of steel bellcranks as replacements for the original aluminium in the Yak-52s operating in the UK. They also advised that some UK operators were continuing with the inspections in MPD 2000-004 even with the steel component fitted.[19] Furthermore, they had no plans to withdraw MPD 2000-004 as there may be aircraft in the UK for which the requirements remained applicable but were updating it to align with the service bulletin, including acknowledgement of the steel replacement.
The CAA of New Zealand were unaware of the service bulletin. Prior to the issue of airworthiness directive, DCA/YAK/5 in 2012, they contacted the UK CAA and adopted the requirements of MPD 2000-004.
The Civil Aviation Safety Authority advised they were unaware of the requirements of the bulletin and there were challenges in obtaining information for Russian aircraft.
The AWAL advised they were also unaware of the requirements but would consider incorporating them into the AWAL Yak-52 maintenance schedule.
Similarly, two aircraft maintenance engineers who specialised in maintaining warbird aircraft advised they were unaware of the requirements but were aware that some Yak-52 aluminium bellcranks were being replaced with steel bellcranks.
In consideration of the minimal awareness of the service bulletin, the ATSB issued a safety advisory notice (AO-2019-027-SAN-024) on 25 November 2020. The purpose of the notice was to remind maintainers and operators of the importance of dye penetrant inspections to identify and remove defective bellcranks from service. The notice also noted that Russia, as the aircraft’s state of design, increased their inspection frequency to 25 ± 5 flying hours and that aluminium alloy bellcranks were no longer approved for use on Yak-52s operating in Russia.
Operational information
Pre-flight briefings and informed participation
Warbirds can be used for private operations provided that any passengers who are carried are given a safety briefing. Civil Aviation Safety Regulation Part 132 required a safety briefing to ensure that a person flying in the aircraft was fully informed of the risks associated with the aircraft and given the opportunity to make a properly informed decision to accept the risks.
According to the CASA advisory circular Limited category aircraft - operation (AC 132-01), all limited category aircraft were required to clearly display the word ‘limited’ on the outside near the entry to the aircraft. In addition, a further safety warning was required to be displayed in a position visible to the pilot and passenger:
WARNING
PERSONS FLY IN THIS AIRCRAFT AT THEIR OWN RISK
THIS AIRCRAFT WAS NOT DESIGNED FOR AIR TRANSPORT OPERATIONS AND IS NOT REQUIRED TO BE OPERATED TO THE SAME SAFETY STANDARDS AS AN AIRCRAFT USED FOR AIR TRANSPORT OPERATIONS
The aircraft had both these displayed in the required areas.
The basis of informed participation in Australia relies on the premise that passengers make themselves aware of the potential risks of undertaking the planned activity, are briefed on the risks, and are given ample time to consider the consequences of accepting these risks. Warbird aircraft are not designed to meet civil aviation airworthiness standards and were constructed for role specific military purposes, therefore, it is important that pilots and passengers of these aircraft are aware that they do not meet conventional airworthiness standards.
The Yak-52 flight manual also specified that a pre-flight briefing must be conducted before any passenger-carrying flight. This should include, explanation of the flight controls and instruments, fitment and operation of the harness, demonstration of the operation of the canopy, and use of the in-cockpit communications system. The second passenger confirmed that the passenger was briefed by the pilot prior to departing on harness operation, remaining clear of the flight controls, and the risk of loose articles in the cockpit. The detail included in the passenger’s briefing met the requirements of being informed.
Cost sharing
The flight was conducted under a private cost sharing arrangement, whereby operating costs for the aircraft where shared between the passenger and pilot towards the running of the aircraft for the flight. This was to be the same arrangement for the second passenger, awaiting the return of the aircraft back to Southport Airport.
Yak-52 aerobatic manoeuvring warnings
The aircraft had G load[20] limits of +7g to -5g and a never exceed speed (VNE) of 227 kt. The pilot’s operating handbook stated that all aerobatic manoeuvres ‘must be conducted at a safe height, not over built-up areas and with a pre-determined lower limit for leaving the aircraft [if a parachute is worn] if the manoeuvre cannot be recovered from’. The handbook also contained several warnings regarding specific aerobatic manoeuvres:
[Dynamic stall][21] Achieved usually through mishandling in tight turns or a too abrupt pull up. A buffet precedes the stall, and the stall is characterized by the aircraft sharply breaking to an unusual flight attitude.
All spinning must be done at a safe altitude with a predetermined bail out height…All spinning must be carried out at an altitude where recovery can be made by 1000m agl (3300 ft agl).
It is not difficult to get into a flat spin through a mishandled stall turn particularly when, as is normally the case, power is kept on. …some aircraft, after a fully developed flat spin…will NOT recover with the conventional spin recovery [techniques].
If practicing spinning, total height loss can be dramatic and even with absolutely correct recovery procedures, height loss can be in excess of 2000 ft and a bit more to level regain flight.
The manual further stated that, irrespective of how many flying hours a pilot had on other aircraft types, it was advisable to receive ‘proper instruction’ from an experienced instructor who was ‘completely familiar’ with the Yak-52, particularly in relation to flat spin recovery.
Risks associated with aerobatics
Low-level aerobatics
Conducting manoeuvres at low-level significantly increases the risk of collision with terrain if the manoeuvre is not correctly executed. For example, the Yak-52 pilot’s operating handbook indicated that greater than 2,000 ft may be required to recover from a spin. The CASA Civil Aviation Advisory Publication (CAAP) 155-1(0), Aerobatics, provided guidance on the rules relating to aerobatic flights and information about the safety risks involved when performing such operations.
As well as detailing the minimum height aerobatics shall be conducted, the CAAP also discusses the risks of low-level aerobatics. Specifically, the CAAP stated that:
Aerobatics at low-level obviously entail a higher degree of risk because of the reduced safety margins for recovery from manoeuvres. A low-level aerobatics permission should be issued not just because the holder has appropriate aerobatic skills, but because he or she has the ability to assess and manage the risks involved in low-level aerobatics, particularly the risks to third parties.
…It is highly probable that the consequence of an error or failure during low-level aerobatics will be fatal to the participants…
Physiological effects
As highlighted in CAAP 155-1(0), ‘Aerobatic manoeuvres involve rapid changes in speed and direction which impose significant accelerative forces on the aircraft and pilot. The physiological effects of these G forces can range from minor discomfort to loss of consciousness’. Such effects may include:
Grey-out: Loss of colour perception and clarity, possibly accompanied with a loss of peripheral vision during high positive G loads.
Tunnel vision: A concentric narrowing of the field of vision following grey-out.
Black-out: The field of vision narrows completely, and vision is lost.
G-induced loss of consciousness: Occurs when the blood flow to the brain, and therefore the supply of oxygen, is sufficiently reduced by the positive G forces being experienced. A high negative G for a significant period may also have a similar effect.
G incapacitation: There will be a short period of total incapacitation where the pilot is completely unconscious. This is followed by a recovery period of relative incapacitation where the pilot regains consciousness but is in a confused state and unable to control the aircraft.
Unless the aircraft has sufficient height for the pilot to reduce G, and recover vision and/or consciousness, there is a risk of collision with terrain (United States Federal Aviation Administration n.d.).
Risk perception and interventions for unsafe behaviour
Unsafe acts are an error or violation committed in the presence of a potential hazard, that if not properly controlled, could cause injury or damage (Reason 1990). Examples of unsafe acts include violations, which are deviations from practices to maintain safe operations. Research conducted by Shuch (1992) reported that pilot perception of risk may decrease with repeated successful outcomes. Shuch (1992) found that if a pilot has a history of flights without incident, then they may perceive that they have a lower likelihood of an adverse outcome based on their prior incident-free experiences.
If there are concerns about a pilot’s behaviour from a safety perspective, there are formal reporting systems available to industry people and the general public. These include:
Reporting to the local flying club or aerodrome operator.
Reporting to the ATSB using the voluntary and confidential reporting scheme (REPCON). This scheme allows any person who has an aviation safety concern to report it to the ATSB confidentially. Safety concerns include an incident or circumstance that affects or might affect the safety of aircraft operations. Once submitted, the report is de-identified to protect the reporter and forwarded to the relevant organisation that is best placed to address the issue.
Reporting unsafe behaviour to CASA using their confidential and anonymous reporting scheme. When a report is made, CASA is obliged to act on valid reported safety related information.
Similar occurrences
A search of the ATSB’s occurrence database found the following investigations relating to low‑level aerobatics.
On 5 October 2018, a BRM Aero Bristell light sport aircraft, registered VH-YVX, departed Moorabbin Airport, Victoria, with a pilot and passenger on board. The purpose of the flight was a navigation exercise in support of the pilot’s commercial pilot training requirements. Following an overfly of the intended waypoint at Stawell Airport, the aircraft was observed by witnesses to conduct a number of aerobatic‑type manoeuvres before control was lost. The pilot was unable to recover control of the aircraft before it impacted terrain. The occupants sustained significant injuries and the aircraft was destroyed.
The ATSB determined that, contrary to the aircraft’s limitations and the pilot’s qualifications, aerobatic manoeuvres were conducted during the flight, and immediately prior to the loss of control. During one of these manoeuvres, the aircraft experienced an accelerated aerodynamic stall and entered into an upright spin at an altitude of about 1,650 ft AGL, which then progressed into a fully‑developed spin. Although the pilot did not consistently apply the manufacturer’s recommended spin recovery technique, recovery from a fully‑developed spin may not have been possible in the aircraft type.
On 7 September 2018, the pilot of a Yakovlev 9-UM (YAK 9) aircraft, registered VH-YIX, departed Latrobe Airport, Victoria for a local private flight. The aircraft was observed by witnesses to the north of Moe performing aerobatic maneuvers. A short time later, the aircraft impacted the ground in a steep nose‑down attitude, fatally injuring the pilot and destroying the aircraft.
The ATSB found that the aircraft entered a spin at low altitude (below 1,000 ft) from which it was not possible to recover. There was no evidence of pilot incapacitation, or a mechanical fault with the aircraft that contributed to the accident. Although possessing an aerobatic endorsement, the pilot did not hold the endorsement to conduct aerobatics below 3,000 ft. The pilot had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. The pilot was therefore likely unaware of its unique handling characteristics and not adequately prepared to conduct the solo aerobatic flight.
On the afternoon of 8 July 2015, the pilot of an amateur-built Pitts Model 12, registered VH‑JDZ, took off from Maitland Airport, New South Wales. Witnesses observed the aircraft at the top of what appeared to be a vertical climb. The aircraft slid backwards, tail first, before entering a horizontal spin. Shortly after, the witnesses lost sight of the aircraft below the tree line and some reported hearing a loud bang. The aircraft had collided with terrain in thick bushland. The pilot was fatally injured and the aircraft was destroyed.
Radar data and witness reports were consistent with the aircraft being used for aerobatic manoeuvres in the minutes prior to the accident, with some of the flight being conducted below 200 ft AGL. The ATSB found that, for reasons that could not be determined, VH‑JDZ entered a vertical manoeuvre from which the pilot did not regain control before colliding with terrain. The pilot had trained for aerobatics, but did not hold an aerobatic endorsement and the aircraft was being flown at a height that reduced the time available to recover from a loss of control, if required.
In the morning, the pilot and passenger departed Southport Airport, Queensland, on a private aerobatic flight in VH-PAE. During the flight, while near South Stradbroke Island, the aircraft collided with water. Both occupants sustained fatal injuries and the aircraft was destroyed.
While the aircraft in its entirety could not be located, examination of the recovered wreckage did not identify any pre-existing defects that would have contributed to the accident. Similarly, witness observations shortly before the accident suggested that there no mechanical issues with the aircraft at that time.
This analysis will examine the known events leading up to the accident, the pilot’s previous history conducting low-level aerobatic flights, and the opportunities available for aviation industry personnel to provide intervention. Further, the fatigue cracking of the elevator bellcrank, the availability of updated airworthiness information for Yak-52 aircraft operating outside Russia, and the aircraft life limits and assigned permit index will also be discussed.
Flight prior to the collision with water
The plan was to conduct a scenic flight along the coast with some aerobatics. This was consistent with witness comments, where a number of aerobatic manoeuvres was observed being conducted below 500 ft during the accident flight. In addition, Department of Defence surveillance data recorded an aircraft manoeuvring over South Stradbroke Island in a manner consistent with aerobatics and with the timing for VH-PAE. No altitude data was detected, which was consistent with the fact that the aircraft was not fitted with a transponder. However, as the aircraft was not detected by the radar numerous times, this indicated it was either below the radar coverage of three local radar sites and/or due to terrain shielding. Despite this, in the absence of recorded data or witnesses to the collision with water, it could not be determined with certainty that the pilot was conducting an aerobatic manoeuvre immediately prior to impact, but it was considered possible.
The significant amount of disruption to the aircraft, and the limited wreckage recovered, indicated the aircraft impacted the water at high speed. The damage to the right horizontal stabiliser and the vertical stabiliser suggested the aircraft entered the water inverted with its right wing down. However, in contrast, the hydraulicing found on the lower surface of the right wing suggested an upright attitude. In light of this conflicting evidence, the exact orientation of the aircraft when it collided with the water could not be determined.
However, due to the limited evidence available at the time of the accident, the ATSB was unable to consider a number of potential factors that could explain why the aircraft collided with the water. These included inadvertent passenger interference with the flight controls, loose articles interfering with the flight controls, an engine failure, partial or full pilot incapacitation possibly due to the physiological effects of conducting aerobatics, an aerodynamic stall, or otherwise mishandled manoeuvre.
Pilot’s history with low-level aerobatics
The pilot had obtained an endorsement to conduct aerobatics and spinning above 3,000 ft about 6 months prior to the accident. However, the pilot did not hold a low-level aerobatic endorsement or an operational rating for low-level flying. Despite this, witnesses and previous passengers had observed the pilot conduct aerobatics below the endorsed height, including on the accident flight. It was also noted that one of these flights had been conducted prior to the pilot receiving the endorsement. Research has shown that the perception of risk can decrease with repeated successful outcomes, which, in this case, may have reinforced the pilot’s behaviour.
In addition, while the pilot was made aware of the requirements for low-level aerobatic training by a flying instructor, the investigation found no evidence that the pilot had received any training toward this. The aerobatic endorsement process outlined in the Civil Aviation Safety Authority’s (CASA) Manual of Standards provided the means for the pilot to conduct training and be assessed for aerobatics at lower heights. If this process had been followed, the pilot would have had further opportunities to learn how to identify and manage the risks specific to low-level aerobatic manoeuvres.
As previously discussed, it could not be determined whether low-level aerobatics was being conducted at the time of the accident. Irrespective, performing these manoeuvres reduces the safety margins to recover from mishandled manoeuvres and adverse physiological effects, which substantially increases the risk of an accident.
Interventions for unsafe acts
Despite not being appropriately qualified, the pilot was observed conducting low-level aerobatics on several occasions prior to the accident by different people from within the aviation industry. While some people attempted to communicate their concerns about risk-taking behaviour to the pilot, there was no evidence found that the pilot’s behaviour had been reported to the ATSB or CASA. Direct intervention with a person observed to be engaged in unsafe flying behaviour can be challenging. For example, it can lead to defensive behaviour and an adversarial situation with a negative outcome for both parties. Therefore, confidential reporting systems such as that provided by the ATSB and CASA provide a means to escalate concerns about pilot behaviour and provide protection for the source of the report.
Elevator bellcrank fatigue crack
Examination of the elevator bellcrank found two small pre-existing fatigue cracks located adjacent to a change in thickness from the inner to the outer section of the bellcrank. The location of these cracks was coincident with the location identified in the United Kingdom Civil Aviation Authority Mandatory Permit Directive MPD 2000-004. As per the Australian Warbirds Association Limited maintenance schedule for the aircraft, which included the requirement to carry out MPD 2000-004, a dye penetrant inspection had been performed on the bellcrank about 35 hours prior to the accident. However, the ATSB was unable to determine when the cracking initiated.
While the cracking did not contribute to the accident, if it had not been identified during subsequent inspections, the crack would have eventually progressed to failure and almost certainly resulted in a loss of control.
Access to information for continued airworthiness
As some Yak-52 aircraft being operated outside of Russia had reached the end of their prescribed airframe life, they were no longer supported by Yakovlev. Therefore, the airworthiness requirements for these aircraft were determined independently by owners, operators and maintainers who relied on local formal requirements such as MPD 2000-004, their peers, and unofficial sources such as the internet for maintenance information. Consequently, these airworthiness requirements had remained relatively unchanged since 2000. This was evident from discussions with a number of relevant parties, including CASA, the Australian Warbirds Association Limited, maintainers, and operators who were not aware of service bulletin 121-BD and the preceding documentation relevant to the elevator bellcrank. In addition, it was not clearly understood that after replacing an aluminium elevator bellcrank with one manufactured from steel, the requirement for dye penetrant inspections still applied.
In accordance with the Australian airworthiness requirements at the time, the aircraft’s elevator bellcrank was inspected about 35 hours prior to the accident. The manufacturer’s most recent requirements had a shorter inspection interval, which would have resulted in the bellcrank being inspected again about 10 hours prior. However, as it could not be determined when the cracking initiated, it was unknown if the cracks would have been identified had that inspection occurred.
Despite this, not having a formal communication mechanism outside of Russia for those aircraft no longer supported, increased the risk that important information about the continued airworthiness of the Yak-52 aircraft might not be identified, which could potentially lead to in‑service failures.
Airframe life and permit index assessment
At the time the permit index assessment for VH-PAE was carried out by the Australian Warbirds Association Limited (AWAL), the aircraft was 15 years older than its prescribed airframe life of 20 years. A further 40 per cent of Yak-52s registered with AWAL had also exceeded their airframe life at the time of registration. Despite this, the aircraft, including VH-PAE, were assigned a permit index of ‘0’, which meant that they could be operated over populous areas.
While AWAL had a life extension procedure that could be applied to an aircraft that exceeded its airframe life, they did not regard the Yak-52 as having an airframe life as they had not been presented with documentation they considered suitable to define it, and from their experience they did not consider it to be an issue. However, the United Kingdom Civil Aviation Authority Mandatory Permit Directive (MPD) 1998-017 defining Yak-52 airframe life limits had been produced with the assistance of Yakovlev. Although Yak-52 aircraft in Australia were not required to comply with the airworthiness requirements of foreign authorities, the existence of an airframe life limit could be established from this directive to guide the AWAL permit index assessment.
The AWAL exposition and self-administration manual permit index assessment procedure, and if needed, the airframe life extension procedure, partly depended on the extent and quality of information provided by the aircraft owner to the approved person carrying out the assessment. However, the procedures were intended to ensure that the risk in operating warbird aircraft such as VH-PAE was confined to the occupants of the aircraft, while protecting the general public from risk of harm or property damage. By not formally considering risk elements contained within the permit index assessment, an acceptable level of safety could not be assured.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the collision with water involving Yakovlev Aircraft Industries Yak-52, VH-PAE, near South Stradbroke Island, Queensland, on 5 June 2019.
Contributing factors
While conducting an aerobatic flight, which included low-level manoeuvres, for reasons undetermined, the aircraft collided with the water at high speed.
Other factors that increased risk
The pilot was not trained or endorsed for low-level aerobatics but conducted them on the accident flight and previous flights. This behaviour increased the risk of an accident from either a mishandled manoeuvre or adverse physiological effects.
The pilot had previously performed unsafe acts that were witnessed by people from the aviation industry. While the pilot did receive previous warnings, there were other opportunities and means for people to formally communicate and escalate their concerns that were not used.
A pre-existing fatigue crack was found in the elevator bellcrank, which had the potential to fail in-flight and lead to a loss of control.
There was no formal mechanism for the state of design to provide airworthiness information for Yak-52 aircraft that had reached the end of their prescribed airframe life. This resulted in updated information regarding the elevator bellcrank inspection interval and design not being known or included in local maintenance schedules.
The Australian Warbirds Association Limited did not consider Yak-52 aircraft to have an airframe life, and therefore, they were assigned a permit index of zero, which allowed flight over populous areas. However, there was information available from Yakovlev via the United Kingdom Civil Aviation Authority that detailed airframe life limits.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions will be provided separately on the ATSB website on release of the final investigation report, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website after the release of the final report as further information about safety action comes to hand.
Safety action not associated with an identified safety issue
Safety advisory notice to owners and maintainers of Yak-52 aircraft
In November 2020, the Australian Transport Safety Bureau issued a safety advisory notice to owners and maintainers of Yak-52 aircraft:
Given the known fatigue cracking and potential failure of Yakovlev Aircraft Factories Yak-52 elevator bellcranks manufactured from aluminium alloy, the ATSB reminds maintainers and operators of the importance of dye penetrant inspections to remove defective bellcranks from service. The ATSB would also like to ensure that operators and maintainers of Yak-52 aircraft are aware that Russia, the aircraft’s state of design, increased the inspection frequency for the bellcranks to 25 ± 5 flying hours. Further, aluminium alloy bellcranks are no longer approved for use on Yak-52s operating in Russia.
Glossary
AGL Above Ground Level
AWAL Australian Warbirds Association Limited
CAAP Civil Aviation Advisory Publication
CAA Civil Aviation Authority
CASR Civil Aviation Safety Regulation
CASA Civil Aviation Safety Authority
MPD Mandatory Permit Directive
PI Permit index
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Federal Aviation Administration n.d. Acceleration in Aviation: G-Force. Federal Aviation Administration.
Schuch, HP 1992, The influence of flight experience on midair collision risk perception. Accident Analysis & Prevention, vol. 24, pp. 655-660.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Civil Aviation Safety Authority
witnesses
maintenance organisation for VH-PAE
Interstate Aviation Committee (MAK)
Yakovlev Design Bureau
Department of Defence
Airservices Australia
Australian Warbirds Association Limited
Southport Flying Club
United Kingdom Air Accidents Investigation Branch
Civil Aviation Authority of New Zealand
Dutch Safety Board.
Responses were received from the:
Civil Aviation Safety Authority
Interstate Aviation Committee (MAK)
United Kingdom Air Accidents Investigation Branch
Australian Warbirds Association Limited.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendix
Appendix - Photographs of elevator bellcrank from the 2010 accident
Figure 8: Yak-52 elevator bellcrank from the 2010 Yekaterinburg accident
Source: Society of Independent Air Accident Investigators, modified by the ATSB
Figure 9: Fatigue fracture zones on the elevator
Note: The various zones indicate the different fatigue fracture characteristics.
Source: Society of Independent Air Accident Investigators, modified by the ATSB
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 19/07/2019
Sequence of events
On 5 June 2019, a Yakovlev Aircraft Factories Yak-52, registered VH-PAE, was conducting a private flight from Southport airfield, Queensland. The aircraft departed the airfield at about 0945 Eastern Standard Time (EST),[1] with a pilot and one passenger on board. The flight was intended to take about 30 minutes, and include a low-level scenic flight north along the coast from Broadbeach to the Jumpinpin channel area, and then seawards off Jumpinpin for some aerobatic manoeuvres, before returning to Southport airfield (Figure 1). A second passenger was waiting at the airfield to complete a similar trip once the aircraft had returned.
When the aircraft had not returned by the designated time, the second passenger became concerned and started asking members at the Southport Flying Club if they had heard anything. At about 1310, a representative from the club contacted Airservices Australia about the overdue aircraft and at 1400, the Australian Maritime Safety Authority’s Joint Rescue Coordination Centre initiated search and rescue operations. At about 1630, part of the propeller was located on the eastern side of South Stradbroke Island. In the following days, additional wreckage was also recovered from the same location, as well as the pilot and passenger, both of whom had been fatally injured.
Figure 1: Map highlighting locations of interest for the proposed flight of VH-PAE
Source: Google earth, annotated by the ATSB
Pilot information
The pilot held a current Private Pilot Licence (Aeroplane) issued on 23 May 2016. The pilot also held a Class 2 Aviation Medical Certificate that was valid until 1 May 2021. The available information from the pilot’s logbook indicated that he had about 490 hours total aeronautical experience, including 38 hours in VH-PAE. The pilot had received both a spinning and aerobatic endorsement in January 2019.
Aircraft information
The Yakovlev Aircraft Factories Yak-52 was an all-metal, two-seat, low-wing aircraft, powered by an air-cooled radial M-14P engine driving a two-bladed, variable-pitch wooden propeller. VH-PAE (Figure 2) (serial number 822001) was manufactured in 1982 and first registered with the Civil Aviation Safety Authority on 5 April 2017. The aircraft was registered to the pilot on 5 July 2018.
The most recent entry on the maintenance release was 5 days prior to the accident (on 31 May 2019) and showed that the aircraft had accumulated 1,164.2 hours’ total time‑in‑service.
Figure 2: VH-PAE
Source: Matthew Coughlin
Wreckage information
The items of wreckage recovered were taken to a secure facility by the Queensland Police Service for examination by the ATSB. These items included:
a section of the left side of the fuselage and the tail section (Figure 3)
a section of the right wing
two seat cushions
pneumatic system cylinders
a number of wooden propeller pieces.
The initial examination found that the tail of the aircraft exhibited significant damage on the vertical and right horizontal stabilisers, and it had remained attached to the fuselage by flight control cables. The significant disruption to the aircraft was indicative of a high-speed impact.
The ATSB removed a number of components from the wreckage for further examination, including various instruments from the fuselage section. The aircraft was not equipped with a flight data or cockpit voice recorder, nor was it required to be.
Figure 3: Some of the recovered pieces of VH-PAE
Source: ATSB
Ongoing investigation
The investigation is continuing and will include consideration of the following:
recovered aircraft components
aircraft maintenance documentation
pilot qualifications, experience, and medical history
weather conditions
witness observations
research and similar occurrences.
Acknowledgements
The ATSB acknowledges the support of the Queensland Police Service for their assistance during this investigation.
The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this report. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 21 May 2019, while engaged in a planned cull of feral animals in Kakadu National Park, Northern Territory, a crew of three were using a Bell 206B3 JetRanger helicopter for aerial platform shooting. While the helicopter was operating at about 50 ft above the ground, the engine decelerated to idle, resulting in an immediate loss of power, and subsequent collision with terrain. The three occupants (pilot, shooter and spotter) were seriously injured.
What the ATSB found
The engine power loss was due to a leak created by a loose union on an engine reference air line. During maintenance 4 days prior to install a power turbine governor (PTG), the union, which was downstream of the work completed, had not been checked for tightness. Potentially associated with distractions in the hangar at the time, an independent inspection following installation of the PTG was probably not conducted, and document verification processes did not detect that the independent inspection had not been recorded.
The cabin was not well prepared for the subsequent collision with terrain, with a range of factors exacerbating the occupants’ injuries or increasing risk. For example, the Director of National Parks required shooters and spotters to wear helmets, but helmets were not provided or used on a routine basis. Safety issues were also identified with the ambiguous wording of the instrument permitting harness use (issued by the Civil Aviation Safety Authority), and renewal of aerial platform shooting approvals without recurrent emergency training.
Additionally, the ATSB found that the Director of National Parks did not actively manage the risk of the aerial culling task, or effectively supervise the operation. As a result, an increase in the number of crew, a change in helicopter type and change of helicopter operator all progressed without requisite risk management. This exposed crew to avoidable harm during low-level aerial shooting operations.
What has been done as a result
The operator ordered an immediate fleet wide check of the security of all flexible and rigid reference air lines in its engines. Additionally, the approved maintenance organisation improved delivery of human factors training for engineers by contracting an external provider to deliver the course.
The Civil Aviation Safety Authority (CASA) has planned action to resolve the ambiguity associated with the instrument permitting harness use, and to require operators to ensure task specialists are trained in normal and emergency procedures. In addition, the operator has taken action to ensure all crew members are aware of the risk associated with using only a harness instead of a seat belt.
The Director of National Parks (DNP) immediately suspended aerial culling activities. In December 2019, the DNP commenced an internal review of standards of practice relating to aerial culling activity and personal protective equipment, and reaffirmed its requirement for the use of helmets during any future culling activities. The DNP has also undertaken a specialist aviation safety review into its aerial culling operation and is conducting ongoing review of its risk management policy and related aspects.
Safety message
Assured airworthiness and preparation of aircraft operating at low-level is paramount. Knowing that maintenance activities carry risk of error, independent inspection is a vital risk control. Inspections must be designed and conducted in a way that will capture critical issues, and visual inspections will not always be enough.
Any organisation that requires staff to engage in high-risk aviation activities should obtain professional advice on task design, actively manage risk, and provide appropriate equipment.
The occurrence
Prior to departure
On 21 May 2019, a Bell B206B3 JetRanger helicopter, registered VH-FHW and operated by Jayrow Helicopters, was being used for an aerial (feral animal) culling task in Kakadu National Park (KNP), Northern Territory (Figure 1). The helicopter operator provided helicopters and pilots under contract to the Director of National Parks (DNP), and the other crew involved in conducting the tasks were employees of Parks Australia.
Maintenance was conducted on VH-FHW by the helicopter operator in Darwin on 16 May 2019, and the helicopter had flown 4.7 hours since that maintenance. The helicopter was repositioned to Jabiru and then Mary River Ranger Station on the afternoon of 20 May and used for aerial culling tasks.
The plan for 21 May was to use the helicopter again as an aerial platform to shoot feral animals in a prescribed area within KNP. The pilot reported that, prior to departure, they refuelled the helicopter and conducted a pre-flight inspection, and no defects were observed. The two aerial culling crew, a shooter and a spotter, both licensed aerial platform shooters and KNP rangers, loaded the helicopter with the weapons, ammunition, and supplies.
Before departure, the pilot engaged the spotter and shooter in a safety briefing. The spotter then sat in the front left seat, the pilot in the front right, and the shooter in the rear right. The pilot and spotter both wore a four-point seatbelt with upper torso restraints. The shooter wore a fall arrest harness (harness) to allow flexibility of positioning in the open doorway for the shooting task.
Figure 1: Kakadu National Park and location of accident
Source: Google Earth, annotated by the ATSB.
Accident flight
At about 0913 Central Standard Time,[1] the helicopter departed Mary River Ranger Station. The search for animals was conducted at 500 ft above ground level (AGL).
At 0923 the crew found a mob of feral horses, and the animals were mustered into a favourable location. The crew reported that this task went smoothly, and the animals were easy to manoeuvre. The mustering was conducted at about 300 ft AGL. Once the animals were in position, the crew began the culling task, and the shooting took place at about 50 ft AGL (Figure 2).
Figure 2: VH-FHW flight path
Source: Google Earth and the operator, annotated by the ATSB
At about 0957, 44 minutes into the flight, the helicopter was at a height of about 50 ft AGL over a lightly wooded area. The pilot reported that the helicopter’s engine started decelerating to idle, and the spotter recalled hearing the engine surge. The pilot’s immediate response was to ensure the throttle was fully open (which it was). The pilot quickly diagnosed the situation as a genuine emergency.
The pilot announced ‘we’re losing power and going over there’, referring to a small clearing slightly left of the nose in their direction of travel. The pilot managed the rotational energy remaining in the rotor system and the forward speed of the helicopter to reach the clearing.
The right side of the helicopter impacted a tree on the edge of the clearing, and then landed heavily in a level attitude. All three occupants were seriously injured, and the helicopter was destroyed (Figure 3).
Post-impact events
The spotter recalled, after impact, being covered in fuel and having heavily restricted movement in the neck and body. The spotter exited the helicopter and noted that the pilot and shooter were unconscious.
The spotter reported attempting to activate a handheld emergency position indicating radio beacon (EPIRB), but given that their corrective glasses were lost, the activation instructions were unable to be read. The spotter returned to the helicopter as the pilot and shooter became conscious. The pilot and spotter between them ensured the helicopter’s emergency locator transmitter (ELT) was on, and the spotter tried to make the pilot comfortable.
The spotter tried to assist the shooter in the back of the helicopter but was unable to do so. The rifle was still in the helicopter, and the barrel had punctured the floor of the cabin. The spotter made the weapon safe by removing the magazine and selecting the safety catch. The spotter located a daypack, which contained a park radio, then made a MAYDAY call which initiated the emergency response from KNP personnel.
The joint rescue coordination centre (JRCC) detected the signal from the ELT and tasked a passing Royal Australian Air Force (RAAF) C130J to search for the source. The RAAF aircraft’s crew found the wreckage of VH-FHW and directed a nearby helicopter to the scene. The crew on the second helicopter were able to provide immediate assistance. Meanwhile, the RAAF aircraft was also in communication with an inbound emergency medical service (EMS) helicopter.
The EMS helicopter arrived at the accident site about 5 minutes later. Medical professionals on board were winched from the helicopter to care for the injured personnel and prepare them for transport.
Following news of the event, the fuel supply at Jabiru was closed for testing as a precaution. This prevented the EMS helicopter from refuelling at Jabiru. Combined with limited access to site, the delays in refuelling meant extraction of the injured crew took longer than desired. The crew eventually reached hospital in Darwin at around 1900, about 9 hours after the collision with terrain.
The pilot held a valid Commercial Pilot Licence (Helicopter), and a current Class 1 Aviation Medical Certificate. Over a 40-year career, the pilot had accumulated over 18,000 hours flight time. The pilot first worked for the operator on a full-time basis in 1994, before then flying for other operators. More recently, the pilot was inducted to the operator as a contractor in 2014.
The pilot had a significant level of experience in low-level and remote area helicopter operations, including extensive experience in aerial shooting programs. The last proficiency check in single engine helicopters was conducted on 26 March 2018 (valid to 31 March 2020), and the last proficiency check for low-level helicopter operations was conducted on 1 November 2018 (valid to 1 November 2020). No problems were noted during either proficiency check.
Shooter and spotter
The shooter was a highly experienced Kakadu National Park (KNP) ranger who was first licenced for aerial platform shooting in 2002.
The spotter had over 30 years’ experience as a KNP ranger, and became a licenced aerial platform shooter in 2000.
Both the spotter and shooter had been trained in aerial platform shooting. The Civil Aviation Safety Authority (CASA) had issued permission to both personnel for carriage and discharge of a firearm from an aircraft. The conditions of permission required that, before shooting from an aerial platform, they must:
have completed training a syllabus of training by an accredited aerial platform shooting training organisation; or by the pilot in command for the type of aircraft to be used (aeroplanes or helicopters); and
retain a copy of this training course and evidence of its completion…; and
within the previous 2 years:
have conducted shooting from an aircraft; or
requalified under the training course mentioned above.
The permissions were valid for 3 years. The aerial platform shooting course was only undertaken once by both crew for the initial issue of their permissions. Permissions were then renewed by shooting from aircraft within the 2-year period. The crew also completed ground-based firearms safety courses. The spotter and shooter had not refreshed their emergency training for aerial platform shooting since the initial issue of their permissions in 2000 and 2002, respectively. They also had not conducted drills on the ground simulating a forced landing to prepare them for an actual event.
Organisational and management information
Kakadu National Park management
The Kakadu National Park (KNP) Board of Management developed, drafted, and monitored management plans for the park. The majority of land in the park was leased to the Director of National Parks (DNP) for management as a Commonwealth reserve. The KNP Board of Management worked with the DNP under a joint management framework.
The DNP was a corporate Commonwealth entity that existed under Part 19 of the Environment Protection and Biodiversity Conservation Act 1999. This entity administered, managed, and controlled the park. The DNP was supported in carrying out its functions by the Parks Australia Division of the Department of Agriculture, Water, and the Environment.
Parks Australia staff operated in the KNP as rangers under direction from the DNP and with oversight from the Board of Management.
Helicopter operator
Jayrow Helicopters held an air operator’s certificate (AOC) that authorised it to conduct a wide range of low-level aerial work activities using a wide range of helicopter types. These activities included aerial spotting and feral animal control (aerial culling).
The DNP tendered for helicopter services in late 2016 and contracted the helicopter operator to support a range of park activities under a deed of standing offer in May 2017.
The operator had provided helicopter services in remote areas of Australia for 55 years. Adaptations to the environment underpinned the expansion of its business into remote areas in the early days. Since then, its services expanded to all areas of onshore and offshore helicopter operations. The operator had a quality management system and safety management system, with a full-time safety and quality manager.
The helicopter operator’s operations in KNP were conducted from Jabiru, with management based in Darwin. The head office of the operator was in Melbourne, Victoria.
The DNP engaged aviation industry auditors to conduct second-party audits of the helicopter operator.
Approved maintenance organisation
The approved maintenance organisation was owned and operated by the same entity that operated the helicopters. The engineering manager, and the head of aircraft airworthiness and maintenance control, were based at head office in Melbourne. A senior base engineer and three full-time engineers were in place at the Darwin base. A contract engineer was temporarily employed to support a busy period of work at the time of the accident.
It was normal for most maintenance of the operator’s helicopters to take place in Darwin.
Helicopter and maintenance information
General information
VH-FHW was one of two helicopters taking part in the aerial culling program. VH-FHW was a Bell Helicopter Company 206B3 JetRanger, serial number 2838. It was manufactured in the United States in 1979, and first registered in Australia in 1980. VH-FHW had seating for a pilot and four passengers, and it was powered by one Rolls-Royce 250-C20J turboshaft engine. At the time of the accident the helicopter had accumulated about 16,916 hours total time in service (TTIS).
For the aerial shooting task, the rear right door of the helicopter was removed.
Wreckage inspection
The ATSB did not conduct an on-site examination of the wreckage. On 30 May 2019, under the guidance of the ATSB, and supervision of the Northern Territory Police, the police, Parks Australia rangers and the operator returned to the accident site to inspect the wreckage.
During the inspection of the wreckage, it was found that an engine reference air line[2] union between the power turbine governor and the accumulator was loose (Figure 4). No other pre-existing problems with the helicopter were reported to be found during the wreckage examination.
Figure 4: Loose reference air union
Source: Operator, annotated by the ATSB
Maintenance information
The helicopter underwent scheduled maintenance in Darwin on 16 May 2019, 5 days prior to the accident. At that time, the helicopter had accumulated 16,911 hours TTIS. The planned maintenance included a clean of the tail rotor assembly, a 100-hour airframe inspection, and a 150-hour engine inspection.
All planned maintenance activities were recorded in a work pack. The package was prepared in advance of the maintenance and outlined the tasks to be completed. The work was conducted by four licenced aircraft maintenance engineers over a full day. The engineers signed each element as it was completed.
During this maintenance, it became apparent that the power turbine governor (PTG) and linear actuator required replacement due to stiff operation. As the PTG change was introduced on the day of maintenance, a separate work sheet was produced for that task.
Requirements of PTG install
The PTG is designed to keep the power turbine rotating assembly in a gas turbine engine rotating at a constant speed throughout changing power demands. The PTG senses engine speed changes by sensing engine reference air pressure (from the engine compressor), and it sends a signal to the fuel control unit (FCU) to adjust the fuel flow to the engine accordingly. A linear actuator assists the PTG by linking it to the pilot’s controls, allowing the PTG to adapt to changing power demands more efficiently.
The maintenance instructions for the replacement of the PTG included a warning in relation to the installation (Figure 5). The engine manufacturer (Rolls-Royce) advised that this warning was repeated throughout its 250-C20 Series Operation and Maintenance manual and applied to all union connections. This included both ends of all lines installed on the PTG. A loose union could create a leak, which would in turn cause engine power loss.
Figure 5: PTG installation warning
Source: Rolls-Royce 250-C20 Series Operation and Maintenance Manual
Replacing the PTG requires removing the air carrying flexible hose and pipes from the old unit and replacing them on the new unit. It is normal practice in maintenance to disconnect the PTG and loosen the other end of the lines (such as the engine reference air line) to allow manipulation of the lines for removal and refitting.
Replacement of the PTG on VH-FHW
The maintenance engineer that conducted the PTG replacement was a licenced aircraft maintenance engineer (LAME) with 27 years’ experience in Australia and overseas. They had maintained the operator’s fleet at the remote base in Darwin for 4 years.
The engineer stated that it was not necessary to loosen the other end of the flexible engine reference air line when replacing the PTG and that the reference air line adjacent to the accumulator was not touched at any point during the maintenance on 16 May 2019.
Other recent activities that could have loosened or dislodged the reference air line union were a turbine module change on 3 July 2015, a compressor module change on 6 July 2015, and a PTG change on 3 May 2018.
Human factors in engineering
The approved maintenance organisation had self-paced human factors training material for its engineers. The LAME that conducted the PTG replacement on 16 May 2019 completed that training on 12 January 2016.
In a Civil Aviation Safety Authority (CASA) published guide (Safety behaviours: human factors for engineers), the stated average rate of leaving a loose nut during maintenance was one in 250. The guide stated that such lapses were most commonly encountered when a distraction was introduced to the maintenance task.
The engineer that replaced the PTG stated that distraction and interruption were existent at the engineering facility where the maintenance was conducted. Such interruptions were witnessed by ATSB investigators during the course of the investigation.
Independent inspection requirements
Civil Aviation Regulation (CAR) part 42G (Flight control systems: additional requirements), mandated that an aircraft’s flight controls required independent inspection following maintenance activities. No other systems were required by regulation to undergo independent inspection. The qualification requirements of people conducting independent inspections were detailed in schedule 8 of CAR 42ZC (Maintenance on Australian aircraft in Australian territory). The qualified parties were essentially licenced engineers and pilots.
The maintenance organisation’s Engineering Procedures & Control Manual allowed appropriate persons to conduct independent inspections as per CAR 42G. It stated that the certifying LAME was responsible for ensuring the person conducting the independent inspection was qualified, trained, and briefed. It was the engineer’s responsibility to brief the pilots, and train them to conduct the independent inspections required. This was managed on an as needed basis without standardisation or formal support.
As human factors principals have been increasingly applied to the practice of aircraft maintenance over the years, the aviation industry has recognised the benefit of expanding the use of independent inspections beyond flight controls. Accordingly, many maintenance organisations have increased independent inspection requirements beyond the regulatory requirements to all critical maintenance tasks. Additionally, the Flight Safety Foundation’s voluntarily adopted Basic Aviation Risk Standard (BARS) required registered operators (of that standard) to identify critical maintenance tasks (CMT), and stated:
Maintenance tasks that involve assembly or disturbance of any system that may affect the flight path, attitude or propulsive force, which, if errors occurred, could result in a failure, malfunction, or defect that would endanger the safe operation of the aircraft must be considered as a CMT.
The maintenance organisation’s Engineering Procedures & Control Manual, last updated 10 January 2018 and valid at the time of the accident, stated that ‘second inspection’ requirements were added to the manual on 7 October 2008. The manual specified additional independent inspection requirements over and above the requirements of CAR 42G. These included:
Main rotor, tail rotor systems and drive-train components.
All powerplant controls, including MFCUs, AFCUs, FCUs, EECUs, etc
All powerplant electrical connectors
All closed areas prior to refitment of panels/assemblies/components, etc.
Fluid line fittings.
Note: Whether the complete system or only part of a system has been disturbed, the independent inspectors should thoroughly check the system and adjacent areas, ensuring that all tools, equipment and materials have been accounted for and removed.
Independent inspection of maintenance on 16 May 2019
The work pack generated at the time of maintenance on 16 May 2019 carried space for signing off after independent inspection of critical maintenance tasks. Two tasks relating to the reassembly of the tail rotor pitch control were identified for independent inspection. These items were signed as carried out by the LAME who completed the work and signed as inspected by a second LAME.
There was no documentary evidence to show independent inspection of the PTG install had taken place. The LAME that conducted the task stated that a pilot had conducted a visual inspection of the installation, and that due to distraction from unrelated operational demands the signing of the paperwork was missed.
The pilot who was nominated as having done the inspection stated that they had done duplicate inspections at times for the engineers, but it was not a common occurrence. They could not recall conducting a visual inspection of the PTG installation or any other aspect of VH-FHW during its maintenance on 16 May.
Verification of maintenance activities
The logbooks for all aircraft were held at head office in Melbourne. All maintenance documentation from the Darwin base was sent to Melbourne for verification prior to a maintenance release being issued for an aircraft. Following the maintenance on 16 May 2019, a maintenance release was issued for VH-FHW without the required independent inspection requirement being signed as completed for the PTG installation.
The last audit commission by the DNP on the helicopter operator and its maintenance organisation in September 2018 included the following observation:
An inspection of a recent work pack for the last service completed for (a company helicopter) showed records to be completed thoroughly and correctly. Logbooks are not kept on site and all records are scanned and sent electronically to the head office. (The operator) meet(s) the requirements of … the Deed of Standing Offer.
Torque seal
As a visual indicator of alignment, and an aid to indicate when an item has been secured, aircraft engineers often applied torque seal to that item. Pilots conducting visual inspections in the field could check the torque seal for cracks or movement. A crack or movement could indicate that the item was potentially not secure (Figure 6). However, torque seal is a hard lacquer and is not a perfect indicator. It can flake and crack due to heat or exposure to the elements (potentially providing false indications of movement), or if there is only slight movement it may only indicate hard to detect hairline cracks.
Orange torque seal had been applied to the several areas around the PTG, and these areas corresponded to the parts the engineer stated were manipulated when installing the PTG (Figure 6). There was yellow torque seal applied where the loose reference air line was located and it was observed to be cracked following the accident (Figure 6). Yellow torque seal was also present on some other parts that were not manipulated during the last maintenance.
Figure 6: Torque seal on air line unions as found on VH-FHW
Source: Operator, annotated by the ATSB
Subsequent inspections of the helicopter
Pilot inspections involved a visual check of the unions at the end of the air lines in the engine compartment, including the condition of the torque seal on air lines in-line with the PTG. However, the PTG lines were one of many components to inspect that would have torque seal applied (that is, there could be dozens of items with torque seal applied that needed to be checked during a daily inspection or similar pilot inspection).
Several visual inspections were made of VH-FHW by qualified people in the normal course of operation following the 16 May 2019 maintenance and none identified any defect. More specifically:
On 17 May 2019, after the scheduled maintenance and replacement of the PTG had been conducted, a functional check of the helicopter’s engine and aircraft was conducted on the tarmac at the operator’s Darwin base. Inspection was required before the helicopter was operated, and was also done during the ground run. No defects were reported.
On the morning of 20 May 2019, VH-FHW was flown to Jabiru and then used on a stream sampling job nearby. The pilot who conducted these flights reported that the daily inspection of the helicopter identified no defects and that the helicopter performed well.
On the afternoon of 20 May 2019, the helicopter was left in Jabiru for the pilot contracted for the aerial culling task to collect. That pilot inspected VH-FHW before departing Jabiru for Mary River Ranger Station and stated that the helicopter presented no defects. The afternoon was spent using the helicopter for aerial culling tasks. The pilot reported that the check conducted at the end of the day identified no issues.
On the morning of 21 May 2019, the pilot reported having ample light and time to conduct a thorough daily inspection. The pilot stated that the daily inspection was conducted, and no defects were identified.
Emergency procedures
Regarding the Rolls-Royce 250-C20J engine, if the PTG fails on the high side (high RPM), and puts too much fuel into the engine, the engine will overspeed. The pilot can decrease the throttle to reduce the fuel flow and therefore manage RPM.
As in the case of the accident on 21 March 2019, if the PTG fails on the low side (low RPM), and restricts the amount of fuel going to the engine, there is no adjustment the pilot can make to increase the fuel flow for this engine type. The pilot must instead treat the problem like an engine failure. When operating at a low height above ground, this means controlling rotor RPM with collective pitch and cyclic and managing the helicopter for the best available outcome.
Meteorological conditions
The pilot reported that there was limited internet connectivity at the Mary River Roadhouse so was unable to obtain updated weather information online. The pilot was familiar with the area and, given the conditions, they were satisfied that the weather was suitable for the planned flight.
The Bureau of Meteorology (BoM) provided automated weather reports for Jabiru for the morning of 21 May 2019. The reports indicated an east to north-easterly wind at 12 kt, nil cloud, temperatures from 28 °C to 30 °C, and visibility greater than 10 km. The weather was typical for the Northern Territory dry season and conducive to flying.
Cabin safety information
Occupant injuries
All three occupants of VH-FHW received serious injuries. The pilot received serious back and foot injuries, as well as chemical burns to the body from leaked fuel. The spotter received a serious back injury, a gash to the outside of the lower right leg, and damage to the right arm. The shooter received chemical burns from fuel, and serious injuries to the back, right hip, and scalp.
Seatbelts and harness
VH-FHW was fitted with four-point seatbelts with upper torso restraints (UTRs) in all seating positions. For the KNP shooting operations in B206B3 JetRanger helicopters, the pilot and the spotter both wore the four-point aircraft seatbelts.
The helicopter operator provided a harness for the shooter, which the shooter did not use. For reasons of comfort, the shooter instead used a harness supplied by Parks Australia, attached by way of a non-energy absorbing, webbing restraint strap of around 1 m to a specified anchor point.
The harness’s design complied with ATSO-C1003[3] and was a quick release type, that could be released under load using two distinct movements (Figure 7), and it was approved under Civil Aviation Safety Regulation (CASR) 21 (Certification and airworthiness requirements for aircraft and parts). It was attached to the aircraft with an adjustable strap. Figure 8 shows the location of the anchor point installation in VH-FHW, which was approved by an authorised engineer under CAR 35 (Approval of design of modification or repair). The anchor point design required it to be installed on the left side of the cabin for use at the rear right door.
Both the shooter’s harness and the anchor point in VH-FHW carried a caveat. Figure 9 shows the harness manufacturer’s statement:
Not approved for take off or landing.
Additionally, the flight manual supplement for the approved anchor point stated:
The camera person/hoist operator must be restrained by his standard seat belt for take-off and landing.
The harness used by the shooter did not fail in the accident sequence, though it was noted after the accident to be past its 10-year retirement date by 3 weeks (Figure 7). The operator took immediate steps to prevent third parties using expired equipment aboard their aircraft after discovering this post-accident.
Harnesses are commonly worn in many aircraft applications. They are designed to prevent people from falling within, and from, the aircraft. They are not designed to protect the occupant during a collision or impact sequence.
Figure 7: Shooter’s harness, rear view
Source: Northern Territory Police, annotated by the ATSB
Figure 8: Harness anchor point
Source: Operator, annotated by the ATSB
Brace positions and emergency response
The operator specified brace positions for passengers in seats fitted with a lap belt and for seats fitted with a lap belt and UTR (Figure 9).
During the occurrence, the seatbelt with UTR kept the pilot in place while they flew the aircraft for as long as they could to achieve the best outcome.
Although the spotter was aware of the brace position, and the UTR held the spotter in their seat, they reported that they lifted their legs prior to impact. In contrast, the specified brace position required the occupant’s feet to be flat on the floor, as depicted in Figure 9.
Figure 9: Brace position information provided by operator
Source: Operator via the Director of National Parks
There was no universally recommended brace position for a crew member in a fall arrest harness, and the operator had not provided procedures or guidance for a brace position for a shooter wearing only a harness. The shooter reported that they crouched down as much as possible, as if they were wearing a lap belt.
A document on helicopter ditching produced by the North Atlantic Treaty Organisation (NATO) in 1989 recommended:
Those unrestrained or on a long tethered harness prior to impact, should if at all possible strap into the nearest seat and assume (a standard brace position). Otherwise they should immediately lie face down flat on the floor with their heads buried in the crook of their arms.
Those actions require time and space, which may not be available when responding to an emergency at a low height above the ground in a small helicopter.
Reducing the flail envelope of an occupant is a vital part of reducing harm in an impact sequence. Even short single-point restraints have been demonstrated to allow significant flail injury to occupants (see for example AO-2014-053). Figure 10 shows the estimated flail envelopes for the occupants of VH-FHW at the time of the accident. The shooter, with a single-point restraint, had a much larger flail envelope than the two front seat occupants.
In the event of an emergency (such as an impending impact), the shooter was required to throw their weapon out of the exit. The shooter advised that they understood this requirement. However, on this occasion they brought the live rifle into the cabin and pointed the barrel down.
Figure 10: Estimated flail envelope for occupants of VH-FHW
Source: ATSB
Harness use instrument
The use of seatbelts is mandated in CAR 251 (Seat belts and safety harness). It stated:
Subject to this regulation, seat belts shall be worn by all crew members and passengers:
during take-off and landing…
when the aircraft is flying at a height of less than 1,000 feet above the terrain…
CASA may direct that a type of safety harness specified in the direction shall be worn in place of a seat belt in the circumstances set out in the direction…
Civil Aviation Order (CAO) 20.16.3 (Air service operations – carriage of persons) detailed technical requirements to support CAR 251. It stated:
3.1 Each crew member and each passenger shall occupy a seat of an approved type:
(a) during take-off and landing; and …
(c) when the aircraft is flying at a height less than 1000 feet above the terrain; ….
4.1 … safety harnesses, or seat belts where safety harnesses are not fitted, shall be worn by all persons at the times listed in paragraph 3.1…
Airworthiness bulletin (AWB) 25-007 issue 3 (Personnel Harnesses, Restraint Straps and Approved Attachment Points) alerted operators to safety issues surrounding the use of harnesses. The AWB did not offer guidance with respect to a brace position for personnel wearing only a harness.
In November 2018, CASA issued the instrument CASA.EQUIP.0029 under CAR 251(3) to the helicopter operator, exempting the operator from CAR 251(1) when certain conditions were met. It stated:
… approved safety harnesses may be worn in lieu of seat belts in a helicopter during take-off and landing and when the helicopter is flying at a height less than 1,000 feet above the terrain.
The instrument also specified various conditions and requirements, which included:
General conditions
The direction to use the harness is applicable only to the conduct of those tasks where the assistance of the otherwise unrestrained crew member is vital to the operational safety or to the conduct of specific aerial work functions as detailed in the operator's operations manual…
The harness must be worn in place of the seat belt for the minimum time commensurate with flight safety;…
Procedures, drills, operating crew duties and recency requirements covering both normal and emergency operations whilst wearing a safety harness, or swapping between seat belt and safety harness, must be defined and published in the operator's operations manual…
Crew requirements
Before flight, the pilot in command must brief crew members in regard to the responsibilities applicable to both normal and emergency operations whilst wearing a safety harness or swapping between seat belt and safety harness. The briefing must include the procedures to be adopted to afford the best protection to crewmembers in the event of a forced landing…
Conduct of flight
An approved seat and seat belt, for use in an emergency, must be available at all times to the occupant of the safety harness…
Transfer between a seat belt and a safety harness during flight must only occur above 1,000 feet AGL, where practicable, and with the cabin doors closed. These restrictions apply only if the occupant is not secured by either system during the transfer…
Notwithstanding the requirements of [previous paragraph], the occupant must not be secured by more than one (1) restraint system for other than the actual transfer (Ref CAO 108.42 para 3.6) except during the conduct of specific power line aerial work functions as detailed in the operator's operations manual.
Operator's responsibilities
…The Operator must further ensure that any person wearing a safety harness pursuant to the provisions of this direction is fully apprised as to the inherent limitations and potential risks involved in the use of such a harness, when it is worn in place of a seat belt or other restraining device of a type that would otherwise be required in accordance with the provisions of CAR 251.
This instrument was a common exemption to seatbelt requirements for operators conducting aerial work in Australia. Jayrow Helicopter’s instrument was initially issued in 2004.
CASA informed the ATSB that, despite the wording of the instrument, caveats on the specific equipment used (see Seatbelts and harness ), and conditions of the instrument requiring equipment to be approved for take-off and landing, meant that a harness could not be worn in lieu of seatbelts during take-off and landing. CASA also stated that, while the wording appeared otherwise, the instrument was never intended to allow the use of a harness during take-off and landing instead of a seatbelt.
CASA advised that no risk analysis had taken place regarding the potential use of the harness instead of a seatbelt for take-off and landing when issuing this instrument, as it had not anticipated that the instrument could be interpreted that way.
CASA provided renewals of the operator’s instrument every 3 years. Renewals relied on the existence of an antecedent instrument, and upon the content of the operator’s operations manual providing the means to fulfil the conditions of the instrument.
Harness use below 1,000 ft
There were three distinct phases of flight mentioned in CAR 251 and instrument CASA.EQUIP.0029: take-off, landing, and flight below 1,000 ft. The use of a harness below 1,000 ft was essential for completion of the shooting task, and the operator had published aerial culling procedures and harness use procedures in its operations manual. The harness use procedures included:
annual recertification of equipment
visual inspection of harness and anchor point
pilot briefing on use by senior base pilot
instructions on proper assembly of the quick release mechanism.
The helicopter operator stated that all crew involved in the shooting tasks had received a mass brief at the beginning of the aerial culling program, and regular briefings before flights at the aircraft. The manager in Darwin advised that the mass brief included the use of the harness, operation of the quick release, and shooting procedures as well as normal flying operations. The pilot reported that the pre-flight briefings at the aircraft included avoidance of rotating parts, how seatbelts and doors worked, and location of emergency equipment, as well as task-specific points such as coordination of turning with shooting.
Parks Australia staff members reported that, aside from the method of attachment and release from the harness, there was no other guidance or information provided to the aerial culling personnel about precautions or risks when utilising the harness, with or without the aircraft seatbelt fitted.
As noted above, the CASA instrument required a person wearing a harness to be made aware of the increased level of risk they are assuming when wearing a harness and not wearing a seatbelt. Parks Australia staff members stated they did not feel this was sufficiently communicated to them.
Harness use on take-off and landing
The pilot recalled that, on the day of the accident, the shooter was wearing only the harness on departure from the ranger station. The pilot reported a preference for crew to use the seatbelt, and on this occasion allowed the shooter to use the harness for comfort.
The shooter recalled wearing the seatbelt (lap belt) over the harness during the take-off and throughout the flight. Following the accident, the shooter was found to be only wearing the harness.
Interviews with the operator’s personnel and Parks Australia staff members confirmed that, in the B206B3, shooters would usually remain in the harness attached to the helicopter with the restraint strap at all stages of flight. Flight crew and Parks Australia personnel also reported that, if the aircraft seatbelt was used, it was normal to use the lap belt portion of the seatbelt in addition to the safety harness.
As noted above, the CASA instrument stated that the occupant must not be secured by more than one restraint system for other than the transfer between restraints.[4]
Ancillary radio install
In 2015 an ancillary radio system was installed in the front passenger footwell of VH-FHW, in accordance with a CAR 35 engineering order. The installation protruded about 8 cm into the footwell (Figure 11). The radio system was a marine VHF/UHF radio, and it was not required for the aerial culling tasks. It had sharp small radii corners, and was not padded.
The spotter reported that the ancillary radio’s placement made it difficult to use the push-to-talk foot switch for the intercom system. Additionally, the large laceration to the spotter’s right leg matched the small radius, metal corners and edges of the ancillary radio installation.
VH-FHW, serial number 2838, was a Bell 206B manufactured in 1979. The Bell 206B model was certified in the normal category in 1971, and its certification basis was the US Civil Aviation Regulation 6, dated December 1956, with various amendments. In terms of emergency landing conditions, that design standard stated:
The structure shall be designed to give every reasonable probability that all of the occupants, if they make proper use of the seats, belts, and other provisions…will escape serious injury in the event of a minor crash landing In which the occupants experience the following ultimate inertia forces… Upward 1.5g (downward 4.0g)…Forward 4.0g… Sideward 2.0g.…
Consequently, modifications to the aircraft (such as for the radio installation in VH-FHW) needed only to comply with the original design standard.
From 1989, the US Federal Aviation Regulation (FAR) 27.561 requirement for helicopter types certified in the normal category were required to be designed to protect up to 16 g forward, 20 g downward, 8g sideward and 4 g upward. From 1984, FAR 27.785 also required that:
Each seat, safety belt, harness, and adjacent part of the rotorcraft at each station designated for occupancy during take-off and landing must be free of potentially injurious objects, sharp edges, protuberances, and hard surfaces and must be designed so that a person making proper use of these facilities will not suffer serious injury in an emergency landing…
The Bell 206B3 is piloted from the right seat, however dual controls can be made available for pilot training and proficiency checks. This would require an instructor or check pilot to fly the helicopter from the left seat. US CAR 6 also required that:
…the pilot will be able to perform all of his duties and operate the controls in the correct manner…
The pedals at the front left seat of VH-FHW were disconnected from the flight control system. That position can be equipped with flight controls for tasks that require two pilots. The protrusion of the radio installation in VH-FHW over the pedals would likely prevent a pilot from effectively operating the controls. The engineering order for the installation did not prohibit a second pilot from flying the aircraft from the left seat.
Figure 11: Exemplar radio installation showing approximate position in footwell
Source: Maintenance organisation, annotated by the ATSB
The aerial culling task
Low-level operations
Helicopters are used extensively in low-level operations to support numerous industries in Australia. These notably include emergency services, fire suppression, and management of national parks. Low-level operation is defined as any operation below 500 ft, aside from take-off and landing.
Low-level flight brings several significant complexities to the operation, and pilots require training and approval to operate helicopters at low-level. One such complexity is management of forced landings. Both time and availability of suitable forced landing areas are significantly reduced.
During a forced landing, a helicopter can descend at around 2,000 ft/minute. From 1,000 ft, this provides around 30 seconds for preparation of the cabin for a forced landing. From 50 ft, the time is reduced to a few seconds, leaving very little (if any) effective time for warning or preparation.
Low-level flight also vastly reduces the availability of forced landing sites (Figure 12) At best glide speed (69 kt in a B206B3), a glide ratio of around 4:1 is achievable. Low-level work ordinarily occurs at lower speeds than that, and in aerial culling the pilot must match the speed of the animals, further reducing choice of forced landing areas.
Figure 12: Theoretical choice of forced landing area at best glide speed
Source: ATSB
Task design
The primary purpose of the aerial culling activity was to care for Country and protect the habitat and people in the park from damage caused by feral animals.
It was normal practice across industry that an aerial culling task was performed with just two people on board the helicopter: a pilot and a shooter. For example, the successful brucellosis and tuberculosis eradication campaign in Australia ran for 27 years and made extensive use of aerial culling with two crew. In addition, the Northern Territory government’s aerial platform shooting course guide, under which the Parks Australia shooters were trained, did not mention observers or spotters being on board an aircraft.
The pilot of VH-FHW, who had 30 years’ experience in aerial culling, had ordinarily conducted shooting tasks with just two people on board. Experienced aerial shooters interviewed after the accident also stated a preference for carrying just the pilot and shooter on board to reduce risk to crew, carry more fuel to improve endurance, and do more work.
Parks Australia employees advised that aerial culling tasks in KNP were conducted in Robinson R44 aircraft with just a pilot and shooter up until 2016. In 2017, the DNP switched to a different helicopter operator, which provided a range of services using the larger Bell 206 JetRanger and Airbus Helicopters EC120B aircraft.
The DNP used the higher capacity of the larger helicopter to include the spotter position and improve data collection (in terms of information about the species, number and location of kills). A Parks Australia representative stated that it was critical that the spotter was carried for the success of the shoot, and to counter the risk of not having data for stakeholders. Accordingly, since 2017, the DNP designed the aerial culling task for three people. It required a spotter on board the helicopter in addition to the shooter and the pilot. Prior to 2017, when using the R44 helicopter, data collection was performed by the shooter.
Safe operating procedures
The DNP amended its safe operating procedures (SOPs) issued for aerial platform shooting in November 2016. The procedures included information relevant for conducting the task in an R44 and in a JetRanger and rated the risk to crews as high. For example, the SOPs accommodated the inclusion of the spotter (only relevant to a JetRanger), and required the shooter to wear a seatbelt at all times (which was applicable to the R44 but not how the operation was conducted in a JetRanger).
The SOPs required the spotter to have training in:
map reading and navigation
aerial animal welfare assessment
locating the animals and counting kills from a helicopter.
During shooting, the pilot positioned the helicopter to the left of the mob of horses, and matched the speed and track of the helicopter to that of the animals. In a JetRanger, the spotter (seated in the front left seat) could not see what was happening on the right side of the helicopter where the shooting was taking place. The spotter would therefore require the input of the pilot and shooter to conduct the count (Figure 13).
Figure 13: Estimated firing zone and visibility
Source: ATSB
The SOPs also stated that safety equipment for the task included a flight helmet with intercom. No flight helmets were provided to the aerial shooting crew. The shooter and spotter on the accident flight reported that they were not wearing helmets and did not generally wear helmets during shooting operations. The pilot provided and wore their own helmet.
The spotter reported that they wore a headset for communicating with the pilot and shooter. The shooter reported that they also wore a headset but pushed it back when shooting, so that the earcups would not interfere with manipulation and aiming of the rifle.
Oversight of contracted helicopter operator
On award of the contract for helicopter services, and annually thereafter, the DNP commissioned an independent aviation auditing company to conduct an audit of the helicopter operator and its co-owned maintenance organisation. The audit examined the operator’s ability to provide the service while observing aviation regulations, as well as observing the terms of the contract entered into between the parties.
An audit conducted in September 2018 resulted in three findings, two related to sling load equipment and aircraft parking, and a third due to the operator’s emergency response plan at Jabiru not including relevant emergency contact details. The operator added the emergency contacts to its emergency response plan at the time of audit.
Oversight of shooting operations
There was limited oversight of shooting operations by the DNP. The aircraft travel plan was a document relied on by the park manager and aerial culling team for authorisation of the task, and it was detailed in the DNP aircraft safety policy as being ‘a very important safety factor’. This document was required to be completed for each task, but the template had not been updated since the change in helicopter operator in late 2016. It carried emergency contact details of the previous helicopter operator, and no contact details for the current helicopter operator.
A Parks Australia representative stated that they did not have visibility of the aerial platform shooting management process and that high turnover in the management role over the preceding years had hampered Parks Australia’s ability to provide oversight in that regard. The culling team had no permanent manager in place. A manager was temporarily seconded to the team to help prepare for the culling task in the lead up to the current program, yet risk management documentation for the operation, which was to be completed at manager level, was not conducted and had last been addressed in 2015.
This situation was accepted by management because the crew were all licenced, and local debriefs took place to manage the risk. However, the SOPs did not require a debrief after shooting and there was no record of crew debriefs, no indication of what the content should be, and no internal procedures to verify they were taking place.
Risk management
The date of the DNP’s last risk assessment for aerial culling was 3 August 2015, with a stated duration of 12 months. Since that time, a number of aerial culling tasks had taken place. In addition, the helicopter operator, helicopter type, crew configuration, and SOPs had all changed.
The introduction of a new helicopter operator introduced changes to elements such as:
the integration of the standard operating procedures of the operator and the DNP’s SOPs
task management documentation (trip plan details for example)
emergency response planning
emergency contacts.
The helicopter type had changed from an R44 to B206B3s (JetRangers) and EC120B helicopters. This introduced changes to the:
seating position of the shooter
shooting position of the shooter
restraints used by the shooter (fall restraint harness in JetRanger instead of a seatbelt in R44)
management of role equipment
inclusion of the spotter.
The inclusion of the spotter introduced changes to:
available fuel load
number of people exposed to low-level helicopter operations.
None of these changes had been formally analysed by the DNP for their effect on the risk assessment, and the risk assessment as it stood was not equipped to capture the changes. Additionally, the risk assessment did not discuss protection of the crew through provision of personal protective equipment. Also, there was no formal risk analysis of the inclusion of the spotter position, or consideration of the potential benefits of improved data collection when weighed against operational difficulties in recording data, reduced efficiencies in operation, and increased exposure of employees to risk.
Additionally, the park’s radio network was cited as a mitigator for:
injury to person on ground from stray bullet or ricochet
inappropriate storage or transport of firearms
incursion of people on ground into the shooting area.
However, KNP personnel reported that the park’s radio was only available 10 per cent of the time to the crew in flight, and the radio network was reported by a Parks Australia representative to be in need of maintenance and upgrade, yet upgrade required resources they did not have. If the aerial culling crew on a helicopter needed to talk to their ground support personnel, they had to land by the road to talk face-to-face. The risk management plan did not document these limitations with the mitigator or identify treatments to address the situation.
While the helicopter was operating at about 50 ft above the ground for the aerial culling task, the engine lost power and the pilot was required to conduct an emergency landing with limited options available. As a result of the collision with terrain, the three occupants (pilot, shooter and spotter) were seriously injured.
This analysis will initially discuss the factors associated with the engine power loss, including the loose reference air line and the associated inspections of this component. It will then discuss various factors that increased the risk of injury to occupants, including the preparation of aircraft for low-level operations, and design and management of the low-level aerial culling task.
Loss of engine power
Based on the available evidence, the direct initiator of the engine power loss was the loose reference air line connected to the accumulator downstream from the power turbine governor (PTG). The reference air union was found loose at the accident site, and it was considered very unlikely that this would have loosened during the impact sequence.
In addition, a loose reference air union is consistent with the descriptions of the engine power loss. It would have vented air pressure from between the PTG and the fuel control unit, which the fuel control unit recognised as a signal to reduce fuel flow to idle. Reducing fuel flow to idle would have decreased the power generated by the engine.
In summary, the ATSB concluded that the loose union on the engine reference air line unscrewed in flight, creating a leak, and this leak resulted in a loss of engine power.
There was no manual override for a low-side governor failure available to the pilot. Therefore, the reduction in engine power deprived the pilot of the power required to keep the helicopter airborne, leading to the forced landing and collision with terrain.
It is virtually certain that the union at the accumulator end of the flexible hose from the PTG would stay fastened if the attachment points were serviceable and the nut was sufficiently torqued. A failure of the attachment point would result in a crack in the hose end fitting, and no cracks were reported. Therefore, it is extremely likely that the nut was loosened at some point and not correctly retightened. It could not be definitively determined when this occurred.
The PTG was replaced on 16 May 2019, 5 days (and 4.7 flight hours) prior to the accident. The engineer who replaced the PTG reported that the engine reference air line union was not manipulated during that maintenance. They stated it was not necessary to do so, as the flexible hose could be manoeuvred at the PTG end. Regardless of whether it was intended, it is possible that the union loosened while the engineer manoeuvred the PTG end of the hose.
The warning in the PTG installation documentation, regarding tightening of fittings and tubes, meant that all lines and unions at both ends should have been checked for tightness. As the hose-to-accumulator union was not touched, it was not intentionally loosened, yet neither was it physically checked for tightness. It is likely that such a check at that time would have identified the loose union.
Maintenance, inspection, and verification
There were three opportunities for the loose air line union to be detected before release to service:
the engineer’s own verification of the PTG installation
independent inspection by another person
verification of completeness of the relevant documentation.
Secondary checks by installing engineers and independent inspection by other trained parties are designed to catch lapses as part of an error-tolerant system. It is common practice for engineers to double check the tightness of unions to verify their own work. It is, however, notoriously difficult to detect issues in your own work (Sarter and Alexander 2000), and research has shown that errors of omission relating to fastenings are particularly difficult to detect (Reason and Hobbs 2003).
As already noted, the engineer that conducted the PTG replacement stated that the other end of the flexible hose was not touched. As such, self-verification of the installation concentrated on the PTG end of the flexible hose and the rigid pipes. It is noted that none of the unions on the PTG end loosened.
Given the likelihood of errors during procedural tasks such as maintenance, an independent inspection is a major part of capturing problems. Accordingly, the maintenance organisation’s procedures required independent inspections to be conducted for a range of activities in addition to the minimum regulatory requirements, including for fluid line fittings. In this case however, the independent inspection probably did not occur. The engineer and pilot provided differing accounts of the conduct of the inspection, and there was no paperwork to verify it had taken place.
Even if the independent inspection occurred, it is not certain that it would have identified the problem. The inspection specified was visual, and the only way to detect the loose union would be to demonstrate tightness of all unions, including unions downstream of the PTG. Tightness can only be assured by placing a spanner on the union and checking it for tightness during independent inspection. Accordingly, a thorough, well-designed independent inspection at the time of maintenance is vital in ensuring the continued airworthiness of an aircraft.
Verification of completeness of paperwork is an opportunity to detect tasks or activities that were potentially missed. Following that step, the issuance of a maintenance release is a trusted signal to all parties that the maintenance was carried out as required and that the aircraft is airworthy.
In this case, the independent inspection documentation was supplied as part of the work package, however, being a separate sheet, it may have been overlooked in the review. On this occasion, the verification of the documents did not detect that the independent inspection of the PTG installation had not been signed. As a result, a maintenance release was issued, and the aircraft was returned to service without full assurance of continued airworthiness.
Torque seal, such as was present on the engine reference air line union, would ordinarily be applied after independent inspection and demonstration of tightness. In this case, torque seal had been applied to the air line union, and it was cracked. However, the torque seal was consistent with that used on a maintenance task prior to 16 May 2019, and not consistent with the torque seal applied during the 16 May 2019 PTG replacement task.
The exact meaning of this evidence is not clear, and a range of possibilities exist. In particular:
torque seal was applied to a loose union an at undetermined time
torque seal was correctly applied to a tight union that was later loosened.
If the torque seal had been applied to a loose union, this would have potentially obscured a missed step in tightening the union. However, if the loose union existed prior to the 16 May 2019, it seems unclear why it would have taken so long to manifest into a leak.
Regardless of when the torque seal was applied, cracks in the torque seal were not identified during the 16 May 2019 maintenance or on other occasions. This could also be due to a variety of reasons, including:
the torque seal was cracked but the crack was not readily detectable
the torque seal was noticeably cracked but missed by all who later inspected the aircraft.
Following maintenance, there were further opportunities to detect a problem in the daily inspections and other inspections conducted by pilots. There are dozens of fastenings to inspect when preparing an aircraft for flight, and it is comparatively rare to find a problem. The high number of fastenings and low expectancy of a fault can predispose people inspecting aircraft to miss items. As all inspections carried out by pilots following the release of the aircraft to service were visual, they would not have detected the fault unless they sighted clearly broken torque seal on the relevant union.
In summary, an independent inspection following installation of the power turbine governor was probably not conducted, and document verification processes did not detect that the independent inspection had not been recorded. As a result, the helicopter departed for low-level operations without assurance of continued airworthiness. The exact reasons why these errors occurred could not be determined. However, errors of omission such as omitting the independent inspection, and not completing the associated documentation, can be associated with distractions, and the investigation noted that distractions were potentially associated with work in the hangar at the time,
Preparation of aircraft and crew operating at low-level
Introduction
To conduct the shooting task, the helicopter was periodically required to operate at a height of about 50 ft over a lightly wooded area. Accordingly, the configuration of the cabin and crew at any point in such a low-level operation is likely to be the configuration for impact with terrain should anything occur. Consideration must therefore be given to:
cabin suitability
personal protective equipment (PPE)
restraints
brace positions
other emergency procedures
awareness of risk.
Cabin suitability
The spotter’s injuries were worsened by the radio installation in the front passenger footwell. Although adopting a brace position, with feet flat on the floor would have helped reduce the injury risk, it is very likely that the spotter would have had a lower level of injury without the radio installation in that location.
It should also be noted that the crashworthiness of small helicopters and aeroplanes has improved over the years with changes in certification and manufacturing requirements. This includes improvements in requirements related to impact forces, injurious objects, restraints, fuel tanks and other aspects to reduce the risk of fire. Organisations who have personnel involved in low-level operations can consider these aspects when deciding what types of helicopters should be used for their activities.
Personal protective equipment
Personal protective equipment (PPE) should be used as the last resort to minimise injury risk, but for some aviation operations it is not possible to reduce the risk to an acceptable level without also including PPE. Low-level flight is one of those aviation operations.
Only the pilot wore a helmet, which they provided themselves. Although the pilot was unconscious following collision with terrain, they had no further head injuries.
Although helmets were required by the Director of National Parks’ (DNP’s) safe operating procedures (SOPs) for aerial culling crews, they were not supplied to the crews, and not worn on a routine basis. It is very likely that the shooter’s level of head injury would have been reduced if they were wearing a helmet.
Restraints
The seatbelts with upper torso restraints (UTRs) worn by the pilot and the spotter likely played a role in minimising the severity of upper body and head injuries.
Unfortunately, for some helicopters, such as the B206B3 JetRanger, use of a fall-arrest harness for the shooter was necessary to conduct the shooting task and a seatbelt could not be worn at the same time. However, in the event of a forced landing when in low-level flight, the shooter has no time to transfer to the seatbelt. This exposed the shooter to a higher level of risk due to the increased flail envelope. In this case, possibly due to the movement afforded by the harness, the shooter received a serious injury to their head and right hip.
Brace positions
The helicopter operator provided detailed information about brace positions for seats fitted with UTRs and seats fitted with just lap belts. In this case, probably associated with the limited time available and the surprise of the unfolding events, the spotter did not keep their feet firmly on the floor. This increased their risk of injury, particularly to their lower legs. More specifically, if they had adopted the specified brace position, it is likely the severity of their leg injury (contacting the radio installation) would have been reduced.
Under the Civil Aviation Safety Authority (CASA) instrument for using a fall-arrest harness, the helicopter operator (via the pilot) was required to provide a briefing on the procedures to be adopted to afford the best protection to crewmembers in the event of a forced landing. In this case, the aerial culling crews reported that they were not provided with any such briefing information. While briefings regularly took place, a brace position specific to a harness was not communicated.
It is acknowledged that there is very little information available, provided by CASA or other regulators, about suitable brace positions for a person wearing only a harness. Nevertheless, there is still a requirement on the operator to research and provide information on a suitable position. The extent to which a suitable brace position would have been able to reduce in jury risk in this case could not be determined.
Emergency procedures training for low-level flight
Renewal of the CASA-issued approvals for discharging firearms from an aircraft only required that the applicant had to complete an initial aerial-platform shooting course, and then have shot from an aircraft within the last 2 years.
The shooter and the spotter (who was also a shooter) had not conducted a full or refresher aerial platform shooting course, which included safe practices around helicopters, in almost 20 years. Although they had received pre-flight safety briefings numerous times, such briefings do not cover some of the essential procedures necessary to minimise risk in the aerial shooting task. Had the spotter and the shooter regularly trained and practiced in helicopter safety and emergency procedures, it is likely that they would have both been better prepared for the forced landing.
In particular, the shooter knew the rifle should be thrown from the helicopter yet had not practiced for such an event. There was very little time for the shooter to think about throwing the rifle clear of the helicopter, and the rifle remained in the cabin. Although the barrel was pointed down, the live firearm being in the helicopter increased the potential consequences of the accident. If the action of throwing the weapon in response to an emergency had been rehearsed or drilled, it would have been more likely to be ejected from the aircraft.
Awareness of risk
The CASA instrument also required the helicopter operator to advise personnel using a harness of the ‘inherent limitations and potential risks involved in the use of such a harness’. Aerial culling personnel using the harnesses reported that they were not made aware of the risks associated with harness use, nor precautions to be taken such as brace positions.
The high time aerial culling crew involved in this accident had a good understanding of the risks of the operation and revision of the risks from the operator would probably not have altered their intent to participate. However, another crew may not have been so experienced.
Harness instrument
The language of the CASA instrument regarding use of safety harnesses appeared to allow the use of a harness in lieu of seatbelts for take-off and landing. Equipment approved under CASA regulations (such as anchor points and harnesses) can be reasonably understood to meet the conditions of the instrument. However, CASA advised that the manufacturers’ caveats on use of these items of equipment meant that a seatbelt still had to be worn for take-off and landing.
CASA advised that the instrument was never intended to allow safety harnesses to be worn in lieu of seatbelts during take-off and landing, and that the conditions of the instrument prevented this from occurring. There appeared to be two specific meanings of the word ‘approved’ which could cloud interpretation of the instrument; one in the sense of the equipment being approved under Civil Aviation Safety Regulation 21, and the other of the equipment manufacturers approving their products for certain activities. The equipment requirements of the instrument did not make this distinction clear.
Both the language of the instrument and conflicting use of ‘approved’ opened the instrument to misinterpretation. The language and conditions of the instrument should be improved. Operators and pilots should be aware that, even though an instrument may appear to permit an activity, the limitations of the equipment used must be observed.
Risk management of aerial culling activities
Significant changes had been made to the Director of National Parks’ aerial culling operations in the KNP in the near 4-year period between the risk management plan development in 2015, and the undertaking of the aerial culling program in May 2019. This included, in 2016, the DNP designing the aerial culling task for three crew, introducing a spotter.
Given the increased complexity and risk in low-level operations, the number of crew should be kept to a minimum. That is, only personnel essential for conducting the task should be carried. In this case, the spotter was added to the crew without any formal or systematic consideration of the increased safety risk.
When pursuing a course of action, if one particular stakeholder risk presents the greatest threat, decision makers are prone to adopt a risky strategy which directly addresses the immediate threat to the detriment of other stakeholders (Jawahar and McLaughlin 2001). The spotter had been built into the program, primarily to collect data for stakeholders. Requiring a spotter to be on board mitigated a corporate stakeholder engagement risk, yet exposed the spotter to a high-risk aviation activity. Expanding the crew beyond the industry proven two crew model should have been a trigger for a formal risk analysis and assessment of controls.
A method of data collection designed for two crew or data collection managed through communication with ground crew would have exposed less people to risk. However, no alternative methods of data collection were explored, and the quality of data between two and three crew operations was not assessed. Therefore, the DNP did not know if lower risk options for data collection were available, or know if the added value to the operation warranted the increased risk exposure.
Additionally, there was no documentary evidence of consideration of the impact of changes in helicopter or operator on the operation. The 2015 aerial culling task risk analysis indicated limited consideration of aviation safety risk, and it is likely that the implications of further changes to the operation were not well understood.
When designing aviation operations, organisations without aviation expertise should seek outside information and expertise. Although the DNP contracted an aviation auditor, their scope of work was to audit against the deed of standing offer. Likewise, the helicopter operator was contracted to deliver services as required by the DNP. Both organisations could have provided valuable input into risk analysis and task design, and neither was called upon to do so.
Furthermore, there was no evidence of a working process to build lessons learned into the aerial culling program. The SOPs did not require task debriefs, and hazard management was not conducted. For example, the aerial culling crew and park management knew that the radio network was unsuitable for the aerial culling task, and that they were unable to remedy it. Being such an important risk control, another solution should have been documented and implemented as an alternative.
Other controls were also not managed or reviewed for effectiveness. Specifically, incorrect emergency contact details on KNP documentation used to authorise the task, expired equipment remaining available for use, and PPE being unavailable to the crew.
High turnover in the role of park manager, and the aerial-culling crew not having a line manager, were reported as reasons for there being no supervision or active management of risk. This limited level of risk management restricted the DNP’s ability to eliminate or minimise risk to the crew, meaning safety risk was not managed, nor was safety assured at an organisational level.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety).
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the engine power loss and collision with terrain of VH-FHW on 21 May 2019.
Contributing factors
A loose union on an engine reference air line unscrewed, creating a leak. The leak caused loss of engine power in flight, resulting in a forced landing.
During installation of the power turbine governor, 4 days prior to the accident, an adjacent downstream attachment of the engine reference air line union was loose and not checked for tightness.
Potentially associated with distractions in the hangar at the time, an independent inspection following installation of the power turbine governor was probably not conducted, and document verification processes did not detect that the independent inspection had not been recorded. As a result, the helicopter departed for low-level operations without assurance of continued airworthiness.
Although compliant with regulatory requirements applying to the helicopter being used, bulky, non-task related equipment was installed in the front left passenger footwell, which increased the level of injury to the spotter during the collision with terrain.
Although the Director of National Parks’ safe operating procedures required shooters and spotters to wear helmets during aerial culling tasks, helmets were not provided or used on a routine basis. (Safety issue)
Associated with the limited time to prepare for the forced landing, the spotter did not adopt the brace position, with feet on the floor, increasing the level of injury to their lower legs.
The Director of National Parks did not actively manage the risk of the aerial culling task being conducted in the Kakadu National Park, or effectively supervise the operation. As a result, an increase in the number of crew, a change in helicopter type and change of helicopter operator all progressed without requisite risk management. This exposed crew to avoidable harm during low-level aerial shooting operations. (Safety issue)
Other factors that increased risk
Associated with the limited time to prepare for the forced landing, the shooter did not eject the rifle in readiness for a forced landing. As such, the cabin was not prepared for a forced landing.
Recurrency training and drills in aircraft emergencies were not required for reissue of an aerial platform shooting permission. Some shooters last conducted training about 20 years prior, during initial issue of their permissions. (Safety issue)
Although required by the harness instrument commonly issued by the Civil Aviation Safety Authority, the operator did not appraise shooting crews of the risks of using only a harness for restraint during low-level flight. (Safety issue)
A harness instrument, commonly issued by the Civil Aviation Safety Authority (CASA), stated that a harness could be used instead of a seatbelt for take-off and landing. Although not intended by CASA, this instrument was easily able to be misinterpreted as indicating that a seatbelt was not required to be used during take-off and landing. (Safety issue)
Other findings
To conduct the shooting task, the helicopter was periodically required to operate at a height of around 50 ft over a lightly wooded area. This reduced opportunity to prepare for and make a successful forced landing.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Although the Director of National Parks’ safe operating procedures required shooters and spotters to wear helmets during aerial culling tasks, helmets were not provided or used on a routine basis.
Safety issue description: The Director of National Parks did not actively manage the risk of the aerial culling task being conducted in the Kakadu National Park, or effectively supervise the operation. As a result, an increase in the number of crew, a change in helicopter type and change of helicopter operator all progressed without requisite risk management. This exposed crew to avoidable harm during low-level aerial shooting operations.
Safety issue description: Recurrency training and drills in aircraft emergencies were not required for reissue of an aerial platform shooting permission. Some shooters last conducted training about 20 years prior, during initial issue of their permissions.
Safety issue description:A harness instrument, commonly issued by the Civil Aviation Safety Authority (CASA), stated that a harness could be used instead of a seatbelt for take-off and landing. Although not intended by CASA, this instrument was easily able to be misinterpreted as indicating that a seatbelt was not required to be used during take-off and landing.
Safety issue description: Although required by the harness instrument commonly issued by the Civil Aviation Safety Authority, the operator did not appraise shooting crews of the risks of using only a harness for restraint during low-level flight.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.
Additional safety action by Jayrow Helicopters
Following inspection of VH-FHW on site, the helicopter operator:
immediately actioned a fleet wide check and retorque of engine flexible and rigid oil, air and fuel lines/hoses/pipes attachments
improved procedures for use of third party harnesses aboard company aircraft
outsourced human factors training for engineers which expanded quality and content of the training.
Additional safety action by Director of National Parks
Following the accident, the Director of National Parks immediately suspended aerial culling activity.
In January 2021, the DNP advised of the following safety actions:
upgraded handheld radios with higher wattage, providing improved communications channels through broader broadcast range for staff undertaking aviation activities. The use of these radios is prioritised for staff undertaking remote work…
As part of their broader commitment to ensuring safety in aviation activities, the DNP and department have also established a program of work relating to aviation activity risk management and mitigation. This includes:
establishing an updated enterprise WHS Information System (WHSIS), with the planned implementation of incident reporting and hazard modules to occur in early 2021. The WHSIS will assist with recording and managing risks and hazards in relation to high-risk operational activities including aviation activity risks
infrastructure investment in the KNP radio and telecommunications network. For example, a total of $7 million has been committed to a new tower network within KNP and planning for those infrastructure upgrades is underway; and procurement of additional handheld radios and personal tracking/emergency call devices for staff working on the park
establishment of a Departmental Focus Group, being a group comprised of operational staff/business areas undertaking aviation activities (including aerial culling operations) and WHS/risk and business continuity specialists to take a collaborative approach to addressing WHS critical risks and controls across the portfolio. The group is planned to commence operating in February 2021.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
pilot of the accident flight
pilots and Head of Flight Operations of the aircraft operator
engineers of the approved maintenance organisation
aerial culling crew on board the helicopter and other Parks Australia personnel
Civil Aviation Safety Authority
engine manufacturer
crew restraint harness manufacturer
aerial platform shooting subject matter experts
Northern Territory Police
recorded data from the GPS unit on the aircraft.
References
Civil Aviation Safety Authority 2013, Safety Behaviours: Human Factors Resource Guide for Engineers, Canberra, ACT.
Hart T & Sander A 2016, Memory and Moderate to Severe Traumatic Brain Injury, Model Systems Knowledge Translation Center, VA, USA.
Hobbs A, 2008, An Overview of Human Factors in Aviation Maintenance, Australian Transport Safety Bureau, Canberra, ACT
Jawahar M & McLaughlin GL 2001, Toward a descriptive stakeholder theory: An organizational life cycle approach, Academy of Management Review, 26(3): 397–414.
Motley EB 2006, Aircraft Accident Survivability: Rotary Wing Aircraft, Naval Air Warfare Center, MD, USA.
Nadine B. Sarter & Heather M. Alexander (2000) Error Types and Related Error Detection Mechanisms in the Aviation Domain: An Analysis of Aviation Safety Reporting System Incident Reports, The International Journal of Aviation Psychology, 10:2, 189-206, DOI: 10.1207/S15327108IJAP1002_5
North Atlantic Treaty Organization 1989, The Human Factors Relating to Escape and Survival from Helicopters Ditching in Water, AGARD-AG-305E, Canada.
Reason J & Hobbs A, 2003, Managing Maintenance Error: A practical guide, CRC Press, Boca Raton, USA.
Transport Canada 2016, Advisory circular: Brace for Impact Positions for all Aircraft Occupants, AC 700-036, Ottawa, Canada.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
pilot of the accident aircraft
aerial culling crew on board the helicopter
helicopter operator
approved maintenance organisation
engine manufacturer
Director of National Parks
Civil Aviation Safety Authority.
Submissions were received from the:
helicopter operator
Director of National Parks
Civil Aviation Safety Authority.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the afternoon of 26 May 2019, a Cessna Aircraft Company T210M, registered VH-SUX and operated by Thomson Aviation, departed Mount Isa Airport for an aerial geophysical survey flight with a pilot and observer on board.
One hour and 40 minutes later, as the aircraft was flown west along a survey line about 25 km north‑east of Mount Isa Airport, the right wing separated from the aircraft. The structural failure led to a rapid loss of control and a collision with terrain. Both crewmembers were fatally injured, and the aircraft was destroyed.
What the ATSB found
The ATSB found that a pre-existing fatigue crack in the aircraft’s wing spar carry-through structure propagated to a critical size resulting in an overstress fracture of the structure and separation of the right wing.
Detailed examination of the structure found that relatively minor corrosion near a highly stressed location on the lower surface of the wing spar carry-through progressed into the aluminium alloy structure. This increased stress concentration in this area and led to initiation and growth of a fatigue crack, significantly reducing the strength of the structure.
In 1992, the aircraft manufacturer introduced a recommended continued airworthiness program, including a flight hour‑based repetitive eddy current inspection for cracking of the carry-through structure. This program included more stringent requirements for aircraft being used for low-level survey flights. However, following an assessment of historical data in 2011, the manufacturer replaced this inspection with a three-yearly visual corrosion inspection for all operation types, which was mandatory in Australia. This inspection variation significantly limited the opportunity to identify fatigue cracking within the carry-through structure of low-level survey aircraft prior to failure.
The ATSB also found that the cyclic loads induced by the low-level survey flight profile were significantly greater than those associated with the higher-level flight profile originally intended for the aircraft type. This probably increased the risk of a fatigue related structural failure.
Additionally, while not contributory to this accident and not applicable to the Cessna 210, the ATSB identified that the current guidance to determine fatigue damage for survey aircraft designed in accordance with United States Federal Aviation Regulation Part 23 probably underrepresents the rate of damage accumulated by aircraft intended to be used for low‑level terrain following. This may reduce the airworthiness assurance for survey aircraft designed under Part 23.
Finally, the ATSB determined that the airframe and system modifications incorporated into the aircraft did not significantly increase the fatigue damage accumulated by the wing spar carry-through structure.
What has been done as a result
Four weeks after the accident, on 24 June 2019, the manufacturer, Textron Aviation (Textron), released service letters SEL‑57-06 for the Cessna 210 (C210) and SEL-57-07 for the Cessna 177 (C177), which incorporates a similar carry-through and wing structure. These service letters instructed a one-off inspection of the structure and communication of inspection findings to the manufacturer.
The United States Federal Aviation Administration (FAA) supported these service letters with the release of an Airworthiness Concern sheet that also requested further information from aircraft operators. In addition, the Civil Aviation Safety Authority released an Airworthiness Bulletin providing additional information to assist in managing the airworthiness of C210 and C177 wing spar carry-though structures.
On 4 November 2019, following the receipt and analysis of results from the previously released service letters, Textron released updates to the service letters. These were further revised on 19 November 2019.
Textron subsequently advised the ATSB that it was undertaking a fatigue analysis for the C210 wing spar carry-through in its original configuration. This analysis included information from the VH-SUX accident and inspections of other aircraft and aimed to determine whether a modified inspection program or life limit was necessary. Textron also advised that work on a certification program to install a new spar in the C210 with an updated configuration and material was ongoing.
The ATSB acknowledged the safety action taken by Textron and welcomed its ongoing efforts to address the risk of cracking in wing spar carry-through structure of C210 aircraft used for low-level geophysical survey operations. However, the ATSB remained concerned by the indefinite nature of the proposed analysis and certification program. As such, the ATSB issued a recommendation to Textron that further action be taken to address this safety issue.
Other significant safety action included FAA airworthiness directive (AD) AD 2020-03-16 for C210 models G through M. This AD, adopted on 21 February 2020, required visual and eddy current inspections of the carry-through spar lower cap and application of a protective coating and corrosion inhibiting compound. On 11 May 2021, the FAA also issued a notice of proposed rulemaking for a one-time inspection for C210 N and R, and C177 models.
Safety message
Maintenance inspections are often the sole opportunity to detect damage within an aircraft structure. When designing or altering maintenance inspections and their schedules, it is important to ensure that appropriate engineering judgment is applied to safeguard the ongoing airworthiness of the aircraft type. In this instance, had the previous eddy current inspection remained in place, it is almost certain that the fatigue crack within the wing spar carry‑through would have been detected prior to the accident.
This accident also shows that even when flying within operational limits, if an aircraft is operated in a flight profile for which it was not originally intended, its structure can fatigue more rapidly. The ATSB cautions geophysical survey aircraft operators that the terrain following flight profile may significantly increase aircraft fatigue damage accumulation.
The occurrence
At 1407 Eastern Standard Time[1] on 26 May 2019, a Cessna Aircraft Company T210M (C210), registered VH-SUX (SUX) and operated by Thomson Aviation, departed Mount Isa Airport for an aerial geophysical survey flight with a pilot and observer on board. The survey segment of the flight commenced about 14 km to the north‑west of the airport and was conducted at a height of about 200 ft above ground level (AGL) along parallel east and west lines (Figure 1).
Figure 1: Accident flight overview with the accident site location (inset)
Source: Recovered survey computer data and Google Earth
At 1422, the flight crew commenced surveying in an easterly direction and then progressed northward with each subsequent survey line. One hour and 25 minutes later, at 1547, as the aircraft was flown west along the sixth survey line at a speed of 147 kt and a height of 193 ft AGL, the right wing separated from the aircraft. The structural failure led to a rapid loss of control and collision with terrain.
The accident occurred about 25 km north‑east of Mount Isa Airport. Both crewmembers were fatally injured, and the aircraft was destroyed.
The pilot held a Commercial Pilot Licence (Aeroplane), a current Class 1 medical certificate and had accumulated about 3,955 hours of aeronautical experience. In the 90 days preceding the occurrence, the pilot had flown about 105 hours, all of which were in the C210 aircraft type.
Observer
The observer also held a Commercial Pilot Licence (Aeroplane), a current Class 1 medical certificate and had accumulated about 1,565 hours of aeronautical experience. In the 90 days preceding the occurrence, the observer had flown 3 hours (none of which were in a C210) and completed a gas turbine engine endorsement.
Meteorological data
A meteorological report for Mount Isa Airport, recorded at 1600, (13 minutes after the accident) included a south-easterly wind of 8 kt, visibility greater than 10 km, broken cloud[2] at 9,221 ft above mean sea level (AMSL) and a temperature of 28 °C.
Aircraft details
Cessna 210
The Cessna Aircraft Company (Cessna) 210 is a high cantilever wing, piston-engine aircraft with a three-blade variable-pitch propeller and retractable tricycle landing gear (Figure 2). While suitable for the operation, the aircraft was not designed for dedicated low-level survey operations and was normally fitted with six seats for the transportation role.
Figure 2: An unmodified Cessna T210M
Source: Phil Vabre
The aircraft type was produced and certified under United States Civil Air Regulations Part 3, effective 15 May 1956. Part 3 of the Civil Air Regulations did not require the calculation or provision of a defined fatigue life (see the section titled Airframe fatigue). The regulations required the aircraft designer to:
‘…avoid points of stress concentration where variable stresses above the fatigue limit are likely to occur in normal service’.
During the period the aircraft type was manufactured, it underwent many variations and improvements. Often, when the manufacturer incorporated a variation, this was denoted by a change in the suffix letter of the aircraft designator. This commenced with the C210 and C210A, progressing alphabetically until the last manufactured model, the C210R which was released in 1985. Turbocharged and pressurised models were prefixed as T210 and P210, respectively.
Early C210 models incorporated a strut-braced wing design. Commencing with the manufacture of the C210G model, the wing design was changed to a cantilever design removing the supporting struts of earlier models (Figure 3). The C210G was the first model to incorporate a carry-through structure, similar to that of SUX. The cantilever wing design continued through all subsequent models of the C210 until production concluded in 1986. In all, about 9,300 C210 type aircraft were produced by Cessna of which 7,225 had the cantilever wing design. Of these, 4,296 (models G through to M) had the same wing carry-through section as SUX.
In 1992, the Textron industrial conglomerate purchased Cessna. At the time of the accident, Textron Aviation provided support for the aircraft type.
Figure 3: A 1960 C210A with wing struts (left) and a 1980, cantilever winged, C210N (right)
Source: Phil Vabre
Wing spar carry-through structure
The wing spar carry-through is the primary structural element for carrying cantilever wing design lateral and bending loads. It comprises a single piece forging fixed within the roof cavity, straddled directly overhead the front seats within the cabin region (Figure 4). The forging incorporates an I-beam shaped cross-section, with integral lugs at each end for wing attachment. Lugs integral to the forging ends also attached the wing spar carry‑through to the root rib of the upper fuselage.
Figure 4: Carry-through structure showing the left-wing attachment points
Source: Textron, modified by the ATSB
For the C210G to C210M models, the carry-through structure was not painted with corrosion‑inhibiting primer during manufacture and remained either bare metal or coated with a corrosion‑inhibiting (non-primer) coating. For these models, the upper surface of the carry-through structure also formed part of the external top surface of the fuselage to which adjoining external skins were abutted. A foam section was glued to the underside surface of the carry-through structure to provide padding for the cabin headliner.
In service experience showed that in these C210 models, the top surface design allowed moisture ingress and the foam section also absorbed and retained moisture. This led to the carry-through underside surface being susceptible to corrosion damage, particularly in the region of the foam pad. Therefore, beginning with the C210N model, the design was changed to reduce corrosion susceptibility. These changes included the outer metal skin passing over and enclosing the carry‑through top surface. The structure was also coated during manufacture with a corrosion inhibiting primer paint.
Material
Technical documentation supplied by the aircraft manufacturer for the construction of the carry‑through spar specified a 2014-T6-series aluminium alloy, die forged and machined-finished to final dimensional tolerance. The 2014-series wrought aluminium alloys can be precipitation hardened.[3]
Cessna 177
The Cessna 177 (C177) is a four-seat high cantilever wing, piston-engine aircraft built by the Cessna Aircraft Corporation between 1968 and 1978. The C177 incorporated a similar wing spar carry-through structure as the C210.
VH-SUX
The aircraft (serial number 21061042) was manufactured in the United States in 1976 as a turbocharged T210L model which was updated to a T210M model prior to entry into service.[4]
History
From 13 January 1976 until 31 August 1981, the aircraft was owned by the manufacturer, Cessna (Figure 5) and undertook flight testing and transport flights. Excluding the origin and destination of the transport flights, their purpose was unknown. Similarly, the specific nature of the flight testing was for the most part unknown. Flight records listed some as engine test, ice flight test or were referenced simply as ‘flight test’.
Figure 5: VH-SUX (US registration N2075S) in service with Cessna
Source: Cavanagh J & Shields K 1995, Standard catalog of Cessna single engine aircraft p748, Jones publishing, Wisconsin USA
In August 1981, the aircraft was sold by Cessna. At that time, the aircraft had accrued 1,180.3 hours in service. Detailed records of the subsequent use of the aircraft while in the United States were not available.
In 2011 the aircraft was purchased by Thomson Aviation and imported into Australia. At that time, the aircraft had 5,933.8 flight hours in service. After arriving in Australia, the aircraft was modified for geophysical survey work. This included the removal of the passenger seats and the installation of specialised equipment.
In June 2013, the aircraft commenced survey operations. The aircraft conducted 1,739 flights and accumulated 6,241.1 flight hours in the 6 years it was on the Australian register (an average of 3.59 hours per flight). It was operated exclusively as a geophysical survey aircraft during that time.
The maintenance release was recovered from the wreckage and showed that:
There were no outstanding defects or maintenance requirements.
The last scheduled maintenance was a 110 hourly inspection conducted on 17 May 2019, 9 days prior to the accident, at 12,117.2 hours in service.
The total time in service before the accident flight was 12,174.9 flight hours.
Suitability for operation
The aircraft was used in the geophysical survey role as the C210 provided an economical platform which combined good speed, manoeuvrability, and its design provided maximum magnetic sensor performance. At the time of the accident, Thomson Aviation utilised five C210 aircraft for geophysical survey operations.
Modifications
Numerous modifications were incorporated into the aircraft during its service life as shown in Tables 1 and 2:
Table 1: Modifications incorporated in the United States.
Date
Modification
Note
1979
Conversion from L to M model
August 1981
Complete de-ice system installation
Removed June 2013
August 1981
Fuel system modification
March 2001
Increase in maximum gross weight from 1,723 kg to 1,814 kg
At 4,662 hours in service
July 2010
Turbo-charged Continental TSIO-520 engine replaced with a naturally-aspirated Continental IO-550-P3B engine and matched propeller
Table 2: Modifications incorporated in Australia
Date
Modification
Note
June 2013
· auxiliary fuel tanks installed in the left and right wing tips
· radio altimeter installed
· weather radar removed
· satellite telephone system installed
· survey equipment, including tail magnetometer, installed
· four-point harnesses installed in pilot and observer positions
Figure 6 shows SUX in its modified configuration for geophysical survey flights, including the magnetometer boom.
Figure 6: VH-SUX (as configured at the time of the accident)
Source: Aircraft operator, annotated by the ATSB
Auxiliary fuel tanks
The aircraft was fitted with auxiliary fuel tanks providing an additional 125 litres of fuel capacity under a United States Federal Aviation Administration (FAA) supplemental type certificate (STC).[5] These comprised an additional fuel tank in each wing tip from which the pilot could transfer fuel to the main fuel tanks using selectable electric pumps.
This installation included the following operational limitation:
For Models 210K, T210K, 210L, T210L, 210M, T210M, and 210N: “Design weights 3,800 lbs (1,723 kg). max. provided each wing tip contains 7 gallons (26.5 L) or more fuel and main tanks are 2/3 full or more. 3530 lbs (1,601 kg). max. with no fuel in wing tips.”
The 1,723 kg maximum weight limitation of the auxiliary fuel tank installation conflicted with a previous FAA STC modification increasing maximum weight to 1,814 kg. The operational documentation provided for the aircraft did not provide a resolution to this conflict. The operator’s documentation for the aircraft listed the maximum take-off weight of 1,723 kg. The operator also advised that it was not aware of the modification increasing maximum gross weight to 1,814 kg and that all Australian operations had been undertaken with 1,723 kg as the assumed maximum allowable gross weight.
Aircraft loading
Standard loading for survey operations was one crewmember and full main and tip fuel tanks. This resulted in a take-off weight of about 1,672 kg and ensured the centre of gravity remained within balance limits.
For the accident flight, the main fuel tanks were reportedly filled but the wing tip tanks were left empty. This was done to ensure the total weight remained below 1,723 kg while allowing for the increased weight of the observer.
The weight and balance of the accident flight was estimated using:
recorded aircraft weight and balance data
the estimated weights of the pilot, the observer, and their personal belongings
the weight of the fuel reported to have been on board.
The aircraft was calculated to have been inside balance limits with a take-off weight of 1,644 kg. This was 43 kg above the 1,601 kg maximum allowable weight for operations with the wing tip fuel tanks empty
The maximum weight limitation for operation with tip tanks empty is intended to maintain similar bending loads for the wing and carry-through structure as those of an unmodified aircraft. Operations exceeding this weight without fuel in the tip tanks will increase fatigue damage accumulation within the carry‑through structure (see the section titled Accident flight weight limit exceedance).
Operational information
Geophysical survey
The operation was a geophysical survey of a large area of land surrounding Mount Isa (Figure 7). The flight was to be conducted at a target height of 60 m (200 ft) AGL and the normal C210 cruise speed of about 150 kt along parallel east and west lines, spaced about 90 m apart. These were supplemented by north and south data quality assurance survey lines spaced about 200 m apart (Figure 8).
Figure 7: Overview of Mount Isa survey area with a close-up of the survey pattern (inset)
Source: Operator and Google Earth, annotated by the ATSB
Figure 8: Recorded GPS flight path of accident flight
Source: Recovered survey computer data and Google Earth, annotated by ATSB
Topography
The topography of the survey area included rugged hills separated by undulating valleys. The predominant vegetation was low open woodland over spinifex hummock grassland. The elevation range of the survey area varied from 1,000 ft to 1,700 ft AMSL.
Flight profile and maneuvering
As the survey flight path encountered terrain or obstacles along a survey line, the pilot climbed and descended the aircraft within the operational and performance limitations of the aircraft to maintain the target height as closely as possible. This resulted in a ‘draping’[6] flight profile (Figure 9). At the completion of each survey line, the pilot climbed the aircraft to about 500 ft AGL and performed a turn at about 45° angle of bank to commence the next survey line in the opposite direction.
Figure 9: Depiction of the accident flight recorded GPS data showing the terrain following (‘draping’) profile
Gust loading (turbulence)
At the low levels of the survey flight profile, the survey aircraft were often affected by mechanical and thermal turbulence.[7] Other survey pilots reported that turbulence experienced during survey flights was often severe. The operator had instructed the survey pilots to use their judgement to determine when the turbulence became too severe to continue survey operations.
Crewing
Normal crewing for a survey flight was one pilot.
In addition to the pilot, the accident flight also carried an observer. The observer was a pilot for the operator and had recently arrived in Mount Isa to join the ongoing survey as an operating pilot. As was the operator’s normal practice, prior to commencing survey operations, a flight was operated with the new pilot in an observer role. The purpose of the observation was to familiarise this incoming pilot with the survey area including the pattern, airport, and topography.
Wreckage and site information
The accident site was located about 25 km north-east of Mount Isa Airport in flat, arid scrub land (Figure 10). The wreckage trail was on an approximate east to west heading, in line with the survey flight path. The right wing (Figure 11) was the first major component in the wreckage trail and was located about 130 m from the main wreckage. The aircraft impacted terrain about 90 m from the right wing, coming to rest a further 40 m away.
Figure 10: Accident site overview looking south‑east
Source: ATSB
Figure 11: Separated right wing viewed from the inboard end
Source: ATSB
All major aircraft components were accounted for at the site. The structure was significantly disrupted with the aircraft fuselage, tail, and left wing located towards the end of the wreckage trail. The left wing was fractured into two pieces, resting upside down and in the opposite direction to flight. The wing spar carry-through structure attached to the left wing showed a fracture surface that corresponded with the remaining carry-through section from the right wing (Figure 12).
Figure 12: The fractured carry-through structure as removed from the wreckage viewed from the rear
Source: ATSB
On-site site examination of the wreckage indicated the right wing and part of the wing spar carry‑through (see the section titled Wing spar carry-through structure) had separated from the aircraft. Preliminary examination of the carry-through spar identified that it had fractured through an area of pre-existing fatigue cracking inboard of the wing attachment lugs (Figure 13).
The carry-through structure was removed from the accident site and transported to the ATSB technical facilities in Canberra for detailed metallurgical examination.
Figure 13: Main spar carry-through fracture surface showing area of fatigue cracking on the lower spar cap
Note: The two brown blemishes in the area of fatigue cracking were substances deposited onto the fracture surfaces during the accident.
Source: ATSB
Further examination of the wreckage was limited by the extensive damage to the aircraft. However, the evidence indicated that the engine was driving the propeller at impact. Other than the wing spar carry-through structure cracking, no pre-existing defects were identified.
Metallurgical examination
Visual examination
A visual inspection of the carry-through structure showed that it had fractured just outboard of a thickness transition between the wing lug base region and the central beam; approximately 290 mm from the right root rib attachment lug (Figure 14).
Figure 14: An exemplar Cessna 210N wing spar showing the approximate location where cracking had developed on the carry-through from SUX
Note: This C210N wing spar carry through was coated during manufacture with a corrosion inhibiting primer paint.
Source: Civil Aviation Safety Authority, annotated by the ATSB
Almost the entirety of the spar was a light yellow/green colour, which was consistent with the application of the specified corrosion inhibiting chromate surface film. No evidence was found to indicate the chromate had been reapplied since manufacture. The foam section normally glued to the underside surface of the carry-through structure was absent. The uppermost portion of the spar had been painted white, consistent with the C210M design where that portion of the spar formed a segment adjoining the external roof skin panels of the aircraft (Figure 15).
Figure 15: The carry-through spar in the ATSB laboratory
Source: ATSB
The visual examination also identified that pitting corrosion damage had developed at multiple discrete locations along the underside surface of the spar (Figure 16). The corrosion damage was also identified adjacent to the fracture plane and confined to the underside surface with no evidence of corrosion on other parts of the structure.
The fractured section of the carry-through spar was examined at varying magnifications using a binocular microscope. The lowermost section of the carry-through spar contained two separate failure mechanisms. Most obvious, was a region of generally flat fracture containing a series of concentric marks (beach marks), consistent with the typical appearance of fatigue cracking (Figure 17). The remaining regions on the fractured spar presented a dull, fibrous and angular appearance consistent with ductile fracture from overstress conditions (Figure 18).
Figure 17: Key measurements of the fatigue portion along the fracture surface
Note that cracking has commenced on the underside surface (inverted in figure) of the carry-through spar.
Source: ATSB
Figure 18: The spar fracture surfaces showing a side-by-side comparison
Source: ATSB
The concentric radiating features present on the fracture showed that fatigue cracking had initiated at a localised underside surface position. A series of ridges (river lines) across the fracture plane at the intersection with the underside surface indicated that fatigue cracking had initiated from a discrete origin (Figure 19). Further inspection revealed that the crack origin was associated with the presence of pitting corrosion that had penetrated and damaged the spar (Figure 20).
Figure 19: Close-up view of the fracture surface surrounding the corrosion pit cluster at the fatigue crack origin
The fracture surface shown was located on the inboard portion of the carry-through structure. Source: ATSB
Figure 20: View of the underside surface showing a corrosion pit cluster at the fatigue crack origin
The surface shown was located on the inboard portion of the carry-through structure. Source: ATSB
As the fatigue crack had grown and approached a critical size,[8] 10 to 12 outer bands of crack progression were linked by bands of tearing (or overstress). These bands were an indicator of accelerating, rapid crack growth that developed in the final period of operation prior to the accident. Detailed measurement of the final band prior to the fatigue-overstress indicated a length of between 0.4 to 0.5 mm. The optical examination did not identify any evidence of finer fatigue striations that might have been associated with an individual load cycle, or a discrete event such as a ground-air-ground cycle (take-off and landing).
Crack measurements
Measurements of the significant features from the fractured spar structure showed that the fatigue cracking grew transversely in a vertical plane before reaching a critical depth of approximately 16 mm toward the web. When measured from the underside surface, the crack had a surface length of approximately 42 mm. The extent of fatigue cracking in the critical section of lower flange was calculated to represent close to 38 per cent of the cross-sectional area of the spar that was in tension (during positive-G flight).
Scanning electron microscopy
Scanning electron microscopy (SEM) techniques were used to closely examine and characterise the surfaces of the fractured carry-through spar and to further support the visual assessment.
Semi-quantitative energy dispersive x-ray spectroscopy was also used to assist in analysis of the products that had formed within the corrosion pits (refer to Appendix A for additional detail).
SEM of fractured lower carry-through spar
Distinct fracture morphologies (origin, fatigue and overstress) from the section of lower carry-through spar were confirmed via examination in the scanning electron microscope. SEM of the fracture origin identified that the corrosion pit damage that initiated the cracking was characterised by an amorphous corrosion product. The corrosion damage transitioned into an underlying zone of intergranular cracking at the base of the pit, before transitioning toward fatigue cracking. Other corrosion pits that were examined on the underside surface of the carry-through spar were also identified to have generated fine intergranular corrosion cracks that penetrated into the base alloy.
The fatigue portion of the fracture was a mixture of predominantly transgranular striations interspersed with some ductile tearing. The fatigue cracking was clearly identifiable through the presence of ‘river’ lines that were directed from a single region of corrosion pitting on the underside surface.
The overstress region was defined almost entirely by micro-void coalescence, features that confirmed that the final fracture was ductile in nature.
Crack analysis
The fatigue crack that had initiated within the lower spar cap reached a critical depth of about 16 mm (measuring 42 mm in length along the underside surface), at which point structural failure occurred. Tear bands developed as the crack increased in depth as it progressed through the structure toward the web. The tear bands showed that the stresses within the structure were increasing and further indicated that the rate of crack growth was accelerating as it progressed.
Crack growth rate
In-service exposure to stresses within the wing spar carry-through are variable and their magnitude is affected by factors such as aircraft weight, take-off and landing cycles, speed and the type and severity of operations being flown. Gusts and manoeuvres of varying magnitudes are the typical in-flight loads affecting wing structure fatigue life.
The load regime imparted though the wings to the carry-through structure during the service life of the aircraft throughout the period of crack growth was normalised to the following load types.
gust loads/aerodynamic buffeting (short interval, less than 2 seconds, both negative- and positive-G
manoeuvre loads (longer interval, typically greater than 2 seconds, both negative-G and positive-G)
taxiing loads
take-off and landing loads (ground-air-ground cycles)
Each load type varied in magnitude; however, it was the take-off and landing loads (ground-air-ground cycles) that were most likely to impart an identifiable, unique and repeatable signature on the fatigue fracture surfaces. This was due to the equivalent loading sequence imparted as the lower spar cap transitions from tension (during flight) to compression (during landing).
The SEM examination also revealed a very high number of striations present throughout the fatigue fracture surface (Figure 21). These were only evident and able to be identified when viewed at very high magnifications (1,400 to 2,500 times magnification) and were less than 1‑micron in spacing. It is probable that the very fine sub-micron striations leading to crack growth were produced from lesser loads as the aircraft was manoeuvred and affected by gust loads.
Separating the very fine striations were regions identified as ‘unique’ progression bands. In this case, the ‘unique’ progression bands were identified across almost the entirety of the fatigue fracture surface and consisted of regularly repeating units. Due to the regularity of the progression marks, in combination with their identifiable and consistent features, it was probable that these bands represented ground-air-ground cycles.
Figure 21: Scanning electron microscopy of the fracture surface
The fracture surface shown was located on the inboard portion of the carry-through structure. Source: ATSB
Measurement of the unique features was performed across the fatigue crack front. The number of unique progression bands during this period of crack growth was estimated by taking the average spacing between each measurement interval and dividing this striation spacing into the interval, then summating the numbers for each interval.
The distance between each ‘unique’ progression band was one flight cycle. A quantitative assessment of the fracture established that fatigue cracking had probably developed over a sustained period of operation of about 3,300 hours of time in service.
Corrosion
Pitting corrosion
Pitting corrosion, (Figure 22) as found in the carry-through underside surface on SUX, was described in the Cessna C210 service manual as:
The most common effect of corrosion on polished aluminium parts is called pitting. It is first noticeable as a white or grey powdery deposit, similar to dust, which blotches the surface.
When the deposit is cleaned away, tiny pits can be seen in the surface.
Figure 22: Pitting corrosion diagram
Source: Textron Aviation
Accident spar corrosion damage
To the unaided eye, the underside surface of the fractured spar appeared in relatively good condition. There were minor amounts of pitting damage along the underside surface, but no significant corrosion products (aluminium oxides), nor any significant scoring, gouging or related mechanical damage present.
Very fine marks were noted on the underside surface, which were consistent with the final-finish machining processes and very likely remnant from original manufacture. The were no indications of rework or blending of the underside surfaces that might have otherwise indicated repair of previously identified corrosion damage.
Inspection of the carry-through spar surfaces at higher magnifications using a binocular microscope identified the extent to which the structure had sustained corrosion damage during its service life, prior to the failure. The corrosion had led to the development of clusters of micro-pits on the underside of the carry-through spar. In the absence of corrosion protection, pitting of that nature is not unusual for the aluminium alloy used in the manufacture of the spar.
Detailed visual inspection of the corrosion damage on the underside surfaces suggested there were no other secondary micro-cracks present in the structure. To confirm that visual assessment, a non‑destructive examination of the spar structure was completed using fluorescent penetrant techniques (Figure 23). No additional cracks were detected on the structure, including the underside surface (where the cracking had initiated) as well as the outboard attachment lugs.
Figure 23: Composite image of the carry-through spar during liquid fluorescent penetrant inspection
Source: ATSB
Corrosion assessment and repair
Prior to the accident, Textron Aviation and Civil Aviation Safety Authority (CASA) maintenance inspections stipulated that if corrosion was identified during inspection then either Textron Aviation or another authorised design organisation should be contacted. The authorised organisation (usually Textron Aviation) would assess the damage and either recommend a repair, or in severe cases, replacement of the carry‑through. In the event that a repair scheme was recommended by a design organisation other than Textron, CASA would assess and approve the repair scheme for compliance.
Textron Aviation advised that, prior to the accident and for the level of corrosion found on the structure recovered from SUX (without knowledge of any fatigue cracking), the following repair process would have been provided:
a. Remove any corrosion using a 20:1 blend ratio.
b. Measure remaining thickness of the spar as well as the thickness of both upper and lower caps and web at the blended location.
c. Report measurements to Cessna Customer Service on the Structural Damage Report form
d. Repair engineering would use the measurements to determine if the spar is still serviceable with the noted measurements.
Following the accident, the manufacturer provided the following criteria to assess the damage severity:
Scenario 1: “Nothing to see here”
If the intent of the service letter [see the section titled Service letters and airworthiness directive] is complied with, no cracks are noted after non-destructive inspection (NDI), and the corrosion is surface corrosion only, the customer will just send us the Carry-thru Inspection Report and no further input is needed from us.
Scenario 2: “Superficial corrosion”
If the intent of the SEL is complied with, no cracks are noted after NDI, but more than minor surface corrosion is noted and removed, than any material removal less than 0.010” (0.254 mm) deep may be considered minor provided a thorough review of the aircraft’s maintenance records/logbook indicates no prior blending to the carry-thru spar has occurred.
If no prior blending is discovered, a Minor repair memo can be issued…if a detailed damage report all pertinent repair data is provided.
Scenario 3: “Material removed and needs engineering review”
If the intent of the SEL is complied with, no cracks are noted after NDI, and the removal is in excess of 0.010” (0.254 mm) deep than a detailed damage report (same as Scenario 2 above) must be sent to Textron Aviation Engineering for specific detailed analysis and review for a FAA approved field repair.
Scenario 4: “Replace the carrythru”
If inspection (visual or NDI) reveals a crack indication, severe intergranular corrosion or material removed in the ‘arm pit’ is in excess of 0.040” (1.016 mm) deep (Models “G” thru “M”) or in excess of 0.030” deep (Models “N” & “R”) the spar carrythru must be replaced and no further flight is permissible.
Based on the manufacturer’s criteria, most of the corrosion identified on the carry-through under surface of SUX was in the scenario 2 ‘superficial corrosion’ (less than 0.010 inches (0.254 mm) deep) which would have required minor repair. However, there were four corrosion pits identified that were in the scenario 3 ‘material removed and needs engineering review’ (exceeding 0.010 inches (0.254 mm) but less than 0.040 inches (1.016 mm) deep).
Corrosion damage growth
The rate of corrosion damage growth to an alloy such as 2014-T6 changes with exposure to external factors such as:
oxygen availability
presence of electrolytes (e.g. salts)
mechanical stress
time of exposure
The unknown variations in these factors prevented determination of the rate of corrosion growth for the corrosion identified on the recovered wing spar carry-through structure.
Maintenance
Operator system of maintenance
The operator had their own CASA‑approved system of maintenance. The maintenance schedule incorporated the:
generic Civil Aviation Safety Authority system of maintenance (CAAP 42B-1(1))
Cessna Supplemental Inspection Documents (SID’s)
Cessna corrosion prevention and control program (CPCP).
The addition of geophysical survey equipment resulted in several other inspections also being integrated.
Due to the high hours and low cycles generated by the work undertaken, the system of maintenance allowed for 100 hourly inspections to be extended to 110 hours and 200 hourly inspections to be extended to 220 hours. The frequency of the inspections of the wing carry‑through structure in the area of the fatigue crack was not altered from the normal Cessna maintenance schedule as it was based on calendar time, not flight hours.
For maintenance purposes the operator considered that the aircraft was being operated in a severe[9] environment and severe usage in accordance with the Cessna maintenance schedule.
Wing spar carry-through inspections
Removing the cabin interior roof lining allowed good access to the carry-through structure for inspections (Figure 24).
Figure 24: View of the carry-through structure looking aft with the cabin lining removed
Note: This C210N wing spar carry-through was coated during manufacture with a corrosion inhibiting primer paint.
Source: ATSB
Required inspections
The area of the fatigue crack in SUX was subject to a manufacturer‑directed visual inspection and a similar visual inspection directed by a CASA‑issued airworthiness directive.
It should be noted that all inspections of the underside surface of the structure at the time of the accident were calendar time based. Prior to the accident, the last detailed visual inspections undertaken of the carry-through structure were:
Supplemental Inspection (SID) number 53-11-01 – Carry-through spar corrosion inspection, initial interval 10 years with repeat inspections every 3 years. The last inspection was conducted on SUX on 10 November 2017, 1,746.4 flight hours prior to the accident. Maintenance logs recorded no defects were identified.
AD/Cessna 210/61 Amdt 2 – Inspection of entire wing carry-through structure for corrosion every 10 years. Thereafter every 6 years, or if the spar carry-through has been subjected to an approved corrosion protection scheme, 12 years. This inspection was last conducted on SUX on 22 December 2017, 1,531.6 flight hours prior to the accident. Maintenance logs recorded no defects were identified.
Cancelled inspection
As a result of fatigue concerns resulting from incidents on other models, on 1 July 1992, the manufacturer introduced Continued Airworthiness Program (CAP) inspection number 57-10-08.
That inspection required a visual and eddy-current[10] inspection of the underside surface of the carry-through. For normal operations, it was to be undertaken initially at 12,000 hours of service and repeated every 6,000 hours. For the low-level overland survey flight profile, the inspection required significantly reduced intervals:
Should any history of low-level overland survey or patrol exist then the initial inspection compliance is 4000 hours with repeat inspections at 400-hour intervals thereafter.
The manufacturer advised that testing of a C210G carry-through structure showed the lower centre wing attachment lug to be a critical area. These test results led to the introduction of the inspection. The manufacturer could not produce any documentation indicating why the underside surface of the carry-through structure was also included in this inspection.
This inspection was subsequently cancelled by the manufacturer in 2012 (1 year before SUX commenced operations in Australia). SUX started low‑level overland survey flights in 2013 at 5,933.8 total hours in service and did not reach the threshold for the initial inspection requirements before the inspection was cancelled.
CAP inspection 57-10-08 was replaced with the visual supplemental inspection number 53-11-01, which was mandatory in Australia. The manufacturer stated that the requirement for an eddy current inspection was removed because:
Cessna decided to develop history-based SID documents for the 100 and 200 series fleet… The inspections were intended to be visual for lower time airplanes. Non‐destructive inspections were called out only for high time airplanes or in situations where visual inspections would not reliably find the crack.
There was no field history of the carry‐thru spar cracking. The only cracks were those observed in cyclic testing which were found in the lower lugs [wing attachment points]. The known field issue with the carry‐through is corrosion, and there have been many instances of corrosion being severe enough to require replacement of the carry‐thru. Thus, the SID addressed the history of the part which are the corrosion inspections found in 53‐11‐01.
Post-accident Cessna 210 fleet inspections
Service letters and airworthiness directive
On 24 June 2019, the manufacturer released service letters SEL-57-06 for the C210 and SEL‑57-07 for the C177. These service letters required a one-off inspection of the carry‑through structure and communication of inspection findings to the manufacturer. On 4 November 2019, following the analysis of findings from the previously released service letters, the manufacturer released updated SEL-57-08 for the C210 and SEL-57-09 for the C177. On 19 November 2019, the manufacturer released further minor revisions to these updated service letters.
On 21 February 2020, the United States Federal Aviation Administration (FAA) adopted Airworthiness Directive (AD) AD 2020-03-16 for all Cessna model 210G, T210G, 210H, T210H, 210J, T210J, 210K, T210K, 210L, T210L, 210M, and T210M aircraft. This AD required:
visual and eddy current inspections of the carry-through spar lower cap
corrective action if necessary
application of a protective coating and corrosion inhibiting compound
reporting the inspection results to the FAA.
Inspection results
Service letter inspection results
Following the release, Textron Aviation advised that 196 reports had been received regarding SEL-57-06. Of these, 69 (35 per cent) reported that corrosion was identified, and 11 carry‑through structures (6 per cent) were removed from service.
FAA AD inspection results
At the time of writing, the FAA had received 923 reports. Of these, 430 (47 per cent) reported corrosion and 57 carry‑through structures (6 per cent) were removed from service.
These inspection results were provided to the ATSB which highlighted a considerable variance across the fleet. Some aircraft displayed significant corrosion damage to the underside surface of the carry-through spar (Figure 25). For those aircraft, there appeared to be major intergranular cracks present. While it was not known how many of these structures were subsequently inspected for fatigue cracking, additional instances of fatigue cracking, as found in SUX, were reported.
Figure 25: Examples of severe carry-through structural corrosion damage identified through SEL 57-06 inspections
Source: Textron Aviation
Airframe fatigue
Aircraft should be designed so that the stresses in their structures from the expected flight loads do not exceed the strength of the materials from which they are constructed. However, the materials used to construct aircraft can be damaged by fluctuations in those stresses, even if they are below the static strength of the material.[11]
The damage from each stress fluctuation is small, but the accumulation of many stresses over time can result in significant damage. The accumulated damage from these fluctuating stresses is referred to as ‘fatigue damage’. Fatigue damage leads to the formation of cracks in the aircraft’s structure. Cracks reduce the load-carrying capability of the structure, which if not managed, can ultimately lead to in‑flight structural failure.
The safe-life of a structure is that number of events, such as flights, landings or flight hours, during which there is a low probability that the strength will degrade below its design ultimate value due to fatigue cracking.
Fail-safe is the attribute of the structure that permits it to retain its required residual strength for a period of unrepaired use after the failure or partial failure of a principal structural element.
Damage tolerance is the attribute of the structure that permits it to retain its required residual strength for a period of use after the structure has sustained a given level of fatigue, corrosion, accidental, or discrete source damage.
Safe-life design is intended to have the structure retired before there is a likelihood of fatigue cracks affecting its strength.
Fail-safe means that redundant structure will cope with the failure of major structure until it is discovered during an inspection program.
Damage tolerance relies on detection of cracks through a specifically designed inspection program to ensure that cracks from fatigue, corrosion or accidental damage are identified before they become large enough to sufficiently degrade the remaining strength.
Wing fatigue components
Wing fatigue life calculations break the analysis down into four loading spectra components:
flight loads
taxi loads
landing impact loads
ground-air-ground cycles.
Flight loads are further split into gust and manoeuvre components. The fatigue life is split into various components to enable designers to then apply those components of the calculation to their assumed flight load profile. For example, training aircraft will have a more severe manoeuvre loading spectra and ground-air-ground cycles than an executive aircraft. Likewise, low-level survey aircraft will have a more severe gust loading spectra than a personal aircraft.
When determining the fatigue damage endured by a structure, it is straightforward to separate flight loads from landing loads or taxi loads as they are distinct phases of flight. Separating manoeuvres from gusts is more difficult, particularly as they can occur simultaneously at different magnitudes.
Accident flight weight limit exceedance
The aircraft commenced the accident flight with a gross weight about 43 kg above the 1,601 kg maximum allowable weight for operations with the wing tip fuel tanks empty.
The ATSB assessed this exceedance to determine its possible contribution to the accident. As the fatigue crack was well developed prior to the accident flight and the aircraft remained within other weight and balance limitations, this exceedance was determined to not have had a significant effect on fatigue damage accumulation for SUX or otherwise have contributed to the accident.
Fatigue damage design guidance
Flight load fatigue spectra
Regardless of the fatigue management approach used, designers aim to understand how the in‑flight stresses vary within the structure over the life of the aircraft. This will depend on a broad range of factors, from the weight for each flight, the environment in which the aircraft is operated, to the manner the aircraft is operated. The designer cannot know all of these factors in advance for each aircraft, so they typically use an assumed load spectrum that will represent that design.
Flight load spectra for fatigue analysis purposes are typically presented as the distribution of the number of times that a flight load factor would be exceeded for a range of flight load factors within the normal flight envelope. For example, flight load factors of about 1g would be expected to occur often, whereas loads near the limit load factor would be rare.
Since the design of the C210, the FAA has developed and released its own flight load spectra for aircraft operating in various roles. These are contained in FAA Advisory Circular AC 23-13A.
In developing the Advisory Circular, multiple aircraft in various operational and airworthiness categories were used to record data. This data was manipulated to generate gust and manoeuvre load spectra graphs. These were combined for multiple aircraft in a given category to develop an average load spectrum as defined in the FAA Memorandum associated with AC 23-13A.[12] Assessments were then made with regards to developing curves that would capture an adequate number of aircraft in the fleet and ensure the resulting failure rate would be tolerable.
The FAA chose 1.5 standard deviations above the mean value to ensure a 99.9777 per cent chance of an aircraft meeting its claimed fatigue life without developing a detectable crack. Thus, data in the Advisory Circular is presented against both the design requirements and a mean distribution to give context to the results.
It should be noted that review of technical documentation referenced by the Advisory Circular shows that AC 23-13A spectra for survey aircraft were developed from two sample aircraft conducting pipeline patrol survey[13] work.
Recorded data
Survey acquisition system data
The survey system on board SUX recorded various parameters including laser height, radio height and barometric pressure along with differential GPS positions (Figure 26).[14]
Data was recovered from this system which captured the accident flight until a point 160 m prior to the initial impact point. This included indications consistent with the separation of the right wing commencing about 285 m prior to the initial impact point.
Figure 26: Depiction of the recorded GPS data of the final moments of the accident flight
Source: Recovered survey computer data and Google Earth
The data showed that immediately prior to the in-flight breakup, the aircraft was in near level flight at a height of 193 ft AGL and a ground speed of 147 kt.
Analysis of differential GPS data
The ATSB further examined the differential GPS data to determine a manoeuvre fatigue load spectrum for the aircraft during the accident flight. However, limitations in the derivation of these loads prevented a robust analysis. The sample rate of the data (2 Hz) was not sufficient to determine gust loads and could only be used to derive a manoeuvre spectrum. Additionally, there was no effective way of validating the accuracy of the derived accelerations.
To address the limitations of the data recovered from SUX, the ATSB, in cooperation with the operator, undertook data gathering to determine in-flight loads associated with the geophysical survey flight profile. To do this, an accelerometer module was fitted to another Thomson Aviation C210N, VH-JEI (JEI).
Survey flight data gathering and analysis
The accelerometer fitted to JEI was rigidly mounted, near the aircraft’s centre of gravity and sampled by the survey computer at 20 Hz. This resolution enabled derivation of both manoeuvre and gust spectra.
Data encompassing 95 flights (374.6 hours and 49,755 NM) over a period of 10 weeks during autumn in 2020 was sampled and analysed. This included the survey commenced by SUX near Mount Isa and a section of another survey area near Parkes, New South Wales.
As the C210 was certified under Part 3 of the United States Civil Air Regulations and has no defined fatigue life, no comparative data was available. Therefore, the aim of the data gathering was to compare results to FAA manoeuvre and gust load spectra for survey work as provided in AC 23-13A. The aircraft was assessed against Advisory Circular flight load spectra for executive usage[15] and survey (pipeline patrol).
The FAA presented data from multiple sources based on sampling flights and aircraft in a similar manner to this project. In fact, in designing this program of data gathering, elements were chosen such that correlation with past data collection would be achievable. However, data collection has changed over the years. The original data collection in the 1970’s used photographic film exposed to light. For this program, completely digital methods were being used.
When differentiating manoeuvres from gusts, the ATSB considered any loading event which deviated from normal acceleration (1g) for more than 2 seconds as a manoeuvre and any less than 2 seconds is a gust. This is the same method as that used in AC23-13A.
Data analysis findings
Manoeuvre loads
Examination of the data from JEI identified that, with respect to manoeuvre loads, the rate of heavier pitch up manoeuvres (above 2g) were about usual for a survey aircraft but lighter pitch up manoeuvres (up to 1.75g) tended to occur much more often, even above the AC 23-13A survey spectra design curve. For pitch down manoeuvres, virtually all manoeuvre counts greatly exceeded the mean and design curves. Only for pitch down manoeuvres below -0.15g did the manoeuvre counts fall below the design criteria.
For the type of survey work being conducted by the operator, quite forceful manoeuvring was required, particularly for pitch down manoeuvres. Additionally, the total number of manoeuvres was high and the balance of pitch up and pitch down manoeuvres was relatively equal. For normal operations (personal, training, executive) pitch up manoeuvres are assumed to outnumber pitch down manoeuvres by a significant margin. In fact, between 0.7g and 1g away from normal acceleration, the number of pitch up manoeuvres will exceed equivalent pitch down manoeuvres by a factor of 30. However, the need for geophysical survey aircraft to ‘terrain follow’ meant pitch down and pitch up manoeuvres were virtually equal. Only manoeuvring at the end of survey runs and away from the survey area slightly increased the number of pitch up manoeuvres.
When assessed against the executive usage profile presented in AC 23-13A (Figure 27) the results showed that the aircraft exceeded usage assumptions for lighter pitch up manoeuvres and far outstripped pitch down manoeuvres. It was up to 50 times the rate for 0.5g pitch up and pitch down manoeuvres (±0.2 acceleration fractions[16].)
Figure 27: Recorded manoeuvre spectrum compared with executive and survey spectra
Note: FAA memo mean frequency refers to that defined in the FAA Memorandum and is that used to calculate the equivalent design curve in AC23-13A.
Source: ATSB
Gust loads
When assessed against the survey usage profile presented in AC 23-12A (Figure 28), positive gusts were generally found to be slightly higher than the design criteria for light gust (<1.8g), reducing to slightly below design criteria for more severe positive gusts (>1.8g) though remaining well above mean frequency. This data was collected in late autumn and did not contain summer data that would be expected to include more turbulence,[17] though this may be offset by winter data. For negative gusts, again the aircraft experienced light gusts around design criteria above +0.5g with the accumulation of more severe gust experiences dropping to about average by -0.5g and below average by -1.5g.
The gust loading experienced by JEI did not show an exceedance as severe as the manoeuvre loading, but greatly exceeded the executive aircraft assumptions.
Figure 28: Recorded gust spectrum
Note, FAA memo mean frequency refers to that defined in the FAA Memorandum associated with AC23-13A.
Source: ATSB
Similar occurrences
Fatal accidents due to metallic fatigue have occurred throughout aviation history and resulted in the introduction of specific fatigue design and maintenance requirements. Most of these accidents occurred in aeroplanes type certificated prior to specific fatigue requirements. Additionally, some of the accidents in aeroplanes with fatigue in their certification bases can be traced to excessive loading spectrum, beyond the assumptions used in the type design.
This accident was the first reported occurrence of a carry-through fatigue cracking or fracture in a Cessna 210 aircraft.
The ATSB identified two other accidents, detailed below, involving an undetected fatigue crack that led to a fracture and in‑flight wing separation. It is noted that they involved different aircraft types and operation to that associated with the VH‑SUX accident.
On 24 October 2013, the pilot of a modified PZL Mielec M18A Dromader, registered VH-TZJ, was conducting a firebombing mission about 37 km west of Ulladulla, New South Wales. On approach to the target point, the left wing separated. The aircraft immediately rolled left and descended before impacting terrain, fatally injuring the pilot.
The ATSB found that the left wing separated because it had been weakened by a fatigue crack in the left wing’s lower attachment fitting. The fatigue crack originated at small corrosion pits in the fitting. These pits formed stress concentrations that accelerated the initiation of fatigue cracks.
National Transportation Safety Board investigation ERA18FA120
On April 4 2018, a Piper PA-28R-201, N106ER, collided with terrain following an in-flight separation of the left wing near the wing root during climb after a touch-and-go manoeuvre at Daytona Beach International Airport, Florida, United States. Both pilots were fatally injured, and the airplane was destroyed.
Metallurgical examination of the accident airplane's left-wing main spar lower cap found that it exhibited fracture features consistent with fatigue through more than 90 per cent of the cross‑section, almost completely reducing its residual strength capability.
On the afternoon of 26 May 2019, while undertaking a geophysical survey flight from Mount Isa, Queensland, the right wing of a Cessna T210M, registered VH-SUX (SUX) separated from the aircraft. The wing separation resulted in an immediate loss of control of the aircraft and collision with terrain, fatally injuring the two crewmembers.
A review of the recorded survey data and aircraft maintenance documentation indicated that the pilot did not manoeuvre the aircraft in a way that directly contributed to the in-flight break up. Furthermore, the failed structure was found to conform to required technical and material specifications. As such, this analysis focuses on the reasons for the failure of the structure and operational factors which led to the in-flight break up.
In-flight break up
The in-flight separation of the right wing was associated with an overstress fracture of the wing spar carry-through structure at an area of pre-existing fatigue cracking. The wing spar carry‑through spar represented a critical load path between the fuselage and wing section. Bending and shear loads during flight were transmitted from the wing and into the fuselage via attachment fittings to the carry-through structure. The loss in structural integrity resulting from the fatigue crack within the carry-through, in combination with normal operational loads, resulted in the overstress failure and separation of the wing.
The location of fatigue crack initiation and direction of crack progression indicated that the carry‑through spar cracking had developed and then, on the accident flight, fractured at a change in section thickness, in a region associated with increased tensile stresses. The underside surface of the spar was exposed to the loads imposed by upward bending of the wing (aerodynamic lift loads). Without any redundant load paths, the fracture of the spar led to the separation of the right wing and an immediate loss of control.
Crack initiation
Relatively minor corrosion damage, associated with the initiation of the fatigue cracking, was evident along the underside surface of the carry-through structure. An area of isolated corrosion pit damage to the alloy structure was identified as the crack initiator. This pitting created a localised stress concentration at a thickness transition between the wing lug base region and the central beam allowing the initiation of micro-cracking, reducing the fatigue endurance of the spar.
A fine network of shallow intergranular cracks was found to have developed at the base of the corrosion pitting. This intergranular cracking, in combination with the pitting damage, raised stresses at that location, further accelerating the fatigue damage. Intergranular cracking associated with corrosion pit damage was also found at other locations on the underside surface of the carry-through spar. However, no other fatigue cracking was identified.
The crack length along the underside surface was approximately 42 mm and penetrated upward into the material until reaching a critical depth of approximately 16 mm. The extent of fatigue cracking in the critical section of lower flange represented close to 38 per cent of the cross‑sectional area of the spar that was in tension, significantly reducing the strength of the structure.
Maintenance inspection requirements
Inspections required at the time of the accident
The last inspections of the area of the crack were undertaken 17 months (1,531.6 flight hours) and 19 months (1,746.4 flight hours) prior to the accident. Both inspections were visual inspections for corrosion detection. No defects were identified during either inspection.
After detailed metallurgical examination and analysis, the ATSB concluded that the fatigue crack (and therefore the initiating corrosion damage) was probably present within the structure for about 3,300 flight hours. The rate of corrosion growth is influenced by several factors, including the condition of the corrosion inhibiting surface treatment and the aircraft’s operating environment. Therefore, it could not be determined if the corrosion pitting present at the time of the last inspection was of a detectable size using the stipulated inspection method (visual).
A post-accident ATSB assessment of the corrosion damage depth indicated that it was not at a level that would be considered severe. At the time of the last inspections, for corrosion of a similar level to that found post-accident, the correct maintenance response would have included a request for an engineering assessment from the aircraft manufacturer. The manufacturer advised that had such an assessment occurred, given the relatively minor corrosion, it would not have resulted in the instruction of a non-destructive inspection (such as an eddy-current inspection) before returning the aircraft to service. Without a requirement for such an inspection, detection of any underlying crack was not assured.
Previous inspections
Introduced in 1992, Continued Airworthiness Program (CAP) inspection 57-10-08 required both visual and eddy-current inspections of the carry-through initially at 12,000 hours in-service, and then repeated at 6,000 hourly intervals. However, when an aircraft was operated in the low-level survey (including geophysical survey), or pipeline patrol flight profile these intervals were significantly reduced to 4,000 hours and 400 hours, respectively. The manufacturer could not provide historical information regarding the engineering justification for introducing this more stringent requirement for the low-level survey or pipeline patrol flight profile.
When creating the supplementary inspection documents for the C210 in 2011, the manufacturer reviewed the history of the aircraft’s structure. As no wing spar carry-through cracking had been identified prior to that time, including during the 19 years that CAP inspection 57-10-08 was in place, and with the knowledge that corrosion of the wing carry-through and surrounding structure was a known issue with the Cessna 210 aircraft, the manufacturer removed those inspections and replaced it with a visual corrosion inspection.
While SUX was undertaking survey operations in Australia, two visual inspections were required (four were completed). However, had CAP inspection 57-10-08 remained in place during that period, 15 visual and eddy-current inspections would have been required. Given how long the fatigue crack was probably present within the structure, inspections conducted in accordance with that program would almost certainly have detected the fatigue cracking prior to the accident.
Flight profile fatigue damage and guidance
Data recovered from the survey computer in SUX indicated that in-flight manoeuvring or gust loads may have been contributory to the development of the fatigue crack. However, limitations in the derivation of these loads prevented a robust analysis.
Therefore, another survey C210 (VH-JEI), was instrumented to gather data to determine the loads sustained by the aircraft during the low-level terrain following profile. Using this aircraft, data for 374.6 hours (95 flights and almost 50,000 NM) of survey operations was recorded.
The C210 was certified in 1957 under regulations which did not require specific fatigue damage analysis. Furthermore, no comparative data was available from that time. However, design fatigue spectra was provided in 2005 by the Federal Aviation Administration (FAA) in Advisory Circular AC 23-13A as guidance to designers and modifiers of aircraft.
The ATSB undertook a comparison of the flight data obtained from JEI to FAA guidance material on fatigue analysis. The fatigue spectra for an executive aircraft was used for the comparison as this spectra best reflected the operational profile for which the C210 are typically operated. Also used for comparison was the survey (pipeline patrol) spectra as this most closely aligned with the geophysical flight profile.
For JEI undertaking survey work, the comparison found that minor gust loads experienced during operations slightly exceeded those presented in AC 23-13A for survey aircraft, but more severe loadings were less than the design guidance. However, the repeated loading and unloading of the wing and carry-through structure associated with the intense pitch up and down manoeuvres was found to be more damaging.
The recorded data also showed that the flight profile exceeded, by an even greater amount, the design curves across the whole spectrum for gust and manoeuvres for the Executive profile (detailed in the section titled Data analysis findings). It was found that almost all manoeuvres were being conducted at a rate 10 times the guidance criteria for executive aircraft and for the pitch up and pitch down manoeuvres of the draping profile it was up to 50 times the assumed rate.
Fatigue profiles are used to determine the expected loads for aircraft structures designed in accordance with Federal Aviation Regulation Part 23. These loads determine the design of both structures and associated maintenance inspections. Any underrepresentation in these spectra may lead to inadequate structure and/or inspections with detrimental outcomes for aircraft safety. However, the ATSB assessed that once additional mitigating factors were also taken into account, the likelihood of the loss of an aircraft designed using this spectra did not meet the threshold criteria for a safety issue.
The C210 was designed and manufactured prior to the introduction of Part 23 and the release of the guidance contained in AC 23-13A. Therefore, the manufacturer was not required to determine a safe-life (fatigue profile) for the aircraft type. In that context, any underrepresentation of in‑flight loads, should they exist, and consequential fatigue damage could not reasonably be considered as contributory to the accident.
At the time of writing this report, there was no data available to determine the extent of the fatigue damage incurred by the C210 operating the geophysical survey flight profile and the extent to which the safe-life of the structure was reduced.
Aircraft modifications
Over the life of the aircraft, many modifications were incorporated into both the airframe and systems. In most part, these modifications were incorporated in a manner that should not have increased the fatigue life damage accumulation of the wing spar carry-through structure.
However, the modification increasing the aircraft’s maximum gross weight from 1,723 kg to 1,814 kg (detailed in the section titled Modifications), incorporated in March 2001 at 4,698.9 hours in service, would have resulted in an increase in the fatigue damage accumulation whenever the aircraft was operated above 1,723 kg. Records of the aircraft’s use (prior to its importation to Australia) were not available, therefore the investigation was unable to determine the extent to which the aircraft was operated above 1,723 kg while overseas.
In June 2013 (at 5,933.8 hours in service), the aircraft was imported into Australia. Its Australian operator was not aware of the incorporation of the modification increasing the maximum gross weight to 1,814 kg. All operator documentation relating to the aircraft listed a 1,723 kg maximum weight and, as normal loading for the survey flights resulted in a take-off weight below the 1,723 kg limit, the higher limit was not utilised.
Therefore, the use of the increase in maximum gross weight was most likely very limited. The other modifications were incorporated in a manner which did not increase fatigue damage to the wing spar carry-through structure. Consequently, the ATSB determined that the modifications incorporated into the airframe did not significantly increase the fatigue damage accumulated by the structure.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the in-flight break-up involving Cessna 210, VH-SUX, 25 km north‑east of Mount Isa Airport, Queensland on 26 May 2019.
Contributing factors
During a low-level geophysical survey flight, a pre-existing fatigue crack in the aircraft’s wing spar carry-through structure propagated to a critical size resulting in an overstress fracture of the structure and separation of the right wing.
Relatively minor pitting corrosion near a highly stressed location on the lower surface of the wing spar carry-through progressed to inter-granular corrosion within the aluminium alloy structure. This increased stress concentration in this area that led to initiation and growth of a fatigue crack, significantly reducing the strength of the structure.
Following an assessment of historical data, the aircraft manufacturer replaced a flight hour‑based repetitive eddy current inspection for cracking of the carry‑through structure with a three-yearly visual corrosion inspection for all operation types. This significantly limited the opportunities to identify fatigue cracking within the carry‑through structure of low-level survey aircraft prior to a crack reaching a critical size. (Safety issue)
Other factors that increased risk
The cyclic loads induced by the low-level survey flight profile were significantly greater than those associated with the higher-level flight profile originally intended for the aircraft type. This probably increased the risk of a fatigue‑related structural failure.
While not contributory to this accident and not applicable to the Cessna 210, the current guidance to determine fatigue damage for survey aircraft designed in accordance with United States Federal Aviation Regulation Part 23 probably underrepresents the rate of damage accumulated by aircraft intended to be used for low‑level terrain following. This may reduce the airworthiness assurance for survey aircraft designed under Part 23.
Other finding
The airframe and system modifications incorporated into the aircraft did not significantly increase the fatigue damage accumulated by the wing spar carry-through structure.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Following an assessment of historical data, the aircraft manufacturer, Textron Aviation, replaced a flight hour based repetitive eddy current inspection for cracking of the carry-through structure with a three-yearly visual corrosion inspection for all operation types. This significantly limited the opportunities to identify fatigue cracking within the carry-through structure of low-level survey aircraft prior to a crack reaching a critical size.
Glossary
AC
Advisory circular
AD
Airworthiness directive
AGL
Above ground level
AMSL
Above mean sea level
AWB
Airworthiness bulletin
CAP
Continuing airworthiness program
CASA
Civil Aviation Safety Authority
CASR
Civil Aviation Safety Regulations
FAA
Federal Aviation Administration
GPS
Global positioning system
IAS
Indicated airspeed
NDI
Non-destructive inspection
SEL
Service letter
SEM
Scanning electron microscopy
STC
Supplemental type certificate
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Civil Aviation Safety Authority
Queensland Police Service
aircraft operator and manufacturer
United States Federal Aviation Administration
United States National Transportation Safety Board
maintenance organisation for VH-SUX
Bureau of Meteorology
recorded data from the survey computer from VH-SUX and VH‑JEI.
References
Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2005-213462.
Cavanagh J & Shields K 1995, Standard catalog of Cessna single engine aircraft, Jones publishing, Wisconsin USA.
United States Federal Aviation Administration 2005, AC 23-13A, Fatigue, Fail-Safe, and Damage Tolerance Evaluation of Metallic Structure for Normal, Utility, Acrobatic, and Commuter Category Airplanes, Washington DC, USA.
United States Federal Aviation Administration 1993, DOT/FAA/CT-91/20 General Aviation Aircraft Normal Acceleration Data and Collection Project, Washington DC, USA.
United States Federal Aviation Administration 1999, DOT/FAA/AR-99/14 An Evaluation of Methods to Separate Maneuver and Gust Loads Factors from Measured Acceleration Time Histories, Washington DC, USA.
United States Federal Aviation Administration 1973, AFS-120-73-2 Fatigue Evaluation of Wing and Associated Structures on Small Airplanes, Washington DC, USA.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Civil Aviation Safety Authority (CASA)
United States National Transportation Safety Board (NTSB)
United States Federal Aviation Administration (FAA)
aircraft manufacturer
aircraft operator
aircraft maintainer
the pilot and observer’s next of kin
Submissions were received from:
CASA
NTSB
FAA
the observer’s next of kin
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Wing spar carry-through examination
Scanning electron microscopy of corrosion damage
Measurements indicated that the corrosion penetrated into the surface approximately 2.9 mm in length by 0.30 mm in depth (Figures A1 to A7). The pit damage that initiated the cracking was characterised by an amorphous corrosion product. Notably, the corroded region transitioned into an underlying zone of intergranular cracking at the base of the pit, before transitioning toward fatigue cracking. Other pits that were examined on the underside surface of the carry-through spar were also identified to have generated fine intergranular corrosion cracks that also penetrated into the base alloy.
Semi-quantitative chemical analysis of the corrosion product located at the fatigue crack origin (as well as other corroded regions) was completed using an energy dispersive spectrometer (EDS) attachment to the SEM. A plot of the EDS spectra is shown at Figure A8. Minor amounts of sodium and chlorine were identified within the corrosion product which suggests that the pitting damage was influenced by the accumulation of common chloride-containing salts on the underside surfaces of the spar.
From these observations it was apparent that the initiating defects were a combination of corrosion pit damage and intergranular attack of the base microstructure.
Figure A1: Scanning electron microscopy of the fracture surface, key features are identified at the fatigue crack origin
It was confirmed that the fatigue cracking initiated from a single corrosion pit cluster which then propagated through the structure from that location.
Source: ATSB
Figure A2: Scanning electron microscopy (back-scattered image) of the fracture surface at the fatigue crack origin
Source: ATSB
Figure A3: Scanning electron microscopy of the fracture surface close to the overstress boundary
Well defined distinct load intervals (or crack arrest marks) and striations were identified along the entire fatigue portion of crack growth up until the overstress fracture.
Source ATSB
Figure A4: Scanning electron microscopy: closer view of the crack arrest marks near the overstress boundary
The distance between each distinct band indicates a distinct load interval that is probably a take-off and landing cycle.
Source ATSB
Figure A5: Scanning electron microscopy of the fatigue fracture surface
A combination of well-defined striations and arrest marks (major load cycles) were identified along the entire portion of the fatigue fracture.
Source: ATSB
Table A1: Unique load count measurements across the fracture surface
Crack Length Distance from origin (mm)
Measured load cycles (n)
Unit Length (um)
Average Microns per Progression Band
1 / (striation spacing)
Incremental Distance (mm)
Striations / Incremental Distance
5.26
5
68
13.6
0.074
4.913
361
5.57
3
53
18
0.057
0.310
18
7.94
3
56
19
0.054
2.364
127
9.41
6
113
19
0.053
1.477
78
11.25
3
63
21
0.048
1.836
87
11.43
4
29
7
0.138
0.178
25
12.86
2
30
15
0.067
1.432
95
13.18
3
80
27
0.038
0.315
12
13.67
2
87
44
0.023
0.495
11
14.34
3
59
20
0.051
0.668
34
14.75
6
63
11
0.095
0.417
40
15.41
8
135
17
0.059
0.654
39
Total estimated number of unique load cycles
927
Figure A6: Scanning electron microscopy image near the crack origin identifying the intergranular and transgranular (fatigue) regions
The corrosion pitting led to intergranular corrosion and the subsequent development of transgranular fatigue cracking.
Source: ATSB
Figure A7: Scanning electron microscopy of the underside surface
Intergranular corrosion/cracking has initiated from the corrosion pits.
Source: ATSB
Figure A8: EDS spectra of the corrosion product within the base of the corrosion pit at the fatigue crack origin
Corrosion damage quantification
To assess the extent of pitting corrosion damage, the underside of the carry-through spar was divided into a grid array, with each square measuring 20 mm by 20 mm. There were 30 sites of corrosion damage selected for measurement. The datum reference point was the oblique centreline of the part. A low-viscosity replicating compound was cast to form a mold of the corrosion damage at each of the selected sites.
A digitally controlled optical microscope was used to scan the mold surface of each corrosion site. Although hundreds of very fine pits were identified on the surface of the fitting, only the very deepest pits at each site were selected for analysis. The mapping survey is presented in Figure A9 and the measurement results in Table A1. The deepest pit measured approximately 0.30 mm.
Several pit clusters were selected for metallographic sectioning to determine the morphology of the corrosion damage. The cross-section demonstrated the invasive nature of the intergranular corrosion and how a network of fine sub-surface cracks is likely to have had metallurgical stress‑raising effect on the initiation of fatigue cracking within the spar (Figures A10 to A12).
Figure A9: Mapping out and measuring the corrosion damage on the underside surface of the carry-through
Table A2: Pit depth measurement from the underside of the carry-through indicated a range of corrosion damage with a maximum measured depth of 0.30mm
Corrosion Pit Depth Measurements
Corrosion Region #
Replicast #
Pit#
co-ord y
co-ord x
Pit Depth (mm)
1
1
E
13R
0.05
1
2
E
13R
0.04
1
3
E
13R
0.02
1
4
E
13R
0.02
2
1
A
13R
0.04
2
2
A
13R
0.03
3
1
A
10R
0.04
3
2
A
10R
0.04
4
1
D
4R
0.06
4
2
D
4R
0.06
5
1
D
4R
0.15
5
2
D
4R
0.17
5
3
D
4R
0.12
6
1
D
2R
0.21
6
2
D
2R
0.20
6
3
D
2R
0.30
6
4
D
2R
0.05
7
1
C
1L
0.04
7
2
C
1L
0.06
7
3
C
1L
0.03
8
1
D
2L
0.36
9
1
C
2L
0.36
10
1
A
4L
0.15
10
2
A
4L
0.05
10
3
A
4L
0.07
11
1
B
5L
0.03
Figure A10: Metallurgical cross-section through a region of pitting damage from the carry‑through spar
The corrosion has progressed from the underside surface. Intergranular corrosion has then developed within alloy surrounding the surface pits
Source: ATSB
Figure A11: Close-up images of some of the corrosion damage identified on the underside surface of the component
Source: ATSB
Figure A12: Depth map of a corrosion pit on the underside surface of the carry-through structure
Metallurgical characterisation
Hardness
Hardness measurements were conducted on suitably prepared sections through the fatigue‑fractured carry-through structure. Samples were destructively sectioned near the fatigue crack plane on the carry-through spar underside.
Transverse Brinell hardness measurements were completed through the bulk of the lower carry‑through structure. A through-hardness Vickers micro hardness traverse was also completed to assess for variability in mechanical properties. The results were then compared to the standard QQ-A-367 for 2014 in the T6 heat treatment. As measured, the average bulk Brinell hardness results were higher than the prescribed value from the aircraft manufacturer (Tables A2 to A4). The Vickers micro-hardness traverse identified no significant difference in the through‑hardness of the carry-through, which showed uniform hardness (strength) levels through the web. Though heat treated to be within the correct strength range, the higher results correlate with an increase in tensile strength for the forging than was specified.
Table A3: Physical properties of carry-through structure from VH-SUX
Tensile Strength (psi)
Tensile Strength (MPa)
Brinell Hardness (minimum)
QQ-A-367 specification
65,000
-
125
MIL HDBK 694A (1966)
62,000
-
150
ASM Metals Handbook
70,000
483
147
VH-SUX carry-through
70,742
488
147
Cessna specify the carry-through spar to be manufactured in accordance with QQ-A-367 (December 1973). The mechanical properties of the forged spar were higher than that specified by Cessna in US Federal Standard QQ-A-367
Material chemistry
Quantitative chemical analyses of metallurgical samples taken from the spar (Figure A13) was completed using Inductively Coupled Plasma-Optical Emission Spectroscopy. The results of the that testing are contained in Table A5 and are displayed as elemental weight percentage. The carry-through spar from VH-SUX was found to conform to the chemical composition for aluminium alloy 2014, as specified in QQ-A-367.
Figure A13: The section of carry-through structure adjacent the fracture plane removed for hardness testing and chemical characterization
Table A4: Quantitative analysis findings of the bulk alloy
Analysis confirmed the material to be within the range of QQ-A-367 for 2014 and was therefore manufactured from the specified alloy
Mechanical testing
Alloy sections from the carry-through were destructively sectioned and tensile samples machined and tested in accordance with ASTM E8[18] The results of those tests, presented in Table A6, indicated an average tensile of 70,742 psi, which exceeded the minimum strength requirements (65,000 psi) specified by Cessna in QQ-A-367.
Dimensional assessment
Measurements of the carry-through spar at the point of failure was conducted and compared with the Cessna engineering drawing, ‘Wing spar Assy Centre Section Cantilever’, Drawing Number 1210702, Sheet 3. The cross-sectional measurements of the carry-through spar from VH-SUX were found to meet or exceed the drawing requirements.
Table A5: Mechanical test results of tensile coupons machined from the upper and lower carry-through spar from VH-SUX
Tensile test results
Method: ASTM E8 / E8M
Coupon diameter: 12 mm
Gauge length: 50 mm
Sample #
Max Force (lbf)
Ultimate Tensile Strength (psi)
0.2 per cent Proof Stress (psi)
Elongation (per cent)
Upper Spar sample 1
13,563
71,325
65,267
10
Upper Spar
Sample 2
13,536
71,188
65,267
10
Lower Spar
Sample 1
13,322
70,072
64,542
10
Lower Spar
Sample 2
13,383
70,385
65,267
10
QQ-A-367 2024-T6
-
56,000 (minimum)
56,000 (minimum)
4 (minimum)
Appendix B – In-flight fatigue load data gathering
Setup and Analysis of VH-JEI Survey Data
An Invensense MPU-6000 6 axis motion tracking surface mounted integrated circuit module (Figure B1) was installed in another Cessna 210, VH‑JEI. Three axis linear acceleration data was added to the channels being recorded by the survey computer.
Figure B1: Invensense MPU-6000
Source: Aircraft operator, modified by the ATSB
The module was hard mounted in the existing survey computer rack, behind the pilot seats. The module was positioned close to the aircraft centreline, high in the rack and longitudinally close to the rear spar (Figure B2 and B3). This positioned the module close to the aircraft centre of gravity to minimise sensing of rotational accelerations.
Figure B2: The mounting location of the accelerometer within the survey equipment racks
Source: Textron Aviation, modified by the ATSB
Figure B3: Accelerometer mounted within the survey equipment rack
The survey equipment rack has been moved forward to the pilot seat location for access.
Source: Aircraft operator
Methodology
Spectra for any flight or taxi load in the aircraft is presented in a tabular and graphical format in such a way as to provide data in a normalised form. Thus, absolute acceleration data collected relative to a time base needs processing and conversion to a cumulative frequency based on distance. A large portion of sampling utilised to generate the United States Federal Aviation Administration guidance material was conducted using analogue processes which involved time consuming review to categorise. Thus, categories tended to be bigger but later digital methods used by United States National Aeronautics and Space Administration in the 1990s separated events into 0.05g blocks. This was the method used for the ATSB analysis.
As normal non-manoeuvring cruise flight in still air has an aircraft reacting to a 1g acceleration (gravity), and can be considered the static load, the fatigue calculations related to flight loads are measured around this state. Variations above and below 1g were recorded and categorised. For gusts, these are referred to as a positive (up) and negative (down) gusts. For manoeuvre, they are referred to as pitch up and pitch down manoeuvres. These variations/events were assessed for peak ‘g’ whether they be above or below ‘1g’. A tolerance was applied to cater for data noise and returning to the static condition. An event was not considered to have occurred and finished until the aircraft acceleration passed and then returned to either 1.05g or 0.95g. The peak over that event was counted as either a manoeuvre or gust depending on the length of the event and placed into the relevant 0.05g wide block. The data was turned into cumulative tables/graphs from each extreme of positive and negative or pitch up and pitch down events.
Once the data review was complete, the blocks for that aircraft were normalised into the form of an acceleration fraction. An acceleration fraction of +1 equates to either the maximum positive manoeuvre limit or maximum positive gust limit. An acceleration fraction of -1 equates to either the maximum negative manoeuvre limit or maximum negative gust limit. An acceleration fraction of zero is equal to ‘1g’. Thus, for different aircraft, the 0.05g block will be scaled differently depending on the aircraft’s manoeuvre and gust design limits. In fact, scaling can be different for positive and negative sides of the graph. For the Cessna 210, the design gust limits are -1.4g to 3.4g. Manoeuvre limits are -1.5g to +3.8g.
While the trigger for an event was 1.05g/0.95g and data blocks were recorded down to these, the data is only presented from 1.4g/0.6g. This equates to an acceleration fraction of approximately ±0.16. In the past, data was presented down to 1.4g/0.6g or 1.3g/0.7g due to the limitations of analogue recording and the excessive manpower to process it. Due to the cumulative nature of the data presentation, most events occur close to 1g. While data could have been shown down to 1.05g/0.95g, it is presented to 1.4g/0.6g for consistency and comparative purposes.
The data from the survey computer was processed by proprietary programs. The resulting files contained over 50 channels of data at a 20 Hz sampling rate and contained all or part of a flight.
Data verification
Qualitative assessment of the output revealed a smooth signal electrically. Figure B4 presents a sample coinciding with the aircraft taxying to a stop while simultaneously shutting down the engine. The rigid mounting of the accelerometer produced good sensing of the vehicle accelerations. Additional filtering or conditioning of the data was deemed not to be required. The assessment of signal post-processing during development was that peaks, particularly for gusts, were being retarded significantly and it was felt a non-processed output provided more accurate results. Mechanical airframe vibrations can be seen below, including the engine shutdown, but this accurately represented the movement in the vehicle.
Due to travel restrictions,[19] there was limited opportunity to calibrate the sensors. The operator’s surveying procedure did involve a calibration and zeroing procedure of their sensors during start‑up. Again, qualitative assessment of the data revealed some drift on start-up, however it was assumed that a warmup period was required. Assessment of the shutdown period revealed the z axis sensor could be seen to be returning 1.00g±0.01g. It was therefore deemed to be correctly orientated and zeroed. Assuming correct zeroing of the sensor, the specifications state a 3 per cent maximum error. This put the absolute error of the measured data at the aircraft’s flight load limits at no more than one 0.05g block. Additionally, most measured data was within 1g of static putting the maximum error within half a 0.05g block.
A variation to the script was written to check correct detection and categorisation of peak values. A sample 20 seconds of the output file is presented in Figure B5 over the top of the raw data. It shows peaks were being correctly identified.
Figure B4: Graphical representation of accelerometer data captured during aircraft shutdown
Source: ATSB
Figure B5: Graphical representation of scatter plot data
Source: ATSB
Accelerometer specifications
Source: Accelerometer manufacturer
Appendix C – Maintenance inspection details
Supplemental Inspection 53-11-01
Wing spar carry-through corrosion inspection
The manufacturer directed supplemental inspection 53-11-01 which included the following requirements:
Inspection compliance
Inspection compliance for severe corrosion environment (IAW section 2A-30-01), initial inspection 10 years with a repeat inspection every 3 years.
Purpose
To ensure the integrity of the main spar carry-through structure.
Inspection instructions
Obtain access to the upper portion of the main spar carry-thru bulkhead. Refer to the applicable Model 210 Service Manual.
Clean areas before inspecting if grime or debris are present.
Inspect for corrosion on the carry-thru spar. Refer to Figure [6]. Pay particular attention to locations where support wires in the air ducts or upholstery pads contact the spar.
Inspect for corrosion at the wing attachment lugs and carry-thru spar attachment area.
Inspection method
Visual.
Repair/Modification
Replace or repair damaged root rib or carry-thru spar. Carefully remove corrosion, removing minimum material. Contact Cessna Customer Service for evaluation of corrosion damage.
Note, the inspection stipulates that no identified cracks are allowable.
Table C1 details the three times the inspection was carried out when the aircraft was on the Australian register. The last inspection was conducted about 18 months and 1,746.4 flight hours before the accident.
Table C1: Special inspection SID 53-11-01 conducted on VH-SUX
Date
Flight hours
Results
26 June 2013
5,933.8
Nil defects found
8 Nov 2016
9,088.2
Nil corrosion or defects evident
10 Nov 2017
10,428.5
Nil defects
Airworthiness Directive AD/C210/61 Amendment 2
Inspection of the wing spar carry-through for corrosion
This Civil Aviation Safety Authority (CASA)‑specific airworthiness directive mandated an inspection of the carry-through structure initially at a time when a mandatory inspection of the area did not exist if CASA maintenance schedule 5 was being utilised.
The original issue of this airworthiness directive became effective on 20 April 1989 as follows:
Applicability: All models with cantilever (unstrutted) wings.
Requirement: 1. Gain access to the upper and underside surfaces of the wing carry-through forging.
Requirement: 2. Inspect the whole wing carry-through forging for any indications of corrosion. Repairs to the wing carry-through forging shall be in accordance with a scheme approved by the Authority.
Compliance: For the initial inspection, upon accumulating 10 years’ time in service since manufacture. Thereafter at intervals not to exceed 6 years, or, if the spar carry-through has been subjected to an approved corrosion protection scheme, at intervals not to exceed 12 years.
Background: There have been reports of corrosion in the wing spar carry-through forging on a number of aircraft. In two cases the corrosion was sufficiently advanced to adversely affect the structural integrity of the wing.
Table C2 identifies that the last inspection was conducted six weeks and about 200 flight hours after it had previously been inspected under the previously mentioned SID 53-11-01. This represented the last detailed inspection of the main spar carry-through structure inboard of the wing attachment lugs. The last inspection was conducted about 17 months and 1,530.2 flight hours before the accident.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 07/06/2019
What happened
At 1407 Eastern Standard Time[1] on 26 May 2019, a Cessna Aircraft Company 210M, registered VH-SUX and operated by Thomson Aviation, departed Mount Isa Airport for an aerial geological survey flight. There were two pilots on board, one operating the aircraft and the other observing the flight to familiarise himself with the survey area. The survey was to be conducted at a target height of about 200 ft above ground level along parallel east and west lines, spaced about 90 m apart.
The evidence indicated that about 1 hour and 40 minutes into the flight, as the aircraft tracked west along the sixth survey line, the right wing separated, resulting in a rapid loss of control and subsequent collision with terrain. The pilots were fatally injured and the aircraft was destroyed.
Wreckage and site information
The accident site was located about 25 km north-east of Mount Isa Airport in flat, arid scrub land (Figure 1). The wreckage trail was on an approximate east to west heading, in line with the expected survey flight path. The right wing was the first major component in the wreckage trail and was located about 130 m from the main wreckage. The aircraft impacted terrain about 90 m from the right wing, coming to rest a further 40 m away. All major aircraft components were accounted for at the site.
Figure 1: Accident site overview looking east
Source: ATSB
On-site examination of the wreckage indicated the right wing and part of the carry-through spar[2] had separated from the aircraft (Figure 2). Preliminary examination of the spar identified that it had fractured through an area of pre-existing fatigue cracking. The fracture was located inboard of the wing attachment lugs.
The carry-through structure was removed for detailed examination.
Figure 2: Right wing viewed from inboard end showing section of carry-through structure
Source: ATSB
Initial findings
Technical examination of the carry-through structure was conducted at the ATSB’s Canberra facilities. This examination confirmed that the fatigue cracking reduced the structural integrity of the carry‑through to the point where operational loads produced an overstress fracture of the remaining material. The fracture location was approximately 290 mm inboard of the right wing fuselage attachment lugs and coincident with a change in section thickness of the lower flange (Figures 3, 4 and 5). Characteristic features identified across the fracture surfaces confirmed that the fatigue cracking had initiated from the underside surface, growing across the lower flange and penetrating vertically into the structure.
Figure 3: The approximate location of fracture
Source: Cessna, modified by the ATSB
Figure 4: Carry-through structure, as received at the ATSB’s facilities
Source: ATSB
Figure 5: Close view of the outboard portion of the fracture surface (fatigue cracking has initiated on the underside surface)
Source: ATSB
Aircraft details
The Cessna Aircraft Company (Cessna) 210M is a high cantilever wing, piston-engine aircraft with a three-blade variable-pitch propeller and retractable tricycle landing gear (Figure 6). The aircraft is normally fitted with six seats. The accident aircraft (serial number 21061042) was manufactured in the United States in 1976 where it operated until 2013. It was imported to Australia and registered as VH-SUX in June 2013. At that time, the aircraft was modified for geological survey work, which included the removal of the passenger seats and the installation of specialised equipment.
Figure 6: VH-SUX
Source: Operator
The aircraft also had Supplemental Type Certificates for the installation of integral wing tip fuel tanks and a non-standard engine and propeller installation.
VH-SUX accumulated about 6,000 flight hours in the 6 years it was on the Australian register. It was operated exclusively as a geological survey aircraft during that time. The aircraft had 12,174 flight hours total time in service at the time of the accident.
Operation
The flight was one of a number of flights undertaken for the purpose of a geological survey to the north and north-east of Mount Isa.
The survey was conducted in a grid pattern, with closely spaced east and west lines along with more widely spaced north and south lines flown for data verification purposes. The flight profile closely followed the topography of the survey area at a speed of about 140-150 kt with procedure turns flown at each end of a survey line.
Each flight typically lasted for about 5 hours with multiple flights required to complete each survey. Two flights were normally flown each day in accordance with allowable environmental and daylight conditions, each flight on a given day being operated by a different pilot.
The aircraft typically departed with full fuel, resulting in it operating at close to the maximum allowable take-off weight.
Safety action
On 31 May 2019, the ATSB notified the Civil Aviation Safety Authority, the US National Transportation Safety Board, the aircraft manufacturer and operator of the initial finding of fatigue cracking within the wing spar carry-through structure.
The ATSB is working closely with those organisations to ensure the continued safe operation of the aircraft type.
Further investigation
The investigation is continuing and will include:
a metallurgical examination of the wing carry-through structure and associated parts
further examination and assessment of the aircraft wreckage
examination of the maintenance procedures and inspections associated with the wing spar carry-through structure
factors that may have contributed to the development of fatigue cracking
the operational history of the aircraft from 1976 until 2013.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this update. As such, no analysis or findings are included.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
The ATSB has assisted the Myanmar Accident Investigation Bureau’s investigation of a collision with terrain involving Biman Bangladesh Airlines – DHC-8-402Q, registered S2-AGQ, Yangon-Mingaladon Airport, Myanmar on 8 May 2019.
The aircraft was operating on a flight from Shahjalal International Airport, Bangladesh to Mingaladon Airport, Myanmar. On board were six crew and 28 passengers. Weather at Yangon was reported as poor, due to the presence of a thunderstorm in the area. The aircraft collided with Runway 21 at Yangon-Mingaladon Airport, Myanmar during the landing phase. The aircraft was destroyed and twenty occupants were reportedly injured.
The aircraft cockpit voice recorder (CVR) and flight data recorder (FDR) from S2-AGQ were brought to Australia by two senior Myanmar investigators on 10 June 2019. In the presence of the Myanmar investigators, both recorders were successfully downloaded on the 11 and 12 June 2019 at the ATSB data recovery facility in Canberra, Australian Capital Territory. In addition, the ATSB assisted the Myanmar investigation team with preliminary factual analysis of the recorded data. All data recovered from the CVR and FDR was provided to the Myanmar investigators to assist with their Annex 13 investigation.
The ATSB also assisted the Bangladesh Accredited Representative on 27 June 2019 with a replay of the CVR and review of the FDR data.
There are no ongoing actions for the ATSB at this stage. Any enquiries regarding the investigation should be addressed to the Myanmar Accident Investigation Bureau at the contact details listed below:
Myanmar Accident Investigation Bureau First Floor, DCA HQ Building (B) Yangon 11021, Myanmar Tel: 951 533162 Fax: 951 533016 Email: aungmaw23@gmail.com
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the ATSB to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation. This statement is published as a report in accordance with section 25 of the TSI Act, capturing information from the investigation up to the time of discontinuance.
The occurrence
On 14 May 2020 at about 0030 Western Standard Time,[1] an Airbus A330-203 aircraft registered VH-EBL, was operating as Qantas flight QF044, a scheduled passenger service between Sydney, Australia and Denpasar, Indonesia. While in the cruise at flight level 390[2] and abeam the Royal Australian Air Force Curtin aerodrome near the West Australian coast, the first officer’s primary flight, navigation and multipurpose control displays lost power and went blank. Accompanying this, the autopilot disconnected, the cockpit Master Warning light illuminated with an aural alert and multiple electronic centralised aircraft monitor (ECAM) messages presented on the engine/warning display.
The flight crew assumed manual aircraft control and worked to complete the appropriate response checklists and to better understand the issue. At 0038, the crew made a PAN[3] call to air traffic control (ATC) advising of the electrical problem and the possible need to divert. That decision was made at 0044 and the crew advised ATC that they would be diverting the aircraft to Broome – approximately 170 km from their position.
The flight crew reported that while some inoperative systems were restored during the diversion, other systems remained unavailable. All flight, navigation and multipurpose controls on the captain’s side of the flight deck remained functional throughout the flight. The approach to and landing on runway 10 at Broome was uneventful and the aircraft touched down at 0150.
Overview of the investigation
Following notification of the occurrence, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003, for the purposes of examining the electrical systems event and the flight crew’s response. Information was obtained from the aircraft manufacturer and operator, including formal technical and operational investigation reports from both Airbus and Qantas. ATSB investigators interviewed both flight crew and the information thus provided was correlated against the technical and operational reports.
In summary, based on information gathered during the investigation, it was found that the electrical systems event had originated within the aircraft’s number-two integrated drive generator (IDG) and generator control unit (GCU) systems. The event produced abnormal behaviours in related electrical systems which were not immediately or definitively indicative of an IDG or GCU fault – making the task of fault diagnosis difficult. Indeed, engineering staff examining the aircraft after arrival in Broome and following relocation under special authority to Brisbane, were unable to replicate the systems behaviour reported by the flight crew.
Reasons for the discontinuation
Following a review of the investigation and the information gathered, the ATSB has discontinued its investigation of this occurrence as a result of the following principal considerations:
The flight crew, despite receiving unclear information from the monitoring systems, recognised that the aircraft’s systems were significantly degraded and appropriately managed the risks by diverting to the nearest suitable airport.
The aircraft flight crew’s responses to the system failures during the diversion effectively managed the risks presented by the degraded aircraft systems.
The approach and landing at the diversion airport was appropriately managed and uneventful.
The operator and manufacturer’s combined investigations into the technical origins of the electrical systems event, while unable to conclusively identify root cause, did isolate the areas of likely contribution.
Both manufacturer and aircraft operator have undertaken proactive safety action in response to the technical failure areas of concern.
The operator has similarly assessed the operational and logistical issues arising from the use of Broome as a diversionary destination.
As such, the ATSB considered it was unlikely that further independent investigation would identify any systemic safety issues or important safety lessons.
The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.
